The Sybil Trilemma — Why Physics Is the Answer
This is the second post in a series expanding on our governance stack overview. Today: Layer 1 — the Iris Oracle.
Every Proof of Personhood system must satisfy three properties simultaneously:
-
Uniqueness — one human, one identity, no duplicates
-
Privacy — nobody learns which human holds a given identity
-
Decentralisation — no central authority decides who counts as human
No existing system achieves all three.
KYC sacrifices privacy. Worldcoin sacrifices decentralisation through proprietary Orb hardware — one company controls who gets verified. BrightID sacrifices uniqueness through collusion vulnerability. Social graph systems require a trusted bootstrapping community. Each solves one or two corners of the trilemma and quietly concedes the third.
The Iris Oracle takes a different approach: instead of asking “what does this person look like?” or “what do they know?” — it asks “how does their involuntary nervous system respond to an unpredictable physical stimulus, right now?”
The Core Insight: Physics Does Not Lie
The pupillary light reflex (PLR) is controlled by the autonomic nervous system. When light intensity changes, the pupil contracts — with a characteristic latency of 200–500ms, a physiologically bounded response curve, and natural micro-fluctuations (hippus) that no static image can replicate.
A photograph does not have a nervous system. A deepfake does not have one either. A pre-recorded video response fails the moment the challenge is unpredictable.
This is the fundamental shift: from appearance (fakeable by anyone with a good GPU and enough training data) to involuntary biological response to a real-time unpredictable physical stimulus (requires simulating a living nervous system in real time).
The challenge sequence is generated by on-chain VRF — unpredictable, unique to each verification moment, bound to a specific block hash. You cannot pre-record the correct response because you cannot know what the challenge will be.
The Four-Factor Model
Four signals are captured simultaneously in a single 10-second optical moment:
| Factor | Signal | What It Proves |
|---|---|---|
| Iris | IrisCode (266 degrees of freedom) | Who are you? False match rate < 1 in 1.2M |
| Pupillary Response | PLR correlation with VRF luminance challenge | Are you alive and present? Autonomic, involuntary, physiologically bounded |
| Corneal Reflection | Purkinje point tracking | Are you looking at THIS challenge? Position and colour must match the VRF trajectory |
| Heart Rate Variability | rPPG (camera) + PPG (smartwatch) | Are you unique and willing? Cross-validated liveness; individual HRV signature |
The cross-device HRV validation deserves a note: if an attacker points their phone at a puppet face while wearing the smartwatch themselves — the camera captures one heart, the watch measures another. These are detectable.
Vote-Moment Binding: No Credential to Steal
A critical design decision distinguishes the Iris Oracle from credential-based systems.
The proof is not generated once and stored. It is generated at the exact moment of each action, bound to the block hash of that specific vote:
-
Chain generates a VRF challenge unique to this block
-
Device displays the challenge while camera captures the eye
-
On-device ZK-proof computed — raw biometric data never leaves the device
-
ZK-proof and vote submitted as a single atomic transaction
There is no credential to steal. The proof is the action. You cannot sell your vote because the vote is literally chained to your body at the moment of casting. You cannot buy someone else’s voting power without being physically present as them, in real time, for exactly the challenge generated at that block.
A Candidate Fifth Factor: Tissue Impedance Spectroscopy
Living biological tissue has frequency-dependent impedance described by the Cole-Cole model: cell membranes behave as capacitors, ion channels as resistors, and the combined response at 1 kHz is measurably different from the response at 100 kHz.
The proposal: the VRF generates a randomised frequency sweep sequence. The smartwatch passes weak currents through the skin at each frequency. The measured impedance must follow the Cole-Cole curve — and because the sequence is unpredictable, no pre-recorded response can match it.
This is the same challenge-response principle as the PLR, applied to electrical signals rather than optical ones. An attacker with a rooted smartwatch who injects a fake PPG/HRV signal must simultaneously produce a frequency-correct tissue impedance response to an unpredictable challenge. Two independent physical phenomena, mutually consistent, in real time.
Our key open hardware question: Is the Cole-Cole frequency response measurable at sufficient signal-to-noise ratio using the dry capacitive skin electrodes present in ECG-capable consumer watches (Apple Watch Series 4+, Samsung Galaxy Watch)? Wet gel electrodes provide better contact — consumer watches use capacitive dry contact. We do not have experimental data on this.
If anyone has worked with BIA or ECG morphology on consumer smartwatch hardware, we would particularly value your input.
What We Evaluated and Rejected
The four-factor model reflects a longer evaluation. Several candidates were seriously considered and rejected — we document them because the reasoning matters:
Geomagnetic field — A $50 electromagnet overwrites any smartphone magnetometer. Signal-to-noise on consumer hardware is insufficient. Rejected.
GPS coordinates — Directly includes location, violating the privacy requirement. Even coarse ZK-proofs over GPS are highly re-identifying over time. Rejected.
DNA hybridisation — The strongest possible biometric, and the privacy objection is largely solvable with ZK on-device processing. Two fatal problems remain: hardware centralisation (calibrated reagents require a supply chain — the Worldcoin Orb problem in biochemical form), and irrevocability. You can re-enrol your iris if the ZK scheme is ever compromised. You cannot change your genome. Rejected on irrevocability grounds.
ECG morphology — The P-wave, QRS complex, and T-wave are individually unique and stable across years (~95%+ recognition accuracy). Apple Watch Lead-I ECG uses exactly the two-electrode configuration we describe for TIS. This is a genuine candidate for extending Factor 4 — the constraint is accessibility (arrhythmias, pacemakers, certain medications alter morphology). Not rejected; flagged as a strong candidate for a future protocol extension.
Three Experiments Before a Formal DIM Proposal
We are transparent about what remains unvalidated:
-
Purkinje reflection imaging — does consumer smartphone resolution support corneal reflection tracking at sufficient precision?
-
rPPG–PPG cross-validation — can two different hearts be reliably distinguished at smartphone signal quality in real-world conditions?
-
PLR demographic validation — what are the false rejection and false acceptance rates across age groups, medications, and ambient lighting conditions?
A working proof-of-concept (Python, MediaPipe, OpenCV) demonstrates that pupillary response to visual stimuli is measurable on commodity webcams and that correlation analysis can distinguish biological responses from static or pre-recorded signals. The three experiments above will determine whether the hardware assumptions hold at population scale.