# Multimodal Biometric Template Protection Based on a
## 5 Unlinkability and Revocability Analysis  
### Unlinkability Analysis  
In our unlinkability analysis, we follow the protocol and method proposed in [41]. The \"mated score\" and \"non-mated score\" first have to be calculated and are defined as follows. **Mated sample scores:** This is a score calculated through cross-matching of the same subject. In our case, we use the face-periocular pair \(\mathbf{X}\) of the same user and different permutations and random projection seeds \(\mathbf{r}\). Let the mated CB template pair be \(\mathbf{T}_{\text{m1}}=\text{CSMoFN}(\mathbf{X}_{1},\mathbf{r}_{1})\) and \(\mathbf{T}_{\text{m2}}=\text{CSMoFN}(\mathbf{X}_{1},\mathbf{r}_{2})\). The mated-samples score can then be obtained via \(s=d_{H}(\mathbf{T}_{\text{m1}},\mathbf{T}_{\text{m2}})\), where \(d_{H}\) is the Hamming distance. The mated sample distribution is denoted as \(p(s|H_{m})\), where \(H_{m}\) belongs to the relationship in which both CB templates are mated. **Non-mated sample scores:** The non-mated score is calculated in a similar way but for different subjects. Using a similar notation to that given above, let the non-mated CB template pair be \(\mathbf{T}_{\text{m1}}=\text{CSMoFN}(\mathbf{X}_{1},\mathbf{r}_{1})\), \(\mathbf{T}_{\text{m2}}=\text{CSMoFN}(\mathbf{X}_{2},\mathbf{r}_{2})\). The non-mated scores are then estimated as \(s=d_{H}(\mathbf{T}_{\text{m1}},\mathbf{T}_{\text{m2}})\), and the distribution of the non-mated sample scores is \(p(s|H_{mm})\), where \(H_{mm}\) is when both templates are non-mated. In addition, we use two measures of unlinkability: a local and a global measure. **Local measure \(D_{\leftrightarrow}(s)\)**: This measure represents the likelihood ratio of two score variances, \(D_{\leftrightarrow}(s)=p(H_{m}|s)-p(H_{mm}|s)\in[0,1]\)  
**Global measure \(D_{\leftrightarrow}\)**: Unlike the local measure, this metric evaluates the unlinkability of the overall system independently of the score domain. This measure also has a range of \([0,\,1]\). A CB scheme is judged to ideally satisfy the unlinkability criterion if \(p(H_{m}|s)=p(H_{nm}|s)\). If they are completely separated, the CB templates are fully linkable; in other words, if both the local and global measures are close to zero, the CB scheme is deemed nonlinkable. According to the proposed benchmark protocol in [41], we carried out experiments by generating three CSMoFN hashed vectors with \(m=4096\) and \(q=32\), by using the Pubfig, Facescrub, and YTF datasets with different user-specific seeds. The three distributions, the mated samples score, non-mated samples score, and local measure values are all plotted together in Figure 10. It can be seen that the two score distributions, mated and non-mated, explicitly overlap. Furthermore, the meaning of this demonstrates that CB templates are unlinkable. Furthermore, the global measure \(D_{\leftrightarrow}^{\text{m}}\) of three datasets are 0.056, 0.039, and 0.104, respectively. For each specific linkage score \(s_{i}\), \(D_{\leftrightarrow}(s)=0\) denotes fully unlinkability, while \(D_{\leftrightarrow}(s)=1\) is a fully linkable of two transformed templates. With the significant