The problem the researchers tackle is one that has haunted artificial intelligence for years: the black box. Deep learning-based palmprint recognition systems can achieve impressive performance, but most existing approaches offer no meaningful insight into why a particular decision was made. When a system grants or denies access, regulators, auditors, and users are left with nothing but a score. That opacity is increasingly untenable in an era of explainable AI requirements and regulatory compliance, where trustworthiness and transparency are not optional extras but prerequisites. The new framework confronts this challenge by embedding interpretable machine learning techniques throughout the entire recognition pipeline, from the first pixel to the final decision.

The first stage of the system is filter construction, and it is here that the researchers make their most distinctive technical move. Instead of relying on conventional convolutional filters learned through backpropagation, the team applies Principal Component Analysis to gradient-based local patches extracted from palmprint images. Gradients capture the local intensity changes that define the ridges, wrinkles, and principal lines of the palm, and PCA distills these into data-driven filters that extract discriminative texture patterns aligned with actual palm structures. The approach echoes the philosophy of PCANet, the simple deep learning baseline introduced by Chan and colleagues in 2015, but tailors it specifically to the gradient structure of palmprint imagery. Because the filters are derived directly from the statistics of the data rather than from an opaque optimization process, their responses can be inspected and understood — a property that black-box convolutional networks cannot offer.

Once the filters are in place, the pipeline adds a phase-distance-guided spatial attention mechanism. This component evaluates which regions of the palm are most relevant for recognition and enhances them before further processing. Attention mechanisms have become a cornerstone of modern computer vision, particularly in medical applications where knowing where a model looks is as important as what it concludes. In this system, the attention mechanism acts as a spotlight, directing computational resources toward the structurally meaningful areas of the palm while suppressing noise and irrelevant background. The result is a representation that is not only more compact but also more aligned with the physical features that human examiners would recognize as significant.

Following attention, the system employs 3D convolution and pooling to produce compact feature representations. The 3D aspect is notable: rather than treating the palmprint as a flat 2D texture, the convolution operates across a volumetric structure, capturing relationships that span multiple dimensions of the feature space. Pooling then compresses these representations into a form that is both efficient to store and robust to small variations in position or scale. The combination produces features that are discriminative enough to separate individuals while remaining stable enough to handle the natural variability of contactless palmprint acquisition, where the hand may be at slightly different distances or angles from the sensor.

The second pillar of the framework is density-radius-based clustering, and it is here that explainability becomes structural rather than cosmetic. Instead of modeling feature distributions through an opaque classifier, the system models them through representative prototypes. Each prototype is a point in feature space that summarizes a cluster of similar features, and the density-radius strategy determines how these prototypes are placed and how broadly each one represents its neighborhood. When a query palmprint is presented, authentication is performed by measuring similarity between the query features and the learned prototypes. The decision is therefore directly associated with meaningful structural patterns: the system can point to the specific prototypes that matched, and through filter response analysis, it can show which texture elements of the palm contributed to that match.

This prototype-based representation transforms the authentication decision from an unverifiable score into an auditable explanation. If a system denies access, it can identify which prototypes were closest, how far the query fell outside the decision boundary, and which structural patterns of the palm were responsible for the mismatch. If it grants access, it can show which prototypes matched and which features of the palm drove the similarity. This level of insight supports the development of trustworthy and auditable biometric authentication systems — a goal that the researchers argue is essential as biometric systems expand into settings where users and regulators demand transparency.

Experimental results demonstrate that the proposed method achieves competitive accuracy while providing clear insight into the decision process. The researchers evaluated the framework on the Tongji Contactless Palmprint Dataset, an openly available benchmark introduced by Zhang and colleagues in 2017 alongside a novel acquisition device and a collaborative representation-based identification approach. The dataset has become a standard testbed for contactless palmprint research precisely because it captures the challenges of real-world acquisition: hands presented without contact, at varying distances, under uncontrolled lighting. Achieving competitive performance on this benchmark while maintaining full interpretability is a significant result, suggesting that explainability need not come at the cost of accuracy.

The implications reach well beyond palmprints. The study appears within a broader cross-disciplinary challenge concerning explainable AI for biometric authentication and medical imaging, a field where the same questions of trust, auditability, and regulatory compliance recur. In medical imaging, knowing why a model reached a conclusion can be a matter of clinical safety; in biometric authentication, it can be a matter of legal defensibility. The techniques presented here — data-driven filter learning through PCA, attention-guided feature enhancement, and prototype-based clustering — are not specific to palms. They form a template for any recognition system where decisions must be explained to humans, whether those humans are clinicians, auditors, or users deciding whether to trust a system with their identity.

The research also situates itself within a growing literature on explainable biometrics. A 2024 systematic literature review by Tucci and colleagues documented the expanding interest in explainable biometric systems, while surveys on interpretable black-box models and user-centered evaluation of explainable AI have highlighted the gap between technical interpretability and human understanding. The new framework addresses this gap by grounding explanations in physical structures — the ridges, wrinkles, and principal lines of the palm — that users can verify with their own eyes. This grounding in meaningful structural patterns, rather than abstract feature activations, is what the researchers argue makes the system genuinely trustworthy rather than merely technically interpretable.

As biometric authentication expands into security-critical and privacy-sensitive settings, the demand for systems that are accurate, interpretable, and transparent will only intensify. The framework presented by Belhocine and colleagues demonstrates that these three goals are not in tension. By integrating interpretable machine learning techniques throughout the recognition pipeline — from gradient-based filter learning through attention-guided enhancement to density-radius prototype clustering — the system achieves competitive performance while offering clear insight into every decision it makes. In an era where the black box is increasingly unacceptable, this work offers a compelling vision of what trustworthy biometric authentication can look like: a system that not only knows who you are but can show you why.

Subject of Research: Explainable palmprint authentication via gradient-based filter learning and density-radius prototype clustering

Article Title: Explainable palmprint authentication via gradient-based filter learning and density-radius prototype clustering

Article References: Belhocine, Y., Meraoumia, A., Chitroub, S., & Bendjenna, H. (2026). Explainable palmprint authentication via gradient-based filter learning and density-radius prototype clustering. Multimedia Tools and Applications, 85(11), Article 811. https://doi.org/10.1007/s11042-026-21980-6

Image Credits: AI Generated

DOI: 10.1007/s11042-026-21980-6

Keywords: Explainable, palmprint, authentication, gradient-based, filter, learning, density-radius, prototype, clustering, scientific research

The starting point for the work is the recognition that perimeter defences, the traditional castle-and-moat model of network security, map poorly onto non-terrestrial networks. In a conventional terrestrial 5G deployment, a device authenticates once at the edge of the network and is then largely trusted as it moves between base stations. In a satellite constellation, however, the topology is in constant flux. Links form and dissolve as spacecraft pass over ground stations, handovers occur far more frequently, and the round-trip delays introduced by distances of hundreds or thousands of kilometres stretch authentication exchanges to the point where they can disrupt live sessions. Static authentication, the authors argue, leaves windows of vulnerability during which a compromised or spoofed node can operate freely. Their answer is to borrow the zero-trust principle, in which no node is trusted by default and every access request must be continuously justified, and adapt it to the physics of space-based networking.

At the heart of the proposed framework sits a machine learning engine that judges trustworthiness from behaviour rather than credentials alone. The researchers feed network signal information into an isolation forest algorithm, an unsupervised anomaly detection method that works by randomly partitioning data and measuring how easily each observation can be isolated from the rest. Anomalies, by their nature, are isolated in fewer random splits than normal observations, which makes the technique computationally light and well suited to streaming telemetry. The team evaluated the engine on 50,000 simulated non-terrestrial network telemetry samples, deliberately keeping a 4-to-1 class imbalance so that anomalous behaviour remained a minority signal, mirroring real-world conditions where attacks are rare events. Under those conditions the detector achieved 88.00 percent accuracy, an average precision of 0.9856 and a receiver operating characteristic area under the curve of 0.9969, figures that indicate the model separates normal from suspicious behaviour with high fidelity despite the skewed data.

Perhaps the most striking result concerns spoofing, one of the most dangerous attack classes for satellite systems because an adversary who convincingly impersonates a legitimate node can intercept or redirect traffic across an entire constellation. Within the simulated environment, the framework detected live spoofing attempts with 100 percent success and achieved an attack recall of 1.0000 with zero false negatives, meaning no attack in the evaluation set slipped past undetected. The researchers attribute this performance to the specific features that their importance analysis identified as the dominant drivers of the zero-trust score. Rather than relying on abstract traffic statistics, the model leans on physics-based kinematic metrics: velocity deviation, GPS distance and Doppler shift. These are quantities that an attacker cannot easily fake, because they are dictated by orbital mechanics. A node claiming to be a particular satellite must move as that satellite moves, and any mismatch between claimed and observed kinematics becomes a powerful telltale of impersonation.

Continuous authentication, however, creates its own problem. If every handover and every access request triggers a fresh cryptographic challenge, the signalling load and the latency of re-authentication can balloon, defeating the purpose of a fast, responsive network. Traditional handover authentication in such systems can peak at around 1600 milliseconds, an eternity for sessions that must survive rapid satellite transitions. The second pillar of the new framework is a proactive cryptographic caching mechanism that anticipates re-authentication needs and pre-stages the necessary cryptographic material before it is requested. Under warm-cache, rule-based conditions, this mechanism reduced re-authentication latency to 7.2 milliseconds while preserving 99.5 percent session continuity, a reduction of more than two orders of magnitude compared with the traditional handover peaks. In practical terms, a connection could survive a satellite handover without the user or application ever noticing an authentication pause.

When the researchers subsequently integrated the machine learning engine with the caching system, the combined framework exhibited a signalling overhead of just 0.75 percent, well below the 8 percent target the authors set as an upper bound for practical deployability. That figure matters because security mechanisms in resource-constrained networks often fail not on detection accuracy but on cost: every extra message exchanged for authentication consumes bandwidth, power and processing time that the network’s primary mission requires. A security layer that adds less than one percent signalling overhead, while continuously scoring every node, represents the kind of efficiency profile that could plausibly be carried by satellite payloads and ground segments without degrading service. The framework’s policy decision point engine completes the loop, translating anomaly scores into access control decisions instantly, so that a node whose behavioural score degrades can be demoted, quarantined or disconnected without waiting for a human operator.

The architectural logic deserves closer attention because it illustrates how zero trust can be operationalised in an environment where the network perimeter is, quite literally, in orbit. In the proposed design, telemetry from network signals flows continuously into the anomaly detection engine, which produces a score for each node. That score is not a binary verdict but a graded measure of trustworthiness, and the policy decision point maps it onto access control actions in real time. A node exhibiting slight kinematic drift might be flagged for heightened monitoring, while one showing a gross Doppler inconsistency with its claimed orbit could be cut off mid-session. This graduated response is what makes the system adaptive: the level of scrutiny and the restrictiveness of access scale with the assessed risk, rather than applying a single static rule to all nodes at all times. It is a security posture that assumes compromise is possible at any moment and designs the network to contain it quickly.

The authors are careful to frame their results as a proof of concept rather than a fielded system. All 50,000 telemetry samples were generated in a simulated environment, and the headline latency and continuity figures for the caching mechanism were evaluated under warm-cache, rule-based conditions before the machine learning engine was integrated. Real constellations will present messier data, adversarial pressure that actively tries to game the anomaly detector, and hardware constraints that simulation can only approximate. The researchers position the work as demonstrating that adaptive, low-overhead security integrations are theoretically viable under orbital constraints, paving the way for future physical validation and for extension into next-generation 6G networks, where the integration of terrestrial and non-terrestrial segments is expected to deepen further and the attack surface will grow accordingly.

Even so, the study arrives at a moment when the security of space-based communications has become a matter of urgent public and strategic concern. Commercial constellations now carry broadband traffic to millions of subscribers, militaries depend on satellite links for command and control, and emergency responders increasingly rely on non-terrestrial coverage when terrestrial infrastructure fails. Spoofing and impersonation attacks against such systems could have consequences far beyond a dropped video call, and the industry has been searching for authentication models that do not collapse under the latency and mobility constraints of orbit. The Bengaluru team’s finding that orbital mechanics themselves, expressed through velocity deviation, GPS distance and Doppler shift, can serve as the strongest signals of trustworthiness is an elegant inversion: the very physics that makes satellite networking hard also furnishes an attacker with an unfakeable fingerprint. If subsequent physical trials bear out the simulation results, continuous behavioural authentication could become a standard layer in the security stack of the satellite networks that increasingly hold the connected world together.

Subject of Research: An adaptive behavioural zero-trust security framework with proactive cryptographic caching for continuous authentication in 5G non-terrestrial networks

Article Title: An adaptive behavioural zero-trust security framework with proactive cryptographic caching for continuous authentication in 5G non-terrestrial networks

Article References: Sankeerthana, N., & Dakshayini, M. (2026). An adaptive behavioural zero-trust security framework with proactive cryptographic caching for continuous authentication in 5G non-terrestrial networks. Scientific Reports. https://doi.org/10.1038/s41598-026-73550-3

Image Credits: AI Generated

DOI: 10.1038/s41598-026-73550-3

Keywords: adaptive, behavioural, zero-trust, security, framework, proactive, cryptographic, caching, continuous, authentication, non-terrestrial, networks

The core problem the review addresses is structural. Mobile cloud computing lets resource-constrained smartphones and IoT sensors offload computation and storage to remote data centers, but that offloading means sensitive data leaves the device and crosses networks the owner does not control. Every handoff, from a wearable sensor to a fog node to a central cloud, is an opportunity for interception, tampering or impersonation. Traditional defenses such as static encryption and perimeter firewalls were designed for stable, well-defined networks, not for ecosystems in which devices join and leave constantly, protocols vary wildly, and the computing continuum stretches from tiny battery-powered sensors to hyperscale data centers.

Artificial intelligence has emerged as the most promising countermeasure precisely because it is adaptive. Machine learning models can learn the normal rhythm of a network, the typical traffic patterns of a sensor, the usual authentication behavior of a user, and flag deviations that would escape rule-based systems. The review catalogs how this capability is being applied across the security stack: authentication schemes that verify identities using learned behavioral biometrics, intrusion detection systems that classify malicious traffic with deep neural networks, and anomaly detection engines that spot compromised devices before they can spread infection. Unlike earlier surveys that treated cloud and IoT security separately, this study explicitly covers AI-based solutions for both environments, arguing that the two can no longer be defended in isolation.

Intrusion detection receives perhaps the deepest treatment. The reviewed literature shows a clear evolution from classical machine learning classifiers toward deep learning architectures, including convolutional neural networks for traffic analysis, recurrent and transformer-based models for sequential attack patterns, and hybrid CNN-LSTM ensembles evaluated on heterogeneous datasets. Generative adversarial networks appear in a dual role: they can synthesize realistic attack samples to augment scarce training data, improving detector robustness, but they also represent a threat, since adversaries can use them to craft evasive malware. Federated learning adds another layer of sophistication, allowing multiple organizations or edge nodes to train shared detection models without pooling raw data, preserving privacy while improving collective threat intelligence.

Authentication and identity management form the second pillar. The review documents lightweight deep learning models designed to secure authentication in mobile cloud settings, blockchain-based schemes that create auditable, tamper-evident records of who accessed what, and zero-trust architectures that refuse to grant implicit trust to any device or user regardless of network location. Biometric frameworks hosted in the cloud, decentralized identity management for multi-domain computing continua, and attribute-based encryption for anonymous authentication all feature in the recent literature. The common thread is a shift away from single-point verification toward continuous, context-aware assessment of trust, an approach that AI is uniquely positioned to deliver because it can weigh dozens of behavioral and environmental signals in real time.

Data protection mechanisms constitute the third major category. The survey examines encryption advances tailored to constrained devices, including lightweight ciphers and fully homomorphic encryption schemes that allow computation on encrypted IoT data without ever decrypting it. Blockchain technology recurs here as well, used to guarantee data integrity and create trust between IoT devices, mobile applications and cloud backends. Smart contracts enable secure sharing of health data in mobile cloud-based e-health systems, while hybrid machine learning techniques optimize secure data transmission and routing. The authors note that these mechanisms must be evaluated against the specific security requirements they address, confidentiality, integrity, availability, authentication and privacy, since no single solution covers all of them simultaneously.

Yet the review is candid about the gaps. The first is lightweight deployment: most state-of-the-art AI security models are computationally heavy, demanding memory, energy and processing power that battery-operated IoT sensors simply do not possess. Studies measuring the energy consumption of on-device machine learning models for intrusion detection reveal a hard trade-off between detection accuracy and battery life. The second gap is cross-layer integration. Security solutions tend to be designed for a single layer of the stack, the network layer, the application layer, or a specific cloud service model, leaving seams between layers that attackers exploit. The third is contextual security: defenses that ignore the specific context of a deployment, a hospital ward versus a smart factory versus a connected vehicle, fail to adapt to radically different risk profiles and regulatory constraints.

The threat landscape itself is evolving faster than the defenses. The reviewed literature documents IoT botnet-driven distributed denial-of-service attacks, DNS flooding, man-in-the-middle attacks on multi-cloud applications, side-channel attacks that leak secrets from hardware, and black hole attacks that silently swallow network traffic. Adversarial machine learning adds a meta-threat: data poisoning and backdoor attacks can corrupt the very AI models deployed as guardians, turning the defense into a vulnerability. The authors highlight this as a critical research direction, since an intrusion detector trained on poisoned data may systematically ignore the attacker’s traffic while appearing to perform flawlessly on benchmarks.

Looking forward, the review outlines several directions the field must pursue. Generative AI is beginning to be applied to IoT security, from quantum-enhanced encryption algorithms for healthcare applications to attribute-based encryption schemes assisted by generative models. Artificial intelligence as a service is emerging as a delivery model, making sophisticated security analytics available to fog and edge deployments that could never run them locally. The authors call for security solutions that span the full computing continuum, from dew and edge devices through fog nodes to the cloud, with AI orchestrating protection across all layers and adapting to context automatically. They also emphasize the need for standardized performance evaluation metrics for cloud, fog and edge security, since the field currently lacks common benchmarks for comparing competing approaches.

What makes this survey significant is its timing and its breadth. The convergence of AI, IoT and mobile cloud computing is no longer speculative; it underpins smart hospitals, fintech platforms and intelligent transportation networks already in operation. By systematically mapping five years of research, classifying solutions by the security requirements they fulfill, and naming the unresolved problems, lightweight models, cross-layer defense, contextual awareness, and the security of the AI itself, the study provides both a snapshot of where the field stands and a roadmap for where it must go. As the authors make clear, the same adaptive intelligence that makes AI a powerful defender also makes it a target, and securing the guardian may prove to be the defining security challenge of the connected decade ahead.

Subject of Research: AI-based security solutions for Internet of Things and mobile cloud computing environments

Article Title: AI-enabled IoT mobile cloud security: trends and challenges

Article References: Annane, B., Cherbal, S., Zier, A., Louail, L., & Alti, A. (2026). AI-enabled IoT mobile cloud security: trends and challenges. Cluster Computing, 29(12), Article 704. https://doi.org/10.1007/s10586-026-06527-6

Image Credits: AI Generated

DOI: 10.1007/s10586-026-06527-6

Keywords: artificial intelligence, Internet of Things, mobile cloud computing, cybersecurity, intrusion detection, authentication, federated learning, blockchain, encryption, systematic literature review, edge computing, zero trust

The research, conducted by Subhadeep Mandal of FORE School of Management in New Delhi, Arpan Kumar Kar of the Indian Institute of Technology Delhi, and Shivam Gupta of NEOMA Business School in Reims, compares consumer resistance to QR code verification systems in India and France. The two countries were chosen deliberately because they sit at opposite ends of one of the most influential dimensions in cross-cultural psychology: uncertainty avoidance. According to Hofstede’s cultural framework, France scores high on this dimension, meaning its citizens tend to feel threatened by ambiguous situations and prefer rules, structure, and predictability. India, by contrast, scores low, reflecting a greater tolerance for ambiguity and a more pragmatic, situational approach to risk. The researchers reasoned that these deep-seated cultural orientations should shape how shoppers react when a code on a package asks them to verify a product’s authenticity or trace its origins.

The study distinguishes between two fundamentally different verification architectures that manufacturers can deploy behind a QR code. The first is traceability, typically built on blockchain-based distributed ledgers that record every step of a product’s farm-to-fork journey in an immutable, decentralized database. No single company controls the record; instead, verification depends on a consensus mechanism spread across multiple supply chain actors. The second is authentication, a company-managed centralized database that confirms whether a specific product is genuine. Here, the manufacturer itself acts as the arbiter of truth, and the consumer must trust not only the technology but also the firm operating it. Both mechanisms are designed to combat the same enemies: counterfeiting and misinformation, problems that cost the food, beverage, and pharmaceutical sectors billions each year and have triggered high-profile scandals, from the European horsemeat affair to raids on counterfeit medicine operations in India.

To understand why consumers resist these systems, the researchers drew on two complementary theoretical lenses. Innovation resistance theory, developed originally by Ram and Sheth in the late 1980s, holds that resistance is not merely the absence of adoption but an active psychological process driven by functional barriers, such as perceived complexity, lack of perceived value, and doubts about usefulness, and psychological barriers, including habits, perceived risk, and attachment to tradition. Status quo bias theory adds a second layer: people systematically prefer their current state of affairs, and the inertia, switching costs, and satisfaction with existing routines can outweigh even compelling reasons to change. The study also separates active resistance, in which consumers consciously oppose or criticize the technology, from passive resistance, in which they simply ignore it and continue shopping as before.

What makes the methodological approach particularly interesting is the analytical tool the authors chose. Rather than fitting a traditional regression model that estimates the average effect of each barrier, the team applied fuzzy set Qualitative Comparative Analysis, or fsQCA, to survey data from 581 retail shoppers. FsQCA is a set-theoretic technique rooted in the work of Charles Ragin, which treats conditions such as perceived risk or system quality as fuzzy sets that respondents can belong to partially, rather than as continuous variables. The method then searches for combinations, or causal recipes, of conditions that are jointly sufficient to produce an outcome, in this case high consumer resistance. This configurational logic acknowledges a truth that averaging techniques often obscure: different shoppers may resist the same technology for entirely different reasons, and multiple distinct pathways can lead to the same resistant behavior.

The barriers the researchers examined spanned four broad categories. Functional barriers included the perceived effort of scanning, doubts about whether the information provided is genuinely useful, and skepticism about the value the system adds to the shopping experience. Psychological barriers captured perceived privacy and security risks, the discomfort of changing established shopping habits, and resistance rooted in tradition. System-related barriers concerned the technical quality of the verification platform itself, including reliability, responsiveness, and the credibility of the information architecture. Individual barriers reflected personal characteristics such as technology readiness, product involvement, and demographic factors. By calibrating each of these conditions into fuzzy sets and analyzing them separately for traceability and authentication systems in each country, the team could identify which combinations of barriers most powerfully predicted resistance in each context.

The comparative design yielded striking insights into how national culture conditions technology acceptance. In France, where uncertainty avoidance runs high, resistance patterns were strongly influenced by psychological barriers and by concerns about the credibility and security of the systems, particularly for centralized authentication databases where the consumer must extend trust to a single corporate actor. French shoppers’ well-documented hesitancy toward government and corporate digital platforms, visible in earlier episodes such as the troubled StopCovid contact tracing application, appears to carry over into the retail verification domain. In India, where tolerance for ambiguity is greater but experience with large-scale data breaches, including the widely reported Aadhaar incident, has sharpened privacy anxieties, resistance was more closely tied to functional and system-related barriers, alongside privacy concerns. The same QR code, backed by the same blockchain architecture, can therefore encounter very different psychological obstacles depending on where it is deployed.

The distinction between traceability and authentication also mattered. Traceability systems, with their decentralized blockchain underpinnings, offer consumers a narrative of transparency: every hand that touched the product is recorded and verifiable. Authentication systems, by contrast, offer a simpler binary answer, genuine or fake, but concentrate trust in the manufacturer. The fsQCA results indicated that the recipes producing resistance differ between these two mechanisms, meaning that a barrier combination that dooms an authentication system in one market may leave a traceability system relatively unscathed, and vice versa. For manufacturers, this implies that the choice between blockchain-based distributed traceability and centralized authentication is not merely a technical or cost decision but a culturally loaded one that should be matched to the target market’s uncertainty profile and trust landscape.

The practical implications extend well beyond the food and beverage sector. Counterfeit goods infiltrate everything from pharmaceuticals to luxury products, and regulators in both the European Union and India are pushing toward digital labelling mandates. Yet the study’s central warning is that technology deployment without behavioral insight risks expensive failure. A system that ignores passive resistance, the quiet refusal to scan that never registers as a complaint, may appear successful on adoption dashboards while failing to change actual verification behavior. The authors suggest that mitigating resistance requires tailored strategies: emphasizing security and data protection where psychological barriers dominate, simplifying the scanning experience and demonstrating tangible value where functional barriers prevail, and ensuring system quality where technical doubts deter engagement.

Ultimately, the research reframes a question that the retail and technology industries have often treated as an afterthought. The success of QR code-based product verification does not hinge solely on the elegance of the blockchain or the robustness of the database, but on a messy constellation of cultural values, personal habits, privacy fears, and system perceptions that vary from one shopper, and one nation, to the next. By mapping the causal recipes behind resistance in two of the world’s largest and most culturally distinct consumer markets, the study offers a template for designing verification systems that people will actually use, and a reminder that in the battle against counterfeits, the consumer’s finger hovering over the camera lens is the final, decisive checkpoint.

Subject of Research: Consumer resistance to QR code-based product traceability and authentication systems in India and France

Article Title: Modelling Consumer Resistance Towards QR Code-Based Product Verification Systems: A Comparative Analysis of Traceability vs. Authentication in India and France

Article References: Mandal, S., Kar, A. K., & Gupta, S. (2026). Modelling Consumer Resistance Towards QR Code-Based Product Verification Systems: A Comparative Analysis of Traceability vs. Authentication in India and France. Information Systems Frontiers. https://doi.org/10.1007/s10796-026-10821-4

Image Credits: AI Generated

DOI: 10.1007/s10796-026-10821-4

Keywords: QR codes, consumer resistance, traceability, authentication, blockchain, fsQCA, uncertainty avoidance, status quo bias, counterfeiting, food supply chain, India, France

Gongfu Tie has long occupied an ambiguous place in the study of Su Shi, one of the most revered literary and calligraphic figures of the eleventh century. Attribution questions of this kind are notoriously difficult because traditional authentication rests on stylistic judgment, provenance records, seals, and the trained eye of experts, all of which are subjective and can disagree. The new study does not claim to replace that expertise, but it offers something the eye cannot easily provide: reproducible numbers. The researchers built a reference dataset from authenticated works of Su Shi and then asked whether the disputed letter’s characters fall inside or outside the statistical envelope defined by those verified exemplars.

The core of the method is a multidimensional feature set that captures three complementary aspects of a written character. The first is the aspect ratio, a structural measure of how a character’s bounding box is proportioned. Calligraphers develop habitual proportions, and deviations in this basic geometry can betray a hand other than the master’s. The second feature is the black-to-white pixel ratio, a tonal measure that reflects how much ink covers the writing surface relative to empty space. This quantity is sensitive to brush pressure, ink loading, and the density of strokes, all of which vary in characteristic ways between an original and a careful imitation.

The third and arguably most revealing feature is the fractal dimension, which quantifies the complexity of a stroke’s boundary. When a calligrapher writes with a brush, ink bleeds into the paper fibers and produces edges that are irregular, organic, and statistically self-similar across scales. When a copyist traces or reproduces a work, however, the contours tend to become regularized: the copying process smooths out the microscopic roughness that the original brush left behind. A fractal dimension computed on the character’s outline captures exactly this difference, rising with genuine boundary complexity and falling when contours have been artificially cleaned up. It is this sensitivity that makes the framework particularly suited to detecting tracing and reproduction artifacts, which are among the most common ways forgeries enter the historical record.

What distinguishes this study from earlier quantitative attempts is its insistence on using all three features jointly. Previous computational approaches often leaned on a single indicator, which the authors argue is fundamentally limiting. A forger might match the proportions of a character while failing to reproduce its ink distribution, or reproduce tonal density while leaving behind unnaturally smooth boundaries. By characterizing structure, tone, and boundary complexity simultaneously, the framework builds a morphological profile that is much harder to fake across the board. The features are also interpretable, meaning that researchers can see which property of a character drives a given result, rather than receiving an opaque verdict from a black-box classifier.

The analytical pipeline combined classical statistics with unsupervised machine learning. After extracting the feature values from characters in the disputed letter and the authenticated reference set, the team performed statistical comparisons to test whether the disputed characters fell within the ranges established by the verified works. They then applied K-means clustering, an algorithm that partitions data points into groups based on similarity, to see whether the disputed characters grouped with the reference material or formed their own separate cluster. Cluster validity evaluation was used to confirm that the resulting groupings were statistically meaningful rather than artifacts of the algorithm’s settings. This combination of methods provides a layered form of evidence: a character must pass multiple independent tests before the analysis would flag it as anomalous.

The verdict, as reported in the study, leans toward authenticity. The character Shi, which appears in the disputed letter and is also the calligrapher’s own name, falls within the statistical ranges of the reference dataset and exhibits clustering behavior consistent with the authenticated works of Su Shi. In other words, on the structural, tonal, and boundary-complexity measures that the framework tracks, the disputed character looks like the genuine article. The authors are careful in their framing: the analysis concerns authenticity-related features, not a definitive certificate of authenticity, and the framework is presented as a computational perspective that complements rather than replaces traditional scholarship.

The significance of the work extends well beyond one letter. Chinese calligraphy is a cornerstone of cultural heritage, and museums, collectors, and scholars routinely face attribution disputes involving works that are centuries old. Physical and chemical analysis can date inks and papers, but such methods are often invasive, and they cannot by themselves distinguish a master’s hand from a skilled contemporary copy made on period materials. Morphological analysis of digitized images offers a non-invasive alternative that requires nothing more than high-resolution photography, making it applicable even to works that are too fragile to travel or too precious to sample. As digitization of museum collections accelerates worldwide, the pool of measurable material is growing rapidly, and frameworks like this one can be scaled across entire corpora.

There are, of course, caveats worth keeping in mind. The reliability of any statistical comparison depends on the size and quality of the reference dataset, and authenticated works by any single historical figure are finite in number. Image quality, scanning conditions, and the physical state of the paper can all influence measured features, so careful preprocessing and standardization are essential. The authors’ emphasis on reproducibility and interpretability addresses some of these concerns, since a transparent pipeline can be re-run, audited, and refined as more verified material becomes available. The study also received no external funding and its authors declare no competing interests, which strengthens confidence in the independence of the analysis.

Still, the demonstration that a disputed Song Dynasty letter can be probed with aspect ratios, ink ratios, and fractal dimensions marks a genuine shift in how heritage science approaches the oldest of questions: is this really the master’s hand? The method turns connoisseurship into measurable evidence, gives curators a new tool for triage, and opens the door to quantitative re-examination of contested works across the entire history of brush writing. For Gongfu Tie, the numbers so far whisper what many scholars have hoped, that the letter belongs among the works of Su Shi. For the field at large, the message is louder: the brush leaves a statistical signature, and now it can be read.

Subject of Research: Quantitative computer vision analysis of the authenticity of the Chinese calligraphy work Gongfu Tie attributed to Su Shi

Article Title: Quantitative analysis of authenticity-related features in Su Shi’s Gongfu Tie

Article References: Ma, J., Ju, Z., Tian, X., & Zhao, C. (2026). Quantitative analysis of authenticity-related features in Su Shi’s Gongfu Tie. npj Heritage Science. https://doi.org/10.1038/s40494-026-03027-z

Image Credits: AI Generated

DOI: 10.1038/s40494-026-03027-z

Keywords: Su Shi, Gongfu Tie, Chinese calligraphy, authentication, computer vision, fractal dimension, K-means clustering, heritage science, npj Heritage Science, ink analysis, attribution, cultural heritage

The core weakness the researchers set out to fix is architectural. Most existing authentication schemes for vehicular networks rely on a single Trusted Authority, a central server that vouches for every vehicle and issues the cryptographic credentials needed to join the network. That model works reasonably well when the fleet is small, but it carries two structural flaws that grow worse with scale. First, as the number of vehicles climbs into the hundreds of thousands, the central authority becomes a computational bottleneck: every registration, every credential check, and every revocation must pass through one system. Second, and more dangerously, the authority represents a single point of failure. Compromise that one server, and an attacker can impersonate vehicles, forge safety messages, or silently disable the trust fabric of an entire transportation network. The team’s answer is to distribute trust across multiple Trusted Authorities using a blockchain as the shared, tamper-resistant ledger that lets them cooperate without a single dominant player.

Cross-domain authentication is the technical heart of the proposal. In a realistic smart-city deployment, vehicles do not stay within the jurisdiction of one authority. A car registered in one municipality may drive through neighboring regions, each managed by a different Trusted Authority with its own databases and policies. Under the traditional model, a vehicle crossing such a boundary either cannot authenticate at all or must re-register from scratch, wasting time and bandwidth. BAS-IoV enables what the authors call cross-TA authentication: authorities that have never directly trusted each other can verify a visiting vehicle’s credentials by consulting the blockchain, which records registration and authentication information in a form that no single party can alter retroactively. The result is a network in which trust is portable, and in which the failure or corruption of any one authority cannot cascade through the whole system.

What makes the protocol genuinely notable, however, is how little computation it demands. Blockchain-based security schemes have a reputation problem: they are often heavy, requiring expensive public-key operations that strain the modest processors embedded in vehicles and roadside units. The researchers deliberately built BAS-IoV from efficient cryptographic primitives. Elliptic Curve Cryptography provides strong security with comparatively small keys and fast operations, since the difficulty of the elliptic curve discrete logarithm problem underpins the scheme’s resistance to forgery. Hash functions compress and bind messages together, and XOR operations, among the cheapest operations a processor can perform, are used to combine secrets without costly modular arithmetic. The most intriguing ingredient is the Physical Unclonable Function, or PUF. A PUF exploits the microscopic, random manufacturing variations in a chip’s silicon to produce a device-specific fingerprint: challenge a PUF with an input and it returns an output that is effectively impossible to predict, copy, or duplicate, because no second chip shares the same physical imperfections. By anchoring authentication in hardware-level uniqueness, the protocol gains protection against physical attacks such as key extraction, since no long-term secret is ever stored in memory in a form an attacker could read out.

Security claims in cryptography are cheap; proofs are not. The authors subjected BAS-IoV to a battery of formal verification techniques that represent the current standard of rigor in protocol analysis. Using the Real-or-Random model, a well-established framework for proving the security of authenticated key exchange, they demonstrated that session keys established by the protocol are indistinguishable from random strings to any adversary, which means an eavesdropper who records an entire conversation learns nothing usable about the keys protecting it. They then turned to two automated formal verification tools, Tamarin and ProVerif, which symbolically explore every possible execution path of a protocol, including those involving a powerful attacker who controls the network, to search for hidden flaws. Both tools confirmed the protocol’s resilience against known attack classes, including impersonation, replay, man-in-the-middle, and privileged insider attacks. Formal verification of this kind matters because history is littered with vehicular authentication schemes that looked sound on paper and collapsed under careful cryptanalysis; indeed, the same research group previously published a cryptanalysis of existing IoV message communication protocols, giving them a practitioner’s skepticism toward unproven designs.

Proving security is only half the battle, because a protocol that is safe but slow would strangle a network that depends on millisecond-level message exchange. Vehicular safety applications, such as collision warnings and cooperative braking, require authentication overhead low enough that messages arrive while they are still relevant. To measure real-world performance, the team ran extensive simulations in NS-3, the widely used discrete-event network simulator, evaluating the protocol under large-scale deployments with high vehicle densities. The results showed high throughput, low End-to-End Delay, and a high Packet Delivery Ratio, the three metrics that together determine whether an authentication scheme can keep pace with live traffic rather than becoming the bottleneck it was meant to eliminate. The lightweight design choices, from elliptic curve arithmetic to XOR-based secret combination, translate directly into these favorable network-level numbers.

The implications reach well beyond academic cryptography. Smart cities are investing billions in connected infrastructure, from adaptive traffic lights to autonomous shuttle fleets, and every one of those systems inherits the security assumptions of the underlying vehicular network. A centralized authentication model that buckles under load, or that can be toppled by compromising a single server, is a poor foundation for safety-critical transportation. A distributed model anchored in a blockchain offers a different bargain: trust becomes a shared, auditable record rather than a promise from one institution, and the cost of that assurance is paid in cheap, hardware-accelerated operations rather than heavy computation. For automakers and infrastructure operators weighing how to secure fleets that will only grow, protocols of this kind sketch a plausible migration path from today’s fragmented, authority-bound systems toward something more resilient.

There are, of course, familiar caveats. Blockchain systems introduce their own questions about consensus overhead, ledger growth, and governance, and the study’s evaluation, while thorough in simulation, represents a model of radio conditions and vehicle mobility rather than a live deployment on crowded highways. The authors report that no datasets were generated or analyzed during the study, and the work received no specific external funding, with the analysis resting on simulation and formal proof rather than field trials. Real-world adoption would also require agreement among the many authorities, manufacturers, and regulators whose cooperation any cross-domain scheme implicitly demands, a coordination challenge that no protocol alone can solve.

Even with those qualifications, BAS-IoV is a compelling demonstration that the perceived trade-off between blockchain-grade security and vehicular-grade speed is not inevitable. By combining PUF-based hardware trust, elliptic curve efficiency, formally verified key agreement, and a multi-authority blockchain backbone, the researchers have assembled a design that addresses the two failure modes, centralization and computational cost, that have limited earlier generations of vehicular authentication. As the number of connected vehicles continues its steep climb, and as smart cities stake safety and efficiency on the integrity of wireless messages exchanged between machines, work of this kind moves from the margins of cryptographic literature toward the center of infrastructure engineering. The roads of the future will be governed less by asphalt and signage than by protocols, and studies like this one are writing the rules those protocols will follow.

Subject of Research: Blockchain-based cross-authority authentication and key agreement for secure, scalable Internet of Vehicles communications

Article Title: BAS-IoV: lightweight blockchain-based authentication for secure and scalable internet of vehicles

Article References: Ghadim, G. O., Rastegari, P., Dakhilalian, M., Hendessi, F., & Susilo, W. (2026). BAS-IoV: lightweight blockchain-based authentication for secure and scalable internet of vehicles. Cluster Computing, 29(14), Article 784. https://doi.org/10.1007/s10586-026-06595-8

Image Credits: AI Generated

DOI: 10.1007/s10586-026-06595-8

Keywords: Internet of Vehicles, blockchain, authentication, cryptography, Physical Unclonable Functions, Elliptic Curve Cryptography, Trusted Authority, NS-3 simulation, formal verification, smart cities, vehicular networks, security protocols

The core idea is deceptively simple: treat a hand-drawn signature as a biometric trait, just as banks and document workflows have done for decades with pen and paper. What makes AirSign distinctive is how it captures that signature. Instead of confining users to a predefined two-dimensional plane, or demanding specialized peripherals such as data gloves or a Leap Motion sensor mounted on a desk, the system exploits hardware that modern headsets already carry. Users can sign either with motion controllers or, on devices that support it, with camera-based hand tracking. A single unified gesture, a pinch between the index finger and thumb, signals the intent to write. When the virtual fingertips touch, the system begins sampling the three-dimensional coordinates of the fingertip at the headset’s refresh rate, typically 90 to 120 hertz, and renders the resulting strokes in real time so the user receives immediate visual feedback.

Under the hood, every signature becomes a multivariate time series. Each sampled point stores a position vector and a velocity vector, the latter computed from the change in position between consecutive frames divided by the elapsed time. Because the hand-tracking cameras on consumer headsets rely on monocular RGB input without dedicated depth sensors, the raw trajectory is noisy. To tame the jitter, the researchers apply linear interpolation, smoothing each sampled position halfway toward the previous one. This acts as a first-order low-pass filter, balancing responsiveness against stability. Two normalization steps then make signatures comparable regardless of where and how the user was facing when signing: the entire trajectory is translated so its first point sits at the world origin, and it is rotated by a quaternion so that the user’s initial viewing direction aligns with a canonical axis. The result is a signature that can be drawn anywhere, at any orientation, and still be matched against stored templates.

Comparing two signatures captured at different speeds and lengths is the central algorithmic challenge, and it is where Dynamic Time Warping enters the picture. Simple Euclidean distance fails catastrophically when two otherwise identical trajectories are temporally shifted, because points that should correspond are compared with the wrong partners. DTW solves this by warping the time axis of one sequence to find an optimal non-linear alignment with the other, minimizing the cumulative local distance along an admissible warping path that respects boundary, continuity, and monotonicity constraints. The method’s key property for signature verification is its invariance to time shifts: identical but misaligned sequences yield a distance at or near zero. Classic DTW carries a quadratic cost in both time and memory, however, which is prohibitive on a battery-powered headset, so the team turned to FastDTW, a multilevel approximation that coarsens the series, projects a low-resolution warping path upward, and refines it within a constrained radius, achieving linear time and space complexity.

The engineering choices reveal how much practical constraint shapes such systems. An early client-server design was abandoned in favor of fully on-device processing, with signature data saved directly to the headset’s local file system. The DTW computation was rewritten in Rust after benchmarks showed the original Python implementation took 2.37 seconds to compare a 383-point signature with itself, while the Rust version finished in 0.03 seconds, roughly 79 times faster. On a tenfold larger sample of 3,830 points, the gap widened to 480-fold, with Rust completing in 0.13 seconds what Python needed more than a minute to do. Further optimizations, including a Sakoe-Chiba band that restricts the warping path to a diagonal window and a diagonal DTW variant that slashes memory use, cut processing time by more than half on a 70,000-point signature. Classification also runs asynchronously on a background thread, preventing the rendering loop from freezing, a detail that matters enormously in VR, where a stalled frame that no longer matches head movement can induce motion sickness.

Even the choice of which features to feed the matcher mattered. An initial feature set combining position, velocity, and acceleration produced puzzling misclassifications: a handwritten name and an arbitrary wave pattern were judged suspiciously similar to a figure eight, with average DTW distances low enough to slip beneath the acceptance threshold. Ablation analysis showed that acceleration data was injecting noise rather than discriminative power, so the team stripped it out, keeping only position and velocity. The revised feature set produced a much clearer separation between similar and dissimilar signatures, eliminated the false positives, and, as a bonus, shrank the data files and simplified the computation. It is a textbook example of how more sensors and more features do not automatically mean better biometrics.

To evaluate the system, the researchers recruited 28 volunteers, roughly 60 percent male and 40 percent female, aged between 20 and 40, none of whom had meaningful prior headset experience. Each participant produced 25 signatures under two input modalities, controllers and hand tracking, and two experimental conditions. In the fixed-signature scenario, everyone wrote the same word, AIRSIGNX, deliberately stressing the system’s ability to distinguish people who share an identical signature shape. In the custom-signature scenario, each user chose a personal symbol or name, mimicking real-world variability. The team measured false acceptance and false rejection rates across swept thresholds and derived Equal Error Rates, the operating point where the two error rates coincide. Custom signatures proved markedly easier to verify, with EERs as low as 0.030 to 0.061 depending on input method, corresponding to authentication accuracy of roughly 94 to 97 percent. The hostile fixed-signature scenario, which doubles as a simulation of a skilled forgery attack in which an attacker knows the target’s signature shape, yielded EERs between 0.097 and 0.165, still translating to accuracy between roughly 83.5 and 90 percent.

Two further findings stand out. First, when the template gallery was reduced from 20 signatures per user to just 5, error rates rose only marginally, with the custom-signature EER reaching 0.030 with controllers and 0.053 with hand tracking. That stability matters for practical deployment, because it suggests users could enroll quickly without degrading security. Second, controllers consistently outperformed hand tracking on the Area Under the Curve metric, with very large effect sizes in both scenarios, reflecting the spatial jitter, gesture-detection latency, and occasional tracking losses inherent to camera-based hand modeling. Yet for the metric that matters most in practice, the EER on custom signatures, the difference between input methods was statistically negligible. In other words, when inter-class variability is high, the noisier but more convenient hand-tracking mode authenticates just as reliably, especially after smoothing. Users themselves praised the pinch-to-write gesture as natural and ergonomic, with the only recurring complaint being a slight lag in detecting fingertip contact at the start and end of strokes.

The security analysis is framed with appropriate caution. The researchers consider three threat levels: zero-knowledge attacks by random impostors, captured by the custom-signature EER; shape-aware attacks by forgers who know what the victim writes, captured by the fixed-signature EER; and dynamics-aware attacks, which they defer to dedicated future adversarial testing. Including velocity profiles in the DTW calculation is hypothesized to resist spatial replay attacks, since replicating how fast a signature was drawn is substantially harder than copying its shape, but the team is explicit that this hypothesis still needs rigorous testing. On the performance side, the entire verification cycle, including normalization, feature extraction, and DTW matching, completes within 350 milliseconds and adds less than 2 percent power draw on a standalone Meta Quest 2, confirming that biometric authentication can run continuously without draining the battery or degrading frame rates.

The authors are candid about the study’s limits. Twenty-eight participants cannot represent the full demographic spectrum, all data was collected in a single session, and no head-to-head comparison with classifiers such as support vector machines or deep learning architectures was possible, partly because variable-length 3D time series resist fixed-length feature extraction and the sample size is too small to train neural models fairly. They position AirSign accordingly, not as a novel classification algorithm but as a systems-level contribution: the first demonstration that unconstrained, on-device, three-dimensional signature verification is feasible on ordinary consumer VR hardware. Future work will scale the user cohort, parallelize the DTW computation across CPU cores, refine index-thumb contact detection, mount a proper defense against forged signatures, and benchmark the approach against gaze, motion, and keystroke biometrics. If those steps succeed, the awkward floating keyboard may finally give way to something far more intuitive: simply signing your name into the air.

Subject of Research: VR-based 3D hand-written signature recognition for biometric user authentication in virtual reality

Article Title: AirSign: An innovative VR-based hand-written signature recognition

Article References: Frascarelli, G., Marini, M. R., De Marsico, M., Mecca, A., & Cinque, L. (2026). AirSign: An innovative VR-based hand-written signature recognition. Multimedia Tools and Applications, 85(10), Article 790. https://doi.org/10.1007/s11042-026-21951-x

Image Credits: AI Generated

DOI: 10.1007/s11042-026-21951-x

Keywords: virtual reality, biometrics, signature recognition, Dynamic Time Warping, hand tracking, authentication, Meta Quest, behavioral biometrics, Rust, Unity, human-computer interaction, cybersecurity