Unlinkability

Overview

Unlinkability asks whether two protected records of one person, stored under different keys in two applications, can be matched to each other 2311.04633 §1, §3. The record is a protected biometric template, and the same biometric sample is enrolled in both applications through an encoder that uses a different secret key for each 2311.04633 §3.

The paper's contribution is a number, not a yes or no. It defines a local value D(s) for each comparison score s and a global value D_sys, both in [0, 1]. Both come from two score distributions: pairs of records from the same person (mated) and pairs from different people (non-mated) 2311.04633 §4.1, §4.2. A value of 0 means the records cannot be linked at any score. A value of 1 means they can be linked with near certainty 2311.04633 §4.2. The same definition is applied to schemes built on iris, signature, face and fingervein data 2311.04633 §6.1. The comparison to earlier analyses is covered in Contradictions.

Card: General Framework to Evaluate Unlinkability in Biometric Template Protection Systems.

Variants

These are the parts of the method that you choose, not competing methods.

Score-wise measure D(s)

The measure starts from the likelihood ratio LR(s), the mated density divided by the non-mated density at score s 2311.04633 eq. 4. Multiplying LR(s) by a prior ratio omega gives the posterior odds that the pair is mated, and the difference between the two posterior probabilities is D(s) 2311.04633 eq. 3, eq. 6. The final form is piecewise. D(s) is 0 while the odds are at most 1. Above 1, D(s) = 2x / (1 + x) − 1, where x is the odds 2311.04633 eq. 13. It is continuous at the boundary, never decreases as the score grows, and is defined at every score 2311.04633 app. A.1. Use it to see which score ranges link the records, not only a single figure 2311.04633 §4.1.

System-wide measure D_sys

D_sys is the mated-weighted integral of D(s), normalised by the mated probability 2311.04633 eq. 16, eq. 17, eq. 18. It lies in [0, 1] 2311.04633 app. A.2. It is 1 when the two distributions do not overlap and 0 when they fully overlap 2311.04633 §4.2. If some scores favour non-mated pairs, the distributions must favour mated pairs elsewhere, so D_sys stays above 0 in that case 2311.04633 §4.3. This is the number to report and compare across schemes.

Prior ratio omega

omega is the mated prior divided by the non-mated prior 2311.04633 eq. 6. When the priors are known, use them. When they are not, set omega = 1, which the paper calls the worst case for unlinkability 2311.04633 §4.1. The paper sweeps omega from 0.0001 to 1 and finds that a larger omega gives a larger D(s) at the same score 2311.04633 §6.4.

With N enrolled subjects, the two prior probabilities are 1/N and (N − 1)/N 2311.04633 eq. 14, eq. 15. Taking their ratio gives omega = 1/(N − 1). This follows from those two equations and is not stated in the paper, which says only that omega is at most 1 and equals 1 at N = 2 2311.04633 §4.1.

When to use which

Implementation sketch

The sketch follows the paper's equations and the evaluation protocol. The density estimator is a choice the paper leaves open, so estimate_density is a placeholder. The paper computes the likelihood ratio point-wise 2311.04633 §6.1.

# Local and global unlinkability from two score samples [§4] [§5]
# Input:  mated, nonmated (1-D score samples), omega, grid of scores
# Output: D(s) on the grid, D_sys in [0, 1]

def unlinkability(mated, nonmated, omega, grid):
    # Estimate p(s | H_m) and p(s | H_nm) on the grid [§5 steps 2-3]
    p_m = estimate_density(mated, grid)
    p_nm = estimate_density(nonmated, grid)

    # Likelihood ratio [eq. 4]
    lr = p_m / p_nm

    # Posterior odds, scaled by the prior ratio [eq. 6]
    x = lr * omega

    # Local measure: 0 up to odds of 1, then 2x/(1+x) - 1 [eq. 13]
    d_local = where(x > 1, 2 * x / (1 + x) - 1, 0.0)

    # Where the non-mated density is zero, the limit is 1 [eq. 13] [§6.3]
    d_local[p_nm == 0] = 1.0

    # Global measure: mated-weighted integral, normalised [eqs. 16-18]
    d_sys = integrate(d_local * p_m, grid) / integrate(p_m, grid)
    return d_local, d_sys

Run the sketch once per linkage function, then report the largest D_sys over the functions 2311.04633 §5.

Contradictions

• Fingervein. The paper's measure gives D_sys = 0.92 for block re-mapping. The DET and RTMR analyses it cites call the same system unlinkable, with the EER rising from 1.91 % to 4.48 % 2311.04633 §6.5. The two readings are not reconciled in the paper.
• Face, Hamming weight difference. The reported value is 0.07, and the text then says it rises to 0.08 2311.04633 §6.3 2311.04633 fig. 5. The paper gives both numbers and does not explain the difference.

Pitfalls

• omega = 1 is a worst case, not a neutral default. A larger omega gives a larger D(s) for the same score 2311.04633 §6.4. Report which omega was used.
• Empty non-mated bins. Where the non-mated density is zero, D(s) is set to 1 2311.04633 eq. 13. With a finite sample, empty bins can arise from sampling alone. The paper's strong face-attack claims rest on this rule 2311.04633 §6.3.
• Low-probability scores. For one face score, some values below 0.94 favour mated pairs, yet D_sys is 0.07. The paper says these scores have a mated density below 0.005, so they carry little weight in D_sys 2311.04633 §6.2.
• The worst linkage function sets the value. A system is only as unlinkable as its most linkable function. The paper reports the maximum over functions 2311.04633 §5 2311.04633 §6.3. A single D_sys = 0 does not cover attacks that were not tried.
• Sampling design matters. Mated pairs must come from different keys. Non-mated pairs follow the paper's pairing of one sample with the first sample of other subjects 2311.04633 §5 2311.04633 §6.1. Report the pairing.
• Bin counts and bandwidths are not given. The paper does not state the histogram or kernel settings used for the densities, so results from different implementations may differ 2311.04633 §6.1.
• Results are the authors' own. The numbers on this page are author-reported. The authors' code is under a custom licence from their institution and is not open source, so this page does not use its code. The script was not run for this page.

Lineage

• Builds on the view of unlinkability as a continuous property, from a fuzzy scheme analysis by Buhan et al. 2311.04633 §2.
• Adapts the mated and non-mated analysis of Ferrara et al. and reduces it from three distributions to two 2311.04633 §3.
• Compared against DET- and ROC-based unlinkability analyses by Kelkboom et al. and Piciucco et al. 2311.04633 §2 2311.04633 §6.5.
• Superseded by: not known from the content in this wiki.

Papers

• General Framework to Evaluate Unlinkability in Biometric Template Protection Systems: defines D(s) and D_sys, sets out the evaluation protocol, and reports values for iris, signature, face and fingervein schemes.