Neural Fuzzy Extractors: A Secure Way to Use Artificial Neural Networks for Biometric User Authentication

TL;DR

This paper addresses the security vulnerabilities inherent in biometric authentication systems by proposing Neural Fuzzy Extractors (NFE), which couple vector-space classifiers with fuzzy extractors through an expander to enable secure template handling without sacrificing classifier performance. NFEs retrofit existing classifiers by adding an expander that reshapes embeddings into sphere-like regions, enabling secure sketches built on a 128-dimensional Low-Density Lattice Code (LDLC) for robust, privacy-preserving authentication with a hash-based verification step; the codeword size is $n=128$. The authors demonstrate NFEs on fingerprint authentication using three architectures (ResNet50, MobileNet, VGG16) across two datasets (FVC2006 and PolyU), finding minimal degradation in equal error rate (EER) and ROC area despite added security overhead, and show LDLC decoding performs comparably or better than distance-based decoding. A security analysis estimates biometric entropy in the expanded embedding space (approximately $2^{68.67}$ distinct profiles, or about $68.67$ bits) and discusses attacker assumptions and post-registration risk, illustrating NFEs as a practical path toward privacy-preserving biometrics with secure template storage.

Abstract

Powered by new advances in sensor development and artificial intelligence, the decreasing cost of computation, and the pervasiveness of handheld computation devices, biometric user authentication (and identification) is rapidly becoming ubiquitous. Modern approaches to biometric authentication, based on sophisticated machine learning techniques, cannot avoid storing either trained-classifier details or explicit user biometric data, thus exposing users' credentials to falsification. In this paper, we introduce a secure way to handle user-specific information involved with the use of vector-space classifiers or artificial neural networks for biometric authentication. Our proposed architecture, called a Neural Fuzzy Extractor (NFE), allows the coupling of pre-existing classifiers with fuzzy extractors, through a artificial-neural-network-based buffer called an expander, with minimal or no performance degradation. The NFE thus offers all the performance advantages of modern deep-learning-based classifiers, and all the security of standard fuzzy extractors. We demonstrate the NFE retrofit to a classic artificial neural network for a simple scenario of fingerprint-based user authentication.

Figures (5)

• Figure 1: Neural Fuzzy Extractor architecture.
• Figure 2: Secure sketch construction. Left: The large circle is chosen to contain all available embeddings, from all users; the small circle for the authentic user (AU) is chosen to yield a favorable false positive-false negative compromise (different radii may be chosen for different AUs). Middle: A codebook is constructed, with Voronoi region congruent to AU's decision region; the center of AU's decision region ($r_i$) is decoded to the closest codeword ($c_i$), and the difference between the center of AU's decision region and this codeword ($d_i$) is saved to the AU's record along with the hash of the center of AU's decision region. Right: The AU submits a new sample for authentication ($b$); by subtracting the difference vector ($d_i$) and decoding to the nearest codeword ($c_i$), the previously-identified codeword is recovered. We then add the difference to the recovered codeword (again $d_i$), and obtain the center of AU's decision region ($r_i$); its hash is compared to AU's record.
• Figure 3: Triplet Loss architecture with Siamese network: Three images ("Anchor","Positive" and "Negative") are passed through the same CNN simultaneously to generate a final layer of 128 dimensional vector. Then all three vectors are passed through the triplet loss function to minimize the distance between "Anchor" and "Positive" as well as maximizing the distance between "Anchor" and "Negative".
• Figure 4: Triplet Loss architecture: The architecture tries to minimize the distance between "Anchor" and "Positive" and maximize distance between "Anchor" and "Negative"
• Figure 5: Error rate vs. injected noise level for the Latin-Square LDLC with row/column degree $d$ of the parity check matrix.