Pith. sign in

REVIEW 3 major objections 5 minor 55 references

Binding Biometrics with AI Agent Identifiers for Delegation of Authority

T0 review · 3 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read BIND cryptographically ties a human's face to an AI agent's authorization token, so every delegated action can be traced back to the person who approved it.

desk verdict A solid feasibility study and a genuinely new application, but the protocol as written stores the template that lets anyone forge delegation tokens, so the non-repudiation claim doesn't survive contact with the equations. read the letter →

arxiv 2608.04292 v1 pith:AG7546EY submitted 2026-08-04 cs.CV

Joseph Geo Benjamin , Anil K Jain , Karthik Nandakumar This is my paper · ORCID
classification cs.CV
keywords biometriccryptosystemsfuzzycommitmentfacerecognitionAIagentdelegationnon-repudiationtemplateprotectionTurboerror-correctingcodesidentitybinding
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper proposes BIND, a scheme that turns a human's biometric signal into a cryptographic binding between that human and a specific AI agent's authorized task. The problem it addresses is the accountability gap in agentic AI: existing OAuth-style tokens say what is permitted, but the link to the originating human weakens as delegation propagates. BIND lets an agent carry a delegation token generated from the user's face, from which an identity auditor recovers the agent ID and scope only if the presented biometric matches the enrolled template. The paper's face-based implementation reaches a 96% true match rate at zero false match rate on one evaluation dataset while supporting 1,024-bit agent tokens, which the authors present as evidence that the framework is practically feasible.

What carries the argument

The load-bearing object is the fuzzy-commitment secure sketch: the agent token is encoded as a codeword of a Turbo error-correcting code, and the delegation token is the XOR of that codeword with a binary biometric template. Recovery succeeds exactly when the query template is close enough in Hamming distance, so the system's operating point is set by the code's correction capacity $\tau$. To make real-valued face embeddings compatible with that capacity, the paper introduces a three-step feature-adaptation pipeline—Gaussian dithering, Gaussian random projection, and WTA-hash binarization—and derives a closed-form relation $\lambda = \sqrt{(\cos(\pi\tau)-\psi)/(1-\cos(\pi\tau))}$ that selects the dithering strength from the desired error bound $\tau$ and the genuine/impostor similarity threshold $\psi$. The three propositions (dithering raises cosine similarity as $(\psi+\lambda^2)/(1+\lambda^2)$, random projection preserves cosine similarity, and pairwise WTA-hashing maps cosine similarity to Hamming similarity as $1 - \arccos(\psi_p)/\pi$) are what let the pipeline be tuned without re-training the face model.

What would settle it

Take the user's enrolled public face image, the user's transformation key (treated as public in the paper's evaluation), and a delegation token issued for a different agent; run the paper's feature extractor and feature-adaptation pipeline on the photo and attempt turbo-decoding of the token. If valid agent credentials are recovered, the claimed non-repudiation is refuted.

Watch

Extended reading notes

Core claim

On the paper's own terms, BIND makes a delegation token that is simultaneously a biometric authentication and an authorization credential. A user's freshly captured face embedding is binarized by a feature-adaptation pipeline, and the resulting binary template is XOR-ed with a turbo-coded agent token that encrypts the agent ID and scope; the secure sketch is the delegation token. At execution time, the identity auditor XORs the enrolled template with the token and turbo-decodes: if the Hamming distance between enrolled and query templates lies within the code's correction radius, the agent token is recovered and verified against its hash, releasing credentials only then. The paper reports that the best face configuration reaches 96% true match rate at zero false match rate on the CFP-FF dataset and supports agent tokens of 1,024 bits, and it argues this enables non-repudiable proof of which human authorized which agent action.

Load-bearing premise

The scheme's non-repudiation collapses if an attacker who knows the user's randomization key and has access to public face photos can reconstruct a fresh binary template that decodes the delegation token for an arbitrary agent ID, and the paper defers the security analysis that would rule this out.

Editorial extensions

If this is right

  • If BIND works as claimed, every agent action can be traced through a token service provider's logs to an agent ID and then back to the human whose biometric released that ID, giving an audit trail that current token-exchange schemes lack.
  • Tampering with a delegation token changes the codeword, so the hash check at recovery fails; this makes scope or agent-ID alteration detectable at authentication time.
  • The error-correction threshold stays consistent across 1,024-, 2,048-, and 4,096-bit agent tokens, so the framework can carry larger authorization payloads without redesigning the code.
  • In adaptive multi-agent workflows, sub-agents that are assigned on the fly must return to the user for a new delegation token unless the user pre-authorizes the subtask, concentrating human oversight on critical decisions.
  • Because recovery requires a fresh biometric sample, the protocol ties authorization to human presence at delegation time, not merely to possession of a software credential.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial extension: the non-repudiation claim is only as strong as the difficulty of inverting the binarized template. Because the transformation key is treated as public and the security analysis is deferred, an attacker with a public face photo and the user's transformation key could plausibly fabricate valid delegation tokens for arbitrary agent IDs; testing this inversion directly would settl
  • Editorial extension: the headline 96% true match rate at zero false match rate is measured on CFP-FF, a frontal-pose dataset; the paper's own results on LFW-a and Multi-PIE show lower true-match rates, so deployments with pose and illumination variation should expect reduced availability unless the pipeline is re-tuned.
  • Editorial extension: a natural testable extension is delegation chaining, where a sub-agent presents the parent agent's recovered token as proof of inherited scope so that on-the-fly subtasks do not each require a fresh biometric capture; the current protocol does not address this case.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes BIND, a framework that binds a human user's biometric template to an AI agent ID and scope via a fuzzy-commitment construct, producing a delegation token that an Identity Service Provider (ISP) can later de-bind using the enrolled plaintext template. The authors also propose a face-feature adaptation pipeline (Gaussian dithering, Gaussian random projection, and WTA-hash binarization) to convert real-valued deep face embeddings into binary templates suitable for turbo-code-based fuzzy commitment. They report experiments on LFW-a, CFP-FF, and Multi-PIE with three feature extractors, two code rates, two decoding thresholds, and agent-token lengths of 1024, 2048, and 4096 bits, achieving a best True Match Rate of 96% at zero False Match Rate for 1024-bit tokens. The central advertised property is non-repudiable delegation of authority by humans to AI agents, with the ISP and TSP acting as auditors.

Significance. If the central claim held, the framework would address a real and timely problem: anchoring delegated AI-agent actions to an authorizing human. The empirical work is a genuine strength: the TMR/FMR numbers come from end-to-end decoding experiments, the evaluation covers multiple models, losses, code rates, and token lengths, and the best configuration is clearly identified. The paper also attempts a closed-form derivation of the dithering factor rather than fitting it to the reported TMR. However, the main system-level guarantee is invalidated by a protocol-level forgery attack on the plaintext stored template, so the contribution as stated is not established. The face-cryptosystem results may still be a useful empirical contribution if the claims are re-scoped, but they do not support non-repudiable delegation as defined in the abstract and Section 3.

major comments (3)
  1. [§3.3, Eqs. (3)–(6)] The central non-repudiation claim is invalidated by the protocol equations themselves. Since b_n is stored in plaintext and Eq. (6) computes FEC_dec(b_n XOR S_{n,m,ell}), any party who obtains b_n (e.g., via an ISP breach, an insider, or any party with access to the enrolled template) can forge a delegation token for arbitrary agent ID and scope without any fresh biometric sample, without K_n, and without a face image. The attacker chooses a_m and s_l, computes C = E_TSP([a_m||s_l]), A = FEC_enc(C), sets S' = b_n XOR A and H' = H(C), and emits D' = [S'||E_ISP(u_n)||H'] as in Eq. (5). Verification in Eq. (6) then successfully recovers C, the hash check passes, and the ISP logs u_n as the authorizer. This is exactly the identity-spoofing threat listed in §3.2, and it makes the abstract's claim of a 'non-repudiable proof of human control' false as stated.
  2. [§5.3] Section 5.3 explicitly defers all security analysis to future work, but the missing property is not a minor rigor gap: the title, abstract, and conclusion claim non-repudiation, and no formal statement anywhere links the construction to that property under the §3.2 threat model. The paragraph asserts that security 'directly follows' from fuzzy commitment and template entropy, but that assertion does not address the fact that the verifier's stored plaintext template is sufficient to mint valid tokens. This is not a question of inversion resistance; it is a direct use of the enrolled template as a master forgery key. A revision must either redesign the protocol so that the stored data cannot by itself authorize an agent, or substantially weaken the claimed guarantees.
  3. [§4.3, Eq. (12)] Equation (12) is presented as a parameter-free closed-form selector for the dithering factor, but it depends on the operating similarity threshold psi, and psi is never reported anywhere in the paper or in Table 1; the lambda values actually used in the experiments are also not reported. Without these values, the reported TMR/FMR cannot be reproduced from the stated analytic chain. In addition, the derivations in Supplementary A–C rely on asymptotic Gaussian-concentration arguments (e.g., WT W ≈ m I_D) without finite-sample bounds for the actual 512-D embeddings. Please report psi and lambda for each configuration, or state clearly that lambda was tuned empirically rather than selected by Eq. (12).
minor comments (5)
  1. [§3.3] 'Now, We illustrate the proposed identity binding framework' should be 'Now, we illustrate...'.
  2. [§4.1] The footnote marker '1' after 'Sionna library' should be a proper superscript rather than inline text.
  3. [Figure 2 caption] The caption 'CFP-FF ( = 14 @ Rate = 1/3)' appears to be missing the tau symbol before 14; please fix the rendering.
  4. [Appendix C] 'hamming similiarity' should be 'Hamming similarity'.
  5. [Table 1] The architecture names 'IResnet101' and 'KPRPE-ViTb' are inconsistently capitalized; please use official names consistently (e.g., IResNet101, KPRPE-ViT-b).

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the reported TMR/FMR values come from decoding experiments, and lambda follows a closed-form analytic chain rather than being fitted to the target metric.

full rationale

The paper's central derivation chain is self-contained with respect to its reported performance numbers. The face implementation is evaluated by actually running the Turbo-code decoder on binary templates; Table 1 reports measured TMR/FMR values, not quantities that are forced by a fitted parameter. The dithering strength lambda is obtained from Eq. (12), whose derivation (Supplementary D) chains three analytic approximations (Gaussian dithering, random projection, WTA-hash binarization) and relates lambda to the code's error-correction bound tau and a cosine-similarity operating threshold psi; it is not fitted to the reported 96% TMR. The self-citations to prior work by the authors ([32], [33], [39]) are used as feature-extractor choices or background fuzzy-commitment references, and none is invoked as a load-bearing uniqueness or existence theorem to force the BIND construction. Section 5.3 explicitly defers security analysis, and the plaintext-template storage noted in Section 3.3 raises a real forgery risk (an attacker with b_n can construct a token that passes Eq. (6)); however, that is a security-correctness limitation, not a case where a prediction reduces to its inputs by construction. The omission of the exact psi value used in Eq. (12) is a reproducibility gap, not circularity. Therefore no circular step can be exhibited under the required standard.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

BIND's central security and feasibility depend on a small set of stated assumptions. The Gaussian isotropic model for face embeddings is the basis for the closed-form lambda selection; the paper does not test how far real embeddings deviate. The Turbo-code threshold tau is calibrated on random bit flips, not on measured bit-error patterns from the binarized face templates. The transformation key K_n is treated as public in evaluation while the deployment security implicitly relies on its secrecy. No genuinely new physical entities are introduced; the delegation token is a protocol artifact.

free parameters (3)
  • dithering factor lambda = not reported; set via Eq. (12) from tau and operating threshold psi
    Controls how much Gaussian noise is added to face embeddings. It is chosen by a formula based on the target bit-error rate tau and a similarity threshold psi derived from genuine and impostor score distributions; the actual values used in experiments are not listed.
  • Turbo decoding threshold tau = 14%, 15% (rate 1/3); 8%, 9% (rate 1/2)
    Selected from Fig. 3 as the maximum correctable bit-error fraction. The paper tests two values per code rate; the best TMR/FMR result is reported at tau=14% for rate 1/3.
  • operating similarity threshold psi = not reported
    Derived from the genuine-impostor distribution of the face embeddings and used to compute lambda. Its value is not stated in the paper, which makes the lambda selection hard to reproduce exactly.
assumptions (4)
  • domain assumption Face embeddings f_n follow a zero-mean Gaussian distribution with spherical covariance sigma_f^2 I (Assumption 1).
    Used to derive Propositions 1-3 and Eq. (12) for selecting lambda. Real normalized deep face embeddings are bounded on a sphere and are not exactly isotropic Gaussian.
  • standard math High-dimensional concentration: D=512 and r up to 4096 are large enough for the approximations in Propositions 1-3 to hold without finite-sample error bounds.
    The proofs use 'sufficiently large D and r' with no error terms; the experimental operating point relies on these limits.
  • domain assumption Biometric bit errors after binarization behave like independent random bit flips, so the Turbo code threshold tau derived from Fig. 3 applies.
    Fig. 3 characterizes Turbo codes on random bit-flip channels; the paper does not verify that WTA-hash bit errors across genuine samples are independent or random.
  • domain assumption The user-specific transformation key K_n can be treated as public (stolen-key scenario) for performance evaluation without affecting the framework's security.
    Section 5.1 says all results assume K_n is not secret; however, the non-repudiation argument in Section 3 implicitly relies on the secrecy of K_n to prevent reconstruction of the binary template from public face images.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Binding Biometrics with AI Agent Identifiers for Delegation of Authority." pith.science (2026). https://pith.science/paper/AG7546EY

@misc{pith2026260804292,
  author       = {Pith},
  title        = {Pith review of: Binding Biometrics with AI Agent Identifiers for Delegation of Authority},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/AG7546EY}},
  note         = {Machine review of arXiv:2608.04292}
}
abstract

The proliferation of agentic artificial intelligence (AI) systems has raised serious questions about the accountability for tasks performed by AI agents. Ideally, an AI agent must not be allowed to perform critical tasks without explicit authorization by a human operator. Since biometric recognition is one of the most reliable approaches for authenticating individuals, it has the potential to enable authenticated delegation of authority to AI agents. In this work, we present a framework called BIND, which leverages ideas from the field of biometric cryptosystems, to securely bind biometric data of the human user to the AI agent identity (ID) and authority scope (task-specific constraints) at the time of agent authorization. This token/identifier can be presented by the AI agent to an Identity Auditor, who simultaneously performs biometric authentication and recovers the agent ID and scope, thereby enabling real-time user authentication and establishing a non-repudiable proof of human control and delegation of authority. We also provide a practical implementation of the proposed BIND framework based on face features extracted using standard deep neural network models. To facilitate this implementation, we propose a feature adaptation module that transforms real-valued feature embeddings into fixed-length binary representations suitable for a fuzzy commitment construct based on turbo error correcting codes. Experiments demonstrate the practical feasibility of the proposed face cryptosystem, achieving a True Match Rate of $96\%$ at zero False Match Rate and supporting $1024$-bit agent tokens.

Figures

Figures reproduced from arXiv: 2608.04292 by the authors.

Figure 1
Figure 1. The flow diagram shows a user delegating a task to a primary agent, which decomposes the task into subtasks and generates [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Effect of each step in the Feature Adaptation and Bina [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. Biometric features show intra-user variability, so a fuzzy [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗

Review history (2 revisions) →

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

55 extracted references · 45 canonical work pages

  1. [1]

    Agent Communication Protocol (ACP).https : / / github.com/i-am-bee/acp, 2025. 3

    work page 2025

  2. [2]

    com / agent - network - protocol / AgentNetworkProtocol, 2025

    Agent Network Protocol (ANP).https : / / github . com / agent - network - protocol / AgentNetworkProtocol, 2025. 3

    work page 2025

  3. [3]

    Open Agent Specification (Agent Spec).https : / / github.com/oracle/agent-spec, 2025. 3

    work page 2025

  4. [4]

    A2UI.https://github.com/google/A2UI, 2026. 3

    work page 2026

  5. [5]

    com / openagentidentityprotocol / agentidentityprotocol, 2026

    Agent Identity Protocol.https : / / github . com / openagentidentityprotocol / agentidentityprotocol, 2026. 3

    work page 2026

  6. [6]

    Agent2Agent (A2A) Protocol.https://github.com/ a2aproject/A2A, 2026. 1, 2, 3

    work page 2026

  7. [7]

    com / modelcontextprotocol / modelcontextprotocol, 2026

    Model Context Protocol (MCP).https : / / github . com / modelcontextprotocol / modelcontextprotocol, 2026. 1, 2, 3

    work page 2026

  8. [8]

    Berrou, A

    C. Berrou, A. Glavieux, and P. Thitimajshima. Near shannon limit error-correcting coding and decoding: Turbo-codes. 1. InProceedings of ICC’93-IEEE International Conference on Communications, volume 2, pages 1064–1070. IEEE, 1993. 5

    work page 1993

Show all 55 references
  1. [9]

    K. N. Chadwick and J. Vercammen. Openid for verifiable credentials.OpenID Foundation, 2022. 1

    2022

  2. [10]

    A. Chan, N. Kolt, P. Wills, U. Anwar, C. S. de Witt, N. Ra- jkumar, L. Hammond, D. Krueger, L. Heim, and M. An- derljung. Ids for ai systems. InNeurIPS 2024 Workshop on Regulatable ML. 4

    2024

  3. [11]

    A. Chan, K. Wei, S. Huang, N. Rajkumar, E. Perrier, S. Lazar, G. K. Hadfield, and M. Anderljung. Infrastructure for ai agents.arXiv preprint arXiv:2501.10114, 2025. 1, 2

    2025 arXiv

  4. [12]

    M. S. Charikar. Similarity estimation techniques from round- ing algorithms. InProceedings of the thiry-fourth annual ACM symposium on Theory of computing, pages 380–388,

  5. [13]

    R. Clarke. Human identification in information systems: Management challenges and public policy issues.Informa- tion Technology & People, 7(4):6–37, 1994. 2

    1994

  6. [14]

    J. Deng, J. Guo, N. Xue, and S. Zafeiriou. Arcface: Additive angular margin loss for deep face recognition. InProceed- ings of the IEEE/CVF conference on computer vision and pattern recognition, pages 4690–4699, 2019. 5, 7

    2019

  7. [15]

    H. Du, S. Thudumu, R. Vasa, and K. Mouzakis. A survey on context-aware multi-agent systems: techniques, challenges and future directions.arXiv preprint arXiv:2402.01968,

    arXiv

  8. [16]

    Ehtesham, A

    A. Ehtesham, A. Singh, G. K. Gupta, and S. Kumar. A survey of agent interoperability protocols: Model context protocol (mcp), agent communication protocol (acp), agent- to-agent protocol (a2a), and agent network protocol (anp). arXiv preprint arXiv:2505.02279, 2025. 3

    2025 arXiv

  9. [17]

    Ghafourian, J

    M. Ghafourian, J. Fierrez, R. Vera-Rodriguez, A. Morales, and I. Serna. Otb-morph: One-time biometrics via morphing. Machine Intelligence Research, 20(6):855–871, 2023. 3

    2023

  10. [18]

    Goh and D

    A. Goh and D. C. Ngo. Computation of cryptographic keys from face biometrics. InIFIP International Conference on Communications and Multimedia Security, pages 1–13. Springer, 2003. 3

    2003

  11. [19]

    Gross, R

    G. Gross, R. Nagi, and K. Sambhoos. Soft information, dirty graphs and uncertainty representation/processing for situa- tion understanding. In2010 13th International Conference on Information Fusion, pages 1–8. IEEE, 2010. 7

    2010

  12. [20]

    F. Hao, R. Anderson, and J. Daugman. Combining crypto with biometrics effectively.IEEE transactions on computers, 55(9):1081–1088, 2006. 3

    2006

  13. [21]

    D. Hardt. The OAuth 2.0 Authorization Framework, RFC 6749.https : / / www . rfc - editor . org / info / rfc6749, October 2012. Ed. 1, 4

    2012

  14. [22]

    Hoydis, S

    J. Hoydis, S. Cammerer, F. A. Aoudia, A. Vem, N. Binder, G. Marcus, and A. Keller. Sionna: An open-source library for next-generation physical layer research.arXiv preprint arXiv:2203.11854, 2022. 5

    2022 arXiv

  15. [23]

    A. Jain, R. Bolle, and S. Pankanti. Introduction to biometrics. InBiometrics: personal identification in networked society, pages 1–41. Springer, 2011. 2

    2011

  16. [24]

    A. K. Jain, A. Ross, and U. Uludag. Biometric template security: Challenges and solutions. In2005 13th European signal processing conference, pages 1–4. IEEE, 2005. 3

    2005

  17. [25]

    Z. Ji, D. Wu, W. Jiang, P. Ma, Z. Li, Y . Gao, S. Wang, and Y . Li. Taming various privilege escalation in llm-based agent systems: A mandatory access control framework.arXiv preprint arXiv:2601.11893, 2026. 2

    2026

  18. [26]

    H. Jin, K. Kim, and J. Kwon. Gridmind: Llms-powered agents for power system analysis and operations. InProceed- ings of the SC’25 Workshops of the International Conference for High Performance Computing, Networking, Storage and Analysis, pages 560–568, 2025. 1

    2025

  19. [27]

    Z. Jin, J. Y . Hwang, Y .-L. Lai, S. Kim, and A. B. J. Teoh. Ranking-based locality sensitive hashing-enabled cancelable biometrics: Index-of-max hashing.IEEE Transactions on Information Forensics and Security, 13(2):393–407, 2017. 6, 8

    2017

  20. [28]

    Z. Jin, A. B. J. Teoh, B.-M. Goi, and Y .-H. Tay. Biomet- ric cryptosystems: a new biometric key binding and its im- plementation for fingerprint minutiae-based representation. Pattern Recognition, 56:50–62, 2016. 3

    2016

  21. [29]

    M. B. Jones, A. Nadalin, and B. Campbell. OAuth 2.0 Token Exchange, RFC 8693.https://www.rfc- editor. org/info/rfc8693, 2020. 1

    2020

  22. [30]

    Juels and M

    A. Juels and M. Sudan. A fuzzy vault scheme. InProceed- ings of the IEEE International Symposium on Information Theory, page 408. IEEE, 2002. 3

    2002

  23. [31]

    Juels and M

    A. Juels and M. Wattenberg. A fuzzy commitment scheme. InProceedings of the 6th ACM Conference on Computer and Communications Security, pages 28–36, 1999. 3, 4, 8

    1999

  24. [32]

    M. Kim, A. K. Jain, and X. Liu. Adaface: Quality adaptive margin for face recognition. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 18750–18759, 2022. 7

    2022

  25. [33]

    M. Kim, Y . Su, F. Liu, A. Jain, and X. Liu. Keypoint relative position encoding for face recognition. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 244–255, 2024. 7

    2024

  26. [34]

    S. Kim, Y . Jeong, J. Kim, J. Kim, H. T. Lee, and J. H. Seo. Ironmask: Modular architecture for protecting deep face template. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 16125– 16134, 2021. 3

    2021

  27. [35]

    Liang, E

    Z. Liang, E. Cui, Q. Wei, R. She, T. Li, M. Guo, and Y . Cheng. A2h: Agent-to-human protocol for ai agent.arXiv preprint arXiv:2602.15831, 2025. 3

    2025

  28. [36]

    Lim and P

    M.-H. Lim and P. C. Yuen. Entropy measurement for biomet- ric verification systems.IEEE transactions on cybernetics, 46(5):1065–1077, 2015. 8

    2015

  29. [37]

    R. Ly, A. Shojaei, and X. Gao. Smart building operations and virtual assistants using llm. InProceedings of the 33rd ACM International Conference on the Foundations of Soft- ware Engineering, pages 1683–1689, 2025. 1

    2025

  30. [38]

    G. Mai, K. Cao, X. Lan, and P. C. Yuen. Secureface: Face template protection.IEEE Transactions on Information Forensics and security, 16:262–277, 2020. 3

    2020

  31. [39]

    Nandakumar

    K. Nandakumar. A fingerprint cryptosystem based on minu- tiae phase spectrum. In2010 IEEE International Workshop on Information Forensics and Security, pages 1–6. IEEE,

  32. [40]

    S. Rane, Y . Wang, S. C. Draper, and P. Ishwar. Secure bio- metrics: Concepts, authentication architectures, and chal- lenges.IEEE Signal Processing Magazine, 30(5):51–64,

  33. [41]

    N. K. Ratha, J. H. Connell, and R. M. Bolle. Enhancing secu- rity and privacy in biometrics-based authentication systems. IBM systems Journal, 40(3):614–634, 2001. 3

    2001

  34. [42]

    Rathgeb, F

    C. Rathgeb, F. Breitinger, and C. Busch. Alignment-free can- celable iris biometric templates based on adaptive bloom fil- ters. In2013 international conference on biometrics (ICB), pages 1–8. IEEE, 2013. 3

    2013

  35. [43]

    Rathgeb and A

    C. Rathgeb and A. Uhl. A survey on biometric cryptosystems and cancelable biometrics.EURASIP journal on information security, 2011(1):3, 2011. 3

    2011

  36. [44]

    Rivkin, F

    D. Rivkin, F. Hogan, A. Feriani, A. Konar, A. Sigal, X. Liu, and G. Dudek. Aiot smart home via autonomous llm agents. IEEE Internet of Things Journal, 12(3):2458–2472, 2024. 1

    2024

  37. [45]

    Schwenkschuster, P

    A. Schwenkschuster, P. Kasselman, K. Burgin, M. J. Jenkins, B. Campbell, and A. Parecki. OAuth Identity and Autho- rization Chaining Across Domains. Internet-draft, Internet Engineering Task Force, June 2026. 2

    2026

  38. [46]

    Sengupta, J.-C

    S. Sengupta, J.-C. Chen, C. Castillo, V . M. Patel, R. Chel- lappa, and D. W. Jacobs. Frontal to profile face verification in the wild. In2016 IEEE winter conference on applications of computer vision (WACV), pages 1–9. IEEE, 2016. 7

    2016

  39. [47]

    South, S

    T. South, S. Marro, T. Hardjono, R. Mahari, C. D. Whitney, A. Chan, and A. Pentland. Position: Ai agents need authen- ticated delegation. InForty-second International Conference on Machine Learning Position Paper Track, 2025. 1, 2, 4

    2025

  40. [48]

    South, S

    T. South, S. Nagabhushanaradhya, A. Dissanayaka, S. Cec- chetti, G. Fletcher, V . Lu, A. Pietropaolo, D. H. Saxe, J. Lom- bardo, A. M. Shivalingaiah, et al. Identity management for agentic ai: The new frontier of authorization, authenti- cation, and security for an ai agent wo...

  41. [49]

    K. Tallam. Authorization propagation in multi-agent ai sys- tems: Identity governance as infrastructure.arXiv preprint arXiv:2605.05440, 2026. 2

    2026 arXiv

  42. [50]

    Toma ˇsev, M

    N. Toma ˇsev, M. Franklin, and S. Osindero. Intelligent ai delegation.arXiv preprint arXiv:2602.11865, 2026. 2

    2026

  43. [51]

    Van Der Veen, T

    M. Van Der Veen, T. Kevenaar, G.-J. Schrijen, T. H. Akker- mans, and F. Zuo. Face biometrics with renewable templates. InSecurity, Steganography, and Watermarking of Multime- dia Contents VIII, volume 6072, pages 205–216. SPIE, 2006. 3

    2006

  44. [52]

    T. Wang, W. Wen, X. Xiao, Z. Hua, Y . Zhang, and Y . Fang. Beyond privacy: Generating privacy-preserving faces sup- porting robust image authentication.IEEE Transactions on Information Forensics and Security, 2025. 3

    2025

  45. [53]

    L. Wolf, T. Hassner, and Y . Taigman. Descriptor based meth- ods in the wild. InWorkshop on faces in’real-life’images: Detection, alignment, and recognition, 2008. 7

    2008

  46. [54]

    J. Yang, N. Yonack, K. Zyskowski, D. Yarats, J. Ho, and J. Ma. The adoption and usage of ai agents: Early evidence from perplexity.arXiv preprint arXiv:2512.07828, 2025. 1

    2025

  47. [55]

    Z. Zhu, G. Huang, J. Deng, Y . Ye, J. Huang, X. Chen, J. Zhu, T. Yang, J. Lu, D. Du, et al. Webface260m: A benchmark unveiling the power of million-scale deep face recognition. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 10492–105...

    2021

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.