ARCUS
01 / 13
FORENSIC DOCUMENT AUTHENTICATION

Proof a document
is what it claims to be.

ARCUS is a forensic instrument for documents. It reads the pixels, the metadata, the structure and the text of a file, scores authenticity 0–100, and seals the finding into evidence — with the first pass running on your own device.

LOW MEDIUM HIGH CRITICAL

EVIDENCE-GRADE · SCORE + TIER, NOT GUESSWORK · CONFIDENTIAL · JUNE 2026

THE PROBLEM
THE PROBLEM · I

Six tells. The eye catches none.

This Proof-of-Funds letter looks bank-perfect. It is AI-generated and edited. Tap the parts that give it away — each maps to a check ARCUS runs automatically.

PoF_MeridianTrust_USD8-5M.pdf CASE ARC-2026-0417
MERIDIAN TRUST BANK · PRIVATE CLIENTS

To Whom It May Concern,

We hereby confirm that our client holds cleared funds of USD 8,500,000.00 available and unencumbered, held in account ****-4471 as of 14 April 2026.

These funds are good, clean, cleared and of non-criminal origin, ready willing and able for the intended transaction.

Authorised by [signature: A. Vautrin], Relationship Director, under reference MT-PCB-0417-FF.

◊ EMBOSSED BANK SEAL (raster)
0 / 6
TELLS FOUND
FORENSIC LOG
Tap a phrase to log the tell…

A single tell is enough to decline. ARCUS runs all six classes at the gate — not from intuition, but from measurement.

BUT THE UPLOAD IS ALSO THE RISK
THE PROBLEM · II

The first pass runs
on your device.

A Proof-of-Funds letter, a passport, a deed — the most sensitive thing in the deal. ARCUS runs its deterministic forensic core on the device, so the first pass happens with no network call. Deeper analysis runs in the cloud — and ARCUS is explicit about exactly what gets sent, and when.

01 · ON DEVICE

The core is local

ARCUS’s computer-vision forensics — ELA, clone detection, noise & AI-generation signals — run on your machine with no network call. The first pass is fully local.

MODULE VIS
02 · EPHEMERAL

Nothing is retained

Where deeper AI analysis runs in the cloud, processing is ephemeral. The default is zero retention after the verdict is returned.

MODULE SEAL
03 · TRANSPARENT

Explicit about what leaves

Deeper analysis runs in the cloud. ARCUS shows exactly which artefacts are sent, and when — no silent uploads, no hidden transfers.

MODULE MET

Stage-1 is fully on-device; deeper stages run in the cloud. ARCUS is explicit about what runs where, and never pretends otherwise.

HOW A SCAN RUNS
THE SOLUTION

One scan, four moves,
file to verdict.

ARCUS carries a document from ingest to sealed evidence in four moves. Each move is owned by a part of the instrument. Hover a move to see what it does.

01 · INGEST

Ingest

The file is fingerprinted — SHA-256, type, structure map — and opened locally. Nothing is altered; the original is hashed and preserved.

MODULE STR
02 · ANALYSE

Analyse

On-device CV runs first; Full-Spectrum adds vision and synthesis stages. Pixels, metadata, structure and text are each interrogated.

MODULE VIS
03 · SCORE

Score

Findings fuse into a 0–100 authenticity risk score across six weighted dimensions, gated at a fixed decision threshold.

MODULE GEN
04 · SEAL

Seal

The verdict and every finding are written to a hash-chained, append-only record and exported as a signed forensic report.

MODULE SEAL

One file in. One score, one tier, one sealed record out. The detailed module screens follow.

WHAT ARCUS IS — AND IS NOT
WHAT IT IS — AND WHAT IT IS NOT

A forensic instrument.
Not a black box.

ARCUS measures and shows its working. It does not pass judgement on people, moderate content, or hand back a verdict you cannot trace to evidence.

✦ What ARCUS does

  • Interrogates pixels, metadata, structure and text for signs of forgery, tampering and AI generation.
  • Returns a 0–100 authenticity risk score and a tier — every point traceable to a finding.
  • Runs the first pass on-device, and is explicit about what runs where.
  • Seals every finding into a hash-chained, exportable forensic record.

✕ What ARCUS never does

  • Never makes the accept/reject call for you — it informs the examiner, it does not decide.
  • Never scores a person, a sentiment, or the "truth" of a claim — only the artefact's integrity.
  • Never silently ships your documents to a cloud you didn't choose.
  • Never returns a black-box number with no evidence behind it.
EVIDENCE OVER OPINION · THE EXAMINER DECIDES · THE RECORD HOLDS
RUN A SCAN
RUN A SCAN

Watch the checks resolve.

The same Proof-of-Funds letter, run end to end. Each check lands, the score climbs, and the verdict settles into a tier. Press play.

Module demonstrated GEN Authenticity scoring
0
/ 100 RISK
CASE ARC-2026-0417 · τ = 50 GATE
VISVisual forensics
METMetadata & provenance
STRStructure & layout
LAYLayer & composite
TXTOCR & text anomalies
CONContent verification
Illustrative scripted run for one case artefact — not a measured validation result.
THE SIX DIMENSIONS
HOW THE SCORE IS BUILT

Six dimensions, weighted.

The composite score is a weighted fusion of six independent forensic dimensions. Each catches a different way a document goes wrong. Here is what each found in case ARC-2026-0417.

VIS
Visual forensics
ELA · clone · noise · splice halos
30%
MET
Metadata & provenance
author · date · software · C2PA
25%
STR
Structure & layout
layers · hidden text · embeds
20%
LAY
Layer & composite
blending · masking · lighting
13%
TXT
OCR & text anomalies
font · kerning · MRZ checksum
7%
CON
Content verification
date · amount · signature logic
5%

Weighted composite for this case → 86 / 100 · CRITICAL. AI-generation signals (GEN) cross-cut every dimension.

SEE WHERE IT WAS TOUCHED
WHERE THE DOCUMENT WAS TOUCHED

The tamper map.

ARCUS localises the manipulation, not just the verdict. Drag to reveal the regions the forensics flagged on the letter — or hover a region directly.

MERIDIAN TRUST BANK · PRIVATE CLIENTS
4
1
3
2
REVEAL TAMPERED REGIONS
LAY
Balance field — masked & replaced; compression halo around the figure.
VIS
Bank seal — clone-stamped raster lifted from another document.
GEN
Signature — synthetic vector, no pen dynamics or ink texture.
MET
Header / provenance — created in an editor after the stated letter date.
NOW TRY TO FOOL IT
ADVERSARIAL

Now try to fool it.

A forger's next move is to hide the edit. Apply a counter-measure to the letter and watch what ARCUS does. The score holds because the evidence is layered.

Module demonstrated GEN AI-generation detection
86CRITICALARC-2026-0417
Awaiting counter-measure.
The artefact currently scores 86 / 100 across six dimensions. Try to bring it down.
Illustrative — demonstrates layered detection logic, not a benchmark of evasion robustness.
STANDARD VS FULL-SPECTRUM
TWO SHIPPED CONFIGURATIONS

Triage speed, or full depth.

ARCUS ships in two configurations. Standard is a single-pass triage. Full-Spectrum runs the complete three-stage pipeline. Switch between them.

1
On-device computer vision
ELA, clone detection, noise & AI-generation signals — deterministic, no network.
ON-DEVICECV CORE
2
Vision forensic pass
Structured visual protocol over the artefact and heatmaps.
CLOUDClaude Sonnet · vision
3
Synthesis & scoring
Dimension scoring, corroborated findings, forensic confidence and verdict.
CLOUDClaude Opus
STAGES
1
TYPICAL TIME
minutes
PRIMARY MODEL
Claude Sonnet
BEST FOR
High-volume triage
Stage-1 is on-device in both. Standard returns a single cloud pass; Full-Spectrum adds Stages 2–3. Standard time scales with the number of pages; Full-Spectrum with the number of documents.
INSIDE THE ENGINE ROOM
INSIDE THE INSTRUMENT

The engine room.

Six forensic dimensions, plus two modules that cut across them all. Each owns one way a document lies. Hover a module to see what it catches.

VIS
Visual forensics
MET
Metadata & provenance
STR
Structure & layout
LAY
Layer & composite
TXT
OCR & text anomalies
CON
Content verification
GEN
AI-generation detection
SEAL
Evidence seal

VISVisual forensics

ELA, copy-move/clone detection, noise discontinuity and splice halos — the pixel-level tells of an edit. Weighted 30% of the score.

THE EVIDENCE SEAL
THE RECORD THAT HOLDS

Written once. Never edited.

Every finding is written to a hash-chained, append-only ledger. You cannot quietly change a finding — a correction is appended as a new entry, and the original stands. Try it.

Module demonstrated SEAL Evidence ledger
● FINDINGS LEDGER · ARC-2026-04177 ENTRIES
14:02:07INGEST · SHA-256 fingerprint sealeda3f1·9e
14:02:09VIS · clone-stamped seal flagged7c2d·11
14:02:09LAY · balance field mask detectedd4e8·a0
14:02:10MET · creation post-dates letter0xb19f
14:02:11GEN · synthetic signature vector5a7c·e3
14:02:12SCORE · composite 86 / 100 · CRITICALe2f0·6b
14:02:12SEAL · report signed & hash-chained9d83·c4
Append-only · an override is a new entry, never a change to an old one.
Illustrative ledger. The append-only, hash-chained design is the point; timestamps and hashes are sample data.
WHO IT'S FOR
WHO IT'S FOR · AND THE RECORD

Where a document
has to hold up.

Anywhere the cost of accepting a forged document is real — and the verdict has to be defensible after the fact.

KYC / KYB

Banking & finance

Proof-of-funds, incorporation and ID documents at onboarding — the flagship domain.

LEGAL

Law firms

Document authentication for disputes, due diligence and discovery.

OSINT

Newsroom & OSINT

Source verification and provenance for investigative reporting.

GOV

Government & insurance

Regulator-reproducible evidence; claim and credential integrity.

The verdict is only as good as the evidence.
ARCUS keeps the evidence.

ARCUS

ARCUS · FORENSIC DOCUMENT AUTHENTICATION · CONFIDENTIAL · JUNE 2026

BACK TO THE TOP