Secure Triplet Loss: Achieving Cancelability and Non-Linkability in End-to-End Deep Biometrics

Abstract

Biometric systems store sensitive personal data that need to be highly protected. However, state-of-the-art template protection schemes generally consist of separate processes, inspired by salting, hashing, or encryption, that limit the achievable performance. Moreover, these are inadequate to protect current state-of-the-art biometric models as they rely on end-to-end deep learning methods. After proposing the Secure Triplet Loss, focused on template cancelability, we now reformulate it to address the problem of template linkability. Evaluated on biometric verification with off-the-person electrocardiogram (ECG) and unconstrained face images, the proposed method proves successful in training secure biometric models from scratch and adapting a pretrained model to make it secure. The results show that this new formulation of the Secure Triplet Loss succeeds in optimizing end-to-end deep biometric models to verify template cancelability, non-linkability, and non-invertibility.

Towards Protecting Face Embeddings in Mobile Face Verification Scenarios

“…Fig. 6 shows the unlinkability plots 19 for the development subset of the Mobio database, separately for our Facenet and Idiap PolyProtected and baseline (unprotected) systems. Due to space restrictions, we show only the unlinkability plots for an overlap of 2, since this was the generally recommended overlap value in Section 4.3, and Table 3 summarises the global D sys ↔ measures for all overlaps.…”

Biometric Template Protection for Neural-Network-based Face Recognition Systems: A Survey of Methods and Evaluation Techniques

“…Examples of BTP methods in this category, include: [43]- [51]. Of these methods, [43], [44], [50], [51] adopt a feature-level approach, where the NN learns a protected template from extracted face features, and [45]- [49] adopt an image-level approach, where the NN is trained in an end-to-end manner to generate the protected template from the face image. A feature-level BTP method can take advantage of robust feature extractors (e.g., pre-trained face recognition models), and it is usually easier to implement/train such methods since the feature extraction part is already taken care of.…”

“…The salting approaches towards incorporating user-specific randomness into the learned protected template, include: [43], [44], [49]. In [43], a pre-trained CNN is used to extract a feature vector from a face image, then the feature vector plus a serial number are passed as inputs to a Recurrent Neural Network (RNN).…”

“…The output of the RNN, corrected via Reed-Solomon error correction, represents the protected template (referred to as a "key"). The approach in [49] uses a modified version of a pre-trained face recognition model to extract a face feature vector, concatenate it with a random key, then pass the result to two fully-connected layers. The NN is trained using a "secure triplet loss" formulation, which aims to: (i) minimise the distance between triplet pairs (of face images) originating from the same identity and the same key, (ii) maximise the distance between triplet pairs originating from the same face identity and different keys, as well as from different face identities and different keys, and (iii) control the amount of "linkability" between protected templates, where "unlinkability" is achieved by ensuring that similar distance values are obtained when comparing protected templates created using different external keys (regardless of whether or not the templates originate from the same identity).…”

“…What makes [48] stand out from the other NNlearned methods, however, is the idea of randomly modifying the actual architecture of the underlying neural network. The methods in [43], [44], [47], [49]- [51] added randomness either to the extracted feature vector or to the outputs of certain layers of the NN, but [48] was the first to consider random activation/deactivation of the NN's neurons. The NN in question (i.e., "randomized CNN") is trained using a "randomised triplet loss", to minimize the distance between templates from the same user generated using the same key and maximize the distance between templates generated using different keys.…”