Blockchain-Auditable Disaster Image Analysis for Trustworthy Damage Assessment

Flood extents and building-damage maps derived from satellite and aerial imagery now feed relief allocation, insurance settlement and reconstruction funding, yet the processing history behind a published map is rarely recorded in a form that a third party can check. This paper presents a reproducible damage-assessment pipeline in which every artefact, from the archived source scenes through each intermediate product to analyst revisions of the final map, is committed to an append-only, hash-chained provenance ledger. Each commitment binds a Merkle root computed over fixed image tiles, a digest of the source code of the stage that produced it, its parameters and the commitments of its parents, and the ledger head is periodically anchored with an independent witness. The processing chain combines relative radiometric normalisation on pseudo-invariant pixels, median filtering, a water-index change rule and object-based building-damage scoring. It was evaluated on 180 synthetic bi-temporal scenes with exact ground truth. At and above 10 dB per-band signal-to-noise ratio the chain reached a damage F1 score between 0.958 and 0.981 against 0.909 to 0.955 for a band-difference baseline; below 8 dB it failed and the simpler baseline was better, a limitation reported rather than tuned away. Every local tampering scenario tested was detected and localised to the altered tile or record, whereas a full rewrite of the ledger by its operator was detectable only up to the most recent witness anchor, in close agreement with a derived exposure model. Re-execution on a different floating-point precision reproduced the class maps exactly but not the floating-point intermediates, even after quantisation. Provenance capture added about one fifth to processing time. The results indicate that auditable damage assessment is mainly a problem of canonical commitment and anchoring discipline rather than of consensus technology.