Single-Component Privacy Guarantees in Helper Data Systems and Sparse Coding with Ambiguation

TL;DR

This paper examines privacy guarantees in helper data systems and sparse coding, focusing on protecting specific binary properties of biometric feature vectors against leakage.

Contribution

It introduces an analysis of privacy leakage regarding binary properties in biometric template protection methods and discusses parameter settings for enhanced privacy.

Findings

Both approaches can protect sensitive binary variables.

System parameters significantly influence privacy leakage.

The study highlights overlooked privacy aspects in biometric systems.

Abstract

We investigate the privacy of two approaches to (biometric) template protection: Helper Data Systems and Sparse Ternary Coding with Ambiguization. In particular, we focus on a privacy property that is often overlooked, namely how much leakage exists about one specific binary property of one component of the feature vector. This property is e.g. the sign or an indicator that a threshold is exceeded. We provide evidence that both approaches are able to protect such sensitive binary variables, and discuss how system parameters need to be set.

Equations

$$s=\max \{t|q_t\le x\}$$

$$\mathbf{u}=\mathtt{Syn}\psi (\mathbf{x});\widehat{\psi (\mathbf{x})}=\psi (\mathbf{y})\oplus \mathtt{SynDec}(\mathbf{u}\oplus \mathtt{Syn}\psi (\mathbf{y})).$$

$$\mathbf{v}=\phi \left(\mathbf{x}\right)={\psi }_{\lambda }^{\mathrm{stc}}\left(\mathbf{Wx}\right)\in \{-1,0,+1{\}}^L.$$

$$\displaystyle H(V|U)\!=\!\left\{\!\!\!\begin{array}[]{rl}J\mbox{ even}\hfill:&1,\cr J=2t+1,\,m\mbox{ even\hfill:}&h(\frac{1-p_{t}}{2}),\cr J=2t+1,\,m\mbox{ odd \hfill:}&\frac{m-1}{m}h(\frac{1-p_{t}}{2})+\frac{1}{m}.\end{array}\right.\!\!\!\!\!$$

$$H(Z|U)=\frac{2}{m}h\left(mF(-\tau )\right).$$

$$H(Z|\tilde{U})=$$

$$\{\begin{array}{cc}F(-\tau )\le \frac{p_0}{2}:& \frac{2F(-\tau )}{p_0}h(p_0)\\ F(-\tau )>\frac{p_0}{2}:& \frac{2p_0-2F(-\tau )}{p_0}h(p_0)+\frac{2F(-\tau )-p_0}{p_0}h(2p_0).\end{array}$$

$$I(B;U)\approx (N-k)[1-h\left(\frac{1}{2}-\frac{1}{2}(1-2\epsilon {)}^r\right)].$$

$$P_{\mathrm{e}}^{\mathcal{H}}(c)=\mathrm{Pr}[{\psi }_{\tau }^{\mathrm{sbc}}({\hat{X}}_n(c))\ne {\psi }_{\tau }^{\mathrm{sbc}}(X_n(c))|\mathcal{H}].$$

Full text

We provide evidence that both approaches are able to protect such sensitive binary variables, and discuss how system parameters need to be set.

I Introduction

I-A Privacy-preserving storage of biometric enrollment data

Biometric data such as fingerprints and irises cannot be treated as a secret. After all, we leave latent fingerprints on many objects that we touch, and high-resolution photos of faces reveal a lot about our irises. Nonetheless, person authentication based on biometrics is still possible, provided that the verifier performs good liveness detection. In spite of the not-really-secret nature of biometric data there are very good reasons to treat them as confidential. Storing biometric databases in unprotected form would lead to various privacy issues. In this paper we focus on one particular privacy problem: some biometric data reveal medical conditions.

The protection of this kind of data must be as good as the protection of passwords. The attacker model in the case of password storage states that the adversary is an insider, i.e., somebody who has access to cryptographic keys. Furthermore, the standard use case considered in most of the literature dictates that the biometric prover does not have to type long keys or to present a smartcard. This combination of attacker model and use case implies that simply encrypting the confidential data is not an option. The typical solution for passwords is to apply a one-way function and to store the hash of each password. However, this solution does not work for noisy data such as biometrics; one bit flip in the input of the hash function causes 50% bit flips in the output.

Several techniques have been developed for securely storing noisy credentials, also known as template protection, in the above given context: (i) Helper Data Systems (HDS), also known as fuzzy commitment, secure sketch, fuzzy extractor [1, 2, 3, 4]; (ii) Locality Sensitive Hash (LSH) functions [5, 6]; (iii) homomorphic encryption [7, 8]; and most recently (iv) Sparse Coding with Ambiguation (SCA) [9, 10, 11, 12].

I-B Comparison of Template Protection Techniques

The LSH approach is fast but does not give clear privacy guarantees. Homomorphic encryption has excellent privacy, but is computationally expensive. In this paper we will not consider the LSH and homomorphic crypto approach.

The HDS approach is the oldest and is well studied. Nevertheless, the narrow privacy question of protecting one specific aspect of the biometric, which is relevant for the above mentioned medical condition, has not been studied in detail.

The aim of this paper is to compare the privacy properties of the HDS and the SCA approach, in particular the ‘medical condition’ aspect. Here it is important to note that previous work on SCA has focused only on the inability of an adversary to reconstruct the full biometric from the enrollment data; that is not the property we will be looking at in the current paper. Mostly, in the literature, the protection of a vector $\mathbf{x}\in\mathbb{R}^{N}$ is considered. However, often it is the projection of $\mathbf{x}$ onto some fixed direction $\mathbf{v}$ that is relevant, $z=\mathbf{x}\cdot\mathbf{v}$. The range in which $z$ lies can be privacy-sensitive, e.g. the sign of $z$ or whether $z$ is far away from average.

I-C Contributions

We concentrate on one component $x_{n}$ of a to-be-protected random vector $\mathbf{x}$, in particular a binary property $\psi(x_{n})$, which is either the sign or an ‘extremeness’ indicator that checks if $|x_{n}|$ exceeds some threshold. We investigate how much information leaks about $\psi(x_{n})$ through the enrollment data.

• •

In quantizing HDSs high leakage can occur if a bad parameter choice is made. The best choice is to take an even number of quantization intervals, and to subdivide them into two helper data intervals; then there is zero leakage about the sign and the ‘extremeness’.

• •

The Code Offset Method causes negligible leakage.

• •

In the SCA mechanism, leakage about the ‘extremeness’ bit can be made negligibly small by setting the ambiguation noise level larger than the Hamming weight of the sparse ternary representation. This noise has little impact on the performance of the authentication system, since it gets removed in case of a genuine user’s verification measurement.

II Preliminaries

II-A Notation and Terminology

Vectors and matrices are denoted by boldface lower-case ($\mathbf{v}$) and upper-case ($\mathbf{M}$). When there is no distinction between a scalar ($w$), vector ($\mathbf{w}$), or matrix ($\mathbf{W}$), we write $\mathsf{w}$. The notation $\mathbf{m}{\left(j\right)}$ denotes the $j$-th column of $\mathbf{M}$. An enrollment measurement will be written as a vector $\mathbf{x}$, and the verification measurement as $\mathbf{y}$. When a distinction needs to be made between a random variable (RV) and its numerical value, the RV is written in capitals, and the value in lowercase. Expectation over $x$ is denoted as $\mathbb{E}_{x}$. The Shannon entropy of a discrete RV $X$ is denoted as $H(X)$ and is defined as $H(X)\!=\!\sum_{x}p_{x}\log\frac{1}{p_{x}}$. The conditional entropy of $X$ given $Y$ is written as $H(X|Y)$ and is defined as $H(X|Y)\!=\!\mathbb{E}_{y}H(X|Y\!=\!y)$. The mutual information between $X$ and $Y$ is $I(X;Y)\!=\!H(X)-H(X|Y)$. For $p\in[0,1]$ the binary entropy function $h$ is defined as $h(p)=p\log\frac{1}{p}+(1-p)\log\frac{1}{1-p}$. We use the notation $\left[n\right]=\{1,...,n\}$. The superscript $(\cdot)^{\!T}$ stands for the transpose and $(\cdot)^{\!\dagger}$ for pseudo-inverse. The logarithm ‘log’ has base $2$. Bitwise XOR is denoted as $\oplus$. The Heaviside step function is written as $\Theta(\cdot)$.

We will work with the following authentication setting. The Verifier owns an enrolment database of public data $P(c)$ for a set of users $c\in[C]$. In the verification phase he is presented with a vector $\mathbf{y}$ and a user label $c$; his task is to decide if $\mathbf{y}$ is consistent with $P(c)$.

II-B Zero Leakage Helper Data Systems

A HDS in its most general form is shown in Fig. 1(a). The Gen procedure takes as input a measurement $\mathsf{x}$. Gen outputs a secret $\mathsf{s}$ and public Helper Data $\mathsf{u}$, where $\mathsf{x}$, $\mathsf{s}$ and $\mathsf{u}$ can be scalar, vector, or matrix, in general. The helper data is stored in a memory that can be accessed by the adversary. In the reproduction phase, a fresh measurement $\mathsf{y}$ is obtained. Typically $\mathsf{y}$ is close to $\mathsf{x}$ but not identical. The Rec procedure takes $\mathsf{y}$ and $\mathsf{u}$ as input. It outputs $\mathsf{\hat{s}}$, an estimate of $\mathsf{s}$. If $\mathsf{y}$ is sufficiently close to $\mathsf{x}$, then $\mathsf{\hat{s}}=\mathsf{s}$. The ‘Zero Leakage’ (ZL) property is defined as $I(U;S)=0$, i.e., the helper data reveals nothing about the secret. Obviously, $U$ has to leak about $X$, since $U$ is a function of $X$. When $\mathsf{s}=\mathsf{x}$ the HDS is referred to as a Secure Sketch. When $S$ given $U$ has a uniform distribution, the HDS is called a Fuzzy Extractor. If $X$ is a continuum variable, the first step in the signal processing is discretisation. For this purpose, a special ZLHDS has been designed [13, 14, 15] which reduces quantisation errors. The distribution of $X$ needs to be known. After discretisation the Code Offset Method can be applied (Section II-C).

The discretising ZLHDS is shown in Fig. 2. Consider a source $X\in\mathbb{R}$, with $X\sim f(x)$. Let $F$ be the cumulative distribution. The $x$-axis is divided into $J$ quantisation intervals corresponding to the extracted secret $s\in\{0,1,\ldots,J-1\}$. The distribution of $S$ is not necessarily uniform. Let $q_{s}$ be the left boundary of the interval $S=s$. Let $\{p_{s}\}_{s=0}^{J-1}$ denote the probabilities of the $s$-values. Then $F(q_{s})=\sum_{i=0}^{s-1}p_{i}$. Each $s$-interval is equiprobably divided into $m$ sub-intervals (depicted as grayscales in Fig. 2); the helper data $u$ is defined as the index of the sub-interval in which the enrollment $x$ lies. The $s$ and $u$ are computed from $x$ as follows:

[TABLE]

In the limit $m\to\infty$, the helper data can be seen as a quantile $\tilde{u}=\frac{u}{m}\in[0,1)$ within the $s$-interval. It holds that $F(x)=F(q_{s})+\tilde{u}p_{s}$.

II-C *The Code Offset Method [16, 1] *

Consider $\psi(\mathbf{x}),\psi(\mathbf{y})\in\{0,1\}^{N}$. Consider a linear binary error-correcting code with syndrome function ${\tt Syn}:\{0,1\}^{N}\to\{0,1\}^{N-k}$ and syndrome decoding function ${\tt SynDec}:\{0,1\}^{N-k}\to\{0,1\}^{N}$, where $k$ is the message length. The Code Offset Method in its simplest form can be used as a Secure Sketch for any distribution of $X$. The helper data and the reconstruction $\widehat{\psi(\mathbf{x})}$ are defined as follows:

[TABLE]

II-D Sparse Ternary Coding (STC) [17, 10]

The encoder is a mapping $\varphi\!:\!\mathbb{R}^{N}\!\rightarrow\!\{-1,0,+1\}^{L}$, where $L$ may be smaller, equal to, or larger than $N$. The $\varphi(\mathbf{x})$ is a sparse encoding of $\mathbf{x}$; the number of nonzero entries is $S_{t}\ll L$, which is called the sparsity level. The encoder first applies a projection matrix $\mathbf{W}\in{\mathbb{R}}^{L\times N}$ and then element-wise thresholding $\psi_{\lambda}^{\rm stc}$, where $\lambda$ is a parameter, $\psi_{\lambda}^{\rm stc}(q)\triangleq{\rm sign}(q)\Theta(|q|-\lambda)$ (see Fig. 3(a)).

[TABLE]

The threshold $\lambda$ is tuned to get the desired sparsity level $S_{t}$. The decoder produces an estimator for $\mathbf{x}$ as $\widehat{\mathbf{x}}={\mathbf{W}}^{\dagger}\mathbf{v}$.

II-E Sparse Binary Coding (SBC)

Here the thresholding function is $\psi_{\tau}^{\rm sbc}(x)\triangleq\Theta(|x|-\tau)$ (Fig. 3(b)). Given a (raw) feature vector $\mathbf{x}\in\mathbb{R}^{N}$ SBC generates a binary vector $\psi_{\tau}^{\mathrm{sbc}}\left(\mathbf{x}\right)\in\{0,1\}^{N}$.

II-F Binary Coding (BC)

This is the component-wise sign operation (Fig. 3(c)) excluding zeros. Given a (raw) feature vector $\mathbf{x}\in\mathbb{R}^{N}$ the BC simply generates a binary vector $\psi^{\mathrm{bc}}\left(\mathbf{x}\right)=\mathrm{sign}\left(\mathbf{x}\right)\in\{-1,1\}^{N}$.

II-G Sparse Coding with Amibiguation (SCA) [9, 10]

Given a sparse ternary vector $\mathbf{v}=\varphi(\mathbf{x})\in\{-1,0,1\}^{L}$, the ambiguation mechanism $A$ turns $S_{n}$ randomly chosen zero components of $\mathbf{v}$ into a (random) $\pm 1$. The resulting ternary vector $\mathbf{u}=A(\mathbf{v})$ is stored as enrolment data (see Fig. 4), together with the matrix $\mathbf{W}$. The randomly added nonzero components make it prohibitively difficult to reconstruct $\mathbf{x}$ from $\mathbf{u}$, while still allowing a verifier to check if a verification measurement $\mathbf{y}$ is consistent with $\mathbf{u}$.

III Problem formulation

We formally capture the ‘medical condition’ issue as follows. We model the existence of the privacy-sensitive medical condition as a binary function of one of the components of the enrollment measurement $\mathbf{x}\in\mathbb{R}^{N}$. That is, we say that $\psi(x_{n})$ is the quantity that should not leak, for some $n\in[N]$.

We will work with two choices for the function $\psi(\cdot)$ that seem to make sense in our context: (a) $\psi(\cdot)=\psi^{\mathrm{sbc}}_{\tau}(\cdot)$ (see Fig. 3(b)), and (b) $\psi(\cdot)=\psi^{\mathrm{bc}}(\cdot)$ (see Fig. 3(c)). We will assume that the index $n$ is not known to the legitimate parties at the time of enrollment. Otherwise, there is a trivial solution.

We will consider only distributions of $X$ that are symmetric around $X=0$, i.e., even functions $f(x)$. Furthermore we work in the ‘perfect enrollment’ model, which states that there is no measurement noise at enrollment time. In this way we are erring on the side of caution, overestimating the leakage.

IV Results for Helper Data Systems

We zoom in on the relevant component $X_{n}$. We introduce shorthand notation $Z=\psi^{\mathrm{sbc}}_{\tau}(X_{n})$ and $V=\psi^{\mathrm{bc}}(X_{n})$. We write $F$ for the cumulative distribution function of $X_{n}$.

IV-A Leakage from the Quantising HDS

First we look at the sign variable $V$.

Theorem 1**.**

Let the distribution of $X_{n}$ be an even function. Then $H(V)=1$ and

[TABLE]

Proof.

When $J$ is even, it holds that $\Pr[V=1]=\frac{1}{2}$ for any $u$. When $J$ is odd and $m$ is even, it holds for any $u$ that $\Pr[V=1|U=u]=\sum_{n>t}p_{n}=\frac{1}{2}\sum_{n\neq t}p_{n}=\frac{1}{2}(1-p_{t})$. When $J$ is odd and $m$ is odd, the above situation holds for $u\neq\lfloor m/2\rfloor$, but for the one special value of $u$ in the middle we have $\Pr[V=1|U=\lfloor\frac{m}{2}\rfloor]=\frac{1}{2}$. ∎

Next we look at the threshold indicator $Z$. The entropy of $Z$ is given by $H(Z)=h(F(-\tau)+1-F(\tau))$. For symmetric $f(x)$ this reduces to $H(Z)=h(2F(-\tau))$.

Theorem 2 below gives an expression for the entropy of $Z$ given the helper data, in the regime where the threshold $\tau$ lies in the outermost $u$-region (the rightmost grayscale band in Fig. 2), i.e., the medical condition is rare.

Theorem 2**.**

Let $f(x)$ be a symmetric pdf. Let $F(-\tau)<\frac{p_{0}}{m}$. Then

[TABLE]

Proof.

For $u\in\{1,\ldots,m-2\}$ it is certain that $Z=0$. This gives $H(Z|U)=\frac{1}{m}\sum_{w=0}^{m-1}H(Z|U=u)=\frac{1}{m}[H(Z|U=0)+H(Z|U=m-1)]$. Due to symmetry this equals $\frac{2}{m}H(Z|U=0)$. Since $Z$ is a binary RV we have $H(Z|U=0)=h(\Pr[Z=1|U=0])$. Finally we use $\Pr[Z=1|U=0]=p_{0}\cdot\frac{F(-\tau)}{p_{0}/m}$. ∎

Remark: For $m=2$ we see that $H(Z|U)=H(Z)$, i.e., there is no leakage.

It is interesting to note that in the HDS with even J and m=2, the helper data leaks absolutely nothing about V and Z.

One may wonder if $m>2$ is still worth considering. It should be noted that the noise resilience of the HDS improves when the number of subdivisions $m$ is increased. Therefore we cannot exclude that setting $m>2$ can be a good design choice. Theorem 3 below gives a leakage result for the limiting case $m\to\infty$, i.e. the continuum helper data.

Theorem 3**.**

Let $f(x)$ be an even function. Let $F(-\tau)\leq p_{0}$.

[TABLE]

Proof.

We compute $H(Z|\tilde{U})={\mathbb{E}}_{\tilde{u}}H(Z|\tilde{U}=\tilde{u})$. Since $\tilde{u}$ is uniform on $[0,1)$ this evaluates to $\int_{0}^{1}\mathrm{d}\tilde{u}\;H(Z|\tilde{U}=\tilde{u})=\int_{0}^{1}\mathrm{d}\tilde{u}\;h(\Pr[Z=1|\tilde{U}=\tilde{u}])$.

Case $F(-\tau)/p_{0}\leq\frac{1}{2}$. For $p_{0}\tilde{u}\in[F(-\tau,p_{0}-F(-\tau))]$ it is certain that $Z=0$. For all other $\tilde{u}$ we have $\Pr[Z=1|\tilde{U}=\tilde{u}]=p_{0}$.

Case $F(-\tau)/p_{0}>\frac{1}{2}$. For $p_{0}\tilde{u}\in[p_{0}-F(-\tau),F(-\tau)]$ we have $\Pr[Z=1|\tilde{U}=\tilde{u}]=2p_{0}$ (left tail and right tail). For all other $\tilde{u}$ the probability is $p_{0}$. ∎

The relative leakage $[H(Z)-H(Z|\tilde{U})]/H(Z)$ is plotted in Fig. 5. The dependence on $\tau$ looks strange, but three special points can be understood. (i) For $\tau\to\infty$ the continuum helper data completely reveals $Z$; (ii) For $F(-\tau)=p_{0}$ the helper data contains no information about $|x|$ crossing the threshold. That information is contained in $S$, and the ZLHDS has been designed not to leak anything about $S$; (iii) At the intermediate value $F(-\tau)/p_{0}=1/2$ a special symmetry occurs between the left region $S=0$ and the right region $S=J-1$. Due to this symmetry the conditional distribution $Z|\tilde{U}=\tilde{u}$ looks the same for every value of $\tilde{u}$.

Furthermore the leakage is a decreasing function of $J$, since at large $J$ the two tail regions $S=0$ and $S=J-1$ have less influence.

IV-B Leakage from the Code Offset Method

Even if the quantising HDS does not reveal $V$, the helper data from the Code Offset Method may still do. Typically the sign $V\in\{-1,1\}$ gets turned into a bit value somewhere in the binary string that serves as input to the COM.

We use notation as in Section II-C. Consider uniform $\psi(X)\in\{0,1\}^{N}$, and helper data $U={\tt Syn}\,\psi(X)$. At fixed $u\in\{0,1\}^{N-k}$, there are $2^{k}$ strings $x$ that are consistent with $u$, and all of them have equal probability. The marginal distribution for one component of $\psi(X)$ is uniform; hence there is no leakage about $V$.

The above reasoning no longer applies when $\psi(X)$ is non-uniform. Then the $2^{k}$ strings compatible with $u$ are not uniform. However, the number of strings summed over in the computation of the marginal is exponentially large; for most ‘normal-looking’ $\psi(X)$-distributions the marginal of one component will still be close to uniform.

Finally we briefly depart from the perfect enrollment setting and investigate the effect of measurement noise at enrollment time on the privacy properties of the COM. Suppose there exists a ‘true’ biometric $B\in\{0,1\}^{N}$, which is shielded from our view by enrollment noise $G$. The enrollment measurement yields $B\oplus G$. Then the relevant privacy question is how much is leaking about (parts of) $B$, as opposed to $B\oplus G$.

Proposition 1**.**

Let the enrollment noise $G$ be bitwise iid Bernoulli noise with bit error rate $\varepsilon$. Let $r$ be the row weight of the error correcting code. Let $U={\tt Syn}(B\oplus G)$. Then

[TABLE]

Proof.

$I(B;U)=H(U)-H(U|B)=H(U)-H({\tt Syn}\,B\oplus{\tt Syn}\,G|B)$ $=H(U)-H({\tt Syn}\,G)$. We use $H(U)\leq N-k$. In a good code the redundancy $N-k$ is just slightly larger than the entropy of the syndrome ${\tt Syn}\,G$. We estimate the entropy of ${\tt Syn}\,G$ by setting it close to the Gallager bound [18], $H({\tt Syn}\,G)\approx(N-k)h(\alpha)$, where $\alpha$ is the bit error probability of $r$ binary symmetric channels concatenated together, $\alpha=\frac{1}{2}-\frac{1}{2}(1-2\varepsilon)^{r}$. ∎

For reasonable values of the row weight, we see that the leakage $I(B;U)$ is very small, approximately $(N-k)\frac{(1-2\varepsilon)^{2r}}{2\ln 2}$; and this is leakage about the whole vector $B$.

V Results for Sparse Coding with Ambiguation

V-A Method

We consider $C$ users. Each user $c\in[C]$ has a measurement vector $\mathbf{x}(c)$; it consists of $N$ components which are modeled as zero-mean unit-variance Gaussian variables. The enrolment of the vectors $\mathbf{x}(1),\ldots,\mathbf{x}(C)$ is as described in Section II-G. The public data for user $c$ is $\mathbf{W}(c),\mathbf{u}(c)$.

We consider a verification vector $\mathbf{y}\in\mathbb{R}^{N}$, which is allegedly from user $c$. It is either a noisy version of the enrolled $\mathbf{x}(c)$ or completely unrelated to it (but drawn from the same distribution). The former case is referred to as Hypothesis ${\cal H}_{1}$, the latter as ${\cal H}_{0}$. We write $\mathbf{y}^{\rm auth}(c)=\mathbf{x}(c)+\mathbf{z}$, with Gaussian noise $\mathbf{z}\sim\mathcal{N}\left(\mathbf{0},\sigma_{Z}^{2}\mathbf{I}\right)$. The verification procedure works as follows. The verifier computes $\mathbf{u}(c)\!~{}\!\cdot~{}\psi^{\rm stc}_{\lambda}(\mathbf{W}(c)\mathbf{y})$. If this inner product exceeds a threshold, then he decides on ${\cal H}_{1}$, otherwise ${\cal H}_{0}$. The expression $\psi^{\rm stc}_{\lambda}(\mathbf{W}(c)\mathbf{y})$ is essentially an STC ‘enrollment’ of $\mathbf{y}$ without ambiguation noise. Taking the inner product with $\mathbf{u}(c)$ is meant to remove the ambiguation noise from $\mathbf{u}(c)$ (we call this ‘purification’), and it results in a similarity score.

The goal of the SCA mechanism is to prevent recovery of $\mathbf{x}$ and the corresponding $\psi(x_{n})$ from the enrolment data while enabling a verifier to check if $\mathbf{y}$ is consistent with enrolment data $\mathbf{u}(c)$. We can characterize the performance of SCA in terms of:

(i) preservation of mutual information between $\mathbf{X}$ and $\widehat{\mathbf{X}}$ in the authorized case, i.e. $I(\mathbf{X};\widehat{\mathbf{X}}|\mathcal{H}_{1})\rightarrow H(\mathbf{X})$, whilst in the unauthorized case $I(\mathbf{X};\widehat{\mathbf{X}}|\mathcal{H}_{0})\rightarrow 0$. The same holds for a function of $\mathbf{X}$, i.e., $I(\psi(X_{n});\psi(\widehat{X}_{n})|\mathcal{H}_{1})\rightarrow H(\psi(X_{n}))$ and I\big{(}\psi(X_{n});\psi(\widehat{X}_{n})|\mathcal{H}_{0}\big{)}\rightarrow 0.

(ii) Reconstruction error: We investigate the error probabilities

[TABLE]

Let $p\triangleq{\rm Pr}[\psi^{\rm sbc}_{\tau}(X_{n})=1]$, $p<\frac{1}{2}$. Ideally it should hold that $P_{\rm e}^{{\cal H}_{1}}\rightarrow 0$ and $P_{\rm e}^{{\cal H}_{0}}\rightarrow 2p(1-p)$. The latter expression is for random $\widehat{X}_{n}$ independent of $X_{n}$, with the same distribution.

V-B Performance results

We consider a database $\mathbf{X}$ of $C=100,000$ random vectors (individuals) with dimensionality $N=256$, which are generated from the distribution $\mathcal{N}(\mathbf{0},\sigma^{2}_{X}\mathbf{I})$. We then generate the noisy version of $\mathbf{X}$ with two different noise variances $\sigma^{2}_{Z}=0.4\sigma^{2}_{X}$ and $\sigma^{2}_{Z}=0.8\sigma^{2}_{X}$. We consider square matrix $\mathbf{W}$, i.e., $L=N$.

We look at the error probability averaged over the users and the components, $\overline{P}_{\mathrm{e}}^{\mathcal{H}}=\frac{1}{CN}\sum_{n=1}^{N}\sum_{c=1}^{C}P_{\mathrm{e}}^{\mathcal{H}}(c)$.

Fig. 7 shows the averaged error probability $\overline{P}_{e}^{\mathcal{H}}$ as a function of the ambiguation ratio $\frac{S_{n}}{L-S_{t}}$, for fixed $\sigma_{X}^{2}=0.5$, $\tau=\sigma_{X}$ and different sparsity ratios $\alpha_{t}\triangleq S_{t}/L=0.025,0.1,0.3,0.5$ and measurement noise variances $\sigma_{Z}^{2}=0.4\sigma_{X}^{2},0.8\sigma_{X}^{2}$. Several things are worth noting.

• •

For the un-enrolled case (random $\mathbf{y}$), the error probability in guessing the privacy bit $Z$ increases as a function of the ambiguation ratio. This is as expected.

• •

In the genuine user case the situation is more complex; the ambiguation noise interferes with the measurement noise.

• •

There is a clear gap between the genuine user case and the un-enrolled case. The low111 Note that the False Negative probability for the overall user matching is much lower than the single-component reconstruction error. (and in some plots nearly constant) error rate for genuine users demonstrates that the ‘purification’ correctly removes the ambiguation noise.

Furthermore we compute the leakage $I(\mathbf{W},\mathbf{U};Z)/H(Z)$. Fig. 8(a) shows what happens when $\mathbf{W}$ is set to the trivial value $\mathbf{W}=\mathbf{I}$. The leakage decreases from 100% to zero with increasing ambiguation. The curve seems to consist of three ambiguation ratio regimes, with piecewise linear behaviour: $0-0.25$, $0.25-05$ and $0.5-1$. At the moment we are not able to explain this behaviour.

Fig. 8(b) shows what happens when a less trivial matrix $\mathbf{W}$ is used, namely the PCA transform matrix of the matrix $[\mathbf{x}(1)\cdots\mathbf{x}(C)]$. This same $\mathbf{W}$ is used for all users. We again observe piecewise linear behaviour with the same three intervals. However, the middle piece is no longer constant but increasing. More importantly, the leakage is reduced by orders of magnitude. Fig. 8(b) also shows the leakage from Sparse Binary Coding with ambiguation; it is slightly smaller than for the ternary case.

V-C Non-square projection matrix

We briefly discuss the case $L>N$, i.e. the number of random projections is larger than the dimension of $\mathbf{x}$. The adversary is confronted with an ambiguized ternary vector $\mathbf{u}$, and from it has to guess the $\mathbf{v}=\psi^{\rm stc}_{\lambda}(\mathbf{Wx})$ by guessing which locations in $\mathbf{u}$ contain the ambiguation noise. When $L$ is larger than $N$, the adversary may be able to distinguish between wrong guesses and the correct guess, as follows. For a wrong guess it will typically hold that $WW^{\dagger}\mathbf{v}_{\rm wrong}$ is far away from $\mathbf{v}_{\rm wrong}$, while on the other hand it holds that $WW^{\dagger}\mathbf{v}\approx\mathbf{v}$. From the correct $\mathbf{v}$ an estimator for $\mathbf{x}$ is then obtained as $\widehat{\mathbf{x}}=W^{\dagger}\mathbf{v}$. Hence, information-theoretically speaking, there is no privacy protection. However, the amount of effort in going through all the possible guesses scales as ${S_{t}+S_{n}\choose S_{n}}$, which is huge. The security is computational, not information-theoretic.

VI Discussion

For quantizing HDSs we have established that there is a clearly identifiable optimal choice for protecting the $V$ and $Z$ bits: taking the number of quantization intervals to be even, and setting $m=2$. However, for noise tolerance it is advantageous to set $m$ as large as possible. The $Z$-leakage result for $m\to\infty$ (Fig. 5) has some caveats. It is nice that a minimum exists at $F(-\tau)=p_{0}/2$ and $F(-\tau)=p_{0}$, but unfortunately the operational meaning of $\tau$ is not really well defined. A small shift of $\tau$ has little impact on the concept “this variable is abnormally far from zero”, but has a large effect in Fig. 5. It is left as a topic for future work to study this further.

There are no such subtleties for the Code Offset Method. We think we can safely conclude that the COM has only negligible leakage.

For the SCA approach we have established that there is a clear gap between how much you know about $Z$ if you do and do not have access to a matching verification measurement $\mathbf{y}(c)$. (Not having such access means trying to reconstruct $Z$ from the public data.) This is visible as a gap (Fig. 7) in the error probability for reconstructing $Z$, and as low mutual information $I(\mathbf{W},\mathbf{U};Z)$ in Fig. 8(b). Determining the leakage about sign($X_{n}$) is left for future work. Other topics for future work are further experimentation with different choices of the projection matrix $\mathbf{W}$ and understanding the piecewise linear shape of the leakage curve.