Cache Governance
A cryptographic record for every AI decision.
Every saved inference state is bound to a W3C credential: the exact model version, document context, timestamp, and compression mode, cryptographically signed and independently checkable.
This page describes the governance architecture. The proprietary compression engine that powers it is not disclosed here. Schedule a technical deep-dive under NDA →
The trust gap in persistent AI state.
Silent model drift
When you save a model's conversation state and reload it later, how do you know the model hasn't changed? A LoRA adapter update, a weight quantisation change, or a minor version bump can silently invalidate saved KV cache. The model produces garbage, and nobody knows.
No provenance chain
A regulator asks: “This AI-assisted decision was made six months ago. Show us that the model state you're reloading is the same one that produced the original output.” Without cryptographic binding between the model identity and the saved state, you cannot answer this question.
Cross-boundary trust
When inference state moves between servers, providers, or organisations, how does the receiving system confirm the state is authentic and untampered? A file hash is not enough. You need identity, provenance, and a checkable chain of custody.
Decentralised identity for inference state.
Model Identity
Every model version (weights, config, LoRA adapters) gets a Decentralised Identifier (DID). A globally unique, cryptographically checkable identity that persists across deployments, providers, and hardware. Change the adapter? New DID. New weights? New DID. No ambiguity.
State Credential
Every saved state receives a W3C credential binding: the model DID, the content hash (SHA-256), compression mode, timestamp, and document context hash. Cryptographically signed. Independently checkable without contacting the issuer.
Trust Anchor
A model registry maps approved model versions to their DIDs. Compliance teams define which models are authorised for which workloads. Only KV caches with valid credentials from approved models can be loaded. Unapproved model versions are cryptographically rejected.
Instant Invalidation
Model version found to be compromised, biased, or non-compliant? Revoke its DID. Every KV cache produced by that model, across every deployment, every provider, every saved session, becomes cryptographically unloadable. Instantly. No recall process needed.
Chain of custody for AI inference.
Save with credential
When Revyzor saves a state, it issues a signed credential: model DID + content hash + document hash + timestamp + compression mode. The credential is stored alongside the state file.
Check on load
Before loading a saved state, the connector checks the credential against the current model's DID. Mismatch? Reject and fall back to full prefill. Not a silent failure; a recorded, signed rejection with an audit log.
Audit anytime
Six months later, a regulator asks about a decision. Pull the credential. It shows which model, which document, which timestamp, which compression. Check the signature independently. Reload the exact inference state. The chain of custody is unbroken.
What the credential is, and what it is not.
The credential is the record. It binds the token sequence, the tool outputs that entered context, the model version, the sampling parameters and the output. A person can read it without access to a GPU, and it survives the model being decommissioned.
The saved state is not the record. It is a tensor. No auditor can inspect it directly and we do not ask them to. What the state gives you is the session back as it was, not as it can be approximated: re-running from a transcript means re-executing tools against systems that have since changed, on a stack that has since moved.
If your only requirement is a signed transcript, you do not need us. Signed transcripts are cheap and you should build one. We are for the case where someone has to pick the session back up.
Who needs attested inference state.
Regulated financial services
SR 11-7, SS1/23, MAS guidelines. Every AI-assisted decision must be traceable to a specific model version. Signed credentials give model risk management the evidence it requires, cryptographically, not administratively.
Legal and forensic analysis
AI-assisted evidence analysis, contract review, eDiscovery. If the analysis is challenged, the credential shows the exact model and state that produced it. A documented chain of custody for AI-generated work product.
Cross-provider portability
Move inference state between cloud providers. The receiving system checks the credential before loading, confirming the state came from an authorised model on authorised infrastructure. Trust without shared infrastructure.
Model governance
Enterprise AI governance teams need to control which models are deployed and which inference states are trusted. The registry provides centralised policy enforcement with independent cryptographic checks. Approve, monitor, or revoke at the model identity level.
Beyond file hashes.
| File Hash | Cache Governance | |
|---|---|---|
| Tamper detection (against any party without the signing key) | Yes | Yes |
| Model identity binding | No | Cryptographic |
| LoRA/adapter awareness | No | DID changes on adapter change |
| Remote revocation | No | Instant, all deployments |
| Independent checking | Requires original file | Checkable without issuer |
| Regulatory audit trail | Manual documentation | Machine-checkable record |
The retained state is the document.
Governance is not optional, because the working state is as sensitive as the document it came from.
Published research reconstructs source text from persisted caches
Peer-reviewed security research (NDSS 2025, NDSS 2026) has shown that the text a model read can be reconstructed from its persisted working state, in some settings near-verbatim. The working state of a model that has read a merger agreement is that merger agreement, in a different coordinate system.
The ecosystem default is an ungoverned shadow copy
Production serving stacks increasingly offload caches to disk, network storage, and shared tiers to cut recomputation cost, and the mainstream open-source offload layers publish no documentation of encryption or access control for the persisted caches. A firm running such a stack has built a shadow copy of its document store, outside its retention schedules, legal-hold tooling, and access controls, without deciding to.
Retention done deliberately treats the state as regulated data
Every record Revyzor retains is encrypted at rest (AES-256-GCM), cryptographically signed at capture, and held under an explicit retention policy on the client’s terms. The record exists because the firm chose to keep it, under controls the firm can show. And the reason the industry default is plaintext is economics: working state is gigabyte-scale, and encrypting it at serving latency has been treated as unaffordable. Lossless compression changes that arithmetic. Compression is not only what makes retention economical; it is what makes retention governable.
Inference state your compliance team can stand behind.
Talk to Us About Governancesales@revyzor.com