From 2708e7b2640069ddf7fbb5d64829841ec82e3ae3 Mon Sep 17 00:00:00 2001 From: Ahmet Abdullah Gultekin Date: Mon, 1 Jun 2026 08:17:31 +0000 Subject: [PATCH] fix(amispoof): correct analyzer/axis counts + un-break opt-in mic MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two verified accuracy fixes for the amispoof.fivucsas.com browser tester. 1. Reconcile analyzer / liveness-axis counts in marketing copy. Verified against source: - ANALYZER_ORDER in web/amispoof/app.js = 23 entries (5 image-track + 18 video-track). 3 are opt-in (off by default): hand_tracking (?hand=1), voice_activity + audio_mouth_sync (?audio=1 / ๐ŸŽค) โ†’ 20 active by default. - PROOF_AXES = 18 entries (17 passive + 1 active challenge axis). - web/src/gates/*.ts = 3 gates (correct as stated). Replaced the stale "19 analyzers" / "15-axis" strings across index.html (meta description, OG description, og:image:alt, twitter:description, JSON-LD FAQ), plus README.md, ROADMAP.md and web/amispoof/README.md (which also still said "Twelve analyzers"). New framing: "23 analyzers (20 active by default; hand & voice/audio are opt-in) ยท 18-axis passive liveness-proof scorer ยท 3 gates". Also corrected README's opt-in list โ€” background motion is on by default (enableBackgroundSegmentation: true), only the 3 above are opt-in. 2. Un-break the opt-in microphone feature. web/amispoof/.htaccess sent Permissions-Policy with microphone=(), which hard-disabled the mic at the HTTP layer, silently killing the opt-in ๐ŸŽค / ?audio=1 voice + audio-mouth-sync analyzers in prod. Changed to microphone=(self); camera=(self) unchanged. Doc/markup only โ€” no TypeScript source touched. typecheck green, JSON-LD blocks parse. Co-Authored-By: Claude Opus 4.8 (1M context) --- README.md | 2 +- ROADMAP.md | 2 +- web/amispoof/.htaccess | 6 +++++- web/amispoof/README.md | 21 ++++++++++++++------- web/amispoof/index.html | 10 +++++----- 5 files changed, 26 insertions(+), 15 deletions(-) diff --git a/README.md b/README.md index 1a8d479..b0b35fa 100644 --- a/README.md +++ b/README.md @@ -237,7 +237,7 @@ Browser TypeScript port (`web/`, published as `@rollingcat/spoof-detector`): - [ ] amispoof.com domain (currently `/amispoof/` slug on fivucsas.com). - [ ] iBeta PAD-Level-1 browser-bundle submission package. -Live tester: https://amispoof.fivucsas.com/ (the old https://fivucsas.com/amispoof/ now 301s) โ€” **19 analyzers + 3 gates + 15-axis passive liveness-proof scorer** running entirely client-side. Default-on: 17 analyzers covering the original ten plus the seven blendshape/3D-pose unlocks (eyebrow motion, blink symmetry, gaze, expression dynamics, 3D pose consistency, behavioural pattern, plus temporal + background grid brought across from `src/`). Opt-in extras: background motion (MediaPipe SelfieSegmenter), hand tracking (HandLandmarker), voice-activity + audio-mouth-sync (Web Audio API). Session recording + JSON replay shipped 2026-05-17. See `web/amispoof/README.md` for the deployment runbook and `ROADMAP.md` "Browser Port v0.1.0" for the full module inventory. +Live tester: https://amispoof.fivucsas.com/ (the old https://fivucsas.com/amispoof/ now 301s) โ€” **23 analyzers + 3 gates + 18-axis passive liveness-proof scorer** running entirely client-side. Default-on: 20 analyzers covering the original ten plus the seven blendshape/3D-pose unlocks (eyebrow motion, blink symmetry, gaze, expression dynamics, 3D pose consistency, behavioural pattern, plus temporal + background grid brought across from `src/`, plus background motion via MediaPipe SelfieSegmenter). Opt-in extras (3): hand tracking (HandLandmarker, `?hand=1`), voice-activity + audio-mouth-sync (Web Audio API, `?audio=1` or the ๐ŸŽค button). Session recording + JSON replay shipped 2026-05-17. See `web/amispoof/README.md` for the deployment runbook and `ROADMAP.md` "Browser Port v0.1.0" for the full module inventory. ## Academic paper diff --git a/ROADMAP.md b/ROADMAP.md index d2bc632..a9946b3 100644 --- a/ROADMAP.md +++ b/ROADMAP.md @@ -61,7 +61,7 @@ quality gate, not LIVE/SPOOF); doc + paper audit; PR + production deploy | Surface | State | |---|---| -| **Browser bundle** (`@rollingcat/spoof-detector` on npm, live at amispoof.fivucsas.com) | **Production** โ€” 19 analyzers, 15-axis proof scorer, 185-pt ceiling; 6.7โ€“9.5 fps Pixel-class Android, 25โ€“30 fps desktop Chrome WebGPU; 217 vitest green | +| **Browser bundle** (`@rollingcat/spoof-detector` on npm, live at amispoof.fivucsas.com) | **Production** โ€” 23 analyzers (20 active by default; hand & voice/audio opt-in), 3 gates, 18-axis proof scorer, 185-pt ceiling; 6.7โ€“9.5 fps Pixel-class Android, 25โ€“30 fps desktop Chrome WebGPU; 217 vitest green | | **Python reference** (`src/`) | **Production** โ€” calibration source-of-truth + ISO/IEC 30107-3 benchmark harness for ยง6โ€“ยง8 of the paper; 138 pytest green | | **Paper** (`paper/sections/`) | **Browser-first reframe** complete (PR #45); ยง0/ยง1/ยง10 lead with the client-side bundle, Python framed as starting-point + evaluation reference; ยง7.6 updated with measured browser-port perf numbers | | **iBeta PAD-Level-1 submission package** | Scoped to the Python pipeline; re-scope to the browser bundle is a planned next iteration | diff --git a/web/amispoof/.htaccess b/web/amispoof/.htaccess index 7d57cac..09f6e4d 100644 --- a/web/amispoof/.htaccess +++ b/web/amispoof/.htaccess @@ -11,7 +11,11 @@ # X-Robots-Tag intentionally NOT set โ€” /amispoof/ is now publicly # indexable per the SEO update (2026-05-16). The page-level meta robots # + JSON-LD SoftwareApplication + Open Graph tags are in index.html. - Header always set Permissions-Policy 'camera=(self), microphone=()' + # microphone=(self) so the opt-in voice / audio-mouth-sync analyzers + # (๐ŸŽค button / ?audio=1) can request mic permission. Was microphone=() + # which hard-disabled the mic at the HTTP layer and silently killed the + # opt-in audio feature in prod. + Header always set Permissions-Policy 'camera=(self), microphone=(self)' diff --git a/web/amispoof/README.md b/web/amispoof/README.md index 98a98bc..354f4c2 100644 --- a/web/amispoof/README.md +++ b/web/amispoof/README.md @@ -74,13 +74,20 @@ Both are aggressively cacheable via jsdelivr's `Cache-Control: public, max-age=3 - **Verdict** (LIVE / SPOOF) with confidence percentage and peak-sensitive session memory โ€” one sustained spoof burst flips and keeps the verdict. -- **Twelve analyzers** with live score 0โ€“100, grouped image-track vs - video-track per the paper's hybrid architecture: - - **Image** โ€” MiniFASNet (w 5.0), Device boundary (0.5), - Background grid (1.5), Texture (0.0 by default), Moire (0.0), Screen - replay (0.5). - - **Video** โ€” Screen flicker (3.0), Micro-tremor (0.5), Landmark - variance (2.0), rPPG pulse (0.5), Blink/EAR (0.5), Temporal motion (0.3). +- **23 analyzers** with live score 0โ€“100 (20 active by default; hand + tracking + voice-activity + audio-mouth-sync are opt-in), grouped + image-track (5) vs video-track (18) per the paper's hybrid architecture. + The canonical list with per-analyzer weights and descriptions is + `ANALYZER_ORDER` in `app.js`; the badge weights are overwritten at load + time from the lib's exported `DEFAULT_ANALYZER_WEIGHTS` so the UI always + reflects the weights the running fuser actually uses. Key signals: + - **Image** โ€” MiniFASNet (w 5.0), Device boundary, Background grid, + Texture, Moire, Screen replay. + - **Video** โ€” Screen flicker (3.0), Micro-tremor, Landmark variance, + rPPG pulse, Blink/EAR, Temporal motion, plus the Phase A blendshape / + 3D-pose unlocks (eyebrow motion, blink symmetry, gaze, expression + dynamics, 3D pose consistency, planarity, behavioural pattern) and the + Phase D background-motion / hand-tracking / voice analyzers. Texture + moire default to weight 0.0 per the paper's ยง5.3 anti-correlation finding; consumers can re-enable via constructor `analyzerWeights` override. diff --git a/web/amispoof/index.html b/web/amispoof/index.html index 6b348fb..b5d33d6 100644 --- a/web/amispoof/index.html +++ b/web/amispoof/index.html @@ -8,7 +8,7 @@ - + @@ -91,7 +91,7 @@ "name": "Am I spoof?", "acceptedAnswer": { "@type": "Answer", - "text": "amispoof answers the question in your browser in a few seconds โ€” open https://amispoof.fivucsas.com/, grant camera access, and the page runs 19 anti-spoof analyzers + a 15-axis passive liveness-proof scorer on your face. The verdict (LIVE or SPOOF) appears in real time with per-axis evidence. Nothing is uploaded โ€” all inference happens client-side in WebAssembly." + "text": "amispoof answers the question in your browser in a few seconds โ€” open https://amispoof.fivucsas.com/, grant camera access, and the page runs 23 anti-spoof analyzers (20 active by default; hand & voice/audio are opt-in) + an 18-axis passive liveness-proof scorer and 3 gates on your face. The verdict (LIVE or SPOOF) appears in real time with per-axis evidence. Nothing is uploaded โ€” all inference happens client-side in WebAssembly." } }, {