Link extracted document fields to their sources.
OCR gives you a value and a confidence score, but that confidence score is just the model grading its own work. AFiR-OCR ties each extracted field to the exact spot it came from, the model that read it, and that confidence score, all inside one tamper-evident receipt. Move the box around the text by even one pixel and the check fails. It works with any extraction engine, and you can check it offline with no secret key.
Check the source behind an extracted value.
Invoices, contracts, claims, intake forms, IDs, titles: the value an extraction model reads off a page drives a decision and a payment. But there's no portable proof of what was read, where it came from, which model read it, or whether someone changed it after the fact.
The model grades its own homework
A confidence score is the model's own opinion of itself, not proof. It can't tell you whether the field was changed before it reached your system, and it won't catch tampering.
No link back to the page
Signing just the extracted text proves some text was produced. It says nothing about where on the page it came from or which model read it. The link to the source spot is gone.
Changes stay invisible
Saving bounding boxes in a database, with nothing that locks them together and flags tampering, means someone can quietly edit a value, a position, or a confidence score and no one will know. There's no audit trail.
Bind extracted fields and their source references in a signed record.
The extraction engine reads the document. AFiR-OCR proves what it read. Each field becomes its own entry that ties together its value fingerprint, its page and bounding box, its block type, the model, and its confidence score. Those entries feed into a Merkle tree (a structure that locks a set of records together so any single change is detectable), and one ML-DSA-65 signature seals the whole document, no matter how many fields it has.
EXTRACTION ENGINE PER-FIELD BINDING SIGN + VERIFY ................. ................. ............. any OCR / IDP --> field + bbox --+ ( Mistral OCR, Textract, ... ) | v +-----------------------+ +----------------------+ | per-field leaf | ---> | Merkle root | | value_commit | | ( fields_root ) | | source_region(bbox) | +----------------------+ | block_class | | | model_ref | v | confidence | +----------------------+ +-----------------------+ | ML-DSA-65 signature | <-- one per doc | | PQ-anchored receipt | v +----------------------+ sensitive field? | value_commit = salted, v off-receipt ( redaction- offline, zero-secret verify compatible ) ( recompute root, check sig )
Integrity checks and tamper tests
All four tie into the same signature. Change a value, a position, a class, or a confidence score, and the recomputed root won't match, so the offline check fails.
Every field is tied to the exact spot it was read from.
The page number and bounding box feed into that field's entry. The tie between a field and its source spot is itself tamper-evident: move the box by one pixel and the entry changes, the root changes, and the check fails.
- source_region: { page, bbox: [x0, y0, x1, y1] }
- block_class tied in too: header | field | table_cell
- tamper test: moving the box 1px on one field fails the offline check
- each field is provably tied to the page coordinates it came from
Change the number after extraction and the receipt catches it.
A fingerprint of the value feeds into each field's entry. Change a value that's already tied in, say an invoice total, to a bigger number, and that entry changes, the fields_root changes, and the recomputed root no longer matches the signed root.
- value_commit tied per field into the Merkle entry
- tamper test: total changed after signing fails the check
- no shared secret needed to catch the change
- it catches every change, not just some of them
The tax ID never shows up in the receipt. The receipt still proves it was there.
For a sensitive field, the value's fingerprint is computed with a secret key kept off the receipt, so it can't be reversed. You can still prove the field existed, where it sat, what class it was, and its confidence score. The actual text never enters the chain.
- sensitive value_commit: uses a secret key, kept off the receipt
- tax_id / SSN / PAN / PHI provably missing from the receipt yet provably extracted
- whoever holds the secret key can re-prove the specific value on demand
- the wrong value won't match the fingerprint
The receipt says what was read. It never claims the value is right.
The asserts field is set to extraction_provenance_only. It proves the named model read the named region and produced that value at that confidence score. It does not claim the value is correct. We don't overclaim what this proves.
- asserts: "extraction_provenance_only"
- if you need correctness checked, that's a separate signed attestation
- that attestation points back to this receipt by its root
- the limit is stated plainly on the receipt itself
Implementation tests and recorded results
We ran this on a real two-page invoice with nine fields, straight from a fresh checkout. Six test checks, all six passed. The hashes below are the actual output of that test run.
Smoke test 6 of 6 pass
- 1✓Anyone can check the whole receipt offline, with no secret key
- 2✓Changing a tied value breaks the recomputed fields_root
- 3✓Moving a bounding box one pixel breaks the check
- 4✓A sensitive field stays out of the receipt yet is provably extracted
- 5✓Whoever holds the key can re-prove the redacted value; a wrong value fails
- 6✓One ML-DSA-65 signature per document, no matter how many fields
Signed test-run outputs
Nine fields: vendor, invoice no., date, bill-to tax ID (redacted), line item, amount, subtotal, tax, total. We tested the adapters against two different extraction-engine output formats. The engine reads the document; the receipt proves what it read.
Try the eleven document instruments.
Each button calls the production service. It mints a real signed receipt over published sample fields, verifies it in front of you, and lists every gate that had to pass. Then you can change one character inside the signed body and watch the same receipt stop being evidence. Press mint twice and the receipt id changes, because the receipt really is minted when you ask for it.
AFiR-OCR DocProof
What the reader read, from which box on which page, at what confidence. It never says the value is right.
Decision Provenance Binding
Ties the extracted field to the model, the prompt and the policy version that produced it.
Raster Origin Assertion
Says which regions of the page were captured by a camera or scanner and which were rendered.
Staged Preprocessing Chain
Every deskew, crop and binarize step commits its input and output, so a bad field pins to a stage.
Table Binding Uncertainty
Records how sure the reader was that a number belongs to that row and that column.
Scoped Absence Assertion
Proves a field was looked for and not found, over a stated scope, instead of just missing.
Reader Divergence Attestation
Two readers disagree. This types the disagreement and records which one was taken and why.
Determinism Class Declaration
Declares up front whether the same page run twice gives the same bytes.
Issue-Time Tolerance Bond
Commits the accepted tolerance before the run, so nobody widens it afterward to make a number pass.
Render Profile Commitment
Commits the exact render settings the page was rasterized under.
Verdict Custody Declaration
Proves the pass or fail was computed by the checking service, not handed in by the pipeline being checked.
The sample fields are the same fixtures our test suite uses. They describe no real document, no real person and no real event. The signature is real, the sample data is sample data, and the receipt says so.
Point it at your OCR. Get a receipt back. Check it offline.
Point AFiR-OCR at your extraction output, whether that's Mistral OCR, AWS Textract, or any engine that outputs regions and confidence scores. You get back one post-quantum-anchored receipt per document. Anyone with the public key can check the whole thing offline.
import { buildReceipt, verify } from "@hive/afir-ocr" // 1. run your OCR engine as usual. AFiR-OCR does not change it const ocr = await mistralOCR(invoicePdf) // fields + bbox + confidence // 2. tie every field to its source region, model, and confidence const receipt = await buildReceipt({ doc: invoicePdf, model_ref: "mir:mistral-ocr-4", fields: ocr.fields, // value, bbox, block_class, confidence sensitive: ["bill_to_tax_id"], // supports redaction asserts: "extraction_provenance_only", // proves origin, not correctness }) // receipt.fields_root -> 0x64c489...a8a34a1 // receipt.sig -> one ML-DSA-65 signature over the whole doc // 3. anyone checks it offline. No shared secret, no call home const { ok, why } = await verify(receipt, PUBLIC_KEY) // move one bbox by a pixel, change one total -> ok === false
Built for document pipelines that have to be auditable.
Anywhere a model reads a regulated document and the value drives a decision or a payment.
Invoices & AP
Extracted totals and line items feed payment runs. AFiR-OCR proves the total on the receipt is the same total read off the page, with no changes.
Contracts & claims
Clause and figure extraction with a provable tie back to the source region. It supports redaction for privileged or sensitive text.
Clinical intake forms
PHI fields stay out of the receipt while still being provably extracted. The data type lands on the receipt; the data itself does not.
OCR & IDP vendors
If you sell extraction to regulated buyers, AFiR-OCR is the proof their auditors will ask for. Your engine becomes the way it gets distributed.
