# Mitigate authentication attack risk on cancelable biometrics by leveraging attacker knowledge

Rima Ouidad Belguechi, Christophe Rosenberger

► To cite this version:

Rima Ouidad Belguechi, Christophe Rosenberger. Mitigate authentication attack risk on cancelable biometrics by leveraging attacker knowledge. EURASIP Journal on Information Security, 2025, 10.1186/s13635-025-00198-3. hal-05016207

HAL Id: hal-05016207

https://hal.science/hal-05016207v1

Submitted on 1 Apr 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
RESEARCH

Open Access

<figure><img src="image_2.png" /></figure>

Check for
updates

# Mitigate authentication attack risk on cancelable biometrics by leveraging attacker knowledge

Rima Ouidad Belguechi<fnref n="1" />,<fnref n="2" />* and Chistophe Rosenberger<fnref n="3" />

**Abstract**

According to the EU's General Data Protection Regulation, cancelable biometrics (CB) are essential for protecting biometric templates by combining three important criteria: irreversibility, revocability, and unlinkability. Unfortunately, many works have demonstrated that the distance preserving property, inherent to CB transforms, has permitted to initiate similarity-based attack (SA). Similarity-based attack takes the information leakage between the original distance and the transformed distance and aims at reconstructing a nearby biometric feature, used to gain illegal access to the system. In this paper, we propose to mitigate the SA by mastering the attacker's knowledge that can lead to its success. For the sake of generality, we reformulate SA for unordered set templates and propose a generalized particle swarm optimization strategy to launch the attack. We pointed out that the weak point allowing the SA to operate is the distance score provided by the matching module. To limit the amount of attacker's knowledge, we propose a new matching strategy adapted to all template formats based on similarity ratio score. We have performed experiments and different comparisons on two common databases, from fingerprints and faces, and have proved at each time, the efficiency of the given countermeasure to the threatening SA. Furthermore, the security is discussed when the attacker's knowledge is expanded by additional information as synthetic biometric features, which meant to approximate the initial research space. Recommendations are then given to alleviate such risks at the design level.

**Keywords** Cancelable biometrics, Similarity-based attack, Particle swarm optimization, Countermeasure

## 1 Introduction

As they are widely used in various applications including border control, payment systems, cloud platforms, and smart devices, biometric recognition systems must undergo continuous monitoring to assess potential security and privacy concerns associated with their deployment. In such systems, biometric characteristics are captured using a specific sensor to create a biometric

template, which is stored during the enrollment step. At the verification level, a new template is acquired and compared to the enrolled template, resulting in acceptance or rejection [1]. A significant risk associated with these systems is inverse biometrics, which allows raw data to be reconstructed using the reference template that has been disclosed. Several reconstruction algorithms have been proposed for different modalities [2, 3], with a recent review available in [4]. This capability poses a violation to user privacy, since it can lead to the exposure of sensitive personal information. Additionally, it facilitates masquerade attack, as an adversary can inject a reconstructed template into the communication channel, thus bypassing authentication mechanisms [5]. In this case, unlike traditional security systems, while biometric data is compromised, it cannot be revoked or replaced.

<figure><img src="image_3.png" /></figure>

<footnote>*Correspondence:
Rima Ouidad Belguechi
r政务公开</footnote>

<footnote n="1">¹ Laboratoire LMCS, Ecole nationale Supérieure d'Informatique ESI, Algiers, Algeria</footnote>

<footnote n="2">² Higher Normal School of Constantine, Constantine, Algeria</footnote>

<footnote n="3">³ Université Caen Normandie, ENSICAEN, CNRS, Normandie Univ, GREYC UMR6072, F-14000 Caen, France</footnote>
In contemporary biometric research, ensuring confiden-
tiality of stored biometric data has emerged as a critical
challenge. It is important to note that traditional cryp-
tographic hash functions such as MD5 or SHA-1 are not
well-suited for securing biometric data due to their sensi-
tivity to noise inherent in biometric signals, which arises
from intra-subject variations. Specifically, these functions
produce entirely distinct hash values even for inputs with
minimal variations. Standard cryptographic algorithms
as AES or RSA are also unsuitable as the matching must
be performed in the clear domain, thereby exposing the
template to potential misuse.

Consequently, biometric template protection (BTP)
has emerged as a brand-new field of study, commonly
referred to as biometric privacy-enhancing technolo-
gies (B-PETs), a concept primarily founded in the work
of Jain et al. [6]. Biometric template protection schemes
are broadly categorized into (i) biometric cryptosystems
(known as helper data-based schemes) and (ii) cancela-
ble biometrics (or feature transformation schemes). Bio-
metric cryptosystems permit the generation or binding
of cryptographic keys to the biometric features. A public
information, known as helper data, is then computed and
stored. This helper data ensures that the secure release
of the cryptographic key is only permitted when a legiti-
mate user provides their biometric data for verification.
A recent work is proposed in [7]. In this paper, we focus
on cancelable biometrics (CB) and we refer the reader to
a recent survey for B-PETs established in [8].

Cancelable biometrics (CB) has been introduced to
guarantee privacy by preventing inversion attacks [9]. To
revoke and renew a fresh template, they are conceptu-
alized as a two-factor authentication system that uses a
user-specific key (e.g., random key or a seed).

CB schemes are namely transform-based approaches,
using a transformation function *H*(.), which depends on
a user-specific key *K*. Let *X* be a biometric template and
*Y* its transformed version. A CB scheme can be denoted
by *Y* = *H*(*X*, *K*). *X* is deleted and only the generated
value *Y* will be saved as a reference. Literature commonly
referred to the transformed template *Y* as biohash or

hashcode [10], which is considered as random mappings
of biometric feature. If *Y* is compromised, the revocabil-
ity is ensured by the replacement of the key *K*. In Fig. 1,
we illustrate the architecture of an authentication system
by CB where the verification is done on the transform
space between *H*(*X*, *K*) and *H*(*X̂*, *K*), *X* and *X̂* being
respectively the probe and the query templates.

The ISO/IEC 24745:2022 standard identifies three cri-
teria for biometric information protection: non-invert-
ibility, revocability, and unlinkability. Non-invertibility
means that the retrieval of the raw original biometric
data from the stored protected template is infeasible.
Revocability requires the system to be able to issue a
new protected model to replace the compromised one.
Unlinkability means that several protected templates can
be derived from the same original data without being
matched. In addition to fulfill the previously specified
properties, non-invertibility question requires more
attention. Even if the full-leakage of the biometric sam-
ple X is shown to be computationally difficult, securing
CB schemes also depends on the difficulty of retrieving
any biometric information that may be used to fool the
system. Thus, non-invertibility should be interpreted in
terms of leaking of pseudo-features or pseudo-templates.
The pseudo-feature non-invertibility means the difficulty
of determining a biometric sample X̂ from the protected
template H(X,K) that is not exactly X but would match
within the unprotected system. This prevents the system
from launching the spoof or the replay attack. For the
pseudo-template non-invertibility, it means the difficulty
of determining a biometric sample X̂ from the protected
template H(X,K) such that X̂ does not match X but its
transformed version H(X̂,K) could match H(X,K) in
the protected space. This thwarts an adversary to fool a
legitimate user and gain authentication to the protected
system. It is known in literature as pre-image attack.

1.1 Motivation

Among cancelable biometric schemes, we can cite Bio-
Hashing [11], random projections [12], 2-PMCC [13],
bloom filters [14], and Index-of-Max (IoM) hashing [15]

<figure><img src="image_4.png" /><figcaption>**Fig. 1** Architecture of a cancelable biometric system</figcaption></figure>
as a popular technique. A recent survey on CBs can be found in [16]. These algorithms share the property of similarity preservation, enabling comparison to be performed in the transformed domain while preventing the retrieve of the original template. However, despite two decades of active research in biometric template protection, it still has not been widely adopted in real-world applications. This may be due to a variety of challenges or issues.

* First, CB schemes suffer from performance degradation compared to the baseline system. The transformation function used in CB requires a feature sample to be represented in a vector data format that even handles the intra-subject variations. The feature extraction must be designed in a manner that it generates a fixed-length vector while maintaining a high level of robustness and discrimination. This is more challenging for unordered set representation such as for fingerprints or palmprints. It then becomes a matter of determining an invariant representation in reduced form for the noise, rotation, and translation [17]. A trade-off between performance and security is often introduced by such schemes.

* Second, because it is more difficult to estimate the entropy of biometric templates than passwords or cryptographic keys, it is still challenging to theoretically measure the non-invertibility property of the transformation function *H*(). Consequently, CBs could be vulnerable to various attacks which lead to non-invertibility violation. In Fig. 2, principal reversibility attacks are summarized.

CBs could be harmed by dictionary or brute force attacks [18]. The ARM (Attack Reference Model) pertains

to scenarios where multiple protected templates are compromised. In such cases, attackers might analyze and correlate these templates, to perform cross-matching or generate new templates. A more challenging attack remains the pre-image attack, primarily conducted by similarity-based strategy. Such attack was first launched by Lacharme et al. [19]. Our focus in this study is similarity-based attack. In such attack, the adversary is trying to determine the input that produces a specific hash-value though the similarity score returned by the matcher by using one corrupted template or by correlating multiple templates.

In [20], authors analyze the risk of pre-image attack by considering the distance preserving property as a source of vulnerability in CB schemes. They experimentally demonstrate that an attacker could exploit the distance returned by the matcher to approximate a pseudo-template. The approximation can be performed by genetic algorithms (GA) or particle swarm optimization (PSO) as presented in some works [21–23]. However, as with any attack, claiming vulnerability to a similarity-based attack necessitates defining the threat model. This model outlines the prior information available to the attackers, the knowledge they can derive, and their capability to manipulate sub-modules of the system. In this paper, we utilize the following threat model as a foundational framework for analyzing and addressing the security challenges under consideration:

* Threat model specification: Following the ISO/IEC 30136 standard, we consider an adversary full-disclosed model where the security analysis must consider that an adversary (a) knows the user-specific key *K*, (b) the protected biometric data *Y*, and (c) can execute the sub-modules of the system and get

<figure><img src="image_5.png" /><figcaption>**Fig. 2** Reversibility attacks against CB schemes</figcaption></figure>
access to their outputs. An illustration of this model is given in Fig. 3.

The success of the similarity-based attack stems from information leakage that occurs during the template matching process. In this scenario, the extent of the security breach depends on the amount of information the attacker is able to infer. The objective of this paper is to measure the ability of an adversary when he/she has a partial knowledge of the system in order to provide a more realistic and thorough evaluation of the vulnerability to similarity-based attack. This implies that although the adversary has access to the outputs of the components, the information available is of limited utility. This scenario poses additional challenges as it explores the system resilience to attacks when the adversary possesses only partial knowledge. We demonstrate that, in contrast to prior work of Dong et al. [24], the similarity-based attack would be far less effective when the matching module revealed less information about similarities expressed by Hamming or Euclidean distance as it was used in the previous works [21–24].

## 1.2 Contribution

Together, the contributions of the paper form a cohesive framework that advances the understanding of similarity-based attack (SA). They can be summarized as follows:

1. **Formalization of SA attack:** We provide a comprehensive formalization of SA tailored to unordered set feature representations. This formalization is designed to be universally applicable across various modalities, including fingerprints, palmprints, and finger-knuckle-prints, establishing a reference framework.

2. **Generalized particle swarm attack strategy:** Building on the formalization, we propose a novel gen-

eralized particle swarm attack strategy specifically designed to exploit unordered set features.

3. **Impact of attacker knowledge on SA effectiveness:** We investigate how the attacker's knowledge influences the success of SA. Specifically, we analyze the role of matching scores revealed by the biometric system and consider different pipelines for implementing the matching module.

4. **Experimental validation on fingerprint database:** Through extensive experiments on a fingerprint database, we show that concealing the distances returned by the matcher—which are crucial for decision making—under a global matching score, formulated as the ratio of matched vectors, does not reveal sufficient information about the original distances, rendering SA ineffective in such scenarios. Experiments show that the success rate of the attack moves from 54 to 0% using the new based-ratio matcher.

5. **Proposed matcher design as a countermeasure:** Leveraging the insights from our analysis, we introduce a new matcher design aimed at mitigating SA. This design is validated on the LFW10 face database, demonstrating its effectiveness as a countermeasure.

The paper is organized as follows: In Sect. 2, we give some background and related works on pre-image attacks. Section 3 is dedicated to the proposed methodology. We first formalize the SA for unordered sets templates. The adversary model and our particle swarm attack strategy tailored for unordered sets are also presented. Section 4 is used for the explicit evaluation of the attack on two datasets (FVC2002-DB2 fingerprint and LFW face datasets) considering various scenarios pertaining to the attacker knowledge and validate the suggested countermeasure to SA. We discuss our conclusions in Sect. 5.

<figure><img src="image_6.png" /><figcaption>**Fig. 3** Fingerprint cancelable system vulnerability points considering a full-disclosed threat model</figcaption></figure>
## 2 Related works on pre-image attacks

In the absence of a common metric, non-invertibility is often expressed in terms of computational complexity. In [25], Nagar and Jain defined the coverage-effort metric to measure the relationship between the number of computations (effort) required by an adversary to recover a certain fraction (coverage) of the biometric template. But even, there is no guarantee the attacker would not come up with a new, more potent inversion strategy. Broadly, we can categorize pre-image attacks into two types of strategies: similarity-based and cryptanalysis.

### 2.1 Background

CB schemes also termed as biometric hashing are rendered possible because the distance preserving property in the two spaces, feature and transform.

**Definition 1** A transformation function $H(.)$ is considered as a distance-preservation transformation if there are two thresholds $\tau_C$ and $\tau_p$, respectively in the clear and the protected spaces such that for any two random feature templates $X_1$ and $X_2$ and two distance functions $D_C$ and $D_P$.

$$D_C(X_1, X_2) \leq \tau_C \rightarrow D_P(H(X_1, K), H(X_2, K)) \leq \tau_P$$

and,

$$D_C(X_1, X_2) > \tau_C \rightarrow D_P(H(X_1, K), H(X_2, K)) > \tau_P$$

For example, orthogonal projections used in bloom filters, BioHashing, or IoM hashing permit the conservation of the pairwise squared Euclidean distance.

**Definition 2** Orthogonal transformations are distance preserving ones equivalent to orthogonal projections and eventually a translation. Let $M_k$ being a random matrix generated from the seed $K$, hence:

$$H(X, K) = M_k X + v_k$$

According to Kaski [26], it is demonstrated that the closer the random matrix $M_k$ is to being orthonormal, the more effectively the statistical properties of the feature topology are maintained. Therefore, $M_k$ is orthonormalized using the Gram-Schmidt process before being used by the function $H(.)$.

If the key $K$ is exposed to the attacker, $M_k$ is revealed and pre-image attack can easily be launched by resolving linear equations [27]. For this reason, in CB schemes, the projection is generally followed by a many-to-one mapping. Many-to-one mapping is a procedure where multiple distinct inputs are associated to a single output. A

binarization by thresholding can be considered as a form of many-to-one mapping.

$D_C$ and $D_P$ are functions implemented within the matcher component, which is responsible for comparing biometric templates. When the template is represented as a vector, the comparison is based on either Euclidean distance (for real-valued vectors) or Hamming distance (for bit-valued vectors), depending on the template's type. To maintain the same error rates as the original biometric system, the transformation function $H(.)$ must preserve distances, as outlined in definition 1. It is worth noting that, in contrast to prior work where (see the recent work of Dong et al. [24]) $D_P$ is explicitly defined as the Hamming distance, we have focused on the problem of determining which score the matcher could return. This score represents the weak point that could enable similarity attack (SA). This distinction emphasizes our focus on addressing vulnerabilities related to distance preservation in biometric systems.

### 2.2 Similarity-based attack (SA)

However, even if the many-to-one mapping is used, different recent researches show that it is possible to partially revert the system by making a similarity-based attack (SA) based on an iterative minimization process expressed by the mathematical model in (1):

$$\hat{X} = \operatorname*{argmin}_{\hat{X}} D_P(H(X, K), H(\hat{X}, K)) \quad (1)$$

From a randomly generated first guess $\{\hat{X}_1\}$, new guesses are updated according to the scores of the fitness function $D_P(.)$. $D_P(.)$ is an algorithm-specific distance function.

The pre-image attack is not designed to inverse the original template $X$ but rather to approximate a pseudo-inverse $\hat{X}$ that is not necessarily similar or close to the original feature $X$ being attacked but its transform $H(\hat{X}, K)$ is sufficiently close to the transform $H(X, K)$ that would allow a false acceptance.

Table 1 provides a comparison between the most recent similarity attacks. Dong et al. [20, 21] and Lacharme et al. [19] used successfully genetic algorithms to minimize the model (1) for the most of cutting-edge secure biometrics. Wang et al. [22] incorporated algorithm-specific constraints into the genetic algorithm to enhance its convergence. On face modality, they succeed more effectively than Dong et al. [20, 21]. However, as authors point out, the constraints derived from the transform algorithm may be challenging to acquire. In [28], authors used an iterative hill-climbing process based on perturbation stochastic approximation to partially reverse the enhanced minutiae cylinder code proposed in [29]. Their attack is able to generate a synthetic data which permits a false
<table><caption>**Table 1** Comparison between similarity-based attacks against CB schemes</caption><thead><tr><th>Reference</th><th>Attack</th><th>Template</th><th>Target</th><th>Success</th><th>Countermeasure</th></tr></thead><tbody><tr><td>Dong<br>et al. [20]</td><td>SA using<br>genetic algorithm</td><td>Deep face<br>vector</td><td>BioHashing</td><td>FAR@ET = 85.54%</td><td>No</td></tr><tr><td></td><td></td><td></td><td>NMDSH</td><td>FAR@ET = 69.11%</td><td></td></tr><tr><td></td><td></td><td></td><td>IoM hashing</td><td>FAR@ET = 41.01%</td><td></td></tr><tr><td></td><td></td><td>Iriscode</td><td>Bloom filter</td><td>FAR@ET = 41.01%</td><td></td></tr><tr><td></td><td></td><td>Minutiae<br>vector</td><td>2PMCC</td><td>FAR@ET = 25.62%</td><td></td></tr><tr><td>Wang<br>et al. [22]</td><td>SA using<br>constrained<br>genetic algorithm</td><td>Deep face<br>vector</td><td>IoM<br>BioHashing</td><td>SAR = 99.91%<br>SAR = 72.74%</td><td>No</td></tr><tr><td>Abdullahi<br>et al. [28]</td><td>SA using<br>customized<br>hill-climbing</td><td>Fingerprint<br>EMCC</td><td>EMCC [29]</td><td>FAR@ET = 81%</td><td>Score<br>quantization</td></tr><tr><td>Feng et al.<br>[30]</td><td>SA using<br>perceptron learning</td><td>Face</td><td>BioHashing</td><td>SAR = 85.2%</td><td>No</td></tr><tr><td>Nanwate<br>and Sadhya [23]</td><td>SA using<br>PSO</td><td>Deep face<br>vector</td><td>BioHashing</td><td>FAR@ET = 97.02%</td><td>No</td></tr><tr><td></td><td></td><td>IrisCode</td><td>Bloom filters</td><td>FAR@ET = 11.05%</td><td></td></tr><tr><td>Proposed<br>strategy</td><td>SA using<br>generalized PSO</td><td>Unordered set<br>of vectors</td><td>BioHashing</td><td>SAR = 54%</td><td>Ratio<br>score</td></tr></tbody></table>

acceptance in the protected system. They speculate that this attack strategy could be extensible to all irreversible order-based transforms. Feng et al. [30] proposed an iterative perceptron learning to construct the pre-image or a synthetic real-valued template. The model 1 is then transformed on a perceptron problem based on the Hamming distances of the fitness function. The perceptron is able to estimate the parameters of the function $H(.)$ even if they are unknown to the user (e.g., the thresholds used in the discretization module). In this paper, authors explore more constraints about the knowledge of the attacker. Nanwate and Sadhya [23] proposed a SA scheme by using a particle swarm optimization process to breach biohashing and bloom filters based face and iris cancelable templates.

## 2.3 Cryptanalysis-based attack

This method uncovers vulnerabilities of the transformation algorithm. For example, in [27, 31], attacks on BioHashing are explored. Furthermore, by correlating multiple protected templates generated from the same original template, more information are revealed to guide the inversion process. This strategy called attack via record multiplicity was outlined in [32]. Recently, Belhadj and Moussaoui [33] exploit this idea to attack the original transform scheme proposed by Das et al. in [34]. Ranking-based hashing (IoM) for fingerprint template protection was proposed by Jin et al. in [28]. In [35], Ghammam

et al. propose a reversibility attack against Gaussian random projection of the IoM hashing based on linear programming solver.

## 2.4 Discussion

In contrast to attacks based on cryptanalysis, SA appears to be unavoidable for the majority CB schemes and is more harmful because it is not limited to a single technique since it is based on the common principle of distance correlation. Table 1 highlights the advantage of the proposed attack strategy over existing approaches, particularly its ability to handle any template format. The previous GA or PSO are conventional algorithms limited to processing one vector, which imposes certain applicability constraints. For example, in Dong et al. [21], GA is employed to estimate a set of minutiae represented as a vector of limited size to attack the 2PMCC target CB scheme [13], as directly estimating the set of Minutiae-Cylinder Codes (MCC) is challenging. In this case, the attacker requires both the feature extractor to derive the MCC codes and the transformation function to obtain the protected 2PMCC, increasing the complexity of the attack in terms of prior knowledge. In contrast, our proposed attack does not require access to the feature extractor, simplifying the attack process.

Even though, there are currently few works that address countermeasures against this attack. In [36], authors proposed a new deep biometric hashing, namely Deep Secure
Quantization (DSQ), to address the pre-image attack. A hashnet, takes inputs from the output of a resnet for iris feature extraction and is trained to produce a secure biometric binaries. In [37], authors propose a many-to-one mapping to resist SA attack. Besides, the suggested strategies are not yet sufficient to successfully fend off SA attack and suffer from inherent weakness. A recent review on CB schemes presented in [38] supports this premise. Therefore, it becomes crucial to find a solution on how to increase the security to withstand SA. In the following, we propose a practical solution that minimizes information leakage at the matcher level.

# 3 Proposed methodology

## 3.1 Problem statement

Let a CB transformation function $H(.)$ in a feature space FS that generates hashcodes in the protected template space PS as:

$$Y = H(X, K), X \in FS \text{ and } Y \in PS$$

The matcher takes as input two templates $Y = H(X, K)$ and $\hat{Y} = H(\hat{X}, K)$ with $X, \hat{X} \in FS$. It returns true if $D_P(Y, \hat{Y}) \le \tau_p$ and returns false if $D_P(Y, \hat{Y}) > \tau_p$. $D_P(.)$ is the distance function that quantifies the similarity between two protected templates.

As previously seen, the ultimate goal of the SA attack is to find a pre-image $\hat{X}$ that minimizes the objective function $F(.)$ expressed by the model in Eq. (1). The attack succeeds when $\hat{X}$ could be used in the target or another third-party system to overcome the following decision:

$$D_P(H(X, K), H(\hat{X}, K)) < \tau_p$$

$\hat{X}$ is called the pseudo-inverse of the protected template $H(X, K)$ (or a pre-image). If in addition $D_C(X, \hat{X}) < \tau_C$, $\hat{X}$ is considered as the total inverse of $H(X, K)$. The model (1) corresponds to an optimization problem on the template space TS.

In this study, for the purpose of generality, we consider the feature template to be estimated $X \in FS$ as an unor- dered set of M fixed-size vectors ($M \ge 1$):

$$X \in FS = \{m_i\}; i = 1..M, m_i \text{ a vector of length P (real, integer or bit valued)}$$

<table><caption>**Table 2** Cancelable biometric schemes properties</caption><thead><tr><td>Method</td><td>Modality and dataset</td><td>Biometric feature</td><td>Feature format</td></tr></thead><tbody><tr><td>BioHashing</td><td>FACE LFW10</td><td>InsightFace deep feature</td><td>512-real valued vector</td></tr><tr><td>IoM</td><td>FACE LFW10</td><td>InsightFace deep feature</td><td>512-real valued vector</td></tr><tr><td>Nmdsh</td><td>FACE LFW10</td><td>InsightFace deep feature</td><td>512-real valued vector</td></tr><tr><td>Bloom filters</td><td>Iris Casia</td><td>IrisCodes</td><td>1024 binary vector</td></tr><tr><td>2PMCC</td><td>Fingerprint FVC2002</td><td>MCC</td><td>Unordered set</td></tr></tbody></table>

The protection module converts each vector $m_i$ into a binary vector of size N with $N < P$ taking a seed K as input. It generates the protected template as an unor- dered set:

$$Y \in PS = \{pm_i\}; i = 1..M, pm_i \text{ a binary vector of length N < P}$$

Regardless of the most popular modalities (face, iris, or fingerprints), this description includes the major- ity of templates created for CB schemes as shown in Table 2.

This constraint results a minimization problem which is computational complex. Algorithms created to address this issue rely on evaluating $F(.)$, on fewest number of measurements by using various search tech- niques such as hill-climbing, genetic algorithm, or par- ticle swarm.

## 3.2 Attack strategy formalization

### 3.2.1 Adversary model

Designing the adversary knowledge is necessary for for- mulating the attack. If we were to think of minimizing Eq. (1) as an online process, this would be impossible as in general biometric systems limit the number of trials. To be more realistic, we presume that the SA attack has to be conducted offline where the adversary must have knowledge of (a) the user-specific key K, (b) the pro- tected template Y, (c) the transformation function $H(.)$, and (d) the matching score S.

So far, we have noted that the success of similarity- based attack strategies depend highly on distances returned by the matcher, generally expressed as Ham- ming or Euclidean distances. In [18], Pagnin et al. proved that when the information leakage is based on distance measurements, the reference template can be recovered since it reveals the distance for the original space.

For instance, the genetic algorithm by Dong et al. [21] requires the average Hamming distance score obtained by comparing two protected MCC sets when using fin- gerprints as case study following the matcher in [39].
For Abdullahi et al. [28], the IPSA-M attack strategy (iterative perturbation stochastic approximation) on the MCC fingerprint template is feasible only if the Hamming-based scores of the words (0,1) and (1,0) are available. All in all, these attacks are highly dependent on the type of scores given by the matcher.

To carry out a thorough analysis of similarity-based attack, we propose an attack strategy based on particle swarm optimization (PSO) adapted to unordered set representations. We examine the effectiveness of the minimization process when it is impacted by the loss of some information regarding the matcher outcome. We first explore, as previous works, the score S as Hamming distance score. Then, we propose to limit the attacker's knowledge, by considering the score S as a ratio of matched vectors.

**Remark 1** The ratio of matched vectors S is a measure of similarity between two templates Y and ŶY with $Y \in PS = \{pm_i\}; i = 1..M$ and $\hat{Y} \in PS = \{\hat{pm}_i\}; i = 1..\hat{M}$ as:

$$S = \frac{\text{number of matched pairs } (pm_i, \hat{pm}_i)}{\text{Min}(M, \hat{M})}$$

### 3.2.2 Proposed PSO attack strategy on irreversible unordered-set template

We suggest using PSO rather than GA to handle real valued-features, as it is recognized to be more suitable in this case. The search space is a set of possible feature templates expressed as unordered set which could be structured as a matrix. Some important notations are included in Table 3.

<table><caption>**Table 3** PSO attack strategy specific parameters</caption><thead><tr><th>Notation</th><th>Description</th></tr></thead><tbody><tr><td>Y<sub>z</sub></td><td>Binary matrix of the compromised template of the user z with size MxN</td></tr><tr><td>K<sub>z</sub></td><td>The stolen key of the user z</td></tr><tr><td>H(.)</td><td>Transform function as BioHashing</td></tr><tr><td>F(.)</td><td>Objective function (cost function)</td></tr><tr><td>X&#770;<sub>z</sub></td><td>The matrix representing the estimated feature set with size MxP, P > N</td></tr><tr><td>num.particles</td><td>Particle number in the group</td></tr><tr><td>maxiter</td><td>Max iteration</td></tr><tr><td>X<sup>i</sup>(t)</td><td>Position of particle i at iteration t</td></tr><tr><td>V<sup>i</sup>(t)</td><td>Velocity of particle i at iteration t</td></tr><tr><td>pbest<sup>i</sup></td><td>Best cost value for the particle i</td></tr><tr><td>X<sup>i</sup>(best)</td><td>Position of the particle i that gets the cost pbest<sup>i</sup></td></tr><tr><td>gbest</td><td>Best cost value for the group</td></tr><tr><td>&chi;<sup>gbest</sup></td><td>Position that gets the cost gbest over the population</td></tr><tr><td>&alpha;, &beta;, &gamma;</td><td>Hyperparameters of the model</td></tr></tbody></table>

To control information leakage Algorithm 1, the primary focus is the fitness function F(.) which is associated to the matching score S. The unordered-set template Yz is composed of binary vectors pm<sub>i</sub>, pm<sub>i</sub> ∈ {0, 1}<sup>N</sup>. By using a basic bitwise operation, one can easily estimate the local similarity between two vectors (percentage of equal bits). The first attack strategy, we call AS-Hamming, computes S as the average of local similarities based on Algorithm 2.

**Algorithm 1** SA with PSO on unordered set template

1: **Step 1:** randomly initialize particles

2: For i = 1 to num.particles

3: Initialize X<sup>i</sup>(0) with random uniform matrix MxP

4: **Step 2:**

5: $\forall i : Compute Y^i(t) = H(X^i(t), K_z)$

6: $\forall i : Compute F(Y^i(t), Y_z)$

7: Update pbest<sup>i</sup> : pbest<sup>i</sup> = Min(pbest<sup>i</sup>, F(i))

8: Update gbest

9: $\forall i : Linearize X^i(t)$ as a vector and Update velocity V<sup>i</sup>(t) as:

10: $V^i(t) = \gamma * V^i(t) + \alpha * (X^i(best) - X^i(t)) + \beta * (X^{gbest} - X^i(t))$

11: $\forall i : Assign X^i(t + 1) \leftarrow X^i(t) + V^i(t + 1)$ and reshape as a matrix

12: **Step 3:**

13: If maxiter return gbest elsewise go to step 2.
In the second attack strategy, called AS-Ratio, a global score can be obtained from local similarities by pairing matched vectors. By excluding local similarity bellow a preset threshold $\delta_{local}$, this suggested process selects the remaining highest local similarities while discarding the

duplicates that appear in more than one pair. The global score is the ratio between the number of matched vectors and their total number as shown in Algorithm 3. In Fig. 4, we illustrate the process of the attack process.

<caption>**Algorithm 2** Computation of the cost value $F(Y_z, Y_{\hat{z}})$ for the attack strategy AS-Hamming</caption>

1: **Input** : compromised template $Y_z$ as a binary matrix of size $MxN$, the estimated one $\hat{Y}_z$ with the same size $MxN$
2: **Output** : the similarity score $S$
3:   Constitute the matrix $PScores$ of size $MxM$ containing local similarities between raw vectors in $Y_z$ and $\hat{Y}_z$
4:   Go through $PScores$ and reset all elements where two vectors $i$ or $j$ appears matched several times (keep only the maximum)
5:   $S$ is equal to the arithmetic mean of values in $PScores$

<caption>**Algorithm 3** Computation of the cost value $F(\hat{Y}_z, Y_z)$ for the attack strategy AS-Ratio</caption>

1: **Input** : compromised template $Y_z$ as a binary matrix of size $MxN$, the estimated one $\hat{Y}_z$ with the same size $MxN$, local threshold $\delta_{local}$
2: **Output** : the similarity score $S$
3:   Constitute the matrix $PScores$ of size $MxM$ as $PScores[i, j] = 1$ if Hamming distance between binary vectors $Y_z[i, \cdot]$ and $\hat{Y}_z[j, \cdot]$ is lower than $\delta_{local}$, 0 elsewise.
4:   Go through $PScores$ and reset all elements where two vectors $i$ or $j$ appears matched several times (keep only the first occurrence where $PScores[i, j] = 1$)
5:   The number of pairs $nb_pair$ is equal to number of 1s remaining in $PScores : s = nb_pair * 100/M$

**Remark 2** When we consider distance cost the model (1) is minimized, it is maximized in case of similarity cost.

# 4 Experimental results

## 4.1 Database and experimental setting

The experiments were carried out on fingerprints using the popular FVC2002-DB2 dataset and on the LFW face dataset.

* **FVC2002-DB2 [40]**: this data set is widely used for cancelable biometric evaluation. It contains 100 subjects and 8 impressions per user, collected using optical sensor.

* **LFW [41]**: It consists of 13,233 images of 5749 subjects downloaded from the Web. To make comparison, we adjust the dataset as done by Dong et al. in [20]. The identity which has more than 10 images is

selected, and the first 10 images are chosen to form a new subset denoted as LFW10 and containing 158 users.

Both the feature extraction and protection processes are carried out as follows:

* **Feature extraction for fingerprint**: intern developed software was used to extract the ISO-minutiae templates for all fingerprints. To generate a fixed-length representation for each minutiae, a local rotation-tolerant descriptor that encodes the texture information around it is extracted using the method described in [42]. The dimension of each descriptor is $P = 384$ and is integer-valued vector in the range $[0 - 255]$.

* **Feature extraction for face**: the face feature of LFW10 is extracted by a deep learning model, namely InsightFace [43]. Each feature sample is 512 real-valued vector in the range $[-1, 1]$.

* **Protection module**: the underlying CB scheme used is BioHashing. For fingerprint templates, the
<figure><img src="image_7.png" /><figcaption>**Fig. 4** Illustration of the proposed attack strategy</figcaption></figure>

descriptor of each minutia is projected using a random matrix generated from a user-specific key K. The matrix was first ortho-normalized based on the Gram-Shmidt process. A binarization by thresholding that serves as the many-to-one transformation is done. Thereby, the template representing one fingerprint is formulated as an unordered set of M vectors (i.e., M the number of minutiae belonging to the raw fingerprint) represented in the form of an integer matrix of size $MxP$ which is biohashed to generate a protected template in the form of binary matrix of size $MxN(N \le P)$. For facial feature, BioHashing is applied to the feature vector to produce a 500-bits vector like in [20].

For the attack performance assessment, the following evaluation metrics are used:

*   **FAR (False Acceptance Rate), FRR (False Rejection Rate), and EER (Equal Error Rate) in the stolen token scenario:** The recognition performance of the protected system is computed using the official FVC protocol. Each sample in the subset is compared against the remaining ones of the same finger to obtain the False Rejection Rate (FRR). The first sample of each finger is compared against the first sample of the remaining fingers in the data set, to determine the False Acceptance Rate (FAR). If template T1 is compared against T2, the symmetric comparison T2 (against) T1 is not executed, to avoid correlation in the scores. The evaluation is accomplished regarding the worst-case when the impostor always knows the

user-key K. This is done by using the same random matrix for all users in the database and is known in the literature as the **stolen-token scenario**.

*   **FAR@ET:** FAR@ET represents the false acceptance rate, which occurs when the impostor gains access to the system at the threshold set by the Equal Error Rate (EER).

*   **SAR:** The performance of the attack will be assessed in terms of the success attack rate (SAR) which is the likelihood that the attack breaks a given account. It is computed as the ratio between the number of broken accounts and the total number of attacked accounts.

*   **ΔFAR:** it is recorded using the success attack rate (SAR) by excluding the FAR@ET which indicates the true attack performance.

Figure 5 shows the remaining experimental tests.

## 4.2 Performance evaluation of the target cancelable system

The performance is reported in Table 4 when the hash-code size *N* varies from 180 to 384. The following indicators are considered: Equal-error-rate (EER), FAR@ET, the decision threshold $\tau_p$, and the local threshold of the matching algorithm $\delta_{local}$. As expected, the accuracy increases with hashcode size *N*, from EER = 9.4% to EER = 1.77% up to a maximum length of *N* = 384. To avoid the random matrix becoming a full-rank square matrix and therefore invertible, *N* is chosen inferior to *P* = 384. In our experiments, we adjust the system to *N* = 300 bits, with the more relevant accuracy EER = 3.99% when the local threshold $\delta_{local}$ is equal to 30.
<figure><img src="image_8.png" /><figcaption>**Fig. 5** Sequence of the experimental workflow</figcaption></figure>

<table><caption>**Table 4** Verification accuracy of the protected system in the stolen-token scenario</caption><thead><tr><th>Hashcode size N</th><th>δ<sub>local</sub></th><th>EER threshold τ<sub>p</sub></th><th>EER (%)</th><th>FAR@ET (%)</th></tr></thead><tbody><tr><td>180</td><td>25</td><td>32</td><td>9.4</td><td>9.5</td></tr><tr><td>200</td><td>25</td><td>20.51</td><td>8.01</td><td>7.40</td></tr><tr><td>250</td><td>30</td><td>15.79</td><td>6.47</td><td>6.29</td></tr><tr><td>300</td><td>35</td><td>10.71</td><td>5.38</td><td>5.13</td></tr><tr><td>300</td><td>30</td><td>5.26</td><td>3.99</td><td>5.05</td></tr><tr><td>384</td><td>35</td><td>3.85</td><td>1.77</td><td>1.82</td></tr></tbody></table>

## 4.3 Similarity-based attack efficacy on the unordered-set template

Using both the lost key and the compromised template of a genuine user, the proposed attack has the perspective to estimate a raw template in the form of an integer-valued matrix with size *MxP* (M the minutiae number of the corrupted genuine template) that could potentially be accepted by the decision module after it has been biohashed to a binary template. This is known as preimage or authentication attack. It is worth noting that, comparing to the work of Nanwate and Sadhya [23], this attack is more challenging because instead of simply estimating one vector, a set of vectors needs to be estimated with the unordered property that makes the matching more complex. Following are experiments carried out for each enrolled user in the database:

1. A binary matrix representing the unrolled user is generated from its first impression regarding the process described in Sect. 4.1.

<table><caption>**Table 5** Evaluation for the attack strategy AS-Hamming</caption><thead><tr><th rowspan="2">Hashcode size N</th><th colspan="2">Stolen token attack</th><th colspan="2">AS-Hamming</th></tr><tr><th>-</th><th>FAR@ET</th><th>SAR</th><th>ΔFAR</th></tr></thead><tbody><tr><td>300</td><td>-</td><td>5.05%</td><td>54%</td><td>48.95%</td></tr></tbody></table>

<table><caption>**Table 6** Evaluation for the attack strategy AS-Ratio</caption><thead><tr><th>δ<sub>local</sub></th><th>30 bits</th><th>35 bits</th><th>50 bits</th><th>100 bits</th><th>150 bits</th></tr></thead><tbody><tr><td>FAR@ET of the stolen token attack</td><td>5.05%</td><td>5.13%</td><td>11.17%</td><td>80%</td><td>100%</td></tr><tr><td>SAR</td><td>0%</td><td>0%</td><td>0%</td><td>0%</td><td>100%</td></tr></tbody></table>

2. From random initial templates, launch the PSO algorithm that optimizes solutions based on the returned matching score. At the convergence, the best particle that represents the underlying approximated feature set is produced.

3. Match the generated transformed template with the attacked one and compare the result to the decision threshold τ<sub>p</sub>. The attack succeeds if the score is inferior to τ<sub>p</sub>.

We first evaluate the attack labeled AS-Hamming. Table 5 resumes the obtained results. We can see that the SAR is 54%, which is significantly important. The ΔFAR is enough high with the value of 48.95% making the authentication attack feasible.

Let now investigate the effectiveness of the attack strategy AS-Ratio. We tune the parameter of the PSO with 30 particles and 100 iterations. Table 6 resumes the SAR obtained according to the δ<sub>local</sub> parameter of the matcher
algorithm. For every minutia, this parameter shows the Hamming distance between an estimated vector template and the original one. We see that the system is more vulnerable to the attack the longer a large distance is tolerated. However, we observe that the attack fails when the local threshold decreases SAR = 0%, indicating the requirement for more recovered bits or, in other words, by placing more constraints on the acceptability of a template. In this case, the FAR-based attack is more successful than the similarity-based attack.

In practice, it is important to set $\delta_{local}$ to 30 bits in order to keep the EER of the system as low as possible under the worst case of the stolen-key scenario as seen in Table 4. This experiment demonstrates that, in contrast to the previous work of Dong et al. [21], we are able to find a countermeasure to the similarity-based attack. By hiding local similarities, pre-image attack becomes more complex. Even, there is a correlation between the ratio-based score in both the feature and the template space, the experiments showed that this information is insufficiently useful to determine an accepted template.

Working on attacks, it is important to be forward-thinking. We explore now how much the attack strategy AS-Ratio would be resistant if the attacker's knowledge expands beyond what we witness in the following phase.

## 4.4 Studying the attack strategy efficacy by expanding the attacker's knowledge

In the previous attack, the attacker was not able to determine enough bits in the generated template for the system to be accepted. Thoroughly, more information on the PSO minimization process objective function could help in approximating the required bit-vectors. Consequently, to assist in approaching the solution, the attack strategy might be more threatened considering this proposition:

* **Proposition 1:** Rather than initializing the particles in the PSO algorithm with random values, master synthetic fingerprints are used to generate the first pop-

ulation. This has the advantage of speeding up and bringing the search even closer to the raw templates. We note these attack strategy as **AS-synthetic**. And we initialize it with 10 particles for 100 iterations.

We carried out experiments with the FVC-2002 DB2. There are a total of 100 users which means 100 accounts to break. For the attack **AS-synthetic**, SFinGE synthetic generator from the BioLab of university of Bologna was used to generate 10 different master fingerprints for initializing the first generation. In order to encompass the majority of fingerprint classes, we create ridge patterns with systematic inner loops and whorls as shown in Fig. 6.

Compared to the attack strategy **AS-Ratio**, **AS-synthetic** may start, for certain samples, from a closest first generation. The PSO converges in 100 iterations considered as relatively small cost time, approximately 20 min with a Core i5.

The effectiveness of **AS-synthetic** is reported in Table 7 with the practical hashcode size of 300 bits and a local threshold acceptance distance $\delta_{local}$ set to the comprehensive values of 30 bits and 35 bits. This benchmark puts in advance how the SAR could augment from 0 to 20% or 17% and, with respect to $\delta_{local} = 35$ or $\delta_{local} = 30$ bits. In any case, the attack with the ratio remains less threatening than Hamming distance where the SAR was 54%.

In the previous task, the pre-image search attack addresses the fitness function based on the score returned by the matcher known as the ratio of matched hashcodes.

The given experiments show how much the efficiency of SA attack varies depending on whether it is based on distances or on a ratio that partially put out some useful information. This could be introduced as a countermeasure to mitigate the SAR attack whatever the feature format of the used modality. In order to validate this finding, we suggest in the next section using the same attacking scenarios **AS-Hamming** and **AS-Ratio** considering face-based features.

<figure><img src="image_9.png" /><figcaption>**Fig. 6** Example of synthetic fingerprints</figcaption></figure>
<table><caption>**Table 7** Comparison between AS-Ratio and AS-synthetic</caption><thead><tr><th>Hashcode size N</th><th>δ<sub>local</sub></th><th>AS-Ratio<br>SAR</th><th>AS-Synthetic<br>SAR</th></tr></thead><tbody><tr><td>300</td><td>35 bits</td><td>0%</td><td>20%</td></tr><tr><td>300</td><td>30 bits</td><td>0%</td><td>17%</td></tr></tbody></table>

## 4.5 Validation of the similarity-based attack countermeasure on face database

As a countermeasure to protect hashed templates from the vulnerabilities described in the similarity-based attack, it is possible to apply some sort of settlement to the matching process, such as replacing Hamming distance by ratio score, while maintaining the same

recognition performance. To validate this consideration, the deep facial features $X_z$ are BioHashed into a binary vector of size 500 bits. The comparison between two hashed codes $Y$ and $\tilde{Y}$ is based on Hamming distance. In the stolen-token scenario, the EER of the system is equal to 0.42% at the decision threshold 59.2%. We simulate now the similarity attack based on the precedent PSO strategy while the cost function is Hamming distance. At the decision threshold 59.2%, 64 of the 158 accounts were broken resulting on a SAR = 40.5% and a $\Delta$FAR = 40.08%.

To balance this high success attack rate, we change the matching process so that it returns a ratio score as indicated by Algorithm 4.

**Algorithm 4** Computation of the cost value $F(Y_z, \tilde{Y}_z)$ between two bit-valued vectors using the ratio-based score

1: **Input** : $Y_z$ and $\tilde{Y}_z$ as a binary vectors of size $M$, the local threshold $\delta_{local}$, the division rate $\mu$

2: **Output** : the similarity score $S$

3: $nb_rows \leftarrow \mu$

4: $nb_columns \leftarrow M/\mu$

5: $Y_z\_matrix \leftarrow Y_z.\_reshape(nb_rows, nb_columns)$

6: $\tilde{Y}_z\_matrix \leftarrow \tilde{Y}_z.\_reshape(nb_rows, nb_columns)$

7: Constitute the matrix $PScores$ of size $M \times M$ as $PScores[i; j] = 1$ if Hamming distance between binary vectors $Y_z\_matrix[i, *]$ and $\tilde{Y}_z\_matrix[j, *]$ is lower than $\delta_{local}$, 0 elsewise.

8: Go through $PScores$ and reset all elements where two vectors $i$ or $j$ appears matched several times (keep only the first occurrence where $PScores[i, j] = 1$)

9: The number of pairs $nb_pair$ is equal to number of 1s remaining in $PScores$ : $s \leftarrow nb_pair * 100/nb_rows$

From the previous decision threshold 59.2% which is associated with the size $M$, the local threshold $\delta_{local}$ may be inferred for the size $M/\mu$. The shape of the matrix created from a vector is determined by the value of the parameter $\mu$. We examine two possible values for $\mu$, to evaluate the EER in the stolen-token scenario. Results are given in Table 8.

We simulate now the SAR attack based on the precedent PSO strategy while the cost function is the ratio similarity score. At the decision threshold 20%, only 1 account was broken resulting on a SAR = 0.6% and a negligible $\Delta$FAR which is relatively low compared to the Hamming

distance where the SAR is equal to 40.5% consisting on 64 broken accounts among 158 as depicted in Table 9.

It is clear that the proposed backbone strategy has improved the resistance to the similarity-based attack and could be recommended for cancelable biometric systems whatever the used modality.

## 5 Conclusion and perspectives

In this work, we address the security of cancelable biometrics transforms under similarity-based attack. We explore how the knowledge of the attacker affects the attack effectiveness. Given the fact that the transformation-based

<table><caption>**Table 8** Verification accuracy in the stolen-token scenario for LFW10 dataset and matching ratio score</caption><thead><tr><th>μ</th><th>EER</th><th>δ<sub>local</sub></th><th>EER threshold</th></tr></thead><tbody><tr><td>10</td><td>1%</td><td>15</td><td>30%</td></tr><tr><td>5</td><td>0.08%</td><td>30</td><td>20%</td></tr></tbody></table>

<table><caption>**Table 9** SA evaluation on LFW10 dataset with respect to the matching score returned</caption><thead><tr><th>Matching score</th><th>EER</th><th>SAR</th><th>EER threshold</th></tr></thead><tbody><tr><td>Hamming distance</td><td>1%</td><td>40.5%</td><td>59.2%</td></tr><tr><td>Ratio of matched vectors</td><td>0.08%</td><td>0.6%</td><td>20%</td></tr></tbody></table>
technique is prone to information leakage from distance
preserving properties, the adversary potentially attacks
the system by using the score revealed from the matcher.
Prior works [24] have focused on evaluating similarity-
based attack by considering the matcher score as a meas-
urement based on Hamming distance. We study in this
paper the potential effectiveness of similarity-based attack
in relation to the score expressed for unordered sets by
using a particle swarm generalized approximation strat-
egy. We demonstrate that SA is ineffective when this score
is a ratio rather than a Hamming distance for both finger-
print and facial modalities. This is a new recommendation
for matcher design which is expandable to include fixed-
length representations. Apart from the matcher module,
we consider the knowledge of the attacker augmented by
master synthetic raw biometrics which are provided as
the initial population as opposed to random inputs. This
may allow a certain degree of convergence and brings the
need for more secure protocols and architectures to alle-
viate the risk of synthetic-based attack. In fact, with the
emergence of generative artificial intelligence, synthetic
biometrics become a threat. For future works, we plan to
protect the feature extractor module in a manner that it
will be able to distinguish between a fresh sample and a
replied or generated one.

Acknowledgements

None.

Authors' contributions

B.R.O. wrote the article. R.C. reviewed the manuscript and approved the last version.

Funding

None.

Data availability

Model evaluation was performed on publicly available datasets such finger-
print FVC2002 and Labeled Faces in the Wild (LFW).

Declarations

Competing interests

The authors declare no competing interests.

Received: 31 July 2024 Accepted: 16 March 2025

Published online: 01 April 2025

References

1. A.K. Jain, A. Ross, S. Prabhakar, An introduction to biometric recognition. IEEE Trans. Circ. Syst. Video Technol. **14**(1), 4–20 (2004)

2. J. Galbally, A. Ross, M. Gomez-Barrero, J. Fierrez, J. Ortega-Garcia, Iris image reconstruction from binary templates: an efficient probabilistic approach based on genetic algorithms. Comput. Vision Image Understand **10**, 1512–1525 (2013)

3. A. Mignon, F. Jurie, in *British Machine Vision Conference 2013*, Reconstructing faces from their signatures using rbf regression (2013), pp. 103.1–103.12. https://doi.org/10.5244/C.27.103

4. M. Gomez-Barrero, J. Galbally, Reversing the irreversible: a survey on inverse biometrics. Comput. Secur. **90**, 101700 (2020)

5. G. Mai, K. Cao, P.C. Yuen, A.K. Jain, On the reconstruction of face images from deep face templates. IEEE Trans. Pattern. Anal. Mach. Intel. **41**(5), 1188–1202 (2018)

6. A.K. Jain, K. Nandakumar, A. Nagar, Biometric template security. EURASIP J. Adv. Signal Process **2008**, 1–4 (2008)

7. R. Canetti, B. Fuller, O. Paneth, L. Reyzin, A. Smith, Reusable fuzzy extrac-
tors for low-entropy distributions. J. Cryptol. 34, 1–33 (2021)

8. P. Melzi, C. Rathgeb, R. Tolosana, R. Vera-Rodriguez, C. Busch, An overview of privacy-enhancing technologies in biometric recognition. ACM Comput. Surv. 56(12), 1–28 (2024)

9. N.K. Ratha, J.H. Connell, R.M. Bolle, Enhancing security and privacy in biometrics-based authentication systems. IBM Syst. J. 40(03), 614–634 (2001)

10. S. Rane, Standardization of biometric template protection. IEEE Multimed. **21**(4), 94–99 (2014)

11. A.B.J. Teoh, A. Goh, A.B.J. Ngo, Random multispace quantisation as an analytic mechanism for biohashing of biometric and random identity inputs. IEEE Trans. Pattern Anal. Mach. Intell **28**, 1892–1901 (2006)

12. M. Deshmukh, M.K. Balwant, in *2017 13th International Conference on Signal-Image Technology & Internet-Based Systems (SITIS)*, Generating cancelable palmprint templates using local binary pattern and random projection (IEEE, 2017), pp. 203–209

13. M. Ferrara, D. Maltoni, R. Cappelli, in *2014 International Conference of the Biometrics Special Interest Group (BIOSIG)*, A two-factor protection scheme for mcc fingerprint templates (IEEE, 2014), pp. 1–8

14. C. Rathgeb, F. Breitinger, C. Busch, in *2013 International Conference on Biometrics (ICB)*, Alignment-free cancelable iris biometric templates based on adaptive bloom filters (IEEE, 2013), pp. 1–8

15. Z. Jin, J.Y. Hwang, Y.L. Lai, S. Kim, A.B.J. Teoh, Ranking-based locality sensitive hashing-enabled cancelable biometrics: index-of-max hashing. IEEE Trans. Inf. Forensic Secur. **13**(2), 393–407 (2017)

16. R. Manisha, N. Kumar, Cancelable biometrics: a comprehensive survey. Artif. Intell. Rev. **53**(5), 3403–3446 (2020)

17. A. Ali, V. Baghel, S. Prakash, in *Recent Trends in Image Processing and Pattern Recognition*, An alignment-free fingerprint template protection technique based on minutiae triplets (Springer, 2022). https://doi.org/10.1007/978-3-031-07005-1_16

18. E. Pagnin, C. Dimitrakakis, A. Abidin, A. Mitrokotsa, in *International Conference on Cryptology in India*, On the leakage of information in biometric authentication (Springer, 2014), pp. 265–280

19. P. Lacharme, E. Cherrier, C. Rosenberger, in *2013 International Conference on Security and Cryptography (SECRYPT)*, Preimage attack on biohashing (IEEE, 2013), pp. 1–8

20. X. Dong, Z. Jin, A.B.J. Teoh, M. Tistarelli, K. Wong, On the reliability of cancelable biometrics: revisit the irreversibility. ArXiv abs/1910.07770, (2019)

21. X. Dong, Z. Jin, A. Jin, in *10th IEEE International Conference on Biometrics: Theory, Applications and Systems (BTAS)*, A genetic algorithm enabled similarity-based attack on cancelable biometrics (IEEE, 2019). https://doi.org/10.1109/BTAS46853.2019.9185997

22. H. Wang, X. Dong, Z. Jin, A.B.J. Teoh, M. Tistarelli, in *2021 IEEE Winter Conference on Applications of Computer Vision Workshops (WACVW)*, Interpretable security analysis of cancelable biometrics using constrained-optimized similarity-based attack (IEEE, 2021). https://doi.org/10.1109/WACVW.52041.2021.00012

23. S. Nanwate, D. Sadhya, in *2020 IEEE International Conference on Computing, Power and Communication Technologies (GUCON)*, Similarity attack on cancelable biometric templates using particle swarm optimization (IEEE, 2020)

24. X. Dong, J. Park, Z. Jin, A.B.J. Teoh, M. Tistarelli, K. Wong, On the security risk of pre-image attack on cancelable biometrics. J. King Saud Univ. Comput. Inf. Sci. **36**(5), 102060 (2024)

25. A. Nagar, A.K. Jain, in *1st IEEE Int. Workshop on Information Forensics and Security (WIFS)*, On the security of non-invertible fingerprint template transforms (IEEE, 2009), pp. 81–85. https://doi.org/10.1109/WIFS.2009.5386477

26. S. Kaski, in *1998 IEEE International Joint Conference on Neural Networks Proceedings. IEEE World Congress on Computational Intelligence* (Cat. No.
98CH36227), Dimensionality reduction by random mapping: fast similarity computation for clustering, vol 1 (IEEE, 1998), pp. 413–418

27. Y. Lee, Y. Chung, K. Moon, in *IEEE Workshop on Computational Intelligence in Biometrics: Theory, Algorithms, and Applications*, Inverse operation and preimage attack on biohashing (IEEE, 2009). https://doi.org/10.1109/CIB. 2009.4925692

28. S. Abdullahi, S. Sun, H. Wang, B. Wang, The reversibility of cancelable biometric templates based on iterative perturbation stochastic approximation strategy. Pattern Recogn. Lett. **172**, 221–229 (2022)

29. Q.N. Tran, J.K. Hu, A multi-filter fingerprint matching framework for cancelable template design. IEEE Trans. Inf. Forensic Secur. **16**, 2926–2940 (2021)

30. Y.C. Feng, M.H. Lim, P.C. Yuen, Masquerade attack on transform-based binary-template protection based on perceptron learning. Pattern Recogn. **47**(9), 3019–3033 (2014)

31. A. Nagar, K. Nandakumar, A. Jain, in *Proceeding of SPIE, Electronic Imaging, Media Forensics and Security, Biometric template transformation: a security analysis* (Sans Jose, 2010)

32. C. Li, J. Hu, Attacks via record multiplicity on cancelable biometrics templates. Concurr. Computat. Pract. Exper. **26**(8), 1593–1605 (2013)

33. F. Belhadj, A. Moussaoui, Attack via missed record synchronization on transformation-based fingerprint template protection algorithms. Multimedia Tools Appl. **83**(9), 27543–27563 (2024)

34. P. Das, K. Karthik, B.C. Garai, A robust alignment-free fingerprint hashing algorithm based on minimum distance graphs. Pattern Recogn. **45**(9), 3373–33 (2012)

35. L. Ghammam, K. Karabina, P. Lacharme, K. Thiry-Atighehchi, A cryptanalytic study of two cancelable biometric schemes based on index-of-max hashing. IEEE Trans. Inf. Forensic Secur. **15**, 2869–2880 (2020)

36. Y. Chen, Y. Wo, R. Xie, C. Wu, G. Han, Deep secure quantization: on secure biometric hashing against similarity-based attacks. Signal Process. **154**, 314–323 (2019)

37. B. Wang, Yand Li, J. Wu, Q. Ma, G. Liu, Y. Li, in *2022 International Conference on Computing, Communication, and Intelligent Systems (ICCCIS)*, A secure biometric template protection mechanism against similarity-based attack (IEEE, 2022), pp. 169–175. https://doi.org/10.1109/ICCCIS56430.2022.10037684

38. S.M. Abdullahi, S. Sun, B. Wang, N. Wei, H. Wang, Biometric template attacks and recent protection mechanisms: a survey. Inf. Fusion **103**, 102144 (2024)

39. R. Cappelli, M. Ferrara, D. Maltoni, M. Tistarelli, in *2010 11th International Conference on Control Automation Robotics & Vision*, Mcc: a baseline algorithm for fingerprint verification in fvc-ongoing (IEEE, 2010), pp. 19–23

40. D. Maltoni, D. Maio, A.K. Jain, S. Prabhakar, et al., *Handbook of Fingerprint Recognition*, vol 2 (Springer, 2009)

41. G.B. Huang, M. Mattar, T. Berg, E. Learned-Miller, in *Workshop on Faces in 'Real-Life' Images: Detection, Alignment, and Recognition*, Labeled faces in the wild: a database for studying face recognition in unconstrained environments (2008). https://inria.hal.science/inria-00321923v1

42. R. Belguechi, E. Cherrier, C. Rosenberger, S. Ait-Aoudia, Operational biohash to preserve privacy of fingerprint minutiae templates. IET Biom. **2**(2), 76–84 (2013)

43. J. Deng, J. Guo, N. Xue, S. Zafeiriou, in *Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition*, Arcface: additive angular margin loss for deep face recognition (IEEE, 2019), pp. 4690–4699. https://doi.org/10.1109/CVPR.2019.00482

**Publisher's Note**

Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.