{"id":"bc04ed59-f82f-44e3-b0a8-6c23983d157a","arxiv_id":"2506.18731","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"A face recognition system can revoke a stolen biometric template by re-enrolling the identity with a freshly trained instance of the same model, because templates from different training runs are strongly incompatible.","lead":"Different training runs of the same face-recognition neural network produce models that are equally accurate but whose stored templates cannot be matched across models. Switching a compromised identity to a freshly trained model instance revokes the stolen template, giving a simple revocable biometric system.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The 'unlimited models' claim rests on an extreme-tail observation from just 10 ResNet instances and two MORPH subgroups, with no statistical confidence or scaling evidence.","rationale":"The strongest claim is explicitly quantified: for a given backbone and training set one can generate an unlimited number of distinct matchers with equivalent recognition power and strongly incompatible templates. The system's security depends on cross-model incompatibility holding for every revoked identity and every chosen model pair; a single violating pair would allow a stolen template to exceed the shared threshold after re-enrollment. The empirical basis is narrow: 10 ResNet instances, 45 pairs, two MORPH subgroups, and a comparison of observed maxima to threshold. This leaves three gaps that are all facets of the same concern: (1) no statistical guarantee about the tail of the cross-model genuine distribution; (2) no scaling evidence beyond 10 instances; (3) no evidence across other backbones, datasets, or demographic groups. The paper's own Future Work explicitly defers verifying other popular CNNs and the theoretical upper limit, which supports the reading that the universality claim is currently unsupported rather than established. I do not see an internal inconsistency or a more fundamental flaw: the same-model distributions and thresholds are consistent, the cross-model distributions are clearly shifted, and the proposed system is coherent if the property holds. The concern is therefore about the strength of the empirical generalization, not about the logic of the scheme. A test that trains 50 instances and checks the 99.99th percentile of cross-model genuine scores against the minimum same-model threshold would directly test the revocation guarantee and settle whether the concern lands. The reader's conditional verdict already reflects this limitation, so the verdict need not change.","tokens_in":12074,"tokens_out":11523,"duration_ms":135061,"concrete_test":"Train 50 ResNet-100 instances on WebFace4M with the same ArcFace configuration. For every one of the 1,225 model pairs, compute the full cross-model genuine score distribution over all identities in all four MORPH demographic groups (or a large in-the-wild set). Estimate the 99.99th percentile of each cross-model genuine distribution with a bootstrap confidence interval, and also record the maximum. Additionally, compute the same-model 1-in-10,000 FMR threshold for each of the 50 instances. The concern is settled if the upper 95% confidence bound of the 99.99th percentile (and the max) for every pair remains below the minimum of the 50 same-model thresholds. If any pair violates this, the universal revocation guarantee is falsified.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim requires that for any of an unlimited sequence of independently trained model instances, the cross-model genuine cosine similarity for every identity and re-enrollment image stays below the same-model 1-in-10,000 FMR threshold. The evidence (Section 5, Figures 2–3) is the observed maximum genuine score over 45 model pairs for two MORPH subgroups (Caucasian Female, African-American Female) with 10 ResNet instances. This is an extreme-value statistic: the maximum of a finite sample being below the threshold does not bound the 99.99th percentile of the cross-model genuine distribution, nor does it rule out a failure for an untested identity, model pair, or larger N. The paper provides no confidence intervals or extreme-value analysis, and its own Future Work states that verifying other popular CNNs and the theoretical maximum number of equally accurate models are open questions. Because the revocation guarantee breaks if any model pair, identity, or image yields a cross-model genuine score above the shared threshold, the 'unlimited' and 'inherently' claims are not yet established.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a revocable biometric framework based on training multiple instances of the same deep CNN face matcher. The authors claim that instances trained identically have equivalent recognition accuracy but generate embeddings that are strongly incompatible across instances, so that a revoked template cannot match a re-enrolled template. They train ten instances each of ResNet-18, ResNet-100, and ViT with ArcFace on WebFace4M, report benchmark accuracy and d-prime, and present relationship matrices for two MORPH demographic groups (Caucasian Female and African-American Female) showing that the maximum cross-model genuine score lies below the same-model 1-in-10,000 FMR threshold. Based on this, they argue that ResNet-based face matchers inherently support unlimited template revocation, while ViT backbones are less suitable because of higher across-instance performance variation.","tokens_in":12211,"tokens_out":7026,"duration_ms":79867,"significance":"If the central claim holds, this is a practically and conceptually significant result: it offers a simple template-revocation mechanism that does not require explicit cancellable-transformation procedures, and it directly challenges the common view that compromised face templates are irreplaceable. The paper is transparent about training configurations, reports standard accuracy and d-prime metrics, and releases code, which are notable strengths. However, the security claim is an extreme-tail empirical assertion that is currently supported only by a finite set of model instances and two demographic groups; the significance is therefore conditional on the authors either supplying the missing statistical evidence or substantially narrowing the claim.","major_comments":[{"comment":"The central security property—that a revoked template is useless against a re-enrolled template—is a claim about the upper tail of the cross-model genuine-score distribution. The evidence in Figure 2 is the observed maximum cross-model genuine score for each of 45 model pairs, restricted to the Caucasian Female and African-American Female MORPH groups. A maximum over a finite set of identities, images, and model pairs does not bound the population quantile corresponding to the 1-in-10,000 FMR threshold; an untested identity, image, or additional model pair could exceed it. The paper reports no confidence intervals, bootstrap estimates, or extreme-value analysis, and it does not state the number of identities or genuine pairs used to form each off-diagonal maximum. Without a distributional or confidence statement, the revocation guarantee is not established beyond the particular test set.","section":"Section 5, Figure 2 and Figure 3"},{"comment":"The claims that revocation can be repeated \"an unlimited number of times\" and that deep CNN face matchers \"inherently\" support revocable templates go beyond the evidence. Only ten instances per backbone were trained, the cross-model security evaluation covers only two MORPH demographic groups, and the paper's own Future Work states that verifying other popular CNNs and determining the theoretical maximum number of equally accurate distinct models remain open questions. The conclusion should be limited to the empirically demonstrated regime (e.g., ten ResNet instances on the tested groups) unless additional scaling, theoretical, or statistical evidence is supplied.","section":"Section 3.3 and Section 6 (Conclusion)"},{"comment":"The revocation guarantee is asserted for enrolled identities generally, but the cross-model relationship matrices are provided only for Caucasian Female and African-American Female MORPH groups. Table 1 shows that same-model d-prime differs substantially across the four demographic groups (e.g., ResNet-100 AA M d-prime is 9.84 while AA F is 8.41), so the cross-model upper-tail behavior of the untested groups cannot be assumed to match the tested groups. The security claim should either be demonstrated for all demographic groups represented in Table 1 or explicitly restricted, with the restriction reflected in the abstract and conclusion.","section":"Section 5, Table 1 and Figure 2"}],"minor_comments":[{"comment":"The caption states that the top diagonal item is the 1-in-10,000 FMR threshold and the bottom item is the d-prime, but the body text says the top value is the d-prime and the bottom value is the threshold; these should be reconciled.","section":"Section 5, Figure 2 caption and body text"},{"comment":"The numeric entries are not cleanly separated (e.g., \"96.41±0.076.27±0.02\"); use explicit column spacing or formatting so each value and its standard deviation is readable.","section":"Table 1"},{"comment":"The sentence \"they can it revoked\" contains a typo; it should read \"they can have it revoked\".","section":"Section 6 (Conclusion)"},{"comment":"The affiliation contains a typo: \"Florida Insitute of Technology\" should be \"Florida Institute of Technology\".","section":"Title page / author affiliation"},{"comment":"Figure 3 uses six model instances while Section 5 and Figure 2 use ten; the paper should clarify why the numbers differ and confirm that the conclusions are consistent across both settings.","section":"Section 3.2 and Figure 3"}],"recommendation":"major_revision","confidential_remarks":"The empirical observation is interesting and the code release is a strength, but the title and abstract overclaim relative to the evidence: the universal and \"unlimited\" language is not supported by ten ResNet instances and two demographic groups. A revision that adds confidence/quantile analysis and tempers the claims would make the contribution suitable for publication; as it stands, the central security guarantee is not yet established."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: the paper has a real observation — retraining the same ArcFace matcher gives you models with nearly identical accuracy whose embeddings are so incompatible that cross-model genuine scores sit below the same-model impostor threshold. If that holds in deployment, it is a genuinely simple revocable-biometric mechanism needing no new cryptographic machinery. The paper deserves a serious referee, but the abstract's 'unlimited' and 'inherently' are stronger than what the evidence supports.\n\nWhat is new: I do not know prior work that frames multiple training runs of the same matcher as a revocation mechanism. Showing 10 ResNet instances with tight accuracy (Table 1) and cross-model maximum genuine scores below the 1-in-10,000 FMR threshold for two MORPH groups (Figure 2) is a solid first experiment. Code is on GitHub, which makes it checkable. The ViT comparison is a useful negative result, and the paper is candid that ViT is not suitable.\n\nSoft spots, in proportion: the empirical base is narrow. Two demographic groups, one dataset, one training configuration. The 'unlimited' claim rests on an extreme-tail observation: the maximum over 45 model pairs being below threshold does not bound the 99.99th percentile of the cross-model genuine distribution, and the paper gives no confidence intervals or extreme-value analysis. That is a real gap, but it is addressable — more models, more groups, and reporting quantiles rather than maxima would tighten it. The paper's own Future Work admits that verifying other CNNs and the theoretical maximum number of models are open, which is more honest than the abstract. The relationship matrix also lacks error bars; the comparison against existing cancellable schemes is thin; and the security model is a bit casual. None of this sinks the core mechanism. It just means the paper should be read as a proof-of-concept with promising pilot data, not as a deployment-ready guarantee.\n\nWho it is for: people working on biometric template protection and face recognition security. I would send it to a serious referee — the observation is useful enough, and the code and data make it falsifiable. I would not desk-reject it.","headline":"A useful, well-scoped proof-of-concept for revocable biometrics via retrained matcher instances, whose 'unlimited' and 'inherently' wording outruns the evidence.","tokens_in":12749,"tokens_out":1515,"would_cite":true,"duration_ms":17170,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The same face matcher, retrained, yields equally accurate models whose templates are mutually incompatible, enabling revocable biometrics.","keywords":["revocable biometrics","face recognition","biometric template protection","deep convolutional networks","ArcFace","ResNet","Vision Transformer","cross-model matching"],"falsifier":"Train two ResNet-100 ArcFace models from scratch on the same dataset, enroll a large set of identities under one model, and probe with the other; if any identity's cross-model genuine cosine similarity repeatedly exceeds that model's 1-in-10,000 FMR threshold, the claimed universal incompatibility is falsified.","tokens_in":11848,"feed_emoji":"🔐","tokens_out":9995,"duration_ms":88465,"temperature":0.7,"pith_summary":"The paper claims that a compromised biometric template does not have to be permanent: retraining the same face-recognition network from scratch produces many equally accurate models whose embeddings are mutually incompatible. For two models trained identically, the same person's face generates cosine similarities that fall below the 1-in-10,000 false-match threshold, making a stolen template useless against a re-enrolled identity. The authors demonstrate this with ten ResNet-18 and ResNet-100 instances trained with ArcFace on the WebFace4M dataset, evaluated on standard benchmarks and the MORPH demographic groups, and show the models can share a single operational threshold. They further report that Vision Transformer backbones are less suitable because their performance varies noticeably across training instances.","feed_headline":"Retraining a face matcher makes stolen templates useless","feed_subtitle":"Equally accurate retrained models yield incompatible embeddings, so stolen templates cannot match re-enrolled users.","key_machinery":"The load-bearing mechanism is the training stochasticity of deep CNNs: multiple end-to-end trainings of the same ResNet backbone with the same data, ArcFace loss, and hyperparameters converge to equally accurate models whose internal non-linear transformations map face images into incompatible embedding spaces. The paper does not derive this property theoretically but demonstrates it through the relationship matrix, a symmetric table whose diagonal entries give each model's d-prime and 1-in-10,000 FMR threshold and whose off-diagonal entries give the maximum cross-model genuine cosine similarity for every pair of the ten instances. Because every off-diagonal maximum falls below every diagonal threshold, the same operational threshold serves all instances and a revoked template cannot match a re-enrolled identity.","core_discovery":"The central discovery is that stochastic retraining of a deep CNN face matcher yields an unlimited supply of distinct models that are equally accurate yet mutually incompatible: genuine pairs compared across models score like impostors, with the upper tail of the cross-model genuine distribution lying below the same-model impostor distribution. Consequently, a single similarity threshold calibrated for a 1-in-10,000 false match rate on one model instance remains valid for every other instance, and an enrolled template created by one instance cannot authenticate against a re-enrollment using another. The paper establishes this empirically with ten instances each of ResNet-18 and ResNet-100 (and ten ViT instances for comparison), using ArcFace training on WebFace4M, and validates recognition equivalence on LFW, CFP-FP, AGEDB-30, CALFW, and CPLFW while validating cross-model incompatibility on the Caucasian Female and African-American Female groups of MORPH. The practical conclusion is a revocation protocol in which the system simply switches the affected identity to a fresh model instance and updates an identity-to-model hashmap, with no re-enrollment of the rest of the gallery.","pith_inferences":["If cross-instance incompatibility persists under fine-tuning from a shared checkpoint, a compromised template could be revoked by fine-tuning a new instance rather than training from scratch, which would substantially cut the computational cost of revocation; the paper only tests full retraining.","The observed separation suggests a general phenomenon for over-parameterized networks: any architecture with training stochasticity that yields multiple local optima of equal loss may exhibit the same cross-instance embedding incompatibility, so the face-specific result may extend to iris or fingerprint CNNs.","The paper's evidence is limited to two MORPH demographic groups with ten ResNet instances; before deployment, one would need to verify that the cross-model genuine distribution stays below the same-model impostor threshold across a much wider set of identities, poses, and image conditions, and to quantify the probability of a single identity violating the bound.","A theory of embedding-space distances between independently trained instances could turn this empirical safety margin into a provable guarantee and would reveal the maximum number of usable instances before cross-model similarity begins to overlap the impostor range."],"forward_implications":["A user whose template is stolen can be re-enrolled under a fresh model instance with no loss in recognition accuracy, and this can be repeated many times.","Revocation updates only the affected identity's template and the identity-to-model mapping, leaving the rest of the gallery untouched.","All instances of a given backbone can share one 1-in-10,000 false-match-rate threshold, so a breach does not force recalibration.","Vision Transformer backbones are currently a poor fit for this scheme because their accuracy varies across training instances, although their cross-model incompatibility behavior is similar.","The approach does not remove the need for presentation attack detection; the two defenses are complementary."],"supporting_citations":[{"why":"Supplies the ResNet-18 and ResNet-100 backbone architectures used for all model instances.","marker":"[12]"},{"why":"Provides the ArcFace training configuration and implementation details used to train every instance.","marker":"[2]"},{"why":"Provides the WebFace4M training dataset on which all instances are trained.","marker":"[52]"},{"why":"Defines the d-prime metric used to compare recognition power across model instances and demographic groups.","marker":"[9]"},{"why":"LFW is one of the five benchmarks used to establish equivalent 1:1 verification accuracy across instances.","marker":"[14]"},{"why":"The ISO/IEC 24745 standard supplies the revocability, unlinkability, and irreversibility criteria the framework is designed to satisfy.","marker":"[15]"},{"why":"Cited as the explanation for ViT training instability that makes that backbone less suitable for the revocation scheme.","marker":"[49]"}],"fun_headline_variants":["Same face, new keys: retrained matchers revoke biometrics","Swap model, keep accuracy, ditch stolen face data","Retrained face matchers: equal accuracy, incompatible templates","Revocable faces: retrain once, stolen template is trash","Biometric revoke via retraining: same accuracy, new keys"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The entire revocation guarantee rests on the assumption that for every enrolled identity and every re-enrollment image, the cross-model genuine cosine similarity stays below the same-model 1-in-10,000 FMR threshold; the paper demonstrates this only for the Caucasian Female and African-American Female groups of MORPH with ten ResNet instances and offers no theoretical reason it holds universally.","fun_headline_variants_meta":{"raw":{"variants":["Same face, new keys: retrained matchers revoke biometrics","Swap model, keep accuracy, ditch stolen face data","Retrained face matchers: equal accuracy, incompatible templates","Revocable faces: retrain once, stolen template is trash","Biometric revoke via retraining: same accuracy, new keys"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000325,"raw_usage":{"total_tokens":1879,"prompt_tokens":1059,"completion_tokens":820,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":675,"completion_tokens_details":{"reasoning_tokens":733}},"tokens_in":675,"tokens_out":820,"duration_ms":7981,"temperature":1.0,"reasoning_tokens":733,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T23:15:12.188464+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train two ResNet-100 ArcFace models from scratch on the same dataset, enroll a large set of identities under one model, and probe with the other; if any identity's cross-model genuine cosine similarity repeatedly exceeds that model's 1-in-10,000 FMR threshold, the claimed universal incompatibility is falsified.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the ResNet-18 and ResNet-100 backbone architectures used for all model instances."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the ArcFace training configuration and implementation details used to train every instance."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the WebFace4M training dataset on which all instances are trained."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Defines the d-prime metric used to compare recognition power across model instances and demographic groups."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"LFW is one of the five benchmarks used to establish equivalent 1:1 verification accuracy across instances."},{"cited_title":"Information tech- nology - security techniques - biometric information protec- tion","cited_arxiv_id":null,"evidence_quote":"The ISO/IEC 24745 standard supplies the revocability, unlinkability, and irreversibility criteria the framework is designed to satisfy."}],"review_version":1}