{"id":"a4430f64-f8c7-4419-ba88-9f847b5398ce","arxiv_id":"2504.14253","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.5,"correctness_risk":"medium","formal_verification":"none","parameter_count":6,"one_line_summary":"ColorVein is a cancelable vein biometric scheme that uses interactive colorization, controlled by user tokens, to create protected templates with competitive recognition and privacy properties.","lead":"ColorVein generates protected, replaceable vein-recognition templates by colorizing grayscale vein images with user-chosen hint colors, so each application can use a different color scheme. It reports lower error rates than existing cancelable vein schemes while claiming the templates cannot be linked or reversed to the original vein.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"ColorVein's irreversibility claim is unverified: Eq. (5)'s I(X;Y) is never estimated, and the L-channel-preserving colorization makes reconstruction plausible rather than impossible.","rationale":"The reader and I converge on the same weak point. The recognition experiments—consistent EER improvements over the baseline and over transferred cancelable schemes—are plausible enough to justify a conditional acceptance if the privacy analysis were solid. But the paper's central security contribution is irreversibility, and Section V-A1 does not actually measure it: Eq. (5) is a formal definition, not an estimator, and Table VII reports numbers close to 1 without describing the entropy or mutual-information estimator, the random variables involved, or the estimation parameters. Given that X is a high-dimensional image and Y is a 64-dimensional learned vector, unvalidated estimates can be arbitrarily biased. Moreover, the method preserves the L channel through colorization, so any scenario in which the colored image, or a feature vector retaining L, leaks makes reconstruction easy. The missing evidence is consequential: a cancelable scheme whose irreversibility is unsupported cannot be recommended for high-security vein recognition. Secondary concerns—no error bars on EER, no code release, and the apparent tension between the 'first' claim and the authors' own CFVNet reference—reinforce the need for more evidence, but they are not the decisive issue. The correct verdict therefore remains CONDITIONAL, with irreversibility as the condition to satisfy.","tokens_in":20385,"tokens_out":7451,"duration_ms":69985,"concrete_test":"Run a reconstruction attack on held-out subjects: with the public colorization network and feature extractor, plus access to stored 64-d protected vectors and the token, train a decoder to predict the binary vein mask or the L channel and compare IoU/SSIM against chance. Separately, compute I(X;Y) on the same held-out pairs with a calibrated neural or kNN estimator and recompute Eq. (5). If reconstruction is above chance, or if the recomputed leakage rate drops materially below the reported 0.95-0.99, the irreversibility claim should be weakened or withdrawn.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The load-bearing weakness is Section V-A1's irreversibility analysis. Eq. (5) defines the privacy leakage rate as 1 - I(X;Y)/H(X), but Table VII reports values of 0.951-0.991 without stating what X and Y are, how the entropies are estimated, or which estimator is used. For high-dimensional images and a 64-dimensional learned feature vector, these quantities are not computable by inspection, so the near-1 leakage rates may be an artifact of the estimator or of implicit distributional assumptions. The construction also makes the claim nontrivial in the wrong direction: the colorization network outputs only the a,b channels while keeping the L channel identical to the input, so the colored vein image retains the full vein pattern; if the protected item were the colored image, irreversibility would fail immediately. For the stored 64-d template, no inversion or reconstruction attack is reported, so the central claim that the original biometric cannot be reconstructed rests on an unmeasured information-theoretic quantity rather than an operational test.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes ColorVein, a cancelable vein-biometric template generation scheme. It first segments a grayscale vein image into a binary vein pattern with a ResU-Net, then colorizes the pattern using an interactive colorization network whose hint points, colors, and lightness are controlled by a user token, and finally extracts a 64-dimensional feature vector with a ResNet50 trained with softmax plus a proposed secure-center loss. Experiments on finger, palm, dorsal-hand, and wrist vein datasets report lower EER than block remapping, mesh warping, Biohashing, and Bloom filters in both normal and token-stolen settings. The paper also claims high privacy-leakage rates, unlinkability, revocability, and resistance to brute-force, false-accept, and record-multiplicity attacks.","tokens_in":20579,"tokens_out":7618,"duration_ms":71016,"significance":"The core idea of using editable colorization as the cancelable transformation is original and well aligned with the ISO/IEC 24745 requirements, and the secure-center loss is a sensible way to push cross-application and stolen-token impostors away from genuine users. The recognition evaluation is the strongest part: it covers four public datasets and compares fairly with representative cancelable schemes, with consistent EER improvements. However, the paper's central privacy guarantee currently rests on an unmeasured information-theoretic quantity and on an unverified uniformity assumption; if those gaps are fixed with concrete estimators, inversion tests, and distributional analysis, the contribution would be a solid fit for a security-oriented journal.","major_comments":[{"comment":"Table VII reports privacy leakage rates of 0.951-0.991, but the manuscript does not specify what X and Y are in Eq. (5), which estimator was used for I(X;Y), or how H(X) was estimated. For high-dimensional vein images and a 64-dimensional learned feature vector, these quantities cannot be computed by inspection; the near-1 values are therefore unverifiable. Because irreversibility is one of the four claimed cancelable attributes and is used in Section V-E to compare ColorVein with other schemes, this missing measurement is load-bearing.","section":"Section V-A1, Eq. (5), Table VII"},{"comment":"The colorization network outputs only the a* and b* channels while the L channel is kept identical to the input (Section III-C1); the original grayscale vein image is therefore exactly recoverable from the colored image by taking the L channel. If the 'cancelable template' considered in the irreversibility analysis is the colored image of Fig. 2, the irreversibility claim fails by construction. If the stored protected template is instead the 64-dimensional feature vector, the manuscript must say so and report an inversion or reconstruction attack; no such operational test is currently provided.","section":"Section III-C2 and Section V-A1"},{"comment":"The claimed brute-force complexity of 2^(17 x 64) = 2^1088 assumes that each of the 64 feature components is uniformly distributed over [-10,10] at a fixed precision of four decimals. This uniform-distribution assumption is not verified for the learned ResNet50 features; if actual features are concentrated on a lower-dimensional manifold, as the t-SNE visualization in Fig. 8 suggests, the enumeration space is much smaller. The random-template experiment samples uniformly and therefore does not test an adversary who exploits the learned feature distribution. Similarly, the false-accept attack assumes the adversary guesses 'N% bits' of a real-valued template without defining how the continuous 64-dimensional feature vector is binarized; this needs to be specified before the 2^646 complexity claim can be assessed.","section":"Section V-B1 and Section V-B2"},{"comment":"The defense against record-multiplicity attacks rests on the sentence that ColorVein 'transforms the template to a rank space [70]', but no rank-space transformation is defined anywhere in Section III, and reference [70] describes index-of-max hashing, which is not part of the proposed pipeline. Either implement and evaluate this claim or remove it; as written, the RM security analysis is unsupported.","section":"Section V-A2"}],"minor_comments":[{"comment":"The method name is misspelled as 'ColorVien' in the contributions paragraph and as 'ColoVein' in Section V-E; please standardize to ColorVein.","section":"Throughout"},{"comment":"No error bars or confidence intervals are reported for the EER values; given the small test sets (e.g., 10 subjects for the PUT-PV stolen scenario), variation across training runs should be quantified.","section":"Tables III-V"},{"comment":"The low-quality EERs are not directly compared with the normal-quality EERs from Table III; for example, HKPU-FV increases from 0.797 to 1.701, which does not obviously support the claim that performance remains stable.","section":"Table V"},{"comment":"The margin m in the secure-center loss is never specified; the text says 'M denotes the margin difference' but does not give the value used in the experiments.","section":"Eq. (3)"},{"comment":"The unlinkability results are shown only as curves; the global linkability values D_sys are not reported numerically, so the 'close to 0' claim cannot be checked against the stated metric.","section":"Fig. 11"},{"comment":"The claim that stolen-scenario EER increases when the hint point count m exceeds 25 is not uniformly supported by Table III (e.g., PUJ-DHV stays at 0.908 for all m); please clarify which datasets exhibit this effect.","section":"Section IV-B"}],"recommendation":"major_revision","confidential_remarks":"The manuscript footer says the paper has been accepted by IEEE TIFS, but the review should judge the submitted content. The security and privacy analysis is not at the level expected for a TIFS paper in its current form; I would require the estimator details for Eq. (5), an inversion or reconstruction experiment, and distributional evidence for the brute-force claims before acceptance. No code or supplementary material is provided, which makes the privacy-leakage numbers impossible to verify."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The core idea is genuinely new: using user-guided colorization as a cancelable transformation for vein biometrics. The token-controlled hint points define a pseudo-random color space, and the secure center loss is a reasonable metric-learning objective. The recognition experiments are the strongest part—on four public datasets, ColorVein consistently beats the transferred cancelable schemes (block remapping, mesh warping, biohashing, Bloom filters) and improves on the non-cancelable baseline. Unlinkability and revocability are also empirically demonstrated with score distributions. If the paper were only about generating revocable, high-performing templates, it would be a solid contribution.\n\nThe soft spots are in the security analysis, and they are real. The privacy leakage rate in Eq. (5) is reported as 0.951–0.991 with no explanation of what X and Y are, how I(X;Y) was estimated, or what estimator was used. For a 64-dimensional feature vector, that quantity is not computable by inspection, so those near-1 numbers are unverifiable. The construction also makes the claim nontrivial in the wrong direction: the colorization network keeps the L channel identical to the input, so the colored image retains the full grayscale vein pattern. Irreversibility therefore rests entirely on the feature extractor, but no inversion or reconstruction attack is attempted. The brute-force and false-accept analyses assume a uniform distribution over feature components and treat real-valued values as bits; that is optimistic. Also, the abstract and introduction claim this is the first cancelable vein-specific scheme, yet reference [2] (CFVNet) is exactly an end-to-end cancelable finger vein network by the same group. That claim needs scoping.\n\nMinor issues: no error bars, no code, and the low-quality-sample results are reported without enough detail to know what is being compared. None of these are fatal to the recognition story, but they matter for the security claims.\n\nWho should read this: anyone working in biometric template protection or vein recognition. It is a clever application of colorization, and the recognition results are worth citing. But I would not cite the irreversibility results as evidence of security until the estimation method is made explicit and a real reconstruction attack is tried.\n\nIf this were under review, I would send it out rather than desk-reject—the idea is good and the recognition work is solid—but I would ask for major revision on the security analysis and the novelty claim. Since the header says it is already accepted at TIFS, I would hope the authors post a revised version that operationalizes Eq. (5) and softens the 'first' claim.","headline":"Smart idea with solid recognition results, but the irreversibility numbers are unverifiable and the 'first' claim clashes with the authors' own prior work.","tokens_in":21128,"tokens_out":3149,"would_cite":true,"duration_ms":29357,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"ColorVein turns grayscale vein scans into color-keyed templates that can be cancelled and reissued.","keywords":["cancelable biometrics","vein recognition","template protection","image colorization","interactive colorization","secure center loss","unlinkability","irreversibility"],"falsifier":"Recompute Eq. (5) with an explicit estimator for $I(X;Y)$, such as a nearest-neighbor mutual information estimator over pairs of original vein images and ColorVein templates, or train a decoder that maps a protected template back to a binary vein mask. If the estimated privacy leakage rate falls far below the reported values near 1, or the reconstructed masks match the true vein patterns substantially better than chance, the irreversibility claim is refuted.","tokens_in":20147,"feed_emoji":"🔐","tokens_out":8148,"duration_ms":68970,"temperature":0.7,"pith_summary":"ColorVein is a scheme for making vein-recognition templates cancelable: instead of scrambling or hashing away the vein pattern, it colorizes the grayscale vein image under a user-defined pseudo-random color space and then extracts a fixed-length feature vector from the colored image. The paper's central claim is that this is the first cancelable template method designed specifically for veins, and that it beats transferred methods such as block remapping, mesh warping, Biohashing, and Bloom filters on recognition while still satisfying revocability, unlinkability, and irreversibility. The reason this matters is that vein biometrics previously had no purpose-built cancelable generation scheme, leaving a gap between security reissuance and recognition accuracy. If the claim holds, vein authentication systems can reissue a compromised template simply by changing the hint points that define the color mapping, and they can do so without paying the usual accuracy penalty.","feed_headline":"Colorizing vein scans makes cancelable templates that still match","feed_subtitle":"A token-controlled color space lets users revoke and reissue vein templates without destroying the vein pattern.","key_machinery":"The engine of the scheme is interactive colorization steered by hint points. Given a binary vein mask and a set of user- or administrator-chosen hint points with colors, a UNet-style colorization network propagates colors through the vein region, turning one grayscale channel into three RGB channels. The hint-point set is the token: changing it changes the template. On top of that, the secure center loss organizes the feature space so that genuine samples cluster at class centers while impostor, cross-application, and stolen-token samples are pushed away, which is what makes the scheme revocable and stolen-token-resistant. The evaluation machinery includes the privacy leakage rate $H(X|Y)/H(X)$, the global unlinkability metric $D^{\\mathrm{sys}}_{\\leftrightarrow}$, and the decidability index $d'$.","core_discovery":"The paper proposes to treat color as the cancelable key. A vein image is first segmented into a binary vein pattern by a ResU-Net segmentation network. Then an interactive colorization network, pretrained on natural images, takes the grayscale lightness channel plus sparse hint points as a token-controlled pseudo-random color space and produces a colored vein image; the hints' positions, counts, and colors define the cancelable identity. A ResNet50 feature extractor trained with softmax plus a secure center loss maps the colored image to a 64-dimensional protected template. The secure center loss pulls genuine samples toward their class center and pushes away three kinds of negatives: impostors, cross-application enrolments of the same user, and samples made with a stolen token. On finger, palm, dorsal-hand, and wrist datasets, the reported equal error rates are below the grayscale baseline and below the four compared cancelable schemes, and the paper reports low global linkability, high privacy leakage rates, and separation between genuine and pseudo-impostor score distributions. The paper concludes that ColorVein is a complete cancelable vein template solution: better recognition than the alternatives, reissuable by redefining hints, unlinkable across applications, and resistant to brute-force, false-accept, and record-multiplicity attacks.","pith_inferences":["A consequence the paper leaves implicit is that the irreversibility guarantee is empirical rather than structural: it rests on the feature extractor discarding reconstruction information, so the decisive test would be training a decoder from templates back to binary vein masks.","Because the colorization network was pretrained on natural images rather than on vein images, the same token-controlled color mechanism could plausibly transfer to other inherently grayscale biometric modalities, such as fingerprint or palmprint images captured in near-infrared.","The secure center loss is a general recipe that other cancelable systems could adopt even without colorization: explicitly equalizing impostor, cross-application, and stolen-token score distributions.","The paper does not quantify how different two hint-point configurations must be before the resulting templates become unlinkable; interpolating hint colors between tokens would expose whether small token changes give partial linkability."],"forward_implications":["Changing the hint-point set reissues the template; the same enrolled vein can be revoked and renewed without retraining the colorization or feature networks.","Recognition improves over the grayscale and binary baselines on all four vein types, with equal error rates typically dropping from multi-percent levels to around or below one percent.","Templates produced with different color spaces are near-unlinkable, so a user's templates in different applications cannot be linked by score correlation.","Stolen-token and cross-application templates score like impostors rather than genuine users, so losing a token does not grant access.","The 64-dimensional fixed-precision features put brute-force and false-accept attacks out of computational reach under the paper's model."],"supporting_citations":[{"why":"Supplies the mesh warping cancelable baseline and the broader cancelable finger-vein framework that ColorVein compares against.","marker":"[2]"},{"why":"Establishes the block remapping baseline and the standard framework of cancelable biometric transformations.","marker":"[15]"},{"why":"Provides the Biohashing baseline, a two-factor tokenized random projection method compared against ColorVein.","marker":"[18]"},{"why":"Provides the Bloom filter baseline, an unlinkable and irreversible template protection method compared against ColorVein.","marker":"[19]"},{"why":"Supplies the ResU-Net segmentation network used to extract binary vein patterns before colorization.","marker":"[54]"},{"why":"Provides the interactive colorization network that maps grayscale vein images and hint points to colored output, the core machinery of the scheme.","marker":"[56]"},{"why":"Supplies the ImageNet large-scale color image data on which the colorization network is pretrained.","marker":"[57]"},{"why":"Provides the ResNet50 backbone used as the protected feature extraction network.","marker":"[58]"},{"why":"Supplies the privacy leakage rate metric and the argument that DCNN feature extractors compress inputs, underpinning the irreversibility analysis.","marker":"[63]"},{"why":"Provides the global unlinkability evaluation framework used to measure linkability between ColorVein templates.","marker":"[64]"}],"fun_headline_variants":["ColorVein turns vein scans colorful, making templates revocable","Color as a cancelable key for vein biometrics","Revocable vein templates via interactive colorization","Coloring vein images for secure, changeable biometrics","ColorVein: colorful, cancelable vein biometric templates"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The privacy claim rests on two unmeasured premises: the feature extractor destroys all vein-reconstruction information, and the mutual information behind Eq. (5) was estimated reliably, but the paper never says how $I(X;Y)$ was computed.","fun_headline_variants_meta":{"raw":{"variants":["ColorVein turns vein scans colorful, making templates revocable","Color as a cancelable key for vein biometrics","Revocable vein templates via interactive colorization","Coloring vein images for secure, changeable biometrics","ColorVein: colorful, cancelable vein biometric templates"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000392,"raw_usage":{"total_tokens":2105,"prompt_tokens":1031,"completion_tokens":1074,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":647,"completion_tokens_details":{"reasoning_tokens":994}},"tokens_in":647,"tokens_out":1074,"duration_ms":9594,"temperature":1.0,"reasoning_tokens":994,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T11:52:36.330692+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Recompute Eq. (5) with an explicit estimator for $I(X;Y)$, such as a nearest-neighbor mutual information estimator over pairs of original vein images and ColorVein templates, or train a decoder that maps a protected template back to a binary vein mask. If the estimated privacy leakage rate falls far below the reported values near 1, or the reconstructed masks match the true vein patterns substantially better than chance, the irreversibility claim is refuted.","supporting_citations":[{"cited_title":"Deep residual learning for image recognition,","cited_arxiv_id":null,"evidence_quote":"Provides the ResNet50 backbone used as the protected feature extraction network."},{"cited_title":"Cfvnet: An end-to- end cancelable finger vein network for recognition,","cited_arxiv_id":null,"evidence_quote":"Supplies the mesh warping cancelable baseline and the broader cancelable finger-vein framework that ColorVein compares against."},{"cited_title":"Enhancing security and privacy in biometrics-based authentication systems,","cited_arxiv_id":null,"evidence_quote":"Establishes the block remapping baseline and the standard framework of cancelable biometric transformations."},{"cited_title":"Biohashing: two factor authentication featuring fingerprint data and tokenised random number,","cited_arxiv_id":null,"evidence_quote":"Provides the Biohashing baseline, a two-factor tokenized random projection method compared against ColorVein."},{"cited_title":"Unlinkable and irreversible biometric template protection based on bloom filters,","cited_arxiv_id":null,"evidence_quote":"Provides the Bloom filter baseline, an unlinkable and irreversible template protection method compared against ColorVein."},{"cited_title":"Resunet-a: A deep learning framework for semantic segmentation of remotely sensed data,","cited_arxiv_id":null,"evidence_quote":"Supplies the ResU-Net segmentation network used to extract binary vein patterns before colorization."},{"cited_title":"Real-time user-guided image colorization with learned deep priors,","cited_arxiv_id":null,"evidence_quote":"Provides the interactive colorization network that maps grayscale vein images and hint points to colored output, the core machinery of the scheme."},{"cited_title":"Imagenet: A large-scale hierarchical image database,","cited_arxiv_id":null,"evidence_quote":"Supplies the ImageNet large-scale color image data on which the colorization network is pretrained."},{"cited_title":"Secure triplet loss: Achieving cancelability and non-linkability in end-to-end deep biomet- rics,","cited_arxiv_id":null,"evidence_quote":"Supplies the privacy leakage rate metric and the argument that DCNN feature extractors compress inputs, underpinning the irreversibility analysis."},{"cited_title":"General framework to evaluate unlinkability in biometric template protection systems,","cited_arxiv_id":null,"evidence_quote":"Provides the global unlinkability evaluation framework used to measure linkability between ColorVein templates."}],"review_version":1}