Tempus AI vs Governed Medical-AI Training: Training-Step Provenance

What Tempus does well

Tempus AI runs commercial molecular sequencing at scale and has assembled one of the larger connected libraries pairing solid-tumor sequencing data with longitudinal clinical and outcome records in oncology. On top of that data substrate it has built clinical decision-support and care-pathway products that surface information such as eligible therapies and clinical-trial options back to ordering physicians, and it has extended the same multi-modal approach beyond oncology into adjacent clinical areas, with imaging and other modalities contributing to a connected patient view. This is a genuine and substantial engineering achievement: integrating molecular, clinical, and imaging data into models that inform care is hard, and Tempus does it at production scale. The point of comparison below is not that this data-integration work is deficient. It is that the training pipeline sitting underneath it, like essentially every large medical-AI training pipeline, governs training data at the dataset and checkpoint level rather than at the level of the individual gradient.

Tempus's institutional position also makes the governance question sharper rather than academic. A company that operates CLIA-certified laboratory testing, ships clinical-grade software, and supplies data into research and regulatory contexts sits under several distinct evidentiary regimes at once. Each of those regimes eventually resolves into the same operational question about any deployed model: which examples influenced it, through what acquisition pathway did the underlying data enter the system, and under what recorded governance rule was that use admitted. Public technical description of medical-AI training pipelines, Tempus included, generally answers those questions at the granularity of a dataset card or a data-use agreement, not at the granularity of a training step.

Why training-step provenance matters here

Several regulatory lines that governed medical AI separately are converging on the same requirement. The FDA's framework for AI-enabled medical devices, including its work on predetermined change control plans, contemplates models that update over time and therefore need demonstrable governance over what changed them. Guidance around real-world data used in regulatory submissions increasingly asks for documentation of how records entered an analytic dataset. And patient-data regimes such as HIPAA, plus contractual research-use limits negotiated with contributing institutions, define what a given record may and may not be used for. These are publicly stated directions of travel, not claims about any Tempus filing; the specifics of any FDA clearance or authorization Tempus holds should be checked against FDA's public database rather than assumed here.

The operational consequence is architectural. A model that informs a clinical decision may be asked, after the fact, which training content was structurally permitted to influence the parameters active in a given output, and through what acquisition pathway that content entered the pipeline. A pipeline that can answer at training-step granularity has an audit story; a pipeline whose finest available record is a dataset card answers at aggregate granularity and, when a specific answer is demanded, tends to re-verify or retrain under pressure. That rework in a regulated setting consumes engineering time, regulatory bandwidth, and customer trust at once, and it is not recoverable through documentation written after training. Making training-step provenance a first-class property of the training loop is therefore a design decision whose value compounds across model generations rather than a one-time compliance cost.

The training-governance substrate

The mechanism disclosed in 19/647,395 treats the gradient itself as the unit of governance, not the dataset and not the checkpoint. As disclosed, each training example is evaluated as a proposed semantic mutation and assigned a training depth profile: a per-layer or per-block contribution-weight vector that specifies how much of that example's gradient signal is permitted to reach each layer of the model. A weight of one admits the full gradient at a layer; a weight of zero blocks it; intermediate values attenuate it. The profile is indexed to the example's entropy band and slope position, so routine, low-entropy content is confined toward shallow layers while high-entropy content is admitted to deeper representational layers, all within bounds set by governing policy objects. Applied to a medical setting, this is the structural means by which a class of content whose acquisition pathway or chain of custody cannot be verified can be restricted, by policy, to shallow layers rather than admitted into the model's deep, more memorizable structures.

The audit backbone is the training-provenance log disclosed in the same chapter. For each training batch or example the log records, as structured data, the entropy-band classification, the depth-aggregation profile and the per-layer contribution weights actually applied, a governance record naming the policy object that authorized admission and the policy object that set the depth profile, a content-provenance record capturing the source, acquisition pathway, chain of custody, and semantic metadata of the content, and an admissibility determination (admitted, rejected, or admitted with modified profile) with the reason. The log is chronologically ordered and append-only, with entries timestamped and sequentially numbered so that retroactive modification produces detectable inconsistencies, and it may be periodically sealed using cryptographic sealing infrastructure to yield tamper-evident checkpoints for third-party verification. The disclosure ties content-provenance records to content anchoring, where content derives a computable identity from its own structural entropy that persists across format conversions, so reverse queries can trace back to anchored content regardless of how it was acquired. The article does not attribute any of these mechanisms to Tempus; they describe the disclosed invention.

The architectural difference

Several established techniques address parts of this problem, and the disclosed mechanism is meant to compose with them rather than replace them. Federated learning keeps raw data inside contributor institutions and exchanges gradients across the boundary; that is a real privacy property, but a federated gradient is still layer-undifferentiated unless the receiving model routes it by depth profile, and it does not by itself produce a per-example, per-layer audit record. Differential privacy adds calibrated noise to bound re-identification risk; the disclosure notes that global differential privacy calibrates noise to the worst-case example across the whole corpus and degrades accuracy accordingly, and offers instead a structural alternative in which privacy-sensitive content is routed to shallow layers and suppressed from deep ones, so the model cannot memorize what it was not permitted to encode. Dataset cards and model cards document training data, but at aggregate granularity; they cannot answer a question posed at gradient or layer resolution. None of these techniques, on their own, yields the training-step-resolution provenance record that the disclosed log produces.

The distinguishing mechanism, and the one 19/647,395 turns into a concrete capability, is reverse-provenance memorization detection. When a model output at inference time is flagged as highly similar to a known training artifact, the disclosed memorization-detection module issues a reverse query against the training-provenance log to identify the set of training content whose depth profiles encompassed the layer blocks active during the output. The disclosure is careful about the limits here: because gradient-based optimization is non-linear, the reverse query does not definitively attribute a behavior to specific content, but it returns a bounded attribution set substantially narrower than the full corpus, and it classifies the similarity as shallow, deep, or absent memorization for inference-time governance. It further separates governed fine-tuning provenance from pre-training provenance, so a challenged output can be traced to whichever provenance chain the activated parameter regions belong to. For a medical platform, that is the difference between answering an audit with a dataset card and answering it with a bounded, per-layer record of what was structurally permitted to shape the model.

Where this leaves a platform like Tempus

Tempus already operates the data-integration substrate, the clinical contributor network, and the regulatory engagement that a training-time provenance architecture presupposes. What no large medical-AI training pipeline is publicly documented as operating, Tempus included, is an architectural primitive that binds gradient application to a recorded content-provenance record and a governing policy object at training-step resolution and preserves that binding in an append-only, sealable log. That gap is not a criticism of Tempus's data work; it reflects the state of the art, in which training governance is generally applied at dataset and checkpoint level. The disclosed mechanism describes how a pipeline of this kind could make training-step provenance a structural property rather than a downstream documentation artifact.

Building this yourself

The disclosure is intended to be enabling: a skilled implementer with a standard training loop can build the described approach. Compute, per training example, an entropy-band classification (for example via a divergence metric between the example's semantic embedding distribution and the model's current representational state). Attach to each example a training depth profile, a per-layer or per-block contribution-weight vector, and modulate each example's gradient at each layer by the corresponding weight during the backward pass, so admission and depth are decided by governing policy objects rather than applied uniformly. Emit one append-only, timestamped, sequentially numbered log entry per batch recording the entropy band, the applied per-layer weights, the authorizing and depth-setting policy objects, a content-provenance record (source, acquisition pathway, chain of custody, semantic metadata, and any anchored content identity), and the admissibility determination; periodically seal the log for tamper-evident checkpoints. Support forward queries (from content to influenced layer blocks) and reverse queries (from an observed behavior to the bounded set of content permitted to influence the active layer blocks), and drive a memorization classifier and inference-time governance from the reverse query.

The approach is intended to be read broadly. It is not limited to oncology or to medical data; it applies to any domain with per-content admission constraints, including labeled data, licensed corpora, regulated records, and safety-sensitive content. Embodiments include batch training and real-time training from individual accepted or corrected interactions; parameter-efficient adaptation layers as well as full fine-tuning; depth profiles that are fixed, entropy-indexed, or adapted during training by a profile-adaptation engine; contribution weights of zero, fractional, unit, or amplifying magnitude; provenance logs sealed continuously or at checkpoints; and content identity derived from structural entropy anchoring, attached metadata, or registry entries. Curriculum sequencing (the temporal dimension) and depth profiles (the spatial dimension) may be combined or used independently. Named products and market context in this article are external reference points, not embodiments of the filing.

Disclosure scope

The training-governance mechanisms described here, depth-selective gradient routing by entropy-band-indexed depth profile, the append-only and cryptographically sealable training-provenance log, forward and reverse provenance queries, reverse-provenance memorization detection, structural differential privacy by depth confinement, and separated fine-tuning provenance, are disclosed in United States Patent Application 19/647,395. This article is a dated public disclosure tied to that filing.

All references to Tempus AI and to any other named company, product, framework, or regulatory program are external context describing the market and technical landscape. They are not claims of the filing, not descriptions of any embodiment, and not assertions about any specific company's internal architecture, training pipeline, data sources, licensing, consent practices, or regulatory status. Statements about Tempus reflect publicly available, general descriptions of its business at the time of writing; any specific clinical, laboratory, or FDA regulatory status should be verified against Tempus's own disclosures and FDA's public records. Nothing here should be read as characterizing Tempus's legal exposure or the provenance of its training data.