How Much Feedback Is Needed to Break Template Protection? The Geometric Vulnerability of Biometric Authentication

1. 01What problem does this paper attempt to solve?

   The authors study whether biometric authentication systems that return only binary accept/reject feedback still leak enough information to reconstruct protected templates.

   Core question: do biometric authentication systems that return only a binary authentication result (accept/reject) still leak enough information to reconstruct the protected biometric template.

   • Setting and importance: once a biometric template leaks, it cannot be changed like a password; ISO/IEC 24745 requires template protection to satisfy irreversibility, and encryption schemes such as FHE are used to complete matching in the encrypted domain, with recent systems further returning only a binary result, so intuitively each query leaks only 1 bit.
   • Shortcomings of existing attacks: existing template reconstruction attacks (hill-climbing, equation-solving-based methods) all rely on the system leaking similarity scores; the authors state that whether systems returning only a binary result are secure had not previously been answered.
   • Core observation: a binary decision defines geometric constraints in feature space—in SED systems the acceptance region is a sphere centered on the target template, and in cosine similarity systems it is a cone on the unit hypersphere; locating points on the decision boundary suffices to construct equations that reveal the template.
   • Paper's contributions: the authors propose (1) a template reconstruction attack using only binary feedback; (2) distribution-aware query-efficient reconstruction for score-leaking systems, which the authors state reduces the number of queries by 5× compared with recent score-based attacks; (3) incorporating a facial diffusion prior into the geometric binary attack, which the authors state reduces the number of queries by 5×.
   • Threat model (Section III-A):
     • Goal: reconstruct the target user's biometric template f.
     • Knowledge: the attacker has black-box access to the matching module and can access the feature extractor to extract templates from candidate images; the service provider is semi-honest, following the protocol but potentially curious.
     • Capability: can submit arbitrary feature vectors (breaking-set) and receives either a similarity score or a binary match/no-match result depending on the setting; under the query-efficient setting, at most Q authentication attempts are allowed.
     • Victim system: a biometric authentication system in which templates are stored in protected form (e.g., FHE) and the attacker cannot decrypt them, with a decision rule of SED or cosine similarity plus a threshold.

   Collapse this answer

2. 02What related research exists?

   Related work falls into two categories: template protection mechanisms (FHE, feature transformation, biometric cryptosystems) and reconstruction attacks that rely on score leakage.

   Biometric Template Protection

   • ISO/IEC 24745 [6]—proposes three requirements for template protection: unlinkability, irreversibility, renewability; this paper targets irreversibility.
   • Feature transformation and biometric cryptosystems [22], [7], [23]—salting, BioHashing, and cancelable biometrics use user-specific keys to perform invertible transformations; fuzzy commitment and fuzzy vault bind biometric data to cryptographic keys.
   • Homomorphic encryption and multi-party computation [8], [9], [11], [7]—matching directly in the encrypted domain; the paper states that FHE-type schemes are the "most advanced and most promising" among them, but notes that the results of this paper apply to any protection mechanism that preserves recognition accuracy.

   Reconstruction attacks based on similarity scores

   • Hill-climbing [17]—iteratively submits synthetic representations and improves the match based on returned matching scores; this is an adaptive attack.
   • Mohanty et al. [18]—a non-adaptive method that constructs a system of equations from leaked scores to solve for the template; the paper notes that its idea still applies to modern deep features.
   • Bassit et al. [19]—targets FHE systems, using random fake templates and their cosine scores to solve an optimization problem under a unit-norm constraint; the paper notes that such methods typically require many queries and have no explicit optimization of query selection.
   • Shahreza and Marcel [24]—reconstructs face images from protected templates; the paper notes that their threat model assumes full knowledge of the protection scheme and its secrets (including the decryption key), whereas this paper assumes the template cannot be decrypted and the attacker interacts only with the authentication interface.

   Baselines and benchmarks: The comparison baselines are hill climbing [17], Lagrange-constrained reconstruction [19], algebraic reconstruction [18] (with two equation sources: random/target distribution), a GMM prior solver, and an average mismatched-template baseline; the benchmarks are LFW and CelebA.

   The authors position this paper as: the first template reconstruction attack using only binary authentication feedback (as claimed by the authors), and they use a distribution-aware prior for both the score scenario and the binary scenario to reduce the number of queries.

   Collapse this answer

3. 03How does the paper address this problem?

   Uses the geometric structure of binary decisions to locate decision boundary points and solve equations, then uses PCA input selection and a diffusion prior to reduce the number of queries.

   Overall approach: convert the feedback from the authentication interface into geometric constraints in feature space—scores directly give equations, and binary results construct equations by using binary search to locate points on the decision boundary; then use a template distribution prior (PCA directions or a face diffusion model) to maintain reconstruction precision when queries are limited. The method covers both SED and cosine similarity decision rules.

   Score-based algebraic reconstruction (Section III-B)

   • SED case: submit d+1 independent queries, construct a nonlinear system of equations from the leaked squared Euclidean distances, subtract pairwise to eliminate the quadratic terms, and obtain a d-variable linear system to solve.
   • Cosine case: deep features are already normalized, and each query directly gives a linear equation c_i = ∑_j f_j q_ji; d independent queries suffice to solve for f.

   Geometric attack with binary feedback (Section III-C)

   • SED system: the problem is equivalent to "given the inside/outside decision function A(x) of a ball, find the d-dimensional center". First, on average 1/FMR queries are used to find a point c that passes authentication, then move 2T along a random direction to outside the ball, and use P rounds of binary search to approach the sphere surface; after repeating d+1 times, solve according to Section III-B. The total number of queries is 1/FMR + P(d+1).
   • Cosine system: the acceptance region is a cone on the unit hypersphere. From the passing point c, rotate by angle θ = 2 arccos(T)+ε along a random direction orthogonal to it to outside the cone; during binary search each midpoint is re-normalized; each boundary constraint is q_i^⊤ f = T, and repeating d times gives a linear system. The total number of queries is 1/FMR + P·d.
   • Baseline: collect incorrectly accepted templates and average them (Algorithm 1), as a comparison.

   Query-efficient score attack (Section IV-B)

   • Goal: replace the unit-norm prior of Bassit et al. with a template distribution constraint, i.e., minimize |Ax−b|² with x following the template distribution D.
   • PCA input selection: perform PCA on a set of real templates generated by the same extractor, and take the top B principal components as queries; directions whose eigenvalues are below threshold τ are replaced with random templates from the dataset. In Appendix B, τ is set to retain the top 40 principal components, and budget beyond 40 is randomly selected from the breaking-set.

   Query-efficient binary attack (Section IV-C)

   • Approach: in the binary setting, boundary points are produced by random search and directions cannot be chosen directly, so the solver is replaced with prior reconstruction: minimize |Ax−b|² − log P(x).
   • Diffusion prior solver: use a pretrained IDiff-Face latent diffusion model (official 25% context-dropout version, trained on FFHQ for 150,000 steps, without fine-tuning and without identity conditioning) to generate faces, extract templates via FaceNet, and guide sampling with the constraint loss; Appendix B gives T=1000 steps, guidance scale λ=1000, switching step τ=300, single generation.
   • Success criterion: reconstruction loss (the distance between the reconstructed template and the target template under the corresponding matching metric) below 1% of the authentication threshold is regarded as near-perfect reconstruction; the proportion of targets meeting the criterion and the number of queries required are reported.

   Collapse this answer

4. 04What experiments did the paper conduct?

   On LFW/CelebA and ArcFace/FaceNet, the binary attack achieves 97.6%–100% of targets with error below the 1% threshold, and the diffusion prior saves about 5× queries.

   Experimental Setup

   • Systems tested: feature extractors are ArcFace and FaceNet (d=512); decision rules are SED and cosine similarity, with thresholds set at FMR 1.0% and 0.1%.
   • Benchmarks: LFW and CelebA; the paper states that both contain more than 10,000 face images and 1,000 identities; 300 identities are randomly selected from each benchmark as target users.
   • Baselines: for the score scenario, hill climbing [17], Lagrange-constrained reconstruction [19], algebraic reconstruction [18] (with two equation sources: random distribution/target distribution); for the no-input-selection scenario, a GMM prior solver is added; for the binary scenario, the baseline is the average mismatched template.
   • Metrics: reconstruction loss (distance between the reconstruction and the target template under SED or cosine), the proportion of targets whose loss is below 1% of the threshold, and the number of queries required to reach that criterion.
   • Implementation details: the binary attack sets P=20; baselines are allocated the same number of authentication attempts as the proposed method; the diffusion solver uses a pretrained IDiff-Face model plus a FaceNet extractor, with a single generation.
   • Review method: all metrics are automatic; the paper does not use human or LLM review.

   Main Results

   Binary-feedback reconstruction (Table II, 300 target identities, P=20):

   Swipe horizontally to read the table

   Decision rule	Extractor	FMR	LFW Baseline	LFW Ours	CelebA Baseline	CelebA Ours
   SED	ArcFace	1%	0.0%	99.3%	0.0%	99.3%
   SED	ArcFace	0.1%	3.5%	99.6%	0.0%	100.0%
   SED	FaceNet	1%	0.0%	99.3%	0.0%	99.7%
   SED	FaceNet	0.1%	0.0%	99.3%	0.0%	100.0%
   Cosine	ArcFace	1%	0.0%	98.6%	0.0%	100.0%
   Cosine	ArcFace	0.1%	4.0%	98.8%	0.0%	100.0%
   Cosine	FaceNet	1%	0.0%	99.5%	0.0%	97.6%
   Cosine	FaceNet	0.1%	0.0%	98.2%	0.0%	98.9%

   • Values in the table are the proportion of targets whose reconstruction loss is below 1% of the corresponding system threshold; the authors state that binary feedback is sufficient to achieve high-accuracy reconstruction.
   • The baseline is 0% in most settings and at best 4.0%; the authors explain that mismatched points are not uniformly distributed around the sphere center but follow the feature-space distribution, so averaging cannot converge to the true template.

   Query-efficient score attacks (Figure 5, 6, Table I)

   • With input selection (LFW/Cosine, Figure 5): PCA input selection has the lowest loss at every evaluated budget, reaching numerical precision at about 50 queries; relative to the algebraic method with random selection from the target distribution, loss improves by 26%–72% (annotated in the figure); random-distribution equations still have a loss of about 0.14 at 500 queries.
   • Without input selection (LFW/Cosine, Figure 6): the diffusion prior solver consistently outperforms Lagrange, random-equation algebraic, and GMM priors; the authors state that its performance is close to the ideal setting with input selection.
   • Query count summary (Table I): reaching error <1% 所需查询——PCA 输入选择 ≈50，扩散先验（无选择）≈90，而 hill climbing、Lagrange、无选择代数、GMM 均 >500.

   Query-efficient binary attacks (Figure 7, Table I)

   • What was tested: under CelebA/Cosine, three binary reconstruction variants are compared: average mismatched, algebraic solver, and diffusion solver.
   • Results: the algebraic solver requires about 10,000 queries to reach numerical precision, while the diffusion solver requires about 5× fewer queries to reach the same precision (recorded in Table I as ≈2,000); the average baseline initially decreases and then saturates at a nonzero loss.
   • Authors' interpretation: reducing the number of boundary constraints directly reduces the total number of queries, and the diffusion prior can recover an accurate template from fewer constraints.

   Other ablations and analyses

   • Binary search precision P (Figure 3): loss decreases as P increases, and at P=20 almost all targets are below 1% of the threshold; the horizontal axis in the figure is P (5–25), and the vertical axis is SED reconstruction loss (log scale).
   • Mechanism of baseline failure (Figure 4): a 2D PCA illustration shows that newly added mismatched points still fall within the same feature-space distribution, which the authors use to explain why the average baseline cannot reconstruct perfectly.
   • Appendix A (Figure 8–10): curves for all combinations of CelebA/LFW × Cosine/SED are consistent with the trends in the main text.

   Collapse this answer

5. 05What are some points that can be further explored?

   The authors note that the attack relies on assumptions such as black-box access and same-distribution data, and future directions include other biometric modalities and relaxing the extractor assumption.

   Limitations and future directions noted by the authors

   • Strong assumptions (Section VI-d): the attack assumes black-box access to the authentication system and, in some cases, also requires a dataset generated by the same feature extractor; the authors state that robustness under stricter constraints, distribution mismatch, and systems with active query detection mechanisms requires further study.
   • Extension to other modalities (Section VII): the authors propose that future work could extend the attack to biometric modalities beyond faces, such as fingerprint, iris, and voiceprint embeddings.
   • Relaxing the extractor assumption (Section VII): the authors propose studying surrogate feature extractors and relying on cross-model transferability, possibly with the shared representation structure suggested by the Platonic Representation Hypothesis.
   • Defense directions (Section VI-c): the authors propose possible defenses including strictly limiting the number of queries, detecting query sequences that search for the decision boundary, adding random perturbations to returned scores and decisions, introducing controlled uncertainty into matching thresholds, and note that future representations should reduce exploitable geometric information while maintaining accuracy.

   Scope of experiments

   • The feature extractors tested are ArcFace and FaceNet, 2 in total; decision rules are SED and cosine similarity; FMR operating points are 1.0% and 0.1% (Section V-A).
   • Benchmarks are LFW and CelebA, with 300 target identities randomly selected from each benchmark (Section V-A).
   • The binary attack experiment fixes P=20, and baselines are allocated the same number of authentication attempts (Section V-B).
   • The diffusion prior uses a pretrained IDiff-Face model without fine-tuning; the GMM prior is a single-component full covariance (Appendix B).
   • The paper does not report the runtime of each reconstruction, nor the number of repeated experiments or confidence intervals over the 300 targets.

   Collapse this answer

6. 06Summarize the main content of the paper

   The authors state that protected biometric templates can be reconstructed using only binary authentication feedback, and that a distribution prior can reduce the number of queries by about 5×.

   An attack paper targeting biometric template protection, studying whether authentication systems that return only binary accept/reject results still leak enough information to reconstruct the template.

   • Problem: protection mechanisms such as FHE only guarantee that the template is not decrypted during storage and computation, but the authentication interface itself is a side channel; previous attacks all relied on similarity score leakage.
   • Method: the acceptance region of an SED system is a ball, and of a cosine system is a cone; the attacker first finds a point that passes authentication (on average 1/FMR queries), then uses binary search to locate decision boundary points and construct a system of equations to solve. The query-efficient version uses PCA principal components for input selection (score setting), or uses a pretrained IDiff-Face diffusion model as a face prior to replace the algebraic solver (binary setting).
   • Result 1: under all settings of LFW/CelebA, ArcFace/FaceNet, SED/cosine, FMR 1%/0.1%, 97.6%–100% of targets have reconstruction loss below the threshold of 1%, while the average mismatched baseline reaches at most 4.0% (Table II).
   • Result 2: in the score setting, PCA input selection reaches numerical precision in about 50 queries, which the authors state is about 5× fewer than recent score-based attacks (Table I).
   • Result 3: in the binary setting, the diffusion solver reaches error <1%，代数求解器需 > in about 2,000 queries versus 10,000 queries, which the authors state is a reduction of about 5× (Table I).
   • Authors' conclusion: independent of the template protection mechanism, the geometric information exposed by the authentication process itself is sufficient to achieve template reconstruction at numerical precision, and the template distribution can be used to mount more effective attacks; existing privacy-preserving biometric systems may protect less against attackers who can query repeatedly than previously believed.

   Collapse this answer

Related papers