How aging, injury and capture impact the challenge of change in biometric identifiers

One of the oft-cited advantages of using biometrics for verification and authentication is that they are unique to a person’s body and therefore more stable and difficult to steal than physical ID documents. But bodies change over time: even someone who never loses their passport is certain to lose their youth.

Biometric identification methods rely on matching a biological signature made up of measurements converted into vectors with a registered copy of that signature. But the temporal persistence or stability of biometrics varies by modality. As a wide variety of biometrics and digital identity applications become increasingly integrated into daily life, it is worth considering how providers and users address questions around aging and physical transformation.

What we know about biometric persistence

Biometrics are unquestionably more secure than a paper ID document that can be lost or stolen. It is not easy to steal someone’s face. However, new engines for fraud have emerged in the form of generative AI, deepfakes and sophisticated 3D spoofs. Are changes in the body the key to biometric security, or a hindrance?

Stephanie Schuckers of Clarkson University says the approach to physical variables changes for each modality. Fingerprints, faces, irises and palms tell different stories and are subject to change in different ways.

Fingerprint biometrics

Fingerprints, notoriously, do not change – but of course, says Schuckers, they do, particularly in young children.

“The relative position between the minutiae is fairly stable,” she says, but you have to scale it as a child grows, measuring at intervals – a process that has not yet been standardized. “Right now, there are multiple papers on how to scale it. But it’s still not totally solved, because how you scale makes a difference.” Schuckers says other factors in accounting for change in children’s prints include the resolution of the scanner – “a 500 DPI scanner is fine to a point right now, but as the fingerprint gets smaller and smaller, you need much higher resolution scanners” – and the relative elasticity of the fingerprint.

The latter is an issue both for newborns and senior citizens, whose prints are less elastic and have thicker ridges, making them harder to read. Cuts and scars can also cause permanent change if they cut through the regenerating layer beneath the fingerprint. But, Schuckers says re-enrolment is an easy fix for most people, and that with fingerprint biometrics there are always multiple options.

“Fingerprints are formed in the womb. It’s just a matter of measuring it and scaling it properly, and it should be persistent throughout your life. Fingerprints can last a lifetime as long as you have an algorithm and hardware and software that can account for all these things.”

Face biometrics

We all know how faces change, from beards to glasses to wrinkles beside the eyes. Schuckers says the long and the short of it with face biometrics is that algorithms are far, far better than they used to be, and continually improving.  With vast databases of accrued images to learn from, performance rates are near perfect, and algorithms can account for aging with standardized re-enrolments in tandem with passports (i.e. every ten years or so).

The story is different for kids, for whom performance rates remain in the low 90s. “It used to be that it just didn’t work at all,” she says. “But these more advanced algorithms – not trained on children, still trained on adult data – are able to handle more variability and are doing better.” She says most of the data for facial recognition is in the upper half of the face, and points out how photographs of people as children are often recognizable as the adults they will become, with most changes visible in the lower half of the face. “So I would say face is getting better, for kids” she says, “but it’s more like a decent performance after a few years” and multiple re-enrolments.

Iris biometrics

“Iris is really interesting,” says Schuckers, “because it is stable throughout the lifetime.” She has written papers arguing as much. But there is some controversy, she says, around dilation. “As you age, the way your eyes dilate changes, and the algorithms to accommodate dilation differences have some adjustments that they make if one image is dilated differently compared to another one. But those adjustments aren’t very good sometimes. And so, the key to that persistence is that the dilation of the pupil is similar when you can actually control it with light.” If you can adjust conditions to control the variable, she says, irises have been shown to be stable throughout a person’s life, barring outliers such as surgery or diseases like cataracts.

The issue with iris biometrics for kids is not temporal change – research has shown that irises do not significantly change between the ages of 4 and 11 – but squirminess at point of capture. “Once you get below five, the systems aren’t designed for that. A child can’t focus long enough. So it’s kind of similar to the fingerprint: it’s stable, but capturing it needs to be specialized for children’s work.”

While the fundamental stability of the iris from cradle to grave is still technically an open question, Schuckers points out that the iris is a muscle, and that with proper capture and algorithmic adjustments, it should theoretically be consistent for a person’s whole life.

Capture and liveness the key

Schuckers has not yet researched palm vein biometrics deeply enough to make a formal comment, and other modalities like body odor and gait have limited use cases compared to the big three. But, says Schuckers, the key to biometric identification is not really in persistence, anyhow – but rather, in liveness.

“People ask me the question, which modality is easiest to spoof? And I don’t think it’s the right question anymore,” she says. “Systems understand that they need to have a mechanism to adjust for liveness,” and which modality is easiest to hack may depend on how much investment has been put into liveness detection at capture. Photographs, says Schuckers, are easy to find, and data breaches and the dark web are making fingerprint data easier than ever to come by. How a biometric changes is ultimately less important than whether or not it is attached to a living person.

“So it’s really like, does it matter that my fingerprints are being stolen, or is it more important to just make sure the data is not useful?” she says. “That’s what we try to do with liveness.”

Article Topics

biometric identifiers  |  biometric liveness detection  |  face biometrics  |  fingerprint biometrics  |  iris biometrics  |  Stephanie Schuckers