# On the Resilience of Biometric Authentication Systems against Random Inputs

arXiv: https://arxiv.org/abs/2001.04056 · HTML: https://mlsanity.com/paper/2001.04056/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 13 Jan 2020.

## Built on by (most cited first, 6 of 6)

- [On the (In)Feasibility of Attribute Inference Attacks on Machine Learning Models](https://mlsanity.com/paper/2103.07101/) (2021)
- [Defending Touch-based Continuous Authentication Systems from Active Adversaries Using Generative Adversarial Networks](https://mlsanity.com/paper/2106.07867/) (2021)
- [iCTGAN--An Attack Mitigation Technique for Random-vector Attack on Accelerometer-based Gait Authentication Systems](https://mlsanity.com/paper/2210.00615/) (2022)
- [GANTouch: An Attack-Resilient Framework for Touch-based Continuous Authentication System](https://mlsanity.com/paper/2210.01594/) (2022)
- [Dictionary Attack on IMU-based Gait Authentication](https://mlsanity.com/paper/2309.11766/) (2023)
- [Deep Generative Attacks and Countermeasures for Data-Driven Offline Signature Verification](https://mlsanity.com/paper/2312.00987/) (2023)

## Abstract (arXiv)

We assess the security of machine learning based biometric authentication systems against an attacker who submits uniform random inputs, either as feature vectors or raw inputs, in order to find an accepting sample of a target user. The average false positive rate (FPR) of the system, i.e., the rate at which an impostor is incorrectly accepted as the legitimate user, may be interpreted as a measure of the success probability of such an attack. However, we show that the success rate is often higher than the FPR. In particular, for one reconstructed biometric system with an average FPR of 0.03, the success rate was as high as 0.78. This has implications for the security of the system, as an attacker with only the knowledge of the length of the feature space can impersonate the user with less than 2 attempts on average. We provide detailed analysis of why the attack is successful, and validate our results using four different biometric modalities and four different machine learning classifiers. Finally, we propose mitigation techniques that render such attacks ineffective, with little to no effect on the accuracy of the system.