EXHIBIT 09

IMPLEMENTATION TRACES

Standards leave room for different legal choices.

Generate one payload with two independent browser encoders. Compare their version, error correction, mask, segments, padding, codewords, and modules without assuming either output is suspicious.

TWO LIVE ENCODERS / FIVE STORED CONTROLLED PROFILES

LIVE COMPARISON

Same payload, different defaults

HideAndSeen currently encodes one byte segment by default. node-qrcode optimizes segmentation and uses its own mask scoring.

Predict first

Two independent, standards-compliant encoders are about to encode the same payload. Will they produce the same symbol?

HIDEANDSEEN
NODE-QRCODE
MODULE DIFFERENCE

CONTROLLED SAMPLE

Five observed profiles

Ranges below summarize five held-out payloads per encoder from the corrected experiment. They are not universal signatures.

EncoderVersionECCMaskSegmentsLeading 00

THE FOUR QUESTIONS

Ask four questions of an innocent symbol.

WHAT THE SCANNER SEES

The same payload from both encoders. An ordinary reader cannot tell them apart.

WHAT CHANGED UNDERNEATH

Nothing was hidden. The two symbols differ because the standard permits different legal choices of version, ECC level, mask and segmentation.

WHAT A SECOND READER CAN RECOVER

No hidden message, because there is none. What is recoverable is a weak hypothesis about which implementation produced the symbol.

HOW AN ANALYST CAN NOTICE

Compare the feature vector against known encoder profiles. The profiles overlap and the payload itself shifts the features, so a match supports an investigative hypothesis rather than an identification.

FINDING

Implementations can leave behavioral traces. Traces are not necessarily identities.

Version, ECC boosting, mask selection, segmentation, and padding behavior can differ among valid implementations. Those features may support a hypothesis about provenance, but overlap, configuration, and payload effects prevent strong identification.

Read the methods and limitations