How Much Feedback Is Needed to Break Template Protection? The Geometric Vulnerability of Biometric Authentication

How Much Feedback Is Needed to Break Template Protection? The Geometric Vulnerability of Biometric Authentication. By Eliron Rahimi and two others, from the Technion, Israel Institute of Technology and the University of Haifa. Published on the eighteenth of October. Its code repository is public but slight: two source files.

Biometric authentication systems increasingly protect their stored templates with privacy-preserving mechanisms. The template may be guarded, but the interface that answers authentication requests can still leak information, and leaked information is what reconstruction attacks feed on. Earlier attacks relied on systems that release similarity scores. More advanced systems release only a binary decision: accept or reject. That single bit carries substantially less information than a score, which makes rebuilding a template far harder. The question in the title is how little feedback an attacker can get away with.

The answer offered is query-efficient reconstruction under extremely limited feedback, and it addresses two limitations of earlier attacks. The first contribution is described as the first attack that reconstructs protected biometric templates from authentication success or failure alone. What it exploits is geometry: the geometric constraints inherent in how biometric authentication works. The second contribution is aimed at systems that do release scores. There, distribution-aware methods make reconstruction query-efficient, which the authors frame as a more realistic threat model.

The two ideas are then combined. A pretrained facial diffusion prior is incorporated into the geometric attack that works from binary feedback, so the distribution of faces informs an attack that otherwise sees only accept or reject. Underneath all three pieces is the same pair of levers: what the geometry of authentication gives away, and what the distribution of biometric templates lets an attacker assume.

Two reductions are reported. For score-releasing systems, the distribution-aware methods cut the number of required queries by a factor of five compared with recent prior score-based attacks. For the binary setting, adding the diffusion prior to the geometric attack also cuts the required queries by a factor of five.

The finding the authors draw out is a limitation of biometric authentication itself. Independently of whichever template protection mechanism is in place, the authentication process exposes geometric information, and that information can enable perfect template reconstruction up to numerical precision. A second point stands beside it: the distribution of biometric templates can be used to make reconstruction attacks significantly more effective. For anyone designing these systems, hiding scores behind an accept or reject answer does not, on this account, close the channel.