1. The Gap
A consuming agent that registers a model obtained from another party inherits a history it did not make. The artifact it now dispatches to was published by a base party and then retrained by a succession of other agents, each redistributing the mutated result onward. Weeks later, one of those upstream parties may conclude that the artifact should no longer be relied on, and it may reach that conclusion for reasons the mechanism never asks it to state. What matters structurally is only that the party no longer stands behind the artifact. The consuming agent, several hops downstream, has no dependable way to learn that this has happened and act on it.
The tooling that exists tends to treat the problem as either deletion or accusation. A registry can deprecate or yank a package, but that removes the artifact and gates installation, not the runtime behavior of an endpoint already registered and already relied upon. A retraction notice reads as a judgment about the artifact or its author. Neither preserves the record of what the consuming agent already did under the artifact, and neither reaches the peers that agent in turn supplied. What is missing is a governed channel by which a party named in the lineage can state, verifiably and without grading anyone, that it no longer stands behind the artifact, and have that statement change how the consuming agent dispatches without erasing anything.
Provenance withdrawal is that channel. It is disclosed in U.S. Provisional Application No. 64/117,812 as part of the derived-artifact provenance mechanism, and it is deliberately narrow: it carries the fact of withdrawal and nothing more.
2. Mechanism
Provenance withdrawal operates over a structure the consuming agent already maintains. Each registered inference endpoint carries a derived-artifact provenance chain: a first base-publisher entry naming the publisher of the base artifact with its signature over a digest of that artifact, and a retraining-agent entry for each subsequent retraining event. Each retraining-agent entry carries that agent's identity primitive, its epoch identifier at the event, a reference to the entry that agent appended to its own append-only lineage field (104), a digest of the artifact as retrained, and a signature over those elements together with a digest of the preceding entry. The last entry is the chain head, and its chain-head identifier is a digest over the head and its predecessor, so a chain that differs at any entry yields a differing identifier. On each dispatch the consuming agent appends a dispatch provenance entry carrying the chain-head identifier then standing, and it maintains a retrieval keyed by that identifier that returns every determination it produced in reliance on the endpoint. This is the substrate a withdrawal acts upon.
The withdrawal itself is emitted by a party named in the chain, the base publisher or any retraining agent, that no longer stands behind the artifact. It is a governed observation bearing that party's authority credential and continuity hash. Its payload names the withdrawing party's identity primitive, its epoch, and the target of the withdrawal: either a chain-head identifier, in which case the withdrawal reaches that head, or an entry, in which case it reaches every chain that descends from that entry. The observation designates itself neither a determination of the closed set of determination classes nor an assessment of any party. It records the fact that the emitting party no longer stands behind the artifact, and it grades nothing.
On receipt the consuming agent verifies the observation against the counterparty identity record (114) it holds for the withdrawing party and against the named entry. On success it deletes nothing. The artifact, the provenance chain, every dispatch provenance entry, and every prior determination all persist, and the agent writes into the endpoint record it keeps a provenance-withdrawn attribute carrying the head withdrawn, the withdrawing identity, its epoch, and the admission time. From that point it routes no inference request to the endpoint, and each dispatch it withholds is appended as a positive abstention rather than a denial, and never as a fault of any party.
A withdrawal that stopped at the first consuming agent would leave that agent's own downstream peers exposed. So the consuming agent maintains, per endpoint, an onward emission register recording each peer to which it emitted the endpoint as a tool source, with the chain-head identifier at emission, the scope partition, and the time. On writing the attribute it enumerates the register and emits an onward withdrawal notice to each peer whose recorded head is the head withdrawn or descends from the withdrawn entry. A peer holding a matching endpoint admits the notice exactly as it would a direct withdrawal, and discharges the same duty to its own peers, so the withdrawal propagates across a sourcing chain of arbitrary length. Every hop is a non-adverse outcome and increments no meter of any party.
The mechanism also reaches backward, to the determinations the consuming agent already made. On writing the attribute the agent retrieves, from its lineage field alone and under the chain-head-keyed retrieval, every determination produced under the withdrawn head whose dispatch falls within a re-marking window declared in the signed policy object (112) and measured backward from admission. To each it appends a withdrawn-provenance mark naming the determination, the head, the withdrawing identity, the action class, and the scope partition. The determination is not modified, reversed, deleted, or reclassified. The mark is subject to the conversion bar (502): no count of such marks becomes a scalar, a threshold operand, or an adverse consequence to any party.
The mark has one forward effect, and it is computed fresh at each action request rather than stored. Where the most recent qualifying determination of an action class within a scope partition bears a withdrawn-provenance mark, the downstream provenance gate resolves withheld, the dispatch-authority predicate fails for that action class alone, and the withholding is appended as a positive abstention. The failure is confined to that action class and reaches no party. It is cured only two ways: by re-derivation against a registered endpoint bearing no withdrawn attribute, which yields a fresh unmarked qualifying determination, or by a positive abstention appended in respect of the class. No passage of time and no successor signed policy object cures it. The whole behavior, from the upstream party's one signed statement to the halted dispatch downstream, runs without any registry, broadcast authority, or coordination beyond the two agents holding records of each other.
3. Operating Parameters
The filed specification declares few numeric quantities for this mechanism. Three parameters govern its operation.
The re-marking window is declared in the signed policy object (112) and measured backward from the admission of the withdrawal. It is expressed in one of two units, and the policy object declares which governs: an absolute duration tested against the recorded dispatch time, or a count of the consuming agent's own successor epochs tested against the recorded dispatch epoch. Because each dispatch provenance entry records the dispatch in both units, the window is evaluable in whichever unit the policy declares.
The provenance-freshness check runs at a declared interval, testing whether each chain party's presented epoch, drawn from a recent governed observation or from the counterparty identity record (114), is a valid successor of the epoch carried in that party's chain entry. This governs the silent-withdrawal limb described below.
The withdrawal's reach is set by what its payload names rather than by any scalar threshold. A withdrawal names either a single chain-head identifier, reaching that head alone, or an entry, reaching every chain that descends from it. Beyond these, the mechanism declares thresholds nowhere. Its consequences are structural and ordinal, and its discipline is that it converts nothing into a magnitude.
4. Composition
Provenance withdrawal is one limb of the derived-artifact provenance mechanism, and it earns its substance from what surrounds it. Beneath it sit the provenance chain and the chain-head-keyed retrieval: without the chain there is nothing to withdraw, and without the retrieval there is no way to find the determinations a withdrawal should mark. The withdrawal is what makes an otherwise descriptive chain actionable.
Its complement is the silent-withdrawal limb. A party may cease to stand behind an artifact without emitting anything, so the consuming agent performs a provenance-freshness check testing whether each chain party's presented epoch is a valid successor of the epoch in that party's chain entry. Where that does not resolve, the agent appends a provenance-indeterminate outcome of its recorded abstention class. That outcome is expressly not a withdrawal: no attribute is written, no determination is re-marked, and dispatch continues. Its single consequence is a quality-promotion bar, under which no locally recorded quality value for the endpoint is advanced to a higher persistence tier while the outcome stands. The explicit withdrawal and the freshness check together cover both the party that says it has left and the party that leaves without a word.
Over the same endpoint-record substrate runs the corpus-contribution limb, which admits a counterparty's training-corpus material only through a settled contribution identifier, so one structure carries both who built the artifact and who fed it. And the withdrawal is built entirely from primitives shared across the filing: the governed observation, the append-only lineage field (104), the counterparty identity record (114), the conversion bar (502), the positive abstention, and the query-time recomputation of the dispatch-authority predicate. It is not a bespoke revocation subsystem bolted on. It is the same governed vocabulary applied to model provenance, which is why its outcomes stay non-adverse and its records stay auditable.
5. Prior-Art Distinction
Several established categories address adjacent problems, and provenance withdrawal is best understood by how it differs from each in structure.
Model cards, AI bills of materials, and model-lineage metadata document where an artifact came from. They are descriptive. An upstream party's change of position is not, in those systems, a signed object a downstream agent verifies and that alters its dispatch. Provenance withdrawal is self-executing at the consuming agent and carries onward to that agent's peers without a central registry.
Package deprecation and yanking, as practiced in software registries, and artifact takedown more generally, remediate by removal. The artifact or version is withdrawn from a central index and installation is gated. This mechanism deletes nothing and gates the runtime dispatch of an endpoint already registered, keeping the artifact, the chain, and every prior determination in place under an append-only discipline.
Certificate revocation lists, online revocation checks, and signing-transparency systems revoke trust in a credential or a signature, usually mediated by an authority or a log and resolving to a binary valid or invalid. A provenance withdrawal is verified locally against a counterparty identity record held by the consuming agent, is non-adverse, and carries no assessment. It also re-marks the consuming agent's own already-produced determinations within a policy window, a backward reach that revocation infrastructure does not provide.
Machine unlearning and data-deletion remedies erase. Provenance withdrawal is deliberately deletion-free. Its effect is to stop routing and to mark, never to erase, so the record of what was done under the artifact survives for audit and dispute.
A retraction notice or a moderation action, finally, is a judgment about a work or its author. The withdrawal expressly designates itself neither a determination of the closed set nor an assessment of any party. None of the categories above is asserted to be practiced by any particular product, and the distinctions here are drawn at the level of mechanism.
6. Disclosure Scope
This article describes subject matter disclosed in U.S. Provisional Application No. 64/117,812. The provenance withdrawal observation and the provenance-withdrawn attribute are disclosed at Section 10.5, paragraph [0398]. The surrounding limbs relied on here are filed in the same section: the derived-artifact provenance chain and chain-head identifier at [0395], chain verification at [0396], carriage of the chain head into the consuming agent's lineage at [0397], the onward withdrawal duty at [0399], re-marking within a window at [0400], the downstream provenance gate and its two cures at [0401], and the silent-withdrawal freshness limb at [0402]. The governed-observation structure the withdrawal inherits is filed at Section 6.1.
What is disclosed is the mechanism as stated above: a signed, content-blind withdrawal, verified against the counterparty identity record (114) and the named entry; a deletes-nothing admission that writes a durable attribute and routes withheld dispatches as positive abstentions; onward propagation to sourced peers; backward re-marking bounded by a policy-declared window; and a query-time gate cured only by re-derivation or by a recorded abstention.
What is not asserted here is anything the filed paragraphs do not state. The reference numerals of the applicant's fuller exposition are drafting artifacts and are not claim terms. The endpoint selection preference computed over the outcome-quality record is a separate mechanism and is not part of this disclosure. Any verification path taken where no counterparty identity record is held, and any observation field beyond those the cited paragraphs recite, are likewise outside what this article publishes. The provisional defines priority for the disclosed subject matter, and nothing here should be read to enlarge it.
