Biometrics Cracked Using Only 'Accepted/Rejected' Answers: Template Reconstructed with 97.6–100% Accuracy

A face recognition system that only responds 'accepted' or 'rejected' is considered fairly secure: neither a similarity score nor the template itself is ever exposed. A team of researchers — Eliron Rahimi, Margarita Osadchy, and Orr Dunkelman — has shown that this isn't enough. A single bit of feedback per query is enough to reconstruct a protected biometric template almost perfectly: the reconstruction error comes out below 1% of the authentication threshold in 97.6–100% of cases. The preprint is published on arXiv as 2610.25118, with code released on GitHub.

A Leak Through the Interface Itself

Modern biometric systems increasingly protect templates with dedicated mechanisms — the raw face vectors are never stored in the open. But verification still boils down to a comparison: the system accepts a user if similarity to the reference exceeds a threshold. Every 'yes' or 'no' tells an attacker which side of that boundary their probe vector falls on. The authors exploit exactly these geometric constraints of the verification process. A series of carefully chosen queries gradually narrows down the region where the reference template could be, eventually pinning it down to within numerical error.

The paper's main finding is that the result doesn't depend on the template protection scheme at all. The leak doesn't originate in storage — it originates in the authentication process itself. Earlier reconstruction attacks relied on similarity scores returned by the system. Binary systems, which reveal only a decision, were considered significantly more resistant, since a single bit carries far less information. Rahimi and co-authors claim to be the first to push such an attack to a practical result.

How Template Distribution Speeds Up the Attack

The second part of the work addresses the cost of the attack. The number of queries to the system remains the main constraint: real-world services can flag and block suspicious activity. To address this, the authors propose methods for selecting queries based on the distribution of biometric templates. For systems that return scores, this cuts the number of required queries by up to 5x compared to recent attacks. That makes the threat model more realistic: an attacker needs far fewer interactions with the interface.

The third step combines both results. The geometric binary attack is paired with a pretrained diffusion prior for faces. It supplies information about what plausible faces look like and rules out regions where the template clearly cannot be. Query complexity drops by roughly 5x. Here, the generative AI isn't attacking the system directly — it acts as a source of knowledge about the data distribution, making the search far more efficient.

Key Findings

• Binary feedback (accepted/rejected) is sufficient to reconstruct a template. • Reconstruction error is below 1% of the authentication threshold in 97.6–100% of cases. • Distribution-aware query selection cuts the number of queries in score-based attacks by up to 5x. • A pretrained diffusion prior for faces reduces the complexity of the binary attack by roughly 5x. • Reconstruction is possible regardless of the template protection mechanism. • Authors: Eliron Rahimi, Margarita Osadchy, Orr Dunkelman.

What Developers of Biometric Systems Should Change

The main practical takeaway: encrypting or transforming templates in storage does not solve the problem as long as the verification interface can be queried with little to no restriction. Teams building biometric authentication should assess the threat model together with the API itself — how many attempts are allowed, how they're counted at the device, account, and network level, and how sequences of structurally similar queries are detected. Rate-limiting queries and monitoring anomalous sequences become part of template protection, not a secondary measure.

There's a broader lesson too. Diffusion models trained on faces hand attackers ready-made information about data distribution, and every new generative model makes such attacks cheaper. Anyone choosing a biometric protection scheme should test its resilience against attacks using generative priors, not just against classical brute-force and guessing attacks.

The authors stress that the finding points to a fundamental limitation: as long as a system returns a decision, that decision carries geometric information. The leak can only be fully eliminated by reducing the feedback itself and the number of permitted attempts.