brightlab.Made for curious mindsBrightlab
Year 8 · Provenance
What does an intact record prove about a picture’s caption?
Go to the investigation ↓A provenance audit contrasting tampering with an intact false claim.
What does an intact evidence chain actually establish?
A provenance chain records how content and metadata connect over time. This lab computes SHA-256 digests of supplied synthetic records, each including the previous digest. Editing an earlier record breaks downstream comparisons unless the chain is rebuilt. A hash detects changes relative to a trusted reference; it does not establish who signed a record or whether its caption is true. An entirely false caption can have a perfectly intact chain.
Before this lesson: Explain the difference between evidence and a source claim. Useful earlier investigations: A claim needs somewhere to stand.
A provenance chain records how content and metadata connect over time. This lab computes SHA-256 digests of supplied synthetic records, each including the previous digest. Editing an earlier record breaks downstream comparisons unless the chain is rebuilt. A hash detects changes relative to a trusted reference; it does not establish who signed a record or whether its caption is true. An entirely false caption can have a perfectly intact chain.
Explain the difference between evidence and a source claim. Useful earlier investigations: A claim needs somewhere to stand.
Prepare three synthetic caption-edit records. Confirm the browser supports Web Crypto in the local preview or HTTPS Site. Explain that this lab has no digital signatures or external trusted timestamp service.
ACARA V9 AI curriculum connection ↗ · Technologies ↗
A complete teaching sequence · 75 minutes
Each group passes a paper caption through two edits and records the preceding version.
Ask: “What would you need to detect an unrecorded edit?”
Listen for: “A trusted copy or fingerprint of the earlier version.”
Predict which records become inconsistent if the first caption changes.
Ask: “Will only the first link be affected?”
Listen for: “Later links depend on the earlier digest too.”
Edit one record and compute digests. Compare stored previous-digest references with current values. Record the first broken link.
Ask: “Did the hash say the caption was false?”
Listen for: “No, it showed a mismatch with the referenced data.”
Build an intact chain around the supplied false caption and observe valid link checks.
Ask: “Can a consistent record preserve misinformation?”
Listen for: “Yes, integrity and truth are different.”
Add a separate claim-check field with a source and uncertainty note. Identify which checks require human judgement or trusted identity outside this lab.
Ask: “What would a signature add that a plain hash does not?”
Listen for: “Evidence tied to a signing key, if that key is trusted.”
Submit one tampered chain and one intact-but-false chain.
Ask: “What exactly can you defend from these tests?”
Listen for: “Whether these records match, not whether their claims are true.”
An intact provenance chain makes content true.
A false caption hashes normally and can sit inside a fully consistent chain.
Pair integrity checks with a separately documented factual check and an explicit identity-trust limitation.
Ask whether an attacker can rebuild an unsigned chain. Require an explanation of the need for a trusted reference, not a claim that hashes make records unchangeable.
| Criterion | Beginning | Secure | Extending |
|---|---|---|---|
| Integrity reasoning | Treats a hash as a truth stamp | Explains mismatch detection | Explains rebuilding and trusted-reference limits |
| Verification design | Relies on an intact chain alone | Adds an independent claim check | Separates integrity, identity and factual support |
Use three short records and display abbreviated digests with full values available for inspection.
Specify a signed manifest design and explain key-compromise and timestamp limitations without implementing real identity claims.
No real people’s images or deceptive media are generated. Captions and records are supplied fiction; hashes are computed locally.
Shared device? Turn remembering off. A project file lets you continue on another device.
Your browser is the laboratory
Edit the first record with later references fixed. Predict the first broken link and downstream effects.
Three caption/edit/publication records are chained with SHA-256(previous digest | record). A classroom snapshot stores their original digests. Edit only the first caption, leaving the trusted snapshot fixed.
The experiment opens after your prediction.
There is no penalty for being surprised.
Apple Silicon · PyTorch MPS
Audit large batches of synthetic provenance manifests and aggregate integrity versus semantic-check outcomes; hash operations remain on CPU while GPU tensor analysis examines failure patterns.
Students extend the experiment in teams, documenting parameters, outputs and limitations.
The bundle contains lesson-specific working code, a configuration file, a reactive notebook, a deterministic CPU check and hardware setup instructions. Acceleration is reported only after a tensor operation and result read-back succeed.
Download Mac Studio investigation ↓unzip y8-provenance-mac-pathway.zip -d y8-provenance-mac cd y8-provenance-mac bash setup-mac.sh source .venv/bin/activate python experiment.py --device mps --output results marimo edit notebook.py
CPU and available-device execution status is recorded in the downloaded README and validation report. DGX Spark execution requires that hardware; static validation alone does not establish GPU compatibility or performance. The browser lesson remains fully available without this extension.
NVIDIA DGX Spark · PyTorch CUDA
Audit large batches of synthetic provenance manifests and aggregate integrity versus semantic-check outcomes; hash operations remain on CPU while GPU tensor analysis examines failure patterns.
Students extend the experiment in teams, documenting parameters, outputs and limitations.
The bundle contains lesson-specific working code, a configuration file, a reactive notebook, a deterministic CPU check and hardware setup instructions. Acceleration is reported only after a tensor operation and result read-back succeed.
Download DGX Spark investigation ↓unzip y8-provenance-dgx-pathway.zip -d y8-provenance-dgx cd y8-provenance-dgx bash run-dgx.sh # Open the localhost notebook URL printed by the container.
CPU and available-device execution status is recorded in the downloaded README and validation report. DGX Spark execution requires that hardware; static validation alone does not establish GPU compatibility or performance. The browser lesson remains fully available without this extension.
A provenance audit contrasting tampering with an intact false claim.
Download the editable handout →