## 4 Experimental Results
### Security Analysis
#### 4.5.1 Resisting Information Leakage Attacks  
In the worst-case scenario, we assume that attackers can obtain intermediate information in our proposed system. Moreover, our algorithm is public to attackers. There are two points where information is leaked as follows: (1) trained network parameters, (2) PV and AD stored in the database. We will analyze the security according to these two points. (1) Trained network parameters: In the trained DNN model, there are a large number of weight and bias parameters, which are used to achieve the mapping of the biometric image to binary code. Since network parameters are only combined with the input biometric image to forward predict binary code, the information of biometric data and bio-key is not revealed from the network parameters. In the case of the known algorithm with network parameters, the attackers can use a large number of imposter samples as input to yield a false acceptance in brute forcing. Actually, this attack exploits the vulnerability of a biometric system in false acceptance. If the system has low distinguishability between genuine and imposter samples, the attacker can easily access the system under a false acceptance. Thus, the FAR of the system under this attack scenario is a satisfactory evaluation metric. To verify this point, we utilize the trained DNN model with parameters to generate binary code under the aforementioned attack. The distributions between genuine and imposter matching distance for all other user samples other than the genuine is considered as the imposter. As shown in Figure 8, it can be seen that the HD distribution of inter-subjects is close to half of the key length. Meanwhile, the HD distribution of intra-subjects is about 15% of the key length. Thus, our model can recognize individuals well when the error-correcting range is set to approximately 15% of the key length. According to the generation rule of BCH codewords, we can make the error-correcting capacity slightly larger than 15% of the key length, which can also maintain the recognition accuracy at FAR = 0. In summary, the error-correcting range of the BCH can recognize individuals in our scheme. In other words, it can be observed that the distributions between the imposter and genuine matching distance are fully distinguishable on ORL, Extended YaleB, and CMU-PIE datasets, specifically, which indicates the FAR is close to zero under this attack. Hence, it proves the false acceptance attack is difficult and biometric information is not leaked in this situation. Figure 7: The distributions of Hamming Distance between the new bio-keys and the old bio-keys for intra-user, applied on (**a**) ORL at \(l=1024\); (**b**) ORL at \(l=2048\); (**c**) Extended YaleB at \(l=1024\); (**d**) Extended YaleB at \(l=2048\); (**e**) CMU-PIE at \(l=1024\); (**f**) CMU-PIE at \(l=2048\). (2) PV and AD stored in the database: In this case, it is assumed that the PV and AD for each user in the database are obtained by attackers. Firstly, the PV is generated by \(RNG\) in the random permutation module, and the binary code \(K\) is randomly shuffled to generate bio-key by using PV. It can be concluded that PV is independent of the binary code and bio-key. Even if the PV is compromised, sensitive biometric information is not leaked. Secondly, the AD is produced from binary codes \(K_{R}\) and \(K\) by using the fuzzy commitment encoder. It is noted that the elements of the \(K_{R}\) and \(K\) follow a uniform distribution. Hence, the attacker cannot infer the element of random binary code through the element correlation of AD. References [24; 25] proposed the statistical attacks to retrieve the biometric data and bio-key by analyzing the correlation of multiple helper data for the same user. However, the extracted binary codes from the same user are independent of each other in our proposed approach. Although multiple ADs are public to the attacker, it is also difficult to retrieve the binary code by using statistical attacks.