Cross-Medium Composite Signatures

Mechanism

The architecture treats every declared event class — a UAS overflight, a drone-swarm coordination event, a high-explosive detonation, a covert RF emitter activation, a contraband-chemical release — as a vector of expected signatures across heterogeneous physical media. The vector is not a fused scalar; each component remains addressable, credentialed, and independently revocable. A class declaration carries an expected RF emission profile (band, modulation, dwell, polarization), an expected acoustic profile (broadband envelope, harmonic structure, propagation-delay distribution), an expected optical profile (radiometric signature, spectral lines, persistence), an expected magnetic profile (dipole orientation, gradient, temporal derivative), and where applicable an expected chemical or particulate profile. Every profile carries declared timing relationships: which medium leads, which medium lags, what the inter-medium delay tolerance is, and how the tolerances scale with range.

Ongoing observations from credentialed sensors are matched against the class library. Each match produces a per-channel confidence; the composite-signature primitive then evaluates joint agreement across channels. Joint agreement is not a simple AND. It is a graded admissibility function: full cross-medium agreement yields high admissibility weight; partial agreement yields a lower weight together with a governed probe directive that schedules an additional observation in the disagreeing medium; structural disagreement yields suppression of the candidate classification and an integrity event recorded against the reporting sensor. The admissibility weight, the probe directive, and the integrity event all enter the lineage chain alongside the underlying observations, so downstream operations receive not just a classification but a credentialed account of how that classification survived cross-medium scrutiny.

Because each channel is governed independently, an adversary attempting to spoof a class must compromise sensors in multiple physical domains simultaneously, under credentialing authorities that need not share a trust root. RF mimicry is decoupled from acoustic mimicry; optical decoys are decoupled from magnetic anomaly injection. The cost of producing a high-admissibility false positive grows multiplicatively with the number of declared channels, while the cost of producing a high-admissibility true positive grows only with sensor density.

Operating Parameters

Declared classes specify a minimum-channel-count parameter (typically two or three) below which no high-admissibility classification can be issued regardless of within-channel confidence. Inter-medium timing tolerances are declared per class and per range bin: an acoustic-RF pair for a small UAS at 200 m might tolerate a 600 ms offset, while at 2 km the tolerance widens to several seconds. Per-channel confidence thresholds are declared by the class authority and may be tightened or relaxed by the admissibility authority without redefining the underlying class. Probe-directive parameters specify the medium to be re-sampled, the maximum probe latency, the credential class authorized to execute the probe, and the fallback behavior if the probe is denied or times out.

Signature libraries are themselves credentialed objects. A library carries an authority, a version, a jurisdictional scope, and a revocation channel. Two meshes operating under different library authorities can interoperate by declaring a translation map between their class taxonomies; the translation is itself credentialed and lineage-bearing. Library updates propagate as governed changes — new classes, deprecated classes, retuned tolerances — and observations recorded against an earlier library version remain valid under that version even after the library evolves.

Alternative Embodiments

In a defense embodiment the channels include passive RF, distributed acoustic arrays, multi-spectral electro-optical sensors, and fluxgate magnetometers; classes describe airborne, surface, and subsurface threats; admissibility weights drive a graduated-response controller. In a civilian critical-infrastructure embodiment the channels include power-quality monitors, vibration sensors, hydrophones on water mains, and chemical sniffers at intake points; classes describe equipment-failure precursors, intrusion events, and environmental excursions. In a public-safety embodiment the channels include gunshot-detection acoustics, RF spectrum monitors, and traffic-camera optical analytics; the same composite-signature primitive arbitrates among overlapping single-channel alerts.

Embodiments differ in how the joint-agreement function is parameterized. A weighted-sum embodiment assigns per-channel weights and thresholds the weighted sum; a Bayesian embodiment treats per-channel confidences as likelihood ratios and combines them under declared priors; a constraint-satisfaction embodiment requires that declared inter-channel timing relationships be satisfied as hard constraints before any agreement is reported. In every embodiment the joint-agreement function is itself a credentialed object, addressable by version and revocable by its declaring authority.

Further embodiments admit chemical and biological channels for hazardous-materials detection, seismic channels for underground-event classification, and ionospheric channels for over-the-horizon RF-event classification. The architecture is indifferent to the physics of the medium so long as each channel admits a credentialed sensor, a declared signature template, and a declared timing relationship to the other channels.

Composition With Other Primitives

Composite signatures compose with the graduated-response primitive: admissibility weight maps to response tier, so a high-agreement classification authorizes a higher-tier response while a partial-agreement classification authorizes only an investigatory probe. They compose with the byzantine-robust observation primitive: a quorum of sensors per channel is required before the channel contributes to joint agreement, defeating single-sensor compromise. They compose with the cross-jurisdictional federation primitive: signature libraries declared under different jurisdictions interoperate through credentialed translation maps. They compose with the dispute-mechanism primitive: a contested classification can be re-adjudicated by re-running joint agreement under an alternative library or alternative joint-agreement function, with the re-adjudication itself entering lineage.

Composite signatures further compose with the temporal-windowing primitive used for transient-event classification. A class declaration may specify that joint agreement must be evaluated within a rolling window of declared duration; observations falling outside the window contribute to the posture vector but not to the live classification. This composition allows the same primitive to handle instantaneous events (a detonation), short-duration events (a UAS pass), and persistent events (a covert emitter campaign) under a single declarative framework. The window is itself a credentialed parameter, addressable and revocable independent of the class declaration.

A further composition is with the resource-budgeting primitive. Probe directives consume sensor time, communication bandwidth, and authority attention; the budget primitive caps the rate at which probes may be issued under a declared authority and shapes the joint-agreement function to prefer high-confidence classifications that do not require probing. When budgets tighten the joint-agreement function is automatically retuned by the admissibility authority, raising the admissibility threshold for partial-agreement classifications and reducing probe issuance, all under credentialed lineage so the operating regime remains auditable.

Distinction From Prior Art

Single-medium detectors — RF-only direction finders, acoustic-only gunshot locators, optical-only object classifiers — produce single-channel confidences without structural cross-medium arbitration. Sensor-fusion systems in the prior art typically fuse channels into an opaque scalar score, losing the per-channel addressability that makes adversarial resistance tractable; they also typically operate under a single trust root, so compromise of the fusion authority compromises the entire output. Multi-modal classifiers in the machine-learning literature train joint embeddings that conflate channels at the feature level, again losing per-channel governance and providing no credentialed lineage. The disclosed primitive differs structurally: channels remain independently credentialed, joint agreement is an explicit and governed function, admissibility weight is graded rather than binary, and the entire chain — observation, per-channel confidence, joint-agreement evaluation, admissibility weight, probe directive — is recorded as credentialed lineage.

Failure Modes And Mitigations

Three failure modes are anticipated and mitigated structurally. The first is correlated channel compromise: an adversary capable of compromising sensors across multiple media simultaneously, for example through a coordinated supply-chain attack against a single sensor vendor whose products span multiple channels. Mitigation: declared channel-diversity requirements at the class level, enforced by the admissibility authority, prohibit a high-admissibility classification from resting entirely on sensors of a single vendor or single trust root. The diversity declaration is itself credentialed and propagates through lineage so an audit can confirm the diversity was honored at the moment of classification.

The second failure mode is class-mimicry, in which an adversary engineers a target to exhibit a benign class signature across all channels. Mitigation: the architecture supports declared discriminator channels — channels chosen specifically because they are difficult to mimic in conjunction with the primary channels — and makes their inclusion conditional on declared threat states. When the threat-state authority declares an elevated state, discriminator channels become required for high-admissibility classification of the affected classes. The threat-state declaration enters lineage; classifications recorded under an elevated state carry the declaration as a precondition.

The third failure mode is library drift, in which the signature library evolves in ways that shift admissibility behavior unintentionally. Mitigation: every classification records the library version and joint-agreement-function version that produced it; library updates are credentialed transactions that can be reverted; and the admissibility authority can declare a quarantine in which classifications produced under a suspect library version are downgraded pending review. The quarantine is itself credentialed and time-bounded.

Disclosure Scope

The disclosure covers the cross-medium composite-signature primitive as an architectural element of the broader credentialed-observation framework. It covers the signature-template format, the joint-agreement function as a credentialed object, the graded admissibility weighting, the governed probe directive issued on partial agreement, and the lineage recording of the full evaluation chain. It does not claim any particular sensor technology, any particular machine-learning architecture for within-channel classification, or any particular physical medium; the primitive is defined at the architectural layer above those choices and admits any credentialed sensor and any credentialed within-channel classifier as a contributing component.