Source-linked AI summary
FBAN: A Fully Homomorphic Encryption Compatible Bottleneck Attention Network for Privacy-Preserving Behavioral Authentication
Jichao Xiong, Atsuko Miyaji, Jiageng Chen
TL;DR
Continuous authentication can leave sessions exposed after entry-point verification, while protecting sensitive behavioral data during inference remains a challenge. FBAN combines a TFHE-compatible bottleneck-attention model with an encrypted-inference workflow; experiments report competitive accuracy on two datasets and cryptographic protections, with latency intended for supplementary re-verification.
Problem
Entry-only authentication leaves an unlocked session vulnerable to short-term unauthorized use, while existing CA lacks privacy protection for sensitive behavioral data.
Source: §1 · pp. 2–3Method
FBAN uses a bottlenecked attention design and floating-point pretraining followed by integer-only quantization-aware training for TFHE encrypted inference.
Source: §1 · p. 3Results
TouchPitfalls and Touchalytics results show competitive accuracy across Pretrain, QAT, and TFHE; analysis gives privacy-in-use and replay and impersonation protections, with TFHE settings at ≥128-bit security.
Source: §7 · p. 18, §6.6 · p. 18Takeaways & Limitations
FBAN's lightweight encrypted inference is positioned for periodic or risk-triggered re-verification rather than the instantaneous primary unlock.
Source: §5.2 · p. 15, §7 · p. 18Bootstrapped-FHE latency confines the intended use to supplementary periodic or risk-triggered re-verification rather than instantaneous primary unlocking.
Source: §5.2 · p. 15
Abstract
from arXiv · showhide
Continuous authentication (CA) strengthens session security by repeatedly verifying the user during device interaction, yet it inherently relies on highly sensitive behavioral traces (e.g., fine-grained touch dynamics) that are often outsourced to cloud/edge services for scalable inference. This raises a fundamental privacy-in-use challenge: protecting behavioral features during computation, not only in transit or at rest. Fully homomorphic encryption (FHE) offers a principled solution, but deploying modern CA models under FHE remains difficult due to non-linearities and attention-style operations that incur high ciphertext cost. We propose FBAN, a TFHE-compatible Bottleneck Attention Network and an end-to-end encrypted CA framework. FBAN is designed for integer-only execution via a two-stage pipeline (floating-point pretraining followed by quantization-aware training) and is compiled into TFHE circuits for homomorphic inference. We further specify a client-server protocol with session-bound blinding and decrypt-and-return verification, enabling the server to authenticate users without observing raw behavioral features. We provide a cryptographic security analysis against an honest-but-curious server under TFHE IND-CPA security, and formalize resistance to replay and impersonation without the TFHE secret key. Experiments on two public touchscreen datasets demonstrate that FBAN achieves strong authentication utility under encrypted inference while maintaining a lightweight model footprint, with TFHE parameters instantiated at $\geq 128$-bit security.
1 Introduction
The introduction identifies privacy-in-use and encrypted-computation costs as gaps in continuous authentication. It presents FBAN as a TFHE-compatible approach and reports competitive authentication performance with reduced model complexity and practical re-verification latency.
1 Introduction
- Outsourced CA inference can expose raw behavioral features, intermediate representations, or scores that may enable profiling or unintended secondary use.Behavioral traces can also reveal private attributes and usage patterns beyond identity.Source: §1 · p. 2
- Running CA entirely on-device does not fully solve privacy-in-use because deep temporal and attention models can exceed mobile computation, memory, and energy budgets.This motivates inference offloading to edge or cloud services, where features may be processed in the clear.Source: §1 · p. 2
- FHE-based CA is difficult because nonlinearities and attention increase circuit depth and ciphertext cost, while efficient encrypted execution favors quantized computation over typical floating-point designs.The introduction targets TFHE for exact integer-domain computation in repeated short-window authentication and threshold decisions.Source: §1 · pp. 2–3
- FBAN combines a bottlenecked serial-attention design with floating-point pretraining and integer-only quantization-aware training for TFHE-compatible inference.Its design avoids FHE-unfriendly operators and compiles into encrypted circuits.Source: §1 · p. 3
- The proposed end-to-end pipeline keeps behavioral inputs encrypted during computation and permits lightweight ensemble aggregation.The authors frame this as privacy-preserving continuous authentication in an untrusted inference setting.Source: §1 · p. 3
- FBAN is reported to achieve competitive performance against representative CA baselines while reducing model complexity and delivering end-to-end FHE latency practical for periodic or risk-triggered re-verification.The evaluation protocol is described as aligned with realistic threat models.Source: §1 · p. 3
2 Preliminaries
The preliminaries define the behavioral-window scoring setup, describe stacked ensemble aggregation, introduce TFHE evaluation, and explain integer quantization for encrypted neural inference.
2.1 Notation
- A continuous authenticator scores a length-L behavioral window and thresholds that score into a binary decision; larger scores indicate greater acceptance confidence.The window is formed from feature vectors across successive time steps.Source: §2.1 · p. 4
2.2 Ensemble Learning
- The ensemble combines member scores with a learned linear stacking model, whose parameters can be trained to minimize FRR subject to a target FAR.Simple and weighted averaging are noted as standard alternatives.Source: §2.2 · p. 4
2.3 TFHE-Based Fully Homomorphic Encryption
- TFHE lets a server evaluate supported circuits on ciphertexts, and the paper uses it for integer-only inference circuits including arithmetic, comparisons, and quantized piecewise-linear primitives.TFHE is described as a gate-bootstrapped FHE family suited to Boolean and integer arithmetic.Source: §2.3 · pp. 4–5
2.4 Integer Quantization for TFHE-Compatible Neural Inference
- Uniform affine quantization converts real-valued tensors into b-bit integers, yielding an integer network circuit that can be evaluated on encrypted inputs while the server learns no plaintext behavioral features.The client quantizes and encrypts the window; it decrypts the resulting score or post-processed decision.Source: §2.4 · pp. 5–6
3 Framework Design
FBAN combines a TFHE-compatible attention model with offline per-user template preparation and a blinded online protocol for continuous authentication. Its design targets encrypted inference over behavioral windows using integer-only computation and circuit-friendly attention.
3.1 System Overview
- The framework preprocesses and quantizes client windows, encrypts them for TFHE inference, and returns a padded decision for decrypt-and-return verification.An offline-generated per-user template supplies the inference circuits, fixed-point stacking weights, and decision threshold.Source: §3 · p. 6, §3.1 · pp. 6–7
3.2 TFHE-Compatible Bottleneck Attention Network
- FBAN replaces costly softmax and multiplicative attention with serial bottleneck attention using affine maps, an integer-compatible activation, and additions.The narrow bottleneck has m′ ≪ m, avoids ciphertext–ciphertext multiplicative gating, and supports compilation over bounded integers.Source: §3.2 · pp. 7–8
3.3 Offline Model Preparation for TFHE Inference
- Per-user templates are prepared through floating-point pretraining, quantization-aware training, TFHE circuit compilation, and fixed-point stacking calibration.Stacking weights are learned on validation scores to optimize an operating metric, and the threshold uses the same fixed-point convention.Source: §3.3 · p. 8
3.4 Blinded TFHE Continuous Authentication Protocol
- At each time step, fresh server-generated blinding binds the submission to the session, while TFHE evaluation returns a one-time-padded decision for verification.The server removes the input mask inside TFHE, compares the score with the threshold, and recovers the decision after the client decrypts and returns the padded bit.Source: §3.4 · pp. 9–10
4 Threat Model and Security Goals
The security model considers an honest-but-curious server that observes the protocol transcript while attempting to infer client behavioral windows. The stated privacy guarantee is bounded by explicit leakage and excludes side channels and physical compromise of the client.
Communication assumption
- Authenticated communication is assumed to prevent active man-in-the-middle modification, but channel confidentiality is not required for input privacy.Sensitive client inputs are encrypted under TFHE.Source: §4 · p. 10
Adversary model
- The client quantizes each behavioral window, while the honest-but-curious server follows the protocol and attempts to infer the underlying inputs from its view.The server view includes its secrets and randomness, as well as intermediate ciphertexts derived during TFHE evaluation.Source: §4 · p. 10
Security goals
- The protocol aims to keep behavioral windows indistinguishable to the server except with negligible advantage in the TFHE security parameter.The privacy goal allows unavoidable leakage such as public dimensions and bit-width.Source: §4 · pp. 10, 12
Leakage and scope
- The guarantee permits leakage of public configuration and the server’s decision sequence, and excludes timing or cache side channels and physical compromise revealing the client secret key.The stated leakage includes public metadata and the Accept/Reject decisions at each time step.Source: §4 · p. 12
5 Experimental Evaluation
FBAN is evaluated on two touchscreen authentication datasets for accuracy, efficiency, and encrypted deployment. The experiments also examine ensemble size and the latency trade-off of TFHE inference.
5 Experimental Evaluation
- TouchPitfalls (470 users) and Touchalytics (41) use 65/15/20 train/validation/test splits; evaluation reports AUC, EER, FRR@FAR=0.001, Params, and FLOPs/PLOPs.Per-user thresholds are calibrated on validation data at FAR=0.001 before test FRR is reported.Source: §5 · p. 13
5.1 Comparative Analysis
- 98.93 AUC on TouchPitfalls and 99.87 AUC on Touchalytics are the best; FBAN also attains the lowest TouchPitfalls EER (1.18) with encrypted TFHE inputs.Table 1 compares results across both datasets; the compared baselines use plaintext inference.Source: §5.1 · pp. 13–14, Table 1 · p. 14
- Unlike plaintext-inference baselines, FBAN uses encrypted inputs under TFHE and is substantially more efficient than heavy Transformer baselines while preserving strong authentication accuracy.Source: §5.1 · p. 14
5.2 Effect of Ensemble Size
- Moderate ensembles (N≈4–6) typically lower FRR/EER and yield smaller AUC gains; improvements saturate, and larger N can slightly worsen FRR/EER.The reported pattern applies across PreTrain, QAT, and TFHE settings.Source: §5.2 · p. 14, Table 2 · p. 15
- 561.43 ms plaintext versus 73.25 s TFHE end-to-end, including encryption, communication, evaluation, and decryption; the authors position TFHE for periodic or risk-triggered re-verification.They describe it as a supplementary layer rather than a replacement for instantaneous primary unlock.Source: §5.2 · pp. 14–15
6 Security Analysis
Under standard TFHE assumptions, the analysis addresses encrypted-authentication correctness and feature confidentiality against an honest-but-curious server. It also formalizes fresh-session impersonation bounds and replay resistance through session freshness and decrypt-and-return verification.
6.1 TFHE Assumptions
- Assumptions include TFHE IND-CPA security and correct homomorphic evaluation; experiments use TFHE parameters targeting at least 128-bit security.Source: §6 · p. 15, §6.1 · p. 16
6.2 Correctness of Encrypted Authentication
- After in-circuit unblinding and circuit evaluation, TFHE execution yields the same score and accept/reject decision as plaintext computation, except with negligible probability.Source: §6.2 · p. 16
6.3 Confidentiality Against an Honest-but-Curious Server
- Assuming IND-CPA security, feature-dependent ciphertexts are indistinguishable from encryptions of zero, enabling a simulated server view consistent with declared leakage.Source: §6.3 · p. 16
6.4 Impersonation Security: Formal Experiment and Bound
- Fresh-session decrypt-and-return requires the client to return the plaintext of rt+dt; without sk, even transcript-observing adversaries can only guess, with success negligible at ℓ≥64.The stated bound is random-guess probability plus negligible terms.Source: §6.4 · pp. 17–18
6.5 Replay and Transcript Reuse
- Replaying an earlier ciphertext encounters fresh session identifiers, input masks, and pads; reused session identifiers are also rejected.Without sk, the replayed transcript cannot answer the fresh decrypt-and-return challenge except with the impersonation bound.Source: §6.5 · p. 18
6.6 Summary
- The security summary states that TFHE assumptions support feature privacy, while impersonation is limited to essentially random-guess success and replay is resisted by freshness and decrypt-and-return.Reported experiments use parameter sets targeting at least 128-bit security.Source: §6.6 · p. 18
7 Conclusions
FBAN combines quantization-aware training with homomorphic-friendly attention for TFHE-style integer computation. The paper reports competitive authentication accuracy and formalizes resistance to impersonation without the TFHE secret key.
7 Conclusions
- FBAN integrates quantization-aware training with homomorphic-friendly attention for TFHE-style integer-only computation.The authors describe its lightweight footprint as practical for periodic or risk-triggered re-verification.Source: §7 · p. 18
- FBAN achieves competitive authentication accuracy across TouchPitfalls and Touchalytics under a unified evaluation pipeline.The reported results remain effective across Pretrain, QAT, and TFHE settings.Source: §7 · p. 18
- An adversary without the TFHE secret key can succeed in impersonation only with negligible, random-guess probability.Source: §7 · p. 19
- The paper presents FBAN as a way to obtain strong continuous-authentication performance without exposing sensitive behavioral traces to the server.Source: §7 · p. 19