Fig 4What attackers can bypassClick a gauge, or press 1–2rooted phone · both gauges read the threat
Teal: a true reading of the threatLeft: on-device check. Right: server-verified anchor under a sealed coverIndigo: where the attacker's probe is stoppedOn a device the attacker controls, any on-device check can be hooked so it reports clean: Rampart's included. Native code and redundancy slow this down; they do not prevent it. Results signed by Google or Apple and verified on your server (Play Integrity, App Attest, key attestation) cannot be forged on the device, so decisions about money and personal data must rest on them.