System and Method for Authenticating Pharmaceutical Products Using Smartphone-Based Near-Infrared Spectroscopy and Packaging Microtexture Analysis

Abstract

At least 1 in 10 medicines in low- and middle-income countries are substandard or falsified, and the people harmed most buy from market stalls and rural pharmacies where laboratory testing never reaches. A smartphone with a clip-on sensor authenticates a medicine at the point of sale by fusing three independent checks that a counterfeiter would have to defeat at once. This disclosure puts the check in their hands: scan the tablet, photograph the carton, scan the code, and get a verdict in under a minute, with no data connection and no name, prescription, or photograph of a person leaving the phone.

The three checks are a near-infrared spectrum of the tablet itself, taken through its transparent blister where possible; a microtexture fingerprint of the carton, from the paper fiber pattern and the print micro-variation; and a serialized 2D DataMatrix code checked against a registry service, with an offline signed revocation list so the check still works where there is no connection. Two distances and a code penalty are combined into one joint score with explicit verdict bands: No falsification detected, Likely authentic, Suspect, and Cannot verify. A Suspect result triggers an on-device report, sent only with the user's explicit tap, that feeds a falsification map for regulators, built from district-level reports delayed 24 to 72 hours. The system is built for the informal markets and rural pharmacies where falsified medicines do the most harm and where laboratory testing does not reach.

Field of the Invention

This invention relates to pharmaceutical authentication: verifying that a medicine contains the stated active ingredient at the stated strength and that its packaging is the manufacturer's own. It uses a smartphone, a pocket near-infrared spectrometer, and a camera-based packaging fingerprint, for patients, pharmacists, and drug regulators in settings without laboratory access.

Background

The World Health Organization estimates that at least 1 in 10 medicines in low- and middle-income countries are substandard or falsified, and that countries spend an estimated $30.5 billion per year on such products. The human cost is deaths: a 2017 WHO study, based on 100 literature reviews covering 48,218 medicine samples in 88 countries, with mortality models from the University of Edinburgh and the London School of Hygiene and Tropical Medicine, estimates child pneumonia deaths from substandard or falsified antibiotics at 72,000 to 169,000 per year, and poor-quality antimalarials at 116,000 additional malaria deaths per year in sub-Saharan Africa, with a range of 64,000 to 158,000. Antibiotics and antimalarials account for more than a third of the products reported as fake or substandard to WHO's Global Surveillance and Monitoring System.

Existing defenses each leave a gap that a counterfeiter can walk through:

• Serialization: The U.S. Drug Supply Chain Security Act (DSCSA) and the EU Falsified Medicines Directive require a unique serialized product identifier on each saleable unit of a prescription medicine, encoded in a 2D DataMatrix code. Serialization verifies the code, not the contents. A counterfeiter who copies a genuine code onto a fake carton passes a code check, and a code copied onto a thousand cartons is only caught if someone notices the same serial number appearing in a thousand places. Neither regime operates a central registry: under DSCSA, suspect-product verification runs through the Verification Router Service, and under the EU directive it runs through national medicines verification systems connected to the EU hub. The registry in this disclosure is the invention's own service, not a feature of those regimes.
• Laboratory spectroscopy: Benchtop near-infrared and Raman instruments, such as the Thermo Fisher TruScan, identify active ingredients in the field and are used by regulators and some manufacturers. Portable Raman spectrometers cost $17,000 to $50,000, against $250 for the SCiO, they need a trained operator, and they do not reach the market stall or the rural pharmacy where a patient buys a single blister strip.
• Consumer handheld NIR: Wilson et al. (2017) showed that a $250 handheld NIR device, the Consumer Physics SCiO research model, detected falsified artemisinin-based combination therapies in every case where the reference library held both genuine and falsified samples of the same stated brand, across a 934-sample field library (677 from Bioko Island, 257 from Kintampo, Ghana). The device was a single-signal tool: it checked the tablet and nothing else, it needed a cloud database of reference spectra, and it could not detect components present below about 1 percent concentration, a limit of that device as reported in the trade press. Spectral Engines sells a pocket MEMS-based NIR scanner for pharmaceutical authentication on the same single-signal principle.
• Paper analytical devices: The University of Notre Dame Paper Analytical Device project and similar chemistry cards detect specific active ingredients by color change. They are destructive, they test one drug at a time, and they consume a test card per check.
• Paper fingerprinting: The fiber structure of paper is already an established authentication signal, and this disclosure does not claim it. Cowburn and Buchanan showed in Nature in 2005 that laser speckle from a paper surface yields a fingerprint unique enough to identify individual sheets, plastic cards, and cardboard packaging. Clarkson et al. (2009) did the same with a commodity flatbed scanner, and Sharma et al. (2011) built PaperSpeckle, a sub-$100 USB microscope attached to a phone that fingerprinted 1,500 papers. What none of those systems did is apply the fingerprint to a medicine carton at the point of sale, enroll it per batch and per unit alongside a tablet spectrum, and fuse it with a serialized code check into one verdict a patient can act on.
• Smartphone AI verification: Cypheme and similar vendors offer smartphone-based AI authentication for pharmaceutical supply chains, with FMD and DSCSA compliance. Those tools are supply-chain facing: their published materials describe packaging-imagery and code verification for distributors and manufacturers, not spectroscopy of the tablet or fiber fingerprinting of the carton, and they depend on cloud connectivity. The tool disclosed here is patient facing, measures the medicine as well as the box, and works offline.
• Visual inspection: Pharmacists are trained to spot fake packaging by fonts, colors, and holograms. Good counterfeits now reproduce all three. What a printer cannot reproduce is the microscopic fiber structure of the manufacturer's own carton stock, which is why the fiber check in this disclosure is a per-unit fingerprint, not a visual comparison.

No consumer tool known to the inventors checks the medicine and the packaging together, works without a data connection, and returns a verdict a patient can act on before swallowing the pill. Single-signal tools fail in one direction: a spectrometer alone passes a genuine tablet in a fake carton and a fake tablet in a genuine carton; a code check alone passes any carton with a copied code; a packaging check alone passes a refilled genuine carton. The novelty claimed here is the fusion of all three signals into one joint score, with an offline-first design and a "cannot verify" verdict that refuses to bless a product the reference library does not cover.

Detailed Description

1. System Architecture and Embodiments

Three embodiments cover the range from a patient buying one strip to a regulator sweeping a market. In the preferred embodiment, the user clips a pocket NIR module (roughly 80 by 80 by 28 mm, USB or Bluetooth, comparable in size to the Spectral Engines NIRONE) to a smartphone, opens the app, and scans the medicine in three steps that take under a minute: spectrum, carton photograph, code scan. In a second embodiment, the NIR sensor is built into the phone itself, as the Changhong H2 did with a SCiO sensor, so no clip-on module is needed. In a third embodiment, a pharmacist kiosk version uses the same three checks with a fixed mount and a larger reference library, and aggregates results across the pharmacy's stock to flag a suspect batch before it is dispensed. The kiosk embodiment is also the access route for patients who cannot afford or obtain a module: the check happens at the pharmacy counter, not on the patient's own phone. At a kiosk, the patient's consent governs the scan and any report, and the pharmacist may not report a result about a patient's medicine without that consent.

All scoring runs on the device. The reference library for the products a user is likely to encounter is downloaded when connectivity is available and stored locally; only the verdict and, with consent, a report containing no name, prescription, or photograph leave the phone. No photograph of a person is taken, no patient name or prescription is recorded, and no audio is captured.

2. Through-Blister Near-Infrared Acquisition

The NIR module illuminates the tablet and records diffuse reflectance across a design target band of 740 to 1700 nm. Existing pocket devices cover parts of that band rather than all of it: the SCiO research model covers 740 to 1060 nm, and NIRONE models cover roughly 1550 to 1950 nm. The module in this disclosure is specified to span the target band, and where a module covers only part of it, the reference library is restricted to the covered range and the app says so. The scan is taken through the transparent front face of the blister, regardless of the foil backing behind the tablet, since the foil sits behind the tablet on the sensor's path and does not block it. Where the blister is opaque, metallized, or heavily printed on the front face, the user removes one tablet and scans it on a dark reference card supplied with the module. Three repeat scans are taken and averaged, which suppresses placement variation.

Each raw spectrum is preprocessed before comparison: standard normal variate (SNV) normalization to remove scatter and baseline drift, a Savitzky-Golay first derivative to sharpen overlapping absorption features, and truncation to the wavelength range where the reference library has coverage. The processed spectrum is compared against the reference spectrum for the stated product and batch using cosine distance and a soft independent modeling of class analogy (SIMCA) residual, two measures that agree when the tablet is genuine and disagree in informative ways when it is not. The two measures are combined into a single spectral distance d_s on a 0 to 1 scale by taking the larger of the cosine distance and the SIMCA residual divided by 3 standard deviations of the reference population, capped at 1. Cosine distance here ranges 0 to 1, since the preprocessed spectra are non-negative. Illustrative thresholds, provisional until measured: a cosine distance below 0.1 is low and above 0.3 is high, and a residual beyond 3 standard deviations of the reference population is high. A low cosine distance with a high SIMCA residual indicates a tablet with the right main ingredient but the wrong excipients, the signature of a competent counterfeit; a high cosine distance indicates the wrong ingredient entirely, the signature of a crude fake, often chalk, starch, or a substituted drug. Where the cosine distance is below a first threshold and the SIMCA residual exceeds a second threshold, the processor reports a wrong-excipient condition, which is the operative step behind the interpretation.

Reference spectra are enrolled per product and per batch, because legitimate batch-to-batch variation in excipients and coating is real and a single global reference would flag genuine batches. Enrollment uses spectra measured from manufacturer-retained samples or from verified pharmacy stock, and each reference entry carries the product name, strength, batch number, expiry date, and the number of spectra behind it. The library is versioned, and a reference entry built from fewer than 10 spectra is flagged as thin and given a wider acceptance band. The number 10 is an arbitrary enrollment floor for testing, not a measured minimum, and a thin reference can never return the top verdict.

3. Packaging Microtexture Fingerprint

The phone camera photographs two regions of the carton at macro distance with the phone flash on, guided by an on-screen frame. The first region is a patch of unprinted board, about 10 by 10 mm, beside the batch number, from which the paper fiber pattern is extracted. The second region is the printed batch number and logo area, from which print micro-variation is extracted: the dot gain, edge raggedness, and ink spread of the print. The photograph is taken at a fixed distance, and the app rejects photographs that are blurred, overexposed, or taken at the wrong distance, rather than scoring them.

The fiber pattern and the print variation are different kinds of evidence, and the disclosure keeps them separate. The fiber pattern is a per-unit physically unclonable function: every carton is unique, and the fiber fingerprint of one carton says nothing about the next carton from the same batch. That is the finding of Cowburn and Buchanan (2005), Clarkson et al. (2009), and Sharma et al. (2011), and this disclosure applies their result rather than claiming it. Per-unit enrollment happens at the manufacturer's packaging line, where an inline camera photographs each carton as it is packed and stores the fingerprint keyed to that carton's serial number. Without per-unit enrollment, the fiber check is unavailable, and the system must say so. Per-carton enrollment costs one inline photograph and one 256-byte descriptor per carton, which is small beside the cost of printing the carton itself, but it requires the manufacturer to run the camera and store the fingerprints, which is a real operational cost. The print micro-variation is a batch-level statistical fingerprint: the distribution of dot gain and ink spread across the printed batch numbers of one production run. It is enrolled from samples of the batch, with the same 10-carton arbitrary floor as the spectral library, and it is the weaker leg, because a counterfeiter with the same press could approximate the statistics. It therefore carries a wider acceptance band, illustratively 1.5 times the per-unit band, and it can never by itself return the top verdict.

The two features are hashed into a compact descriptor, on the order of 256 bytes, that can be stored in the reference library beside the spectral reference for the same batch. The texture distance d_t on a 0 to 1 scale is defined as follows: where both a per-unit fiber reference and a batch print reference exist, d_t is 0.6 times the fiber distance plus 0.4 times the print distance; where only the batch print reference exists, d_t is the print distance alone, with the widened acceptance band. These weights are provisional, like the joint score weights in section 5.

A carton that matches the genuine texture but fails the spectrum is a refilled carton. A carton that fails texture but passes the spectrum holds a genuine tablet moved into a fake carton, a common pattern when counterfeiters buy genuine blister strips and repackage them. Either failure alone is enough to move the verdict to Suspect; both must pass for the top verdict.

4. Serialized Code Verification and Reuse Detection

The 2D DataMatrix code is decoded from the carton photograph or from a dedicated scan, yielding the product code (GTIN), serial number, batch, and expiry date, in the GS1 format used under DSCSA and the EU Falsified Medicines Directive. The app checks the code against three sources in order. First, a locally cached signed revocation list from the manufacturer or national regulator, updated whenever the phone has connectivity, which covers recalled batches and serial numbers reported stolen. Second, a local allowlist of batch numbers for the stated product, which catches codes whose batch number was never issued for that product. Third, when connectivity is available, a live query to the invention's registry service, which returns the serial number status and the number of times that serial number has been verified before. Where the DSCSA Verification Router Service or a national medicines verification system is reachable, the registry service queries it as the source of truth; the registry service itself is the invention's own layer, not a DSCSA or FMD feature.

Reuse detection is the code check's main contribution. A serial number verified from two locations far apart, or verified an implausible number of times, is evidence of code copying even when the code itself is genuine. Illustrative thresholds, provisional until measured: the same serial number verified in two cities more than 500 km apart within 24 hours, or more than 5 verifications of one serial number in total. A single verification of a code that has never been seen before is weak evidence either way: the code check can condemn a product, through revocation or implausible reuse, but it cannot by itself clear one. Parallel legitimate verification is a known false-positive source, a distributor and a pharmacy scanning the same unit, so the registry service whitelists the legitimate scan chain for a serial number and does not count those verifications as reuse.

Every verification records time and approximate location only with the user's consent, and consent is per report, not blanket. The data controller is the operator of the app, which must publish a contact point and a deletion route for reporters and must operate under the data-protection law of the country where the report is made; retention is capped at 2 years, and location is stored at district level, never as a street address or GPS point. A location-tagged report can still identify a seller in a village with one stall, which is why reporting is never automatic and why section 6 puts the reporting decision in the user's hands.

5. Joint Scoring and Verdict Bands

Each check returns a distance on a 0 to 1 scale, where 0 is a perfect match to the reference. The three inputs are spectral distance d_s, texture distance d_t, and a code penalty c: 0 for a clean code, 0.5 for a code that cannot be checked, and 1 for a revoked code or implausible reuse. A code that cannot be checked is one with no registry entry, no connectivity, and no cached revocation data. The joint score is:

S = 0.45 × d_s + 0.35 × d_t + 0.20 × c

The spectrum carries the most weight because it is the only check that measures what the patient will swallow. The code carries the least because a code is only ink.

Verdict bands are set on the joint score S, with the lower bound inclusive. S below 0.15 reads as No falsification detected, with the words "not a guarantee" shown beside the verdict, the enrollment count behind the reference, and a plain-language confidence note. S from 0.15 up to but not including 0.35 reads as Likely authentic. A Likely authentic verdict carries guidance: proceed if the weak check is the code check, for example an unchecked code with no connectivity, but re-scan or consult a pharmacist if the weak check is the spectrum, since the spectrum is the check that measures the medicine. S at or above 0.35 reads as Suspect: do not take this medicine, and report it. Where withholding a life-saving medicine may itself kill and no alternative source exists, seek a clinician or pharmacist urgently the same day, retain the sample, and treat the verdict as one input, not a medical order. Separately, if any single check fails outright, a revoked code, a spectral distance above 0.8, or a texture distance above 0.8, the verdict is Suspect regardless of the joint score, because a strong failure in one channel should not be averaged away by passes in the others. If the reference library holds no entry for the stated product and batch, the verdict is Cannot verify, with a plain explanation that the tool has no reference to compare against, and the user is directed to a pharmacist or the regulator's hotline rather than given a false pass. A thin reference, fewer than 10 spectra or cartons, caps the verdict at Likely authentic and can never return the top verdict.

The worked examples below use the equation above. A near-perfect spectrum and texture with an unchecked code gives S = 0.45 × 0.05 + 0.35 × 0.10 + 0.20 × 0.5 = 0.16, which reads as Likely authentic rather than the top verdict, because the code check can condemn a product but cannot by itself clear one. S is rounded to two decimals in the table below.

Case	d_s	d_t	c	S	Verdict
Genuine tablet, full check	0.05	0.10	0	0.06	No falsification detected
Genuine tablet, offline, code unchecked	0.05	0.10	0.5	0.16	Likely authentic
Competent counterfeit, right active ingredient, wrong excipients	0.70	0.15	0	0.37	Suspect
Revoked code, genuine-looking tablet	0.05	0.10	1	0.26, veto applies	Suspect

The failure modes also form a two-by-two table, which is the quickest way to read them:

	Texture passes	Texture fails
Spectrum passes	Consistent with a genuine product	Genuine tablet moved into a fake carton
Spectrum fails	Refilled genuine carton	Likely falsified on both counts

Thresholds are provisional until tested against genuine and falsified samples. The weights (0.45 spectrum, 0.35 texture, 0.20 code) and the band edges (0.15, 0.35) and the veto values (0.8) are engineering estimates, stated so they can be tested, not measured results, and the Limitations section says what has not been measured.

Showing the user the contributing distances creates an adversarial-oracle risk: a counterfeiter who can see the score can adjust a formulation or a carton and rescan until it passes. The mitigation is to show detailed per-check distances only as bands, and only on the first scan of a batch in a day; repeat scans of the same batch return the verdict without the detailed breakdown, and the acceptance bands in a deployed implementation may be jittered within a stated range, illustratively plus or minus 0.05, so that a score just below the threshold on one scan is not a guarantee of a pass on the next. The registry service also throttles repeat scans of the same batch from one device. The binary verdict itself remains an oracle, so the mitigation limits the information a counterfeiter can extract, not access to the check.

6. Offline-First Design and Field Reporting

The system is built for the places where falsified medicines do the most harm, which is also where connectivity is worst. The reference library, the revocation list, and the scoring model all live on the phone. A verification with no connection returns a full verdict from local data; the only check that degrades offline is the live registry query, and the code penalty of 0.5 in section 5 accounts for that honestly instead of pretending the check happened.

When a verdict is Suspect, the app offers a one-tap report, and the tap is the user's decision, never the app's. The report contains the product name, batch, serial number, the three measured values, time, and district-level location, and nothing else: no name, no phone number, no photograph of the user. Before the tap, a warning screen states plainly that a report can identify the seller by location and time, and that sellers in informal markets may retaliate, and that the user should not confront the seller, should leave the stall before reporting, and should report later and off-site. A report is never sent automatically. Reports are queued on the device and uploaded when connectivity returns.

Aggregated reports feed a public falsification map showing where suspect batches cluster, which gives regulators a heat map of the problem and gives buyers a warning before they reach the counter. The map is a signal for investigation, not a verdict on a batch. A batch is publicly flagged only after human review, and only when it meets a confirmation threshold, illustratively 3 independent reports from different devices at distinct locations, or 1 report plus laboratory confirmation. Reports are published at district level, where a district is an administrative area of at least about 100,000 people, and reports from smaller areas are aggregated to the next larger area. Publication is delayed 24 to 72 hours, and districts with fewer than 3 reports are not shown. Duplicate reports from the same device do not count as independent confirmation, and repeat reports are rate-limited with device attestation where the phone supports it. A genuine batch wrongly flagged has a correction and delisting process: the manufacturer, the regulator, or the flagged seller or pharmacist can submit laboratory evidence, the flag is reviewed within 7 days of the submission, and it is removed with the correction shown if the evidence confirms the batch, so the map carries its own error record.

7. Figures Description

• Figure 1: System block diagram, in three columns: on the left, the phone, the clip-on NIR module, and the medicine carton; in the middle, the spectrum acquisition, texture extraction, and code verification modules; on the right, the joint scorer, the verdict display, and the reporting queue.
• Figure 2: NIR spectra for one genuine antimalarial tablet and two falsified samples, plotted as absorbance against wavelength from 740 to 1700 nm, with the genuine spectrum's characteristic peaks marked near the active-ingredient bands around 1200 nm and 1450 nm, and the fakes diverging at those bands.
• Figure 3: Packaging microtexture, in two panels: on the left, a macro photograph at 10x magnification of genuine carton board showing the random fiber pattern, with a 1 mm scale bar; on the right, the same area on a counterfeit carton, where the fiber pattern is a printed reproduction and the print edges are smoother.
• Figure 4: Verdict flow diagram: the three checks feed the joint scorer, the scorer applies the per-check veto rules, and the output is one of four verdict bands, with Suspect routing to the report queue.
• Figure 5: Falsification map mockup, showing a region with clustered suspect reports for one batch, a time slider, and the legend: a cluster is 3 or more reports in one district within 30 days, filled markers are confirmed reports, open markers are unconfirmed, and districts below the minimum report count are not shown.

Claims

1. A system for authenticating a pharmaceutical product, comprising: a smartphone; a near-infrared spectrometer module coupled to the smartphone and configured to record a diffuse reflectance spectrum of a tablet of the product; a camera of the smartphone configured to photograph a defined patch of the product carton; and a processor configured to compute a spectral distance between the measured spectrum and a reference spectrum for the stated product and batch, compute a texture distance between the photographed carton patch and a reference microtexture for the same batch, verify a serialized code of the product against a registry service or a locally cached signed revocation list, combine the spectral distance, the texture distance, and a code penalty into a joint authenticity score, and return one of four explicit verdict bands: No falsification detected, Likely authentic, Suspect, and Cannot verify.
2. The system of claim 1, wherein the near-infrared spectrometer records the spectrum through the transparent front face of a blister, regardless of foil backing behind the tablet, or from a single tablet removed from an opaque, metallized, or heavily printed blister and placed on a dark reference card, and wherein three repeat scans are averaged before comparison.
3. The system of claim 1, wherein the processor preprocesses the spectrum with standard normal variate normalization and a Savitzky-Golay first derivative, and compares it using cosine distance and a soft independent modeling of class analogy residual, wherein the processor reports a wrong-excipient condition when the cosine distance is below a first threshold and the SIMCA residual exceeds a second threshold.
4. The system of claim 1, wherein the texture distance is computed from two regions of the carton: a paper fiber pattern extracted from a patch of unprinted board, enrolled per carton at the manufacturer's packaging line and stored keyed to that carton's serial number, and print micro-variation comprising dot gain, edge raggedness, and ink spread, extracted from the printed batch number and logo area and enrolled as a batch-level statistical fingerprint; and wherein the texture distance is computed from the print micro-variation alone where no per-unit fiber reference exists; and wherein the application of the fiber pattern and the print variation to a medicine carton, fused with the spectral distance and the code penalty of claim 1, is the subject of this claim, the fiber fingerprint itself being prior art.
5. The system of claim 1, wherein the processor distinguishes a refilled genuine carton, which matches the genuine texture but fails the spectrum, from a genuine tablet in a fake carton, which passes the spectrum but fails the texture, and reports the distinction to the user.
6. The system of claim 1, wherein the serialized code is a 2D DataMatrix code decoded from the carton photograph, and wherein the processor checks the code against a locally cached signed revocation list, a local batch allowlist, and, when connectivity is available, a live query to the registry service returning the serial number status and the number of prior verifications, and wherein the registry service queries the DSCSA Verification Router Service or a national medicines verification system where reachable.
7. The system of claim 6, wherein the processor flags code reuse where the same serial number is verified in two cities more than 500 km apart within 24 hours, or more than 5 times in total, and reports the reuse as evidence of code copying, and wherein verifications forming the legitimate scan chain of that serial number are not counted as reuse.
8. The system of claim 1, wherein the joint score is a weighted sum of the spectral distance, the texture distance, and the code penalty, and wherein a verdict of Suspect is returned when the joint score is at or above 0.35, or when the spectral distance or the texture distance exceeds 0.8, or when the code is revoked.
9. The system of claim 1, wherein the processor returns a verdict of Cannot verify, with a referral to a pharmacist or regulator, where the reference library holds no entry for the stated product and batch, and wherein the processor does not return a No falsification detected verdict on the basis of the code check alone, and does not return the top verdict where the reference entry is thin.
10. The system of claim 1, wherein the reference library, the revocation list, and the scoring model reside on the smartphone, and wherein a verification performed without connectivity returns a verdict from local data, with the code penalty reflecting the unavailable live registry query.
11. The system of claim 1, further comprising a reporting module that, on a Suspect verdict and only after the user's explicit tap following a warning that a report can identify the seller by location and time and that sellers in informal markets may retaliate, queues a report comprising the product name, batch, serial number, the spectral distance, the texture distance, and the code penalty, time, and district-level location, uploads the report when connectivity returns, and aggregates reports into a public falsification map, wherein duplicate reports of the same serial number from different devices strengthen each other but do not by themselves meet the confirmation threshold without laboratory confirmation or verification from distinct locations and times, and wherein a batch is publicly flagged only after human review and a confirmation threshold.
12. The system of claim 1, implemented as a patient application with a clip-on spectrometer module, as a smartphone with a built-in near-infrared sensor, or as a pharmacist kiosk with a fixed mount, and wherein scoring runs on the device and no patient name, prescription, or photograph of a person leaves the device.
13. A method for authenticating a pharmaceutical product, comprising: recording, with a near-infrared spectrometer module coupled to a smartphone, a diffuse reflectance spectrum of a tablet of the product; photographing, with a camera of the smartphone, a defined patch of the product carton; computing a spectral distance between the measured spectrum and a reference spectrum for the stated product and batch; computing a texture distance between the photographed carton patch and a reference microtexture for the same batch; verifying a serialized code of the product against a registry service or a locally cached signed revocation list; combining the spectral distance, the texture distance, and a code penalty into a joint score; and returning one of four verdict bands: No falsification detected, Likely authentic, Suspect, and Cannot verify.
14. The method of claim 13, further comprising returning a verdict of Suspect when the joint score is at or above 0.35, or when the spectral distance or the texture distance exceeds 0.8, or when the code is revoked, and returning a verdict of Cannot verify where the reference library holds no entry for the stated product and batch.
15. The method of claim 13, further comprising, on a Suspect verdict and only after the user's explicit tap following a warning that a report can identify the seller by location and time and that sellers in informal markets may retaliate, queuing a report comprising the product name, batch, serial number, the spectral distance, the texture distance, and the code penalty, time, and district-level location, and uploading the report when connectivity returns.

Prior Art References

1. WHO, "Substandard and falsified medical products" (fact sheet, Dec 2024): At least 1 in 10 medicines in low- and middle-income countries are substandard or falsified; $30.5 billion per year
2. WHO, "1 in 10 medical products in developing countries is substandard or falsified" (Nov 2017): 10.5 percent failure rate across 48,218 samples in 88 countries; 72,000 to 169,000 child pneumonia deaths (University of Edinburgh model); 116,000 additional malaria deaths, range 64,000 to 158,000 (London School of Hygiene and Tropical Medicine model)
3. Wilson et al., "A New Handheld Device for the Detection of Falsified Medicines," Am. J. Trop. Med. Hyg. 96(5), 2017, pp. 1117-1123: $250 SCiO handheld NIR detected falsified artemisinin therapies in every case where the library held genuine and falsified samples of the same brand, across a 934-sample field library (677 from Bioko Island, 257 from Kintampo, Ghana)
4. Securing Industry, "Consumer spectrometer has anti-counterfeit applications": SCiO miniaturized NIR, unable to detect components below about 1 percent, needs a reference database
5. TechCrunch, "The SCiO Handheld Scanner Makes Sure You're Taking The Right (Prescription) Drugs" (2015): SCiO identifies a drug from a tablet by near-infrared spectroscopy and a cloud database
6. Spectral Engines, "Anti Counterfeiting with Mobile NIR Spectroscopy Solutions": Pocket MEMS-based NIR scanner with mobile app and cloud reference libraries for branded product verification
7. Spectral Engines, "Pharma Security with Mobile NIR Spectroscopy Solutions": Pocket NIR for pharmaceutical authentication at any point in the supply chain, scanning through transparent plastic
8. GS1 US, "Drug Supply Chain Security Act (DSCSA)": DSCSA requires interoperable electronic package-level tracing, unique serialized product identifiers in 2D DataMatrix codes
9. McKesson, "Drug Supply Chain Security Act FAQs": DSCSA signed 2013, serialization at the package level, electronic traceability phased in through 2023-2025
10. Securing Industry, "App developed to test legitimacy of euthanasia drugs": SCiO-based app testing drug purity, Changhong H2 smartphone with built-in SCiO sensor
11. Cowburn and Buchanan, "Forgery: 'Fingerprinting' documents and packaging," Nature 436, 475 (2005): Laser speckle from a paper surface yields a fingerprint identifying individual sheets, plastic cards, and cardboard packaging
12. Clarkson et al., "Fingerprinting Blank Paper Using Commodity Scanners," Proc. 30th IEEE Symposium on Security and Privacy, pp. 301-314 (2009): Paper texture fingerprinting with a commodity flatbed scanner, no modification to the document
13. Sharma et al., "PaperSpeckle: Microscopic Fingerprinting of Paper," Proc. 18th ACM Conference on Computer and Communications Security, pp. 99-110 (2011): Sub-$100 USB microscope on a phone fingerprinting 1,500 papers, aimed at rural regions
14. University of Notre Dame, Paper Analytical Device Project: WHO study: about 10.5 percent failure rate across 48,218 medicine samples in 88 countries; paper devices as a low-cost test
15. Cypheme, "Solving Healthcare's Anti-Counterfeiting Crisis": Smartphone verification, FMD and DSCSA compliance, AI authentication for pharma supply chains
16. RAPS, "WHO: 1 in 10 Medicines in Developing Countries is Substandard or Fake" (2017): WHO Global Surveillance and Monitoring System: 1,500 reports in four years, 42 percent from sub-Saharan Africa

Limitations

The method in this disclosure has not been validated against measurements from real medicines. The joint score weights (0.45 spectrum, 0.35 texture, 0.20 code) and the verdict thresholds (0.15, 0.35) and the veto values (0.8) are engineering estimates, stated so they can be tested, not measured results. Through-blister NIR has not been demonstrated here for any specific blister material or tablet coating, and opaque, metallized, or heavily printed blisters may block the measurement entirely. The microtexture fingerprint has not been tested against a competent counterfeiter with access to the same paper stock, and a counterfeiter who buys genuine cartons and refills them defeats the texture check by design, which is why the spectrum check carries the most weight. The code reuse test depends on voluntary reporting and on registries that many countries do not operate, and in a market with no registry and no connectivity, the code check contributes only the batch allowlist. For a SCiO-class device, NIR cannot detect a wrong ingredient present below about 1 percent, and it cannot detect a correct ingredient at the wrong dose with confidence unless the dose difference changes the spectrum beyond the batch variation, which for low-dose tablets it may not. Nothing here should be read as evidence that any particular medicine will be detected as falsified, or that any particular verdict is correct for any particular product, without validation against a library of genuine and falsified samples of that product.

A false verdict harms in both directions, and the draft's verdict names are chosen with that in mind. A false top verdict is the most dangerous failure: it reassures a patient into taking a falsified drug they might otherwise have distrusted, which is why the top verdict is named "No falsification detected" rather than "Authentic," why it carries the words "not a guarantee," and why a thin reference can never return it. A false Suspect is the other harm: it denies a needed antimalarial or antibiotic, delays treatment, pushes the patient to a worse source, or causes a genuine medicine to be discarded in a shortage. At a prevalence near 10 percent, even a good screen produces false Suspects, and the base rate means most Suspect verdicts in a low-prevalence setting will be wrong. A patient part-way through a course should seek a pharmacist or clinician before stopping, and where there is no alternative source, the verdict is one input to that conversation, not a medical order. A suspect sample should be retained for laboratory confirmation where possible.

Three objections bound what this tool can do, and the disclosure states them plainly. First, Cannot verify will be the default verdict where the tool is needed most. Enrollment is per product and per batch with a 10-sample floor, informal markets sell hundreds of batches with rapid turnover and no manufacturer cooperation, and the tool will therefore say "I do not know" precisely in the stalls the Abstract targets, until enrollment coverage grows. Patients who hear "I do not know" every time will learn to ignore the tool, which is a failure mode of its own. Second, field conditions defeat both optical legs at once: macro texture photography under market lighting, humidity, and scratched or faded cartons, and through-blister NIR through scuffed, printed, or tinted plastic, will inflate both distances together, which is the exact correlated failure the joint score assumes away by treating the channels as independent. Third, a competent counterfeiter reassembles genuine parts: genuine blister strips and genuine cartons are both sold as waste or diverted stock, so a refilled, resealed carton with a copied code passes the spectrum, passes the texture, and passes the code unless reuse is caught, and reuse is caught only if registries and reporting exist, which this disclosure concedes they often do not.

The strongest case against this approach is that it asks the patient to do the regulator's job, and that the patients most at risk, in informal markets with no connectivity, are the least likely to own a phone with a clip-on spectrometer and the least likely to trust an app over a pharmacist they know. That case is fair. It fails where the pharmacist is the one selling the fake, where the pharmacy is a market stall with no pharmacist at all, and where the regulator has no inspectors in the district. A second fair objection is that a public falsification map invites gaming: a counterfeiter could flood it with false reports against a competitor's genuine batch. The duplicate-report rule and the requirement that a report carry the three measured values are partial answers, not complete ones, and the map must be treated as a signal for investigation, not as a verdict on a batch. The fusion of spectrum, texture, and code exists to give a buyer one number with a stated confidence before the pill is swallowed, not to replace laboratory testing, and where the confidence is low the system must say Cannot verify instead of guessing.

Implementation Notes

Ship the reference library before the verdict. A spectral distance without a batch-matched reference is a number without a meaning, and the first user who gets a Suspect verdict on a genuine medicine because the library held a different batch is unlikely to trust the second one. Enroll at least 10 genuine spectra and 10 genuine cartons per batch before that batch can return the top verdict, and show the enrollment count beside every verdict.

Do not ship a code-only version. A code check alone is a serialization reader, and the world already has those; the three-signal fusion is the product. Calibrate the NIR module against a white reference tile at the start of every session, because a drifting light source shifts every spectrum the same way and looks like a product-wide quality problem.

A tool that says "I do not know" when it does not know is the kind of tool worth trusting with this question.

Present the Cannot verify verdict as a first-class result, not as an error screen. Keep the on-device processing rule in every embodiment, because a medicine check that uploads a photograph of a patient's prescription will not be adopted where it is needed most, and it should not be. Never let a Suspect verdict trigger an automatic report without the user's explicit tap: a report names a seller, and naming a seller in a market where the seller may be armed is a decision for the person standing in that market, not for the app. Cost and access are part of the build, not an afterthought: the SCiO precedent cost $250, this module's cost is unestimated, and the pharmacist kiosk embodiment exists so that a patient who cannot afford a module still gets the check at the counter.

Finally, validate on real medicines before claiming any threshold in this document: build a library of genuine and falsified samples of one high-volume antimalarial and one high-volume antibiotic, publish the confusion matrix at each threshold, and let the thresholds move where the data says they should. Never add a motor that turns the problem into something else: this disclosure authenticates a medicine, it does not dispense one, and a tool that tells a patient what to take is a different product with different risks.