{"id":"51bbf8f0-94e5-468e-a570-de3dacc64958","arxiv_id":"2608.02329","paper_version":1,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"A vision paper defining four traceability dimensions for AI-generated code and proposing post-hoc attribution methods (LEA, GEA) to make provenance explainable.","lead":"This paper is a research roadmap for 'explainable provenance' of AI-generated code: automatically tracing generated code back to the prompts, training data, and model internals that shaped it. It argues that current tools only flag bad code without explaining why it was generated, and that the next generation of code assistants must embed this traceability for developers, compliance teams, and courts.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The central 'must' claim rests on unvalidated feasibility of post-hoc instance-to-output provenance; the paper's own admissions on membership inference and missing ground truth leave this unproven.","rationale":"The reader's weakest assumption correctly identifies the technical achievability of post-hoc provenance, particularly instance-to-output and model-component-to-output links, as the load-bearing premise. My stress test agrees: the paper's own Sec. IV admissions about membership inference, inaccessible training data, and missing ground truth show that this premise is unvalidated. The concrete test I propose—a controlled benchmark with known training data and generated outputs—would provide direct evidence on whether the proposed pipeline can actually attribute outputs to specific training instances. Such evidence is needed before the vision can be accepted as a practical foundation. Since this concern does not change the reader's conditional verdict (the paper is a research vision, not a claimed result), the verdict remains CONDITIONAL, and I mark it UNCHANGED.","tokens_in":8893,"tokens_out":4143,"duration_ms":36928,"concrete_test":"Build a controlled provenance benchmark: train or fine-tune a small code-generation model on a corpus containing a known set of 'source' snippets, then generate outputs from prompts designed to elicit those snippets. Run the proposed provenance pipeline—clone/neural retrieval for candidate sources, membership inference using the model's logits, and a GEA-style causal analysis on corpus-level factors—and measure whether the true source snippet is ranked first (or within top-k) at a rate significantly above a retrieval-only baseline. If instance-level attribution does not substantially exceed this baseline, the central feasibility premise is falsified.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central claim is that the next generation of CodeGenAI tools must be built on automated, post-hoc explainable provenance spanning four dimensions. For that 'must' to be actionable, the proposed techniques must be able to deliver trustworthy attribution from model outputs alone. The weakest link is the instance-to-output dimension: the paper itself concedes (Sec. IV) that membership inference provides only 'statistical evidence rather than definitive attribution,' that proprietary training data are inaccessible, and that 'ground truth is difficult to obtain.' These are not minor caveats; they directly undermine the feasibility of the attribution task. If membership inference cannot definitively link an output to a training instance, and if no ground truth exists to evaluate the pipeline, then the research program cannot currently demonstrate that its proposed retrieval-plus-membership-inference approach yields reliable provenance. Similarly, the GEA causal framework assumes that do-calculus can identify average treatment effects from observational training data despite unobserved confounders; the paper acknowledges this risk but offers no validation. Without a controlled demonstration that instance-level attribution can exceed chance (or near-duplicate retrieval), the central premise of the vision remains an act of faith rather than an evidence-based requirement.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This is a position/vision paper arguing that next-generation AI code-generation tools must provide automated, post-hoc explainable provenance linking generated code to prompt components, training-data instances, global data features, and internal model components. The authors ground the vision in their prior survey and interview studies of developers, model users, and compliance/legal professionals; propose a research program combining stakeholder taxonomies with technical building blocks (propensity scoring, LEA, retrieval plus membership inference, GEA causal analysis, activation patching); and close with a candid list of open challenges including training-data inaccessibility, confounding, and missing ground truth. No new empirical data, systems, or formal results are presented; the contribution is a synthesized research agenda.","tokens_in":9177,"tokens_out":2437,"duration_ms":26465,"significance":"If the proposed program succeeds, it would give developers, organizations, and regulators a principled way to answer 'why did this generated code come out this way?' — a question that current filtering, citation, and similarity tools do not answer. The paper's strengths are its clear four-dimension taxonomy, its grounding in previously published stakeholder studies, and its unusually honest discussion of the feasibility gaps in Sec. IV. It also names concrete technical building blocks rather than stopping at motivation. However, the central claim is a normative and empirical 'must,' while the evidence supplied is not yet sufficient to show that the required instance- and model-component-level traceability is achievable at usable fidelity. The paper is best read as a well-structured research proposal, not as a demonstrated solution.","major_comments":[{"comment":"The load-bearing premise is that post-hoc instance-to-output traceability is technically achievable. The paper's own Sec. IV concedes that membership inference provides only 'statistical evidence rather than definitive attribution,' that proprietary training data are inaccessible, and that 'ground truth is difficult to obtain.' These admissions directly undercut the abstract's 'must' claim: if instance-level attribution cannot be validated above chance or near-duplicate retrieval, the central vision remains an untested hypothesis. Please add either a concrete feasibility argument, a pilot demonstration, or an explicit reframing of the four-dimension provenance claim as an open research question with defined success criteria.","section":"Sec. III-B / Sec. IV"},{"comment":"The GEA framework assumes that do-calculus and standard adjustment can estimate average treatment effects of training-data factors on model outputs from observational data. The paper acknowledges that 'causal graphs constructed from domain knowledge may miss important confounders,' but it does not specify how GEA will address this in the proposed research program. A plan for sensitivity analysis, causal discovery from data, or controlled simulation is needed to make GEA more than a plausible metaphor. Without such a plan, the 'causal' attribution promised by GEA is not yet defensible.","section":"Sec. III-B (GEA) / Sec. IV"},{"comment":"The normative claim that 'the next generation of CodeGenAI tools must be built on a foundation of explainable provenance' is supported by stakeholder surveys and by SBOM-related regulations. However, EO 14028 and the EU CRA mandate SBOMs for software components, not specifically the four-dimension post-hoc provenance defined in this paper. The jump from 'stakeholders need provenance information' to 'tools must be built on explainable provenance' should be argued more carefully: either identify a regulatory or market mechanism that demands all four dimensions, or soften the conclusion to a research hypothesis. As written, the abstract overstates the strength of the external grounding.","section":"Sec. I / Sec. II"}],"minor_comments":[{"comment":"The figures are referenced in the text but not included in the manuscript body; please ensure they are embedded and legible, especially the LEA workflow and the GEA causal graph, since the text relies on them.","section":"Figs. 1-3"},{"comment":"The paper's empirical grounding is taken entirely from the authors' prior studies. This is acceptable for a vision paper, but the text should state this explicitly in Sec. II and avoid the impression of a new meta-analysis.","section":"Sec. II / Sec. III-A"},{"comment":"The phrase 'the copyright law does not operate' is awkward; consider 'copyright law does not operate' or 'copyright doctrine does not operate.'","section":"Sec. IV"},{"comment":"The terms 'CodeGenAI supply chain' and 'AI supply chain' are used interchangeably; define one term and use it consistently.","section":"Sec. I"}],"recommendation":"major_revision","confidential_remarks":"This is a grant-funded position statement. Its contribution is agenda-setting rather than a technical result, and it should be evaluated as such. The main risk is that the 'must' language in the abstract oversells a vision whose core feasibility is explicitly admitted to be open. I would encourage the editor to require the authors to reframe the central claim as a research hypothesis or to provide a proof-of-concept, and to ensure the paper is not read as claiming validated capabilities."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"First, the key thing to know: this is a vision/position paper, not a new result. It argues that AI-generated code needs automated, post-hoc provenance across four traceability dimensions—prompt, training instance, global data factor, and internal model component—and it proposes a research program (LEA, GEA, activation patching, etc.) to get there. If you read it expecting empirical validation or a novel technique, you'll be disappointed. If you read it as a well-organized call to action, it does its job.\n\nWhat's actually good: the four-dimension taxonomy is a genuinely useful organizing frame. Naming the gap as a multi-level explanation problem, rather than just \"attribution\" or \"interpretability,\" is a real synthesis. The paper is also refreshingly candid: it lists the hard problems—proprietary training data, weak membership inference, missing ground truth, confounded causal estimates—and explicitly says these are open. That intellectual honesty deserves credit.\n\nThe soft spots are equally clear. The load-bearing premise is that post-hoc traceability can achieve sufficient fidelity on the instance-to-output and component-to-output dimensions. The paper provides no controlled demonstration that this is feasible; it offers a pipeline and a hope. Its own Sec. IV concedes that membership inference gives only statistical evidence, not definitive attribution. That's not a hidden flaw—it's a stated limitation—but it means the \"must\" in \"next generation must be built on explainable provenance\" is a normative preference, not an evidence-backed requirement. The empirical grounding, such as the 89.7% usage statistic, comes largely from the authors' own prior surveys, which is fine but leaves the motivation somewhat self-referential. And the paper gives little attention to training-time or intrinsic approaches beyond a dismissive paragraph, so the argument that post-hoc is the only viable route is not fully developed.\n\nWho should read this: anyone working on provenance, SBOMs, or responsible AI for software. It's a good framing paper for a reading group, and it deserves a serious referee—but as a vision paper, not as a technical contribution. The right peer-review outcome is conditional acceptance if the venue publishes position pieces, with the expectation that the technical claims remain untested. I'd cite the taxonomy in future work, but I wouldn't build on the LEA/GEA specifics until they've been evaluated.\n\nRecommendation: send it to review, but tell the authors the paper should be judged on its framing and roadmap, not on demonstrated capability.","headline":"A clear, honest research-vision paper with a useful four-dimension taxonomy; its central premise—that post-hoc instance-to-output provenance can be made reliable—is unproven, but the paper openly says so and does not overclaim results.","tokens_in":9640,"tokens_out":1877,"would_cite":true,"duration_ms":18979,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"AI-generated code must be built on explainable provenance—automated post-hoc traceability to prompt components, training instances, training-data factors, and internal model components—or it will remain opaque to the developers, organizatio","keywords":["explainable provenance","AI-generated code","traceability","code generation","interpretability","membership inference","software compliance","causal attribution"],"falsifier":"Run a controlled study where a large closed model is prompted with a verbatim snippet from a known open-source file, then apply the proposed membership-inference and retrieval pipeline: if instance-level attribution performs at chance while similarity search retrieves unrelated code, the post-hoc program's central premise fails. On the causal side, train an open-weights model on synthetic data with known compositional characteristics and check whether GEA's estimated treatment effects recover the planted relationships; failure to recover them would falsify the factor-level claim.","tokens_in":8814,"feed_emoji":"🧩","tokens_out":4301,"duration_ms":40149,"temperature":0.7,"pith_summary":"This paper is a research vision rather than a finished result. It argues that the next generation of AI code-generation tools must be built on a foundation of explainable provenance: automated, post-hoc traceability that links a generated snippet to the prompt parts, training examples, global data characteristics, and internal model components that caused it. Survey and interview evidence from developers, compliance professionals, and model developers shows that current tools leave a traceability gap that output filtering and source-citation features do not close. If the vision is correct, every AI coding assistant would need provenance tooling as a core feature, and the paper's four-dimension classification plus its proposed post-hoc techniques would be the template for building it. The authors frame the technical core as a program to be realized, not an accomplished technique.","feed_headline":"Four traceability links would open AI code's black box","feed_subtitle":"A vision ties generated code back to prompts, training data, global data factors, and internal model components.","key_machinery":"The central object is the four-dimensional provenance space: prompt-to-output, instance-to-output, factor-to-output, and model component-to-output traceability. The technical carriers are a suite of post-hoc techniques designed around this space: LEA (local explanation attribution using feature attribution such as SHAP to rank prompt tokens), propensity scoring on token log-probabilities, a retrieval pipeline combining clone detection, neural similarity, and membership inference attacks, GEA (global explanation attribution using causal graphs and average treatment effects for training-data factors), and module-level interpretability via functional modularization, sparse autoencoders, and act","core_discovery":"The paper's central claim is that transparency for AI-generated code cannot be achieved by flagging problematic outputs after the fact. Instead, next-generation CodeGenAI tools must provide automated, post-hoc traceability along four causal dimensions: prompt-to-output (which prompt tokens caused a problematic generation), instance-to-output (which training or external code instances are associated with an output), factor-to-output (how global training-data characteristics shape output), and model component-to-output (which internal circuits or attention heads are responsible). The paper grounds this claim in empirical studies showing that developers, compliance professionals, and model deve","pith_inferences":["The paper stops short of saying this, but its four-dimension taxonomy could be reused as a general evaluation schema for any transparency technique in AI code generation, independent of the specific tools proposed.","A testable implication of the vision is that provenance fidelity will correlate with model openness: if membership inference and causal proxies hit a ceiling for closed models, organizations may be pushed toward open-weight deployment or contractual data disclosure to meet compliance obligations.","The paper's own legal caveat implies that even perfect technical provenance may not translate into copyright evidence without new legal frameworks; future work may need to define evidentiary standards for similarity scores and membership probabilities.","The emphasis on post-hoc techniques suggests a viable near-term research path: rather than trying to inspect training pipelines, the community can build provenance tools on outputs and logits alone, but the ceiling of that path is the key empirical question the program must answer."],"forward_implications":["If provenance becomes a foundation, CodeGenAI tools will expose which prompt tokens caused a bad output, letting developers refine prompts instead of blindly discarding generated code.","Instance-to-output traceability would give compliance teams an automated way to assess license and copyright risk, replacing manual GitHub and Stack Overflow searches.","GEA-style causal analysis would let model builders see how training-data composition—such as the share of restrictively licensed code—shifts output quality, guiding data curation priorities.","Model component-to-output traceability is offered only for open-weight models, creating a transparency asymmetry unless black-box proxies improve for proprietary models.","Because ground truth is scarce, the paper calls for constructing controlled evaluation benchmarks that simulate realistic provenance scenarios with known causal relationships.","The four-dimension taxonomy could become a checklist for future provenance requirements, including SBOM-style lineage for AI-generated artifacts."],"fun_headline_variants":["Why AI wrote that code: four traceability links","Four causal links to explain AI code generation","AI code transparency: four traceability dimensions","Trace AI code to its causal roots: four links","Make AI code explainable: link it to its causes"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The vision presupposes that a model's outputs and logits carry enough recoverable signal to attribute a generation to specific training instances and internal circuits after the fact—especially for large, closed models whose training data is hidden—an empirical premise the paper itself flags as unvalidated.","fun_headline_variants_meta":{"raw":{"variants":["Why AI wrote that code: four traceability links","Four causal links to explain AI code generation","AI code transparency: four traceability dimensions","Trace AI code to its causal roots: four links","Make AI code explainable: link it to its causes"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00137,"raw_usage":{"total_tokens":5371,"prompt_tokens":706,"completion_tokens":4665,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":450,"completion_tokens_details":{"reasoning_tokens":4606}},"tokens_in":450,"tokens_out":4665,"duration_ms":27654,"temperature":1.0,"reasoning_tokens":4606,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-04T09:12:01.008294+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run a controlled study where a large closed model is prompted with a verbatim snippet from a known open-source file, then apply the proposed membership-inference and retrieval pipeline: if instance-level attribution performs at chance while similarity search retrieves unrelated code, the post-hoc program's central premise fails. On the causal side, train an open-weights model on synthetic data with known compositional characteristics and check whether GEA's estimated treatment effects recover the planted relationships; failure to recover them would falsify the factor-level claim.","supporting_citations":[],"review_version":1}