{"id":"0167cbb4-05f9-4dbc-af4b-cf2359640dd9","arxiv_id":"2504.21846","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"A speaker-deployed projector embeds cryptographically hashed features of the speaker's identity and lip motion into the scene, and any recording can be verified by comparing those features to the video content.","lead":"VeriLight projects a secret, content-specific optical code into a live speech environment, so every video recording naturally captures a mark that can later be checked for authenticity. Downstream verification compares the recovered mark to the face and lip motion in the video and flags edited or deepfaked footage without needing the camera or uploader to cooperate.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The 100% true positive rate is an in-sample estimate: thresholds and the 16-signal feature subset are chosen using the same data on which the headline detection numbers are reported.","rationale":"The reader's weakest assumption concerns whether the 16 FaceMesh-derived signals generalize to unseen falsifications and poses; my concern is closely related but focuses on the evaluation protocol: because threshold selection and feature selection are performed on the same data used for the reported 100% recall, that headline number is an in-sample estimate. This does not invalidate the system concept, and the threshold-independent AUCs plus the released code provide real support for the approach, so the conditional-accept verdict remains appropriate. I considered two other candidate concerns. First, the proof of Theorem 2 in Appendix A.3 uses an independence assumption over comparisons of vector pairs that is not justified; however, the hash-size choice is also supported empirically in Figure 8, so this theoretical flaw is not the most load-bearing for the central detection claim. Second, adversarial robustness is tested on only two attack families and dynamic-feature perturbation attacks are explicitly left to future work; this is a genuine limitation but the paper states the claim narrowly and the adversarial-training experiments provide some evidence. The threshold/feature-selection circularity is the most load-bearing because it directly affects the paper's most prominent quantitative claim and can be settled by a straightforward held-out evaluation.","tokens_in":31575,"tokens_out":7826,"duration_ms":83209,"concrete_test":"Split the Section 8 dataset into disjoint folds by participant or recording session. On the training fold only, set the identity and dynamic hash-distance decision thresholds (and, if feasible, re-run the dynamic feature selection on a training-only portion of the §9.1 multi-camera dataset). Freeze the feature set and thresholds, then evaluate TPR and AUC on the held-out fold, counting localization failures as detection failures. If the held-out true positive rate is below 100%, the advertised 100% TPR is an artifact of in-sample tuning rather than a validated deployment property.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central empirical claim is the 100% true positive rate and AUCs ≥ 0.99 on over 2,000 deepfaked videos (Abstract, Section 8). Section 7 states: \"We empirically set our descriptor comparison decision thresholds using data from §8.\" Section 4.2 selects the 16 FaceMesh signals via forward sequential feature selection on the multi-camera dataset that is later used for the pose-invariance and fine-grained AUC evaluation in §9.1. Thus the same recordings determine which features are used, where the decision thresholds sit, and the reported detection performance. In particular, the 100% recall is the recall at thresholds tuned on the very videos whose recall is being reported; it is not a validated out-of-sample operating point. The table-level AUCs are threshold-independent and remain informative, but the deployment-facing claim that VeriLight detects every one of the over 2,000 fake videos is not supported without a held-out threshold-selection protocol. The paper's own results also hint at sensitivity: 36 of 2,400 videos failed optical signature localization (§8.1), and even after localization the fine-grained window AUC drops to 0.72 when only 10–20% of a window is modified (Figure 8). None of this disproves the system concept, but it does mean the headline recall should be read as an optimistic in-sample number rather than a guaranteed detection rate.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes VeriLight, a system that embeds cryptographically secured optical signatures into live speech events by projecting imperceptible modulated light onto a surface near the speaker. The embedded signature carries a compact, locality-sensitive-hashed descriptor of the speaker's identity and lip/face motion, recovered later from arbitrary downstream videos and compared with descriptors computed from the portrayed content. The authors report AUCs of at least 0.99 and a 100% true positive rate on over 2,000 deepfaked videos, robustness across recording angles, distances, devices, surfaces and post-processing, and resistance to two white-box adversarial attacks. The paper includes a hardware prototype, a large evaluation corpus, artifact links, and a theoretical analysis of LSH hash size. The main concern is that the headline recall and some robustness numbers are computed on the same data used for threshold setting and feature selection, so the reported operating point is not yet an out-of-sample estimate.","tokens_in":31732,"tokens_out":6496,"duration_ms":73819,"significance":"If the results hold, VeriLight is a meaningful contribution to media authentication: it shifts protection from recording-device cooperation to the event site, provides an end-to-end hardware and software prototype, and demonstrates broad empirical separation between real and falsified videos. The evaluation is unusually extensive for the area, covering 1,883 reenactment and 473 identity-swap deepfakes, multiple cameras, surfaces, lighting conditions, distances, post-processing operations, and adversarial training objectives. The LSH-based compact descriptor framework is a useful general tool, and the explicit release of code and hardware reproduction guides strengthens the work. The central limitation is that several performance claims are in-sample: the decision thresholds are tuned on the section 8 data and the dynamic feature subset is selected on the section 9.1 data, so the 100% recall figure should be understood as an optimistic, threshold-fit estimate rather than a validated deployment guarantee.","major_comments":[{"comment":"The paper states in §7 that \"We empirically set our descriptor comparison decision thresholds using data from §8,\" and Table 1 then reports a 100% true positive rate on the videos of §8.1. Since the thresholds are fit to the same videos whose recall is reported, the 100% recall is an in-sample operating point, not an out-of-sample detection guarantee. Please split the data at the participant/session level into calibration and evaluation sets, or use nested resampling, and report recall at the resulting held-out threshold. At minimum, report a precision-recall sweep over thresholds and qualify the abstract and §8.1 claims accordingly.","section":"§7 and §8.1 (Table 1)"},{"comment":"The 16 dynamic FaceMesh signals are selected via forward sequential feature selection on the multi-camera dataset described in §9.1, and the same dataset is then used to evaluate pose invariance, modification granularity, and hash-size effects. If the reported AUCs are computed on the same recordings that determined the feature subset, the robustness numbers are optimistically biased. Please use nested feature selection with held-out sessions or cameras, or otherwise state explicitly whether any test recording contributed to feature or hash-size selection.","section":"§4.2 and §9.1 (Figure 8, Table 3)"},{"comment":"Theorem 2 is presented as a proof that hash-size effects are independent of input dimensionality, but the proof as written is not a well-defined probability statement. It treats a single hash comparison as a Bernoulli event and multiplies over a continuum of pairs, and the integral expression uses a constant summation bound k*theta_th/pi even though the conditioned angle varies inside the integral. Please either provide a rigorous concentration argument over a finite comparison set or clearly label the derivation as an approximation, since the current text overstates the mathematical support for the hash-size choice.","section":"Appendix A.3, Theorem 2"}],"minor_comments":[{"comment":"Please state the exact denominator for the 100% recall after excluding the 36 videos in which the signature could not be localized, and clarify whether a verification failure on a fake video is counted as detection, abstention, or exclusion.","section":"§8.1"},{"comment":"There is a typo: \"FaceMech\" should be \"FaceMesh.\"","section":"Appendix A.2"},{"comment":"The text calls theta_th a \"cosine similarity decision threshold,\" but theta_th is an angle, not a cosine similarity; please use consistent terminology.","section":"Figure 12 and §A.3"},{"comment":"The sentence \"We empirically set our descriptor comparison decision thresholds using data from §8\" should be moved to the experimental section and accompanied by a description of the calibration protocol, including how many videos were used and how thresholds were chosen.","section":"§7"}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThe thing to know: VeriLight is one of the few proposals I've seen that shifts deepfake protection to the physical scene rather than the pixel stream, and it does so with a working prototype. A speaker-deployed light modulator embeds a cryptographically bound, content-derived descriptor (identity + lip/face motion) into every recording. The idea is genuinely new in this configuration, and the paper backs it with an unusually large custom evaluation.\n\nThe engineering deserves credit. The LSH compression of ArcFace and FaceMesh signals to 150 bits is clever and well motivated. The optical embedding scheme—BPSK-modulated cells, concatenated error correction, adaptive intensity to balance SNR and perceptibility—is properly evaluated across surfaces, lighting, distances, angles, and post-processing. They release code. The threat model is realistic, and the paper is transparent about limitations: still cameras, projection region visibility, feature scope, and secret-key security.\n\nThe soft spots are real but not fatal. The headline 100% true positive rate is in-sample: decision thresholds are set on the same Section 8 videos whose recall is being reported, and the 16-signal dynamic feature subset is selected on the multi-camera dataset later used for robustness evaluation. That means the recall figure is an optimistic estimate, not a validated out-of-sample operating point. The AUCs are threshold-independent and remain strong (≥0.99), so the central concept holds, but 'detects every one of over 2,000 fakes' should be read with that caveat. Also, 36 of 2,400 videos failed localization and aren't cleanly accounted for, and the fine-grained detection AUC falls to 0.72 when only 10–20% of a window is modified. The adversarial robustness conclusion rests on two attack families—honest and useful, but not a security proof. The Theorem 2 proof in the appendix uses an independence assumption across comparison pairs that isn't justified; minor, since the hash-size choice is empirically validated.\n\nWho's this for? Security and multimedia forensics folks, and anyone working on media provenance beyond C2PA-style digital signatures. It's a credible complement, not a replacement, for passive detectors.\n\nI'd send this to peer review. It deserves a serious referee. The right outcome is conditional acceptance with a request for a held-out threshold-selection protocol and clearer accounting of localization failures.","headline":"VeriLight is a credible, well-engineered physical-signature system for speech video verification; the headline detection numbers are in-sample, but the concept and the AUC evidence are strong enough to warrant serious peer review.","tokens_in":32416,"tokens_out":2813,"would_cite":true,"duration_ms":27471,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A speaker can embed a signed semantic fingerprint into every video of a live speech using imperceptible modulated light, so later deepfaked copies fail a content check.","keywords":["video falsification detection","deepfake detection","physical signatures","optical embedding","locality-sensitive hashing","speech video authentication","message authentication codes"],"falsifier":"Run VeriLight on a corpus of reenactment deepfakes from a model not in the tested set, such as a newer lip-sync model, that changes a single word in less than 20 percent of a 4.5-second window; if even one such fake is verified as real, the claim that the selected facial-analysis features catch content-changing falsifications fails for that regime.","tokens_in":31208,"feed_emoji":"🔦","tokens_out":6770,"duration_ms":66650,"temperature":0.7,"pith_summary":"VeriLight's claim is that a speech can be protected at the physical scene: a small unit near the podium projects imperceptible, modulated light onto a nearby surface, encoding a cryptographically signed 150-bit descriptor of the speaker's identity and facial and lip motion into every video recording automatically. Because the descriptor is derived from what the speaker visibly says and who visibly says it, any downstream falsification that changes identity or face and lip motion will make the video's re-computed descriptor disagree with the recovered signature. The paper reports AUCs at or above 0.99 and a 100% true positive rate on over 2,000 deepfaked videos made with four reenactment models and one identity-swap model, and robustness to compression, transcoding, filtering, viewing angles up to 60 degrees, and distances up to 3 meters. If correct, this shifts the burden of authenticity from recording apps and editing platforms to the speaker, and supplements passive deepfake detectors with a physical, explainable check.","feed_headline":"Invisible projected light authenticates recordings of live speeches","feed_subtitle":"A podium-side unit signs every video with a 150-bit face and lip-motion code that later catches deepfaked edits.","key_machinery":"The load-bearing object is the locality-sensitive hashing framework used to compress high-dimensional semantic features into 150-bit descriptors. Cosine-similarity LSH maps similar feature vectors to similar hashes, so small pose- and capture-induced differences between legitimate recordings do not change the hash much, while a semantically different face or lip motion does; a derived closed-form expression shows this verification performance is independent of the input dimension, justifying hashing 512-dimensional identity embeddings and long dynamic feature vectors into the same small size. The second mechanism is the spatio-temporal optical modulation scheme: an amplitude-modulating spatial light modulator projects a cell grid onto a planar surface, each data cell carrying one bit per two bitmaps through phase-keyed intensity changes, with border cells acting as synchronization references and corner cells as localization beacons. An adaptive control loop adjusts each cell's color and intensity to balance bit error rate against perceptual indistinguishability, which is what lets the signature survive compression, transcoding, and diverse surfaces.","core_discovery":"The central discovery is that semantic speech-content features can be compressed cryptographically and delivered through light in real time. The signature creation module runs a real-time facial analysis model and a face-embedding model on a window of video, concatenates 16 dynamic signals (5 lip landmark distances and 11 blendshapes) plus a 512-dimensional identity embedding, and hashes each with cosine locality-sensitive hashing into 150 bits. These hashes, together with window metadata and an HMAC-SHA256 message authentication code truncated to 80 bits, form the signature. The embedding module drives a spatial light modulator with a 16x9 grid of cells using binary phase-shift keying at 3 Hz, plus synchronization and localization cells, achieving over 200 bits per second. Verification localizes the cells by a Fourier heatmap, recovers the coded data through Viterbi and Reed-Solomon decoding, validates the MAC, and compares hashes by Hamming distance; if identity or dynamic distance exceeds its threshold, the video is declared falsified and the type of falsification is indicated. The paper reports perfect recall on over 2,000 deepfaked videos, with identity swaps and reenactments separated by which hash trips the threshold.","pith_inferences":["An implicit consequence is that the choice of the 16 facial-analysis features bounds the system's guarantee: attacks that alter speech through cues outside that set, such as changing intonation or word order without changing lip geometry, would not be flagged.","A testable extension is to re-run the forward feature selection on a larger, multi-language corpus; if different features are selected there, the current 16-signal set may be overfit to the authors' English-paragraph corpus.","If a future deepfake model learns to modify lip motion while keeping the 16 facial analysis signals nearly unchanged, VeriLight's dynamic threshold would need to be tightened, at the cost of more false positives from facial-tracking noise.","The still-camera requirement is a deployment constraint rather than a conceptual one; coupling verification with video stabilization could extend the scheme to handheld recordings, and projecting onto the speaker's face would remove the need for a visible projection region."],"forward_implications":["A speech venue with a VeriLight core unit produces a canonical, self-authenticating record: every attendee's camera captures the signature without any app, specialized hardware, or cooperation from the camera vendor.","Compression, transcoding, brightness and contrast edits, and aesthetic filters do not break verification, because the descriptor lives at a semantic level and the optical code is error-corrected.","VeriLight can report what kind of falsification it detected: identity-swap fakes raise only the identity-hash distance, while reenactment fakes raise only the dynamic-hash distance.","For fine-grained edits, VeriLight remains usable down to roughly 1.35 seconds of modification within a 4.5-second window, where it reports an AUC of 0.90; partial-window edits below about 20 percent of a window are the hardest case, with AUC dropping to 0.72.","Replay and signature-injection attacks fail because the descriptor is speech-specific and the MAC is keyed; an attacker cannot mint a valid signature for altered content."],"supporting_citations":[{"why":"MediaPipe FaceMesh supplies the 5 lip landmark distances and 11 blendshapes that form the dynamic feature vector.","marker":"[8]"},{"why":"The cosine-similarity LSH scheme is the basis of the 150-bit descriptor compression framework.","marker":"[32]"},{"why":"ArcFace provides the 512-dimensional face embedding that is hashed into the identity descriptor.","marker":"[42]"},{"why":"Labeled Faces in the Wild gives the 1,680-subject cross-pose test set used to evaluate identity-hash generalization.","marker":"[55]"},{"why":"FSGAN generates the identity-swap deepfakes used in the main protection evaluation.","marker":"[78]"},{"why":"FaceForensics++ supplies the corpus used to train the passive detector baselines that VeriLight is compared against.","marker":"[84]"},{"why":"FOMM is one of the four reenactment deepfake models used to generate falsified videos in the evaluation.","marker":"[90]"},{"why":"DeepfakeBench identifies the top-performing passive detectors used as baselines.","marker":"[112]"}],"fun_headline_variants":["Optical light signatures expose fake speech videos","VeriLight: invisible light codes verify speech videos","Optical signatures thwart deepfake videos","Invisible light codes authenticate speech videos"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the 16 facial-analysis signals selected in Section 4.2 are rich and pose-invariant enough that any falsification changing what the speaker appears to say visibly alters at least one hashed signal beyond the decision threshold, across recording angles up to 60 degrees, distances up to 3 meters, and any future deepfake model.","fun_headline_variants_meta":{"raw":{"variants":["Optical light signatures expose fake speech videos","VeriLight: invisible light codes verify speech videos","Optical signatures thwart deepfake videos","Invisible light codes authenticate speech videos"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000922,"raw_usage":{"total_tokens":4012,"prompt_tokens":1065,"completion_tokens":2947,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":681,"completion_tokens_details":{"reasoning_tokens":2892}},"tokens_in":681,"tokens_out":2947,"duration_ms":22557,"temperature":1.0,"reasoning_tokens":2892,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T04:53:12.578839+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run VeriLight on a corpus of reenactment deepfakes from a model not in the tested set, such as a newer lip-sync model, that changes a single word in less than 20 percent of a 4.5-second window; if even one such fake is verified as real, the claim that the selected facial-analysis features catch content-changing falsifications fails for that regime.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Labeled Faces in the Wild gives the 1,680-subject cross-pose test set used to evaluate identity-hash generalization."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"FSGAN generates the identity-swap deepfakes used in the main protection evaluation."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"FaceForensics++ supplies the corpus used to train the passive detector baselines that VeriLight is compared against."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"FOMM is one of the four reenactment deepfake models used to generate falsified videos in the evaluation."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"DeepfakeBench identifies the top-performing passive detectors used as baselines."}],"review_version":1}