Claims Evidence Firewall

Authenticate insurance claim evidence before you assess the damage

A forensic authentication gate for auto-insurance claims. It ingests the claim packet, runs a multi-agent forensic crew, and a deterministic policy gate decides the route: AUTO-PROCEED, SIU-REFERRAL, HUMAN-REVIEW, or ABSTAIN. The case it is built for is the one your deepfake detector waves through: a real photo recycled from a settled claim. Agents advise, code decides, and every decision is written to a tamper-evident ledger.

35 / 35

Recycled and metadata-spoofed frauds caught that a single-signal detector misses (0 / 35)

Labeled 120-claim synthetic benchmark

0.0%

False-accusation rate: clean claims wrongly routed to SIU

0 of 47 clean claims, same synthetic benchmark

100%

Decisions carrying a verifiable hash-chained record

Audit-integrity coverage, shown live by the chain-break

A runnable demo of the mechanism on synthetic claims and a synthetic historical index. The full pipeline and on-screen run work offline with no API key; the live narrative analysts are the optional part.

The fraud that beats your detector is not fake. It is recycled.

Volume without verification, and a chain of custody you cannot defend in court.

Insurers are being flooded with manipulated and recycled claim evidence, and most detection is fragmented and post-hoc: a third-party deepfake detector run after submission, not a gate inside the pipeline. A lone authenticity detector has two structural weaknesses at once. It ages out the moment generators improve, and it is blind to the oldest fraud in the book, a genuine camera photo lifted from a prior settled claim, because that photo passes every authenticity test by being real. Separately, if a generative "enhancement" or upscale step overwrites the original claim image, the carrier picks up spoliation exposure in litigation.

The market signals are hard to ignore. In the 2026 State of Insurance Fraud (Verisk, 2026), 98 percent of insurers report a surge in manipulated media, 36 percent of consumers say they would alter a claim image, and only 32 percent of insurers feel very confident detecting deepfakes, yet 65 percent lean on a third-party AI detector and 44 percent still rely on manual review. Deepfake fraud attempts are up 2,137 percent over three years (Facia.ai), and one UK motor carrier saw a 300 percent rise in AI-manipulated vehicle images in a single year (The Guardian and Milliman). A single disputed claim reaching litigation costs 30,000 to 75,000 dollars.

The regulatory wall arrived at the same time. A NAIC Model Bulletin on AI use has been adopted by 24 states, the Colorado AI Act takes effect June 30 2026, and the EU AI Act high-risk deadline lands in August 2026 with penalties up to 35 million euros or 7 percent of global turnover. Outsourcing the AI does not outsource the liability. That makes the audit trail behind an automated decision the thing that keeps the decision defensible, not a nice-to-have.

A forensic crew advises, a deterministic policy gate decides

Authentication is a gate, not a report. The trust boundary is plain code, never an LLM self-report.

The pipeline is direct: a claim packet goes through deterministic signal extraction, a forensic crew advises, a policy gate returns the route, and a hash-chained evidence ledger records it. The design principle is that independent evidence streams corroborate each other, and no analyst is trusted to grade the decision it advised on.

Deterministic signal extraction

Plain code, real signals. A SHA-256 of the original is taken at ingest and appended to the hash-chained ledger. EXIF and capture metadata are parsed, and a 256-bit perceptual hash (a 16 by 16 average hash, called pHash in the code) runs a nearest-neighbour search over a roughly 200-record historical claims index. Metadata is checked against the claim for device, GPS, and date consistency. The original is never mutated, only sidecar artifacts are written.

Hash-chained evidence ledger

Every decision is written to an append-only, hash-chained record per claim: the original SHA-256, each analyst finding and confidence, the rule that fired, model, version, and timestamps, and a NAIC AIS-Program and EU AI Act compliance mapping. It exports as JSON and rendered HTML. The verify-chain routine recomputes every link and re-hashes each original on disk, so tampering shows up as a broken chain.

The forensic crew: four analysts and an adversarial Challenger

Analyst	What it reasons over	Basis
Provenance Analyst	Capture-metadata, EXIF, and device-attestation consistency against the claim record (device, GPS within range of the loss location, capture date).	deterministic, real signals
Pixel-Forensics Analyst	A sensor-noise and frequency-domain artifact score. This signal is simulated, a stand-in for a future learned generative-artifact model, and is labeled simulated everywhere it surfaces on screen.	simulated signal
Reuse Analyst	Perceptual-hash matches against the historical claims index, the signal that catches a recycled real photo lifted from a prior claim.	deterministic, real pHash
Narrative-Consistency Analyst	Whether the FNOL text, metadata, and visible damage cohere, for example a narrative that describes one kind of impact while the image shows another. A genuine cross-modal reasoning task.	LLM reasoning
Adversarial Challenger	A skeptic prompted to refute every flag and clear the claimant, so only surviving flags stand and a legitimate policyholder is not falsely accused.	LLM reasoning

The policy gate: code decides

Outside the agents, plain code aggregates the typed analyst verdicts and the raw signals against the carrier's configured thresholds into one reproducible routing decision: AUTO-PROCEED, SIU-REFERRAL, HUMAN-REVIEW, or ABSTAIN, where ABSTAIN routes to HUMAN-REVIEW. The gate is the trust boundary. It is deterministic, so the same claim yields the same decision every run, which is what makes it defensible to a regulator in a way an LLM self-report is not. The narrative and challenger roles run through a provider-swappable adapter (Anthropic, OpenAI, or Gemini, default claude-opus-4-8); with no key set they fall back to a deterministic offline stub, and the gate never changes hands.

Worked claims, on screen

All claims, images, and the historical index are synthetic, built for the demo. No real claim photo, policyholder, carrier, or account is used.

The FNOL intake queue

Four synthetic first-notice-of-loss claims arrive awaiting verification. The console frames the job plainly: a fraudster can diffusion-generate a smashed bumper or recycle a real photo from a settled claim, and a damage-assessment tool will happily score either. The gate verifies whether a claim's evidence can be trusted before it is assessed or paid.

The Claims Evidence Firewall FNOL intake queue listing four synthetic auto claims, CLM-A-1042 through CLM-D-1045, each with claimant, loss type, severity score, and an Awaiting verification status. — The intake queue: four claims enter the forensic pipeline before any damage assessment.

The recycled real photo that a single detector clears

Claim CLM-C-1044 is the case the firewall is built for. Its image is a genuine camera photo, so provenance and pixel-forensics both pass, which is exactly where a lone deepfake detector stops and clears it. The Reuse Analyst matches its perceptual hash to a settled prior claim and the Narrative Analyst sees the account and the image disagree, so the deterministic policy gate routes it to SIU-REFERRAL at 0.96 confidence, with a Duplicate image, matches prior claim marker on the evidence. Single-signal detection passes this; cross-signal forensics catches it, and this beat does not depend on the simulated signal.

Claim CLM-C-1044 expanded to show the evidence image stamped Flagged SIU with a Duplicate image, matches prior claim marker, the first-notice-of-loss details, the nine-stage forensic pipeline, and a Referred to Special Investigations verdict at 0.96 confidence decided by the deterministic policy gate. — CLM-C-1044: a real photo, recycled. The policy gate refers it to SIU on the reuse and narrative signals.

Why the crew beats a classifier

The decision analysis makes the corroboration visible. Provenance reads consistent and Pixel-Forensics reads consistent and is labeled simulated, both green. Reuse and Narrative-Consistency are flagged, and the adversarial Challenger tested two flags and both survived. The reason for the route is named in plain terms: the perceptual hash matches prior claim HIST-4019 (Maple Mutual, 2025-11-29) at hamming distance 0. A perfect single deepfake detector could not have caught this, because nothing about the photo is fake.

The Decision analysis panel for CLM-C-1044 showing four analyst verdicts: Provenance Analyst consistent, Pixel-Forensics Analyst consistent and simulated with artifact score 0.06, Reuse Analyst flagged, and Narrative-Consistency Analyst flagged because the narrative and photo disagree, with a note that the adversarial challenger tested two flags and two survived, and a why-this-route line citing a perceptual-hash match to prior claim HIST-4019. — Four analyst verdicts, an adversarial check, and a named reason. The proof behind the SIU referral.

The coverage gap, benchmarked

Running every claim in the labeled 120-claim synthetic set surfaces the durable result. Of the 35 frauds that carry no authenticity artifact, the 20 recycled-real and 15 metadata-spoofed claims, a single-signal authenticity baseline catches 0 and the firewall catches all 35, because those are real photos a lone detector passes and cross-signal forensics is what closes the gap. Clean claims run straight through at a 0 percent false-accusation rate, every decision carries a verifiable audit record, and fraud-routing recall against the ground-truth labels reads 1.00. These are figures on a fixed, labeled synthetic set whose fraud classes carry detectable signatures by construction, not an open-world guarantee, so the number to lead with is the coverage gap against the incumbent a lone detector represents.

The benchmark panel over 120 labeled claims showing metric cards for 100 percent clean straight-through, 100 percent decisions with a verifiable audit record, 0 percent false-accusation rate, and 1.00 fraud-routing recall, above a coverage-gap row reading 0 of 35 caught by a single-signal detector versus 35 of 35 caught by the firewall, with a note that those are real photos a lone authenticity detector passes. — 0 of 35 versus 35 of 35: the coverage gap a single-signal baseline leaves open, closed by the crew.

Spoliation, turned into a red row

Every decision binds the original image into an append-only, tamper-evident chain. Editing a stored original, which is what a generative enhancement or a fraud does, breaks that chain. Tamper with a cleared original and re-verify, and the row for CLM-A-1042 turns red as Altered, spoliation, while the sealed rows stay green, and the verifier reports the chain broken, tampering detected. A litigation risk that is usually abstract becomes something the buyer can watch happen.

The Evidence Certificate chain-of-custody view after tampering with the CLM-A-1042 original: its row is red reading Altered and spoliation with the original on disk marked Altered, spoliation, while CLM-B, CLM-C, and CLM-D rows read Sealed and Unaltered, and a status line reads chain broken, tampering detected. — The chain-break: verify-chain re-hashes each original on disk and flags the altered one as spoliation.

Where the firewall sits, and where it does not

It runs before damage assessment and in front of tools like Tractable and CCC. It authenticates what they assess; it does not compete with them.

Concern	A single-signal deepfake detector	Claims Evidence Firewall
Recycled real photo	Cleared, because the photo is genuine	Caught on the perceptual-hash reuse and narrative signals
Who decides the route	A threshold on one model score	A deterministic policy gate outside the model
Thin or conflicting evidence	Forced to a pass or fail	Abstains to HUMAN-REVIEW rather than bluffing
Falsely accusing a claimant	No built-in check	An adversarial Challenger clears surviving-only flags
Chain of custody	Not addressed	Hash-chained ledger, tampering shows as a broken chain
Audit trail	A score, not a record	A JSON and HTML evidence record with a NAIC and EU AI Act mapping

What this demo does not do

It does not connect to live carrier systems. The Guidewire ClaimCenter and Duck Creek connectors, a mobile guided-capture SDK, a real C2PA verifier, and a real PRNU camera-fingerprint database are stubbed or deferred.
The pixel-forensics signal is simulated and labeled as such on screen, a stand-in for a future learned generative-artifact model. The recycled-photo differentiator does not rely on it.
It does not assess damage, estimate repair cost, or replace Tractable or CCC. The carrier's severity score is accepted as an input field, not computed here.
Every claim, image, policyholder, carrier, and the historical index is synthetic. No real claim photo, live carrier system, or external account is used.
The benchmark figures are on a fixed, labeled 120-claim synthetic set whose fraud classes carry detectable signatures by construction. The honest claims are the coverage gap over a single-signal baseline, 0 percent false accusation, and 100 percent audit integrity on that set, not zero fraud or perfect detection in the open world.
The NAIC and EU AI Act mapping is a compliance record the system produces, not a certification, an audit sign-off, or a legal guarantee.

Questions buyers ask

How is this different from the deepfake detector we already run?

A single-signal authenticity detector asks one question: was this image generated or altered. It ages out as generators improve, and it is structurally blind to a real photo recycled from a prior claim, because that photo passes every authenticity test by being genuine. The firewall corroborates four independent signals instead, provenance, historical reuse by perceptual hash, narrative coherence, and a simulated pixel-forensics signal, so the recycled real photo that clears a lone detector still gets caught on the reuse and narrative signals. On the labeled 120-claim synthetic benchmark, a single-signal baseline caught 0 of the 35 signal-less frauds and the firewall caught all 35.

Does this replace Tractable or CCC for damage assessment?

No. It authenticates the evidence before damage assessment, it does not estimate repair cost or replace an assessor. The carrier's existing severity score is accepted as an input field, not recomputed here. Think of it as a gate that decides whether a claim's evidence can be trusted, sitting in front of the tools that assess what the evidence shows.

The AI is making a fraud call. How do we defend that to a regulator?

The agents only advise. The routing decision is made by a deterministic policy gate written in plain code, outside the language model, which aggregates the typed analyst verdicts and raw signals against your configured thresholds into one reproducible outcome. The same claim yields the same decision every run, and each decision is written to an append-only, hash-chained evidence ledger with model, version, and timestamps and a NAIC and EU AI Act compliance mapping. That mapping is a record the system produces, not a certification or legal sign-off.

What does it do when the evidence is too thin to decide?

It abstains to a human rather than bluffing a pass or an accusation. A low-resolution image with partial metadata routes to ABSTAIN, then HUMAN-REVIEW, marked as needing proof. An adversarial Challenger also runs on every claim, prompted to refute each flag and clear the claimant, so only flags that survive scrutiny stand and a legitimate policyholder is not falsely accused. Across the benchmark, 0 of the 47 clean claims were routed to SIU.

Can it plug into Guidewire ClaimCenter or Duck Creek today?

Not in this demo. The Guidewire ClaimCenter and Duck Creek connectors, a mobile guided-capture SDK, a real C2PA verifier, and a real PRNU camera-fingerprint database are stubbed or deferred. The pixel-forensics signal is simulated and labeled as such on screen, a stand-in for a future learned generative-artifact model. What runs today is the real forensic logic: the SHA-256 chain, the EXIF parse, the perceptual-hash reuse search, the narrative reasoning, the policy gate, and the ledger, all on synthetic claims and a synthetic historical index.

Are those benchmark numbers real-world accuracy?

No, and we are careful to say so. The 35 of 35 coverage, 0 percent false-accusation, and 100 percent audit-integrity figures are on a fixed, labeled 120-claim synthetic benchmark whose fraud classes carry detectable signatures by construction, so the perfect routing on that set is a property of that constructed set, not an open-world guarantee. The number worth leading with is the coverage gap against a real incumbent approach: a single-signal baseline catches 0 of the 35 recycled-real and metadata-spoofed frauds, and the cross-signal firewall catches all 35. The durable claims are the 0 percent false accusation and the 100 percent audit integrity, both of which hold at any model quality.

Technical Research

The research behind this demo — the architecture, the verification design, and the enterprise blueprint.

The Forensic Imperative: Deterministic Computer Vision for Insurance Claims (interactive whitepaper)

Full solution

Explore the Insurance Claims AI & Deepfake Detection solution →

Authenticate the evidence before you assess the damage

A forensic gate for claim evidence, with an audit trail that holds up.

If your claims and SIU teams are weighing how to authenticate claim evidence without falsely accusing legitimate policyholders, and how to keep the automated decision defensible under the NAIC bulletins and the EU AI Act, we would genuinely like to hear how you are thinking about it. The problem is industry-wide and the answers will be too.

Evidence-integrity assessment

✓ Map where recycled and manipulated evidence enters your intake
✓ Define the routing thresholds for AUTO-PROCEED, SIU, and abstain
✓ Review spoliation and chain-of-custody exposure in litigation
✓ A reproducible policy gate your compliance counsel can sign off

Build with us

✓ A cross-signal forensic crew and deterministic policy gate
✓ A hash-chained evidence ledger with verify-chain tamper detection
✓ A court-ready evidence record with a NAIC and EU AI Act mapping
✓ Connectors and a learned artifact model on the roadmap, not faked

Connect via WhatsApp Email Our Team