01RESEARCH & SYSTEM DESIGN

Multiple signals. A considered decision.

BioAuth studies whether quality- and attack-aware fusion can improve the balance between security, genuine-user experience and computational cost.

01THE EVIDENCE CHANNELS

Understand what each signal can tell us.

Explore the purpose, method and limits of each input. All channels remain separate until an immutable evidence snapshot is evaluated by the selected policy.

01 / IDENTITY

Is this the expected person?

A one-to-one facial comparison evaluates a live capture against an approved reference template. Model and preprocessing versions must be compatible before evidence can be interpreted.

METHOD: Face embeddings · cosine similarity
OUTPUT: Match evidence + quality + model version

A face match alone cannot distinguish a person from a replay of that person.

02QUALITY- & ATTACK-AWARE FUSION

Reliability comes before a score.

Every policy shares mandatory safety gates. Face mismatch or strong qualified PAD evidence can reject an attempt; missing or unreliable required evidence prevents acceptance.

C / L1

Fixed-weight baseline

Combine normalized face, PAD and physiological support using validation-selected fixed weights and decision bands.

C-Q

Quality-only baseline

Weight the same evidence by channel reliability, retaining the same required gates and evaluation protocol.

D / L2

Quality & attack awareness

Add explicit conservative rules for suspicious patterns and channel disagreement. Measure the resulting cost in retries and coverage.

L3 is an ML-assisted advisory strategy planned for offline evaluation. It must retain the shared safety gates and L2 safety holds. These are alternative policies, rather than sequential processing stages.

03EXPLAINABLE OUTCOMES

Knowing when to ask again.

ACCEPT

All required evidence is usable, safety gates pass and the selected policy supports acceptance.

REJECT

Reliable identity mismatch, qualified attack evidence or another explicit rejection rule prevents this attempt.

RETRY

Evidence is insufficient, unreliable or inconclusive. A fresh capture is needed; missing physiology alone is not proof of attack.

04MODULAR BY DESIGN

A reusable core. Clear boundaries.

The proposed Python Core owns evidence and decisions. The application layer owns sessions, enrollment review and authorization. The browser captures data; the server selects and runs the authoritative policy.

React web clientTypeScript capture SDKFastAPI servicePython Core

PostgreSQL persistence, encrypted reference templates and role-filtered audit records belong to the service and infrastructure layers. This is the architecture specified in the design report; the public website currently hosts documentation and an illustrative simulation.

05REPRESENTATIVE INTEGRATION

Step-up verification for a sensitive action.

The controlled demo design covers reviewed account enrollment and verification before a payout-destination change. Biometric acceptance and authorized manual review are both required for account activation; routine review cannot override a biometric rejection.

The document portrait is used as a facial reference. The design does not authenticate official documents or provide full KYC. Dynamic light challenges, native secure capture, deep-learning rPPG, OCR and NFC are deferred extensions.

Explore the evaluation plan

FROM DESIGN TO IMPLEMENTATION

Explore the thinking behind BioAuth.

Read the architecture, evidence contracts and experimental design.