Reconstructing Protected Biometric Templates from Binary Authentication Results

TL;DR

This work shows that biometric templates protected by strong cryptographic schemes remain vulnerable when a system exposes only binary authentication outcomes. It introduces two reconstruction pathways: (i) from similarity scores using a triangulation/linearization approach for squared Euclidean distance or cosine similarity, and (ii) from binary accept/reject results by locating $d+1$ surface points on a sphere of radius $T$ and solving a linear system, with an efficient two-stage process that requires $1/ ext{FMR} + P(d+1)$ attempts. An end-to-end facial-image reconstruction pipeline leverages a GAN-based inversion to produce high-resolution images that pass verification in over 98% of cases. The results imply that FHE-based and other cryptographic protections do not guarantee irreversibility under interactive attacks, motivating stronger defenses and broader evaluation across biometric modalities.

Abstract

Biometric data is considered to be very private and highly sensitive. As such, many methods for biometric template protection were considered over the years -- from biohashing and specially crafted feature extraction procedures, to the use of cryptographic solutions such as Fuzzy Commitments or the use of Fully Homomorphic Encryption (FHE). A key question that arises is how much protection these solutions can offer when the adversary can inject samples, and observe the outputs of the system. While for systems that return the similarity score, one can use attacks such as hill-climbing, for systems where the adversary can only learn whether the authentication attempt was successful, this question remained open. In this paper, we show that it is indeed possible to reconstruct the biometric template by just observing the success/failure of the authentication attempt (given the ability to inject a sufficient amount of templates). Our attack achieves negligible template reconstruction loss and enables full recovery of facial images through a generative inversion method, forming a pipeline from binary scores to high-resolution facial images that successfully pass the system more than 98\% of the time. Our results, of course, are applicable for any protection mechanism that maintains the accuracy of the recognition.

Figures (6)

• Figure 1: Reconstructed images obtained by our attack from protected ArcFace and FaceNet templates compared to the original images.
• Figure 2: Overview of Biometric Authentication Systems Based on FHE.
• Figure 3: Illustration of our template reconstruction attack in using only binary authentication results in 2D.
• Figure 4: Illustration of the baseline attack using 2D PCA: left -- the approximation of the feature space density distribution within the match space of the target template; right -- Illustration of the impact of adding more false match points.
• Figure 5: Reconstruction loss of ArcFace templates using the baseline approach.