Design identity and physical identity
A Helix optical design is derived from the work's evidence commitment. That relationship is useful: the design can be checked against the record from which it was generated. It does not make the design impossible to copy. A deterministic pattern can, in principle, be reproduced by anyone who obtains the pattern or implements its public derivation.
An optical physically unclonable function, or PUF, addresses a different question. Its candidate distinguishing information comes from stochastic manufacturing variation measured after a particular unit is fabricated. This protocol describes how that variation would be enrolled, observed, and evaluated. It does not claim that rendering an optical design in the Artist Studio creates a qualified physical PUF.
The term “unclonable” names a research and engineering objective, not an absolute guarantee. A useful physical claim must identify the tested population, adversary classes, measurement conditions, decision rule, and uncertainty. Without those boundaries, the word communicates more assurance than the available evidence supports.
The four relationships to preserve
| Relationship | What it contributes | What it does not establish alone |
|---|---|---|
| Evidence root to optical design | A reproducible connection to the signed work record | A unique manufactured object |
| Manufactured unit to enrollment template | A reference observation of that unit | Resistance to all copies or substitutions |
| Fresh observation to template | A comparison under a named reader profile | Continuity of the attachment to the artwork |
| Carrier to attachment profile | Evidence about the commissioned assembly | Authenticity beyond the profile's evaluated scope |
The public token envelope can bind these relationships using identifiers and digests. Those commitments make substitution detectable when verification is performed correctly. They do not turn an unevaluated measurement into a qualified result. HXP-002 describes the envelope, while HXP-007 and HXP-008 address attachment continuity.
What enrollment records
Enrollment associates the physical unit and manufacturing lot with a reader profile, challenge conditions, protected raw observations, a normalized feature template, quality metrics, and a template digest. The record should be sufficient for an authorized evaluator to reconstruct what was measured and which method produced the reference.
Only the digest of the protected template travels in the public token envelope. Raw enrollment observations remain access-controlled. A digest lets a verifier check that supplied data match a commitment when that data are legitimately available; it does not recover the template or itself perform a physical comparison. Public disclosure of a hash is therefore different from publishing the reference measurement.
Enrollment quality matters independently of later comparison quality. A poorly focused, contaminated, or misidentified enrollment sample can create a stable reference to the wrong thing. Traceability between the unit, lot, work record, measurement session, and authorized commissioning action is necessary before any performance claim is considered.
Reader profiles and controlled observations
A reader profile declares the geometry, illumination, applicable wavelength or angle, polarization, focus, and fiducial handling needed for the observation. The public contract identifies the method and its valid operating envelope. Proprietary fixture construction, manufacturing recipes, private calibration controls, and protected raw templates are outside this article.
The purpose of control is to distinguish variation between units from variation caused by measurement. A reader that changes its illumination or registration behavior between enrollment and verification may compare acquisition artifacts rather than stable unit features. A qualified result therefore depends on both the carrier and the observation process.
A photograph uploaded through a general-purpose interface is not automatically a controlled-reader observation. Device capability, operator guidance, and an attractive preview do not supply calibration or attestation. Where the reader profile is unavailable or the observation cannot be trusted to satisfy it, the physical axis should remain indeterminate or not evaluated.
Matching and abstention
Normalized correlation is the initial comparison metric in this candidate protocol. The metric compares a fresh normalized observation with the enrolled representation. A threshold and quality rules then determine the reported outcome. Later extractors require new profile identifiers and conformance vectors; they must not silently reinterpret an older enrollment.
Threshold selection trades false acceptance against false rejection. Tightening a threshold may reduce acceptance of different units while making genuine worn or imperfectly observed units harder to recognize. Quality-based abstention adds a third outcome: insufficient evidence to decide. Indeterminate observations must remain visible in the report rather than disappearing from the denominator used to advertise performance.
No single score should be presented as universal authenticity. The meaningful statement is that a specified observation met a particular unit-correspondence rule, within its qualified conditions and at the reported time. Issuer authority, registry freshness, and attachment continuity remain separate requirements.
Proposed performance targets
The following are qualification targets, not achieved performance measurements:
| Measure | Candidate target within the qualified envelope |
|---|---|
| False acceptance | Upper 95% confidence bound no greater than 10^-6 |
| False rejection | Upper 95% confidence bound no greater than 1% |
| Indeterminate outcomes | No greater than 2%, with the evaluated population stated |
These targets are demanding because a rare false acceptance cannot be established merely by showing several successful demonstrations. The evaluation must justify its population, sampling, dependence assumptions, and uncertainty method. A large number of correlated comparisons derived from a few units is not equivalent to a large independent physical sample.
For intuition, if independent trials share a fixed false-accept probability p, the probability of observing zero false accepts in n trials is (1-p)^n. Solving that expression at 0.05 gives a one-sided 95% upper bound of 1 - 0.05^(1/n) when zero events are observed. This illustrative calculation is not a Helix result and does not remove the need to justify independence or representativeness. The NIST statistical handbook provides background on confidence intervals for proportions.
Sampling genuine and challenging units
Genuine-unit trials measure repeatability across permitted sessions, readers, operators, and environmental conditions. Different-unit trials measure separation across the intended manufacturing population. Lots must be represented explicitly so that a result from a narrowly selected batch is not generalized to later production without evidence.
Mandatory challenging negatives include same-mask overruns, reconstructed-template samples, high-resolution copies, and malicious-manufacturer samples. These categories test whether the observed separation survives more than ordinary unrelated-unit comparisons. The public report can state the categories and outcomes without publishing sensitive fabrication procedures or a step-by-step reproduction recipe.
Development, threshold selection, and final evaluation must be separated. An evaluator should be able to identify the frozen method used for the final result and distinguish preregistered exclusions from decisions made after failures were observed. Failed units and indeterminate reads are part of the evidence, not inconvenient exceptions to remove silently.
Aging, replacement, and continuity
An optical response may change through wear, contamination, material aging, or movement of the attachment. A qualified profile needs an evaluated service envelope and a policy for observations outside it. The absence of a match after damage does not establish why damage occurred, and a surviving optical match does not prove that the carrier stayed attached to the same work.
Replacement must preserve history. A newly enrolled unit can be associated with the work through an authorized, disclosed event; it should not masquerade as the original unit's uninterrupted physical continuity. Readers should be able to distinguish the original enrollment, any superseding carrier, and the scope of evidence supporting the current assembly.
Manufacturing changes, reader revisions, or material substitutions may require requalification. Compatibility should be demonstrated under a named profile rather than inferred because the new component looks similar or uses the same marketing name.
What the current platform can honestly display
The software can represent design commitments, carrier data, enrollment digests, and separate physical verification signals. Browser NFC preparation and readback can support a carrier workflow on compatible equipment. These capabilities are useful foundations, but they do not themselves establish qualified optical-PUF performance or trustworthy physical-reader measurements.
A demonstration or user-entered observation must retain that classification. The interface should not upgrade it to a physical authenticity verdict simply because a digital signature passes. When physical qualification is absent, the digital evidence can still be valid while the physical claim remains unvalidated.
Dossier and further reading
A complete qualification dossier links the profile version to sampling, enrollment quality, reader controls, comparison code, threshold selection, genuine and challenging trials, failures, indeterminate outcomes, confidence bounds, and independent review. Public summaries should expose the basis and limits of the claim while protecting raw enrollment material and proprietary production information.
Read HXP-003 for result aggregation, HXP-005 for correspondence with the artwork itself, and HXP-009 for the gate between a candidate method and a qualified physical claim. This article specifies that gate's optical evidence requirements; it does not announce that the gate has been passed.