Privacy Preserving Biometrics: 2023–2025 Research for Your First Pilot

Privacy preserving biometrics protect users by keeping raw fingerprints, faces, and voice templates hidden from the systems that verify them, using four main method families: encryption based computation (homomorphic encryption and secure multi party computation), proof based verification (zero knowledge proofs), transform based template protection (cancelable biometrics), and statistical perturbation (differential privacy). Each approach trades formal privacy strength against latency, compute cost, or recognition accuracy, and the strongest options align with ISO/IEC 24745 and NIST guidance.

TL;DR:

• Procurement should test irreversibility, unlinkability across deployments, and documented revocation under ISO/IEC 24745, rather than treating encryption at rest as sufficient.
• Use edge processing or cancelable templates for low latency mobile unlocking; reserve homomorphic encryption, secure multiparty computation, or zero knowledge proofs for higher risk checks.
• Before adding cryptography, run a revocation drill, then measure false accept and false reject rates and transaction latency against the unprotected baseline.
• Pair template protection with capture integrity and liveness detection, because spoofed or injected samples can defeat verification before privacy safeguards apply.
• Require independent testing for preimage attacks on cancelable templates, since distance preserving transforms can leak enough information to partially reconstruct the original biometric.

Table of Contents

• Why Biometrics Need Special Protection
• A Taxonomy of Privacy Preserving Biometric Approaches
• Privacy Strength Versus Latency, Cost, and Accuracy
• Standards, Evaluation, and the Questions to Ask
• What We See in Practitioner Pipelines
• Representative Research Findings Worth Tracking
• Integrating Privacy Preserving Biometrics in Real Deployments
• Regulatory Considerations Shaping Design Choices
• Beyond Face and Fingerprint: Newer Modalities
• Where Adoption Is Paying Off Across Industries
• How Privacy Preserving Methods Change the Fraud and Trust Equation
• What to Pilot Now and What Research to Watch
• Resources for Teams Ready to Pilot
• FAQ
• Sources

Why Biometrics Need Special Protection

A password can be reset. A face or fingerprint cannot. That permanence is what separates biometric data from every other credential we rely on for identity verification, and it is why encrypting a database at rest never counts as adequate protection on its own. Once a biometric template leaks, the person behind it carries that exposure for life, across every system that ever matched against the same feature set.

The risk compounds when templates from different databases can be linked to each other. A breached fingerprint template at one bank becomes a cross matching tool against a different provider’s enrollment database, turning a single incident into a standing surveillance risk. ISO/IEC 24745 names three properties that any serious protection scheme has to satisfy:

• Irreversibility: the protected template cannot be inverted back into the original biometric sample.
• Unlinkability: templates generated from the same person for different applications cannot be matched to each other.
• Renewability: a compromised template can be revoked and replaced with a fresh one, the way a credit card number gets reissued.

Three threat models drive most design decisions in this space: a direct server breach exposing stored templates, an insider with legitimate database access who misuses it, and cross matching attacks that link supposedly separate enrollments. Any protection scheme that only addresses the first threat while ignoring the other two is incomplete for production use.

A Taxonomy of Privacy Preserving Biometric Approaches

Six technique families dominate current research and deployment, each solving the exposure problem through a different mechanism.

1. Homomorphic encryption (HE): HE lets a server perform matching computations directly on encrypted templates without ever decrypting them. Schemes like CKKS support the approximate vector arithmetic that face and fingerprint matching require, so a system can compute similarity scores on ciphertext and only the final match decision becomes visible. The cost is computational: HE operations are orders of magnitude slower than plaintext math, which has historically limited HE to smaller scale or batch deployments.
2. Secure multi party computation (MPC): MPC splits the matching task across multiple parties so no single party ever sees the complete template or the complete query in the clear. It suits outsourced matching models where an enrollment server and a verification server are operated independently, trading some network overhead for a reduction in single point of trust.
3. Zero knowledge proofs (ZKP): ZKP lets a party prove that a biometric match occurred, or that an attribute threshold was met, without revealing the underlying template at all. This fits serverless or verifiable checks well, since the verifier learns only the yes or no outcome.
4. Cancelable biometrics: this approach transforms the raw biometric into a distorted version before enrollment and performs matching in that transformed domain. If the transformed template leaks, it can be revoked and regenerated with a new transform, similar to reissuing a card number. The open risk is pre-image attack: a transform that preserves too much distance information between samples can be partially reversed.
5. Differential privacy and perturbation: these methods add calibrated statistical noise to biometric data or features before storage or transmission, including frequency domain approaches applied directly to face images.
6. Federated and edge processing: keeping templates and matching logic on the user’s device, rather than centralizing raw samples, reduces the volume of sensitive data that ever reaches a server at all.

A Computers & Security review covering these approaches finds that HE and MPC remain the most common cryptographic bases across published protocols, while flagging practical deployment gaps that keep many schemes confined to research settings.

Privacy Strength Versus Latency, Cost, and Accuracy

No single approach wins on every axis, which is why selection depends on the use case. Here is how the main families stack up on the dimensions that matter to an engineering or risk team.

• Privacy strength (theoretical guarantees): ZKP and well-designed MPC protocols offer the strongest formal guarantees, since the verifying party learns nothing beyond the match outcome. HE is close behind. Cancelable biometrics and differential privacy offer weaker formal guarantees that depend heavily on implementation quality.
• Computational cost and latency: cancelable biometrics and edge processing are the fastest, often comparable to unprotected matching. HE and MPC carry the heaviest computational burden, though optimized implementations are narrowing that gap.
• Revocability: cancelable biometrics were built specifically for this property. HE and MPC templates can also be revoked if key material is rotated, while raw biometric matching offers no revocation path at all.
• Unlinkability across systems: ZKP and MPC schemes generally resist cross system linking by design, since no shared plaintext template exists to compare. Cancelable schemes need per application transform keys to achieve the same property.
• Impact on recognition accuracy: HE and MPC, when implemented correctly, preserve the underlying matching algorithm’s accuracy. Differential privacy introduces an explicit, tunable accuracy cost as the privacy budget tightens.

For low latency mobile unlocking, edge processing and cancelable biometrics fit best, since they avoid the overhead of cryptographic matching on every attempt. For high security bank authentication, HE, MPC, or ZKP justify their added cost because the stakes of a single compromised session are higher. For large scale one to much identification, such as border or national ID systems, the matching workload against millions of records makes raw HE cost prohibitive without optimization.

One recent optimization shows that path forward: a Blind-Match implementation applies vector splitting and CKKS based HE tuning to one to many matching, reporting improved matching speed alongside high reported accuracy on face and fingerprint datasets. That kind of optimization is what makes HE progressively viable for medium scale identification rather than only small pilot deployments.

Standards, Evaluation, and the Questions to Ask

ISO/IEC 24745 remains the practical benchmark for evaluating any privacy preserving biometric claim, and it should anchor every procurement or research assessment. Compliance means testing irreversibility, unlinkability across separate deployments, and documented renewability procedures, not merely confirming that data sits encrypted on a disk. NIST’s digital identity guidance, including the ongoing SP 800-63 series, complements the ISO standard by framing privacy and risk management expectations for identity systems more broadly.

A useful credibility checklist for evaluating a vendor claim or a research paper:

1. Does the scheme include a formal security proof or a cryptographic argument, rather than only an empirical accuracy number?
2. Is there a published, reproducible evaluation covering latency, false accept and false reject rates, and dataset provenance?
3. Has an independent party tested pre image or reconstruction attacks against the protected template, not just the vendor’s own team?
4. Is the threat model stated explicitly, including whether insider access and cross database linking were considered?
5. Does the scheme demonstrate a working revocation procedure, not just a theoretical renewability claim?

Our technical guide to biometric template protection walks through how to apply this checklist against a real template protection proposal.

Pro Tip: Ask any vendor for a documented pre image attack test result before trusting a “non invertible” claim; a recent analysis found that several distances preserving cancelable schemes leaked enough information to enable partial reconstruction.

What We See in Practitioner Pipelines

Template protection only closes part of the exposure window. A cryptographically sound matching scheme still fails if the capture step itself is compromised, which is why capture integrity and liveness detection have to sit upstream of any privacy preserving matching layer. A perfectly protected template built from a spoofed or injected image protects nothing, since the fraud already succeeded before protection logic ever runs.

We track this interaction closely in our coverage of identity verification failures, and the operational pattern that holds up across fraud teams looks like this:

• Start a pilot with revocation drills, not cryptography: simulate a template compromise and time how long full reissuance takes.
• Measure false accept and false reject rates before and after adding any privacy layer, since some schemes shift that balance.
• Track added latency per transaction, especially for any HE or MPC component introduced into a live authentication flow.
• Escalate to heavier cryptographic approaches only once lighter controls, like cancelable templates and liveness checks, are already proven in production.

Our liveness detection guidance covers the capture side of this pipeline in more depth for engineering teams building it out.

Representative Research Findings Worth Tracking

A handful of recent papers give a concrete sense of where this field stands in practice rather than in theory. The Blind-Match work on HE optimized one to many matching reports strong Rank-1 accuracy alongside meaningfully reduced execution time compared to unoptimized HE, using vector splitting to cut the number of expensive rotation operations.

On the perturbation side, a 2022 paper on frequency domain differential privacy for face recognition proposes allocating a differential privacy budget unevenly across frequency components rather than uniformly, learning which frequencies matter most to recognition accuracy and protecting those less aggressively. The paper reports that this learnable budget approach holds accuracy loss down while still providing a tunable formal privacy guarantee, a meaningful improvement over naive pixel level noise injection.

On the proof based side, a PLOS One study describes a zero knowledge proof based anonymous biometric authentication scheme built for e-health systems, reporting short measured prove and verify times alongside a security analysis supporting anonymity and unlinkability properties. That result matters because ZKP schemes are often dismissed as too slow for production, and this implementation suggests otherwise for at least some use cases.

Together these three results sketch a field moving from purely theoretical guarantees toward measured, reproducible performance, which is exactly the shift that makes piloting these approaches more defensible for engineering teams today than it was even two years ago.

Integrating Privacy Preserving Biometrics in Real Deployments

Moving any of these approaches from a paper to production surfaces integration problems that research benchmarks rarely capture. Banking systems need matching decisions in well under a second at the point of transaction, which puts real pressure on any scheme with heavy cryptographic overhead. Healthcare systems often need to support cross facility verification while keeping patient biometric data from ever leaving a controlled environment, favoring federated or edge first designs. Fintech onboarding flows need to support enrollment at scale across devices with wildly different processing power, which rules out some HE configurations on lower end mobile hardware.

A workable integration pattern that fraud and engineering teams have converged on is hybrid by design: perform feature extraction and initial filtering on the device or at the edge, keeping the raw sample from ever reaching a central server, then apply a cryptographic check such as HE or ZKP only for higher value transactions where the added latency is justified. This limits the performance cost of heavier cryptography to the cases that actually need it.

Key practices worth building into any rollout include running a revocation drill before launch rather than after an incident, documenting the threat model explicitly for audit purposes, and validating that accuracy measured in a lab environment holds up against the device and network diversity of a real user base. Our bank fraud reduction guide covers how these integration patterns play out specifically in financial services deployments.

Regulatory Considerations Shaping Design Choices

Regulation increasingly treats biometric data as a distinct category requiring stronger protection than other personal data, which pushes design decisions toward privacy preserving methods rather than leaving them as an optional enhancement. Under the EU’s General Data Protection Regulation, biometric data used for unique identification is classified as a special category requiring explicit safeguards, which is one reason unlinkability and renewability are not just technical nice to haves but compliance relevant properties.

In healthcare settings in the United States, the Health Insurance Portability and Accountability Act governs how biometric identifiers tied to patient records are protected, adding another layer of obligation on top of any general data protection framework a health system already follows. Industry specific rules compound further: banking regulators generally expect documented risk assessments for any authentication method handling customer funds, and biometric systems are not exempt from that expectation simply because the credential cannot be typed or guessed.

The practical implication for teams building these systems is that compliance documentation and technical design need to develop together rather than compliance being bolted on afterward. A renewability procedure that satisfies ISO/IEC 24745 also tends to satisfy a regulator asking how a biometric credential gets revoked after a breach, which means building for the standard largely builds toward compliance at the same time. Our guide to biometric compliance requirements breaks down how these obligations map across sectors in more detail.

Beyond Face and Fingerprint: Newer Modalities

Privacy preserving techniques are not limited to face and fingerprint systems. Voice biometrics raise their own exposure risk, since a raw voice sample can be used to train a cloning model as easily as it can verify identity, making template protection and on device feature extraction particularly relevant to this modality. Behavioral biometrics, including keystroke dynamics and the rhythm of how someone types or swipes, introduce a different wrinkle: the data is continuously collected rather than captured once at enrollment, which raises the stakes for unlinkability if a behavioral profile is ever compared across unrelated services.

Cancelable transform approaches extend reasonably well to these modalities, since the underlying principle, transform before matching rather than matching on raw features, does not depend on the biometric being visual. Differential privacy also applies naturally to continuous behavioral streams, where noise can be added to timing or pressure measurements without destroying the statistical pattern that makes the modality useful for authentication.

The tradeoffs shift slightly with these newer modalities. Voice samples carry enough information for cloning that capture integrity protections against synthetic audio become as important as template protection itself. Keystroke dynamics, by contrast, carry lower individual re-identification risk than a face template but accumulate linkability risk over time as more behavioral data points get collected. Our guide to piloting keystroke dynamics and our voice cloning detection program both address how teams are adapting protection strategies to these specific modalities.

Where Adoption Is Paying Off Across Industries

Fraud prevention teams in banking have reported the clearest wins from combining template protection with strong liveness detection, since the two controls address different parts of the same attack surface: one protects stored data, the other protects what gets captured in the first place. Fintech onboarding flows that pair cancelable templates with device bound encryption have reduced reliance on knowledge based verification steps that fraudsters could answer using stolen personal data.

Healthcare systems adopting federated or edge first biometric verification have been able to support cross facility patient identification without centralizing raw biometric samples in a single database, limiting the blast radius of any single facility’s breach. Our patient identity verification guide covers how this pattern has taken hold specifically in health administration settings.

Across these sectors, the common thread in successful adoption is sequencing: teams that started with capture integrity and revocation procedures before layering in heavier cryptography saw fewer operational surprises than teams that tried to deploy HE or ZKP first without those foundations in place.

How Privacy Preserving Methods Change the Fraud and Trust Equation

Traditional biometric systems that store or transmit raw templates create a single point of catastrophic failure: one breach exposes a credential that can never be reissued in its original form, and that exposure can propagate to any other system where the same biometric was enrolled. Privacy preserving approaches change that calculus by making the stored or transmitted artifact itself less dangerous if it leaks, whether through encryption, transformation, or proof based verification that never exposes the underlying sample at all.

This shift matters for fraud risk reduction specifically because it closes off the highest severity failure mode rather than just adding friction against lower severity attacks. A revocable, non invertible template turns what would be a permanent credential compromise into an operational inconvenience, closer in impact to a card reissue than to identity theft. User trust follows a similar logic: once people understand that a biometric system cannot leak a reusable copy of their face or fingerprint, resistance to biometric enrollment tends to ease, which is itself a meaningful factor in whether these systems get adopted widely enough to reduce fraud at scale.

The honest caveat is that privacy preserving methods do not eliminate fraud risk on their own; they reduce the severity of a specific failure mode while leaving capture integrity, liveness detection, and operational discipline just as necessary as they were before.

What to Pilot Now and What Research to Watch

Start pilots with revocability drills and capture integrity, not cryptography: prove you can reissue a compromised template before adding HE or ZKP complexity. A practical hybrid pattern worth testing is edge based filtering paired with server side HE or ZKP reserved for high value transactions. Watch for standardization of differential privacy guarantees and continued performance gains in HE and MPC implementations over the next few cycles.

— Carlos Ochoa

Resources for Teams Ready to Pilot

Picking a first approach gets easier with a concrete pilot plan rather than a theoretical comparison, and that is the gap our longer guides are built to close. Our compliance requirements guide walks through the documentation an audit will expect once a privacy preserving scheme is live, and our template protection technical guide breaks down revocation testing step by step.

For teams weighing biometric authentication specifically for financial services, our guide to reducing bank fraud with biometrics lays out the evaluation metrics, from false accept rates to latency budgets, that a pilot program needs to track before scaling past a limited rollout. If your organization handles trading or financial data where cross system privacy signals matter just as much as biometric protection, our partner resource on trading privacy practices offers a useful parallel view from outside the biometrics field. Start with the compliance guide if your next step is audit readiness, or the template protection guide if your next step is a technical proof of concept.

FAQ

Is biometrics an invasion of privacy?

Biometric systems are not inherently invasive, but raw, unprotected biometric storage does create permanent privacy risk because a leaked template cannot be reset like a password. Privacy preserving methods such as cancelable biometrics, homomorphic encryption, and zero knowledge proofs reduce that risk by ensuring the stored or transmitted data cannot be reversed into the original sample, as required by ISO/IEC 24745.

Which US states have biometric privacy laws?

Illinois, Texas, and Washington have each enacted specific biometric privacy statutes governing how organizations collect, store, and use biometric identifiers, with Illinois’s Biometric Information Privacy Act being the most frequently litigated. Several other states have since passed broader consumer privacy laws that include biometric data provisions, so organizations operating across state lines generally need to track requirements per jurisdiction.

Can hackers access your biometrics?

A hacker can access stored biometric data if a system stores raw or weakly protected templates and that database is breached, which is why irreversibility and unlinkability matter so much in system design. Schemes built around homomorphic encryption, zero knowledge proofs, or well designed cancelable transforms are built specifically to make a breached template useless to an attacker, though independent testing has found that some cancelable schemes leak more than intended.

Why are people against biometrics?

Concerns about biometrics generally center on permanence, since a compromised fingerprint or face template cannot be reissued the way a password can, and on the risk of cross system tracking if templates from different services can be linked together. Privacy preserving techniques address both concerns directly through revocability and unlinkability, though adoption of these stronger protections across deployed systems remains uneven.

Sources

• ISO/IEC 24745:2022 – Biometric information protection
• A review of privacy-preserving biometric identification and authentication protocols | Computers & Security
• Blind-Match: Efficient Homomorphic Encryption-Based 1:N Matching for Privacy-Preserving Biometric Identification
• A ZKP-based anonymous biometric authentication scheme for the E-health systems | PLOS One

Recommended

• 21 Day Pilot: Layer Behavioral and Physical Biometrics for Fraud Teams
• Prevent a Biometric Breach: 6 Operational Controls for Identity Teams
• 5 Steps to Pilot Keystroke Dynamics Biometrics for Engineers