{"id":"26c13347-da44-49c2-bde2-39224cb8e541","arxiv_id":"2608.03520","paper_version":1,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"A position paper arguing that investigator access should be the primary organizing axis for AI forensics, with a process model matrix, an order of volatility, and a research agenda.","lead":"This paper proposes organizing the investigation of AI incidents around how much of the system an investigator can access: white box (full internals), grey box (deployment logs and traces), or black box (inputs and outputs only). It maps these access levels onto four forensic phases and identifies missing capabilities, notably preserving evidence when only black box access is available.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The process-model matrix and volatility order are populated with LLM/agentic-specific content, so the access-first claim is not supported; system type appears to do the organizational work.","rationale":"The reader's CONDITIONAL verdict is based on the untested assumption that the access trichotomy is more decisive than system type. My concern sharpens this: the matrix's own content is system-type-specific, which is internal evidence that system type is not merely an annotation. This does not overturn the reader's verdict—the paper is still a useful position piece—but it strengthens the case for conditions: the claims about access primacy and the generality of the matrix need revision or empirical support. I partially agree with the reader's weakest_assumption because I focus on an internal inconsistency rather than the lack of empirical evaluation, though both point to the same fragility in the central claim.","tokens_in":11875,"tokens_out":5915,"duration_ms":70327,"concrete_test":"Use the paper's definitions to populate the grey-box and black-box cells of Table 1 for a non-LLM AI system (e.g., a tabular credit-scoring model or an image classifier). If the resulting cells require different primary artifacts, analysis methods, and volatility priorities than those listed (beyond simple annotation), then the matrix is not access-general and the access-first claim fails. Alternatively, code 20 published AI-incident forensics cases across system types and access levels and test which axis better predicts the forensic phases and methods used.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central claim (Section 3.1) is that investigator access—not system type—determines the forensic process. But the operational content of the matrix (Table 1) and the order of volatility (Section 5) are almost entirely drawn from the motivating agentic-LLM/RAG scenario. Grey-box collection lists prompts, RAG stores, and tool-call traces; grey-box analysis lists prompt-injection reconstruction and drift analysis; black-box analysis lists surrogate modeling and reanimation; the volatility order includes a 'context window' and 'RAG/vector store state.' For non-LLM AI systems—tabular classifiers, vision models, speech systems—these artifacts and techniques do not exist, and the relevant grey-box/black-box processes would be different (e.g., feature/service logs, prediction explanations, model extraction from a different API surface, different volatility ordering). Thus the matrix is not actually organized by access alone; it is organized around a particular system type, with access as a secondary label. The paper asserts that system type is 'an annotation rather than structure' (Section 3.3), but the structure itself is system-type-specific. If the matrix cannot be populated for other system types without changing the core cells, then system type is doing the organizational work, and the access-first thesis is unsupported—even before considering empirical validation.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a framework for post-incident forensic investigation of AI systems organized primarily by investigator access. It defines three access regimes—white box, grey box, and black box—based on the artifacts an investigator can obtain, and maps these onto a four-phase process model: collection, preservation, analysis, and reporting (Table 1). It introduces an order of volatility for AI evidence (Section 5), derives an access-conditioned examination workflow (Section 8), and identifies open problems such as black-box preservation, model version attestation, and uncertainty quantification for surrogate-based analysis. The motivating example of a financial advisory agent is carried through each phase to illustrate how the same incident is investigated differently across access levels. The paper explicitly positions itself as a position paper and research agenda rather than an empirically validated standard.","tokens_in":12126,"tokens_out":3331,"duration_ms":38129,"significance":"If the access-first thesis holds, the paper would provide a useful unifying axis for a fragmented literature spanning model forensics, agentic system investigations, provenance, and black-box extraction. The authors deserve credit for clearly defining the access regimes, constructing a concrete matrix that situates prior work, articulating an order of volatility with a sharp 'volatility–reachability inversion' insight, connecting the framework to the EU AI Act, and candidly flagging that the workflow has not been evaluated on real investigations. The framework is internally consistent and the definitions are transparent. However, the central organizing claim—that access, not system type, is the primary determinant of forensic process—is not actually established by the paper's operational content, because the matrix and volatility order are populated almost entirely from an LLM/agentic scenario.","major_comments":[{"comment":"The matrix's operational content is almost entirely drawn from the motivating agentic-LLM/RAG scenario: grey-box cells list prompts, RAG stores, and tool-call traces; black-box cells list surrogate modeling and reanimation; analysis cells mention prompt-injection reconstruction and drift analysis; the volatility order includes a 'context window' and 'RAG/vector store state.' For non-LLM AI systems—tabular classifiers, vision models, speech systems—these artifacts and techniques do not exist, and the corresponding grey-box/black-box processes would be different (e.g., feature/service logs, prediction explanations, a different API extraction surface, a different volatility ordering). Thus Table 1 does not demonstrate that access alone organizes the field; system type appears to do the organizational work. The authors need to either populate the matrix for at least one non-LLM system type t","section":"Section 4, Table 1 and Section 3.3"},{"comment":"The proposed order of volatility is presented as 'AI specific' and is used to 'dictate collection sequencing' for the whole discipline, yet items 1, 2, 6, and 7—accelerator memory, assembled context window, RAG/vector store state, and agent/tool-call traces—are artifacts of one system type. A tabular credit-scoring model or an image classifier has no context window, no KV cache, and no RAG store; its volatility ordering would look different, and the 'volatility–reachability inversion' would need to be re-derived. This reinforces the concern in my first comment: the paper's substantive content is system-type-specific even though the stated thesis is that access is the primary axis. A general order of volatility should be stated at the level of evidence classes (e.g., transient inference state, request/response logs, persistent model artifacts, training lineage) with system-type-specific i","section":"Section 5"},{"comment":"The paper states: 'It has not yet been evaluated across a corpus of real investigations, and some steps, especially black box preservation, depend on capabilities that the field has not yet matured.' This is a load-bearing limitation because the central claim is an organizational/empirical one: that access, rather than system type, determines the forensic process. As written, the framework is a plausible hypothesis, but the only concrete instantiation is the LLM/agentic case, and no retrospective test against published case studies (e.g., the OpenClaw investigation cited as [7]) is provided. The authors should either add retrospective application to one or more published investigations spanning different system types, or explicitly frame the access-first thesis as a falsifiable prediction with proposed tests, so that the paper's contribution as a research agenda is not overstated.","section":"Section 8, final paragraph"}],"minor_comments":[{"comment":"The recurring heading 'Case beat.' appears to be a typo; likely intended as 'Case in point' or 'Case study.' Please fix throughout.","section":"Sections 4.1–4.4"},{"comment":"The table caption in the text renderings shows 'T able 1' with a stray space. Also, the table uses 'Gap' as a stylistic marker, but some cells marked as gaps (e.g., 'model-version attestation') are also discussed in the main text; consider adding cross-references to the corresponding sections.","section":"Section 4, Table 1"},{"comment":"The root-cause taxonomy is introduced with examples but no citation for the enumerated categories (data poisoning, backdoor, prompt injection, RAG poisoning, jailbreak, drift, supply-chain compromise). Please cite relevant surveys or taxonomies to help readers locate the broader attack literature.","section":"Section 4.3"}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"You should know: this is a genuinely useful position paper for AI forensics, but the central claim is more fragile than it looks. The authors argue that investigator access (white/grey/black box) should be the primary organizing axis for post-incident AI investigations, over system type. The contribution is a process model matrix (collection, preservation, analysis, reporting × access), an AI-specific order of volatility, and a research agenda derived from the gaps. The order of volatility—accelerator memory, context window, logs, RAG state, weights, training lineage—and the \"volatility-reachability inversion\" (the most probative evidence is the least reachable) are the best parts. The paper is clearly written, candid about its own limits, and grounds everything in a running incident example. It also honestly states that the workflow has not been tested on real cases (Section 8).\n\nThe soft spots: first, the access-first thesis isn't really demonstrated. The matrix's operational content is almost entirely populated with LLM/agentic artifacts—prompts, RAG stores, tool-call traces, prompt-injection reconstruction. For a tabular classifier or a speech system, those cells would look different. The paper says system type is an \"annotation rather than structure,\" but the structure is built from one system type's artifacts. That doesn't falsify the framework, but it means the primacy claim is more assertion than argument. Second, some cells are definitional: if you hold the weights, you can do weight-diffing; if you only have I/O, you're limited to probing. That's fine for a scaffold, but it isn't an empirical finding. Third, a citation issue: \"AI Psychiatry\" (Table 1, black-box analysis) actually used memory images, which is closer to grey-box access; placing it in the black-box cell is misleading.\n\nOverall, I think this is worth serious peer review. It is a scaffold, not a validated standard, and the authors know that. The reader's conditional verdict seems right. I would bring it to a reading group for people working in AI forensics or incident response, and I'd cite it if I wrote in that area. It deserves a referee, not a desk reject, and the main revision should address the system-type vs. access question with a broader set of examples or a more careful statement of scope.","headline":"A useful, honest scaffold for AI forensics, but the access-primacy claim is asserted more than shown and the matrix leans heavily on LLM/agentic examples.","tokens_in":12633,"tokens_out":3082,"would_cite":true,"duration_ms":34285,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Investigator access, not system type, should be the organizing axis of AI forensics, and a phase-by-access matrix makes the fragmented field cohere while exposing its gaps.","keywords":["AI forensics","post-incident investigation","white-box access","grey-box access","black-box access","order of volatility","model version attestation","chain of custody"],"falsifier":"Collect a corpus of real AI-incident investigation reports and code each by artifacts actually held, system type, and the confidence of causal conclusions. If two investigations with the same access posture but different system types show systematically different forensic capability, or if most real cases have such fragmented access that no regime cleanly applies, the central organizing axis fails. A sharper test: document a black-box investigation that reached high-confidence causal attribution of a model-resident defect without provider cooperation or attestation—that single case would refut","tokens_in":11743,"feed_emoji":"🕵️","tokens_out":5020,"duration_ms":46362,"temperature":0.7,"pith_summary":"The paper argues that the field of AI forensics—investigating an AI system after an incident—should be organized by how much of the system an investigator can reach, not by the type of system involved. It defines three access regimes: white box (weights and training data), grey box (deployment logs, prompts, retrieval state), and black box (inputs and outputs only). On this axis it builds a process model matrix spanning collection, preservation, analysis, and reporting, and an order of volatility unique to AI systems that tells investigators what to capture first. The payoff is a unified map where fragmented prior work finds its place and the empty cells—black-box preservation, model version attestation, uncertainty for surrogate analysis—become a concrete research agenda. The authors do not claim the framework is validated; they offer it as a scaffold to test and refine.","feed_headline":"What you can reach decides what AI forensics can prove","feed_subtitle":"A white-grey-black access matrix maps every forensic phase and shows why black-box findings stay low-confidence.","key_machinery":"The process model matrix (Table 1): rows are the four forensic phases (collection, preservation, analysis, reporting) and columns are the three access regimes (white, grey, black box), each cell stating what is achievable, what binds, and which prior work occupies it. The access regimes are defined purely by artifact possession: white-box holds model internals and provenance, grey-box holds the deployment surface, black-box holds only I/O. The matrix carries the argument by converting the abstract 'access matters' claim into a concrete grid whose empty cells become research problems. Supporting machinery is the order of volatility, inspired by RFC 3227, which sets collection priority and exp","core_discovery":"On the paper's own terms, the central claim is that the forensic character of an AI investigation is determined first by what the investigator can reach. Access—defined by the artifacts obtainable, not by institutional role—sets what can be collected, preserved, analyzed, and reported with what confidence. The paper's contributions are the access taxonomy, the four-phase by three-regime process model matrix (Table 1), an AI-specific order of volatility (accelerator memory and context window most volatile, training lineage most stable, with a 'volatility-reachability inversion' where the most probative evidence is often least reachable), and a derived access-conditioned examination workflow.","pith_inferences":["The access trichotomy predicts a confidence gradient that is testable: if real case corpora show grey-box investigations routinely achieving high-confidence causal attribution, the gradient as stated is too pessimistic; conversely, if black-box investigations routinely fail without provider cooperation, the case for mandated disclosure strengthens.","The 'volatility-reachability inversion' suggests a policy lever the paper leaves implicit: regulators could compel providers to expose an attestable snapshot of the model version behind each logged inference, converting black-box cases into grey-box ones at the source.","The matrix could extend to a fourth dimension—time since incident—since preservation feasibility likely decays along the volatility order; a longitudinal study could quantify how quickly each evidence class becomes unreachable."],"forward_implications":["If adopted, new investigations can be scoped by asking 'what artifacts can we obtain?' first, and the appropriate process follows from that answer.","Existing techniques like influence functions, log correlation, or model extraction find their place as access-level tools; the field can stop fragmenting by system type.","Black-box investigations can name their epistemic ceiling: behavioral findings with explicit uncertainty, unless provider cooperation or model version attestation raises the floor.","The order of volatility gives a defensible collection sequence and motivates forensic readiness: logging, attestation, and preserved context windows become the high-value intervention points.","The research agenda becomes concrete: model version attestation, uncertainty quantification for surrogate analysis, and cross-boundary chain of custody are the gaps to fund."],"supporting_citations":[{"why":"Names AI forensics as the investigation of AI systems and sketches model authentication/identification sub-areas; supplies the founding taxonomy the paper extends.","marker":"[2]"},{"why":"RFC 3227 order of volatility; the template the paper adapts into an AI-specific collection ordering.","marker":"[4]"},{"why":"EU AI Act Articles 12, 18, 19, 26, 73; the regulatory driver that mandates logging and reporting and motivates the process model.","marker":"[6]"},{"why":"OpenClaw forensic analysis; its artifact planes fill the grey-box collection/analysis cells and exemplify the one-system, one-posture work the matrix unifies.","marker":"[7]"},{"why":"Influence functions; supplies the white-box analysis technique for training-data attribution.","marker":"[11]"},{"why":"Model-DNA provenance fingerprinting; supports the preservation/white cell's claim that model lineage can be attested.","marker":"[12]"},{"why":"Reanimation of models from memory images; supports the black-box analysis cell and the claim that reconstruction is possible without full access.","marker":"[13]"},{"why":"Practitioner book on AI forensics; evidence that demand predates regulation and motivates the collection/white cell and the broader discipline.","marker":"[17]"}],"fun_headline_variants":["Access determines what AI forensics can prove","Least reachable AI evidence is often most probative","Black-box access caps AI forensic confidence","White, grey, black: access sets AI forensic limits"],"cache_read_input_tokens":2688,"weakest_assumption_plain":"The framework assumes that the white/grey/black-box trichotomy, defined by which artifacts an investigator possesses, is a faithful and decisive description of real investigations—more decisive than system type or tooling—and the authors concede the workflow has not yet been tested on a corpus of real investigations.","fun_headline_variants_meta":{"raw":{"variants":["Access determines what AI forensics can prove","Least reachable AI evidence is often most probative","Black-box access caps AI forensic confidence","White, grey, black: access sets AI forensic limits"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00067,"raw_usage":{"total_tokens":2883,"prompt_tokens":728,"completion_tokens":2155,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":472,"completion_tokens_details":{"reasoning_tokens":2096}},"tokens_in":472,"tokens_out":2155,"duration_ms":15627,"temperature":1.0,"reasoning_tokens":2096,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-05T17:24:52.073248+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Collect a corpus of real AI-incident investigation reports and code each by artifacts actually held, system type, and the confidence of causal conclusions. If two investigations with the same access posture but different system types show systematically different forensic capability, or if most real cases have such fragmented access that no regime cleanly applies, the central organizing axis fails. A sharper test: document a black-box investigation that reached high-confidence causal attribution of a model-resident defect without provider cooperation or attestation—that single case would refut","supporting_citations":[{"cited_title":"Founding The Domain of AI Forensics","cited_arxiv_id":"1912.06497","evidence_quote":"Names AI forensics as the investigation of AI systems and sketches model authentication/identification sub-areas; supplies the founding taxonomy the paper extends."},{"cited_title":"RFC 3227, Internet Engineering Task Force (IETF) (2002)","cited_arxiv_id":null,"evidence_quote":"RFC 3227 order of volatility; the template the paper adapts into an AI-specific collection ordering."},{"cited_title":"laying down harmonised rules on artificial intelligence (artificial in- telligence act)","cited_arxiv_id":null,"evidence_quote":"EU AI Act Articles 12, 18, 19, 26, 73; the regulatory driver that mandates logging and reporting and motivates the process model."},{"cited_title":"Foundations for Agentic AI Investigations from the Forensic Analysis of OpenClaw","cited_arxiv_id":"2604.05589","evidence_quote":"OpenClaw forensic analysis; its artifact planes fill the grey-box collection/analysis cells and exemplify the one-system, one-posture work the matrix unifies."},{"cited_title":"In: Proceedings of the 34th International Conference on Machine Learning (ICML)","cited_arxiv_id":null,"evidence_quote":"Influence functions; supplies the white-box analysis technique for training-data attribution."},{"cited_title":"In: 33rd USENIX Security Symposium (USENIX Security 24)","cited_arxiv_id":null,"evidence_quote":"Reanimation of models from memory images; supports the black-box analysis cell and the claim that reconstruction is possible without full access."},{"cited_title":"Chapman & Hall/CRC, Boca Raton, FL (2026)","cited_arxiv_id":null,"evidence_quote":"Practitioner book on AI forensics; evidence that demand predates regulation and motivates the collection/white cell and the broader discipline."}],"review_version":1}