Feature Fusion for Template Stability in Biometric Cryptosystems. An Application to Face Biometrics based on Eigen-Models Enrique Argones R´ ua 1 , Emanuele Maiorana 2 , Jos´ e Luis Alba Castro 3 , Patrizio Campisi 2 1 GRADIANT, Galician Research and 2 Department of Applied Electronics, 3 Signal Processing Group, Development Centre in University Roma Tre, Signal Theory and Advanced Telecommunication Via della Vasca Navale 84, Communications Department, Edificio CITEXVI, local 14 00146, Rome, Italy. University of Vigo, Campus Lagoas Marcosende ETSET Campus Lagoas Marcosende, Vigo, Pontevedra, Spain, 36310. 36310, Vigo, Pontevedra, Spain, 36310. Abstract—User’s privacy protection is a very important issue which can seriously affect the usability of a biometric system, and prevent its successful establishment. In order to perform people verification while providing security and privacy to the employed characteristics, several biometric template protection schemes have been recently proposed. Unfortunately, when deploying a biometric cryptosystem, a significant intra-class variability, combined with the lack of enrollment data for estimating the templates’ statistics, may prevent the users’ verification due to the limits on error correction capability of the employed codes. In this paper we propose a feature-level fusion technique which can significantly reduce the intra-class variability of feature- based templates, thus allowing to reach low false recognition rates in protected systems. The benefits of the proposed approach are evaluated over a novel video-based face verification system relying on Universal Background Models and adapted user model eigen-projections. Tests over the BANCA database show good performance of the proposed features for face verification, and improved template protection when the proposed feature fusion approach is applied. I. I NTRODUCTION Security and privacy are among the major concerns which have to be faced when implementing biometrics-based recog- nition systems [1]. In fact, individuals’ biometrics are limited in number, and can be hardly replaced if stolen or copied. Bio- metric data can also reveal significative information regarding people personality and health, or be employed to perform an unauthorized tracking of the enrolled subjects across multiple databases [2], [3]. Template protection is therefore an issue of paramount importance which has to be addressed in the design of a biometric recognition system. In order to improve biometrics’ public acceptance, several approaches, roughly classified into biometric cryptosystems and feature transfor- mation approaches, have been recently proposed in order to secure biometric templates [4],[5]. When implementing a feature transformation approach, a function dependent on some parameters is applied to the input biometrics: invertible functions are employed in salting schemes [6], while one- way functions are conversely used in non-invertible transform approaches [7], [8]. Biometric cryptosystems provide the way to integrate biometrics into cryptographic protocols. They can be divided into key generation [9] and key binding systems [10]. The former generate a person-specific cryptographic key from the acquired features, while the latter combine a secret key with the biometrics during the enrollment phase, generating a protected template which do not allow obtaining any information about the original data. The helper data is then used in the verification phase, in conjunction with the query biometrics, to retrieve the key [11]. In order to cope with the intra-class variability which characterizes the users’ templates, error correcting codes are typically employed in biometric cryptosystems. This is for instance the case of the fuzzy commitment scheme [12], one of the most commonly used key binding scheme, already applied to many different biometric modalities [10], [13], [14], [15]. According to this approach, biometric templates have to be binarized and bind to error correcting codes through a XOR operator, and the Hamming distance is thus employed as the metrics determining the proximity between two biometric templates. Unfortunately, the employed codes have limits in the error correction capability they can provide, being thus difficult to avoid false recognitions in case of users with significant intra-class variability. In this paper we propose a method able to produce highly stable binary biometric templates, which are therefore suitable for the use in a fuzzy commitment scheme, even in case the original features are characterized by a relevant intra- class variability. The proposed feature-level fusion approach is applied to a novel video-based face recognition system. The employed face representation is derived from the use of Universal Background Models (UBM), whose parameters are adapted to generate users’ templates in an eigen-model space [16]. In our case, multiple local UBMs are used to model local biometric features from different regions of the face. User’s biometrics are modeled at each region by the Maximum a Posteriori mean projection coefficients of the adapted user model in an eigen-model space [17]. This method provides a large number of noisy biometric descriptors, characterized