RUIP-BA: Renewable, Unlinkable, and Irreversible Privacy-Preserving Behavioral Authentication via Random Projection and Local Differential Privacy

Behavioral authentication (BA) systems verify user identity claims based on unique behavioral characteristics using machine learning (ML)-based classifiers trained on user behavioral profiles. Although effective, ML-based BA systems face serious privacy threats, including profile inference and reconstruction attacks. This paper presents RUIP-BA (Renewable, Unlinkable, and Irreversible Privacy-Preserving Behavioral Authentication), a non-cryptographic framework designed for settings where computational resources may be limited. Random Projection (RP) maps behavioral profiles into lower-dimensional protected templates while approximately preserving utility-relevant geometry, and local Differential Privacy (DP) injects calibrated stochastic perturbations to provide formal privacy protection. The proposed design jointly targets the ISO/IEC 24745 requirements of renewability, unlinkability, and irreversibility. We provide complete algorithmic realizations for enrollment, verification, template renewal, unlinkability testing, and GAN-based adversarial privacy evaluation. We also introduce rigorous formal privacy derivations and proofs under explicit assumptions, including formal security games, information-theoretic theorem-level guarantees, Cramér–Rao lower bounds for irreversibility, full Jensen–Shannon divergence derivations for unlinkability, and a GAN Nash-equilibrium attack bound. Comprehensive dimensionality ablation across all three modalities confirms robust utility at compact template sizes, and an expanded analysis of the privacy–utility trade-off under varying ϵ values is provided. Experiments on voice, swipe, and drawing datasets show authentication accuracy above 96% while sharply limiting feature recoverability under strong GAN-based attacks. All reported FAR/FRR figures are single-session best-case estimates; cross-session longitudinal evaluation remains future work. RUIP-BA provides a scalable, mathematically grounded, and deployment-ready privacy-preserving BA solution.