# Dictionary Attack on IMU-based Gait Authentication

arXiv: https://arxiv.org/abs/2309.11766 · HTML: https://mlsanity.com/paper/2309.11766/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 8 of its 72 references that are in the map.
- First posted on arXiv 21 Sep 2023.

## Builds on (most cited first, 8 of 8)

- [Implicit Smartphone User Authentication with Sensors and Contextual Machine Learning](https://mlsanity.com/paper/1708.09754/) (2017)
- [Continuous Authentication Using One-class Classifiers and their Fusion](https://mlsanity.com/paper/1710.11075/) (2017)
- [On the Resilience of Biometric Authentication Systems against Random Inputs](https://mlsanity.com/paper/2001.04056/) (2020)
- [Acoustic Gait-based Person Identification using Hidden Markov Models](https://mlsanity.com/paper/1406.2895/) (2014)
- [Defending Touch-based Continuous Authentication Systems from Active Adversaries Using Generative Adversarial Networks](https://mlsanity.com/paper/2106.07867/) (2021)
- [Authenticating users through their arm movement patterns](https://mlsanity.com/paper/1603.02211/) (2016)
- [iCTGAN--An Attack Mitigation Technique for Random-vector Attack on Accelerometer-based Gait Authentication Systems](https://mlsanity.com/paper/2210.00615/) (2022)
- [GANTouch: An Attack-Resilient Framework for Touch-based Continuous Authentication System](https://mlsanity.com/paper/2210.01594/) (2022)

## Abstract (arXiv)

We present a novel adversarial model for authentication systems that use gait patterns recorded by the inertial measurement unit (IMU) built into smartphones. The attack idea is inspired by and named after the concept of a dictionary attack on knowledge (PIN or password) based authentication systems. In particular, this work investigates whether it is possible to build a dictionary of IMUGait patterns and use it to launch an attack or find an imitator who can actively reproduce IMUGait patterns that match the target's IMUGait pattern. Nine physically and demographically diverse individuals walked at various levels of four predefined controllable and adaptable gait factors (speed, step length, step width, and thigh-lift), producing 178 unique IMUGait patterns. Each pattern attacked a wide variety of user authentication models. The deeper analysis of error rates (before and after the attack) challenges the belief that authentication systems based on IMUGait patterns are the most difficult to spoof; further research is needed on adversarial models and associated countermeasures.