Tamper-evident AI logs, and the question the phrase hides

Three common designs get called tamper-evident:

• Append-only databases. Writes add rows; updates are discouraged by convention or permissions.
• Hash chains. Each entry includes the hash of the previous one, so edits break the chain.
• WORM storage. Write-once media or object locks prevent modification for a retention period.

Each genuinely raises the cost of tampering. None of them, by itself, answers the question a sceptical outsider asks.

Evident to whom

An append-only table is append-only because the operator configured it that way, and the operator can reconfigure it. A hash chain detects edits to earlier entries, but the chain itself can be recomputed end to end by whoever holds the data, unless some external party has already seen its state. WORM locks expire, and the account holder sets the terms.

The common flaw is that the detection mechanism and the data both sit inside the same trust boundary. Tamper-evidence within your own perimeter is an internal control. It is valuable, and it is not evidence to anyone else.

The test

For any system claiming tamper-evidence, ask three questions:

• Can someone outside the organisation detect a change, using only public information?
• Is the record's time established by a party with no stake in the record?
• Does verification work if the organisation declines to cooperate?

If the answer to any is no, the property is internal integrity rather than external evidence. That may be exactly what you need. It is worth knowing which one you bought.

What external tamper-evidence requires

Two ingredients: a signature made with a key the application itself does not hold, and publication of the record's fingerprint to infrastructure the organisation does not operate. Rubric does both, signing with ML-DSA-65 and anchoring to the Hedera Consensus Service, a public ledger with an independent governing council.

Hash chains are still useful

None of this argues against internal hash chaining, which remains a cheap and effective integrity control for high-volume data. The productive combination is chaining internally for everything and anchoring externally for the records whose truth may one day be contested by someone who does not trust you.