Self-witnessing: worked examples

Step-by-step walk-throughs of the self-witnessing verification, taken only from the published Filing 3 - the loop, the two-manifold test, and the declared numbers.

A recurring audit note on this work is that the analogue, self-witnessing verification is only asserted, never shown. This page answers that note directly. Every step below is a walk-through of the procedure exactly as set out in the published Filing 3 Description; nothing here is added beyond the filing. Where the filing gives declared, non-limiting example numbers, they are restated and marked as such. This is the filed, enabled description of the procedure; it is not a demonstrated result. The one demonstrated instance of the wider architecture is the digital Truth Beam; the self-witnessing procedure below is enabled in the filing and patent pending, its physical envelope still being characterised.

1 · The committed interrogation loop

The filing's canonical embodiment interrogates a specimen in a committed, closed, real-time feedback loop, the specimen being at once its own reactor and its own scene. The instrument is a projector-detector pair: a controllable emitter (for example a structured-light projector, a coherent source producing a speckle field, a scanned spot, or a patterned illuminator) directs a probe onto the specimen, and a detector (for example a camera, a photodetector array, or a digital-image-correlation sensor) records the response. In some embodiments the emitter and detector share an optical axis as a projector-camera pair; the instrument may sit fixed on a bench, or be carried by a drone, a crawling module, or a robotic stage that sweeps a large specimen under committed coverage.

The loop the filing specifies runs as follows.

1. Genesis commitment, before any assignment. A one-way genesis commitment c_0 = H(σ_0, g, K, ρ, E) is formed and published before the specimen is assigned to any condition, where σ_0 is the enrolment signature, g a declared coarse geometry, K a committed degradation kernel (the expected on-manifold evolution), ρ a declared rate bound, and E a committed tolerance envelope. The declared interrogation protocol, including the committed decomposition that splits σ into a and d, the committed registration transform, and the declared outcome map φ, is itself bound in as a committed protocol digest P, so c_0 = H(σ_0, g, K, ρ, E, P). Neither the identity/outcome split nor the reported outcome variable can be chosen after assignment.
2. Commit the scan configuration θ_t before the capture. Before each capture, the controller commits the scan configuration θ_t to the protocol digest P. θ_t comprises the emitter pattern, wavelength, exposure, and the region and order of the sweep. Because θ_t is fixed before the surface is observed, it cannot be chosen from the captured content. In some embodiments θ_t is seeded from a public-randomness beacon round not yet drawn at commit time, so coverage is provably unstaged.
3. Capture and read σ_t = (a_t, d_t). The committed probe is applied and the detector records the specimen's response, from which the same emitter-detector read yields both projections in a single acquisition: the identity-persistent substructure a_t and the outcome-varying substructure d_t.
4. Check identity persistence. a_t is tested against the committed tolerance envelope, accepting only if a_t ∈ E(a_0), reconstructed through the committed fuzzy extractor or secure sketch (Section 3). A substituted specimen presents an off-manifold jump and is rejected here.
5. Read the outcome. The outcome reading y_t = φ(d_t) is taken along the committed kernel K, and the epoch signature is appended to the one-way hash chain χ_t = H(χ_{t-1}, σ_t, meta_t).
6. Adapt, but commit before observing. The controller may adapt the next configuration θ_{t+1} from the committed history, closing the loop, but θ_{t+1} is itself committed before its own capture. The loop therefore gains coverage without gaining hindsight: the rule that decided to sample a region more densely was bound before the surface was observed, so a dense scan of a suspect region cannot be dismissed as post-hoc staging, and an evasive coverage cannot be arranged to skip a modification. Where a region cannot be resolved in real time, the frame is buffered and the omission is evident in the committed coverage record rather than being silently skipped.

Because every committed configuration θ and every signature σ are committed in order, the sequence is a self-witnessing longitudinal record: a substitution severs it, and coverage cannot be arranged after the fact to conceal a modified region. The industry embodiments below are particular cases of this one loop, each obtained by specialising θ - for example to a fixed scan pattern, a trivial non-adaptive policy, or a single or periodic epoch schedule.

2 · Ageing accepted, substitution rejected: the two-manifold test

This is the technical heart, and the clearest answer to "never shown": the filing sets out, in classical and non-learned terms, exactly how legitimate ageing is told apart from a swap. A naive acceptance region - a fixed ball about the enrolled signature - fails, because a legitimately aged specimen leaves the ball while a well-chosen substitute may lie inside it. Unconstrained re-enrolment fails the other way, laundering substitution as drift. The filing resolves this by testing self-continuity on the identity-continuity manifold, kept separate from conformance to the null-expectation manifold.

At each epoch the estimator forms the residual r_t = σ_t - K(σ_{t-1}) and decides between H_age (legitimate ageing) and H_sub (substitution) by three committed tests.

An epoch that fails both identity persistence and self-continuity places the record in a declared quarantine state. All three tests are classical, non-learned computations executable by an independent party against the committed record; no trained model and no trusted third party is used.

Identity-persistent versus outcome-varying: the decomposition

The single committed quantity σ = (a, d) is read as two projections that answer two different questions, on two manifolds kept distinct.

The consequence is the part that answers the criticism most sharply. Substitution is a departure from the identity-continuity manifold and is rejected. A genuine outcome, including a genuine novel effect not predicted by K, is a departure from the null-expectation manifold that nonetheless remains on the identity-continuity manifold - the same specimen, evolving anomalously - and is therefore reported, not rejected. Its credibility follows precisely because the continuity test has already excluded substitution. The measurand is the projection onto deviation-from-null; the security is the projection onto continuity. Because the discriminator rests on self-continuity rather than on K forecasting the exact aged state, a coarse or imperfect K suffices for substitution detection: operability does not depend on an exact ageing model, and its mis-specification produces systematic, detectable residuals on genuine specimens rather than silent failure.

What this test does and does not close. The coincidence of identity and outcome closes substitution, the presentation of a different specimen. It does not, by itself, close in-situ tampering, the deliberate alteration of the genuine specimen, which remains on the identity-continuity manifold. Where that assurance is required, the filing closes in-situ tampering with a distinct layer - a sealed-access enclosure, blinded condition assignment, and pre-registration under commit-before-assignment - and asserts the credibility of an anomalous outcome only for specimens that pass self-continuity and were sealed against access.

3 · Cold-chain dose tag, with the filing's declared numbers

In this embodiment the specimen is a consumable dose-integrating tag affixed to, or moulded into, a vaccine, biologic, or blood-product container. One interrogated volume discharges both roles: the same disordered microstructure that supplies the committed unclonable signature (reactor) is the very body whose irreversible evolution is measured (scene). The tag is a light-scattering matrix overlaid with, or doped throughout by, a dose-responsive layer - for example radiochromic, phase-change, or photobleaching - so that cumulative thermal, ultraviolet, or humidity-time exposure writes a monotone, irreversible displacement into the microstructure itself.

Reading is by coherent illumination: a laser or narrow-band source produces a speckle field whose statistics are decomposed into the committed quantity σ = (a, d). The walk-through:

1. Enrol the identity over the invariant sub-component. The identity substructure a resides in the stable, high-contrast scattering centres and is stabilised for re-authentication by a committed fuzzy extractor or secure sketch, whose helper data w_0 is fixed at genesis and bound into c_0. Because the committed decomposition confines the irreversible drift to d, the fuzzy extractor operates on a substantially invariant source and is not required to track a moving target.
2. Reconcile each re-read; reject outside the envelope. At each epoch the noisy re-read is reconciled against w_0, so ordinary read noise, alignment error, and reader variation are corrected without disclosing a, while any correction lying outside the committed tolerance envelope E(a_0) is rejected.
3. Read the dose as monotone on-manifold drift. The outcome substructure d is the integrated-dose drift of the same speckle field along the committed kernel K: accumulated excursion advances σ_t monotonically and on-manifold, correlated with the specimen's own prior fine structure. A swapped vial presents an off-manifold field, uncorrelated with the committed history and unreachable from c_0 under K at any admissible rate ρ. Substitution therefore severs the excursion record itself, with no evidence-external custody assumption required to detect it.
4. Condemn a dose outside the release envelope. Acceptance additionally requires the reconciled d_t to lie within a committed release envelope; a reading outside it condemns the dose. In some embodiments the helper data w_0 and the kernel K are borne on the container as a machine-readable code and hashed into c_0; where the dose-responsive layer is radiochromic, the drift is calibrated to a mean-kinetic-temperature threshold.

A single point-of-use scan thereby authenticates the container and reads its accumulated excursion at once, superseding a separate tamper label and a separate temperature logger, neither of which is bound to the article it certifies - aligned to WHO and ICH cold-chain governance.

The declared non-limiting acceptance numbers. The filing sets out the committed fuzzy-extractor / secure-sketch construction and its acceptance parameters as a worked example, and states expressly that this construction is representative and applies, mutatis mutandis, to every embodiment disclosed - including this dose tag - so that each embodiment need not separately re-teach it. As a non-limiting worked example from the filing, that construction is: a secure sketch over a (for example a BCH-code construction) committed at enrolment with its helper data w_0; a declared error radius set from the replicate-read variance of three enrolment reads, with E(a_0) the corresponding tolerance envelope; and per-epoch acceptance of the residual as H_age only if its fine-structure correlation with the committed prior meets or exceeds a declared threshold (for example 0.6), its energy is concentrated in at most a declared number of dominant singular modes (for example rank five), and ||r_t|| ≤ ρ·Δt. These numeric values are declared, non-limiting example choices committed in the protocol digest P and selected per material class and modality within the committed calibration procedure.

4 · One texture, two roles: materials ageing and vessel self-certification

Materials ageing and fatigue by digital image correlation

Here the specimen is a structural coupon of metal, polymer, or composite whose free surface bears a random speckle texture, intrinsic to the microstructure or applied as a stochastic pattern, and that same surface region is interrogated by digital image correlation (DIC), laser-speckle interferometry, or surface profilometry. The committed speckle texture is simultaneously the identity commitment and the measured field: one texture discharges two roles. The unclonable spatial arrangement of the speckle - drawn by the committed decomposition from the substantially-invariant coarse arrangement and fiducial sub-band that persists under load - is the reactor signature a, its genesis commit c_0 = H(σ_0, g, K, ρ, E) recorded before the coupon is placed in service. The progressive displacement and decorrelation of that same speckle under load is the scene outcome d: the accumulating plastic-strain, creep, and micro-crack field the metal itself carries. A genuine crack propagates as a continuation of the coupon's own prior fine structure, correlated with the speckle already committed; a substituted coupon presents an off-manifold, uncorrelated texture that severs the record. A service log asserting zero hours thereby becomes physically checkable against the metal itself: a pristine ledger is irreconcilable with a strain field the surface plainly carries.

The filing gives a full declared protocol as a non-limiting worked example:

All values above are declared, non-limiting example choices committed in the protocol digest P. Suitable applications named in the filing include aerospace life-limited parts, offshore and rail structural members, pressure vessels, and additively-manufactured components; the measurand may be fatigue-crack length, creep strain, or residual-life fraction; and the same surface may be over-determined by reading it from several viewing angles or illumination directions at once, each independently re-deriving a and d, so that a substitution must defeat every view simultaneously.

Vessel self-certification: the committed-θ coverage loop, registration as genesis commit

Here the specimen is a large distributed structure - a marine vessel, aircraft, bridge, pressure hull, or building - whose own fabrication- and service-determined microstructure supplies the committed signature. There is no separate reactor: the structure is its own reactor and its own scene, its steel, welds, and coatings furnishing the unclonable disorder while their evolution furnishes the outcome. The committed signature σ = (a, d) is drawn from a plurality of committed patches distributed over the structure and read by a projector-detector instrument carried, in some embodiments, by a drone or a crawling module that sweeps the structure. The identity-persistent substructure a is the deep, slowly-varying structural fingerprint (weld-bead topology, plate-boundary layout, hull-form geometry recovered by photogrammetry, deformation history at committed fiducial patches); the outcome-varying substructure d is the surface and near-surface state (corrosion, coating craquelure, modification).

The walk-through, as the filing sets it out:

1. Registration is the genesis commitment. The genesis commitment c_0 = H(σ_0, g, K, ρ, E) is formed at a declared enrolment event, in some embodiments the registration or commissioning of the structure, so that the registered identity of the structure is its self-witnessing signature rather than an applied marking. In a dependent arrangement the enrolment event is bound to a public-randomness beacon so that the enrolment time is itself attested.
2. Unchanged regions anchor self-continuity. Because the greater part of the structure is unchanged at any epoch, the unchanged regions anchor the correlation that establishes self-continuity. A repaint, re-plating, or refit presents as a localised, committed, on-manifold event, reachable from the committed history under K only at a per-epoch change no greater than ρ·Δt and only where the changed region remains correlated with the persisting committed neighbourhood that anchors it. Even a piecewise substitution staged across epochs cannot remain on-manifold.
3. The Ship of Theseus, resolved for a structure. The structure remains the same structure through gradual replacement, its identity residing in the unbroken committed continuity of its evolving signature rather than in the persistence of its matter. Presentation of a different structure yields a signature uncorrelated with the committed history - an off-manifold jump that severs the record - and a structure reconstructed from removed components, having no committed continuity chain, likewise fails self-continuity.
4. The committed-θ coverage loop. The scanning instrument operates an adaptive coverage loop in which a scan configuration θ_t is committed to the protocol digest before the corresponding capture is acquired, and is not selected from that capture's content, so that coverage cannot be staged after the fact to avoid a modified region: the scan law is bound before it observes the structure it inspects, and any omitted region is evident in the committed coverage record. In a dependent arrangement that committed coverage record is a required output of each epoch.

This suits the detection of vessel-identity fraud - the re-registration of a repainted or re-numbered hull, the substitution of a hull under a retained identity, and the laundering of a stolen or sanctioned vessel - none of which can reproduce the committed continuity of the genuine structure however faithfully an applied identifier is copied. In some embodiments the arrangement furnishes a self-witnessing identity for a flag-state registry, a classification society, or a marine insurer.

5 · How this is checked

The filing's verifier audit protocol proceeds in two tiers, both classical and requiring no trained model and no trusted third party. The custody-free property is a property of the record, not a separate claim over custody.

In some embodiments the record is hardened further by multi-vantage over-determination: the specimen is read simultaneously by several detectors sampling one physical field, and an epoch is accepted only if there exists a field admissible under declared physical constraints - field propagation, material response, and a global passivity or Kramers-Kronig energy-balance constraint - consistent, to within a declared residual tolerance, with all detector records on the committed coarse geometry. Acceptance is a feasibility test, computed without reference to any committed input-output coupling network, so no inversion is performed and no unique field need be recovered. The joint record is thereby un-spliceable, and its acceptance rests on physical law rather than on any fitted model. This hardening is distinct from, and additional to, the committed-model continuity test.

Scope

See also

Self-Witnessing Specimens · the plain-language framing this page details.
The Reality Kernel · the apparatus and formalism a self-witnessing specimen is a configuration of.
The filings, at a glance · where Filing 3 sits in the patent stack.
truthbeam.com · the one demonstrated instance of the wider architecture.