Does any biometric data ever leave the user's device under BPoH?

No. Capture, local feature extraction, one-way hash generation, and zero-knowledge proof construction all execute on-device. Only the resulting biometric commitment, the zero-knowledge uniqueness proof, a separate liveness proof, and a 0-100 confidence score are ever submitted on-chain - never the original face depth map, voiceprint, or behavioral signal.

How does the system stop the same person from enrolling twice under different wallets?

A standalone UniquenessRegistry contract tracks two independent dedup keys - the zero-knowledge proof digest and the biometric commitment itself. Enrollment reverts if either has already been consumed by any prior wallet, anywhere on the network, closing the gap between per-wallet 'verified' badges and true one-human-one-token guarantees.

Can a Humanity token be bought, sold, or transferred?

No. The token is soulbound: the contract's transfer hook reverts unconditionally whenever both sender and recipient are non-zero addresses, and both approve() and setApprovalForAll() are hard-reverted. The only state transition after minting is revocation by a governance-held role.

What happens if someone tries to replay a valid enrollment signature on a different contract or chain?

The attestor's signature is bound to the exact biometric commitment, uniqueness proof, humanity score, chain ID, and contract address via a keccak256 digest before EIP-191 prefixing. A signature valid on one deployment or chain will not recover to an authorized signer on any other, so it cannot be replayed cross-contract or cross-chain.

Biometric Proof-of-Humanity with On-Device ZK Uniqueness Proof

Executive Summary

JIL Sovereign's Biometric Proof-of-Humanity (BPoH) system is a protocol-native identity primitive that lets a wallet holder prove they are a unique, living human being without any biometric data - raw or derived - ever leaving their device or becoming visible to JIL, a validator, or any counterparty. Rather than bolting a third-party KYC vendor onto an existing chain, BPoH embeds human verification as a first-class on-chain primitive: a single boolean any contract can check.

Three innovations distinguish this architecture: (1) multi-modal biometric capture and feature extraction that executes entirely on the user's device, so raw biometric data is architecturally incapable of reaching a server; (2) a locally-generated one-way commitment plus a zero-knowledge proof that the underlying biometric has never previously enrolled anywhere on the network, submitted in place of the biometric itself; and (3) a soulbound (non-transferable) ERC-721 Humanity token, minted only after both the uniqueness proof and an independent biometric-commitment check clear a standalone global registry.

Core Innovation: On-device-only biometric processing combined with a chain-verifiable, replay-proof uniqueness commitment and a transfer-disabled token - Sybil resistance becomes an L1-native primitive that proves uniqueness while learning nothing about the person behind it.

Problem Statement

Most blockchain ecosystems are, at the protocol level, wallet-based rather than human-based. A single actor can generate an unbounded number of wallets at near-zero marginal cost, and the network has no native way to distinguish one human controlling one wallet from one human controlling ten thousand. This gap is exploited systematically: bots and Sybil clusters have captured outsized shares of token airdrops and public-goods distributions, governance votes are diluted by holdings fragmented across throwaway wallets, and a large share of on-chain "social" activity is automated rather than human.

$10B+

Estimated annual cost of Sybil/bot exploitation across crypto ecosystems (industry estimate)

up to 99%

Share of value captured by bot/Sybil wallets in documented public airdrop cases

Bytes of raw biometric data transmitted off the enrolling device under BPoH

Why Existing Solutions Are Insufficient

Vendor-hosted biometric KYC (Persona, Jumio, Onfido-style): biometric templates are captured and matched on vendor infrastructure. A single vendor breach exposes templates for every enrolled user, and the verification result is scoped to that vendor's own database, not to the chain.
Hardware-orb proof-of-personhood networks: require dedicated capture hardware and centralize raw iris/biometric data at enrollment kiosks operated by the network or its partners.
Social-graph webs-of-trust: infer uniqueness from vouching relationships rather than biometric evidence, which is itself gameable at scale by coordinated ring vouching.
Simple soulbound "verified" badges without a uniqueness proof: can mark a wallet as attested but cannot cryptographically stop the same human from enrolling a second wallet, because there is no global commitment tied to the underlying biometric itself.

Technical Architecture

Multi-Modal On-Device Capture

Biometric modalities are combined so that no single sensor becomes a single point of failure. Feature extraction and hashing occur entirely on-device; nothing below is ever transmitted in raw form.

Modality	Method	False-Accept Rate	Capture Time
3D Face Recognition	Depth-map scan via structured-light / TrueDepth-class sensor	~1 in 1,000,000	~30s
Voice Print	Vocal-tract resonance, formant structure, deepfake detection	~1 in 100,000	~10s
Behavioral Biometrics	Typing rhythm, touchscreen pressure, gesture dynamics	~1 in 50,000	~2 min
Liveness Detection	Randomized challenge-response, skin micro-texture analysis	Supplementary gate	~5s

Enrollment Pipeline

Device sensors collect the enabled modalities; on-device ML models extract feature vectors.
An irreversible one-way hash (biometricHash) is generated locally from the extracted features.
A zero-knowledge proof is constructed on-device attesting "this hash belongs to a unique human who has not previously enrolled" (uniquenessProof), plus a separate liveness attestation (livenessProof).
Only the hash, the two proof digests, and a 0-100 confidence score are submitted on-chain - never the underlying biometric.

Smart Contract Layer

Contract	Role
`BiometricHumanity`	Soulbound ERC-721 enrollment and proof storage; stores the `HumanityProof` struct (biometricHash, uniquenessProof, livenessProof, enrollmentTime, humanityScore, lastVerification, verified, revoked) per wallet.
`UniquenessRegistry`	Standalone contract, deliberately separated from `BiometricHumanity` so the deduplication set survives contract upgrades; tracks `consumedProofs` and `enrolledBiometrics` as two independent dedup keys.
`HumanityGate`	Importable modifier library; a single `requireHumanity(minScore)` modifier gates any downstream contract function behind a minimum verified-human confidence score.

On enrollment, the contract verifies an ECDSA signature from an authorized VERIFIER_ROLE attestor over a digest binding the biometric hash, uniqueness proof, humanity score, block.chainid, and the contract's own address - preventing the signature from being replayed against a different contract or a different chain. Only after signature verification does the contract call the registry's consumeProof (reverts if the ZK proof digest was already used) and enrollBiometric (reverts if the biometric hash itself was already enrolled) - two independent, atomic dedup checks - before minting the token.

Attack Resistance & Reverification

Attack	Technique	Defense
Deepfake video	AI-generated face video	3D depth requirement; unpredictable liveness challenges; skin micro-texture analysis
Photo replay	High-resolution photo to camera	No blink/head-movement/depth signal; behavioral biometrics absent
Synthetic voice	TTS or voice cloning	Vocal-tract mismatch; micro-timing absent; spectral synthesis detection
3D mask	Silicone or 3D-printed mask	No pores/blood-flow signal; sub-dermal checks; behavioral mismatch
Duplicate enrollment	Same person, new wallet	Hash collision rejected by `UniquenessRegistry`
NFT transfer	Buy or steal a Humanity token	Soulbound: transfer function reverts unconditionally

A needsReverification() view compares block.timestamp against lastVerification + reverificationPeriod (default 365 days; governance may only raise the floor to at least 30 days). Revocation, exercised by a governance-held REVOKER_ROLE, checks the revoked flag before the verified flag specifically so a revoked wallet remains distinguishable from a never-enrolled one rather than collapsing to the same error state.

Prior Art Differentiation

Approach	Biometric leaves device?	Dedicated hardware required?	Cryptographic uniqueness proof?	Non-transferable token?
Vendor-hosted KYC (Persona/Jumio-style)	Yes	No	No	No
Hardware-orb proof-of-personhood	Yes, to enrollment kiosk	Yes	Partial	Varies
Social-graph webs-of-trust	N/A (no biometric)	No	No	Varies
Generic soulbound "verified" badge	N/A	No	No	Yes
JIL BPoH	No	No	Yes	Yes

Patent Claim

Independent Claim 108: A computer-implemented system for privacy-preserving proof of human uniqueness, comprising: an on-device biometric capture and feature-extraction module configured to process at least one biometric modality entirely on a user's device and to output only a one-way cryptographic commitment of the extracted features, the underlying biometric data never being transmitted from the device; a zero-knowledge proof generator, executing on the device, configured to construct a proof that the commitment corresponds to a human who has not previously enrolled, without revealing the commitment's derivation; a uniqueness registry smart contract, separate from an enrollment contract, configured to atomically mark both a zero-knowledge proof digest and the biometric commitment as consumed upon a first successful enrollment, and to reject any subsequent enrollment attempt presenting either value; and an enrollment smart contract configured to verify a signature from an authorized attestor over the commitment, the proof, and a confidence score bound to a requesting contract address and chain identifier, and, upon successful verification and registry consumption, to mint a non-transferable token to the requesting wallet, the token's transfer and approval functions being disabled by construction.