📄 other

Blockchain Anchoring of Electronic Evidence: Verifiable Integrity and the Limits of Legal Authentication

This article argues that while blockchain anchoring provides robust proof of post-capture continuity for electronic evidence, it cannot verify pre-capture truthfulness or authorship, necessitating a six-layer legal test and a specific protocol to establish a rebuttable presumption of continuity rather than absolute factual authenticity.

Original authors: Peizhen Yuan

Published 2026-09-25

📖 7 min read🧠 Deep dive

CC BY 4.0

Original authors: Peizhen Yuan

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the modern courtroom, a piece of evidence is no longer just a physical object like a blood-stained shirt or a signed contract. It is often a digital file: a text message, a security camera video, or a voice recording. For decades, the legal system has learned how to admit these digital records, but a new challenge has emerged. We now live in an era where artificial intelligence can create images, voices, and videos that look and sound completely real, yet never happened. This creates a dangerous uncertainty. If a video of a crime can be faked perfectly, how can a judge or jury know if a real video is genuine? The core problem is no longer just about whether a file can be played in court, but about understanding exactly what that file represents and where it came from. The question has shifted from simple admission to a deeper inquiry into the truth of the record itself.

A new study by Peizhen Yuan, a legal scholar at the China University of Political Science and Law, tackles this problem by examining how blockchain technology is currently used to secure electronic evidence. Blockchain is often described as an unchangeable digital ledger, a system where once something is recorded, it cannot be altered. Many legal systems have begun using this technology to "anchor" evidence. The process involves taking a digital file, creating a unique digital fingerprint of it, and recording that fingerprint on the blockchain. The idea is that if anyone tries to change the file later, the fingerprint will no longer match the one on the chain, revealing the tampering. However, the study argues that this common belief is dangerously incomplete. While blockchain is excellent at proving that a file has not been changed after it was recorded, it cannot prove that the file was truthful or authentic before it was recorded. A criminal could create a fake video, generate its digital fingerprint, and record that fingerprint on the blockchain. The system would then prove that the fake video has not been altered, but it would not reveal that the video was a lie from the start.

To address this gap, the researcher proposes a new way of thinking about digital evidence that separates the idea of "continuity" from the idea of "truth." Continuity means the file you are looking at in court is the exact same file that was captured at the scene. Truth means the file actually shows what the person claiming it shows. The study demonstrates that blockchain is a powerful tool for proving continuity, but it is useless for proving truth on its own. To solve this, the author designs a detailed protocol that combines blockchain with other necessary steps. This protocol involves capturing the evidence from the original device, creating a secure digital fingerprint, and then keeping a detailed, signed log of every person who handles the file and every change made to it. This log is then anchored to the blockchain. The system was tested using a computer simulation where researchers tried to break it in six different ways, such as altering the file after recording, replacing the file's hidden data, or having two people working together to fake the history. The simulation showed that the protocol successfully detected almost all attempts to tamper with the file after it was captured. However, it also confirmed that the system could not detect a file that was fabricated before it was ever captured, nor could it prove who originally created the content if that person was not properly identified.

The study then translates these technical findings into a six-step legal test that courts in the United States, Germany, Japan, and China could use. The first step is provenance, which asks where the file came from and who touched it. The second is integrity, which asks if the file is the same one that was originally captured. The third is attribution, which asks who or what created the content. The fourth is process reliability, which examines whether the software or device used to make the evidence was working correctly. The fifth is semantic accuracy, which asks if the file actually supports the specific claim being made in court. The final step is lawful acquisition, ensuring the evidence was gathered legally. The author argues that courts should not treat a blockchain record as a magic seal of truth. Instead, they should view it as proof that the file has remained unchanged since it was anchored, while requiring other evidence to prove that the file was real and truthful before that moment.

This approach is designed to prevent two specific dangers. The first is the acceptance of a fake piece of evidence as real. The second is the "liar's dividend," a situation where a person accused of a crime can claim that a genuine, incriminating video is actually a fake because deepfakes exist. By requiring a layered investigation that looks at the source, the process, and the history of the file, the legal system can distinguish between a genuine recording and a synthetic one without demanding impossible levels of certainty. The study suggests that courts should adopt a standard rule where a blockchain record creates a presumption that the file has not been altered, but this presumption can be challenged if there are questions about how the file was created or who created it.

The research also highlights that different countries handle this issue in different ways. The United States relies on flexible rules that allow judges to decide case by case. Germany uses strict formal rules and digital signatures to ensure integrity. Japan focuses on the function of the record rather than its physical form. China has developed specific rules for internet courts that recognize blockchain preservation but still require proof of the source. Despite these differences, the study finds that all these systems are moving toward the same goal: establishing a credible connection between a record, its creator, and the fact it is meant to prove. The proposed framework does not promise a perfect detector that can spot every fake. Instead, it offers a structured way for courts to ask the right questions and for parties to provide the right answers. It asks lawyers to disclose exactly how a file was made and changed, and it asks judges to look at the whole picture rather than just the digital fingerprint.

In the end, the study concludes that the legal system must adapt to a world where digital records are created by both humans and machines. The solution is not to ban new technologies or to trust them blindly. It is to build a system of checks that separates the question of whether a file was changed from the question of whether it is true. By using blockchain to secure the history of a file while requiring other evidence to verify its origin and content, courts can maintain trust in the evidence process. This approach protects the rights of the accused while ensuring that genuine evidence is not discarded simply because it is digital. The work provides a clear path forward, suggesting that with the right combination of technology and legal procedure, the courts can navigate the complexities of the digital age without losing sight of the truth.

Technical Summary: Blockchain Anchoring of Electronic Evidence

1. Problem Statement

The central problem addressed is the legal and technical misconception that blockchain hash anchoring renders electronic evidence "immutable" and inherently truthful. While blockchain can effectively store file commitments and detect post-capture tampering, it cannot verify the truthfulness of the initial file capture, the authorization of the submitter, or pre-registration AI-driven manipulation.

The paper identifies a critical gap in current evidentiary frameworks: the conflation of continuity (the file presented is the same as the file captured) with truth (the file depicts the event as claimed). In a generative environment, this confusion creates two symmetrical risks:

False Admission: Fabricated content (e.g., deepfakes) is accepted as a record of reality.
False Exclusion (The "Liar's Dividend"): Genuine recordings are rejected or discounted because the mere existence of convincing fakes allows bad-faith actors to cast doubt on authentic evidence without providing specific proof of manipulation.

Current authentication architectures, designed before the era of generative AI, often lack clear mechanisms to allocate responsibility for determining audiovisual authenticity or to distinguish between machine reliability and human attribution.

2. Methodology

The paper employs a comparative legal analysis and a technical protocol design approach:

Comparative Legal Analysis: The study examines evidence rules across four jurisdictions—United States, Germany, Japan, and Mainland China. It analyzes how these systems handle electronic data, focusing on the convergence of principles (source connection, integrity protection, adversarial testing) and divergence in institutional allocation (party presentation vs. formal signatures vs. platform integration).
Technical Protocol Design: The author proposes a specific system architecture that separates the evidence payload from the verification record.
- Off-chain Storage: The actual evidence (payload) is stored in encrypted off-chain storage to protect privacy and trade secrets.
- On-chain Anchoring: The blockchain stores a compact commitment (hash), custody events, and a Merkle root.
- Cryptographic Mechanisms: The system utilizes SHA-256 hashing for file commitments, Merkle trees for batching multiple exhibits, and signed custody logs (using Ed25519 signatures) to track events (Capture, Transfer, Analysis, Export, Disclosure).
Threat Modeling: A synthetic threat model was constructed to test the protocol against six specific attack vectors:
- $T_1$ : Pre-capture fabrication (submitting a fake file honestly).
- $T_2$ : Post-capture alteration.
- $T_3$ : Metadata replacement.
- $T_4$ : Custody log erasure or reordering.
- $T_5$ : Private key compromise.
- $T_6$ : Custodian collusion.
Experimental Validation: The protocol was tested using 128 synthetic trials per scenario involving text, images, and audio. Metrics included detection rates, false acceptance rates, proof size, and verification time.

3. Key Contributions

A. The Six-Layer Legal Test

The paper advances a framework for "layered authenticity," arguing that courts must evaluate evidence across six distinct propositions rather than treating "authenticity" as a binary property. A cryptographic hash only supports the Integrity layer; it does not prove the others.

Provenance: Where the exhibit came from and its transformation history.
Integrity: Whether the presented file is materially the same as the captured file.
Attribution: Who or what generated the content (human vs. AI, operator vs. model).
Process Reliability: Whether the system producing the evidence functioned correctly and consistently.
Semantic Accuracy: Whether the exhibit supports the specific proposition it is offered to prove.
Lawful Acquisition: Whether the evidence was obtained and disclosed in compliance with procedural safeguards.

B. The Digital Evidence Provenance Package

The author proposes a standardized, six-component package for litigants to submit:

Original or best-available source image/file.
Cryptographic hashes and trusted timestamps.
Custody and access logs.
Transformation Ledger: A critical innovation identifying every edit, conversion, or model operation (distinguishing reversible from destructive changes).
System statement describing the capture/generation process.
Proposition statement specifying what the exhibit is offered to prove.

C. Clarification of Blockchain's Role

The paper demarcates the boundaries of blockchain technology in law:

What it does: Provides robust proof of post-capture continuity and integrity. It creates a tamper-evident sequence of custody events.
What it does not do: It cannot prove the truth of the committed statement, the authorization of the submitter, or the accuracy of the source device. A false file can be immutably hashed.
Legal Effect: Blockchain anchoring should create a rebuttable presumption of continuity, not a presumption of factual truth.

D. Model Rules and Institutional Design

The paper proposes specific model rules (Rules A–E) for AI-mediated evidence, including mandatory disclosure of material operations, foundations for admission based on contestability, and sanctions for withholding transformation histories. It also outlines institutional designs for pretrial procedures, court infrastructure (secure portals), and expert reproducibility standards.

4. Results

Technical Verification: The protocol successfully detected all instances of post-capture alteration ( $T_2$ ), metadata replacement ( $T_3$ ), and custody log tampering ( $T_4$ ) when events were independently signed and anchored.
Limitations Identified: The cryptographic verifier could not detect pre-capture fabrication ( $T_1$ ), nor could it prove that the initial source was truthful. It also could not prevent collusion ( $T_6$ ) or key breaches ( $T_5$ ) without additional governance controls (e.g., key rotation, revocation registries).
Performance: Verification proof size grows logarithmically with batch size (e.g., 128 bytes for 16 leaves), and median local verification time was approximately 0.37 milliseconds.
Legal Synthesis: The comparative analysis revealed that while institutional mechanisms differ (e.g., US flexible authentication vs. German formal signatures), all systems seek a credible connection between a record, its creator/process, and the fact to be proved. The proposed six-layer framework is portable across these legal families.

5. Significance and Claims

The paper claims three primary contributions:

Demarcating Boundaries: It clarifies that blockchain is an integrity infrastructure, not a "truth machine." It prevents the legal system from over-relying on cryptographic hashes to validate the semantic content of AI-generated media.
Expert-Testable Workflows: It supplies courts with a concrete, reproducible protocol (the Provenance Package and Transformation Ledger) that allows for meaningful adversarial testing of evidence layers.
Rebuttable-Presumption Rule: It establishes a legal standard where blockchain anchoring creates a rebuttable presumption of post-capture continuity only. This shifts the burden to the proponent to provide independent evidence for attribution and semantic accuracy, thereby mitigating the "liar's dividend" by refusing to let the mere possibility of fabrication invalidate all digital evidence.

The paper concludes that the solution to the challenges of generative AI is not a new category of "AI evidence" or rigid technology-specific presumptions, but a layered, proposition-specific framework that makes inferential steps visible and contestable. It argues that legal systems must distinguish between continuity and truth, and between machine reliability and semantic accuracy, to uphold functional equivalence in the digital age.