A forward pass carries no stamp of where it came from. Distill a model, or just run it, and the output looks the same whatever the origin — provenance is laundered. Model it as a many-to-one map: ten distinct sources collapse into three output buckets, so from the output you cannot recover the source. The bits that named the origin are simply erased. Slide to trace a source and watch it merge with others.
A non-injective map erases origin: with g(s)=s mod 3, ten sources (0..9) map into three buckets, so several sources share each output and you cannot invert to the source. Information erased = log₂(10) − log₂(3) ≈ 1.74 bits — gone, not hidden. This is the shape of provenance laundering: the RESULT of a computation does not carry a recoverable trace of which data or which teacher produced it. A fail-loud self-check throws unless multiple sources collide AND the erased-bit count exceeds 1. ◆ real information theory, node-verified.
s mod 3 is a toy stand-in for a real forward/distillation pass; the exact bit-count is for this toy. The structural fact — a non-injective transform makes origin unrecoverable from output — is general, and is what ‘distillation launders provenance’ means. Whether that is wrong is a separate, normative question ([[lillith]]’s).