The threat at the heart of the work is the membership inference attack, or MIA. In such an attack, an adversary interrogates a trained model and tries to determine whether a specific record, perhaps a patient’s medical scan or a person’s biometric template, was part of the data used to train it. The mere confirmation that someone’s data was in a hospital’s training set can be a privacy violation in its own right, particularly under regulations such as the GDPR that govern how personal information may be processed. Membership inference attacks were first formalized by Shokri and colleagues in 2017, and since then an entire research literature has grown around both sharpening these attacks and defending against them.

What has frustrated defenders is that most existing attack and evaluation methods rest on assumptions that rarely hold in the real world. Classic approaches require shadow models, replicas trained to mimic the target’s behavior, or access to confidence scores, or knowledge of how the data was split between training and test sets. In a genuine black-box scenario, where an evaluator can only query a deployed model and observe its outputs, these assumptions are often unrealistic. Moreover, existing techniques tend to be computationally expensive, and many were designed exclusively for classification tasks, leaving semantic segmentation models, which are central to medical imaging, poorly covered. Evaluating whether decentralized training paradigms such as federated learning resist these attacks has therefore remained a genuine open challenge.

The IIT Kharagpur team’s contribution is a framework that sidesteps these obstacles entirely. Their method assesses membership privacy risk through what they call dropout-induced inference deviation. Dropout, a technique originally introduced by Srivastava and colleagues in 2014 to prevent overfitting, randomly deactivates units in a neural network during training. The researchers exploit a different facet of dropout: by randomly dropping units at inference time and observing how much the model’s outputs fluctuate, they obtain a signal that distinguishes memorized training samples from unseen ones. Samples the model has memorized respond differently to this induced randomness than samples it has merely generalized over, and the magnitude of that deviation serves as a proxy for membership risk.

The elegance of the approach lies in its minimal requirements. It demands no shadow models, no auxiliary datasets, and no access to the model’s internal parameters or train-test splits. Anyone who can query a deployed black-box model can apply the diagnostic, making it a practical tool for organizations that need to audit privacy risk in systems they did not train. Because it works for both classification and segmentation tasks, it covers the full spectrum of vision models used in biometric authentication and medical imaging, the cross-disciplinary context in which the work is situated.

Beyond the empirical tool, the study offers a theoretical account of why federated learning should resist memorization in the first place. Through sensitivity analysis and an examination of loss surface geometry, the authors show that centralized training tends to converge to sharp minima, narrow valleys in the loss landscape where the model fits the training data with high precision. Sharp minima are associated with overfitting and with amplified output variability between training and non-training samples, which is precisely the variability an inference attacker exploits. Federated aggregation, in which multiple clients train locally and only model updates are combined by a central server, drives models toward flatter minima. Flatness, as prior work on generative models has also suggested, suppresses memorization and reduces the leakage of membership information.

This connection between loss landscape geometry and privacy is the conceptual payoff of the paper. It reframes federated learning not merely as a data-governance arrangement, in which raw data never leaves the client device or institution, but as a training procedure whose optimization dynamics themselves confer a privacy benefit. The aggregation of updates across heterogeneous clients acts as a form of implicit regularization, smoothing the loss surface and discouraging the model from latching onto individual records. That mechanistic insight elevates the work beyond a benchmarking exercise and gives practitioners a principled reason to prefer decentralized training when privacy is paramount.

The empirical validation is unusually broad. The framework was tested across seven datasets spanning both classification and segmentation tasks, including biomedical image benchmarks such as MedMNIST and the ISIC skin lesion archive, alongside classic computer vision datasets like CIFAR and SVHN. Model architectures were equally diverse, ranging from residual networks and MobileNet variants for classification to U-Net, U-Net++, and DeepLabV3+ for segmentation. Across this breadth, the dropout-induced deviation signal consistently separated training from non-training samples, and the comparison between centralized and federated training regimes confirmed that federated aggregation reduces membership leakage. Demonstrating generality across tasks and architectures is what distinguishes the method from earlier evaluation schemes that were tailored to a single model family or output type.

The practical implications extend well into the domains where the stakes are highest. In medical imaging, models trained on hospital data are exactly the kind of high-value, sensitive assets that membership inference attacks target, and regulations going back decades, from early federal medical privacy rules to modern data protection law, recognize the harm that even metadata-level disclosures can cause. In biometric authentication, where the training data consists of irrevocable personal identifiers, the ability to audit a deployed model for memorization without touching its internals is a significant operational advantage. A hospital or a device manufacturer could run the diagnostic on a production model, quantify its membership risk, and make informed decisions about whether additional defenses, such as input perturbation at the client level, are warranted.

The work also contributes to a broader recalibration in the security community. Recent systematizations of knowledge have argued that membership inference is harder than previously thought, and that many reported attack successes depend on favorable assumptions about data dependencies, distribution shifts, and attacker knowledge. Against that backdrop, a cheap, assumption-free measurement tool is valuable precisely because it lets defenders, not just attackers, quantify risk under realistic black-box conditions. The authors’ framework, computable with nothing more than repeated stochastic queries to the model, turns privacy auditing from an expensive research project into a routine check. As federated learning continues to spread through healthcare, mobile computing, and cross-institutional collaborations, the study suggests that the decentralized paradigm offers not just regulatory comfort but a measurable, geometrically grounded reduction in the risk that a model will give up the secrets of the data it was built on.

Subject of Research: Membership privacy risk assessment in federated versus centralized deep learning

Article Title: Can federated models keep secrets better?

Article References: Borthakur, A., Srivastava, A., & Sheet, D. (2026). Can federated models keep secrets better?. Multimedia Tools and Applications, 85(11), Article 816. https://doi.org/10.1007/s11042-026-21981-5

Image Credits: AI Generated

DOI: 10.1007/s11042-026-21981-5

Keywords: federated learning, membership inference attack, deep learning, data privacy, dropout, loss surface geometry, black-box evaluation, medical imaging, biometric authentication, semantic segmentation, sharp minima, privacy auditing

The scale of the problem the researchers set out to address is growing rapidly. Digital wallets have matured from a niche curiosity into a mainstream payment technology, with industry analyses such as the Worldpay Global Payments Report 2024 describing a golden age of digital wallet adoption. At the same time, surveys conducted for the payments industry suggest that European consumers are increasingly willing to use biometrics to secure payments, and market researchers project substantial growth in the biometric payment sector through 2034. Yet the recovery mechanisms underpinning self-custodied cryptocurrency wallets have remained largely unchanged since BIP 39 was introduced in 2013. Users are expected to transcribe a sequence of twelve or more words drawn from a fixed vocabulary of 2048 English terms, hide that transcription securely, and remember where they put it, sometimes for decades.

The consequences of this design are well documented in the security literature. Recovery phrases can be photographed by malware, discovered by anyone with physical access to the hiding place, or irretrievably forgotten. Previous attempts to soften the burden have taken several forms, including user-defined seed phrases that substitute memorable personal phrases for random word lists, secure testament methodologies that entrust recovery material to third parties, and decentralized backup schemes that split the mnemonic across multiple locations using techniques such as elliptic curve cryptography and secret sharing. Others have explored binding cryptographic keys to biometric templates through fuzzy vault schemes and fuzzy extractors, or deriving authentication material from behavioral biometrics such as typing patterns. Each approach trades some combination of security, convenience, and trust in external parties. The Iranian team’s proposal aims to minimize reliance on the mnemonic phrase itself while keeping the entire authentication process local to the user.

At the heart of the new system is a multi-factor construction that combines three distinct elements: fingerprint recognition, facial feature extraction, and a minimal remnant of the traditional mnemonic scheme. The facial component is deliberately unusual. Rather than relying solely on a face match, the system extracts attributes including the user’s gender and dominant emotional expression from facial images, treating these inferred characteristics as additional authentication factors. According to the paper’s experimental results, the gender classification component achieved an accuracy of 97.44 percent, while emotion recognition reached 91.5 percent. The fingerprint module, evaluated on the publicly available Sokoto Coventry Fingerprint Dataset, produced a False Non-Match Rate of 0.0598, meaning roughly six legitimate users in a hundred would fail a verification attempt, and a False Match Rate of zero, meaning no impostor in the tested population was wrongly accepted.

The choice of those two error metrics matters enormously in a wallet recovery context. A False Match Rate of zero indicates that the system did not grant access to any unauthorized fingerprint in the evaluation, which is the more dangerous failure mode when cryptographic keys controlling real money are at stake. The nonzero False Non-Match Rate, by contrast, represents a usability cost: some legitimate users would need to retry or fall back on their remaining factors. This tension between false accepts and false rejects is the fundamental trade-off of all biometric systems, and the researchers tuned their thresholds toward the conservative end, accepting occasional inconvenience in exchange for tighter security. Feature extraction for the fingerprint stage drew on established computer vision techniques, including Harris corner detection and the ORB algorithm, an efficient alternative to older methods such as SIFT and SURF that is well suited to resource-constrained devices.

Biometric matching alone, however, does not produce cryptographic keys. Fingerprints and faces are noisy, variable, and impossible to reproduce exactly, whereas wallet keys demand bit-perfect determinism. The system bridges this gap using modern, standards-based key derivation functions. The first is Argon2id, the winner of the Password Hashing Competition, which is specifically designed to be memory-hard, meaning it forces any attacker attempting a brute-force search to consume large amounts of memory as well as computation. This makes large-scale guessing attacks dramatically more expensive, particularly for adversaries running parallel attempts on graphics processors. The second is the HMAC-based Extract-and-Expand Key Derivation Function, standardized as RFC 5869, which takes unevenly distributed input material and distills it into cryptographically strong, uniformly random key material through an extract phase followed by an expand phase.

The architecture can be understood as a layered funnel. Biometric measurements and the user’s chosen passphrase feed into the derivation pipeline, where Argon2id first imposes its memory-hard cost on any computation, whether legitimate or adversarial. HKDF then normalizes the resulting material and expands it into the key components the wallet requires. The single retained mnemonic word acts as an additional secret that the user must supply, preserving a small foothold of the traditional scheme while eliminating the need to safeguard eleven or more words. Because the derivation is deterministic, the same combination of biometric presentation, passphrase, and mnemonic word reliably regenerates the same wallet keys, which is precisely the property that deterministic wallets demand. An attacker who lacks any one of the factors cannot reconstruct the key, and the memory-hardness of Argon2id ensures that even partial knowledge does not translate into a tractable offline guessing campaign.

The datasets underpinning the evaluation are themselves a notable aspect of the work. The researchers trained and tested their facial attribute models on two publicly available facial emotion recognition datasets from Kaggle, contributed by Roman K in 2023 and Kapadnis in 2024, while fingerprint experiments used the Sokoto Coventry Fingerprint Dataset, a widely cited benchmark assembled by Shehu and colleagues in 2018. Relying on public benchmarks allows independent researchers to reproduce and stress-test the reported figures, an important consideration for any security proposal that aspires to real-world deployment. The authors have also made their data available through a public repository link, further supporting reproducibility. The work was conducted without external funding, and the authors report no competing interests.

Still, the path from a promising prototype to a wallet that safeguards life savings is long, and the paper’s approach raises questions that future research must confront. Biometric characteristics are not secrets in the cryptographic sense: faces are visible in public, and fingerprints are left on surfaces everywhere. The security of the scheme therefore rests not on the secrecy of the biometric itself but on the difficulty of converting a stolen image or latent print into the exact digital template the system expects, combined with the passphrase and mnemonic word that the user keeps secret. The broader biometric cryptosystem literature has developed countermeasures such as cancellable templates, which allow a compromised biometric reference to be replaced the way a password would be, and recent work on privacy-preserving template generation suggests these defenses are maturing. How well such protections integrate with the new wallet architecture remains to be demonstrated.

There is also the question of what happens when biology misbehaves. Cuts, scars, aging, and injuries can change fingerprints; illness, fatigue, and lighting conditions can alter facial appearance and even emotional expression. With a False Non-Match Rate approaching six percent, a meaningful fraction of legitimate recovery attempts would initially fail, and the consequences of a failed recovery in a self-custody context are far more severe than a failed login to a social media account. The single mnemonic word and passphrase provide a fallback factor, but they also mean the system does not entirely eliminate the cognitive burden it set out to remove. What the study does demonstrate is that the burden can be reduced from memorizing and safeguarding a dozen high-entropy words to remembering one word and a personal passphrase, with biometrics carrying most of the load. If the reported accuracy figures hold up under adversarial scrutiny and real-world variability, the framework could mark a meaningful step toward wallets that are both safer and more humane, turning the body itself into a recovery phrase that can never be left on a train.

Subject of Research: Biometric authentication for deterministic cryptocurrency wallets to reduce reliance on mnemonic recovery phrases

Article Title: Biometric authentication system for deterministic digital wallets: aiming to reduce the reliance on mnemonic phrases

Article References: Haghighatkhah, F. H., & Mosharraf, M. (2026). Biometric authentication system for deterministic digital wallets: aiming to reduce the reliance on mnemonic phrases. Multimedia Tools and Applications, 85(10), Article 800. https://doi.org/10.1007/s11042-026-21960-w

Image Credits: AI Generated

DOI: 10.1007/s11042-026-21960-w

Keywords: biometric authentication, digital wallets, cryptocurrency, mnemonic phrases, BIP 39, fingerprint recognition, facial recognition, emotion recognition, Argon2id, HKDF, key derivation, biometric cryptosystem

The difficulty of the task stems from two opposing phenomena that researchers call intra-person variation and inter-person similarity. No one signs their name exactly the same way twice; mood, speed, writing surface, fatigue and even the angle of the pen introduce variation between two genuine signatures from the same hand. At the same time, two different people—especially those trained in the same script or school of penmanship—can produce signatures that look strikingly alike. A verification system must therefore walk a narrow line: it must tolerate the natural drift within one person’s signatures while remaining sensitive enough to reject a skilled forgery by someone else. Features that fluctuate wildly between genuine samples inflate false rejections, while features shared by many writers invite false acceptances.

To resolve this tension, the team proposes a Multi-Phase Fusion Architecture that builds reliability into the system at several successive stages rather than relying on a single classification step. The central idea is to identify a compact set of consistent and stable discriminatory features—measurements that repeatedly appear, with little variation, across the genuine signature samples of the same individual. The authors contend that such stability-driven features, being both repeatable and influential in separating writers, are the true foundation of a verification system that generalises beyond the data it was trained on, a property that matters enormously when signatures arrive in the real world under conditions no training set can fully anticipate.

The first phase of the architecture tackles the question of what to measure. The researchers combine global texture features, which characterise the overall statistical appearance of the signature image, with fine-grained texture features that capture local, detailed patterns of ink and stroke structure. Texture analysis has a long pedigree in image processing, and descriptors derived from the spatial distribution of grey-level values can encode subtle regularities in pen pressure, stroke density and slurry of ink that are difficult to articulate but easy to compute. By fusing coarse and fine scales of description, the method aims to preserve both the gestalt of a signature—its overall shape and balance—and the microscopic texture cues that often betray a forgery, such as hesitation marks, tremor or unnatural stroke filling.

The second phase is where the study makes its most distinctive contribution. Rather than feeding the full fused feature vector into a classifier, the team subjects it to multiple feature selection techniques, spanning both filter-based methods, which rank features by intrinsic statistical properties, and wrapper-based methods, which evaluate subsets of features by how well a learning algorithm performs with them. Crucially, the authors place heavy emphasis on stability analysis. A feature selection method is only useful, they argue, if it repeatedly selects the same features when the training data changes. Stability metrics are therefore computed to evaluate the consistency and robustness of the selected features across varying datasets. This step directly addresses a well-known weakness of wrapper methods: on small or noisy datasets they can latch onto accidental correlations that vanish on new data. By demanding that the chosen features remain stable, the study seeks a feature set that reflects the true, writer-specific signature of a person’s hand rather than the quirks of one particular sample collection.

The third phase turns to decision-making. Instead of trusting a single classifier, the system employs an ensemble learning technique, combining the judgments of multiple learners into a final verdict. Ensemble methods, which have a rich theoretical grounding in the pattern recognition literature, reduce the risk that one model’s idiosyncratic errors will dominate the outcome. In the context of signature verification, where the consequences of a false acceptance can be financial fraud and those of a false rejection can be inconvenience and mistrust, this layered approach to reliability—stable features first, robust selection second, collective decision third—forms a coherent defence against the two classic failure modes of biometric systems.

The evaluation is unusually broad in linguistic scope. The proposed method was tested on four multilingual signature datasets: CEDAR, MCYT-75, UTSig, and BHSig260, the last covering both Hindi and Bengali scripts. These benchmarks collectively span English, Spanish, Persian, Hindi and Bengali writing traditions, exposing the system to radically different scripts, stroke conventions and cultural signing habits. The reported accuracies are 100 percent on CEDAR, 96.61 percent on BHSig260, 88.75 percent on MCYT-75, 92.66 percent on UTSig, and 98.94 percent on the respective datasets evaluated. The authors interpret this spread as evidence of superior performance and strong generalisation capability across diverse linguistic and writing styles, with the perfect score on CEDAR demonstrating how well the stability-selected features behave when intra-writer consistency is high.

The significance of the stability-first philosophy extends beyond signature verification. Feature selection stability has become a recognised concern across machine learning, from text classification to anomaly detection, because unstable selections undermine reproducibility and trust. By explicitly measuring whether the same features survive across datasets, this study aligns signature verification with a broader movement in applied machine learning that prizes interpretability and robustness over raw benchmark scores. A compact, stable feature set is also cheaper to compute and easier to audit than a deep network’s latent representations—an attractive property for forensic and banking applications, where explaining why a signature was rejected can be as important as the rejection itself.

The work also arrives at a moment of rapid change in the field. Recent literature on offline signature verification is dominated by deep learning approaches: Siamese networks that learn writer-independent similarity metrics, transformer architectures, graph neural networks, diffusion models that generate synthetic training data, and hybrid designs that fuse hand-crafted features with learned ones. Against this backdrop, the Mysuru team’s contribution is a reminder that classical texture descriptors, careful feature selection and ensemble voting remain competitive when they are engineered around the specific statistical structure of the problem—in this case, the search for features that are consistent within writers and discriminative between them. The study builds on the authors’ own 2024 multi-dimensional review of handwritten signature verification, which catalogued the strengths and gaps of the field and evidently shaped their decision to target stability as the central design criterion.

Practical deployment still faces hurdles that no single paper can clear. Skilled forgeries continue to improve, adversarial attacks tailored to defeat verification models have been demonstrated in recent research, and real-world documents introduce noise, skew and partial signatures that laboratory benchmarks only approximate. Yet the core insight of this study—that the quest for a reliable signature verifier should begin with the question of which measurements are trustworthy in the first place—offers a durable template. If a feature is not stable across the genuine samples of the same writer, no amount of classifier sophistication can rescue it; if it is stable, even relatively simple ensembles can achieve near-perfect discrimination. As institutions worldwide continue to rely on the humble handwritten signature as a legal instrument, research that makes its automated verification more consistent, more explainable and more language-independent brings a centuries-old human practice a decisive step closer to the standards of modern biometric security.

Subject of Research: Stability-driven feature selection for offline handwritten signature verification

Article Title: A diversified study to explore consistent features across writers for offline signature verification

Article References: S D, B., R K, B., & K S, M. (2026). A diversified study to explore consistent features across writers for offline signature verification. Multimedia Tools and Applications, 85(9), Article 729. https://doi.org/10.1007/s11042-026-21883-6

Image Credits: AI Generated

DOI: 10.1007/s11042-026-21883-6

Keywords: offline signature verification, biometrics, feature selection, feature stability, texture features, feature fusion, ensemble learning, machine learning, forgery detection, CEDAR dataset, BHSig260, multilingual signatures