Research Provenance Infrastructure: Ending the Detection Arms Race

Research Provenance Infrastructure: Ending the Detection Arms Race

By DecentraSec Team

The five crises battering scholarly publishing — AI-generated peer review, paper mills, hijacked journals, fabricated images, and research data sovereignty threats — are not five separate problems requiring five separate tools. They constitute a single architectural failure: the absence of digitally attested, computationally verifiable provenance across the research lifecycle. Reactive detection has reached its asymptotic limit. The only scalable solution is to build provenance verification into the infrastructure itself.

Consider a scenario unfolding now in a research-intensive university. A mid-career PI submits a manuscript to a reputable journal. The paper passes the plagiarism check. The figures appear clean to the editorial eye. Three peer reviewers return favorable reports, and the journal accepts the paper. Nine months later, the paper is retracted.

The PI discovers that two of the three peer reviewers were LLM-generated, one key figure was AI-manipulated from a non-existent experimental run, and the journal itself — the one on the PI's CV — was a cloned hijacked domain whose legitimate counterpart ceased operation two years earlier.

Every gatekeeping mechanism failed. Not through negligence. Because they were designed to detect symptoms, not to verify provenance.

This is the structural reality of scholarly publishing in 2026. And it lands on your desk — not the journal's.

---

The Detection Ceiling — Why Statistical Tools Are Losing

Detection tools operate inside a closed feedback loop. Every plagiarism checker, every LLM detector, every image forensics algorithm generates a training signal that the next generation of generative models learns to evade. Attackers move faster because their coordination costs approach zero. Defenders must retrain, patch, and update; generative adversaries simply sample from an updated model.

The dynamic is formally adversarial: the defender optimizes a classifier against a stationary distribution while the attacker shifts that distribution. In any adversarial game where the attacker's adaptation cost is lower than the defender's retraining cost, the defender's true-positive rate asymptotically approaches the base rate. Institutions spend millions on tools structurally guaranteed to lose ground.

Consider the evidence. A Pangram Labs analysis of 75,800 peer reviews from ICLR 2026 found 21% fully AI-generated and over 50% with LLM traces (Shen & Wang, arXiv:2602.00319v2). Detection tools can flag some of these retrospectively but cannot prevent the damage. By the time a detector identifies a pattern, the submission has already been accepted.

The detection lag is punishing. Three studies identified 764 AI-linked retractions in early 2026; most took over 550 days to detect post-publication (ITS-AI, April 2026). During that window, papers accumulate citations, incorporation into meta-analyses, and use in tenure decisions. By the time the retraction arrives, the academic capital has already been spent.

Hijacked journals outrun blocklists at equivalent velocity. Retraction Watch's Hijacked Journal Checker surpassed 400 entries, with 70 to 80 new hijacked journals appearing annually (Abalkina, arXiv:2101.01224v2). Centralized lists cannot scale. By the time cataloguers add a hijacked journal, it has already victimized a wave of researchers — disproportionately early-career scholars who lack the institutional knowledge to distinguish legitimate venues from cloned domains.

For a dean or ORIC director, the calculus shifts. The question is no longer "which detection tools should we license?" but "why are we still funding detection infrastructure that cannot structurally win?"

DecentraSec's AI Integrity Layer inverts the detection paradigm. Rather than ask "is this text AI-generated?" — a statistical question with an eroding accuracy curve — it asks "does this review carry a digitally signed attestation linking it to a verifiable human institutional identity?" This shifts the approach from probabilistic classification to deterministic identity verification: the submitting reviewer's institutional credential is bound to the review content via public-key signature, producing a tamper-evident provenance token that can be verified in constant time at the submission boundary. Unlike detection tools that require retraining against each new model generation, this verification scales without adaptation because it depends not on generator behavior but on the presence or absence of a valid attestation — a binary check, not a statistical estimate.

---

Crisis of the Reviewers — When Gatekeepers Become Bots

The peer review system is broken by design. Reviewers are unpaid, unrecognized, and unaccountable. Outsourcing reviews to LLMs is not an ethics failure — it is a rational response to an irrational incentive structure. Institutions that demand peer review participation but offer neither recognition nor accountability subsidize the crisis.

The hallucination liability is real. Authors withdraw submissions after receiving reviews containing fabricated references and non-existent methodological critiques. When the reviewer is an LLM, no human counterpart exists to contact. The scholarly conversation becomes a conversation with machines.

Shen & Wang found that approximately 12% of Nature Communications reviews were AI-generated by 2025, with a substantial increase across the study period from 2022 through 2025 (arXiv:2602.00319v2). Top-tier journals are not immune; they are being silently hollowed out. The ICLR findings — 21% fully AI-generated, over 50% with detectable LLM involvement — confirm that even flagship venues in technically sophisticated fields are compromised.

Why does this land at the dean's door? If your faculty serve as reviewers for journals where LLM-generated reviews compromise editorial quality, your institution's scholarly output passes through a degraded gatekeeping system. Your PIs' papers are being reviewed — and possibly accepted or rejected — by machines. The institutional liability is compound: your researchers are both producers of reviews that may be fraudulent and consumers of review quality that may be subverted.

The fix is not better detection. It is identity-bound attestation for every review submitted under an institutional affiliation.

DecentraSec's AI Integrity Layer embeds automated provenance verification directly into the institutional submission workflow. Every review submitted through an affiliated system must carry a tamper-evident provenance token — a digitally signed binding between the reviewer's verified institutional identity and the review content. The binding operates through a public-key infrastructure: the reviewer's institution attests to the individual's identity, the reviewer signs the review output with their private key, and the submission system verifies the signature chain before the review reaches an editor's desk. Reviews lacking valid attestation are rejected at submission time. This is not detection; it is structural prevention through identity-bound content provenance.

---

The Provenance Chain — From Paper Mills to Pirate Journals

Paper mills and hijacked journals are two faces of the same problem: the absence of non-repudiable attribution across the research artifact chain.

Paper mills operate in plain sight. The Problematic Paper Screener flagged nearly 19,000 papers containing tortured phrases by January 2025 (Cabanac, Labbé & Magazinov, The Conversation, January 29, 2025). The traditional response — "better screening" — has failed because screening is post-hoc and mills adapt their linguistic patterns faster than detection lexicons update.

But paper mills cannot survive when every artifact in the research lifecycle carries a tamper-evident hash anchored to an append-only distributed ledger with consensus-verified immutability. Mills fabricate data, analysis, and author identities — but they cannot fabricate a chain of provenance linking data collection timestamps, analysis script execution, image generation metadata, and peer review submission to verifiable institutional identities. That requires coordinated falsification across multiple independent layers — raw data collection records, instrument logs, analysis execution environments, image metadata, submission timestamps, and institutional identity attestations — each carrying its own hash commitment. The cost of coordinated forgery across these layers scales geometrically, exceeding any rational economic incentive for fraudulent publication.

The hijacked journal epidemic is equally immune to centralized defenses: 400+ entries on the Hijacked Journal Checker, 62 clone URLs detected through archive analysis alone (Abalkina, arXiv:2101.01224v2, Scientometrics 126, 6181–6203). Centralized lists constitute a single point of failure: they are always reactive, always incomplete, and always one cataloguing cycle behind the hijackers.

A distributed, consensus-verified registry of legitimate journal identities — ISSNs, editorial board memberships, publication histories — changes that calculus structurally. Verification becomes a lookup against an append-only ledger where entries require multi-party attestation to be added and cannot be unilaterally altered or deleted. Hijacking a journal would require compromising the distributed consensus mechanism, not merely registering a deceptive domain and copying a website.

The institutional action is clear: mandate provenance logging for all research outputs originating from your institution. Require journal identity verification against a consensus-backed registry before submission. These are not IT decisions; they are research integrity policy decisions that begin at the ORIC level.

DecentraSec's Integritas Vault provides immutable, verifiable logging for every step of the research lifecycle — from raw data collection through peer review submission. Each artifact carries a tamper-evident hash anchored to an append-only distributed ledger. The hash chain is constructed such that any alteration to any upstream artifact invalidates all downstream commitments, making retrospective fabrication computationally detectable. The GEAR Network complements this with a distributed, consensus-verified registry of legitimate journal identities — ISSNs, editorial board composition, and publication history — where entry addition requires multi-party institutional attestation. Together, they close the structural gap that paper mills and hijackers exploit: the absence of non-repudiable, computationally verifiable attribution across the research artifact chain.

---

The Image Crisis and the Sovereignty Imperative

Image manipulation consistently ranks among the leading causes of retraction across disciplines. The Retraction Watch Database contains over 69,000 records as of April 2026; image-related issues — duplication, fabrication, inappropriate manipulation — appear across a significant fraction of cases, though exact ranking varies by discipline and methodology. The 764 AI-linked retractions identified in early 2026 tell only part of the story. The NTIRE 2026 Challenge on Robust AI-Generated Image Detection drew 511 participants (Gushchin et al., arXiv:2604.11487) — a sign of urgency, but not a solution.

The detection arms race is structurally unwinnable for images as it is for text. AI detectors improve; generative models adapt. The NTIRE 2026 challenge demonstrated that detectors trained on specific generator architectures degrade when tested against held-out models — precisely the condition that real-world deployment entails. Manual inspection cannot scale to modern submission volumes. The only structural fix is chain-of-custody verification: every published image must carry a tamper-evident record of its origin — raw instrument data through analysis pipeline to final figure — such that any post-capture manipulation is detectable as a break in the provenance chain.

At the same time, European research data sovereignty has become a geopolitical imperative. The European Parliament published a 2025 study on European Software and Cyber Dependencies documenting US dominance across all major software layers and the legal exposure created by the US CLOUD Act and FISA — which grant US authorities legal reach over data of European citizens and institutions hosted by American providers. The Horizon Europe 2026–2027 Work Programme, adopted December 11, 2025, allocates €14 billion in funding, with dedicated calls addressing secure data sharing within the European Open Science Cloud across different regulatory regimes.

Brussels has diagnosed the problem but cannot operationalize the solution. Policy frameworks require infrastructure that enforces data residency, access control, and provenance through distributed consensus — where no single administrative actor, regardless of jurisdiction, can unilaterally alter or access protected data. US cloud providers, structurally subject to the CLOUD Act, cannot offer what geopolitical sovereignty demands: mathematically guaranteed data locality enforced by consensus protocol, not by Terms of Service.

If your institution receives Horizon Europe funding or collaborates with EU partners, data sovereignty compliance is not optional. The question is whether you will wait for mandated requirements or build compliant infrastructure now.

DecentraSec's GEAR Network directly operationalizes the EU's data sovereignty requirements. It provides a distributed, tamper-evident storage and compute layer where data residency, access control, and provenance are enforced by a distributed consensus protocol — not by a US-based cloud provider's Terms of Service. European research institutions retain computationally verifiable control over their data assets: every access event, transfer, and modification is logged to an append-only ledger that no single jurisdictional actor can alter. For the image integrity dimension, the AI Integrity Layer's automated forensics — duplicated panel detection, AI-generated figure identification, statistical anomaly flagging — operates before peer review, and Integritas Vault ensures every image carries its chain-of-custody record from instrument to publication, establishing a verifiable provenance trail that survives compression, format conversion, and downstream reuse.

---

What Institutional Leaders Must Do — The Provenance Infrastructure Decision

The strategic diagnosis is unambiguous: the five crises share a single root cause — the absence of verifiable provenance across the research lifecycle. Every dollar spent on detection tools that cannot structurally win is a dollar that should be redirected toward provenance infrastructure.

Three institutional priorities for 2026–2027:

1. Mandate provenance logging for all research outputs (data, code, images, manuscripts) originating from your institution, with each artifact carrying a tamper-evident hash commitment.
2. Deploy automated provenance verification at the submission boundary — verifying digital attestations before peer review, not investigating after retraction.
3. Require distributed journal identity verification for all submissions by affiliated researchers, checking against a consensus-backed registry rather than a centralized blocklist.

The cost of inaction is measurable. Research by Stern, Casadevall, and colleagues (eLife, 2014) calculated a mean of $392,582 in direct NIH funding per retracted article attributable to misconduct — and this figure accounts only for grant dollars, not institutional investigation costs, legal exposure, reputation damage, or the downstream effects on meta-analyses and clinical guidelines that cite retracted work. The 764 AI-linked retractions identified in early 2026 represent an institutional liability that will grow as detection catches up to what has already been published.

The opportunity is equally clear. Early adopters of provenance infrastructure will set the standard for research integrity certification. Funders — Horizon Europe, NIH, NSF — are moving toward requiring provenance verification as a condition of grant compliance. Institutions that build now will define the compliance framework, not merely satisfy it.

This infrastructure does not compete with existing tools. It provides the foundational layer of digitally attested provenance that makes those tools more effective — narrowing their detection scope from "find the needle in the haystack" to "confirm that every needle carries a verifiable identity."

ScholarMark's institutional-grade infrastructure provides all three layers in a unified deployment: the AI Integrity Layer for identity-bound provenance verification at the review and submission boundary, Integritas Vault for tamper-evident lifecycle logging anchored to an append-only distributed ledger, and the GEAR Network for distributed journal identity verification and data sovereignty enforcement through consensus protocol. Designed for university-wide deployment, not individual researcher adoption. The infrastructure constitutes the standard.

---

The Provenance Infrastructure Pilot Grant

ScholarMark is accepting applications from 12 research-intensive universities for an Institutional Pilot Grant program commencing Q3 2026. Selected institutions receive:

• Full ScholarMark stack deployment for up to 500 affiliated researchers
• Dedicated integration engineering support for existing submission and repository workflows
• A structured implementation roadmap with quarterly integrity benchmarking
• Priority access to GEAR Network consensus participation for sovereignty compliance

Pilot Grant recipients also qualify for an Early Adopter Subsidy covering 40% of first-year infrastructure costs — reserved for the first eight institutions to complete due diligence.

This is not a software license. It is an infrastructure partnership.

[CONTACT LINK: DecentraSec Research Division — Institutional Deployment] Subject line: Provenance Infrastructure Pilot Grant Inquiry

---

References

• Shen, X. & Wang, Y. (2026). Detecting AI-Generated Content in Academic Peer Reviews: A Large-Scale Analysis of ICLR 2026. arXiv:2602.00319v2.
• ITS-AI. (2026). 764 Retracted Papers: What Happens Without AI Detection. April 2026.
• Abalkina, A. (2021). Detecting a network of hijacked journals by its archive. arXiv:2101.01224v2. Scientometrics, 126, 6181–6203.
• Cabanac, G., Labbé, C. & Magazinov, A. (2025). Problematic Paper Screener: Trawling for fraud in the scientific literature. The Conversation, January 29, 2025.
• Retraction Watch. (2025). The Retraction Watch Hijacked Journal Checker now has 400 entries. December 26, 2025.
• European Commission. (2025). Horizon Europe Work Programme 2026–2027: €14 billion investment. Adopted December 11, 2025.
• European Parliament. (2025). European Software and Cyber Dependencies. Study for the ECTI Committee.
• Gushchin, A. et al. (2026). NTIRE 2026 Challenge on Robust AI-Generated Image Detection in the Wild. arXiv:2604.11487.
• Stern, A.M., Casadevall, A., Steen, R.G. & Fang, F.C. (2014). Financial costs and personal consequences of research misconduct resulting in retracted publications. eLife, 3, e02956.
• Retraction Watch Database. 69,911 records as of April 2026 (via AMI Data).