Signature Filtering: Methods & Applications

Updated 5 July 2026

Signature filtering is a process that selects, suppresses, normalizes, or transforms raw signature-bearing data to enhance downstream matching and detection.
It employs diverse methods—from OCR and CNN-based cleaning in document forensics to wavelet transforms and learned pre-signature filtering in biometrics.
Applications span document verification, biometric authentication, network intrusion detection, and watermark integrity, yielding significant performance and efficiency gains.

Searching arXiv for the cited papers and closely related uses of “signature filtering” to ground the article. First, I’ll look up the core document-signature analysis paper and then broader “signature filtering” usages across adjacent areas. Signature filtering denotes a family of intermediate operations that select, suppress, normalize, or structurally transform signature-bearing information before downstream inference. In the literature, the term is used in several distinct settings: offline document forensics, online biometric verification, rough-path and signature-transform learning, packet and content screening, and watermark or authentication pipelines. This suggests that the unifying concept is architectural rather than modality-specific: signature filtering is the stage that makes raw inputs usable for matching, verification, clustering, or detection by reducing nuisance structure while preserving the evidence carried by the relevant “signature” object (Woodruff et al., 2021, Teymourzadeh et al., 2018, Bonnier et al., 2019, Hong et al., 16 Jun 2026).

1. Conceptual range of the term

The literature uses “signature filtering” for at least four recurrent roles.

Domain	What is filtered	Immediate objective
Document forensics	pages, candidate crops, obstructed signature regions	reject non-signatures and clean retained signatures
Biometric verification	trajectory streams, transform coefficients, structural summaries	suppress nuisance variation and improve separability
Path-signature methods	stream representations before truncation	move informative structure into low-order signature terms
Security and detection	packets, content fingerprints, disruptive watermark tokens	prefilter workload or recover weak signature evidence

A recurring misconception is to treat filtering as synonymous with hard rejection. Several of the cited systems use filtering in a broader sense. In corporate-document analysis, OCR-based page rejection, CNN-based crop rejection, and CycleGAN-based content cleaning are all parts of the curation logic (Woodruff et al., 2021). In path-signature learning, the learned map $\Phi^\theta$ is a data-dependent pre-signature filter rather than a reject/keep gate (Bonnier et al., 2019). In LLM watermark detection, filtering removes learned disruptive tokens and then reruns the original detector without modifying watermark embedding or generation (Hong et al., 16 Jun 2026).

2. Document-signature filtering in real-world paperwork

In the document-analysis setting, signature filtering is the curation stage between crude extraction and downstream verification or clustering. The target data are not clean benchmark signatures: Companies House filings contain signatures embedded in dense paperwork, partially covered by stamps, mixed with other handwriting, and scanned at variable quality. The pipeline therefore begins with document acquisition, applies OCR as a page-level prefilter using phrases such as “electronically filed,” binarizes pages, extracts connected components, merges nearby regions, applies heuristic filters based on density, aspect ratio, and edge removal, and then uses a CNN to classify each crop as signature or non-signature. Retained crops are cleaned by a CycleGAN that removes stamps, text, and form elements, then embedded by a Siamese network and grouped by hierarchical clustering with cosine similarity and threshold $t$ . The CNN takes a binarized $256 \times 256$ crop in $[0,1]$ , outputs a sigmoid in $[0,1]$ , and retains crops above an unspecified threshold; after 3000 epochs it reached 93.5% validation accuracy. OCR prefiltering improved extraction precision from 0.935 to 0.947 on a manual evaluation of 266 extracted signatures. The fully automated clustering stage achieved 78.19% accuracy, compared with 76.38% for the Engin et al. baseline, while automated clustering took about 0.1 seconds per signature and reduced storage from 26.8 KB per signature image to 3.0 KB per embedding on average, an 89% reduction (Woodruff et al., 2021).

The same document-centric interpretation appears in bank-document verification, where signatures overlap with rubber stamps, company seals, ruling lines, signature boxes, and other artifacts. There the filtering problem is framed primarily as cleaning rather than candidate rejection. A CycleGAN maps stamped signatures to clean ones, after which writer-independent CNN features from VGG-16 or ResNet-50 are compared by cosine similarity under a global threshold. On the custom dataset, VGG-16 gave $\text{EER}_{global}=0.33$ for Reference vs Stamped Target and 0.23 for Reference vs Cleaned Stamped Target; on Tobacco-800, VGG-16 improved from 0.24 to 0.17 after cleaning. A human study reported 91.66% majority-voting accuracy and 89.25% individual accuracy on a difficult subset, whereas VGG-16 $_{cleaned}$ reached 76.38% and ResNet-50 $_{cleaned}$ 75.00%, underscoring the difficulty of the setting (Engin et al., 2020).

A central point in this literature is that cleaning is not optional in adversarial paperwork. One study reports that in Companies House data less than 1% of signatures are clean to begin with, compared with 26.3% in prior work, and emphasizes that obscured same-author signatures are “virtually impossible” to identify without cleaning (Woodruff et al., 2021). Another shows that cleaning materially recovers performance lost to stamps while image inversion has little effect overall (Engin et al., 2020).

3. Signal-level filtering in biometric signature verification

In online signature verification, filtering is often literal signal processing. One DSP-oriented formulation treats a signature sample as a multichannel 1-D time series

$S(n)=\left[x(n)\; y(n)\; t(n)\; p(n)\right]^T,$

then applies a single-level discrete 1-D wavelet transform with Daubechies order 4, using $Lo_D$ and $t$ 0 to separate approximation and detail coefficients. DWT and DCT are used collectively to create a feature dataset in $t$ 1-dimensional space, PCA reduces the 477 DWT feature points in the MCYT-100 experiment to the top 8 feature components and the statistical features to the top 2 features, and an SVM performs genuine/forgery classification. Reported results include EER $t$ 2 for Signer A and $t$ 3 for Signer B on MCYT-100, EER $t$ 4 for both signers on SVC2004, and an average correct verification rate of 91.3% (Teymourzadeh et al., 2018).

A more discriminative formulation uses a handcrafted filtering stage followed by learned metric filtering. The length-normalized path signature (LNPS) converts local windows of an online trajectory into scale-invariant iterated-integral descriptors, and a GRU-based network with architecture Input $t$ 5 128 GRU $t$ 6 128 GRU $t$ 7 64 FC learns a 64-dimensional embedding under triplet loss plus center loss. On SVC-2004, LNPS with DTW reached 4.98% EER at $t$ 8, while the RNN + LNPS system reached 2.37% EER at $t$ 9; joint training with increasing fractions of MCYT-100 lowered EER from 3.58% to 2.37% (Lai et al., 2017).

Offline signature forgery detection provides a more ambivalent case. A shell preprocessing pipeline applies OTSU binarization, bounding-box cropping, resizing to $256 \times 256$ 0, morphological pruning, and extraction of superior, inferior, and residual shells, yielding six 1-D shell vectors of length 512. This shell representation acts as a structural filter that reduces dataset-specific variability, but it discards discriminative detail. On a CEDAR-trained contrastive setting, the raw-image model obtained AUC 0.89 on CEDAR, 0.91 on ICDAR, and 0.59 on GPDS, whereas the shell model obtained 0.74, 0.72, and 0.64, respectively. The authors therefore do not claim definitive superiority: raw images achieve higher peak performance, while shells narrow the performance spread across datasets (Parracho, 20 Oct 2025).

This supports a broader distinction. Some filters are designed for denoising and normalization, as in db4 wavelet smoothing or LNPS scale normalization; others are designed for robustness to domain shift, as in shell preprocessing. The latter may improve balance across datasets while lowering absolute accuracy (Teymourzadeh et al., 2018, Parracho, 20 Oct 2025).

4. Learned signature filtering in path-signature and rough-path methods

In signature-transform learning, “signature” no longer means a handwritten mark; it means the sequence of iterated integrals of a path. Here filtering refers to a learned transformation $256 \times 256$ 1 applied before the truncated signature $256 \times 256$ 2. The purpose is to make low-order signature terms carry task-relevant information that would otherwise only appear in higher-order coordinates. The learned map may be pointwise, convolutional, or recurrent, and the signature layer is interpreted as a pooling operation that summarizes an ordered stream into a fixed-dimensional representation. Empirically, learning the pre-signature filter is decisive: on Hurst-parameter regression for fractional Brownian motion, Neural-Sig achieved test MSE $256 \times 256$ 3, DeepSigNet $256 \times 256$ 4, and DeeperSigNet $256 \times 256$ 5; in non-Markovian Mountain Car, the deep signature agent succeeded after about 1500 episodes whereas a comparable RNN failed to solve the task within 2000 episodes (Bonnier et al., 2019).

A related but distinct use appears in nowcasting. Regression on signatures embeds irregularly sampled or mixed-frequency data into continuous time, computes truncated path signatures, and performs regularized linear regression on the resulting features. The paper states that this framework subsumes the continuous-time Kalman–Bucy filter. In application to U.S. GDP growth, the signature model on filtered DFM factors achieved validation RMSE 0.46 and test RMSE 0.82, compared with 0.85 and 0.98 for the authors’ own dynamic factor model and 0.86 and 1.03 for the published New York Fed Staff Nowcast; in weekly fuel-price nowcasting, the signature method achieved test RMSE 1.132 versus 1.237 for AR(1) and 1.243 for autoARIMA (Cohen et al., 2023).

Rough-path robust filtering pushes this interpretation further by fixing an observation sample path $256 \times 256$ 6, lifting it to rough-path space, and treating filtering as a deterministic optimal-control problem. The observation is enhanced by iterated integrals, the Kalman–Bucy-type dynamics are rewritten as a rough differential equation driven by $256 \times 256$ 7, and the associated value function satisfies a rough Hamilton–Jacobi–Bellman equation. The paper’s main message is stability: the value function is locally uniformly continuous with respect to the rough-path metric, so small perturbations of the enhanced observation path induce small changes in the filter (Mavroforas et al., 3 Sep 2025).

A plausible implication is that path-signature filtering unifies feature construction and stability analysis: in one line of work, learned pre-signature maps improve finite truncations; in another, lifted signatures provide the deterministic object on which robust filtering is posed (Bonnier et al., 2019, Mavroforas et al., 3 Sep 2025).

5. Probabilistic prefilters and content signatures

Outside biometrics, signature filtering often means early-stage workload reduction. In network intrusion detection, a programmable Ethernet interface card offloads signature matching from software by checking packet content against a Bloom-filter-encoded signature set and forwarding only packets likely to match a rule. Because Bloom filters in the standard model have no false negatives, relevant packets are not dropped by the filter; the trade-off is false positives, which merely send extra packets to the host. In the reported experiments, the number of attacks detected by Snort with the programmable card matched the number detected with a normal NIC, while host workload was substantially reduced; a 2 KB Bloom filter maintained very low false-positive probability for up to about 2000 signatures (0912.5292).

In content-based data leakage detection, signatures are document fingerprints rather than packet rules. The proposed extension replaces ordinary contiguous $256 \times 256$ 8-grams with sorted $256 \times 256$ 9-skip- $[0,1]$ 0-grams and retains only hashes that appear in less than $[0,1]$ 1 non-confidential documents, with $[0,1]$ 2 described as often a good default. The purpose is explicitly selective: ignore non-confidential sections such as boilerplate while remaining more robust to rephrasing, word insertion, deletion, and reordering. Here filtering does not suppress noise in a signal-processing sense; it suppresses non-relevant content during fingerprint construction (Shapira et al., 2013).

These examples make the architectural analogy clear. In both systems, an inexpensive probabilistic or combinatorial filter shields a more expensive downstream analysis. One filters packets before full IDS inspection; the other filters text fragments before confidentiality scoring [(0912.5292); (Shapira et al., 2013)].

6. Detection-time signature filtering in watermarking and authentication

A recent use of the term appears in statistical watermark detection for LLMs. Signature filtering is defined as a detection-time module that learns a small set of token types or local $[0,1]$ 3-grams whose presence makes watermark tests unreliable, removes those tokens, and then reruns the original detector on the filtered text. The signatures are learned by mixed-integer linear programming to maximize training-set true positive rate. The paper analyzes Kgw-style and Exp-style watermarks, derives finite-sample and asymptotic bounds, and reports that on four watermark families, four corpora, and six LLMs, 2- and 3-gram signatures raise detection rates in weak-signal and low-entropy settings from 8–31% without filtering to 78–99% with filtering. It also shows a cautionary boundary: under color-blind null-consistent deletion the safe deletion budget is linear in $[0,1]$ 4, whereas under color-adaptive or distributionally correlated conditions the fragile regime occurs at $[0,1]$ 5; for Exp, the conditional flip probability is bounded by $[0,1]$ 6 under the stated secrecy assumption (Hong et al., 16 Jun 2026).

Image-authentication pipelines use a different two-stage signature filter. DeepSignature embeds a cryptographically signed, content-encoding watermark into the image, then verifies the recovered signature with the public key and performs a latent-space integrity check against the received image. The first stage filters unsigned, removed, replaced, or corrupted watermarks; the second filters authenticated-but-tampered images. Reported results include near 100% identification of significant forgery attempts, AUC $[0,1]$ 7 on CASIA V1.0, AUC $[0,1]$ 8 on CASIA V2.0, and AUC $[0,1]$ 9 on Emu Edit, while the paper emphasizes trade-offs among imperceptibility, robustness, and integrity sensitivity (Graf et al., 24 Apr 2026).

These detection-time systems also clarify a common limitation. Filtering can strengthen a weak decision statistic, but it does not eliminate the underlying trade-off between sensitivity and false positives. In the LLM setting, overly correlated signatures can inflate conditional false-positive risk; in image authentication, stronger robustness generally reduces imperceptibility (Hong et al., 16 Jun 2026, Graf et al., 24 Apr 2026).