What if someone genuinely steals my biometric signal and signs in my name?

The protocol design limits the damage. The biometric signal does not leave the creator's device in plaintext. What leaves is a derived cryptographic attestation, bound to a specific work, with the work's content hash baked in. A stolen biometric template cannot retroactively sign past works. It can sign new ones until the theft is detected, at which point the creator publishes a revocation entry. The original attestations remain in the registry. The fraudulent attestations are marked as disputed. The audit trail makes the boundary of the compromise visible to a court.

Doesn't the legal system already handle attribution disputes without this infrastructure?

It does, slowly and expensively, on the strength of contemporaneous evidence. The question in a copyright dispute is what evidence exists that this party created this work at this time. The biometric attestation is a contemporaneous record, generated at the moment of signing, anchored in an append-only registry. It does not replace the legal system; it produces the kind of evidence the legal system can act on without requiring twenty thousand dollars of forensic accounting to reconstruct.

What is the analog to this in physical security?

Locks on a front door. A determined burglar gets in. The lock is not designed to prevent that; it is designed to raise the cost of entry, separate casual from determined attempts, and produce evidence (broken lock, tool marks) that distinguishes the events afterward. Insurance, police investigation, and legal pursuit are the systems that handle the determined attempt. The lock is the threshold-raising layer. Biometric attestation is the same layer applied to creative provenance.

All articles

EssayAug 03, 2026

But couldn't anyone fake it is the wrong question

The first objection to a biometric registration is always the same. Could a determined fraudster sign AI-generated work as their own? Yes. And that yes is the whole point. The question hides a category error about what attribution infrastructure actually does.

Key points

The first objection to biometric attestation is whether a fraudster can sign AI-generated work as their own. The answer is yes. The infrastructure does not prevent the fraud; it makes the fraud accountable.
A passport does not stop forgery. It puts a name on the forger. SSL does not stop malicious sites. It puts a verified identity on the certificate. Attribution systems are accountability tools, not crime-prevention tools.
The category error in the objection is conflating identification with prevention. A working creator does not need the system to be unfakeable. The creator needs the system to make faking expensive and traceable.
A fraudster signing synthetic work as their own creates a record that can be pursued in court, in copyright filings, and in subsequent transactions. The cost of fraud rises by orders of magnitude. The fraud does not disappear; it stops being a costless act.

A working illustrator at a 2026 panel on creator-side provenance heard the same objection she always hears, this time from a senior engineer in the audience. Could not a determined fraudster sign AI-generated work with the same biometric protocol and have the signature treated as authentic? She paused, said yes, and asked him whether he would rather use a bank that had no records or one that had records that could occasionally be wrong. The room laughed. The engineer did not.

That exchange contains the entire category error around biometric attestation. The objection is correct on the facts. A determined fraudster, with the technical capability and the willingness to risk prosecution, can sign synthetic work as their own. The objection is wrong about what that fact implies for the infrastructure.

What is the actual function of an attribution system?

The function is not to make fraud impossible. The function is to make fraud accountable. The difference is the entire history of identification infrastructure.

A passport does not prevent identity forgery. Passports are forged regularly, and the rate of successful forgeries has fluctuated for two centuries without ever approaching zero. The passport's job is not to stop the forger. The passport's job is to put a verified identity on every legitimate border crossing, so the forger is the exception against a background of accountable identifications. When a forgery is detected, the system has the evidentiary basis to pursue the forger, revoke the document, and warn the next checkpoint.

SSL certificates do not prevent malicious websites. A misissued certificate enables a malicious site to look authoritative until the misissuance is detected. The SSL infrastructure's job is to put a verifiable identity on the certificate, log the issuance into Certificate Transparency, and produce the audit trail that allows browser vendors to revoke the certificate's recognition when the misissuance is discovered. The system tolerates the existence of bad actors and works to make their actions expensive and traceable rather than impossible.

Biometric attestation in 2026 is operating in the same architectural tradition. The signature does not prevent a fraudster from signing synthetic work. The signature creates a public, dated, registry-backed claim that a named party signed a specific work at a specific time. The fraudster who signs synthetic work has produced a courtroom-ready statement of fact that names them, dated to the minute. The fraud has not disappeared. The fraud has stopped being costless.

What changes for the fraudster?

In the absence of attestation, a fraudster's claim of authorship on a piece of synthetic work is cheap and largely undocumented. The work appears, the fraudster claims it, no record exists of who actually generated it, and the fraudster's incremental risk is whatever defamation or copyright liability they incur in the specific transaction.

In the presence of attestation, the fraudster's signature is a public record. The record names them, timestamps the act, binds it to the specific file hash, and anchors it in an append-only registry that survives indefinitely. If the original synthetic source is subsequently identified (a model output that matches the work, a training corpus that contains it, a generation log on a vendor's servers), the fraudster's signature becomes evidence of a specific false statement made at a specific time. The fraud is now actionable in a court that operates on documentary evidence.

The cost calculation for the fraudster shifts by orders of magnitude. In a no-attestation regime, the expected cost of fraud is the probability of legal pursuit (low) times the legal penalty (variable). In an attestation regime, the cost includes the certainty of a permanent public record, the elevated probability of pursuit, and the increased penalty exposure under any jurisdiction that treats false attestation as a discrete offence.

The fraudster who proceeds anyway is a fraudster who has accepted those costs. They exist, and the system does not pretend they do not. The system is engineered around the fact that they are the minority and that the majority of attestations are honest, just as the passport system is engineered around the fact that the majority of border crossings are not forged.

What does the protocol actually limit?

Biometric signal capture is local to the creator's device. The template that performs the signing never leaves the device in plaintext. What leaves is a cryptographic attestation, bound to the work's content hash, with the work's bytes as the only thing the recipient registry sees. The biometric template itself is not stored remotely. A breach of the registry does not enable retroactive signing. A breach of the device enables prospective signing until the breach is detected.

The detection mechanism is the creator's own audit trail. The creator can query the registry for every attestation made under their identity. An attestation they did not generate is visible to them as soon as they look. The revocation mechanism appends a revocation entry to the registry, marking the disputed attestation as repudiated. The original attestation remains, alongside the revocation, with both timestamps visible. The audit trail makes the boundary of any compromise visible to a court evaluating the dispute later.

The protocol is not faked-proof. The protocol is auditable. The auditability is the property that matters for the disputes the system is designed to handle.

What should a working creator take from this?

The objection "but anyone could fake it" is the right objection to ask about a system that has not been designed for accountability. It is the wrong objection to ask about a system that has been. The biometric attestation on a finished piece of work is the same kind of artifact as a passport on a border crossing, an SSL certificate on a connection, a hallmark on a piece of silver. The artifact does not stop misuse. The artifact makes misuse traceable, dated, and actionable.

The working creator who needs to defend their work in 2027 will be defending it on the strength of attestations made in 2026. The fraudster who tries to claim that work as their own will have to either produce no signature (in which case the fraud is obvious) or produce a signature in their own name (in which case the fraud is named, dated, and actionable). Neither outcome is the disaster the objection implies. Both are the system functioning as designed.

A lock that can be picked is still worth installing. The pick takes time, leaves marks, and ranks the determined burglar against the casual one. The protocol that can be misused by a determined fraudster is still worth running. The misuse takes effort, leaves a record, and turns the casual fraudster into the documented one. That is the entire job.

Frequently asked questions

What if someone genuinely steals my biometric signal and signs in my name?: The protocol design limits the damage. The biometric signal does not leave the creator's device in plaintext. What leaves is a derived cryptographic attestation, bound to a specific work, with the work's content hash baked in. A stolen biometric template cannot retroactively sign past works. It can sign new ones until the theft is detected, at which point the creator publishes a revocation entry. The original attestations remain in the registry. The fraudulent attestations are marked as disputed. The audit trail makes the boundary of the compromise visible to a court.
Doesn't the legal system already handle attribution disputes without this infrastructure?: It does, slowly and expensively, on the strength of contemporaneous evidence. The question in a copyright dispute is what evidence exists that this party created this work at this time. The biometric attestation is a contemporaneous record, generated at the moment of signing, anchored in an append-only registry. It does not replace the legal system; it produces the kind of evidence the legal system can act on without requiring twenty thousand dollars of forensic accounting to reconstruct.
What is the analog to this in physical security?: Locks on a front door. A determined burglar gets in. The lock is not designed to prevent that; it is designed to raise the cost of entry, separate casual from determined attempts, and produce evidence (broken lock, tool marks) that distinguishes the events afterward. Insurance, police investigation, and legal pursuit are the systems that handle the determined attempt. The lock is the threshold-raising layer. Biometric attestation is the same layer applied to creative provenance.