Source-linked AI summary
Identity by Design, Demographics by Accident: Demographic Leakage and Suppression in Behavioral Biometric Embeddings
Iyadh Khan, Patrick Nilackshan, Mohamed Aathif, Mohamed Theesan, Sandareka Wickramanayake, Sanka Rasnayaka
TL;DR
Behavioral biometric identity embeddings may expose sensitive demographic attributes, yet comparative evidence on leakage and suppression across BBA settings is limited. This paper audits 11 models across 9 datasets and four modalities, then benchmarks four post-hoc suppression methods. Leakage and suppressibility vary substantially: voice embeddings show high but effectively suppressible leakage, whereas keystroke/touchstroke embeddings show lower leakage that resists sanitization. The results identify embedding geometry, rather than leakage magnitude alone, as the key factor governing suppressibility.
Problem
BBA embeddings may reveal demographic attributes, creating a privacy risk when an adversary accesses the authentication model.
Method
The paper audits demographic leakage and suppression across 11 models, 9 datasets, four modalities, and four post-hoc methods.
Results
Voice embeddings combine high baseline leakage with strong post-hoc suppressibility, whereas keystroke/touchstroke embeddings show moderate leakage but resist suppression.
Takeaways & Limitations
Embedding geometry better explains demographic suppressibility than initial leakage magnitude alone.
Takeaways & Limitations
The audit assumes a passive adversary has access to the deployed authentication model and labeled reference data.
Abstract
from arXiv · showhide
Behavioral biometric authentication (BBA) systems use deep learning models to transform biometric signals, such as eye movements, voice, keystroke/touchstroke dynamics, and gait, into identity embeddings for user authentication. While designed to encode identity, these embeddings may inadvertently reveal sensitive demographic attributes, including gender, age, and height. Consequently, an adversary with access to the authentication model can infer demographic information from biometric signals, including those of users unseen during training or enrollment. In this paper, we present the first systematic audit of demographic leakage in BBA systems, evaluating 11 models across 9 datasets spanning four biometric modalities. We further benchmark four post-hoc suppression methods-Incremental Variable Elimination (IVE), Hilbert-Schmidt Independence Criterion (HSIC), Adversarial Encoder-Decoder (AED), and Protected Attribute Suppression System (PASS) to assess their ability to mitigate demographic leakage while preserving authentication utility. Our analysis reveals substantial variation in leakage and suppressibility across modalities, model architectures, and learning objectives. While voice embeddings exhibit high leakage that can be effectively suppressed, keystroke/touchstroke embeddings exhibit lower leakage but are considerably more difficult to sanitize. These findings highlight a fundamental privacy risk in behavioral biometric authentication and provide insights into the factors governing demographic information suppressibility.
1. Introduction
BBA identity embeddings can retain demographic information, creating privacy risks as behavioral biometrics spread across sensitive applications. This paper addresses limited comparative evidence by auditing leakage and suppression across modalities, models, datasets, and methods.
- Motivation: BBA systems transform behavioral signals into identity embeddings that may also encode demographic attributes unrelated to authentication.The motivating privacy concern spans eye gaze, voice, keystroke/touchstroke dynamics, and gait.
- Research gap: Prior studies largely examine individual modalities, datasets, or privacy techniques, leaving comparative leakage and suppression behavior poorly understood.
- Study scope: The study presents the first systematic audit of demographic leakage and suppression in behavioral biometric authentication.
- Study scope: The audit evaluates 11 authentication models across 9 datasets and four modalities, using probes for gender, age, and height.
- Study scope: Four post-hoc methods are benchmarked by their ability to reduce demographic leakage while preserving authentication utility.The methods are IVE, HSIC, Adversarial Encoder-Decoder, and PASS.
- Central finding: Demographic suppressibility is governed primarily by the geometric organization of demographic information in embedding space rather than initial leakage magnitude.
2. Related Work
Earlier work establishes that behavioral biometric signals and identity representations can reveal demographic and other personal attributes. However, suppression research remains fragmented across modalities, model families, and methods, leaving cross-setting suppressibility unresolved.
- Existing leakage evidence: Eye gaze, gait, keystroke dynamics, speaker-verification embeddings, and face-recognition embeddings have all been associated with recoverable personal or demographic attributes.
- Existing leakage evidence: Prior gait work predicts gender, age, height, and weight from raw signals and handcrafted features, but does not study authentication embeddings or algorithmic suppression.
- Suppression methods: Existing demographic suppression methods aim to reduce attribute predictability while retaining authentication utility and operate directly on learned embeddings.
- Research gap: Prior evaluations are typically limited to one modality, model family, or method, leaving generalization and the relationship between leakage and suppressibility open.
3. Experimental Protocol
The evaluation uses a two-stage protocol: probes measure demographic information in authentication embeddings, then post-hoc methods modify those embeddings and are assessed for privacy and authentication utility. The protocol spans nine datasets, four modalities, multiple model families, and complementary leakage, utility, and trade-off metrics.
- Evaluation protocol: The first stage extracts identity embeddings from biometric signals and trains probe classifiers to predict sensitive demographic attributes.
- Evaluation protocol: The second stage applies suppression methods to embeddings and re-evaluates demographic leakage alongside authentication utility.
- Data and models: The benchmark covers 9 datasets across eye gaze, voice, keystroke/touchstroke, and gait.Gender is evaluated across modalities, while age, height, and weight are evaluated where annotations exist.
- Data and models: Models include EKYT and DeepEye for gaze, ECAPA-TDNN and WavLM for voice, BehaveFormer and Type2Branch for keystroke/touchstroke, and multiple gait architectures.
- Threat model: The threat model assumes a passive adversary with access to a deployed authentication model and labeled reference data who trains demographic probes on extracted embeddings.The probe may be applied to previously unseen users because the authentication model generalizes across users.
- Metrics: Leakage is estimated using the strongest among logistic regression, random forest, XGBoost, and MLP probes, with binary attributes measured against a 50% chance baseline.
- Metrics: Authentication utility is measured by EER, while privacy leakage is measured by demographic probe accuracy before and after suppression.Lower EER indicates better authentication utility.
- Metrics: PVI summarizes attribute predictability and importance, and PIC summarizes the post-suppression privacy-utility trade-off.Positive PIC indicates that relative privacy gain exceeds relative authentication cost.
4. Results and Analysis
Demographic leakage varies across behavioral biometric modalities, datasets, architectures, and training objectives, while suppression effectiveness depends strongly on the underlying embedding geometry. Voice leakage is highly suppressible, whereas keystroke and touchstroke leakage is more resistant and multimodal inputs can make privacy–utility trade-offs harder.
- Cross-modal leakage: Demographic leakage appears across eye gaze, voice, keystroke/touchstroke, and gait embeddings, but its magnitude varies by modality and authentication model.Voice embeddings show the strongest reported leakage, while leakage is also present in gaze, gait, and keystroke systems.
- Training objective and architecture: 70.43% versus 61.93% gender accuracy on OU-ISIR shows that gait model design changes leakage within the same modality.On NUS-IGD, FG-FCN reaches 70.40%, whereas whuGAIT and the standard Transformer remain near chance.
- Suppression effectiveness: Suppression methods interact strongly with authentication models: each method helps in some settings but can provide limited benefit, increase leakage, or reduce authentication utility elsewhere.PASS, HSIC, IVE, and AED differ in which embedding geometries they can sanitize while preserving identity information.
- Suppression effectiveness: 86–94% voice leakage can be almost fully suppressed, whereas 62–69% keystroke and touchstroke leakage remains resistant across all four methods.The results link suppressibility to the geometric organization of demographic information rather than its initial magnitude alone.
- Multimodal input: Multimodal inertial inputs improve authentication but also increase demographic leakage and can make suppression more costly when demographic structure overlaps with identity-relevant information.In BehaveFormer, HSIC and IVE raise EER to 34.95% and 44.71%, respectively, despite stronger leakage reduction in some cases.
- Cross-modal transfer: Methods developed for face or speaker verification reduce demographic leakage across every tested behavioral modality, subject to per-modality validation.Gait results show AED and HSIC lowering NUS-IGD FG-FCN leakage from 70.4% to 62.0% and 58.0%, respectively.
5. Discussion
Demographic suppressibility depends more on embedding geometry than on initial leakage magnitude. Voice embeddings are highly suppressible, whereas keystroke and touchstroke embeddings often trade substantial authentication utility for modest privacy gains.
- Every evaluated model leaks gender above chance, indicating that identity-focused training objectives routinely entangle demographic and identity structure.
- Voice embeddings show the highest baseline leakage yet are the most suppressible, while keystroke and touchstroke embeddings show moderate leakage but resist suppression.AED reduces ECAPA-TDNN leakage from 86.1% to 52.1% and WavLM leakage from 94.8% to 57.0% with near-zero authentication cost; keystroke IVE can raise EER to 35-45% for marginal privacy gains.
- When demographic information occupies a separable embedding subspace, suppression can remove it while preserving identity-discriminative directions.
- Responsible suppression requires characterizing geometric organization, not merely measuring a deployed model’s demographic leakage level.Suggested diagnostics include linear separability probes or principal-direction analysis.
- Gaze and gait often gain privacy at near-zero EER cost, whereas keystroke and touchstroke reach EER ≈46% for modest privacy gains.Pareto-frontier shape represents the privacy–utility exchange rate.
6. Conclusion
The paper audits demographic leakage and post-hoc suppression across behavioral biometric modalities, models, and datasets. It finds that suppression effectiveness varies substantially and is better explained by embedding geometry than by initial leakage magnitude alone.
- The study systematically audits demographic leakage and post-hoc suppression across eye gaze, voice, keystroke/touchstroke, and gait embeddings.
- Demographic leakage appears in every tested model, while metric-learning objectives and stronger authentication training tend to encode more demographic structure.
- Post-hoc suppression methods transfer across behavioral biometric modalities, but their effectiveness varies substantially across settings.
- Demographic suppressibility is better explained by embedding geometry than by initial leakage magnitude alone.