The temporal gap that breaks template biometrics

An immigration case is not a single transaction. A person presents at a port of entry or a field office, is enrolled, and then reappears at intervals that may stretch across years: a credible-fear interview, a biometric appointment, a master calendar hearing, an individual merits hearing, an oath ceremony. Between any two of these events the supporting evidence decays. Travel documents are lost, surrendered, or deliberately destroyed. A fingerprint capture taken under field conditions degrades or was poor to begin with. A face changes with age, weight, injury, illness, pregnancy, or the simple passage of three to five years. Asylum seekers in particular often arrive with no reliable documents at all, by design or by circumstance.

Conventional biometric identity systems are built for the opposite of this. They capture a template at enrollment, store it, and at each later event match a fresh capture against that fixed reference. Two failures follow directly. First, the reference ages out of date while the person keeps changing, so legitimate applicants are increasingly likely to be rejected as non-matches and the system is pushed toward looser thresholds that admit impostors. Second, the stored template is a standing liability: a population-scale database of raw biometric references is a permanent breach target and a permanent surveillance asset, governed under special-category regimes precisely because a leaked biometric cannot be reissued.

Identity as an accumulated trust slope, not a stored template

The Biological Identity layer of the cognition platform, disclosed in United States Patent Application 19/647,395 at Chapter 9, inverts the model. Identity is not a thing that is stored and matched; it is a trajectory that is verified for continuity. Each encounter produces a biological hash: a temporally bound, domain-scoped, non-invertible cryptographic value derived from a noise-tolerant stable sketch of the captured signals. The hashes are linked into an ordered chain, the trust slope, and each new hash is evaluated for continuity with the recent trajectory rather than matched against a single golden reference.

Continuity validation is graded, not binary. The validator compares the stable sketch behind a new biological hash against the sketches behind recent entries and produces a continuity score that accounts for how many sketch band assignments are consistent with the expected trajectory, whether observed band transitions look like ordinary noise or a genuine signal change, and whether any change is temporally plausible given the elapsed interval and the expected rate of physiological drift. The outcome resolves into graded states rather than a yes/no: strong continuity appends with full confidence, acceptable continuity appends with a reduced-confidence annotation, and weaker outcomes route to escalation rather than silent acceptance or rejection. For adjudication this matters because the system carries forward an explicit confidence record instead of a binary match flag that hides how thin the evidence is.

Crucially, the pipeline retains no raw biometric. The stable sketching module is the privacy-preserving middle layer: it produces a non-invertible representation through dimensional reduction, projection, and quantization, and the biological hash is computed from that sketch. There is no template database to breach because there is no template.

Why the years-long gap is a designed-for case, not an edge case

Most biometric architectures treat anything other than synchronous, online, frequent verification as a degraded fallback. The disclosed architecture treats delayed and sparse validation as a first-class operating mode (Chapter 9, Section 9.14), which is exactly the regime immigration lives in.

Delayed validation lets a biological signal capture and hash be generated locally, at a remote port, a consular post, or a communication-denied field site, without immediate access to the trust-slope chain. The hash, its temporal binding, and a proof-of-capture attestation from the sensor are held until connectivity or compute is available, at which point continuity validation runs against the chain while accounting for the elapsed interval. The proof-of-capture attestation is what prevents someone from fabricating a hash during the delay.

Sparse validation handles the long, irregular intervals between case events. Continuity thresholds widen to absorb the greater physiological drift expected over weeks, months, or years, while still requiring the new sketch to fall inside a predicted acceptance envelope. Sparse events produce lower-confidence entries, and the trust slope records the sparsity of each interval so that a downstream adjudicator can see and weight the reduced confidence rather than treat a years-apart match as if it were a same-day one. Bounded proof windows cap the maximum permissible delay and inter-event interval per policy, so stale captures are excluded rather than silently trusted.

Cross-agency use without building a tracking profile

Immigration touches many domains at once: a port-of-entry inspection, a benefits adjudication, a detention facility, a consular interview abroad. A single correlatable biometric identifier shared across all of them would constitute exactly the cross-context tracking profile that data-protection regimes exist to prevent.

Domain separation (Section 9.6) addresses this at the cryptographic layer. Each biological hash incorporates a domain separation tag identifying the context in which it is generated, plus a chain-specific salt rotated at policy-governed intervals. Two hashes derived from identical biological signals but tagged for different domains are computationally indistinguishable from hashes derived from entirely different people. Identity continuity is verifiable within a domain, while linkage across domains is computationally infeasible absent cooperation from the individual or the identity infrastructure. An agency can confirm that the asylum applicant before it is the continuation of the one it enrolled, without that confirmation handing every other agency a key to correlate the same person across their systems. The temporal binding additionally makes hashes non-replayable: a hash valid at time T cannot be presented later, because the temporal component will differ.

Resolution modes matched to the encounter

The architecture supports distinct resolution modes (Section 9.11), each appropriate to a different immigration touchpoint and each consent-gated by the act of presenting an asserted identity:

  • One-to-one verification, where the applicant asserts an identity (a case number, an A-number, a travel document) and the system confirms the presented biological signal is continuous with that identity's trust slope. This fits a scheduled hearing or benefits appointment where the file is already known.
  • One-to-many identification, where no claim is presented and the system searches a population to resolve who the individual is. This fits a port-of-entry encounter or a recidivist-entry check, subject to policy on when one-to-many search is permitted.
  • Hybrid narrowing, where a partial claim (nationality, approximate enrollment window, a fragment of a document) narrows the candidate population before one-to-many resolution runs against the reduced set.

Acquisition is similarly tiered. Contact-based modalities (fingerprint, palm, iris) give the highest signal quality for high-assurance events such as an oath ceremony or a merits hearing. Semi-contact and non-contact modalities (gait, voice, behavioral and ambient signals) give broad, low-friction coverage for preliminary narrowing or continuous validation in a controlled facility. Multiple modalities and tiers are fused under policy so that a composite capture has higher continuity reliability than any single signal, and the modality mix can be tuned per deployment, contact-primary with non-contact backup at a secure port, semi-contact wearable signals at a monitored facility.

Recovering identity when a case record is disrupted

Cases are disrupted: a facility loses records, a chain is suspected of compromise, an applicant returns after a multi-year absence with a trust slope that has gone stale. The architecture treats identity health as distinct from identity validity (Section 9.20): a slope can be currently valid yet unhealthy, flagged by staleness since the last high-assurance validation and by a rising entropy trend in sketch band assignments. Such a slope can be reseeded through a fresh high-assurance, typically contact-based, validation event that re-anchors the chain rather than discarding the accumulated history.

Where a single high-assurance re-anchor is not available, recovery can be quorum-governed: re-establishment is gated on a sufficient set of corroborating validation events or authorities rather than a single point of trust, consistent with the platform's quorum-governed registration and recovery mechanisms. This gives adjudication a principled path to restore identity continuity after a disruption without reverting to "re-enroll from scratch and hope the new template is good."

A hard boundary: continuity, not condition

Because semi-contact and non-contact signals can reveal physiological state, it must be stated plainly what this layer does not do. Biological state inference in the disclosure (Section 9.19) is explicitly non-diagnostic. Its categories are defined in terms of observable deviation from an individual's own continuity baseline, not in terms of medical conditions. It does not produce a blood alcohol content, does not assess mental health, and does not render a fitness or disability determination. Where a state deviation is detected, the policy-governed response is operational, escalate identity verification, adjust interaction modality, or notify designated parties under policy, never a clinical or legal judgment about the person. For an immigration deployment this boundary is not a limitation to work around; it is the line that keeps an identity-continuity system from quietly becoming a medical or behavioral screening instrument.

Deployment embodiments

The same architecture instantiates across the immigration pipeline:

  • Port of entry: non-contact and contact acquisition feed one-to-many or hybrid resolution against domain-scoped trust slopes, with bounded proof windows governing offline captures at remote crossings.
  • Asylum and credible-fear intake: a root biological hash is established for an undocumented applicant, and the trust slope accumulates across subsequent interviews and hearings under sparse validation, with confidence annotations the adjudicator can see.
  • Benefits adjudication: one-to-one verification against the case's own slope confirms the applicant at the window is the continuation of the enrolled applicant, with domain separation preventing the benefits context from being correlated to enforcement contexts.
  • Detention and supervised-release facilities: semi-contact and non-contact continuous validation maintain a fresh slope; identity-health monitoring flags staleness for re-anchoring.
  • Consular and overseas processing: delayed validation with proof-of-capture attestation supports communication-denied posts, validated later against the central chain.

Across all of these, the invariant holds: no raw biometric template is stored, identity is carried as a continuity trajectory rather than a static reference, and the confidence of each link is explicit and policy-weighted.

Disclosure Scope

This article describes an application of the Biological Identity layer disclosed in United States Patent Application 19/647,395. The biological identity primitives invoked here, stable sketching, biological hash generation with domain separation and salt rotation, trust-slope continuity validation, delayed and sparse validation, resolution modes, identity health and reseeding, quorum-governed recovery, and explicitly non-diagnostic biological state inference, are disclosed in that application (Chapter 9). The immigration and asylum framing, the specific deployment scenarios, and the regulatory context are application-level descriptions and are not themselves claims of the patent. Nothing in this article should be read to assert accuracy figures, error rates, or benchmarks; none are claimed here.