An unbroken chain can still be wrong

Year 8 · 75 minutes · Provenance

Driving question

What does an intact record prove about a picture’s caption?

Conceptual explanation

A provenance chain records how content and metadata connect over time. This lab computes SHA-256 digests of supplied synthetic records, each including the previous digest. Editing an earlier record breaks downstream comparisons unless the chain is rebuilt. A hash detects changes relative to a trusted reference; it does not establish who signed a record or whether its caption is true. An entirely false caption can have a perfectly intact chain.

Learning intentions

Success criteria

Vocabulary

Teacher preparation

Prepare three synthetic caption-edit records. Confirm the browser supports Web Crypto in the local preview or HTTPS Site. Explain that this lab has no digital signatures or external trusted timestamp service.

Materials

Prerequisites and grouping

Explain the difference between evidence and a source claim. Useful earlier investigations: y6-sources Use pairs for investigation, with operator/reviewer swaps after each comparison. Keep individual predictions, journals and a short oral defence so group work does not hide understanding.

Curriculum connections

Australian Curriculum Version 9 · Digital Technologies: AC9TDI8P01, AC9TDI8P10. Selected aspects only. This activity contributes evidence; it does not cover the full descriptor or achievement standard. A programming descriptor is not claimed for merely moving controls. ACARA AI curriculum connection · V9 Technologies These are planning connections, not ACARA endorsement or exhaustive descriptor alignment.

Timed teaching sequence

0–10 min · Pass a record

Each group passes a paper caption through two edits and records the preceding version.

Ask: “What would you need to detect an unrecorded edit?”

Listen for: “A trusted copy or fingerprint of the earlier version.”

10–18 min · Predict a digest change

Predict which records become inconsistent if the first caption changes.

Ask: “Will only the first link be affected?”

Listen for: “Later links depend on the earlier digest too.”

18–40 min · Inspect the chain

Edit one record and compute digests. Compare stored previous-digest references with current values. Record the first broken link.

Ask: “Did the hash say the caption was false?”

Listen for: “No, it showed a mismatch with the referenced data.”

40–48 min · Hash a false caption

Build an intact chain around the supplied false caption and observe valid link checks.

Ask: “Can a consistent record preserve misinformation?”

Listen for: “Yes, integrity and truth are different.”

48–69 min · Design verification notes

Add a separate claim-check field with a source and uncertainty note. Identify which checks require human judgement or trusted identity outside this lab.

Ask: “What would a signature add that a plain hash does not?”

Listen for: “Evidence tied to a signing key, if that key is trusted.”

69–75 min · Present two cases

Submit one tampered chain and one intact-but-false chain.

Ask: “What exactly can you defend from these tests?”

Listen for: “Whether these records match, not whether their claims are true.”

Misconception to surface

An intact provenance chain makes content true.

Prediction

Edit the first record with later references fixed. Predict the first broken link and downstream effects.

Counterexample

A false caption hashes normally and can sit inside a fully consistent chain.

Redesign challenge

Pair integrity checks with a separately documented factual check and an explicit identity-trust limitation.

Discussion and reflection

Formative assessment

Ask whether an attacker can rebuild an unsigned chain. Require an explanation of the need for a trusted reference, not a claim that hashes make records unchangeable.

Differentiation

Use three short records and display abbreviated digests with full values available for inspection.

Extension

Specify a signed manifest design and explain key-compromise and timestamp limitations without implementing real identity claims.

Final artefact

A provenance audit contrasting tampering with an intact false claim.

Safety and data boundaries

No real people’s images or deceptive media are generated. Captions and records are supplied fiction; hashes are computed locally.

Hardware investigation

Audit large batches of synthetic provenance manifests and aggregate integrity versus semantic-check outcomes; hash operations remain on CPU while GPU tensor analysis examines failure patterns.

Lesson-specific rubric

Criterion Beginning Secure Extending
Integrity reasoning Treats a hash as a truth stamp Explains mismatch detection Explains rebuilding and trusted-reference limits
Verification design Relies on an intact chain alone Adds an independent claim check Separates integrity, identity and factual support

Curriculum and assessed evidence

Australian Curriculum Version 9 · Digital Technologies

References: AC9TDI8P01, AC9TDI8P10. Read the current source (checked 2026-09-07).

Evidence to assess: A provenance audit contrasting tampering with an intact false claim.

Selected aspects only. This activity contributes evidence; it does not cover the full descriptor or achievement standard. A programming descriptor is not claimed for merely moving controls. Moderate the supplied illustrative responses against your school unit and current achievement standard.

Choose a teaching schedule

These are planning estimates to test with your class. A short session develops one supported claim; it does not compress the whole senior project.

Stage 45 minute focus 60 minute investigation
Readiness and prediction 0–5 0–5
Trace the supplied example 5–13 5–15
Author and run cases 13–25 15–35
Counterexample and redesign 25–35 35–45
Explain and discuss 35–42 45–55
Export and handover 42–45 55–60

For a longer project, use three 50-minute sessions. Session 1 (0–50): readiness, model, hypothesis and initial cases. Export a project and record the next test. Session 2 (50–100): reopen, check settings, author counterexamples and revise the design. Export the changed project and identify unresolved evidence. Session 3 (100–150): independent peer test, final artefact, individual explanation and moderation. If using two 60-minute sessions, stop at minute 60 after saving the first comparison; use 60–120 for redesign, independent test and defence.

Readiness and access

Entry check: Explain the difference between evidence and a source claim. Ask the learner to demonstrate it before choosing the level of support.

Preparation: allow about 15 minutes to run the starter, print the cards and check a project can be reopened. This estimate has not yet been measured in a classroom pilot.

Read the entry question aloud, model one row, and label the units. Offer the case table as a large-print sheet. Keep mathematical derivations optional until the learner can explain the comparison.

For one device, use a projector: one pair predicts, one operates, and the class records on paper. Swap roles after the first comparison. For individual access, support keyboard controls and a written table equivalent to each visual. Learners may explain orally or with an annotated diagram. Never require personal data, a recorded voice, or a photograph.

Mixed readiness: if the entry check is difficult, use the linked prerequisite and the first two case cards; retain the same central question. If secure, ask the learner to design an unseen test and state which explanation it could disprove.

Supplied experiment and answer notes

Compare the supplied starting claim with the independently recorded trusted claim before examining a chain.

Starting parameters: The supplied cases define the inputs.

2 cases calculated from your supplied inputs. Compare the evidence with your prediction.

claim independent anchor matches still requires truth check
The fictional ticket costs eight. The fictional ticket costs eight. True True
The fictional ticket costs ten. The fictional ticket costs eight. False True

Illustrative responses and marking notes

These are authored examples, not work collected from children. Assess reasoning using the lesson rubric, not whether the first prediction was correct.

Beginning: “It worked because the result looks right.” This identifies no exact case, control or measurement. Ask the learner to point to one row and say what happened.

Developing: “In the first case I recorded claim: The fictional ticket costs eight.; independent anchor: The fictional ticket costs eight.; matches: True; still requires truth check: True.” This cites evidence, but does not yet explain how the result follows from the rule. Ask the learner to trace the relevant step.

Secure: “For the first supplied case, claim: The fictional ticket costs eight.; independent anchor: The fictional ticket costs eight.; matches: True; still requires truth check: True. I can trace it using this mechanism: Compare the supplied starting claim with the independently recorded trusted claim before examining a chain. My result supports a claim about these supplied cases. It does not establish that the same result holds outside them.” Look for an accurate trace, the actual settings and a bounded claim; accept equivalent oral or visual evidence.

Extending: The learner constructs and reruns a new case, reports whether the first explanation survives, and defends a revised design. Use this concrete challenge: Record a trusted starting digest separately. Compare content alteration, chain recomputation and an untrusted original claim. Require the original and changed evidence and this boundary: This comparison illustrates a trust anchor. It is not a digital signature or proof the trusted claim is true.

Moderation: first assess independently against each lesson criterion. Compare the exact trace or artefact that led to your judgement. Resolve differences using evidence, not polished language. Keep each learner's individual explanation even when the artefact was produced in a group.