Layer-aware deep feature optimization for privacy-preserving face biometrics with revocable key binding

Abstract

Biometric cryptosystems designed with revocability and session-level renewability must preserve template privacy and maintain reliable authentication despite the inherent variability of biometric data. A key unresolved issue in deep biometric protection is how the embedding should be formed from a network’s final representation for secure cryptographic key binding. This study presents a privacy-preserving face biometric framework in which deep embeddings are transformed into binary revocable templates and bound on the fly to cryptographic keys using a fuzzy commitment scheme with error-correcting codes. This work focuses on revocability and session-level renewability; achieving full ISO/IEC 24745 cancelability (specifically unlinkability and irreversibility) requires a keyed transform and salted-hashed storage, which we identify as essential future work. Holding the trained network and the binding pipeline fixed, three feature-aggregation strategies applied to the final representation are systematically compared, namely Global Average Pooling, Smoothed Flattening, and a dedicated Dense Feature Layer. The resulting templates are combined with Reed–Solomon and Extended Hamming coding schemes to analyse the trade-offs among discriminability, error tolerance, key length, and computational cost. Experiments conducted on the FEI Face Database show that the Dense Feature Layer (a learned non-linear projection) provides a markedly more suitable representation for secure key binding than the non-learned spatial-aggregation alternatives, achieving the best authentication performance among the tested alternatives. At the selected operating point under controlled-acquisition, frontal-face conditions, the protected system achieves a 0% false acceptance rate (95% confidence interval [0%, 0.92%], n = 400) with a 1360-bit bound key while maintaining a genuine acceptance rate of 91.0% with Reed–Solomon coding and 89.75% with Extended Hamming coding in the structurally secure independent-segment configuration, which eliminates key-reuse leakage. On the deployment side, mobile-side binding completes in well under a millisecond for both codes, whereas cloud-side decoding differs sharply: Reed–Solomon requires 15.056 ms per attempt against 0.042 ms for Extended Hamming, a≈ 350 × gap that dominates one-to-many scalability. The results further show that Reed–Solomon coding is preferable for high-security low-scale verification, whereas Extended Hamming coding offers substantially lower cloud-side decoding cost and better scalability for one-to-many identification. Consequently, the relative ranking of the three strategies, rather than the absolute error rates, is the primary transferable finding. Overall, the study provides practical design guidance for jointly selecting CNN feature representations and cryptographic binding mechanisms in secure and privacy-preserving biometric authentication systems.