Biometric data is considered to be very private and highly sensitive. As such, many methods for biometric template protection were considered over the years -- from biohashing and specially crafted feature extraction procedures, to the use of cryptographic solutions such as Fuzzy Commitments or the use of Fully Homomorphic Encryption (FHE). A key question that arises is how much protection these solutions can offer when the adversary can inject samples, and observe the outputs of the system. While for systems that return the similarity score, one can use attacks such as hill-climbing, for systems where the adversary can only learn whether the authentication attempt was successful, this question remained open. In this paper, we show that it is indeed possible to reconstruct the biometric template by just observing the success/failure of the authentication attempt (given the ability to inject a sufficient amount of templates). Our attack achieves negligible template reconstruction loss and enables full recovery of facial images through a generative inversion method, forming a pipeline from binary scores to high-resolution facial images that successfully pass the system more than 98\% of the time. Our results, of course, are applicable for any protection mechanism that maintains the accuracy of the recognition.

翻译：生物特征数据被视为高度私密且极其敏感的信息。因此，多年来人们提出了多种生物特征模板保护方法——从生物哈希和专门设计的特征提取流程，到采用模糊承诺等密码学解决方案或全同态加密（FHE）技术。这些方法面临的一个关键问题是：当攻击者能够注入样本并观察系统输出时，这些方案能提供多大程度的保护。对于返回相似度分数的系统，攻击者可采用爬山攻击等方法；但对于攻击者仅能获知认证尝试是否成功的系统，该问题始终悬而未决。本文证明，仅通过观察认证尝试的成功/失败结果（在能够注入足够数量模板的前提下），确实可能重构出生物特征模板。我们的攻击实现了可忽略的模板重构损失，并通过生成式反演方法实现了面部图像的完整恢复，形成了一条从二进制分数到高分辨率面部图像的完整链路——重构的图像在超过98%的情况下能成功通过系统认证。当然，我们的研究结果适用于任何保持识别准确度的保护机制。