Synthetic Forensics glossary: 300 AI evidence terms

Account attribution

An evidence-supported connection between activity and a specified account.

In practice. An authenticated request can support account association without identifying the human at the keyboard. Consider delegated access, shared sessions, compromise, and service automation when interpreting activity records.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Limited supporting context. The glossary’s account/operator distinctions are editorial; no universal source-identification method is validated.

Account takeover

Unauthorized acquisition or use of control over an account.

In practice. Compare authentication changes, session events, actions, and independent reports under a defined timeline. Unexpected content alone cannot determine whether takeover, delegated access, automation, or an authorized change caused it.

Further reading: NIST SP 800-63B-4: Authentication and Authenticator Management · Reference v1.1.0

Limited supporting context. Email control, session possession, credential status, and human identity are separate; broader application session semantics vary.

Acquisition

Documented collection of evidence by an appropriate method, with scope, conditions, integrity checks, and limitations recorded.

In practice. Document source scope, tools, timing, versions, and unavoidable effects. A useful collection need not include everything, but the report must keep unexamined and unavailable sources separate from negative findings.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Core concept supported. The source supplies general forensic practice; the AI-export examples are editorial applications.

Acquisition log

A record of how evidence was collected, including source, scope, tools, times, and handling.

In practice. A browser export log records the account, export option, application version, and errors. This helps a reader understand which material the export includes and what the collection could have changed.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Core concept supported. The source supplies general forensic practice; the AI-export examples are editorial applications.

Agent

An AI-enabled system that can pursue a task through actions, such as using tools, under a particular runtime and permission context.

In practice. Record the task, runtime, permissions, and tools involved. A conversational assistant becomes relevant to action reconstruction when its workflow can request or execute changes beyond producing a displayed answer.

Further reading: Machine Learning Glossary · Reference v1.1.0

Limited supporting context. Not every agent uses MCP, and a function schema is not proof of execution.

Agent forensics

Examination of AI-driven task execution, tool use, state, delegation, and effects on local or external systems.

In practice. Link requests, results, and target-system observations through identifiers and timing. A reported upload or command is useful evidence, but independent state checks determine whether its intended effect actually occurred.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Editorial definition. These are editorial definitions or application-dependent records, not terms standardized by the cited publications; examples are hypothetical and historical behavior must be demonstrated.

Agent task

A bounded assignment pursued by an agent in a particular execution context.

In practice. Record the initiating instruction, task identifier, permissions, and completion state. The requested goal can differ from the actions actually attempted and the effects independently observed.

Further reading: Machine Learning Glossary · Reference v1.1.0

Limited supporting context. Not every agent uses MCP, and a function schema is not proof of execution.

AI anti-forensics

Defensive study of interference with the availability, integrity, provenance, or interpretation of AI-related evidence.

In practice. Compare missing records with ordinary retention, synchronization, and acquisition limits. Interference is a hypothesis requiring support; absence alone cannot show that someone deliberately concealed AI activity.

Forensic significance. Test normal explanations and publish defensively useful findings without evasion instructions.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Editorial definition. These are editorial definitions or application-dependent records, not terms standardized by the cited publications; examples are hypothetical and historical behavior must be demonstrated.

AI artifact

A record or residual object created, used, or retained by an AI application or its surrounding environment.

In practice. A conversation database, tool receipt, and saved output may reveal different aspects of activity. Inspect actual structures and application versions rather than assuming that every AI system retains the same records.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Editorial definition. These are editorial definitions or application-dependent records, not terms standardized by the cited publications; examples are hypothetical and historical behavior must be demonstrated.

AI evidence

Digital evidence relevant to a question involving an AI system, interaction, output, configuration, or action.

In practice. Start with a question about an object or event. Identify which digital sources can test it, including ordinary device or account records that become relevant because an AI workflow used them.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Editorial definition. These are editorial definitions or application-dependent records, not terms standardized by the cited publications; examples are hypothetical and historical behavior must be demonstrated.

AI provenance

Information about the origin and history of AI-related content, interactions, models, or workflows.

In practice. Connect the available generation, editing, and distribution records. Describe which relationships are documented and which are asserted or missing, rather than treating one model label as the entire history.

Further reading: PROV-DM: The PROV Data Model · Reference v1.1.0

Limited supporting context. These field-specific formulations are editorial; a missing relationship is not proven concealment.

API audit event

A service-generated record of an API request or related action.

In practice. It can independently support a tool-call timeline if its source and semantics are understood. Check whether it records request acceptance, authorization, or committed effect before using it to confirm a change.

Further reading: NIST SP 800-53 Rev. 5 — control catalog · Reference v1.1.0

Limited supporting context. API payloads and agent traces vary by implementation, and the record set may be incomplete or alterable.

Approval event

A record of a decision authorizing a specified action or change.

In practice. Identify the approving actor, exact scope, and applicable version. An approval for one file or operation does not necessarily authorize a later revised request, broader target, or different external effect.

Further reading: NIST SP 800-53 Rev. 5 — control catalog · Reference v1.1.0

Core concept supported. A control description is not evidence that an application enforces it or that a particular operation completed.

Artifact

A digital object or record that may help explain an activity or system state. Its significance depends on context and validated interpretation.

In practice. An object becomes useful evidence through a documented relationship to the question. A cache fragment may show retention without establishing when the user viewed it or which interaction created it.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Limited supporting context. These bounded editorial formulations are not quoted NIST definitions of every named term.

Assertion

A stated claim in a record or provenance system. A signature can protect its integrity without proving its factual truth.

In practice. Treat it as a claim with an identifiable source. Signing can protect the recorded statement against changes, while the truth and completeness of what it says still require evidentiary assessment.

Further reading: C2PA 2.4 Technical Specification · Reference v1.1.0

Core concept supported. Validation of an assertion is distinct from factual truth and completeness.

Assistant response

A response represented as produced by the assistant within an interaction record.

In practice. A displayed response can differ from a streamed or later revised version. Preserve message identifiers and status so the analysis distinguishes generated content, presentation, and downstream actions.

Further reading: Transformers — Chat templates · Reference v1.1.0

Limited supporting context. Role priority and application/runtime instructions differ by platform; the user-visible prompt need not be the entire context.

Asynchronous operation

An operation whose dispatch and completion occur separately.

In practice. A tool can return a job identifier before the external work finishes. Retain later status and result records so the timeline distinguishes acceptance, execution, completion, and observation of the final state.

Further reading: RFC 9110 — HTTP Semantics · Reference v1.1.0

Core concept supported. The actual tool’s lifecycle and persistence guarantees must be established separately.

Attachment

An object associated with a message, task, or other application record.

In practice. Preserve both the object and the relationship linking it to the interaction. A file in a download folder does not alone establish which prompt used it or whether the model could access its full contents.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Editorial definition. These are editorial definitions or application-dependent records, not terms standardized by the cited publications; examples are hypothetical and historical behavior must be demonstrated.

Attribution

An evidence-supported association with a source, system, workflow, account, model, or actor, at an explicitly stated level.

In practice. Separate the source of content from the person operating an account. Each association needs its own evidence, and one well-supported connection does not automatically resolve the remaining identity questions.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Limited supporting context. The glossary’s account/operator distinctions are editorial; no universal source-identification method is validated.

Audio spoofing

Presentation of manipulated, replayed, or generated audio to misrepresent a source or defeat an audio check.

In practice. Distinguish the audio technique from the historical intent and actor. A detector's alert needs condition-specific validation and independent context before it supports a conclusion about a particular call or account.

Further reading: ASVspoof 2019: A large-scale public database of synthesized, converted and replayed speech (Wang et al.) · Reference v1.1.0

Core concept supported. The evaluated recordings and simulated replay conditions do not establish how a case recording was created.

Audio synthesis

Computational generation of audio such as speech, music, or sound.

In practice. Preserve the original stream and sharing history where available. Compression, mixing, and playback recording can alter useful signals, and a synthetic-speech finding alone does not establish an impersonator's identity.

Further reading: NIST AI 100-4: Reducing Risks Posed by Synthetic Content · Reference v1.1.0

Core concept supported. NIST’s overview does not certify any detector, watermark, or conclusion on a case object.

Audit trail

A sequence of records describing activities and changes in a system.

In practice. An account audit trail may record a download separately from a conversation event. Identify who produces the records and whether administrators can alter them before treating the sequence as complete.

Further reading: NIST SP 800-53 Rev. 5 — control catalog · Reference v1.1.0

Limited supporting context. API payloads and agent traces vary by implementation, and the record set may be incomplete or alterable.

Authentication event

A recorded check used to establish an account or session's access context.

In practice. Identify the method, time, device context, and outcome where available. Successful authentication supports the system's access decision, while the identity of the historical operator remains a separate attribution question.

Further reading: NIST SP 800-63B-4: Authentication and Authenticator Management · Reference v1.1.0

Limited supporting context. Email control, session possession, credential status, and human identity are separate; broader application session semantics vary.

Authenticity

The extent to which an item is what it is claimed to be, assessed for a stated proposition rather than inferred from appearance alone.

In practice. Ask what the item is claimed to represent. An authentic export can contain an invented scene; confirming the export source and confirming the depicted event require different evidence.

Forensic significance. Name the claim being tested before assigning an authenticity conclusion.

Further reading: C2PA 2.4 Technical Specification · Reference v1.1.0

Limited supporting context. The proposition-based authenticity definition is editorial and extends beyond C2PA validation.

Authenticity calibration

Assessment of how a person’s authenticity judgments and confidence correspond to known source conditions in a defined study.

In practice. Compare judgments with documented source conditions and retain confidence responses. Accuracy and confidence can differ, so a confident answer is not itself evidence that a participant recognized the true origin.

Forensic significance. Report the stimuli, population, measures, and limits rather than generalizing from intuition.

Further reading: Source monitoring (Johnson, Hashtroudi & Lindsay, 1993) · Reference v1.1.0

Editorial definition. These operational/working concepts are project editorial formulations; no established diagnosis, measured AI effect, or validated instrument is asserted.

Authorization context

The permissions and policy applicable to an actor's action.

In practice. An authenticated account may lack permission for a particular operation. Preserve role and resource scope at the relevant time so the report does not infer authority merely from possession of a session.

Further reading: NIST SP 800-53 Rev. 5 — control catalog · Reference v1.1.0

Core concept supported. A control description is not evidence that an application enforces it or that a particular operation completed.

Automation bias

A tendency to favor automated guidance under specified task conditions.

In practice. Test it through a defined study with suitable comparisons. Agreement with one detector result is not by itself evidence of the bias, since independent information or a reasonable method choice can produce the same decision.

Further reading: Automation: Decision Aid or Decision Maker? (Skitka) · Reference v1.1.0

Core concept supported. No AI-specific effect or finding about an individual user is established by this report.

Base model

A model used as the starting point for an adaptation or downstream deployment.

In practice. An adapter's behavior depends on its base-model relationship. Document that relationship rather than attributing all output characteristics to the adapter name or assuming two deployments with similar labels share identical starting weights.

Further reading: Machine Learning Glossary · Reference v1.1.0

Core concept supported. The project’s forensic applications and a deployment’s actual lineage are not independently established.

Benchmark

A specified task, dataset, and evaluation procedure used for comparison.

In practice. A benchmark result can compare systems under its rules while leaving case suitability unresolved. Report the version, metrics, exclusions, and input conditions instead of advertising a score as universal forensic accuracy.

Further reading: WILDS: A Benchmark of in-the-Wild Distribution Shifts (Koh et al., 2021) · Reference v1.1.0

Core concept supported. The cited datasets do not establish reliability of an AI artifact attribution method.

Biometric comparison

Comparison of measured biological or behavioral characteristics under a defined method.

In practice. A face or voice similarity result requires quality and error context. Synthetic representations and ordinary lookalikes complicate interpretation, so do not turn a comparison score into certain identity without independent support.

Further reading: NIST SP 800-63A-4: Identity Proofing and Enrollment · Reference v1.1.0

Core concept supported. Proofing and authentication policies do not retrospectively identify every human actor in a case.

Bit depth

The number of bits used to represent a sample or channel value in a format.

In practice. Changing bit depth can alter quantization without changing the apparent subject. Record the actual format and transformations rather than interpreting a technical precision label as evidence of origin or overall quality.

Further reading: PNG Specification — Third Edition · Reference v1.1.0

Core concept supported. The underlying signal, model precision, and other formats require their own semantics.

Bitstream image

A copy of a specified storage source at the level of its accessible bytes.

In practice. An image of a volume can include information absent from a file export. Record unreadable regions and acquisition boundaries; a copy of one volume does not cover an entire cloud account.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Core concept supported. A preserved copy or custody record does not establish content truth or collection completeness.

Branch

An alternate path in an interaction graph, often produced by regeneration or editing a prior input.

In practice. Preserve alternate paths and their parent relationships. A flattened export can place mutually exclusive responses in apparent sequence, making a conversation look different from its retained structure.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Editorial definition. These are editorial definitions or application-dependent records, not terms standardized by the cited publications; examples are hypothetical and historical behavior must be demonstrated.

Browser history

Records of navigation retained by a browser under its implementation and settings.

In practice. A visit to an AI service supports a navigation observation. It does not alone establish which account was used, which prompt was submitted, or whether a generated output was saved.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Limited supporting context. The retained records and eviction behavior of a particular product remain unvalidated.

Browser storage

Data retained by a browser through mechanisms such as local storage, databases, or caches.

In practice. A web application can distribute state across several storage mechanisms. Inventory the actual origin and profile, and validate each structure instead of assuming a browser history page represents all retained activity.

Further reading: Storage Standard · Reference v1.1.0

Core concept supported. A storage API does not demonstrate that a particular application retains messages there.

C2PA

The Coalition for Content Provenance and Authenticity and its technical system for content provenance.

In practice. C2PA records can describe creation or editing assertions bound to an asset. Validation assesses the specified binding and trust conditions; it does not establish that every depicted event or signed statement is factually true.

Further reading: C2PA 2.4 Technical Specification · Reference v1.1.0

Core concept supported. Validation does not establish factual truth, full history, or consent.

C2PA claim

The signed structure connecting specified assertions and other information in a C2PA manifest.

In practice. Identify what the claim covers and which validation checks passed. A valid claim signature supports integrity under the trust model, while the reliability of the asserted facts requires separate examination.

Further reading: C2PA 2.4 Technical Specification · Reference v1.1.0

Core concept supported. Validation of an assertion is distinct from factual truth and completeness.

C2PA ingredient

An input asset represented in a content-provenance workflow.

In practice. An edited image can reference an ingredient photograph. Check the ingredient relationship and available bindings; a reference alone does not mean the examiner possesses the source or can independently validate every earlier transformation.

Further reading: C2PA 2.4 Technical Specification · Reference v1.1.0

Core concept supported. An ingredient reference does not by itself recover or verify every earlier input.

C2PA manifest

A structured provenance record containing a claim, assertions, and related information under the C2PA format.

In practice. Preserve the manifest with its asset and validation context. A manifest can refer to ingredients and editing actions while leaving earlier history undocumented, so describe its actual coverage rather than calling the entire history verified.

Further reading: C2PA 2.4 Technical Specification · Reference v1.1.0

Core concept supported. Validation does not establish factual truth, full history, or consent.

Cache

A retained copy or intermediate representation used to speed later access.

In practice. A cached image may be resized or older than the current attachment. Establish the cache key, creation behavior, and relationship to the source before using it as evidence of what a user saw.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Limited supporting context. The retained records and eviction behavior of a particular product remain unvalidated.

Calibration

Agreement between stated confidence or probability estimates and observed outcomes under defined conditions.

In practice. A score of 0.9 is not automatically a 90% chance of AI origin. Calibration requires a specified target, population, and evaluation; report those conditions before interpreting a detector score probabilistically.

Further reading: On Calibration of Modern Neural Networks (Guo et al., 2017) · Reference v1.1.0

Core concept supported. The classification study does not calibrate a particular forensic detector or a person’s confidence.

Canonicalization

Conversion into a defined representation for a specified comparison or signature process.

In practice. A signed JSON system may apply rules before signing. Document those rules and preserve raw bytes, since equal canonical representations and identical acquired files answer different questions about change.

Further reading: RFC 8785 — JSON Canonicalization Scheme · Reference v1.1.0

Core concept supported. JCS is one scheme; applying it to another format without its rules is unsupported.

Certificate

A signed structure binding a public key to stated attributes under a certificate system.

In practice. Examine the certificate chain, validity period, policy, and revocation context. A certificate label is not an independent guarantee that a depicted scene is real or that the named party created every part of the asset.

Further reading: RFC 5280 — Internet X.509 PKI Certificate and CRL Profile · Reference v1.1.0

Core concept supported. A valid path under one policy does not establish every asserted human identity or authorization.

Certificate chain

A sequence of certificate relationships evaluated toward a chosen trust anchor.

In practice. Validation can differ across trust stores and dates. Record the chain and policy used, and distinguish a successful trust path from the separate factual claims contained in the signed provenance record.

Further reading: RFC 5280 — Internet X.509 PKI Certificate and CRL Profile · Reference v1.1.0

Core concept supported. A valid path under one policy does not establish every asserted human identity or authorization.

Chain of custody

A documented record of evidence handling, transfers, storage, and responsible parties over time.

In practice. Document handling from collection through analysis and transfer. Hashes help compare bytes, while the custody history records responsibility, storage conditions, and actions that could affect the evidence.

Forensic significance. A digest supports byte comparison while the record explains responsibility and continuity.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Core concept supported. A preserved copy or custody record does not establish content truth or collection completeness.

Cloud export

An application-provided download of selected remotely stored data.

In practice. Read the export's documented scope and inspect its structure. A collection may omit internal events or older versions, so compare identifiers and timestamps with separately authorized sources before inferring completeness.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Editorial definition. These are editorial definitions or application-dependent records, not terms standardized by the cited publications; examples are hypothetical and historical behavior must be demonstrated.

Codec

A system for encoding and decoding media data.

In practice. Identify the codec, settings, and version when examining a media stream. Re-encoding can change forensic signals even when a viewer sees the same scene, so validation should include relevant compression conditions.

Further reading: Media container formats · Reference v1.1.0

Core concept supported. Format recognition alone does not validate a whole file or identify its source.

Collection scope

The stated boundaries of an evidence collection.

In practice. Specify accounts, devices, periods, object types, and excluded sources. A scoped export can still be useful, but its gaps must remain visible when the report addresses activity outside the collected interval.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Core concept supported. The source supplies general forensic practice; the AI-export examples are editorial applications.

Command execution

Running a command in a specified shell or program environment.

In practice. A displayed command is not necessarily an executed command. Preserve the shell, arguments, working directory, exit status, and corroborating effects so the report explains what the execution evidence actually supports.

Further reading: Python — subprocess management · Reference v1.1.0

Core concept supported. Process success can be narrower than the intended application or external-system effect.

Competing hypothesis

An alternative explanation of the available evidence that can be compared with a preferred account through explicit tests.

In practice. For an apparent agent-created file, consider manual creation, an earlier file, and another process. Identify observations that distinguish these accounts rather than merely listing possibilities without a test.

Forensic significance. State what evidence would distinguish the alternatives, not only what supports the favored one.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Limited supporting context. The project’s independence tests, competing-hypothesis formulation, and confidence language need case-specific justification.

Completion status

A record describing whether and how a generation request ended.

In practice. A timeout and a normal stop can leave similar visible text while having different execution histories. Preserve the raw status and validate the application's mapping before stating that the response was completed successfully.

Further reading: Transformers — GenerationConfig and generation · Reference v1.1.0

Core concept supported. Defaults and completion records differ across implementations; an output cannot recover unknown settings.

Concept drift

Change over time in a relationship a predictive method relies on.

In practice. A label's relationship to observable signals can change as workflows evolve. Monitor the defined task and data, and distinguish this change from a one-time input-quality problem or an undocumented model update.

Further reading: Measuring the Discrepancy between Conditional Distributions: Methods, Properties and Applications (Yu et al.) · Reference v1.1.0

Core concept supported. The study’s metric does not establish a universal drift detector or identify the cause of a case-specific change.

Confabulation

An inaccurate account expressed without establishing intentional deception; usage varies by research context.

In practice. In memory research, characterize the tested task and evidence rather than diagnosing a person. In AI discussion, prefer a precise description of an unsupported generated statement instead of importing human psychological conclusions.

Further reading: NIST AI 600-1 — Generative AI Profile · Reference v1.1.0

Limited supporting context. The glossary’s broad usage is context dependent; this is not a human clinical diagnosis or proof of deception.

Confidence statement

An explanation of evidentiary support, assumptions, alternatives, and uncertainty for a particular proposition.

In practice. Attach the statement to a particular conclusion. Explain supporting sources, independence, alternatives, and gaps so that readers can see why one claim is stronger or weaker than another.

Forensic significance. Keep limitations beside the claim and do not import a tool score’s meaning without validation.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Limited supporting context. The project’s independence tests, competing-hypothesis formulation, and confidence language need case-specific justification.

Confusion matrix

A table comparing predicted classes with reference classes in a specified test.

In practice. Keep the underlying counts, not just one summary score. The matrix reveals missed positives and false alerts, while its interpretation still depends on label quality, sampling, thresholds, and the intended use.

Further reading: Metrics and scoring: quantifying the quality of predictions · Reference v1.1.0

Core concept supported. Evaluation labels, population, threshold, and class convention determine interpretation; case performance is not guaranteed.

Content address

An identifier derived from content under a defined hashing and representation scheme.

In practice. It can locate a stored object independently of its filename. Verify the scheme and retrieved bytes; a matching address does not explain the object's creator, custody, or the truth of its embedded claims.

Further reading: IPFS — Content addressing · Reference v1.1.0

Core concept supported. An IPFS CID need not equal the SHA-256 digest of the raw file; it does not authenticate a source.

Content credentials

Provenance records associated with content, commonly using the C2PA system of manifests and signed assertions.

In practice. Inspect the associated assertions and validation result. Credentials can document a signed editing claim; they do not guarantee that the pictured scene happened or that the entire earlier history is recorded.

Further reading: C2PA 2.4 Technical Specification · Reference v1.1.0

Core concept supported. Validation does not establish factual truth, full history, or consent.

Content provenance

Information describing the origin, creation, handling, and transformation of a content object.

In practice. A source image, project file, export, and repost can document different stages. Keep each version distinct and check the links between them before presenting a continuous creation history.

Forensic significance. Assess binding, completeness, and source trust separately from factual truth.

Further reading: PROV-DM: The PROV Data Model · Reference v1.1.0

Core concept supported. A provenance description is not independent proof that each relationship occurred.

Context summarization

Replacement of earlier material with a shorter representation for continued processing.

In practice. A summary can omit wording or introduce an interpretation. Treat it as its own derivative and preserve its source relationship where available, especially when reconstructing what information influenced a later answer.

Further reading: Transformers — Tokenizer · Reference v1.1.0

Limited supporting context. The source does not establish a universal summarization algorithm or the text supplied to a particular run.

Context truncation

Removal of input material to fit a system's available context or processing rules.

In practice. An earlier message can disappear from the actual input while remaining visible in a transcript. Document available runtime evidence and avoid assuming that a complete conversation display equals the context used at every step.

Further reading: Transformers — Tokenizer · Reference v1.1.0

Core concept supported. The exact tokenizer, runtime inputs, and hidden summarization rules of a service remain separate questions.

Context window

The model’s available input context for a particular step, subject to system limits and any truncation or summarization.

In practice. Establish what was supplied for the particular step where evidence permits. Earlier visible messages may have been truncated or summarized, and external material may have been added without appearing in the user transcript.

Further reading: Transformers — Tokenizer · Reference v1.1.0

Core concept supported. The exact tokenizer, runtime inputs, and hidden summarization rules of a service remain separate questions.

Conversation branch

An alternate route through a conversation's message relationships.

In practice. An edited earlier prompt can create a new branch while retaining the old response elsewhere. Preserve branch identifiers and selection context; a single exported view may not show which version a user saw.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Editorial definition. These are editorial definitions or application-dependent records, not terms standardized by the cited publications; examples are hypothetical and historical behavior must be demonstrated.

Conversation export

An application-provided representation of conversation data.

In practice. Check its schema, attachments, branch selection, and export time. A readable transcript may conceal missing alternatives or tool events, so assess coverage before treating the displayed order as the entire interaction history.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Editorial definition. These are editorial definitions or application-dependent records, not terms standardized by the cited publications; examples are hypothetical and historical behavior must be demonstrated.

Conversation graph

A representation of messages and relationships such as parent links, branches, or revisions.

In practice. It helps distinguish alternative responses from sequential events. Mark absent nodes and unsupported edges so readers can see what was recovered without mistaking an analytical layout for the application's complete original state.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Editorial definition. These are editorial definitions or application-dependent records, not terms standardized by the cited publications; examples are hypothetical and historical behavior must be demonstrated.

Cookie

A browser-managed value associated with requests under domain, path, and other rules.

In practice. A cookie can help explain an account session but is not proof of a person's identity. Treat session credentials as sensitive, record only necessary context, and prevent their inclusion in public examples.

Further reading: RFC 6265 — HTTP State Management Mechanism · Reference v1.1.0

Core concept supported. A cookie or session credential does not establish human identity.

Correlation

Comparison of records to assess a relationship using identifiers, content, time, or other properties, with alternatives considered.

In practice. State the matching rule and its alternatives. Shared times or filenames may narrow candidates, but stronger identifiers and independent relationships help distinguish coincidence from a supported event link.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Limited supporting context. The project’s independence tests, competing-hypothesis formulation, and confidence language need case-specific justification.

Corroboration

Support for a proposition from independent evidence, with independence assessed for the particular claim.

In practice. Check independence for the specific claim. Three websites repeating one source are not three independent observations, while a target-system audit event can test an agent’s reported action.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Limited supporting context. The project’s independence tests, competing-hypothesis formulation, and confidence language need case-specific justification.

Credential verification

Checking an issued credential's recorded identity, scope, issuer, and status under its verification process.

In practice. A valid credential record supports the issuer's stated award and current status. It does not guarantee every future forensic conclusion, and a course-completion record must retain its actual meaning.

Further reading: NIST SP 800-63B-4: Authentication and Authenticator Management · Reference v1.1.0

Limited supporting context. Email control, session possession, credential status, and human identity are separate; broader application session semantics vary.

Cryptographic signature

A cryptographic mechanism used to verify a signed record under a key and trust model; claim truth and signer identity need separate assessment.

In practice. Record the algorithm, key association, verification result, and trust policy. Successful verification supports a defined cryptographic relationship without establishing that the signed narrative is complete or truthful.

Further reading: FIPS 186-5 — Digital Signature Standard · Reference v1.1.0

Core concept supported. Key control, human identity, content truth, and authority to act remain separate propositions.

Custody transfer

A documented handoff of an evidence object or its controlled storage responsibility.

In practice. Record the parties, time, identifiers, and integrity checks at the handoff. A digest can verify transferred bytes while the custody record explains who handled them and under what conditions.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Core concept supported. A preserved copy or custody record does not establish content truth or collection completeness.

Data leakage

Unintended use of information in evaluation that undermines the claimed separation or validity of a test.

In practice. Near-duplicate training and test files can inflate apparent performance. Check splitting and transformations, and distinguish evaluation leakage from unauthorized disclosure of private data, which is a separate security meaning.

Further reading: Common pitfalls and recommended practices · Reference v1.1.0

Core concept supported. Determining leakage in a particular corpus requires its actual collection and transformation records.

Data minimization

Limiting collected and disclosed information to what a stated purpose requires.

In practice. An identity analysis may need account event identifiers while not needing unrelated messages. Document the selection and access controls so that privacy protection does not become an unexplained omission in the reasoning.

Further reading: NIST SP 800-53 Rev. 5 — control catalog · Reference v1.1.0

Limited supporting context. The project’s evidence-report redaction practice is an editorial application, not a universal legal rule.

Database checkpoint

An operation that incorporates changes from a transaction log into another database representation.

In practice. A SQLite checkpoint can change where committed records reside. Record when and how an application was stopped or opened, since those actions can affect the relationship between database and WAL files.

Further reading: SQLite: Write-Ahead Logging · Reference v1.1.0

Core concept supported. Evidence significance depends on acquisition consistency and the actual application configuration.

Database journal

A database's record used to support recovery or transactional consistency.

In practice. A journal is an implementation-specific source, not a universal message history. Acquire related files consistently and test how the application's actual database configuration creates, updates, and removes them.

Further reading: SQLite: Write-Ahead Logging · Reference v1.1.0

Limited supporting context. Journaling varies by engine; SQLite behavior does not define every database journal.

Dataset provenance

Information about a dataset's sources, collection, processing, permissions, and revisions.

In practice. A detector benchmark needs traceable labels and transformation history. Document sampling and rights as well as file hashes so readers can assess whether the corpus represents the population relevant to their question.

Further reading: Datasheets for Datasets (Gebru et al.) · Reference v1.1.0

Core concept supported. A dataset document can contain unverified assertions or omit history.

Deduplication

Identification or consolidation of repeated objects under a defined comparison rule.

In practice. Two byte-identical attachments can share content while having different message relationships. Preserve those relationships even when storage is consolidated, and distinguish exact matching from perceptual or semantic similarity.

Further reading: FIPS 180-4: Secure Hash Standard · Reference v1.1.0

Limited supporting context. Similarity-based consolidation and evidence-source independence require separate criteria.

Deepfake

A commonly used term for synthetic or manipulated media representing a person or event, often through AI-based generation or alteration.

In practice. Describe the actual manipulation: a swapped face, generated voice, or altered performance. The broad label does not establish a production method, deceptive intent, or who controlled the workflow.

Further reading: NIST AI 100-4: Reducing Risks Posed by Synthetic Content · Reference v1.1.0

Core concept supported. NIST’s overview does not certify any detector, watermark, or conclusion on a case object.

Delegation

Assignment of work from an initiating agent or task to another agent or process, with a traceable relationship where records permit.

In practice. Preserve parent and child task identifiers with dispatch, completion, and incorporation events. A child report can exist without the parent using it, and a summary may hide important errors or limits.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Editorial definition. These are editorial definitions or application-dependent records, not terms standardized by the cited publications; examples are hypothetical and historical behavior must be demonstrated.

Delegation chain

Recorded relationships connecting an initiating task to delegated work and subsequent results.

In practice. Trace child identifiers and result incorporation where evidence permits. A parent's final answer may summarize a child's report without independently checking it, so preserve that distinction in the evidence account.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Editorial definition. These are editorial definitions or application-dependent records, not terms standardized by the cited publications; examples are hypothetical and historical behavior must be demonstrated.

Deleted record

A record removed from an application's active view or logical data structure.

In practice. A deleted conversation can still have references elsewhere, or no recoverable residue at all. Separate the user's deletion action, server retention, local synchronization, and forensic recovery rather than treating them as one event.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Core concept supported. Logical application deletion and physical recovery are separate; recovery is not guaranteed.

Deployment identifier

A reference to a particular hosted or local model deployment.

In practice. It may identify an endpoint configuration rather than immutable weights. Check its scope and change history before linking responses across time or concluding that all requests used the same model state.

Further reading: Transformers — Configuration · Reference v1.1.0

Limited supporting context. Endpoint aliases, labels, routing, and historical runtime identity need independently acquired records.

Derivation

A documented relationship in which one object or record was produced from another.

In practice. A transcript derived from audio should point to the exact recording and processing method. Retain uncertainties such as recognition errors so the transcript is not presented as a direct capture of spoken words.

Further reading: PROV-DM: The PROV Data Model · Reference v1.1.0

Core concept supported. The evidence-handling application is editorial; transformation quality and claim truth require assessment.

Derived evidence

An output created from source evidence by a documented transformation, retained with a traceable relationship to its inputs.

In practice. A normalized timeline is an analysis product, not the original log. Retain its input references, conversion rules, and version so another examiner can inspect how each event was produced.

Forensic significance. Assign the derivative its own identifier and preserve transformation details and source references.

Further reading: PROV-DM: The PROV Data Model · Reference v1.1.0

Core concept supported. The evidence-handling application is editorial; transformation quality and claim truth require assessment.

Detection threshold

A chosen decision boundary used to classify a measurement or score.

In practice. Changing a threshold changes the balance of missed cases and false alerts. Report the selected rule and validation population so readers can assess what a positive result means in the actual examination.

Further reading: Metrics and scoring: quantifying the quality of predictions · Reference v1.1.0

Core concept supported. Evaluation labels, population, threshold, and class convention determine interpretation; case performance is not guaranteed.

Developer instruction

Application-supplied guidance that influences a model's behavior under a system's instruction rules.

In practice. A service can change this guidance between sessions. Record the available version and scope, and distinguish documented configuration from a reconstruction based only on output behavior.

Further reading: Transformers — Chat templates · Reference v1.1.0

Limited supporting context. Role priority and application/runtime instructions differ by platform; the user-visible prompt need not be the entire context.

Diffusion model

A generative model family that learns a process for transforming noise or corrupted representations into outputs.

In practice. A diffusion-generated image can pass through substantial editing and compression. Model-family information gives workflow context, but it does not validate a particular detector or prove a specific output came from that family.

Further reading: Denoising Diffusion Probabilistic Models (Ho et al., 2020) · Reference v1.1.0

Core concept supported. Sampler names and step parameters vary across implementations; reproduction of a historical result is not guaranteed.

Digital evidence

Digital data used to assess an investigative proposition, with its source, integrity, and interpretive limitations documented.

In practice. Keep source, integrity, and interpretation visible. A trustworthy collection of a false statement is still a real digital record; its evidentiary use depends on the proposition being assessed.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Core concept supported. The project’s proposition-based phrasing is editorial; the source is IT-oriented guidance, not legal admissibility advice.

Digital persona

An identity representation assembled through an account, profile, or online behavior.

In practice. A persona can combine true, invented, and borrowed elements. Preserve the relevant account and content relationships while separating representation, control, and the unresolved identity of the operator.

Further reading: Synthetic Identity Fraud Defined · Reference v1.1.0

Editorial definition. The established fraud definition includes dishonest gain; it does not classify every fictional or AI-generated persona as fraud.

Digital provenance

Recorded information about the origin, derivation, and handling of digital objects and records.

In practice. Record derivations as well as custody. A file can retain identical visible content after metadata changes, so distinguish the history of acquired bytes from the history of the represented information.

Further reading: PROV-DM: The PROV Data Model · Reference v1.1.0

Core concept supported. A provenance description is not independent proof that each relationship occurred.

Disk image

A documented representation of a specified disk or storage volume.

In practice. A disk image can support repeatable analysis of local application files. Its value depends on the imaging method and coverage; it does not automatically include remote messages or encrypted data in readable form.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Core concept supported. A preserved copy or custody record does not establish content truth or collection completeness.

Distribution shift

A change in the statistical distribution of inputs or outcomes relevant to a system.

In practice. Changes in content sources or processing can alter errors without any software update. Describe the comparison populations and dates, and test performance under the actual distribution rather than assuming past calibration remains valid.

Further reading: WILDS: A Benchmark of in-the-Wild Distribution Shifts (Koh et al., 2021) · Reference v1.1.0

Core concept supported. The cited datasets do not establish reliability of an AI artifact attribution method.

Domain shift

A difference between the conditions represented in development or evaluation and those in use.

In practice. A detector trained on clean images may encounter screenshots with overlays. Test the acquired input conditions or state the gap before assigning a score the meaning established on the original population.

Further reading: WILDS: A Benchmark of in-the-Wild Distribution Shifts (Koh et al., 2021) · Reference v1.1.0

Core concept supported. The cited datasets do not establish reliability of an AI artifact attribution method.

Email verification

A check that demonstrates access to an email address under stated conditions.

In practice. It supports control of that address at the check time. It does not independently establish the account holder's real-world identity, authority to represent an institution, or competence in forensic examination.

Further reading: NIST SP 800-63B-4: Authentication and Authenticator Management · Reference v1.1.0

Limited supporting context. Email control, session possession, credential status, and human identity are separate; broader application session semantics vary.

Embedded manifest

A provenance manifest stored inside an asset's format or container.

In practice. An export can remove the manifest while retaining visible content. Compare versions and workflow records; absence from the circulated file does not establish that an original never had credentials or that the content is nonsynthetic.

Further reading: C2PA 2.4 Technical Specification · Reference v1.1.0

Core concept supported. Validation does not establish factual truth, full history, or consent.

Embedding

A numerical representation used by a system to encode properties or relationships of data. Similarity in that representation is method-dependent.

In practice. Similarity depends on the model and representation. Two neighboring vectors may help retrieve related passages but do not alone prove copying, shared authorship, or factual agreement between the passages.

Further reading: Machine Learning Glossary · Reference v1.1.0

Limited supporting context. A Transformer paper is not a complete definition of every LLM or multimodal deployment.

Evaluation dataset

A collection used to measure performance under a defined evaluation procedure.

In practice. State how items were selected, labeled, and separated from training material. A useful score still applies only to the tested conditions and does not guarantee the same error rate on an unknown case population.

Further reading: WILDS: A Benchmark of in-the-Wild Distribution Shifts (Koh et al., 2021) · Reference v1.1.0

Core concept supported. The cited datasets do not establish reliability of an AI artifact attribution method.

Evidence contamination

Introduction of changes or outside material that can affect evidence interpretation.

In practice. Opening a project can create new cache files or timestamps. Record examiner actions and controlled comparisons so that collection artifacts are not attributed to the historical user or original generation workflow.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Limited supporting context. These bounded editorial formulations are not quoted NIST definitions of every named term.

Evidence identifier

A stable label connecting an object or source to examination and reporting records.

In practice. Assign identifiers to originals and derivatives separately. A timeline entry can then point to the exact source row and transformation record, allowing another examiner to check how the statement was produced.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Core concept supported. The source supplies general forensic practice; the AI-export examples are editorial applications.

Evidence inventory

An organized list of acquired sources and objects with identifiers and collection context.

In practice. List a conversation export, its attachments, and an API audit file as separate items. Record their relationships so that two copies of one event are not mistaken for independent corroboration.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Core concept supported. The source supplies general forensic practice; the AI-export examples are editorial applications.

Evidence reconstruction

An account of events and relationships derived from surviving evidence, with source references, gaps, and alternative histories made explicit.

In practice. Build the account from identified source records. If a missing interval permits several histories, preserve those alternatives instead of supplying a plausible sequence as though it were recovered.

Forensic significance. Keep uncertain ordering and missing links visible in the reported history.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Limited supporting context. These bounded editorial formulations are not quoted NIST definitions of every named term.

Execution trace

Records of steps performed during a program or agent run.

In practice. A trace can link tool requests to reported results, but its completeness depends on instrumentation. Corroborate consequential changes with target-system evidence rather than assuming every trace entry describes a successful effect.

Further reading: NIST SP 800-53 Rev. 5 — control catalog · Reference v1.1.0

Limited supporting context. API payloads and agent traces vary by implementation, and the record set may be incomplete or alterable.

Exfiltration

Unauthorized movement of information out of its permitted environment.

In practice. A forensic account needs evidence of the information, destination, transfer, and authorization boundary. A suspicious URL or proposed upload alone cannot establish that protected content actually left the system.

Further reading: RFC 9110 — HTTP Semantics · Reference v1.1.0

Limited supporting context. An attempted request is not a completed transfer; labeling a transfer unauthorized requires the applicable policy and evidence.

EXIF metadata

Structured metadata commonly associated with image capture and editing workflows.

In practice. An EXIF camera label is a recorded assertion that can survive copying or be modified. Compare it with file structure, provenance, and independent source records before treating it as proof of capture by that camera.

Further reading: PNG Specification — Third Edition · Reference v1.1.0

Limited supporting context. PNG storage is one context; tag meanings and validity in other formats require their specifications.

Exit status

A code or state returned when a process or operation ends.

In practice. Zero can indicate success under a program's rules without proving every desired outcome. Validate the tool's semantics and inspect the relevant output or external state before concluding that the agent's task was fulfilled.

Further reading: Python — subprocess management · Reference v1.1.0

Core concept supported. Process success can be narrower than the intended application or external-system effect.

Face reenactment

Modification or synthesis of facial movement or expression using another performance or control signal.

In practice. A face may retain identity appearance while its expressions are changed. Examine the relevant temporal sequence and creation records; a single still frame can conceal the movement relationships the method is meant to test.

Further reading: Face2Face: Real-time Face Capture and Reenactment of RGB Videos (Thies et al., 2016) · Reference v1.1.0

Core concept supported. The paper’s method is not proof of how a specific video was produced.

Face swap

Replacement or alteration of a depicted face using another identity representation.

In practice. Compare source media, edit records, and timing rather than relying only on visual artifacts. A depicted resemblance can support a content question without identifying the person who operated the software.

Further reading: FaceForensics++: Learning to Detect Manipulated Facial Images (Rössler et al.) · Reference v1.1.0

Limited supporting context. A temporal pattern can have ordinary encoding or capture causes; the benchmark does not validate every such observation.

False negative

A negative classification when the tested proposition is present, measured relative to defined ground truth and evaluation conditions.

In practice. Record what the positive class contains and how it was labeled. A missed compressed synthetic image is different from a test excluding such inputs; describe the coverage before applying the measured rate.

Further reading: Metrics and scoring: quantifying the quality of predictions · Reference v1.1.0

Core concept supported. Evaluation labels, population, threshold, and class convention determine interpretation; case performance is not guaranteed.

False positive

A positive classification when the tested proposition is absent, measured relative to defined ground truth and evaluation conditions.

In practice. Report the tested negative class and denominator. Ordinary camera images with editing may produce different error conditions from untouched negatives, so a published rate needs relevant population context.

Further reading: Metrics and scoring: quantifying the quality of predictions · Reference v1.1.0

Core concept supported. Evaluation labels, population, threshold, and class convention determine interpretation; case performance is not guaranteed.

File carving

Recovery of candidate file content from storage using structure or recognizable patterns.

In practice. A carved image may have lost its original filename and folder relationship. Validate its boundaries and label missing context instead of assigning it to a conversation solely because it resembles an attachment.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Core concept supported. A header or candidate recovery is not a complete format validation or an application association.

File container

A format that holds one or more streams, objects, or metadata structures.

In practice. A video container can hold audio, video, subtitles, and timing information. Document which components an extraction preserves, because converting the visible video alone may discard useful context.

Further reading: Media container formats · Reference v1.1.0

Core concept supported. Format recognition alone does not validate a whole file or identify its source.

File signature

A recognizable byte pattern used to identify a possible file format.

In practice. A JPEG header can identify a candidate format even when the filename ends in .bin. Validate the whole structure; a matching prefix alone does not prove the file is complete or safe to parse.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Core concept supported. A header or candidate recovery is not a complete format validation or an application association.

Filesystem metadata

Filesystem records about objects, such as names, locations, permissions, and recorded times.

In practice. A modification time describes a filesystem event under that system's rules. Compare it with application and transfer records before interpreting it as the time an AI output was originally generated.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Limited supporting context. Application-specific time meanings, clock offsets, and reconstruction rules must be established separately.

Fine-tuning

Additional training that modifies a model or adaptation component; its records may help establish a deployment’s lineage.

In practice. Distinguish updated weights from adapters and configuration changes. Preserve the accessible inputs and resulting components so model lineage claims remain tied to actual records rather than names alone.

Further reading: Machine Learning Glossary · Reference v1.1.0

Core concept supported. The project’s forensic applications and a deployment’s actual lineage are not independently established.

Forensic artifact

A digital object or residual record examined for its potential evidentiary meaning in a defined context.

In practice. Validate how the application creates and changes the record before assigning meaning. A field named created_at might refer to import or local storage rather than the historical creation of the underlying content.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Limited supporting context. These bounded editorial formulations are not quoted NIST definitions of every named term.

Forensic working copy

A copy designated for examination while preserving a documented reference source.

In practice. Verify the copy against the recorded source digest before analysis. If analysis changes it, retain that result as a derivative with its own identifier rather than silently replacing the reference copy.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Core concept supported. A preserved copy or custody record does not establish content truth or collection completeness.

Frame rate

The rate at which video frames are represented or presented.

In practice. Variable frame timing and later conversion can complicate event ordering. Inspect timestamps and the container's timing rules instead of assuming every frame is separated by the reciprocal of one displayed rate.

Further reading: Web video codec guide · Reference v1.1.0

Limited supporting context. Presentation rate, frame timestamps, retained metadata, and conversion effects need format-specific examination.

Function calling

A model interface pattern for selecting named functions and structured arguments.

In practice. The model's argument proposal is distinct from application execution. Identify which component validates, authorizes, and runs the call so that a structured response is not mistaken for proof of an action.

Further reading: Machine Learning Glossary · Reference v1.1.0

Limited supporting context. Not every agent uses MCP, and a function schema is not proof of execution.

Generation seed

A value used to initialize a pseudorandom process in a generation workflow.

In practice. Record it with the model, software, sampler, and configuration. The same seed can yield different outputs after an environment or model change, so it is one reproducibility input rather than a universal output identifier.

Further reading: Diffusers — Reproducibility · Reference v1.1.0

Core concept supported. A seed alone is not a complete replay specification; implementation, hardware, and other inputs can matter.

Generative adversarial network

A model framework involving a generator and a discriminator trained in relation to one another.

In practice. The discriminator used during training is not automatically a forensic detector. Evaluate any examination method on the actual output conditions, including later processing and sources outside the training population.

Further reading: Generative Adversarial Nets (Goodfellow et al., 2014) · Reference v1.1.0

Core concept supported. Output appearance alone cannot identify use of the architecture.

Generative AI

An AI system used to produce outputs such as text, images, audio, video, or code from inputs and learned relationships.

In practice. Outputs reflect a model operating within a larger application. Prompts, retrieval, settings, tools, filtering, and later edits can all matter when reconstructing a particular generated result.

Further reading: NIST AI 100-4: Reducing Risks Posed by Synthetic Content · Reference v1.1.0

Core concept supported. NIST’s overview does not certify any detector, watermark, or conclusion on a case object.

Generative artifact

A generated output or associated record connected to a generative-system workflow.

In practice. A render, intermediate file, and job receipt can all belong to one generation. Give each an identifier and test their relationships instead of counting them as independent proof of the same event.

Forensic significance. Preserve inputs and provenance where available instead of inferring a complete workflow from one output.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Editorial definition. These are editorial definitions or application-dependent records, not terms standardized by the cited publications; examples are hypothetical and historical behavior must be demonstrated.

Ground truth

Reference labels or outcomes used as the basis for a defined test.

In practice. Document how the labels were established and what they actually mean. A file marked synthetic may represent generation, editing, or redistribution, and those differences can materially change a detector's evaluated claim.

Further reading: Machine Learning Glossary · Reference v1.1.0

Core concept supported. The project’s forensic applications and a deployment’s actual lineage are not independently established.

Guidance scale

A parameter controlling the influence of conditioning in some generation systems.

In practice. Its behavior depends on the model and implementation. Report the recorded setting as workflow context, without treating a particular value as a recognizable visual signature or a measure of factual reliability.

Further reading: Diffusers — Stable Diffusion image-to-image pipeline · Reference v1.1.0

Core concept supported. These are implementation-specific parameter meanings; they do not prove the settings of an unknown historical run.

Hard binding

A cryptographic relationship tying provenance information to specified asset content.

In practice. Check which parts of the asset the binding covers and how exclusions are handled. Successful validation supports that defined relationship, not an unrestricted claim about every byte, prior version, or real-world event.

Further reading: C2PA 2.4 Technical Specification · Reference v1.1.0

Core concept supported. Their validity and tolerance are scheme specific; neither guarantees the scene is true.

Hash collision

Different inputs producing the same digest under a hash function.

In practice. Collision resistance is a property of an algorithm and threat context. Select an appropriate integrity method and retain collection records; a digest is evidence of byte comparison rather than a complete provenance account.

Further reading: FIPS 180-4: Secure Hash Standard · Reference v1.1.0

Core concept supported. Algorithm properties alone do not authenticate origin, establish custody, or exclude all collisions.

Hash digest

The fixed-length result of applying a stated hash algorithm to bytes.

In practice. Record the algorithm and acquired object along with the digest. Matching SHA-256 values support byte equality under the method; they do not show who created the object or whether its claims are true.

Further reading: FIPS 180-4: Secure Hash Standard · Reference v1.1.0

Core concept supported. Algorithm properties alone do not authenticate origin, establish custody, or exclude all collisions.

Hash verification

Comparison of a computed digest with a documented reference digest.

In practice. Verify evidence after a transfer to detect byte changes. A mismatch calls for investigation of scope, encoding, corruption, or modification; it does not alone tell you which explanation caused the difference.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Core concept supported. The result is a bounded byte-integrity statement, not a truth or authorship finding.

Human-AI interaction

An exchange between a person and an AI-enabled system, including available context, responses, revisions, and associated actions.

In practice. Preserve the exchange with its uploads, revisions, and relevant context. A visible question and final answer can leave out the branches or external actions needed to understand what happened.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Editorial definition. These are editorial definitions or application-dependent records, not terms standardized by the cited publications; examples are hypothetical and historical behavior must be demonstrated.

Hyperparameter

A setting controlling a training or computation process rather than a fitted parameter.

In practice. A learning rate or batch size can help explain adaptation conditions. Record the actual setting and stage rather than assuming a common default was used when the historical configuration is unavailable.

Further reading: Machine Learning Glossary · Reference v1.1.0

Core concept supported. The project’s forensic applications and a deployment’s actual lineage are not independently established.

Idempotency

A property in which repeating an operation has the same relevant effect as applying it once.

In practice. The property depends on the specific interface and state. Record idempotency keys and service semantics when interpreting retries; repeated requests do not necessarily create repeated objects, but some operations do.

Further reading: RFC 9110 — HTTP Semantics · Reference v1.1.0

Core concept supported. Do not infer idempotency from a method name or apply HTTP guarantees to an unrelated tool.

Identity claim

A statement that a person, account, or representation corresponds to a specified identity.

In practice. A profile name and a verified email answer different questions. Document exactly what was checked before treating an identity label as evidence of expertise, legal identity, or control of another account.

Further reading: NIST SP 800-63A-4: Identity Proofing and Enrollment · Reference v1.1.0

Core concept supported. Proofing and authentication policies do not retrospectively identify every human actor in a case.

Identity fusion

Combining generated, invented, or borrowed identity elements into a composite representation.

In practice. Describe which identity elements are documented as borrowed, generated, or invented. A composite representation does not automatically reveal common account control or the real-world identity of its creator.

Further reading: Synthetic Identity Fraud Defined · Reference v1.1.0

Editorial definition. The established fraud definition includes dishonest gain; it does not classify every fictional or AI-generated persona as fraud.

Identity linkage

An evidence-supported relationship among accounts, identities, or representations.

In practice. State whether the link concerns shared content, contact details, access infrastructure, or an operator. Each has a different strength and scope; one repeated avatar does not settle personal identity.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Limited supporting context. The glossary’s account/operator distinctions are editorial; no universal source-identification method is validated.

Identity proofing

A process for assessing evidence that connects an applicant to a claimed identity.

In practice. Its assurances depend on the process and evidence used. Keep it separate from email verification and professional qualification, and record the specific checks rather than describing every verified account as identity-proven.

Further reading: NIST SP 800-63A-4: Identity Proofing and Enrollment · Reference v1.1.0

Core concept supported. Proofing and authentication policies do not retrospectively identify every human actor in a case.

Image synthesis

Computational creation of an image from learned or procedural representations.

In practice. A generated picture can later be edited and photographed from a screen. Examine the acquired version and available workflow records; visual plausibility does not establish camera origin or identify the generation system.

Further reading: NIST AI 100-4: Reducing Risks Posed by Synthetic Content · Reference v1.1.0

Core concept supported. NIST’s overview does not certify any detector, watermark, or conclusion on a case object.

Image-to-image generation

Creation or transformation of an image using another image as an input.

In practice. An output may retain some source composition while altering details. Compare preserved input and output objects and transformation records; similarity alone cannot determine whether the process was generative, manual, or a combination.

Further reading: Diffusers — Stable Diffusion image-to-image pipeline · Reference v1.1.0

Core concept supported. These are implementation-specific parameter meanings; they do not prove the settings of an unknown historical run.

Impersonation

Representation or use of an identity in a manner that purports to be another person or entity; operator attribution remains a separate question.

In practice. Identify the representation and who it purports to be. A resemblance or misleading account name may support a content observation, while intent, distribution, and operator attribution require additional evidence.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Limited supporting context. The glossary’s account/operator distinctions are editorial; no universal source-identification method is validated.

Impersonation artifact

An object or record relevant to a representation purporting to be another identity.

In practice. A cloned voice clip, profile image, and registration event can support different parts of the account. Preserve their relationships and distinguish depicted identity from source creator, distributor, and controlling operator.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Limited supporting context. The glossary’s account/operator distinctions are editorial; no universal source-identification method is validated.

IndexedDB

A browser database interface used by applications to store structured objects.

In practice. An application may retain conversation objects in IndexedDB. Inspect the relevant origin, schema, and version; the API's existence does not mean a particular application stores prompts or keeps deleted material there.

Further reading: Indexed Database API 3.0 · Reference v1.1.0

Core concept supported. The cited API 3.0 document is a specification draft; application schema and retention are separate.

Indirect prompt injection

A redirection attempt carried through material a system reads, such as a retrieved page or document.

In practice. Preserve the encountered material and retrieval context. A webpage can contain hostile wording without the system obeying it, so reconstruction must link exposure to observed actions and consider other explanations.

Further reading: LLM01:2025 Prompt Injection · Reference v1.1.0

Core concept supported. Presence of instructions does not establish compliance or a downstream effect.

Inference

A reasoned interpretation supported by evidence and stated assumptions, rather than a directly observed fact.

In practice. Show the observations and assumptions supporting the step beyond direct measurement. Keep reasonable alternatives visible so another reader can assess whether the conclusion follows under the stated conditions.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Limited supporting context. These bounded editorial formulations are not quoted NIST definitions of every named term.

Inference runtime

Software and configuration that execute a model's computations.

In practice. Runtime versions and hardware can affect reproducibility. Preserve the environment when accessible, and distinguish known local conditions from a hosted service's undisclosed infrastructure rather than inventing missing implementation detail.

Further reading: Transformers — Configuration · Reference v1.1.0

Limited supporting context. Endpoint aliases, labels, routing, and historical runtime identity need independently acquired records.

Inpainting

Replacing or generating content inside a selected region of an image.

In practice. A changed region may coexist with camera-origin pixels elsewhere. State which proposition concerns which region, and retain masks or edit records when available rather than classifying the entire image's history from one local signal.

Further reading: Diffusers — Stable Diffusion inpainting pipeline · Reference v1.1.0

Core concept supported. The result supplies generated content, not independently recovered original detail.

Integrity

A property assessed through checks of whether an object or record changed relative to a reference. It is distinct from origin and factual accuracy.

In practice. Compare acquired bytes against a specified reference and method. A preserved file can contain false information; demonstrating no detected change is separate from demonstrating origin or factual accuracy.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Core concept supported. The result is a bounded byte-integrity statement, not a truth or authorship finding.

Interaction forensics

Reconstruction of human-AI exchanges, their context, revisions, branches, tool activity, and downstream consequences from evidence.

In practice. Reconstruct the exchange as linked events rather than flattening every response into one conversation. State which branch was retained or displayed and where missing context limits the account.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Editorial definition. These are editorial definitions or application-dependent records, not terms standardized by the cited publications; examples are hypothetical and historical behavior must be demonstrated.

Interpretation

An explanation of what an observed artifact may mean within a stated system, method, and context.

In practice. Explain the system-specific meaning assigned to an observation. Test a timestamp field’s behavior, for example, before using its name to infer when a user created the underlying message.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Limited supporting context. These bounded editorial formulations are not quoted NIST definitions of every named term.

Job queue

A system that holds work for later processing.

In practice. A queued task is not yet a completed operation. Examine scheduling, worker records, cancellation, and results to establish what occurred, particularly when requests were accepted shortly before a service interruption.

Further reading: Python — queue · Reference v1.1.0

Core concept supported. A library queue is one implementation; distributed queues may have different delivery guarantees.

JPEG quantization

A JPEG encoding process that reduces precision in transformed image coefficients.

In practice. Quantization can influence visible artifacts and signal measurements. Record the actual encoding evidence and comparison conditions; similar tables may arise from common software rather than a unique camera or generator.

Further reading: ITU-T T.81 / ISO/IEC 10918-1 — JPEG · Reference v1.1.0

Core concept supported. Lossy transformations affect method-specific signals; they do not by themselves identify AI generation.

Keyframe

A frame that serves as a reference within a video encoding structure.

In practice. Extraction tools can seek to a nearby keyframe rather than the exact requested moment. Document decoding and time selection when an analysis depends on a particular frame or the onset of a depicted action.

Further reading: Web video codec guide · Reference v1.1.0

Limited supporting context. Presentation rate, frame timestamps, retained metadata, and conversion effects need format-specific examination.

Large language model

A model trained to process and generate language-related sequences; deployment behavior also depends on context, configuration, and surrounding systems.

In practice. A hosted model name does not reveal every deployment detail. Use actual configuration or service evidence where available, and avoid attributing an output to one model solely through writing style.

Further reading: Machine Learning Glossary · Reference v1.1.0

Limited supporting context. A Transformer paper is not a complete definition of every LLM or multimodal deployment.

Latent representation

An internal numerical representation used by a model to encode information.

In practice. A saved latent can connect stages of a generation workflow if its source is documented. Similar latent coordinates or output resemblance do not by themselves establish a shared creator or identical generation history.

Further reading: High-Resolution Image Synthesis with Latent Diffusion Models (Rombach et al.) · Reference v1.1.0

Core concept supported. An acquired latent or image does not identify its whole creation history.

Least privilege

Granting only the permissions required for a stated task or role.

In practice. An agent can read a resource while lacking authority to modify it. Compare the historical permission state with attempted and observed actions when examining whether a workflow crossed its intended access boundary.

Further reading: NIST SP 800-53 Rev. 5 — control catalog · Reference v1.1.0

Core concept supported. A control description is not evidence that an application enforces it or that a particular operation completed.

Lip synchronization

Alignment of mouth movements with speech, whether captured, edited, or generated.

In practice. Mismatch can result from ordinary dubbing or playback issues as well as synthesis. Assess audio and video timing and acquisition transformations before interpreting a synchronization anomaly as evidence of a deepfake.

Further reading: A Lip Sync Expert Is All You Need for Speech to Lip Generation In The Wild (Prajwal et al.) · Reference v1.1.0

Core concept supported. Good alignment does not establish authentic capture or consent.

Live acquisition

Collection performed while a system is running.

In practice. Capturing a running application's memory can preserve temporary state, but the collection itself changes the environment. Record the order of actions and explain why volatile material matters to the question.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Core concept supported. Available evidence and collection effects require environment-specific validation.

Liveness detection

A check intended to distinguish a live presentation from specified nonlive or manipulated inputs.

In practice. Its effectiveness depends on the modality, challenge, and tested attack conditions. Record what the check actually establishes rather than assuming a successful result rules out every replay or synthetic presentation.

Further reading: NIST SP 800-63A-4: Identity Proofing and Enrollment · Reference v1.1.0

Core concept supported. Proofing and authentication policies do not retrospectively identify every human actor in a case.

LocalStorage

A browser mechanism for retaining string key-value data for an origin.

In practice. A key may contain preferences or an account reference rather than a transcript. Preserve and interpret it within the application's version and origin, and avoid exposing authentication values in a public report.

Further reading: HTML Standard — Web storage · Reference v1.1.0

Core concept supported. Application-defined sessions are not necessarily browser page sessions.

Logical acquisition

Collection of selected files, records, or objects through a filesystem or application interface.

In practice. Downloading a conversation is a logical acquisition. It may preserve visible messages while excluding internal identifiers, deleted branches, and application state. Describe the selection rather than calling it a complete device image.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Limited supporting context. Application and cloud-object acquisition extend beyond the source’s logical-backup example.

LoRA

Low-Rank Adaptation, a method for adapting a model through additional low-rank parameter components.

In practice. An acquired LoRA component needs its compatible base and runtime context for reproduction. Its filename or author label is a provenance assertion, while byte identity and historical use require separate supporting records.

Further reading: LoRA: Low-Rank Adaptation of Large Language Models (Hu et al.) · Reference v1.1.0

Core concept supported. The paper does not prove that a particular acquired deployment used LoRA.

Lossless compression

Compression designed to preserve the encoded input information on decoding.

In practice. Lossless handling can preserve pixel or sample data while a surrounding export changes metadata. Define which representation is compared; unchanged decoded content is a different proposition from identical file bytes.

Further reading: PNG Specification — Third Edition · Reference v1.1.0

Core concept supported. The underlying signal, model precision, and other formats require their own semantics.

Lossy compression

Compression that discards some information according to an encoding method.

In practice. A social-media upload can remove details or create artifacts. Compare the acquired object's processing history with tested controls before interpreting those artifacts as generation traces or relying on a detector evaluated only on originals.

Further reading: ITU-T T.81 / ISO/IEC 10918-1 — JPEG · Reference v1.1.0

Core concept supported. Lossy transformations affect method-specific signals; they do not by themselves identify AI generation.

Magic bytes

Characteristic bytes, often near the beginning of a file, that help identify its format.

In practice. A format check can expose an incorrect extension before analysis. Retain the original filename in the inventory while separately recording the format supported by the acquired bytes and parser results.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Core concept supported. A header or candidate recovery is not a complete format validation or an application association.

Manifest

A structured record describing claims, references, or relationships associated with an object or release. Its meaning depends on the manifest format.

In practice. Read it under its own format and scope. A release manifest lists artifacts and hashes; a content-provenance manifest carries assertions. Similar names do not give these records identical assurances.

Further reading: C2PA 2.4 Technical Specification · Reference v1.1.0

Limited supporting context. A generic manifest has format-specific semantics; neither source defines every release manifest.

MCP

Model Context Protocol, a protocol for connecting applications with tools and related capabilities. Durable logging depends on the implementation.

In practice. Record protocol revision, tool identifiers, arguments, and results where available. The protocol defines interactions, but durable audit records and permission enforcement depend on the particular client and server implementation.

Further reading: Model Context Protocol: Tools, specification 2025-11-25 · Reference v1.1.0

Core concept supported. The protocol does not guarantee durable logs or independent target-system success.

Media lineage

Documented relationships among source, edited, generated, and distributed media versions.

In practice. A screenshot, repost, and original file can depict similar content while having different histories. Identify each object and link transitions to evidence, leaving unsupported relationships explicitly unresolved.

Further reading: PROV-DM: The PROV Data Model · Reference v1.1.0

Limited supporting context. These field-specific formulations are editorial; a missing relationship is not proven concealment.

Message identifier

An application-defined value used to refer to a message.

In practice. Use it to connect exports, attachments, and branch records when the source supports that relationship. Identifier order need not represent time, and the same-looking value may have different scopes across platforms.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Editorial definition. These are editorial definitions or application-dependent records, not terms standardized by the cited publications; examples are hypothetical and historical behavior must be demonstrated.

Metadata

Data describing properties or context of another object or record. It can be incomplete, altered, or assigned by a later workflow.

In practice. Preserve raw values and identify their producer. A camera label, export time, or account identifier can be useful without being infallible; compare consequential interpretations with independent source records.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Limited supporting context. Application-specific time meanings, clock offsets, and reconstruction rules must be established separately.

Model adapter

A component that modifies or supplements a model's behavior without necessarily replacing all base weights.

In practice. Preserve the adapter, base-model identifier, and loading configuration where accessible. A deployment can combine components dynamically, so an adapter file alone does not establish which configuration produced a particular response.

Further reading: Parameter-Efficient Transfer Learning for NLP (Houlsby et al., 2019) · Reference v1.1.0

Core concept supported. The paper studies particular NLP adapters, not every modification or deployment.

Model attribution

An assessment linking evidence to a model, version, family, or deployment, with the level and uncertainty made explicit.

In practice. Test known alternatives and sources outside the candidate set. A classifier forced to choose one listed model can return a confident label even when another model produced the object.

Forensic significance. Style similarity and self-reported model names need independent support.

Further reading: Towards Open World Recognition (Bendale & Boult) · Reference v1.1.0

Limited supporting context. The recognition study is not validation of generative-model attribution or source identification from output style.

Model checkpoint

A saved model state associated with a point in training or adaptation.

In practice. A checkpoint label may describe a stage without uniquely identifying its bytes. Preserve hashes and training records where available, and distinguish a locally acquired checkpoint from a service's advertised model name.

Further reading: PyTorch — Saving and Loading Models · Reference v1.1.0

Core concept supported. Checkpoint scope varies; a saved file does not establish use in a particular interaction.

Model configuration

Settings defining how a model is instantiated or used in a deployment.

In practice. Architecture settings, sampling rules, and enabled components can affect outputs. Preserve actual configuration rather than relying on a product label, and identify which settings were documented versus recovered from the examined environment.

Further reading: Transformers — Configuration · Reference v1.1.0

Core concept supported. A supplied configuration is not independent proof of historical deployment settings.

Model forensics

Examination of evidence about model identity, configuration, lineage, integrity, and modification in a deployment.

In practice. Collect accessible weights, adapters, configuration, runtime records, and deployment identifiers. Explain the evidence available for identity and lineage separately from any behavioral conclusions drawn from test outputs.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Editorial definition. These are editorial definitions or application-dependent records, not terms standardized by the cited publications; examples are hypothetical and historical behavior must be demonstrated.

Model lineage

The documented relationships between a model and its predecessors, modifications, adapters, or derived deployments.

In practice. Trace documented predecessors and adaptations without treating similar output style as ancestry. Record unknown relationships and distinguish a vendor’s stated lineage from file-level comparisons or reproducible training evidence.

Further reading: PROV-DM: The PROV Data Model · Reference v1.1.0

Limited supporting context. These field-specific formulations are editorial; a missing relationship is not proven concealment.

Model provenance

Recorded information about a model’s sources, lineage, modifications, distribution, and deployment history.

In practice. Trace the documented base model, adaptations, and deployed components. Labels and release notes are sources of claims, while acquired files and hashes can support more specific integrity comparisons.

Further reading: PROV-DM: The PROV Data Model · Reference v1.1.0

Limited supporting context. These field-specific formulations are editorial; a missing relationship is not proven concealment.

Model version

A label or identifier used to distinguish a model release or deployment state.

In practice. A vendor can update behavior behind a stable label. Record dates, available revision identifiers, and supporting service records, and avoid treating an output's style as a reliable substitute for version evidence.

Further reading: Transformers — Configuration · Reference v1.1.0

Limited supporting context. Endpoint aliases, labels, routing, and historical runtime identity need independently acquired records.

Model weights

Numerical parameters used by a model in its computations.

In practice. A preserved weight file can support an identity and integrity comparison. Record format, digest, and surrounding configuration, since the same weights can behave differently under different runtimes, prompts, or adaptation components.

Further reading: Machine Learning Glossary · Reference v1.1.0

Core concept supported. The project’s forensic applications and a deployment’s actual lineage are not independently established.

Multi-factor authentication

Authentication requiring factors from more than one defined category.

In practice. Record the actual factor checks when examining access. The label does not by itself prove who operated a session or prevent every compromise, and a later session can persist beyond the original authentication event.

Further reading: NIST SP 800-63B-4: Authentication and Authenticator Management · Reference v1.1.0

Limited supporting context. Email control, session possession, credential status, and human identity are separate; broader application session semantics vary.

Multimodal

Involving more than one data modality, such as text, image, audio, or video, within a system or workflow.

In practice. Identify which modality carries each observation. A text transcript, image attachment, and audio stream can be related while differing in timing, retained context, and what the model actually received.

Further reading: Machine Learning Glossary · Reference v1.1.0

Limited supporting context. A Transformer paper is not a complete definition of every LLM or multimodal deployment.

Negative prompt

An input describing features a generation system is asked to avoid.

In practice. It can help explain intended conditioning but not necessarily the final output. Preserve its relationship to the actual generation request, and distinguish it from later image analysis or a user's explanation of intent.

Further reading: Diffusers — Stable Diffusion image-to-image pipeline · Reference v1.1.0

Core concept supported. These are implementation-specific parameter meanings; they do not prove the settings of an unknown historical run.

Network request

An attempted or observed exchange with a network destination under a protocol.

In practice. A request can be redirected, retried, or rejected. Preserve destination, timing, identifiers, and response context while protecting secrets; network contact alone does not establish successful transfer of a particular object.

Further reading: RFC 9110 — HTTP Semantics · Reference v1.1.0

Limited supporting context. An attempted request is not a completed transfer; labeling a transfer unauthorized requires the applicable policy and evidence.

Observation

What was directly found or measured in an examined source, identified without adding an unstated interpretation.

In practice. Use precise source references and raw values. State that an export contains a named field before interpreting what the field means or attributing the recorded action to a person.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Limited supporting context. These bounded editorial formulations are not quoted NIST definitions of every named term.

Operator attribution

An assessment connecting a system's activity to the person or organization controlling it.

In practice. It requires evidence beyond a depicted face, voice resemblance, or account label. State the supported level and alternatives, especially when automation, delegation, or account compromise could explain the observed event.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Limited supporting context. The glossary’s account/operator distinctions are editorial; no universal source-identification method is validated.

Origin claim

A statement about where an object, record, or event came from.

In practice. Specify whether it concerns camera capture, model generation, account export, or distribution. Those propositions require different evidence, and one supported origin statement cannot automatically settle the others.

Further reading: C2PA 2.4 Technical Specification · Reference v1.1.0

Core concept supported. Validation of an assertion is distinct from factual truth and completeness.

Outpainting

Generating image content beyond an existing image boundary.

In practice. A wider version can include invented surroundings while preserving an original center. Identify the acquired versions and expansion records so that the added scene is not interpreted as evidence of what the camera captured.

Further reading: High-Resolution Image Synthesis with Latent Diffusion Models (Rombach et al.) · Reference v1.1.0

Limited supporting context. The exact outside-boundary workflow is editorial and implementation dependent; the source is not asserted to define every outpainting interface.

Overfitting

Learning or tuning that fits particular data patterns without adequate generalization.

In practice. A detector can perform well on its development corpus and poorly after new compression or generator changes. Evaluate relevant held-out conditions and avoid equating one strong benchmark with dependable performance everywhere.

Further reading: Machine Learning Glossary · Reference v1.1.0

Core concept supported. The project’s forensic applications and a deployment’s actual lineage are not independently established.

Parent message

A message linked as a predecessor in an application's conversation structure.

In practice. A parent link can reveal branches that a flattened transcript hides. Validate the application's semantics and preserve the original relationship before arranging messages into one apparently continuous exchange.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Editorial definition. These are editorial definitions or application-dependent records, not terms standardized by the cited publications; examples are hypothetical and historical behavior must be demonstrated.

Parent process

A process identified as creating or launching another process under operating-system semantics.

In practice. A parent relationship helps reconstruct execution but may be affected by wrappers or reparenting. Record the relevant platform and timing before equating the process tree with the agent's complete delegation structure.

Further reading: Linux man-pages — fork(2) · Reference v1.1.0

Core concept supported. Check the actual operating system, identifier lifetime, and reuse before correlating records.

Perceptual hash

A compact representation intended to compare similarity under a particular perceptual method.

In practice. It can help locate related images after resizing, but it is not an integrity digest. Record thresholds and check candidate matches manually or with independent comparisons before claiming two items share a source.

Further reading: OpenCV — image hashing module · Reference v1.1.0

Core concept supported. Perceptual similarity is not cryptographic byte identity or source attribution.

Permission boundary

A limit separating actions an actor or process is authorized to perform.

In practice. Record the effective permissions for the examined interval. A successful operation may use a service account or delegated token, so its occurrence does not automatically establish that a human user had the same access.

Further reading: NIST SP 800-53 Rev. 5 — control catalog · Reference v1.1.0

Core concept supported. A control description is not evidence that an application enforces it or that a particular operation completed.

Persistence

Retention or survival of a record across actions or state changes under specified conditions; it requires environment-specific testing.

In practice. Test creation, closure, deletion, and synchronization under a recorded environment. A record surviving one condition does not establish that it survives every platform version or retention setting.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Limited supporting context. The retained records and eviction behavior of a particular product remain unvalidated.

Precision

The proportion of positive classifications that are correct within a defined evaluation population.

In practice. Precision changes with class prevalence and the decision threshold. State the population and counts so readers do not confuse it with sensitivity or assume a published value transfers unchanged to another setting.

Further reading: Metrics and scoring: quantifying the quality of predictions · Reference v1.1.0

Core concept supported. Evaluation labels, population, threshold, and class convention determine interpretation; case performance is not guaranteed.

Presentation attack

An attempt to mislead a biometric or identity-check system through a presented artifact.

In practice. A printed face, replayed recording, and generated video are different conditions. Evaluate the actual mechanism and source records before assigning a detector alert a specific attack type or operator.

Further reading: NIST SP 800-63A-4: Identity Proofing and Enrollment · Reference v1.1.0

Core concept supported. Proofing and authentication policies do not retrospectively identify every human actor in a case.

Preservation

Documented measures to reduce evidence alteration or loss, while recording unavoidable effects and handling.

In practice. Prioritize relevant volatile sources and limit unnecessary change. Record protective measures and unavoidable effects rather than claiming that collection left an active application or remote service completely untouched.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Core concept supported. A preserved copy or custody record does not establish content truth or collection completeness.

Process identifier

An operating-system identifier associated with a process during a bounded context.

In practice. Identifiers can be reused. Pair them with host, start time, parent process, and collection context when linking commands to agent activity rather than assuming a numeric match uniquely identifies one historical process.

Further reading: Linux man-pages — fork(2) · Reference v1.1.0

Core concept supported. Check the actual operating system, identifier lifetime, and reuse before correlating records.

Prompt

Input supplied to an AI-enabled system at a particular interaction point. It may not include all context presented to the model.

In practice. Preserve the exact recorded input and its source. The user-visible prompt may exclude application instructions or retrieval context, so do not assume it alone explains the response.

Further reading: Transformers — Chat templates · Reference v1.1.0

Limited supporting context. Role priority and application/runtime instructions differ by platform; the user-visible prompt need not be the entire context.

Prompt history

Available records of prompts over an interaction or set of sessions, potentially excluding edits, deleted material, or inaccessible context.

In practice. Inspect edits and branches when the format provides them. A list of current prompts can omit earlier versions, and retained order may reflect export formatting rather than the complete historical sequence.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Editorial definition. These are editorial definitions or application-dependent records, not terms standardized by the cited publications; examples are hypothetical and historical behavior must be demonstrated.

Prompt injection

Input that attempts to redirect an AI system through instructions outside the intended control channel.

In practice. A suspicious instruction in a document supports an input observation, not a confirmed causal effect. Compare subsequent actions, permissions, and independent system records before concluding that the instruction changed the workflow.

Further reading: LLM01:2025 Prompt Injection · Reference v1.1.0

Core concept supported. Presence of instructions does not establish compliance or a downstream effect.

Prompt reconstruction

An evidence-based effort to recover or connect recorded inputs and their context without inventing missing text.

In practice. Recover available records and relationships without guessing missing wording. Explain which text is directly acquired, which is a summary, and which contextual inputs remain inaccessible.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Editorial definition. These are editorial definitions or application-dependent records, not terms standardized by the cited publications; examples are hypothetical and historical behavior must be demonstrated.

Prompt template

A reusable structure used to assemble an input from fixed and variable parts.

In practice. Record both the template version and supplied values when available. The template alone does not establish the exact model input, particularly when retrieved material or system instructions are added later.

Further reading: Transformers — Chat templates · Reference v1.1.0

Limited supporting context. Role priority and application/runtime instructions differ by platform; the user-visible prompt need not be the entire context.

PROV activity

An action or process represented as acting on or producing entities in the PROV model.

In practice. Extraction and redaction can be separate activities with different effects. Describe their inputs, outputs, and conditions so that a reader can understand which transformation supports each derived observation.

Further reading: PROV-DM: The PROV Data Model · Reference v1.1.0

Core concept supported. A PROV agent can be software; it is not automatically an autonomous AI agent or a human operator.

PROV agent

A person, organization, or software participant associated with responsibility in the PROV model.

In practice. A PROV agent is broader than an autonomous AI agent. Label the role precisely so a graph does not confuse a signing service, human examiner, and AI tool-running process.

Further reading: PROV-DM: The PROV Data Model · Reference v1.1.0

Core concept supported. A PROV agent can be software; it is not automatically an autonomous AI agent or a human operator.

PROV entity

A thing represented in the W3C PROV model as the subject of provenance relationships.

In practice. An acquired export and a normalized timeline can be separate entities. Naming both makes the derivation inspectable and prevents the analysis product from being confused with the original application record.

Further reading: PROV-DM: The PROV Data Model · Reference v1.1.0

Core concept supported. A PROV agent can be software; it is not automatically an autonomous AI agent or a human operator.

Provenance

Information about origin, derivation, handling, and transformations, represented through records or assertions whose reliability must be assessed.

In practice. Ask who recorded each relationship and what supports it. A complete-looking diagram can contain unsupported assertions, while a partial but well-documented history can still answer a bounded question.

Further reading: PROV-DM: The PROV Data Model · Reference v1.1.0

Core concept supported. A provenance description is not independent proof that each relationship occurred.

Provenance assertion

A statement about an object's origin, handling, or transformation.

In practice. An application can assert that an image was edited by a named tool. Check the assertion's source, binding, and corroboration rather than treating its presence or signature as self-validating proof of the whole workflow.

Further reading: C2PA 2.4 Technical Specification · Reference v1.1.0

Core concept supported. Validation of an assertion is distinct from factual truth and completeness.

Provenance gap

An interval or relationship in an asserted history that is undocumented, inaccessible, unsupported, or unverifiable.

In practice. Identify the missing relationship and its effect on the proposition. The absence of one export record can reflect retention or unavailable access rather than proving an event did not occur.

Further reading: PROV-DM: The PROV Data Model · Reference v1.1.0

Limited supporting context. These field-specific formulations are editorial; a missing relationship is not proven concealment.

Provenance graph

A graph representing entities, activities, agents, and their asserted history relationships.

In practice. Connect an image to an edit activity and its inputs while marking which edges are supported. A well-formed graph remains an account of claims; missing evidence should not be filled with assumed history.

Further reading: PROV-DM: The PROV Data Model · Reference v1.1.0

Core concept supported. A provenance description is not independent proof that each relationship occurred.

Public key

A shareable key used in specified cryptographic verification or encryption operations.

In practice. A public key can verify a signature, but its association with a person or organization needs a trust basis. Record where that association comes from rather than inferring identity from successful mathematics alone.

Further reading: FIPS 186-5 — Digital Signature Standard · Reference v1.1.0

Core concept supported. Key control, human identity, content truth, and authority to act remain separate propositions.

Quantization

Representation of model values with a reduced or altered numerical precision.

In practice. It can change resource use and behavior. Record the format, conversion tool, and resulting files when comparing deployments, because a quantized derivative is not necessarily behaviorally interchangeable with the original weights.

Further reading: PyTorch — Quantization, version 2.14 documentation · Reference v1.1.0

Core concept supported. Format, scale, and configuration affect behavior and must be identified in the acquired environment.

Race condition

Behavior influenced by the relative timing of concurrent operations.

In practice. Two tasks can observe different states while both records are accurate. Preserve ordering constraints and timing uncertainty, and test the actual environment before assigning a contradiction to tampering or an agent's reasoning failure.

Further reading: CWE-362 — Concurrent Execution using Shared Resource with Improper Synchronization · Reference v1.1.0

Core concept supported. A mismatch alone does not establish that a race caused it.

Read-only access

An access mode designed to prevent specified write operations.

In practice. A read-only filesystem view limits one type of change. It does not guarantee that a running application, remote account, or storage controller remains unchanged; explain the scope of the protection used.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Core concept supported. A write restriction is scoped to its interface; the surrounding running environment can still change.

Reality-model drift

A project working term for a hypothesized change in a person’s understanding of events after information exposure; not an established diagnosis or measured AI effect.

In practice. Describe the hypothesized change and the evidence needed to test it. Avoid using the label to diagnose a person or claiming that one interaction demonstrates a causal AI effect.

Forensic significance. Do not turn a conceptual label into a clinical finding or a claim of validated causation.

Further reading: Source monitoring (Johnson, Hashtroudi & Lindsay, 1993) · Reference v1.1.0

Editorial definition. These operational/working concepts are project editorial formulations; no established diagnosis, measured AI effect, or validated instrument is asserted.

Recall

The proportion of relevant positive cases identified under a defined evaluation; often equivalent to sensitivity.

In practice. Explain the target class and denominator. A retrieval task and a synthetic-media detection task can both report recall while measuring different propositions, so compare results only when their definitions and conditions align.

Further reading: Metrics and scoring: quantifying the quality of predictions · Reference v1.1.0

Core concept supported. Evaluation labels, population, threshold, and class convention determine interpretation; case performance is not guaranteed.

Receiver operating characteristic

A curve comparing true-positive and false-positive rates across decision thresholds.

In practice. It describes threshold behavior under a test population. A favorable curve does not select a case-appropriate threshold or determine alert precision without relevant prevalence and operational consequences.

Further reading: Metrics and scoring: quantifying the quality of predictions · Reference v1.1.0

Core concept supported. Evaluation labels, population, threshold, and class convention determine interpretation; case performance is not guaranteed.

Redaction

Removal or concealment of selected information in a disclosed derivative.

In practice. Publish a redacted log while retaining the protected source under appropriate controls. Explain the categories removed and whether the omissions affect reproducibility, without revealing the sensitive values in the explanation.

Further reading: NIST SP 800-53 Rev. 5 — control catalog · Reference v1.1.0

Limited supporting context. The project’s evidence-report redaction practice is an editorial application, not a universal legal rule.

Regeneration

A request or process that produces another response for an interaction point. It may create alternatives rather than overwrite a single event.

In practice. A second response can create an alternative branch rather than replace the first. Keep both when available and distinguish generation order from the version selected for display or later use.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Editorial definition. These are editorial definitions or application-dependent records, not terms standardized by the cited publications; examples are hypothetical and historical behavior must be demonstrated.

Replay attack

Reuse of a recorded or captured interaction to satisfy a check or impersonate a fresh event.

In practice. A repeated voice recording can differ from newly synthesized speech while causing a similar identity problem. Preserve challenge timing and session context so the analysis tests the actual verification mechanism.

Further reading: ASVspoof 2019: A large-scale public database of synthesized, converted and replayed speech (Wang et al.) · Reference v1.1.0

Core concept supported. The evaluated recordings and simulated replay conditions do not establish how a case recording was created.

Reproducibility

The ability to repeat documented consequential steps and assess whether their results hold under stated conditions and access limits.

In practice. Provide enough inputs, versions, steps, and conditions to repeat consequential work. When private evidence or unavailable cloud state prevents repetition, explain the constraint and what can still be independently checked.

Forensic significance. State conditions, inputs, versions, controls, and access constraints, including failed repetitions.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Limited supporting context. This source does not experimentally validate this glossary, an AI detector, or an application interpretation.

Response revision

A change to a recorded response or its representation, made by a person, a system, or a further generation step.

In practice. Identify whether the change came from editing, a new generation, or presentation processing. Preserve the versions and their links before interpreting differences as a change in the underlying interaction.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Editorial definition. These are editorial definitions or application-dependent records, not terms standardized by the cited publications; examples are hypothetical and historical behavior must be demonstrated.

Retention policy

Rules describing how long a system keeps particular categories of information.

In practice. A service can retain audit events longer than message text. Check the relevant category and date, and distinguish the written policy from observed implementation and the account's actual settings.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Limited supporting context. The retained records and eviction behavior of a particular product remain unvalidated.

Retrieval query

The input used to request material from a search or retrieval system.

In practice. It can differ from the user's visible question after rewriting or decomposition. Preserve query records where available so the reconstruction explains what was actually searched instead of assuming a direct verbatim lookup.

Further reading: Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks (Lewis et al., 2020) · Reference v1.1.0

Core concept supported. Retrieved records, model-visible material, and durable logs must be distinguished in a particular implementation.

Retrieval-augmented generation

A workflow that supplies retrieved material to a model’s input context. Retrieved content and retrieval records can be distinct evidence sources.

In practice. Preserve retrieved versions, queries, and supplied excerpts when available. A document returned by retrieval may be truncated or excluded before generation, so return records do not alone establish full model exposure.

Further reading: Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks (Lewis et al., 2020) · Reference v1.1.0

Core concept supported. Retrieved records, model-visible material, and durable logs must be distinguished in a particular implementation.

Retrieved document

Material returned by a retrieval process for potential use in an interaction.

In practice. Returned content may be filtered, truncated, or unused. Identify the retrieved version and any supplied excerpt before asserting that a full document influenced the model's response.

Further reading: Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks (Lewis et al., 2020) · Reference v1.1.0

Core concept supported. Retrieved records, model-visible material, and durable logs must be distinguished in a particular implementation.

Retry

Another attempt at an operation after a failure, timeout, or chosen repetition.

In practice. A timed-out call can still complete externally before a retry. Compare request identifiers and target-state records to avoid counting repeated attempts as separate intended actions or assuming only one effect occurred.

Further reading: RFC 9110 — HTTP Semantics · Reference v1.1.0

Core concept supported. Do not infer idempotency from a method name or apply HTTP guarantees to an unrelated tool.

Revocation

A recorded withdrawal of a certificate, key, or credential's accepted status.

In practice. Interpret it within the applicable system and time. A current revoked status does not by itself specify whether an earlier signature was valid when created, or why the issuing authority changed the status.

Further reading: RFC 5280 — Internet X.509 PKI Certificate and CRL Profile · Reference v1.1.0

Core concept supported. A valid path under one policy does not establish every asserted human identity or authorization.

Sample rate

The number of signal samples represented per second.

In practice. An exported recording can have a different sample rate from its source. Document resampling and duration handling before comparing timing or frequency measurements across versions, especially when a pipeline performs conversions automatically.

Further reading: Web Audio API 1.0 · Reference v1.1.0

Core concept supported. Recording quality and attribution are outside the API specification.

Sampler

An algorithm used to obtain an output from a model's generative process.

In practice. Different samplers can change an image even with similar other settings. Preserve the named algorithm and version when available, and test reproduction within the recorded environment instead of inferring it from appearance.

Further reading: Denoising Diffusion Probabilistic Models (Ho et al., 2020) · Reference v1.1.0

Core concept supported. Sampler names and step parameters vary across implementations; reproduction of a historical result is not guaranteed.

Sampling steps

A configured number of iterative steps in a generation procedure.

In practice. The meaning depends on the algorithm and implementation. Include it with the other settings in a generation record; an undocumented step count cannot establish image quality, provenance, or whether the output is authentic.

Further reading: Denoising Diffusion Probabilistic Models (Ho et al., 2020) · Reference v1.1.0

Core concept supported. Sampler names and step parameters vary across implementations; reproduction of a historical result is not guaranteed.

Sandbox

An environment designed to constrain a process's access or effects.

In practice. The restrictions depend on implementation and configuration. Document what was isolated and what external access remained available rather than treating the label as proof that no network, filesystem, or account changes were possible.

Further reading: NIST SP 800-53 Rev. 5 — control catalog · Reference v1.1.0

Limited supporting context. The sandbox’s actual interfaces and escape resistance require separate testing.

Semantic similarity

A method-dependent measure of related meaning or representation.

In practice. Two passages can be highly similar without one copying the other. Explain the representation, threshold, and alternatives before using similarity to support source attribution, plagiarism, or a shared generation-history claim.

Further reading: Sentence-BERT: Sentence Embeddings using Siamese BERT-Networks (Reimers & Gurevych) · Reference v1.1.0

Core concept supported. Semantic similarity does not establish identical meaning, source, or authorship.

Sensitivity

The proportion of known positive cases classified positive under a defined test.

In practice. Report the positive class, denominator, threshold, and input conditions. High sensitivity can coexist with many false alerts in a low-prevalence population, so it does not alone describe the reliability of an individual alert.

Further reading: Metrics and scoring: quantifying the quality of predictions · Reference v1.1.0

Core concept supported. Evaluation labels, population, threshold, and class convention determine interpretation; case performance is not guaranteed.

Session

An application-defined interval or context of activity. Session boundaries and retained state vary by system.

In practice. Use the application’s actual boundaries and identifiers. A browser session, account session, and conversation session can overlap without being the same interval or retaining the same information.

Further reading: NIST SP 800-63B-4: Authentication and Authenticator Management · Reference v1.1.0

Limited supporting context. Email control, session possession, credential status, and human identity are separate; broader application session semantics vary.

Session token

A value used by an application to associate requests with a session or access context.

In practice. Treat it as a credential rather than public evidence text. Record necessary identifiers or protected hashes under the applicable method, and distinguish possession of the token from independently established personal identity.

Further reading: NIST SP 800-63B-4: Authentication and Authenticator Management · Reference v1.1.0

Limited supporting context. Email control, session possession, credential status, and human identity are separate; broader application session semantics vary.

SessionStorage

Browser key-value storage scoped to an origin and a page session.

In practice. State can disappear when the relevant session ends. Document collection timing and tab context, and distinguish it from application-defined conversation sessions, which can have different boundaries and persistence.

Further reading: HTML Standard — Web storage · Reference v1.1.0

Core concept supported. Application-defined sessions are not necessarily browser page sessions.

SHA-256

A cryptographic hash algorithm producing a 256-bit digest, useful for comparing acquired bytes with a documented reference.

In practice. Record the exact object and digest at collection and transfer. The hash supports integrity comparisons of bytes; it does not prove camera origin, identify an author, or validate a statement in the file.

Further reading: FIPS 180-4: Secure Hash Standard · Reference v1.1.0

Core concept supported. Algorithm properties alone do not authenticate origin, establish custody, or exclude all collisions.

Sidecar file

A separate file carrying metadata or related information for another object.

In practice. A provenance sidecar can be separated during copying. Preserve both files and their linkage, and verify the association rather than assuming that similarly named files describe the same acquired asset.

Further reading: C2PA 2.4 Technical Specification · Reference v1.1.0

Limited supporting context. The broad sidecar concept is not restricted to C2PA or defined identically by every format.

Signer

The entity or key holder associated with a cryptographic signing operation.

In practice. Identify the certificate or key and applicable trust policy. The signing identity may describe a service or device rather than the human creator, and a signed statement still needs factual support.

Further reading: FIPS 186-5 — Digital Signature Standard · Reference v1.1.0

Core concept supported. Key control, human identity, content truth, and authority to act remain separate propositions.

Signing key

A cryptographic key used to produce signatures under a specified algorithm.

In practice. Protect secret key material and document only necessary public verification context. A signature's integrity check does not establish exclusive historical control of the key without additional evidence about its handling and compromise status.

Further reading: FIPS 186-5 — Digital Signature Standard · Reference v1.1.0

Core concept supported. Key control, human identity, content truth, and authority to act remain separate propositions.

Slack space

Unused bytes inside an allocated storage unit beyond an object's logical content.

In practice. Residual bytes can sometimes appear in a unit's slack. Explain the storage layout and collection method before interpreting them, since different filesystems and storage technologies retain different kinds of residue.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Core concept supported. Logical application deletion and physical recovery are separate; recovery is not guaranteed.

Sockpuppet account

An account used to present a separate apparent participant while concealing common control.

In practice. Similar names or opinions are not enough to establish common control. Compare independently acquired account activity and infrastructure evidence, considering shared services or legitimate collaboration as alternatives.

Further reading: An Army of Me: Sockpuppets in Online Discussion Communities (Kumar et al., 2017) · Reference v1.1.0

Core concept supported. The study’s behavioral patterns are not proof of common control for any particular accounts.

Soft binding

A method for associating provenance with content through a representation tolerant of specified changes.

In practice. It can help locate provenance after a content transformation. Matching depends on the scheme and tested conditions, so document the method and possible ambiguous matches instead of treating it like exact hash equality.

Further reading: C2PA 2.4 Technical Specification · Reference v1.1.0

Core concept supported. Their validity and tolerance are scheme specific; neither guarantees the scene is true.

Source attribution

An evidence-supported association between an object or event and a stated source, with alternatives and uncertainty documented.

In practice. Name the level supported: application, account, model family, or person. A service record can support one level while leaving others unresolved, even when the final output looks distinctive.

Forensic significance. Report the supported level and retain unknown-source alternatives.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Limited supporting context. The glossary’s account/operator distinctions are editorial; no universal source-identification method is validated.

Source memory

Remembered information about where encountered content came from.

In practice. A study can compare source judgments with documented presentation conditions. It cannot infer an AI-specific memory effect from one person's account alone; distinguish measured judgments from broader causal or clinical claims.

Further reading: Source monitoring (Johnson, Hashtroudi & Lindsay, 1993) · Reference v1.1.0

Core concept supported. The general memory framework does not empirically validate synthetic-imprinting effects.

Source-monitoring error

An incorrect attribution of information or recollection to its source, such as confusing encountered content with an experienced event.

In practice. A study can ask whether participants attribute a presented statement to a generated source or an experienced event. Define the task and comparison before interpreting an incorrect source judgment.

Forensic significance. A digital exposure record is distinct from evidence that exposure caused a particular recollection.

Further reading: Source monitoring (Johnson, Hashtroudi & Lindsay, 1993) · Reference v1.1.0

Core concept supported. The general memory framework does not empirically validate synthetic-imprinting effects.

Speaker verification

Testing whether a voice sample matches a stated enrolled speaker under defined conditions.

In practice. A match depends on the method, sample quality, enrollment, and error conditions. Synthetic and replayed speech complicate the interpretation; report the tested claim without converting a score into certain personal identity.

Further reading: NIST 2021 Speaker Recognition Evaluation Plan · Reference v1.1.0

Core concept supported. A match does not establish consent, operator identity, or general performance outside the evaluation.

Specificity

The proportion of known negative cases classified negative under a defined test.

In practice. A specificity estimate depends on what the negative class contains. Ordinary editing, screenshots, or unknown sources may differ from the tested negatives, changing how a result applies to an acquired object.

Further reading: Metrics and scoring: quantifying the quality of predictions · Reference v1.1.0

Core concept supported. Evaluation labels, population, threshold, and class convention determine interpretation; case performance is not guaranteed.

Spectrogram

A visual representation of signal energy across time and frequency under a specified transform.

In practice. Record the window, overlap, scale, and preprocessing. A striking pattern may reflect compression or background conditions; the graphic is a measurement view, not an automatic explanation of how the audio was created.

Further reading: SciPy — spectrogram · Reference v1.1.0

Core concept supported. Windowing, sample rate, and other settings affect the result; it does not independently identify a speaker.

Speech-to-speech conversion

Transformation of spoken input into another speech representation.

In practice. A converted voice may preserve wording or rhythm while altering speaker characteristics. Compare the input, output, and conversion context, and separate speaker resemblance from the question of who produced or distributed the recording.

Further reading: AutoVC: Zero-Shot Voice Style Transfer with Only Autoencoder Loss (Qian et al., 2019) · Reference v1.1.0

Core concept supported. This is one conversion family; other speech-to-speech tasks and forensic attribution need separate evidence.

SQLite WAL

SQLite’s write-ahead log, which can hold committed database changes before checkpointing. Its forensic significance depends on acquisition consistency and application use.

In practice. Collect related database files consistently under the tested conditions. Opening or stopping an application can trigger checkpoint behavior, so document those actions before interpreting the acquired database and log together.

Further reading: SQLite: Write-Ahead Logging · Reference v1.1.0

Core concept supported. Evidence significance depends on acquisition consistency and the actual application configuration.

Standard error

The stream conventionally used by a process for diagnostic output.

In practice. Programs can use it for warnings or progress as well as failures. Interpret it with exit status and tool documentation rather than treating any output on this stream as a failed operation.

Further reading: Python — subprocess management · Reference v1.1.0

Core concept supported. Process success can be narrower than the intended application or external-system effect.

Standard output

The stream conventionally used by a process for ordinary output.

In practice. It can contain results, progress, or arbitrary text. Preserve it with execution context and distinguish it from a validated target-system observation, especially when a script reports what it intended to do.

Further reading: Python — subprocess management · Reference v1.1.0

Core concept supported. Process success can be narrower than the intended application or external-system effect.

Stop sequence

A configured sequence that can end generation under an interface's rules.

In practice. A response ending abruptly may reflect a stop rule, a limit, an error, or a presentation issue. Compare the request and completion status before interpreting the missing remainder as a deliberate omission.

Further reading: Transformers — GenerationConfig and generation · Reference v1.1.0

Core concept supported. Defaults and completion records differ across implementations; an output cannot recover unknown settings.

Streaming response

Output delivered incrementally instead of as one completed object.

In practice. A captured stream can include partial content that differs from the final retained response. Keep event order and completion markers, and distinguish network chunks from meaningful message or sentence boundaries.

Further reading: Transformers — GenerationConfig and generation · Reference v1.1.0

Core concept supported. Defaults and completion records differ across implementations; an output cannot recover unknown settings.

Super-resolution

Reconstruction of a higher-resolution representation from lower-resolution material using a model or method.

In practice. The result can contain plausible detail unsupported by the source. Label it as a derivative and evaluate consequential interpretations against the original rather than presenting recovered-looking pixels as direct evidence.

Further reading: Image Super-Resolution Using Deep Convolutional Networks (Dong et al.) · Reference v1.1.0

Core concept supported. Generated detail is not recovered evidence of what the original scene contained.

Supply chain provenance

Information about the sources, dependencies, and transformations involved in producing software or another artifact.

In practice. A build record can connect a tool release to dependencies and source inputs. It supports a production-history question, while the correctness and forensic suitability of that tool still need separate evaluation.

Further reading: SLSA Provenance v1.1 · Reference v1.1.0

Core concept supported. These are provenance assertions; a valid representation does not prove an uncompromised build.

Synchronization

Transfer or reconciliation of state across systems or devices, potentially propagating changes, deletions, or conflicts.

In practice. Compare device and service events instead of assuming immediate agreement. A deletion or edit can propagate later, leaving apparently contradictory snapshots that reflect different states rather than false records.

Further reading: CouchDB Replication Protocol · Reference v1.1.0

Core concept supported. This is one documented protocol; actual marker contents and synchronization behavior are product dependent.

Synthetic artifact

An object produced or modified through a synthetic or AI-assisted process; its evidentiary meaning depends on source and context.

In practice. Preserve an output image and its generation record as separate objects. Their relationship can help explain creation, while the image alone may say little about the inputs or later changes.

Forensic significance. Separate the generated object from the records that connect it to creation or modification.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Editorial definition. These are editorial definitions or application-dependent records, not terms standardized by the cited publications; examples are hypothetical and historical behavior must be demonstrated.

Synthetic evidence

Evidence relating to synthetic content or an AI-assisted workflow. The term does not, by itself, mean the evidence was fabricated.

In practice. Specify whether the object is generated content or a record about synthesis. An authentic service log of an AI event should not be called fabricated merely because the event involved synthetic media.

Forensic significance. Avoid labeling an authentic application record false merely because its subject is synthetic.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Editorial definition. These are editorial definitions or application-dependent records, not terms standardized by the cited publications; examples are hypothetical and historical behavior must be demonstrated.

Synthetic forensics

Synthetic forensics is the systematic identification, preservation, examination, reconstruction, and interpretation of digital evidence involving artificial intelligence systems, synthetic media, AI-generated artifacts, and human-AI interactions.

In practice. Begin with a testable proposition and preserve relevant sources before interpretation. The field includes media examination, application artifacts, interactions, agents, models, identity, and provenance rather than relying on one detection score.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Editorial definition. These are editorial definitions or application-dependent records, not terms standardized by the cited publications; examples are hypothetical and historical behavior must be demonstrated.

Synthetic identity

A generated or manipulated representation of identity, potentially combining invented details with elements associated with real people.

In practice. Examine the representation and its account relationships separately. A composite profile may borrow a photograph while inventing a biography; neither element alone identifies the operator behind it.

Further reading: Synthetic Identity Fraud Defined · Reference v1.1.0

Editorial definition. The established fraud definition includes dishonest gain; it does not classify every fictional or AI-generated persona as fraud.

Synthetic imprinting

A related-project working concept for studying how exposure to synthetic information may influence later source judgments or understanding.

In practice. Use the term to frame a research question, with defined exposure and comparison conditions. It is a project concept rather than an established clinical condition or evidence of a particular person being influenced.

Forensic significance. Use consent, operational measures, controls, and source records for any empirical study.

Further reading: Source monitoring (Johnson, Hashtroudi & Lindsay, 1993) · Reference v1.1.0

Editorial definition. These operational/working concepts are project editorial formulations; no established diagnosis, measured AI effect, or validated instrument is asserted.

Synthetic media

Media generated or modified through computational synthesis, including AI-generated or AI-assisted image, audio, video, and text.

In practice. Assess the acquired version and its transformation history. An original generated image, an edited derivative, and a screenshot can require different tests even when they depict the same scene.

Forensic significance. Choose examination methods for the actual modality and transformation conditions.

Further reading: NIST AI 100-4: Reducing Risks Posed by Synthetic Content · Reference v1.1.0

Core concept supported. NIST’s overview does not certify any detector, watermark, or conclusion on a case object.

Synthetic media forensics

Examination of media that may have been generated or altered by AI, together with evidence of its creation and transformation.

In practice. Combine content measurements with source and workflow evidence. Explain the input conditions under which a method was validated, especially when the examined file has been compressed, resized, or re-recorded.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Editorial definition. These are editorial definitions or application-dependent records, not terms standardized by the cited publications; examples are hypothetical and historical behavior must be demonstrated.

System instruction

An instruction supplied by the application or runtime to shape an AI interaction.

In practice. It may be absent from a user-visible export. Preserve available configuration and describe missing context before attributing a response solely to the user's displayed prompt or assuming the instruction remained constant.

Further reading: Transformers — Chat templates · Reference v1.1.0

Limited supporting context. Role priority and application/runtime instructions differ by platform; the user-visible prompt need not be the entire context.

Task graph

A representation of task dependencies, delegation, and completion relationships.

In practice. A child task can finish before its parent incorporates the result. Preserve identifiers and timing constraints so the graph does not confuse dispatched work with an accepted result or completed external operation.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Editorial definition. These are editorial definitions or application-dependent records, not terms standardized by the cited publications; examples are hypothetical and historical behavior must be demonstrated.

Temperature

A sampling parameter affecting how a generation system selects among candidate outputs.

In practice. Its meaning depends on the implementation and interacting settings. A low value is not a guarantee of identical output, factual accuracy, or evidentiary reliability; document conditions when testing repeated responses.

Further reading: Transformers — GenerationConfig and generation · Reference v1.1.0

Core concept supported. Defaults and completion records differ across implementations; an output cannot recover unknown settings.

Temporal artifact

A pattern or inconsistency observed across a sequence of media frames or samples.

In practice. An unusual transition may come from synthesis, editing, dropped frames, or decoding. Test the acquired sequence and processing history rather than assigning a cause from the anomaly alone.

Further reading: FaceForensics++: Learning to Detect Manipulated Facial Images (Rössler et al.) · Reference v1.1.0

Limited supporting context. A temporal pattern can have ordinary encoding or capture causes; the benchmark does not validate every such observation.

Text-to-image generation

Creation of image outputs from a textual input under a generation workflow.

In practice. A prompt can describe a scene without documenting all settings or later edits. Preserve the output, model context, generation parameters, and associated records where available rather than assuming prompt text fully specifies the image.

Further reading: High-Resolution Image Synthesis with Latent Diffusion Models (Rombach et al.) · Reference v1.1.0

Core concept supported. An acquired latent or image does not identify its whole creation history.

Text-to-speech

Conversion of text into spoken audio through a speech-generation system.

In practice. The supplied text and generated audio are distinct evidence objects. Pronunciation, pauses, and later edits can differ from the script; preserve both when reconstructing what was created and what listeners received.

Further reading: Neural Codec Language Models are Zero-Shot Text to Speech Synthesizers (Wang et al.) · Reference v1.1.0

Core concept supported. The method does not identify an operator or establish authorization to use a voice.

Timeline reconstruction

An evidence-referenced arrangement of events and temporal relationships with clock assumptions, gaps, and uncertainty documented.

In practice. Retain raw time values, timezone assumptions, and uncertainty. Use event identifiers and causal constraints where available, since sorting displayed timestamps alone can misorder asynchronous actions.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Limited supporting context. Application-specific time meanings, clock offsets, and reconstruction rules must be established separately.

Timestamp

A recorded time value whose format, clock, event meaning, timezone, and resolution require verification.

In practice. Record the raw value, event meaning, clock, timezone, and precision. A displayed date can reflect import or modification, and sorting it without those details can produce an incorrect event sequence.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Limited supporting context. Application-specific time meanings, clock offsets, and reconstruction rules must be established separately.

Timestamp authority

A service that signs a time-related statement under a stated protocol and policy.

In practice. A trusted timestamp can support when particular data existed under the scheme. It does not directly establish when the depicted event occurred or when an unsupplied source asset was originally created.

Further reading: RFC 3161: Time-Stamp Protocol · Reference v1.1.0

Core concept supported. Ordinary file times are different; trust and applicable protocol updates must be evaluated.

Timestamp normalization

Conversion of verified time representations into a comparison format while retaining the raw value and documenting assumptions.

In practice. Keep original values alongside the conversion. State timezone and offset assumptions and represent uncertainty, especially when comparing service events with local clocks that may drift or have different resolution.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Limited supporting context. Application-specific time meanings, clock offsets, and reconstruction rules must be established separately.

Token

A unit into which a model or tokenizer divides input or output for processing.

In practice. Token boundaries vary by tokenizer and do not map one-to-one to words. Record the tokenizer and relevant representation when comparing limits, costs, or truncation; token counts alone do not establish semantic content.

Further reading: Transformers — Tokenizer · Reference v1.1.0

Core concept supported. The exact tokenizer, runtime inputs, and hidden summarization rules of a service remain separate questions.

Tokenization

Conversion of content into the units used by a particular model interface or tokenizer.

In practice. The same text can produce different units across systems. Preserve the original content and named tokenizer so a reported count or boundary can be reproduced rather than inferred from another model's behavior.

Further reading: Transformers — Tokenizer · Reference v1.1.0

Core concept supported. The exact tokenizer, runtime inputs, and hidden summarization rules of a service remain separate questions.

Tombstone

A retained marker indicating that an object or record was deleted or superseded.

In practice. A synchronization tombstone may carry an identifier without message content. It can support a deletion-state observation but does not reconstruct the missing message or necessarily identify the person who removed it.

Further reading: CouchDB Replication Protocol · Reference v1.1.0

Core concept supported. This is one documented protocol; actual marker contents and synchronization behavior are product dependent.

Tool call

A recorded request to a tool with particular arguments and execution context. A request alone does not establish the external effect.

In practice. Separate the request, the returned result, and the observed effect. A file-writing call can fail after partial work or report completion before a separate system reflects the change.

Further reading: Model Context Protocol: Tools, specification 2025-11-25 · Reference v1.1.0

Core concept supported. The protocol does not guarantee durable logs or independent target-system success.

Tool invocation

An actual request to run a named tool with supplied arguments and context.

In practice. Distinguish the invocation from a model's suggested command. Preserve execution identifiers and outcomes, because even an issued call can fail, time out, or complete only part of the requested work.

Further reading: Model Context Protocol: Tools, specification 2025-11-25 · Reference v1.1.0

Core concept supported. The protocol does not guarantee durable logs or independent target-system success.

Tool result

Information returned from a tool invocation.

In practice. A success-looking message can describe an intermediate operation rather than final external state. Check the tool contract and target system, and retain errors or partial results alongside the displayed response.

Further reading: Model Context Protocol: Tools, specification 2025-11-25 · Reference v1.1.0

Core concept supported. The protocol does not guarantee durable logs or independent target-system success.

Top-p sampling

A generation rule that restricts candidate choices using a cumulative probability threshold.

In practice. It affects output selection within a configured system. Preserve the actual setting and other sampling parameters rather than inferring them from writing style or assuming that one parameter fully explains variation.

Further reading: Transformers — GenerationConfig and generation · Reference v1.1.0

Core concept supported. Defaults and completion records differ across implementations; an output cannot recover unknown settings.

Training data

Material used to fit a model during a training process.

In practice. An output that resembles a source does not by itself prove that source was in the training set. Use documented datasets and appropriately validated tests, keeping source membership separate from similarity or memorization hypotheses.

Further reading: Machine Learning Glossary · Reference v1.1.0

Core concept supported. The project’s forensic applications and a deployment’s actual lineage are not independently established.

Training run

A particular execution of model training under defined inputs and conditions.

In practice. Preserve logs, configuration, checkpoints, and environment where available. A final model cannot automatically reconstruct all choices made during training, so state which aspects of the run are evidenced and which remain unknown.

Further reading: Machine Learning Glossary · Reference v1.1.0

Core concept supported. The project’s forensic applications and a deployment’s actual lineage are not independently established.

Transaction

A database unit of work that is committed or rolled back together under stated rules.

In practice. Several message updates can belong to one transaction. A visible log entry may describe a step before commitment, so check durable state and transaction semantics before counting it as a completed change.

Further reading: Indexed Database API 3.0 · Reference v1.1.0

Core concept supported. Inspect the actual engine and durability settings; an application log is not proof of commitment.

Transcoding

Conversion of media to another encoding or container, potentially changing metadata and method-specific signals.

In practice. Retain the input, output, codec, and settings where possible. Conversion can alter timing, metadata, and detection signals even if the content looks unchanged, requiring tests appropriate to the acquired derivative.

Further reading: Web video codec guide · Reference v1.1.0

Limited supporting context. Presentation rate, frame timestamps, retained metadata, and conversion effects need format-specific examination.

Transformation history

A documented sequence of operations that changed an object or its representation, such as editing, transcoding, or export.

In practice. Give every consequential derivative an identifier and a documented input relationship. Record editing, conversion, redaction, and export so that altered signals are not assigned to the original object.

Further reading: PROV-DM: The PROV Data Model · Reference v1.1.0

Core concept supported. The evidence-handling application is editorial; transformation quality and claim truth require assessment.

Trust anchor

A key or certificate accepted as a starting point for a validation policy.

In practice. Two examiners can reach different trust outcomes if their anchors differ. Preserve the relevant policy and versions so the report explains why a signer was accepted rather than describing trust as universal.

Further reading: RFC 5280 — Internet X.509 PKI Certificate and CRL Profile · Reference v1.1.0

Core concept supported. A valid path under one policy does not establish every asserted human identity or authorization.

Trust store

A configured set of trusted certificates or keys used by a validation process. Its contents and policy influence interpretation.

In practice. Record the anchors, version, and validation policy used. Different stores can produce different outcomes, so a signature’s accepted status should be described under explicit conditions rather than as universal trust.

Further reading: RFC 5280 — Internet X.509 PKI Certificate and CRL Profile · Reference v1.1.0

Limited supporting context. The storage and management of a particular trust store are implementation specific.

Trusted timestamp

A time statement whose verification relies on a defined authority, signature, and policy.

In practice. Record the token, verification software, and trust conditions. Keep ordinary filesystem timestamps separate, because those values have different origins and do not gain the timestamp authority's assurances through proximity.

Further reading: RFC 3161: Time-Stamp Protocol · Reference v1.1.0

Core concept supported. Ordinary file times are different; trust and applicable protocol updates must be evaluated.

Unallocated space

Storage regions not currently assigned to active filesystem objects.

In practice. Fragments can survive there under some conditions. Their presence, absence, and recoverability depend on storage behavior, overwrite activity, and acquisition scope; an empty search does not establish that a file never existed.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Core concept supported. Logical application deletion and physical recovery are separate; recovery is not guaranteed.

Unknown-source rejection

A method's ability to withhold a known-source classification when the source is outside its supported set.

In practice. Test unknown generators and ordinary alternatives separately. A classifier forced to choose a listed model can produce a confident but unsupported attribution even when none of the listed sources produced the object.

Further reading: Towards Open World Recognition (Bendale & Boult) · Reference v1.1.0

Limited supporting context. The recognition study is not validation of generative-model attribution or source identification from output style.

Upload event

A recorded action transferring an object to an application or service.

In practice. An upload confirmation can document transfer without proving the object was processed by a particular model. Compare attachment identifiers, processing status, and later references to establish the supported relationship.

Further reading: RFC 9110 — HTTP Semantics · Reference v1.1.0

Limited supporting context. An attempted request is not a completed transfer; labeling a transfer unauthorized requires the applicable policy and evidence.

Upscaling

Increasing an image's dimensions through an interpolation or reconstruction process.

In practice. A larger output may include newly inferred detail. Retain the smaller source and identify the upscaling method before treating a facial feature or text fragment in the enlarged version as an original observation.

Further reading: Pillow — image concepts and resampling · Reference v1.1.0

Core concept supported. Increased dimensions do not guarantee recovered physical detail.

User message

Content submitted in a user-role position within an interaction record.

In practice. Role identifies a position in the application's message structure, not necessarily the real person who authored every word. Uploaded quotations and copied instructions need source context before being interpreted as personal intent.

Further reading: Transformers — Chat templates · Reference v1.1.0

Limited supporting context. Role priority and application/runtime instructions differ by platform; the user-visible prompt need not be the entire context.

Validation

Testing whether a method or interpretation works within defined conditions, using reproducible procedures and documented limitations.

In practice. Define the claim, reference labels, controls, and relevant input conditions before testing. Report failures and exclusions as well as successful cases, and avoid transferring results to untested platforms or transformations.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Limited supporting context. This source does not experimentally validate this glossary, an AI detector, or an application interpretation.

Vector database

A system that stores and queries vector representations, often for similarity retrieval.

In practice. A retrieved neighbor reflects the indexing and search method rather than factual agreement. Record embedding versions, filters, and retrieval context when evaluating why particular material entered an AI workflow.

Further reading: pgvector — vector similarity search · Reference v1.1.0

Core concept supported. One extension’s semantics do not establish the schema or behavior of a different product.

Version history

Records connecting an object's revisions over time.

In practice. A publication correction and a file re-encoding are different revisions. Preserve identifiers and reasons for consequential changes, making clear whether a history is complete or limited to versions retained by one service.

Further reading: PROV-DM: The PROV Data Model · Reference v1.1.0

Core concept supported. The evidence-handling application is editorial; transformation quality and claim truth require assessment.

Voice cloning

Synthesis or manipulation of a voice representation that resembles a particular speaker; resemblance alone does not identify an operator.

In practice. Separate speaker resemblance from operator identity. Preserve the audio and available generation or session context, and evaluate synthetic, replayed, and ordinary voice alternatives under the actual recording conditions.

Further reading: Neural Codec Language Models are Zero-Shot Text to Speech Synthesizers (Wang et al.) · Reference v1.1.0

Core concept supported. The method does not identify an operator or establish authorization to use a voice.

Voice conversion

Changing voice characteristics in an audio representation.

In practice. Conversion can occur in a real-time call or in a saved file. Seek session and source records appropriate to the workflow, because a final clip may not reveal the timing or operator of the conversion.

Further reading: AutoVC: Zero-Shot Voice Style Transfer with Only Autoencoder Loss (Qian et al., 2019) · Reference v1.1.0

Core concept supported. This is one conversion family; other speech-to-speech tasks and forensic attribution need separate evidence.

Volatile evidence

Information that may change or disappear when a process, device, or service changes state.

In practice. A temporary tool result can disappear when an agent session closes. Preserve it under authorized conditions and record its relationship to durable files, without assuming every transient message reaches storage.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Core concept supported. Available evidence and collection effects require environment-specific validation.

Watermark

A scheme-dependent signal embedded in or associated with content to support a particular identification or labeling claim.

In practice. Name the scheme, detection method, and supported claim. A mark may indicate a system relationship under tested conditions; missing or detected marks do not by themselves resolve complete provenance or factual accuracy.

Further reading: NIST AI 100-4: Reducing Risks Posed by Synthetic Content · Reference v1.1.0

Core concept supported. NIST’s overview does not certify any detector, watermark, or conclusion on a case object.

Waveform

A representation of signal amplitude over time.

In practice. A waveform can help locate edits or clipping but does not reveal every transformation. Keep the underlying audio and measurement settings so another examiner can reproduce the view and test alternative explanations.

Further reading: Web Audio API 1.0 · Reference v1.1.0

Core concept supported. Recording quality and attribution are outside the API specification.

Write blocker

A mechanism intended to prevent writes through a specified storage interface.

In practice. Record the blocker, firmware, configuration, and validation checks. Its protection applies to the tested path, so it cannot by itself guarantee that a cloud service or another device leaves the source untouched.

Further reading: NIST SP 800-86 — full publication · Reference v1.1.0

Core concept supported. A write restriction is scoped to its interface; the surrounding running environment can still change.