Cross-Modal Biological Hash Fusion

Mechanism

Each biological modality is processed by an independent pipeline whose stages are feature extraction from the raw sensor signal, normalization against modality-specific drift sources, sketching into a compact intermediate representation, and hashing with a domain-separation tag that encodes the modality identity, the pipeline version, and a salt scoped to the deployment. The outputs of these per-modality pipelines are fixed-length hashes that share no algebraic structure across modalities; the domain-separation tag ensures that even structurally similar feature spaces produce hashes that cannot be correlated except through the fusion procedure.

The fusion stage takes the per-modality hashes together with per-modality confidences. A confidence is a scalar in a bounded range produced by the same pipeline that produced the hash, derived from observation-quality indicators specific to the modality: signal-to-noise ratio for voice, contrast and viewpoint stability for facial geometry, stride regularity and visibility for gait, sample density and dwell time for micro-movement. The confidences are normalized so that they sum to one over the modalities currently contributing, with modalities below a configured admissibility floor excluded.

The combining function is a one-way mixer: it accepts the per-modality hashes and the normalized confidences and produces a fixed-length fused hash through a construction that depends on every input but is reversible to none of them. The mixer is built from a keyed hash whose input is the concatenation of (modality identifier, confidence quantum, modality hash) tuples ordered by a canonical modality ordering, with the keyed hash's key drawn from the deployment's domain-separation salt. The output binds to all inputs without exposing any one. An attacker who recovers the fused hash gains no information about which modalities contributed at what confidence; an attacker who additionally compromises a single modality's pipeline gains no information about the other modalities or about the fused result for prior or future moments.

Identity continuity over time is established by chaining fused hashes into an identity stream. Each stream entry binds to the prior entry through a credentialed lineage stamp, and downstream verifiers compare incoming fused hashes against expected ones using a similarity oracle that operates on the fused-hash space without ever requiring access to the underlying modality hashes.

Operating Parameters

The modality set is the collection of pipelines available to a deployment; common deployments combine two to six modalities. The admissibility floor is the minimum per-modality confidence below which a modality is dropped from the fusion; values are typically set so that approximately five percent of observations from a healthy modality fall below the floor under nominal conditions. The weight ceiling bounds the maximum normalized weight any single modality may contribute regardless of its raw confidence; representative deployments cap any single modality at 0.5 or 0.6 to prevent a transiently dominant modality from approximating a single-modality system.

The weight floor is the minimum normalized weight assigned to any admitted modality, ensuring that an admitted modality contributes nontrivially even when its raw confidence is the lowest in the contributing set. The fusion period is the interval at which the fused hash is recomputed and emitted; values from tens of milliseconds for active-authentication deployments to several seconds for passive continuous-presence deployments are supported. The continuity window is the maximum interval over which a missing-modality observation may be tolerated before the identity stream is considered to have lapsed and re-enrollment is required.

The confidence quantum is the granularity at which raw confidences are rounded before entering the mixer; quantization stabilizes the fused output against jitter while preserving the influence of meaningful confidence variation. The domain-separation salt is configured per deployment so that hashes produced under one deployment are structurally non-comparable with hashes produced under another, preventing cross-deployment correlation. The similarity threshold at the verifier is calibrated against the deployment's required false-accept and false-reject rates and may be adjusted as a credentialed observation if the deployment's risk posture changes.

Alternative Embodiments

A first embodiment combines gait and voice for an environment in which subjects are observed at distance and in motion, with micro-movement as a passive reinforcement modality during stationary intervals. A second embodiment combines facial geometry and voice for a kiosk interaction in which the subject is briefly stationary, with gait providing pre-arrival continuity. A third embodiment combines micro-movement and physiological-rhythm modalities for continuous wearable authentication where neither modality alone resists adversarial replay.

A fourth embodiment supports modality dropout: when a modality's confidence falls below the admissibility floor, the fusion proceeds with the remaining modalities and the verifier's similarity threshold is adjusted along a credentialed schedule that reflects the reduced collision resistance of the smaller modality set. A fifth embodiment supports modality bring-up: when a previously absent modality re-appears, its confidence is ramped in over a configured horizon to prevent abrupt fused-hash discontinuity.

A sixth embodiment realizes the mixer as a sponge construction whose absorption phase consumes the modality tuples and whose squeeze phase produces the fused hash. A seventh embodiment realizes the mixer as a Merkle accumulation over the modality tuples, which supports selective-disclosure proofs in deployments where a verifier must be convinced that a given modality contributed without learning the contributions of the others. An eighth embodiment integrates a bounded-distance metric over the fused-hash space, allowing the verifier to admit small biological drift between identity-stream entries without admitting fabricated entries.

A ninth embodiment supports cross-deployment portability through a credentialed re-salting procedure in which the subject's per-modality hashes are presented to a re-salting authority that produces a fused hash valid under the destination deployment's salt without disclosing the modality hashes to the destination. A tenth embodiment couples fusion with a freshness-and-liveness primitive: a credentialed liveness indicator from each modality's pipeline is bound into the fused hash so that a verifier who admits the fused hash also admits the liveness assertion of every contributing modality.

Composition With Other Primitives

The fusion mechanism composes with the credentialed-observation primitive: each fused hash is emitted as a credentialed observation signed by the device's identity-stream key, and each per-modality pipeline's domain-separation salt is itself credentialed. The fusion mechanism composes with the lineage primitive: the identity stream is a chain of fused hashes linked by lineage stamps, and the chain provides the audit substrate for any later challenge. The fusion mechanism composes with governed actuation: an actuator gate that depends on subject identity consults the fused hash directly, never requiring access to the underlying modality hashes.

The fusion mechanism composes with the spatial-mesh substrate when identity is asserted across a fleet of receivers; the fused hash is a small, opaque, credential-bearing observation that may traverse the mesh under the same admissibility rules as any other observation. The fusion mechanism composes with the privacy primitive at the verification boundary: the verifier's similarity oracle operates on fused hashes alone, so a verifier need never see the per-modality content nor the per-modality confidences in raw form.

Prior-Art Distinctions

Conventional multi-modal biometric systems combine modalities at the score level — each modality produces a match score, and the system fuses scores by weighted sum or rule combination. Score-level fusion exposes per-modality scores to the verifier and to any party who can observe the fusion stage, which makes those systems incompatible with deployments that require per-modality privacy. The mechanism here fuses at the hash level under a one-way mixer, so per-modality information is not present at the verifier at all.

Conventional feature-level fusion concatenates raw features before classification, which entangles the modalities so deeply that compromise of any one modality's pipeline can leak information about the others. The mechanism here keeps the per-modality pipelines fully separated through hashing with domain separation before the mixer, which structurally prevents that leakage. Conventional template-protection schemes for single-modality biometrics produce one-way templates but do not address fusion; the mechanism here extends the one-way property across modalities while preserving graceful degradation under dropout and continuous-presence reinforcement under bring-up.

Conventional continuous-authentication architectures combine modality signals into a running score that the verifier monitors directly; the mechanism here instead chains fused hashes into a credentialed identity stream, which both preserves privacy and provides an audit substrate. The bounded-weight construction with explicit ceilings and floors is itself a distinguishing property: it prevents both single-modality dominance during transient confidence spikes and complete-suppression of a contributing modality when its confidence is merely the lowest of an admitted set.

Disclosure Scope

The disclosure covers the per-modality pipeline structure with feature extraction, normalization, sketching, and domain-separated hashing; the bounded-weight combining function with admissibility floor, weight ceiling, and weight floor; the one-way mixer construction and its sponge and Merkle-accumulation embodiments; the identity-stream chaining with lineage stamps; the modality-dropout and modality-bring-up procedures; the cross-deployment re-salting procedure; the liveness-binding embodiment; and the compositional embodiments with credentialed observations, lineage, governed actuation, the spatial-mesh substrate, and the privacy primitive.

The associated Cognition Patent situates this primitive among the biological-identity cluster. The primitive is not limited to any particular modality combination. It applies wherever an identity assertion must be both robust to modality variability and resistant to disclosure of the underlying biological signals.

The disclosure also covers degenerate cases. A single-modality configuration reduces the fusion to a domain-separated hash of one modality with weight one, and the same identity-stream and verifier behaviors apply unchanged. An all-modalities-equal configuration reduces the bounded-weight scheme to uniform averaging over the admitted set, retained for deployments where confidence indicators are unreliable or unavailable. An all-modalities-zero-confidence configuration produces no fused hash for the affected interval; the verifier observes a continuity gap and applies the deployment's configured re-enrollment policy.

The disclosure further covers extension to non-biological modalities that share the bounded-confidence and domain-separation properties — behavioral modalities such as keystroke dynamics, contextual modalities such as device-handling rhythm, and environmental modalities such as room-acoustic fingerprint — admitted into the same fusion mixer under the same construction. The mixer's structure does not depend on biological origin; it depends only on the per-modality hash and bounded confidence shape.