Abstract
Item-level authentication requires a physical identifier that remains distinguishable under legitimate changes in acquisition. We evaluate ethanol-treated, methylene blue-stained, and polydimethylsiloxane-encapsulated Escherichia coli colony patterns as weak physically unclonable function (PUF) tokens. Each query is verified against the reference enrolled under its claimed identifier. Thirty tokens were evaluated by panoramic and localized imaging at enrollment, 1 h, 3 months, and 3 months with an iPhone. Panoramic inter-token normalized Hamming distance was 0.4966 ± 0.0105, and genuine distance rose from 0.0086 ± 0.0019 to 0.0147 ± 0.0036 across devices. Registration rejected 5167 of 5220 directed impostor claims across both modalities and all conditions. Genuine and gate-passing impostor scores separated within each condition, but no single deployment threshold gives zero observed error. At the retrospectively selected panoramic threshold 0.03, all five scanned printouts were rejected. Four of five localized printouts were accepted at T = 0.23, which also rejects the largest observed genuine score of 0.2306. The static response does not prevent digital replay, and entropy-budget calculations do not establish a cryptographically secure key source. These results support further evaluation of panoramic tokens for manufacturers, supply-chain inspectors and provenance services requiring physical-item verification with controlled image acquisition.