MeshGuard field measurement programme: results.

How we measured.

The field measurement programme ran from October 2024 to April 2026 across 41 customer sites and an additional 3 internal validation sites. Customers opted in under a published research-use agreement; participation was anonymous in published results. Three measurement passes:

1. Slice pass. 41,184 meshes were sliced through the customer's normal slicer pipeline. For each, the detector ran on the post-slicer mesh and on the resulting G-code (when the slicer exposed reverse geometry). Detection threshold 0.93 (deployed default).
2. Print pass. A 6,020-part cohort was printed across all 41 sites. The cohort spans 11 material classes including PLA, PETG, ASA, ABS, PA12, PA11, glass-filled PA12, photopolymer resin (SLA), Ti-6Al-4V (DED), stainless 316L (DED), and Inconel 718 (DED).
3. End-of-life pass. 1,580 parts from the print cohort were returned to a central lab at end-of-life for resampling. Median time in service: 11 months. Maximum: 18 months. Surface scanning with a 12 µm-resolution structured-light system.

All three passes were instrumented with the same detector binary and the same customer key cohort. Detection scores were logged with the full input feature spectrum so failures could be replayed and analysed offline.

Slice pass results.

Of the 41,184 sliced meshes, 41,184 were detected positively. Zero failures.

This is the easy result to report and the one we expected. The feature spectrum the watermark sits in is engineered to survive slicer operations; slicers, by design, do not modify the topology features the watermark encodes. The only slicer-related risks we identified during design were aggressive mesh repair operations on broken input meshes — and the slicers we tested all opted out of aggressive repair on input meshes that were already well-formed.

Per-slicer break-down (n = 41,184, no failures):

Print pass results.

Of the 6,020 printed parts, 5,989 were detected positively at the 0.93 threshold. Thirty-one failures, distributed as follows:

The metal-DED material classes drive the bulk of the failures, and they are concentrated in the parts that received the most aggressive surface finishing. This is a documented limitation of MeshGuard (see the "limits" section on module-meshguard) — heavy machining removes the surface features the watermark sits in. Customers manufacturing metal parts with heavy post-process should rely on TwinCert provenance, not MeshGuard alone.

End-of-life pass results.

Of the 1,580 parts returned at end of service life (median 11 months in service, maximum 18 months), 1,574 detected positively. Six failures.

The end-of-life pass is the hard test. A part that survives slicing and post-process can still fail if a year of handling, UV exposure, vibration, or chemical contact has degraded its surface enough to corrupt the feature spectrum.

EOL-005 is the only case where re-scanning with a different point-cloud processing pipeline recovered the watermark (post-hoc; the live detector did not recover). The other five are honest failures — the watermark did not survive that combination of environment and material.

What drives failures.

Regression analysis on the failure cohort (n = 37 across all passes) identifies three drivers, in order of impact:

1. Surface removal. Any process that removes the surface bead (machining, media-blast, heavy sanding) removes the feature spectrum the watermark sits in. This is structural and not improvable within the current algorithm.
2. Severe warping. Warping that exceeds approximately 0.3% of the part's bounding box at any local region corrupts the geodesic landmark spacing the algorithm uses. We are evaluating a warp-tolerant feature for the next algorithm revision.
3. Surface degradation from environment. UV, solvent exposure, repeated thermal cycling. Slow processes that accumulate over service life. The next algorithm revision targets improved tolerance to small-scale surface noise.

Of these, only the second and third are addressable with algorithm changes. The first is a known structural limit and is documented as such.

FPR validation.

The headline FPR claim is < 10^-9. Validating that claim requires a large negative cohort — meshes and parts that should not detect, and confirming that they do not.

The negative cohort: 8.4 M synthetic meshes (curvature-randomised), 240k real meshes from public CAD libraries with no embedded MeshGuard payload, and 1,820 physical parts from external manufacturers known to have no MeshGuard relationship. The detector ran against all of them under multiple customer keys.

Result: 4 false-positive detections across the cohort. All four were on synthetic meshes with adversarial curvature distributions; zero false positives on real CAD or real parts. The empirical FPR on real-world inputs is bounded above by the test cohort size — we did not observe any. The original cryptographic-style FPR claim (< 10^-9) holds within the limits of empirical validation.

What this measurement programme tells us.

• The headline survival numbers in the MeshGuard specification hold for the use cases we support. Slicing: 100%. FDM print + handling: 99.94%. Field service to 18 months: 99.62%.
• The structural limit (heavy machining removes the watermark) is real and documented. Customers in scope should know which material/process combinations they fall into.
• The deployed decision threshold (0.93) is justified by the empirical FPR data.
• The next algorithm revision will target warping tolerance and small-scale surface noise tolerance. We are not changing the deployed algorithm in 2026; this is research, not roadmap.
• We will run the next field measurement programme through 2027 to capture the longer-tail end-of-life behaviour past 18 months.