TACET — verifiable silence for AI training disclosure

Live log · Specification & Internet-Draft · PNX Action · Whitepaper · LACUNA candidates · Canon

countersign — Witness protocol and home of TACET (verifiable map, epoch sheets, silence proofs), the PNX profile, the tacet-pnx CLI and the canon that every Crovia surface follows. Specification and Internet-Draft: croviatrust.com/registry/tacet/spec/.

Transparency logs prove that something was published. TACET is a transparency log whose product is the opposite: a portable, offline-verifiable proof that, for a given AI model, no training-data disclosure was found on its public surfaces in any of these hours — each hour opened by a public randomness beacon and closed by a Bitcoin block.

It runs in production. Every hour since 2026-09-19T18:00Z, Crovia's operator fetches the model cards of the systems under watch, runs a public predicate over the bytes, signs what it saw, commits the verdicts to one sparse Merkle map, and anchors the epoch in Bitcoin. When a lab stays silent, the silence stops being an opinion.

Verify a live proof in 30 seconds

In the browser, nothing to install, including the Bitcoin anchors: croviatrust.com/registry/seal/verify/?url=…Qwen__Qwen3-32B.seal.json — site/registry/seal/verify/tacet-verify.js + ots-verify.js are a second, independent implementation of SPEC §8.5–8.6 in plain JS on WebCrypto. With network checks on, the page parses every OpenTimestamps proof itself and compares its merkle root with the Bitcoin block header from a public explorer. No Bitcoin node, no ots client, no Crovia server trusted.

On the command line, same checks, pure Python, standard library only for the anchors:

pip install crovia-tacet-operator crovia-seal

curl -sO https://croviatrust.com/registry/data/tacet/proofs/Qwen__Qwen3-32B.seal.json
tacet-operator verify Qwen__Qwen3-32B.seal.json

{
 "ok": true,
 "seal_ok": true,
 "issuer_id": "urn:crovia:seal-issuer:tacet",
 "strength_verified": 2,
 "silence": { "map_epochs": 3, "observed_epochs": 3,
              "observed_from": "2026-09-19T18:00:00Z", "observed_to": "2026-09-19T21:00:00Z",
              "silence_seconds": 10800, "silence_days": "0.12" },
 "anchors": [
  "block 967736 merkle root a27c668a4d320942f8cb3906efbfefefaedda9d760d5d52bdb74f7a7e0f1a0d4 matches the proof",
  "block 967736 merkle root a27c668a4d320942f8cb3906efbfefefaedda9d760d5d52bdb74f7a7e0f1a0d4 matches the proof",
  "block 967740 merkle root a41b0f50275c48922c27d6335434b5afb91ddc4bb4f80e9d96edd1e9f3b16af7 matches the proof"
 ],
 "errors": [], "warnings": []
}

(Output from the first three hours of the log, all three confirmed in Bitcoin blocks 967736 and 967740. silence_days is truncated, never rounded: 10 800 s is 0.12.)

The verifier recomputes every map root from the empty tree, checks the chain of sheets, verifies the observer signature on every negative snapshot and its Merkle inclusion in the hour, and recomputes the silence figure — all from the file. The two time bounds are external facts: for each drand round it checks chain and schedule from the sheet and, over the network, that the round's bytes are what the drand relays serve (it does not verify the BLS signature itself); for each anchor it parses the OpenTimestamps proof and matches its merkle root to the Bitcoin block header. With --offline, or when a relay or explorer is unreachable, those items come back as named warnings, never as passes. Run a node? Pass your own header source to tacet.ots.verify_sheet_anchor; the explorer is only the default.

How an hour becomes evidence

   drand round r ─────▶  epoch e  ─────▶  Bitcoin block h
   (not before T₁)          │              (not after T₂)
                            │
      fetch card ──▶ predicate(bytes) ──▶ signed snapshot ──▶ snapshots_root
                                                  │
                                       slot(model) in sparse Merkle map
                                                  │
                     sheet = { root, prev_sheet_hash, beacon, snapshots_root }  ── signed, then OTS-anchored

A silence proof for one model over epochs [a, b] is the delta-encoded chain of non-inclusion paths for its slot, plus one negative snapshot per counted hour, wrapped in a crovia.seal.v1. Three strengths:

Monotonicity rule. silence_days is the sum of anchored epochs that hold a negative snapshot. Hours nobody looked, hours not yet in Bitcoin, and operator downtime add nothing. Silence cannot grow while observation is paused, and any verifier can recompute it from the proof alone.

What TACET does not say

Nothing about intent ("hid", "refused" never appear). Nothing about surfaces that were not listed. Nothing about hours in which nobody looked. Nothing about quality: the predicate is deliberately permissive — a datasets: tag counts as disclosure. A level-2 proof is a proof about what was served to the observer; level 3 (independent witnesses) is the next milestone.

Providers are protected too: a model can commit-then-reveal its training-data summary (SPEC §11). A committed slot can never yield a silence proof.

PNX — the same machine, pointed at agents (draft)

TACET proves what a public surface did not contain. PNX — Proof of Non-Exfiltration (tacet/PNX.md, profile crovia.pnx.v1) proves what an AI agent did not send out. An egress witness fingerprints every outbound body (salted 32-byte k-grams, winnowed with window 16), commits the fingerprints to the same sparse Merkle map and signs a run sheet; the operator then proves, per protected asset, non-inclusion against the run root. Any shared substring of 47 bytes or more is always detected; shorter assets are reported as partial or undetectable and never counted as clean. The run root is committed into a TACET epoch, so it inherits the drand opening and the Bitcoin closing.

The auditor sees neither the traffic nor the secrets and verifies offline:

from tacet import egress
from tacet.keys import SigningKey

w = egress.EgressWitness(run_id="ci-4711/agent-review")
w.ingest(request_body, "2026-09-19T22:00:03Z")            # for every outbound body
sheet = w.sheet(SigningKey.generate("witness-ci"), "2026-09-19T22:59:59Z")
proof = w.prove(sheet, [("openai_key", b"sk-live-..."), ("customers.csv", open("customers.csv","rb").read())])
egress.verify_pnx(proof, {"openai_key": b"sk-live-...", "customers.csv": ...}).verdict   # 'absent' | 'present' | 'mixed'

Status: reference + tests shipped; conformance vectors, browser verifier and a one-command tacet-egress proxy are next (see GROWTH.md).

Repository