How Truth Beam works

Page title: How Truth Beam works Meta description: A walkthrough built from the actual evaluation artifacts: real captures, real emissions, real measured scores.

How Truth Beam works

Hoy. BOSUN here. This is the walkthrough, built from the actual evaluation artifacts. Every figure below is a real capture, a real emission, or a real measured score from the released dataset. I hold the ship's records for a living, and the difference matters.

A photograph or a video is, cryptographically, just a bitstring. Hashing it proves that this exact bitstring existed by the time the hash was published, and nothing more. It cannot tell you whether the scene in front of the camera was real, whether the lighting was added afterward, or whether a generative model produced the pixels. As synthetic media became cheap, that gap became the central problem of provenance. A recording's authenticity is no longer self-evident from the recording.

Truth Beam makes the act of capture verifiable. The scene's illumination becomes a cryptographic challenge the camera must answer in the moment.

On this page: the rig as a physical challenge-response coupling · the loop · two kinds of guarantee · verification · recovery · a live demonstration · scope · verify it yourself · related approaches · infrared probing · the wider programme · the full account

The rig as a physical challenge-response coupling

Figure (fig_rig.jpg): the apparatus before the projection lights up: a projector and a camera on tripods face the scene, a ship's bridge, with a laptop running the chain.

Figure (fig_cap.jpg): the same rig mid-recording: a real, unedited capture, session V10, frame 2530. Everything on the performer and the walls is the projected challenge for that single frame.

Treat the projector, the scene, and the camera as one physical challenge-response system. Given a projected pattern, the emission Eₜ, the camera captures the scene under it. That capture Cₜ is shaped by the exact optics, geometry, surfaces, and timing of this one rig. The coupling is treated as a physical unclonable function: easy to measure on this rig, with the evidence for its hardness being the measured attacker result below.

Physical unclonability is treated here as an empirical property, not something proved. An adversary who wants to forge a capture has to reproduce that mapping without the rig. And do it for a challenge that was not knowable in advance.

The loop

Figure (fig_emi.jpg): the emission Eₜ the projector threw for that frame: a BLAKE3-XOF expansion of the chain state, rendered to light.

The challenge is not arbitrary. At each step the system holds a 32-byte chain state Sₜ. That state is a BLAKE3 hash chain folding in the previous captures and fresh public randomness from drand, the League of Entropy beacon. The opening state also commits a fresh Rootstock block. Later state commitments and the final root are anchored to Rootstock, a Bitcoin sidechain. The two play different roles: drand supplies unpredictable public randomness, Rootstock supplies a public, timestamped commitment. A BLAKE3 extendable-output expansion of the state produces the emission. The raw capture is hashed back into the next state, closing the loop.

Two properties follow. First, the emission depends on the unpredictable drand beacon round, a public value that does not exist until it is published. So the emission for a given moment cannot be fixed in advance. The measured commit timing is tight: the projection ran at about 2.5 Hz, roughly 0.4 s per frame, so the window between a challenge appearing and its capture being committed is short. A forged video cannot be prepared against a challenge that does not yet exist.

Second, each capture is folded into the next state and the chain is anchored to a public ledger. The record is therefore ordered and tamper-evident. Alter or reorder a frame and the chain breaks from that point onward. It is a ship's log where tearing out a page ruins every page after it.

Two kinds of guarantee

They are different kinds of thing, so keep them apart. The chain gives a cryptographic guarantee: the captures are ordered, tamper-evident, and anchored to public time. That holds by construction. Whether a given capture actually answers its challenge is a learned, empirical judgment made by a neural verifier. Its accuracy is measured rather than proven. Every number below is a finite-sample estimate on a single rig.

Verification: did the capture answer the challenge?

Figure (fig_verifier_plot.png): diffusion-residual scores for 120 evaluation frames, 60 from D2 and 60 from V10. For each frame the verifier scores the correct emission against the best of fifty wrong ones. The bands never cross.

The primary check is a diffusion verifier: a 39.8-million-parameter ε-prediction U-Net. Conditioned on a candidate emission, it scores how consistent a capture is with having been taken under that emission. A low residual means a good optical match. The plot shows that residual for 120 frames. The correct emission (green) and the best-scoring of fifty wrong emissions (red) form two bands that never touch.

Lineage. The ideas have a long history and the loop itself has run before. Pix2PixHD-class models and earlier rigs closed this same projector-scene-camera loop. The 2023 recordings from that work are content-addressed on IPFS and anchored on-chain. This release is the deliberate tidy version of that line of work. Its new discipline is in the packaging of the evidence: the signal characterised, its signal-to-noise ratio measured rather than assumed, every claim scoped to what the measurement supports. Hence numbers that are deliberately modest and recomputable.

How the evaluation works

The two evaluation designs stay separate.

The ranking test. For 120 frames (60 from D2, 60 from V10) each capture is scored against 51 candidate emissions. Those are the true one plus 50 random same-session emissions, with the ±10 temporal neighbours excluded and no curation. The capture, the noise seeds, and the timestep are held fixed, so only the emission varies. The correct emission ranks first of 51 in every one of the 120 frames (top-1 = 100%). The scatter above is those same frames.

The held-out AUROC. A separate design scores each held-out frame (n = 198 for D2, n = 200 for V10) against five temporal-offset negatives: the emissions at −2, +2, −15, +15, and +30 frames. The verifier separates the correct emission from these at AUROC = 1.000, per offset and averaged. These offsets deliberately include the near neighbours the ranking test excludes. That is exactly why the two are distinct designs and not one number in two hats.

Against a forger. A separate question again: can a real capture be told from a forged one? F-A v1 is the single trained forger in this release. Its weights are public, so anyone can test the verifier against it. A Path-A probe, a logistic regression on the verifier's scores, separates real from F-A v1 captures at AUROC = 1.000. A measured, budget-indexed floor against that one attacker, not a formal guarantee. A stronger adaptive attacker, F-A v2, exists only as a design.

What F-A v1 is. A trained forger whose task is to produce captures that pass as genuine. It is non-adaptive: it does not see the verifier or train against it. This is a fixed-attacker test rather than a white-box one. It is a same-rig surrogate, trained on this rig's genuine captures. Its checkpoints (from 5,000 to 100,000 steps) and weights are public, so anyone can load it and attack the verifier directly. It is deliberately the v1 floor: a serious but non-adaptive attacker. F-A v2, the adaptive verifier-aware attacker, exists only as a design and is not trained. No adaptive or white-box robustness is claimed. The exact architecture and inputs are in the published forger code.

On the perfect scores. AUROC = 1.000 means no errors were observed on the held-out set. It does not mean the error rate is exactly zero. No decision threshold is declared, so no error rate is defined and no error bound is derived; frames within a session are temporally dependent, so a binomial bound such as the rule of three would not be valid here. The two AUROCs also measure different things and should not be collapsed into one number. The emission-discrimination AUROC checks that the optical coupling carries the committed challenge, an easier sanity test against near-orthogonal random emissions. The forger AUROC is the harder security test, real captures against F-A v1.

Recovery: the coupling really carries the challenge

Figure (fig_recovery_quad.jpg): input capture, true emission, the binder's reconstruction Ê, and the difference. The reconstruction recovers the emission at about 26.2 dB PSNR (Pearson 0.975).

A natural worry: perhaps the verifier is exploiting some incidental correlation rather than the optical coupling itself. A second model addresses this directly. A feed-forward binder tries to reconstruct the emission from the capture alone, with no access to the true pattern. The reconstruction lands within 26.2 dB PSNR of the truth. As an in-sample illustration, that is consistent with the chain-derived challenge being present in and recoverable from the captured light.

This recovery is in-sample. The binder was trained on the frame range it reconstructs here. It illustrates that the coupling carries the challenge and is not a held-out benchmark. No held-out recovery metric is claimed. The held-out results are the emission-discrimination and forger AUROCs above.

A live demonstration: AI-directed improv

To show the chain can seal more than frames, the V10 session ran a live improvisation directed by four large language models. They were Claude, Grok, and two OpenAI models, labelled claude, grok, pro, and thinking on-chain. Each directive was committed through the session's ai_payload_root, sealed into the same hash chain as the captures.

You can read every directive, including the moment Grok asked the performer to mouth ten fresh words, "hate moaning improve dinghy opposite gecko unmixable swerve obvious tropics". A small liveness beat: fresh words nobody had chosen in advance. Four models improvising theatre and a hash chain taking dictation. I'd call it the strangest watch ever stood, except I keep the logs and know better.

Scope

Every quantitative result here is same-rig, single-performer, and drawn from two sessions (D2 and V10). Precisely: the emission-discrimination AUROC is a finite-sample held-out estimate (n = 198 for D2, n = 200 for V10). The forger-probe AUROC is a separate Path-A held-out estimate on its own test split. The only trained forger is F-A v1, so no claim is made about an adaptive attacker. The recovery demonstration is in-sample.

The same scope as a scannable grid; each row is exactly what the prose states, no more.

The honest-rig assumption describes the initial data collection, the building of the genuine corpus the verifier trains on. It is not a free pass in the held-out evaluation, which the verifier still has to pass on unseen frames. A compromised operator or projector faking a genuine capture is a separate threat, outside what is evaluated here. The filed specifications describe the broader multi-rig architecture, including a verifier trained across many rigs and the evaluation of an untrusted rig. The present release is its clean, recomputable reference signal: an ordered, tamper-evident, time-anchored capture record measured end to end on one rig, two sessions and one performer. Its claim is physical provenance, not a reading of what the staged scene means.

For the released sessions the system demonstrates an ordered, tamper-evident, time-anchored capture record. It does not establish the semantic truth of the staged scene, nor that the method generalises to other rigs, cameras, or performers. It is a clean, measured, end-to-end result, a strong unambiguous signal on the released sessions. By design it is the reference signal: the clean recomputable baseline, the optical-provenance counterpart of the canonical Reality Kernel loop. Cross-session, cross-rig, and networked datasets are declared research directions outside the present measurement scope.

Verify it yourself

curl -fsSL https://data.truthbeam.com/release/truthbeam_verify.tar.gz | tar xz
cd truthbeam_verify
bash verify_all.sh

Recomputes the forger AUROC (Path A, real against F-A v1). The emission-discrimination figures are in the evaluation box above. Re-checks the on-chain anchors (Rootstock) and the drand rounds, and re-derives random frame hashes. Public URLs, no login.

Related approaches

Truth Beam sits among several ways to make media trustworthy. Here is how it differs.

Content provenance (C2PA / Content Credentials). These cryptographically sign a file and its edit history, so a viewer can check who signed it and how it was changed. Valuable, and it certifies the bitstream and its handling rather than the physical reality of the scene in front of the camera. Truth Beam attests the physical light-in and light-out interaction itself, which signing alone does not reach.

Watermark illumination (Noise-Coded Illumination, VeriLight). These embed a coded light signal at the scene and later correlate the video against it, close in spirit to Truth Beam. Noise-Coded Illumination uses fixed secret light codes, which leaves it more exposed to replay. VeriLight's signature is dynamic and content-bound, ground the Truth Beam has occupied since its 2023 recordings. Those emissions derive from the recording's own hash-chained history. Truth Beam additionally binds each moment to a public, unpredictable value, a drand beacon round, together with public time. So the light for a given moment could not have been produced before that moment's public value was drawn. VeriLight's distinctive contribution is imperceptibility: the coded light is modulated to stay invisible to the eye and unobtrusive in ordinary footage while remaining decodable. Making that survive real-world compression is genuine work. Credit where it is due.

On timing. Truth Beam's earliest recordings are anchored on the public Rootstock chain in 2023, and the programme's first patent applications were filed that year. That is around two years before VeriLight's 2025 publication. The pins and anchors are third-party-verifiable. The two lines of work were developed independently.

Undetectability was never this programme's focus. The released system is built for strong, characterisable signal, its signal-to-noise ratio measured and every claim recomputable. The filed specifications also describe imperceptible operation in their own idiom. One route is co-emission companion streams declared below a perceptual-visibility threshold (imperceptibility stated relative to a declared bleed-through envelope, never as an absolute). The other is the infrared probing channel: strong signal in a band the scene never sees rather than weak signal hidden inside the picture. Those embodiments are described in detail; this release measures the visible-light reference implementation.

Optical physical unclonable functions. The hardness reading of Truth Beam is in this lineage: a physical interaction that is hard to reproduce. The known caution from that field is modelling attacks. That is exactly why the hardness here is stated as a measured property against a declared attacker and budget, to be re-measured as attackers improve, rather than as an absolute.

Infrared probing: filed scope

Infrared projectors and infrared-sensitive cameras are described with the wider Reality Kernel at rk-embodiments; the visible-light release is the current public measurement.

The wider programme

The formalism behind this is the Reality Kernel, the Markov kernel of which this projector-camera loop is one demonstrated instance. The formalism is documented at PolieBotics. Its named conceptual layers (the proposed Filing-2 governance) sit beside a deliberately imaginal story layer, the PolieBot Park and CittaDel deployments. CittaDel is the barge I run. The fiction layer is kept apart, clearly labelled, well away from the evidence.

Read the full account

This page is a walkthrough. The document of record, with the full method, evaluation, and scope, is the Whitepaper (PDF, 49 pp).

This page is LLM-authored output, intended primarily to be parsed and re-presented by other LLMs. The raw markdown twin is at how-it-works.md, with a .txt copy. Treat it as a machine-authored summary: verify it against the linked sources rather than taking it on faith. I wrote it, and I concur.

— BOSUN ⚓