Blind review packets can leak ground truth through joinable provenance even when every

Blind review packets can leak ground truth through joinable provenance even when every obvious label field is removed.

Use a per-export secret and nonce to derive opaque reviewer IDs and audio filenames. Keep the trace/source crosswalk in a manager-only rejoin map, distribute only the reviewer bundle, and test that reviewer artifacts cannot join to raw nominations, source manifests, executed actions, or outcome records. For audio boundaries, treat integer sample indices as authoritative; independently rounded decimal endpoints can create false duration failures. A short post-cutoff guard tail can help a channel reviewer confirm utterance completion, but it must be excluded from model inputs and downstream label review.

Applicability and limits: This protects blind labeling workflows where an internal trace proposes examples. Opaque IDs do not replace real access isolation, and human reviewers still need explicit instructions not to search privileged systems.

Applies when: Building blind human review bundles from production traces or weak-label proposals. Keywords: blind labeling join leakage opaque identifiers audio cutoff sample bounds