← Vetro Attest · Free Art. 12/14 checker · Free EU AI Act tools

Tamper-evident logs: hash chains and signatures, explained with one changed word

Take a log of an agent run. Change "Alice" to "Mallory" in one event: same length, still valid JSON. A diff of plain log files will not flag anything unusual, and neither will your log pipeline. The record now says something that did not happen.

A tamper-evident log is one where that edit is detectable. Not impossible: anyone with disk access can still write bytes. But anyone checking afterwards will see exactly which event was altered.

Hash chain: detects edits

Each event stores the hash of the event before it:

event 0: { ..., prev: null }          hash h0
event 1: { ..., prev: h0 }            hash h1
event 2: { ..., prev: h1 }            hash h2

Change one byte in event 1 and its hash no longer matches, and event 2's prev no longer matches either. Verification walks the chain and names the first broken link:

vetro verify → FAILED
  seq 1: hash mismatch: event content was altered

To forge a consistent chain an attacker has to recompute every hash after the edit, which is why a hash chain alone is not enough.

Signatures: prove who wrote it

Sign the chain with a private key held by the system that produced it (Vetro uses ed25519). Recomputing hashes is easy, producing a valid signature without the key is not. Anyone with the public key can verify the run without trusting you or your infrastructure.

Anchoring: catches truncation

A hash chain cannot tell you that the last ten events were deleted: a shorter chain is still a valid chain. The fix is to publish the chain head somewhere you do not control (a timestamping service, a third-party counter-signature, a public log). If the published head is not in the file, the tail was cut.

Limits worth saying out loud

• Honest writer at write time. A compromised process can log false events from the start; tamper evidence protects the record *after* it is written.
• Key custody. Whoever holds the signing key can sign a new history. Rotate keys and anchor externally.
• Not WORM storage. Tamper evidence and immutable storage solve different problems; see hash chain vs. WORM.

Try it

Vetro's browser demo flips one byte in a sample ledger and pinpoints the tampered event, entirely client-side. Vetro Attest runs the same verification on your own ledger or OpenTelemetry GenAI trace for free, and its paid report adds an independent ed25519 counter-signature: an external anchor for the run's chain head.

See a sample ledger verified in one click, check your own logs free or get the countersigned EU AI Act report.