Three Lund University projects selected by Sweden’s engineering academy promise safer data, sharper forensic intelligence and more functional plant foods. Behind the exuberant terminology lies serious research, early commercial ambition and a recurring question for European innovation policy: when does a promising laboratory result become infrastructure society can safely trust?
An academy’s list is a signal, not a scientific verdict
On 2 June 2026, Lund University announced that three of its research projects had been selected for the Royal Swedish Academy of Engineering Sciences’ IVA List for Research Impact. The list, formerly known as the “100 List”, returned in 2026 in a smaller and more selective form, comprising roughly 30 projects judged to have potential for commercialisation, practical application or wider social benefit. Lund’s representatives ranged across three increasingly fashionable territories: decentralised and post-quantum cloud storage, microbiome-assisted criminal investigation, and biotechnology for enriching plant foods. It is difficult to imagine a more obliging trio for the modern innovation lexicon unless one of the fermented lupins were also placed on a blockchain.
Selection by IVA is crucial. The academy occupies a useful position between research, industry and public policy, and its committee includes representatives of academia, business and the public sector. But inclusion is not peer review, regulatory approval, product certification or independent technical validation. IVA explicitly chooses projects for their prospective impact and capacity to move research towards use. Its list should therefore be read as a portfolio of informed bets, not as a league table of proven technologies.
That distinction becomes important when examining Lund’s three projects. All have identifiable research beneath them. None is merely a handsome collection of adjectives. Yet the distance between the supporting papers and the strongest public-facing claims varies considerably. NodeX Cloud combines separate strands of cryptographic and distributed-storage research in a commercial platform whose complete architecture has not been described in a peer-reviewed systems paper. The forensic project has published an impressive geolocation model, but has not yet demonstrated routine evidential performance on guns, bombs or drugs in operational police casework. The food project has experimentally increased GABA and amino-acid concentrations, but biochemical enrichment is not equivalent to a demonstrated health benefit in people.
Taken together, however, the projects illuminate something larger than Lund’s innovation pipeline. They show Europe attempting to convert anxieties about digital dependence, organised crime, food-system resilience and public health into technologies that promise greater autonomy. They also reveal the awkward borderland where science meets entrepreneurship. Here, a result must be technically credible, commercially legible, regulatorily acceptable and sufficiently memorable to survive a pitch meeting. The first three are difficult. The fourth tends to produce phrases such as “Europe’s first post-quantum secure decentralised cloud storage solution”.
NodeX Cloud and the appeal of data scattered on purpose
NodeX Cloud is the most explicitly geopolitical of the three projects. Lund describes it as a decentralised storage system that splits and encrypts data across several European locations. Its stated aims include resilience, data sovereignty, compliance with European rules and protection against future quantum attacks. Rohon Kundu, a doctoral researcher in cybersecurity and the company’s founder and chief executive, argues that distributing data avoids the dangers of keeping everything in one place. The company’s other named principals are Alberto Butera, a doctoral researcher at Politecnico di Torino and NodeX’s chief technology officer, and Roman Beck, a professor at Bentley University and company board member.
There is a substantial academic foundation, although not yet a peer-reviewed paper describing and evaluating the entire NodeX product. Kundu’s 2024 licentiate thesis, On Decentralized Cloud Storage Security and an Efficient Post-Quantum Encryption Scheme, draws together three published studies. One proposes a method for compressing public keys and accelerating polynomial multiplication in NTRU, a family of lattice-based post-quantum cryptographic systems. Another examines secure cloud deduplication combined with erasure protection. The third models the robustness of the Storj decentralised storage network under a coordinated distributed denial-of-service attack.
These papers address real engineering problems. Post-quantum public-key mechanisms can impose larger keys, ciphertexts or signatures than conventional systems. Deduplication, meanwhile, can reduce storage costs by eliminating repeated copies, but it sits uneasily beside client-side encryption because independently encrypted copies generally cease to look identical. Decentralised storage presents another trade-off: distributing fragments can remove a single physical point of failure, while simultaneously enlarging the system’s operational complexity and attack surface. Kundu’s research does not pretend decentralisation is magically invulnerable. On the contrary, the Storj study investigates how an adversary might disrupt enough nodes or fragments to cause data loss.
That nuance is less visible in the promotional version. IVA’s project page says NodeX “brings sovereignty, decentralization, EU compliance, and quantum security under one unified platform”. It further reports three enterprise pilots, three letters of intent, two patents, backing from LU Ventures and a Vinnova grant. Vinnova’s public database confirms SEK 150,000 in funding for a project conducted between January and April 2026. It says the work produced a 24-month technology roadmap, a joint white paper with Bentley University and two letters of intent from American companies. Importantly, Vinnova notes that the project description was supplied by the project members and had not been editorially reviewed.
This is not evidence of impropriety. It is evidence of an early-stage company behaving like an early-stage company. Pilots and letters of intent demonstrate interest, not production-grade performance. Patents may indicate novel intellectual property, but neither the Lund announcement nor IVA’s summary identifies the patent numbers, jurisdictions, granted status or precise claims. The publicly located research establishes expertise in relevant components. It does not, by itself, establish that the integrated NodeX service has passed independent penetration testing, cryptographic audit, red-team exercises, certification or comparative performance evaluation against established storage providers.
There is also a terminological trap. “Post-quantum” does not mean that a system has been tested against a functioning cryptographically relevant quantum computer. It ordinarily means that it uses algorithms believed, on present evidence, to resist both classical and quantum attacks. This is a necessary field of engineering, not a warranty issued by a time traveller. Europe’s concern is nonetheless well founded. The European Commission’s 2024 recommendation called for migration away from vulnerable public-key cryptography, and the EU’s 2025 implementation roadmap urged member states to begin transitioning by the end of 2026, with high-risk critical infrastructure migrating no later than 2030. The roadmap also highlights “store now, decrypt later”, in which encrypted information is stolen today in the hope of decrypting it once quantum capabilities mature.
NodeX therefore addresses a genuine policy demand. Banks, hospitals, public authorities and defence organisations cannot sensibly wait for a large cryptographically relevant quantum computer to appear before inventorying and replacing vulnerable cryptography. Nor is concern about cloud concentration invented for marketing purposes. Reliance on a small number of large, predominantly American providers has become entangled with European debates about jurisdiction, strategic dependency, public procurement and control over sensitive data. Yet “European locations” alone do not guarantee sovereignty. Ownership, corporate control, subcontractors, administrator access, legal exposure, key custody, metadata processing and software dependencies all matter. Geography is part of sovereignty, not its entirety.
Nor does dispersal automatically defeat ransomware. A decentralised system may improve availability if fragments are redundant, independently administered and protected by sound access controls. But ransomware frequently compromises credentials, management planes, endpoints or backup policies rather than merely attacking one storage building. If malicious deletion commands or corrupted data propagate across nodes, distribution can reproduce the disaster with admirable efficiency. A credible evaluation of NodeX would therefore need to explain immutability, versioning, key recovery, identity controls, deletion authority, quorum rules, node vetting, repair mechanisms, audit logging and responses to compromised orchestration software. Kundu’s Storj analysis shows that he is alert to such questions. It does not publicly answer them for NodeX.
The responsible conclusion is neither dismissal nor coronation. NodeX is a plausible research spin-out responding to a strategic European problem at an opportune moment. Its founder has peer-reviewed work on NTRU implementation, cloud deduplication and decentralised-storage resilience. The company has secured modest public funding and early commercial signals. What remains undisclosed or unverified is precisely what would matter to a procuring hospital, bank or municipality: the deployed cryptographic suite, standards alignment, threat model, benchmark data, audit results, patent details, governance arrangements and evidence from operational pilots. A sovereign cloud cannot run on sovereignty as a slogan. Eventually somebody must inspect the plumbing.
When the bacteria take the witness stand
Eran Elhaik’s project begins with a compelling proposition: criminals may remove fingerprints, avoid leaving usable human DNA or handle objects through intermediaries, but they cannot prevent those objects from accumulating biological material from their surroundings. Soil, dust, microbes, fungi, plant matter and other environmental traces might reveal where an object has been stored, assembled or transported. Lund and IVA suggest that such profiles could help investigators trace firearms, explosive devices, drones or drug shipments when conventional evidence is absent or degraded.
The central paper behind this claim is the 2024 study “Microbiome Geographic Population Structure (mGPS) Detects Fine-Scale Geography”, published in Genome Biology and Evolution by Yali Zhang, Leo McCarthy, S. Emil Ruff and Elhaik. The researchers developed a machine-learning system that uses the relative abundance of microbial sequences to predict a sample’s geographical source. Across the datasets analysed, mGPS reportedly identified the source city of urban samples with 92 per cent accuracy, within-city sites with 82 per cent accuracy, soil locations with 86 per cent accuracy and marine sites with 74 per cent accuracy.
Those figures are striking, but their meaning depends on the experimental design. The system was evaluated on structured research datasets from urban transit systems, soils and marine environments. Classification accuracy among known candidate locations is not the same task as assigning an unknown evidential sample recovered from a weapon to one place in the world. Real forensic samples may contain mixtures from several environments, degraded DNA, contaminants introduced by police handling, cleaning chemicals, laboratory batch effects or biological traces transferred secondarily by people and packaging. A model trained on existing reference locations may also be forced to choose the nearest familiar class even when the true location is missing from its database.
The published paper demonstrates microbial geolocation. The proposed forensic product goes further. IVA’s description says the technology can reveal the “hidden history” of objects, connect people, objects and locations, generate leads and integrate into police workflows. Lund’s May 2026 account says it could address where a bomb was assembled, whether drug seizures share a production site and possibly when an object occupied a location. These are hypotheses for development, not outputs directly validated by the mGPS paper. The 2024 study did not report a blinded trial involving crime-scene bombs, illicit drug batches or firearms travelling through real evidential chains of custody.
The commercial dimension is already visible. Elhaik’s laboratory materials identify MicroDentify Sweden AB as a commercial tool or venture established around the forensic idea, while LU Ventures publicly described MicroDentify and NodeX Cloud as portfolio spin-outs based on research findings. This connection ought to be stated whenever claims about readiness or transformative potential are assessed. A researcher founding a company to apply a discovery is normal within innovation policy. It does, however, create a financial and professional interest in presenting the route to adoption as short and the destination as revolutionary.
The broader scholarly literature is markedly more cautious. A 2021 review co-authored by Elhaik examined more than 100 papers on forensic microbiomics and concluded that the field had potential but remained in its infancy. It identified small samples, variable model accuracy and unrealistic environmental settings as recurring weaknesses, and stated that the information available at that time was unlikely to be usable by law enforcement. Later reviews continue to describe problems involving contamination, stability, standardisation, reproducibility, population diversity and the absence of sufficiently comprehensive reference databases.
Forensic science imposes a sterner standard than exploratory machine learning because errors can alter prosecutions, liberty and public confidence. A tool used only to generate investigative leads may be permitted greater uncertainty than one offered as courtroom evidence. But even intelligence-led use can create tunnel vision if investigators treat an algorithmic location as a fact rather than a probability conditioned on the reference database. Validation must therefore test false-positive rates, mixtures, environmental persistence, secondary transfer, seasonal change, unseen locations and differences between laboratories. It must also define what the model does when the correct answer is “none of the above”, a reply to which computers, institutions and dinner-party experts are all sometimes curiously resistant.
Privacy deserves equal attention. Environmental DNA samples can include human genetic material alongside microbial and other biological signals. Large geospatial databases might reveal patterns of movement, association or presence extending beyond a suspect to bystanders and entire communities. European deployment would therefore require clear rules for collection, purpose limitation, retention, database access, model training and evidential disclosure. An opaque proprietary classifier would be particularly difficult to reconcile with a defendant’s ability to challenge scientific evidence, especially if the reference data or model weights were treated as commercially confidential.
The proposition is nevertheless scientifically credible enough to warrant serious trials. The mGPS paper is a real peer-reviewed advance, based on the geographical structure of microbial communities rather than a fanciful claim that every bacterium carries a tiny passport. The crucial next step is prospective testing designed for forensic conditions, preferably conducted across independent laboratories and police services, with preregistered performance criteria and samples whose provenance is blinded to analysts. Until then, “forensic intelligence research platform” is a fair description. “Crime-solving bacteria” is excellent copy, but the bacteria have not yet survived cross-examination.
GABA, fermentation and the difference between enriched and healthier
The third project, led by Javier Linares-Pastén with J. Mauricio Peñarrieta, Gabriela Ibieta and Jimena Ortiz-Sempértegui, is less dramatic but perhaps closer to an established industrial pathway. The researchers use enzymes and fermentation to increase bioactive compounds in plant materials including tarwi, a species of lupin, cañihua, quinoa and traditional Andean potato products. The principal molecule in the IVA presentation is gamma-aminobutyric acid, or GABA, an inhibitory neurotransmitter that can also be produced by microorganisms during food fermentation.
The strongest directly relevant experimental publication appeared in Frontiers in Nutrition in November 2025. Ibieta and colleagues fermented tarwi, cañihua and quinoa with Levilactobacillus brevis DSM 1269. The reported GABA concentration reached approximately 4 mg per gram in fermented tarwi, compared with 1 mg per gram in quinoa and 0.3 mg per gram in cañihua. Fermentation also produced lactic and acetic acids and increased several soluble essential amino acids, including threonine, histidine, methionine, isoleucine, leucine, valine and lysine.
A separate 2025 paper in LWT examined enzymatic production of GABA from proteins in tarwi, cañihua and quinoa. A Food Chemistry study investigated resistant starch, probiotic fermentation, short-chain fatty acids and GABA production in chuño and tunta, traditional freeze-dried potato products. Together, these papers substantiate the narrower technological claim: the team can use food-compatible enzymatic or microbial processes to alter metabolite and amino-acid profiles in several plant matrices.
That is meaningful. Fermentation is already deeply embedded in food production, and increasing the value of locally or regionally important crops may create new ingredients, markets and processing opportunities. Tarwi is protein-rich, while quinoa and cañihua possess nutritional and cultural importance in the Andes. Mild processing routes may prove more attractive than extensive chemical treatment if they can be scaled reliably, preserve sensory quality and meet food-safety requirements. Unlike an entirely novel technical platform, fermentation arrives with several millennia of field experience, though admittedly most of it was conducted before the invention of the venture-capital deck.
The difficulty lies in Lund’s description of the resulting foods as “healthier” and its reference to possible stress reduction and improved sleep. The published studies chiefly measure composition and in vitro or fermentation outcomes. They do not establish that consuming these particular enriched ingredients improves sleep, reduces stress or produces clinically meaningful effects in humans. GABA’s activity as a neurotransmitter does not automatically mean that dietary GABA reaches the brain in sufficient quantities or produces the effects implied by its neurological function.
European regulatory history supplies a useful bucket of cold water. In 2009, the European Food Safety Authority assessed a proposed relationship between dietary GABA and cognitive function. It concluded that the cited evidence did not directly address dietary intake and that a cause-and-effect relationship had not been established. More generally, health claims used in EU marketing must undergo scientific assessment and authorisation; EFSA says that more than 70 per cent of evaluated claims had been rejected for insufficient evidence as of 2023.
This does not invalidate the Lund research. It narrows what may responsibly be claimed. “GABA-enriched”, “fermented” and “higher in specified free amino acids” are measurable compositional descriptions, subject to applicable labelling rules. “Reduces stress”, “improves sleep” or even an unqualified “healthier” requires different evidence, including human intervention studies using the finished food or ingredient at realistic consumption levels. Such trials would need suitable controls, preregistered endpoints, adequate duration and attention to bioavailability, dose, diet and individual variation.
Commercial feasibility brings further questions. Laboratory fermentation must be translated into reproducible batches with acceptable taste, texture, shelf life and cost. Lupins can contain bitter or undesirable alkaloids that must be appropriately controlled, while introducing a microbial strain into production requires rigorous process and safety assessment. Any claim of sustainability would also need a comparative life-cycle analysis, since fermentation consumes energy, equipment, water and processing inputs. The phrase “food-safe method” is encouraging but does not substitute for specification of organisms, process controls, contaminant limits and the regulatory category of the eventual ingredient.
Among the three IVA projects, this may have the clearest chain from published experiment to industrial development. The biochemical effect exists, several plant materials have been tested, and fermentation is commercially familiar. The leap occurs not between experiment and process but between enriched composition and improved human health. The next decisive paper should therefore not merely report that more GABA has been produced. It should determine whether anybody eating the product experiences a reproducible benefit, and at what dose, without requiring the consumer to ingest a heroic quantity of lupin paste before bedtime.
Three projects, three different evidential gaps
The three projects should not be judged by one uniform technology-readiness scale. NodeX faces a systems-integration and assurance problem: relevant components have been studied, but the complete commercial architecture requires independent security and performance validation. The microbiome project faces a translation and forensic-validity problem: geographical classification has been demonstrated on research datasets, but operational claims involving criminal evidence remain to be established. The plant-food project faces a clinical-evidence problem: biochemical enrichment is demonstrated, while downstream health effects remain uncertain.
Their commercial interests also differ. NodeX Cloud openly presents itself as a company with pilots, letters of intent, patents, investors and public funding. MicroDentify is a university spin-out associated with Elhaik’s forensic work. The food-biotechnology project appears, in the located sources, primarily as an academic research programme seeking industrially scalable applications, although Linares-Pastén’s university profile records consultancy work for biotechnology companies and co-founding an unrelated plastics-recycling enterprise. Disclosure of these connections is not an accusation. It is the ordinary transparency required when scientific claims and prospective products travel together.
What IVA has identified, then, is not three finished solutions but three potentially valuable transitions. NodeX could help translate Europe’s post-quantum timetable and sovereignty ambitions into storage infrastructure. Microbial geolocation could convert vast environmental sequencing resources into a new class of forensic intelligence. Fermentation could transform underused plant proteins and traditional crops into higher-value ingredients. Each deserves investment proportionate to its evidence, and scrutiny proportionate to the consequences of failure.
For European innovation policy, the broader lesson is that sovereignty is not achieved simply by attaching the word to a cloud, nor public safety by placing artificial intelligence beside a bacterium, nor health by increasing the concentration of a molecule associated with the nervous system. Sovereignty requires governable infrastructure. Forensic utility requires validation under casework conditions. Health benefit requires human evidence. The scientific groundwork at Lund is sufficient to justify all three journeys. It is not sufficient to declare that any of them has arrived.
That may sound less thrilling than the innovation brochure, but it is ultimately the more favourable conclusion. Hype is most damaging when it attaches itself to weak research. Here, the underlying work is substantial enough to withstand a cooler description. NodeX is an early sovereign-storage contender with relevant cryptographic scholarship but an unverified integrated product. MicroDentify rests on a notable microbiome-geolocation study but still needs forensic trials and governance. The plant-biotechnology team has produced convincing compositional changes but not yet convincing evidence of better sleep, calmer citizens or other human outcomes. These are not failures. They are research programmes at the precise point where a celebratory list ought to place them: promising, consequential and not remotely finished.
References
European Commission. (2024). Commission Recommendation (EU) 2024/1101 of 11 April 2024 on a coordinated implementation roadmap for the transition to post-quantum cryptography. Official Journal of the European Union. https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=OJ:L_202401101
European Commission. (2025, June 23). EU reinforces its cybersecurity with post-quantum cryptography. https://digital-strategy.ec.europa.eu/en/news/eu-reinforces-its-cybersecurity-post-quantum-cryptography
European Commission. (n.d.). EU register of health claims. https://food.ec.europa.eu/food-safety/labelling-and-nutrition/nutrition-and-health-claims/eu-register-health-claims_en
European Food Safety Authority Panel on Dietetic Products, Nutrition and Allergies. (2009). Scientific opinion on the substantiation of health claims related to gamma-aminobutyric acid and cognitive function (ID 1768) pursuant to Article 13(1) of Regulation (EC) No 1924/2006. EFSA Journal, 7(9), 1274. https://doi.org/10.2903/j.efsa.2009.1274
Ibieta, G., Ortiz-Sempértegui, J., Grey, C., Peñarrieta, J. M., & Linares-Pastén, J. A. (2025). γ-Aminobutyric acid production and soluble free amino acid profile change in Andean seeds by Levilactobacillus brevis fermentation. Frontiers in Nutrition, 12, 1693053. https://doi.org/10.3389/fnut.2025.1693053
Ibieta Jiménez, G., Ortiz-Sempértegui, J., Peñarrieta, J. M., & Linares-Pastén, J. A. (2025). Enhancing the functional value of Andean food plants: Enzymatic production of γ-aminobutyric acid from tarwi, cañihua and quinoa real seeds’ proteins. LWT, 220, 117564.
Kundu, R. (2024). On decentralized cloud storage security and an efficient post-quantum encryption scheme [Licentiate thesis, Lund University]. Department of Electrical and Information Technology, Lund University.
Kundu, R., De Piccoli, A., & Visconti, A. (2022). Public key compression and fast polynomial multiplication for NTRU using the corrected hybridized NTT-Karatsuba method. In Proceedings of the 8th International Conference on Information Systems Security and Privacy (pp. 145–153).
Kundu, R., Gehrmann, C., & Kihl, M. (2023). A comprehensive robustness analysis of Storj DCS under coordinated DDoS attack. In 2023 IEEE 29th International Conference on Parallel and Distributed Systems (pp. 659–666). IEEE.
Lund University. (2026, May 6). New DNA technology could support police investigations. https://www.science.lu.se/article/new-dna-technology-could-support-police-investigations
Lund University. (2026, June 2). Decentralised data, crime-solving bacteria, healthier food: Three Lund University projects on IVA’s 2026 list. https://www.lunduniversity.lu.se/article/decentralised-data-crime-solving-bacteria-healthier-food-three-lund-university-projects-ivas-2026
Ortiz-Sempértegui, J., Ibieta, G., Nguyen, T. T., Zhang, B., Peñarrieta, J. M., & Linares-Pastén, J. A. (2026). Functional characterisation of traditional Andean freeze-sun dried potato derivatives, chuño and tunta: Resistant starch, probiotic fermentation, and production of SCFA and GABA as bioactive metabolites. Food Chemistry, 502, 147760.
Robinson, J. M., Pasternak, Z., Mason, C. E., & Elhaik, E. (2021). Forensic applications of microbiomics: A review. Frontiers in Microbiology, 11, 608101. https://doi.org/10.3389/fmicb.2020.608101
Royal Swedish Academy of Engineering Sciences. (2026). IVA’s List for Research Impact 2026. https://www.iva.se/en/what-iva-does/distinctions/iva-list-2026/
Vestergaard, R., Pagnin, E., Kundu, R., & Lucani, D. E. (2022). Secure cloud storage with joint deduplication and erasure protection. In 2022 IEEE 15th International Conference on Cloud Computing (pp. 554–563). IEEE.
Vinnova. (2026). NodeX Cloud, project 2025-04724. https://www.vinnova.se/en/p/nodex-cloud/
Zhang, J., Liu, W., Simayijiang, H., Hu, P., & Yan, J. (2023). Application of microbiome in forensics. Genomics, Proteomics & Bioinformatics, 21(1), 97–107. https://doi.org/10.1016/j.gpb.2022.07.007
Zhang, Y., McCarthy, L., Ruff, S. E., & Elhaik, E. (2024). Microbiome Geographic Population Structure (mGPS) detects fine-scale geography. Genome Biology and Evolution, 16(11), evae209. https://doi.org/10.1093/gbe/evae209
Photo:
