FBAN: A Fully Homomorphic Encryption Compatible Bottleneck Attention Network for Privacy-Preserving Behavioral Authentication

FBAN: A Fully Homomorphic Encryption Compatible Bottleneck Attention Network for Privacy-Preserving Behavioral Authentication⋆ Jichao Xiong1 , Atsuko Miyaji1✉ , and Jiageng Chen2 1

arXiv:2610.08174v1 [cs.CR] 6 Oct 2026

Department of Information and Communications Technology, The University of Osaka, Suita, Osaka 565-0871, Japan 2 School of Computer Science, Central China Normal University, Wuhan 430079, China {miyaji}@comm.eng.osaka-u.ac.jp Abstract. Continuous authentication (CA) strengthens session security by repeatedly verifying the user during device interaction, yet it inherently relies on highly sensitive behavioral traces (e.g., fine-grained touch dynamics) that are often outsourced to cloud/edge services for scalable inference. This raises a fundamental privacy-in-use challenge: protecting behavioral features during computation, not only in transit or at rest. Fully homomorphic encryption (FHE) offers a principled solution, but deploying modern CA models under FHE remains difficult due to non-linearities and attention-style operations that incur high ciphertext cost. We propose FBAN, a TFHE-compatible Bottleneck Attention Network and an end-to-end encrypted CA framework. FBAN is designed for integer-only execution via a two-stage pipeline (floating-point pretraining followed by quantization-aware training) and is compiled into TFHE circuits for homomorphic inference. We further specify a client–server protocol with session-bound blinding and decrypt-and-return verification, enabling the server to authenticate users without observing raw behavioral features. We provide a cryptographic security analysis against an honest-but-curious server under TFHE IND-CPA security, and formalize resistance to replay and impersonation without the TFHE secret key. Experiments on two public touchscreen datasets demonstrate that FBAN achieves strong authentication utility under encrypted inference while maintaining a lightweight model footprint, with TFHE parameters instantiated at ≥ 128-bit security. Keywords: Continuous Authentication · Privacy-preserving · Fully Homomorphic Encryption (FHE) · Biometrics security

1

Introduction

Smartphones and wearables increasingly mediate security-critical actions—mobile payments, healthcare access, enterprise messaging, and location-dependent ser⋆

This paper has been accepted at the 28th International Conference on Information and Communications Security (ICICS 2026). ✉ Corresponding author.

2

Jichao Xiong, Atsuko Miyaji, and Jiageng Chen

vices—making user authentication a first-order security primitive [12]. Traditional mechanisms, including passwords/PINs and physiological biometrics (e.g., face or fingerprint), are widely deployed but remain vulnerable to credential theft and presentation or replay attacks, and—crucially—only verify the user at session entry [1]. Once a session is unlocked, an adversary who gains short-term access can operate under the legitimate identity until the session terminates [3]. Continuous authentication (CA) has emerged as a promising complement to entry-point authentication by continuously verifying the user in a passive and transparent manner during device interaction [20]. Recent CA systems leverage behavioral biometrics such as keystroke dynamics [29], touch gestures, and inertial signals, often augmented by context or temporal modeling [21]; complementary schemes exploit richer physiological cues such as auditory-pupillary response for emerging platforms [32]. For example, touchscreen-based approaches model fine-grained touchpoints and contextual dependencies across consecutive swipes to improve recognition performance while controlling model complexity. Transformer-based frameworks further exploit attention to extract discriminative spatio-temporal representations from multimodal behavioral streams, achieving strong error rates on public datasets [23] [8]. Despite this progress, a critical gap remains underexplored in most research prototypes: the behavioral and contextual signals enabling CA are intrinsically sensitive personal data [17]. CA continuously captures and processes fine-grained behavioral traces (e.g., timing, pressure, motion, and usage context), which can reveal not only identity but also private attributes and usage patterns. CA surveys explicitly recognize that such continuous monitoring raises privacy concerns because personal data are collected, transmitted, and processed outside the user’s direct control, particularly in cloud-assisted settings [2]. In practice, many deployed applications already rely on cloud resources for scalability and on-demand computation [25]; however, outsourcing CA inference to an untrusted server exacerbates privacy risk: the server can observe raw behavioral features, intermediate representations, or authentication scores, enabling profiling or unintended secondary use [4]. A straightforward response—running CA entirely on-device—does not fully resolve the problem. Existing continuous authentication (CA) systems largely focus on recognition accuracy and efficiency, while overlooking a fundamental issue: the behavioral stream itself is highly sensitive and is typically processed in the clear. This creates a clear gap between current CA designs and practical privacy requirements. Meanwhile, modern CA models increasingly employ deep architectures with temporal modeling and attention-style components, whose computation, memory, and energy costs can exceed the budget of mobile devices, thereby motivating inference offloading to the edge or cloud [28]. As a result, trustworthy CA requires privacy-in-use, i.e., protection of behavioral features throughout inference rather than only in transit or at rest. Fully homomorphic encryption (FHE) offers a principled way to realize privacyin-use by enabling computation directly over encrypted data [26]. However, bringing FHE into modern CA remains difficult. On the one hand, nonlinear

FBAN: FHE-Compatible Bottleneck Attention Network

3

layers [13], normalization [31], and especially attention-style interactions [18] can significantly increase circuit depth and ciphertext cost, leading to substantial latency [15]; recent work on quantized attention under FHE for health sensing [27] further highlights the tension between model expressiveness and encrypted-inference efficiency. On the other hand, typical CA models are designed in floating-point arithmetic with standard activations, whereas efficient encrypted deployment often favors tightly controlled quantized computation [5]. Although approximate-arithmetic schemes such as CKKS [6] support real-valued operations, they are less suitable for our setting, where CA is repeatedly executed over many short behavioral windows and requires stable threshold-based decisions; in this regime, repeated approximate nonlinear evaluation and precision management can still incur expensive refresh operations. We therefore target TFHE [7], which naturally supports exact integer-domain computation after quantization and better matches the discrete inference-and-verification workflow considered here. To address the above challenges—namely, (i) the lack of privacy protection in existing CA despite the sensitivity of behavioral data, (ii) the high homomorphic cost induced by deep nonlinear and attention-based CA models, and (iii) the mismatch between floating-point model design and efficient encrypted execution—we propose FBAN, an FHE-compatible Bottleneck Attention Network for privacy-preserving behavioral continuous authentication. FBAN is designed from the ground up for TFHE-style integer-domain execution: we introduce a bottlenecked serial attention formulation that avoids FHE-unfriendly operators and can be compiled into efficient encrypted circuits after quantizationaware training (QAT). Our end-to-end workflow supports (i) floating-point pretraining for strong baseline accuracy, (ii) integer-only QAT for faithful deployment under FHE constraints, and (iii) secure inference over encrypted behavioral streams, optionally combined with lightweight ensemble aggregation to further improve robustness. Our main contributions are as follows: – Privacy-in-use continuous authentication: We formulate privacy preserving behavioral continuous authentication under an untrusted inference setting and present an end-to-end FHE-based inference pipeline that keeps sensitive behavioral inputs encrypted throughout computation, addressing privacy concerns highlighted in CA surveys. – FBAN: FHE-compatible bottleneck attention: We propose FBAN and an integer-only deployment pipeline via QAT, enabling attention-based modeling to be compiled and executed efficiently under TFHE-style FHE constraints. – Strong accuracy–latency trade-offs with rigorous evaluation: We empirically show that FBAN achieves competitive authentication performance against representative CA baselines (including Transformer-based context-aware models) while reducing model complexity and delivering endto-end FHE latency practical for periodic or risk-triggered re-verification, supported by an evaluation protocol aligned with realistic threat models.

4

Jichao Xiong, Atsuko Miyaji, and Jiageng Chen

2

Preliminaries

2.1

Notation

Scalars are denoted by italic letters (e.g., x), vectors by bold lowercase (e.g., x), and matrices by bold uppercase (e.g., W). For an integer n, we write [n] = {1, . . . , n}. We use λsid for the bit-length of session identifiers and ℓ for the bitlength of the one-time pad used in the masked decision return. For a vector v, its j-th entry is v[j]. We use I[·] for the indicator function. Continuous behavioral authentication stream. Let xt ∈ Rd be the feature vector extracted at time step t from behavioral signals (e.g., touch/keystroke/IMUderived descriptors). A length-L sliding window is   Xt = xt−L+1 , . . . , xt ∈ RL×d . (1) A continuous authenticator with parameters θ maps each window Xt to a realvalued score st and a binary decision ŷt : st = fθ (Xt ),

ŷt = I[st ≥ τ ],

(2)

where τ is a decision threshold. Throughout the paper, the score is interpreted as an acceptance confidence (larger is more likely to be genuine), though the construction applies to any monotone scoring rule. 2.2

Ensemble Learning

To improve robustness and reduce variance [19], we consider an ensemble of N base authentication models {fθi }N i=1 . For a given window Xt , each member outputs a score st,i = fθi (Xt ), i ∈ [N ]. Let st = (st,1 , . . . , st,N )⊤ ∈ RN collect all member scores. An ensemble aggregator maps st to a final score s̄t , which is then thresholded: ŷt = I[s̄t ≥ τ ]. Standard choices include simple averaging and weighted averaging; we adopt stacking (a linear meta-model) as it can be directly optimized for an operating constraint. Let ϕ = (w, c) with w ∈ RN , c ∈ R. The stacked score is s̄t = gϕ (st ) = w⊤ st + c.

(3)

The parameters ϕ are trained on a held-out set (e.g., minimizing FRR subject to a target FAR). 2.3

TFHE-Based Fully Homomorphic Encryption

Fully homomorphic encryption (FHE) enables computation over encrypted data: given ciphertexts encrypting plaintext values, a server can evaluate a function and obtain a ciphertext encrypting the correct result, without learning the plaintexts [10]. We instantiate FHE with TFHE, a gate-bootstrapped FHE family well-suited for boolean and integer arithmetic via programmable bootstrapping [7].

FBAN: FHE-Compatible Bottleneck Attention Network

5

TFHE interface. Let λ be the security parameter. We abstract TFHE as TFHE = (KeyGen, Enc, Dec, Eval).

(4)

– TFHE.KeyGen(1λ ) → (sk, ek) outputs a secret key sk and an evaluation key ek. The evaluation key contains the auxiliary material required for homomorphic evaluation (e.g., bootstrapping and key-switching keys) and is intended to be shared with the evaluator/server. – TFHE.Enc(sk, m) → JmK encrypts a plaintext message m into a ciphertext JmK. – TFHE.Dec(sk, JmK) → m decrypts a ciphertext. – TFHE.Eval(ek, C, ·) → JC(·)K homomorphically evaluates a circuit C on ciphertext inputs and returns a ciphertext of the output. In our setting, C represents an integer-only inference circuit (including additions, multiplications, comparisons, and piecewise-linear primitives after quantization), which aligns naturally with TFHE’s evaluation model. Correctness and homomorphic evaluation. For any supported circuit C and plaintext m, correctness requires
TFHE.Dec sk, TFHE.Eval(ek, C, JmK) = C(m), (5) except with negligible probability in λ. For clarity, we also write homomorphic evaluation for basic integer operations using circuits C+ and C× : Jm1 + m2 K ← TFHE.Eval(ek, C+ , Jm1 K, Jm2 K),

Jm1 · m2 K ← TFHE.Eval(ek, C× , Jm1 K, Jm2 K).

2.4

(6) (7)

Integer Quantization for TFHE-Compatible Neural Inference

TFHE evaluation is most practical when the target computation is expressed over integers or bits. We therefore adopt a standard uniform affine quantization to convert real-valued tensors into b-bit integers, enabling an integer-only network whose forward pass can be compiled into a circuit Cθ . Let ∆ > 0 be a scale and z ∈ Z be a zero-point. For a real scalar x, define the b-bit quantizer    Qb (x) = clip x/∆ + z, 0, 2b − 1 ∈ Z2b , (8) where ⌊·⌉ denotes rounding to the nearest integer and clip(·) clamps values into the representable range. The corresponding de-quantization is x̃ = Db (q) = ∆ · (q − z),

q ∈ Z2b .

For vectors/matrices, Qb (·) and Db (·) are applied element-wise.

(9)

6

Jichao Xiong, Atsuko Miyaji, and Jiageng Chen (Q)

We denote the quantized (integer-only) version of a network by fθ . Its forward computation is represented as an integer circuit Cθ over Z2b . Given an input window Xt , we quantize it to Qt = Qb (Xt ) and compute an integer score (Q)

st

= Cθ (Qt ) ∈ Z2b .

(10)

Encrypted inference under TFHE then evaluates the same circuit on ciphertext inputs:
(Q) Jst K = TFHE.Eval ek, Cθ , JQt K . (11) This notation will be reused when specifying the end-to-end protocol: the client produces JQt K, the server evaluates Cθ homomorphically, and the client decrypts (Q) to obtain st (or a post-processed decision) while the server learns no plaintext behavioral features.

3

Framework Design

This section details the proposed FBAN framework from both the model-design and the cryptographic deployment perspectives. We first formalize the client– server workflow and the per-user template/policy representation, then present the TFHE-compatible FBAN architecture, and finally specify the end-to-end interaction protocol that supports privacy-preserving continuous authentication. In particular, the complete offline procedure that produces a user-specific template—including two-stage training (pre-training → QAT), TFHE compilation, and fixed-point stacking calibration—is summarized in Algorithm 1. Given the resulting template, the online blinded authentication interaction executed at each time step is specified in Algorithm 2. 3.1

System Overview

Fig. 1 depicts the end-to-end workflow of FBAN. At each time step t, the client device C extracts a behavioral window Xt ∈ RL×d and applies a deterministic preprocessing pipeline Norm(·) (e.g., cleaning and standardization). We treat Norm as a public, deterministic transformation with fixed parameters (e.g., means/standard deviations) learned offline and included in public parameters. This avoids any ambiguity about hidden state in preprocessing. Followed by b-bit quantization Qb (·), to obtain an integer tensor
X̃t := Qb Norm(Xt ) ∈ ZL×d . 2b

(12)

The client encrypts X̃t under TFHE and sends only ciphertexts to the server S for inference. The server evaluates TFHE-compiled FBAN circuits and returns an encrypted one-time-padded decision bit for decrypt-and-return verification (Algorithm 2).

FBAN: FHE-Compatible Bottleneck Attention Network

7

Template/policy. For each user identity uid, the server stores a template/policy   Tuid := {Cuid,i }N i=1 , ŵuid , τ̂uid , where {Cuid,i } are TFHE inference circuits of an ensemble of size N , ŵuid = (ŵuid,1 , . . . , ŵuid,N ) ∈ ZN are fixed-point stacking weights, and τ̂uid ∈ Z is the correspondingly scaled decision threshold chosen at a target operating point (e.g., FAR = ρ). The template is generated offline following Algorithm 1 and then reused for all subsequent online authentications. Design goals. FBAN targets: (i) privacy-in-use for behavioral windows during inference via TFHE; (ii) FHE-compatibility via integer-only computation and circuit-friendly attention; (iii) practicality via high authentication accuracy and encrypted latency suitable for periodic or risk-triggered re-verification.

Model Training Stages ( Ensemble x N )

Data Preprocessing

Stage 1: Pre-training (FBAN Floating-point) Plaintext Data

FC Data Loaders

Data Cleaning

FC

…

Bottleneck Attention (Serial)

xN

ReLU

FC Data Loaders

Train Set

Val Set

ReLU Q-Attention (Serial)

Ensemble

Float Model (Plaintext) AUC, EER, FRR

Weights Transfer

Stage 2: QAT (QuantFBAN Integer-only) Train / Val / Test Split

Train ( Adam, BCE, Early Stopping)

FC

…

xN

QAT Train (Lower Ensemble Quantized Model LR, & Early Stopping) (Plaintext) AUC, EER, FRR

FHE Compilation & Secure Inference (FHE Integer-only)

Test Set

FHE AUC Score SMOTE Oversampling

Data Loaders (Batching)

Data Loaders Concrete ML Compile (FHE Circuit Gen)

Test Set

Encrypted Input

FHE Compiled Model

FHE Execution

FHE EER Score Ensemble Strategy (Stacking)

FHE FRR Score

Fig. 1. FBAN workflow: preprocessing, two-stage training (pre-training → QAT), TFHE compilation, and secure inference with ensemble stacking.

3.2

TFHE-Compatible Bottleneck Attention Network

Let x̃t = vec(X̃t ) ∈ ZD 2b with D = L · d. A naive attention layer (softmax normalization and multiplicative gating) is ill-suited for TFHE due to high circuit cost. FBAN therefore employs serial bottleneck attention that uses only affine maps, an integer-friendly activation, and additions, which can be compiled into efficient TFHE circuits.

8

Jichao Xiong, Atsuko Miyaji, and Jiageng Chen

Bottleneck attention block. Given an intermediate hidden vector h ∈ Zm 2b , a bottleneck attention block is defined as   BA(h) := σ We σ(Ws h + bs ) + be , (13) ′

′

where Ws ∈ Z2mb ×m , We ∈ Zm×m with m′ ≪ m, and σ(·) denotes an integer2b compatible activation (e.g., quantized ReLU) realizable under TFHE. Importantly, (13) avoids ciphertext–ciphertext multiplicative gating, keeping TFHE evaluation efficient. FBAN forward computation. A representative instance (matching our implementation) is: h1 := σ(W1 x̃t + b1 ), h2 := σ(W2 h1 + b2 ), h3 := BA(h2 ), h4 := σ(W3 h3 + b3 ), h5 := σ(W4 h4 + b4 ), h6 := BA(h5 ), st := wo⊤ σ(W5 h6 + b5 ) + bo ∈ Z,

(14)

where st is the integer logit score. All parameters are trained under quantization constraints so that every operation in (14) is valid over bounded integers, enabling direct compilation to TFHE circuits (Algorithm 1). 3.3

Offline Model Preparation for TFHE Inference

This subsection describes how a per-user template Tuid is constructed offline. Given the enrollment dataset Duid = {(X, y)} with y ∈ {0, 1}, FBAN is trained in two stages: (i) floating-point pre-training to obtain a strong initialization, and (ii) quantization-aware training (QAT) to produce an integer-only network. After QAT, each member is compiled into a TFHE circuit using a calibration subset (for range/quantization calibration). (i)

FHE-friendly stacking. Let st be the plaintext score of member i at time t (Eq. (14)). We aggregate members using a stacking-style linear combiner St :=

N X

(i)

ŵuid,i · st ,

(15)

i=1

where ŵuid,i ∈ Z are fixed-point weights learned on the validation set to optimize the operating metric (e.g., FRR@FAR). The decision threshold τ̂uid is chosen under the same fixed-point convention. The complete template generation pipeline—including data preparation, two-stage training, TFHE compilation, and stacking calibration—is summarized in Algorithm 1.

FBAN: FHE-Compatible Bottleneck Attention Network

9

Algorithm 1: Template Generation for User uid (Two-Stage Training → TFHE Circuits → Stacking Policy) : Enrollment dataset Duid ; ensemble size N ; quantization bit-width b; target FAR ρ Output : Template Tuid = ({Cuid,i }N i=1 , ŵuid , τ̂uid ) Input

▷ Data Preparation ◁; Split Duid into (Dtr , Dval , Dte ); tr 3 (Optional) Apply class re-balancing on D (e.g., SMOTE) avoid contamination; 1 2

// Train-only to

for i ← 1 to N do ▷ Stage 1: Pre-training (Floating-Point FBAN) ◁; 6 Train FBANi on Dtr with early stopping on Dval // e.g., Adam + BCE; 7 ▷ Stage 2: QAT (Integer-Only QuantFBAN) ◁; 8 Initialize QuantFBANi by weight transfer from FBANi // Warm-start improves convergence; 9 QAT-train QuantFBANi with b-bit quantization on Dtr ; 10 ▷ TFHE Compilation ◁; 11 Select a calibration subset Dcal ⊆ Dtr // Range calibration; 12 Compile QuantFBANi into a TFHE circuit Cuid,i // Circuit gen + parameterization; 4

5

▷ Stacking Policy (Fixed-Point) ◁; (i) 14 Compute validation scores {st } from members in plaintext simulation; N 15 Learn ŵuid ∈ Z to minimize FRR@FAR(ρ) under (15); val 16 Select threshold τ̂uid on D at FAR = ρ; N 17 return Tuid = ({Cuid,i }i=1 , ŵuid , τ̂uid ); 13

3.4

Blinded TFHE Continuous Authentication Protocol

This subsection specifies the online interaction between C and S for continuous authentication. The client holds the TFHE secret key sk and decrypts, while the server holds the evaluation key ek and the user template. At each time step t, the server enforces fresh blinding to (i) bind submissions to the current session and (ii) prevent a malicious client from deterministically forging an always-accept response based on raw scores. Input blinding (session binding). The server samples a fresh additive mask β t ∈ ZL×d and requires the client to encrypt X̃⋆t := X̃t + β t . The server removes β t 2b inside TFHE by evaluating a constant-subtraction circuit. Masked decision return (anti-forgery and minimal disclosure). To avoid leaking the raw score St and to prevent a malicious client from forging the server-side accept/reject outcome, the server performs the threshold comparison under TFHE and returns only a one-time padded decision bit. Let dt := I[St ≥ τ̂uid ] ∈ {0, 1}.

10

Jichao Xiong, Atsuko Miyaji, and Jiageng Chen $

The server samples a fresh pad rt ← − Z2ℓ (kept secret from the client) and returns a ciphertext of Ut := rt + dt (mod 2ℓ ). (16) We encode the bit dt as an integer in Z2ℓ (i.e., 0 or 1) so that the addition in Eq. (16) is well-defined. The client decrypts Ut and sends it back in the clear. The server recovers dt by subtracting rt (mod 2ℓ ) and outputs Accept iff dt = 1. This design yields a standard decrypt-and-return soundness check while revealing neither St nor dt to the client device. The complete online protocol is detailed in Algorithm 2.

4

Threat Model and Security Goals

System model and trust assumptions. We consider the two-party setting induced by Protocol ΠFBAN (Algorithm 2), between a client device C (holding the behavioral stream) and an authentication server S. At each time step t, C extracts a behavioral window Xt ∈ RL×d and deterministically computes the (see Eq. (12)). quantized integer representation X̃t := Qb (Norm(Xt )) ∈ ZL×d 2b C runs TFHE key generation (sk, ek) ← TFHE.KeyGen(1λ ), keeps sk locally, and registers ek to S. For each identity uid, S stores the user template/policy Tuid = ({Cuid,i }N i=1 , ŵuid , τ̂uid ) generated offline (Algorithm 1). We assume authenticated communication (e.g., standard channel authentication) to prevent active man-in-the-middle modification. Confidentiality of the channel is not required for privacy, since all sensitive client inputs are encrypted under TFHE. Adversary model (honest-but-curious server). We model S as an honest-butcurious (a.k.a. semi-honest) adversary: it follows Algorithm 2 exactly, but attempts to infer sensitive information about {Xt } (and hence {X̃t }) from its internal state and the protocol transcript. Formally, let AS be a PPT algorithm controlling the server. For each time step t, define the server-side transcript item   trt := uid, sidt , β t , JX̃⋆t K, JUt K , (17) where X̃⋆t = X̃t + β t is the client-side blinded input (Algorithm 2), and JUt K is the ciphertext of the masked decision value from Eq. (16). Since AS controls S, its view additionally contains all server-held secrets and randomness, namely   ViewS := ek, Tuid , {rt }t , {trt }t , (18) as well as any intermediate ciphertexts deterministically derived during TFHE (i) evaluation (e.g., Jst K and JSt K), which are functions of ek, Tuid , and JX̃⋆t K. Security goal (privacy-in-use of behavioral windows). Our primary goal is to ensure input privacy against AS : the server should learn nothing about the client windows beyond inevitable leakage such as public dimensions (L, d), bit-width

FBAN: FHE-Compatible Bottleneck Attention Network

Algorithm 2: Protocol ΠFBAN : TFHE-Based Privacy-Preserving Continuous Authentication (Blinded) Input : User identity uid; template Tuid = ({Cuid,i }N i=1 , ŵuid , τ̂uid ) Output : Server decision Accept / Reject at each time step t ; // Key setup and enrollment are performed as in Alg. 1; we describe the online phase. 1 foreach time step t do 2 Server-side: 3 ▷ Fresh Blinding Material ◁; 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31

$

Sample fresh session id sidt ← − {0, 1}λsid and record it as used; $

− ZL×d βt ← 2b

// Input one-time mask;

$

− Z 2ℓ // Secret one-time pad for masked decision return; rt ← Send (sidt , β t ) to C // rt kept secret; Client-side: ▷ Quantize, Blind, Encrypt ◁; Extract window Xt and compute X̃t := Qb (Norm(Xt )) // Preprocessing; X̃⋆t ← X̃t + β t // Input blinding; JX̃⋆t K ← TFHE.Enc(sk, X̃⋆t ); Send (uid, sidt , JX̃⋆t K) to S; Server-side: ▷ Session Check ◁; if sidt is not fresh then Output Reject;

▷ In-Circuit Unblinding ◁; Let C−βt the circuit U 7→ U − β t over ZL×d // Constant subtraction; 2b JX̃t K ← TFHE.Eval(ek, C−βt , JX̃⋆t K); ▷ TFHE Inference (Ensemble) ◁; for i ← 1 to N do (i) // FBAN member i; Jst K ← TFHE.Eval(ek, Cuid,i , JX̃t K)

▷ Stacking in TFHE ◁; P (i) JSt K ← N // Eq. (15); i=1 ŵuid,i · Jst K ▷ Masked Decision in TFHE ◁; Let C≥τ̂uid the circuit z 7→ I[z ≥ τ̂uid ] outputting a bit dt ∈ {0, 1}; Jdt K ← TFHE.Eval(ek, C≥τ̂uid , JSt K); Let C+rt the circuit u 7→ u + rt over Z2ℓ // Eq. (16); JUt K ← TFHE.Eval(ek, C+rt , Jdt K); Send (sidt , JUt K) to C;

32 33 34 35

Client-side: ▷ Decrypt-and-Return ◁; Ut ← TFHE.Dec(sk, JUt K) // Masked decision; reveals neither St nor dt ; Send (sidt , Ut ) to S;

36 37 38 39

Server-side: ▷ Verification and Decision ◁; if sidt was seen before for this t then Output Reject;

40 41

// Replay protection d′t ← (Ut − rt ) mod 2ℓ ; if d′t = 1 then Output Accept;

42 43

else Output Reject;

11

12

Jichao Xiong, Atsuko Miyaji, and Jiageng Chen

b, the number of time steps, and the final authentication decision. We capture this goal via an indistinguishability-based definition on the server view. (0) (1) Let X1:T and X1:T be two sequences of windows of equal length T and identical public meta-data (i.e., same (L, d), same quantization bit-width b, and the (0) (1) same protocol parameters). Let ViewS (resp. ViewS ) denote the distribution of the server view (Eq. (18)) when Protocol ΠFBAN (Algorithm 2) is executed (0) (1) on X1:T (resp. X1:T ). We say ΠFBAN provides server-side input privacy if for every PPT distinguisher D,     (0) (1) Pr D(ViewS ) = 1 − Pr D(ViewS ) = 1 ≤ negl(λ).

(19)

Intuitively, even though S observes the ciphertext stream and performs TFHE evaluation, it cannot distinguish which underlying behavioral sequence generated the transcript, except with negligible advantage in the TFHE security parameter λ. Leakage function and scope. For clarity, we make explicit the permitted leakage. Let L be the leakage function that returns only public meta-data and the server output decisions:   L(X1:T ) := uid, T, L, d, b, N, {sidt }t , {Dect }t , (20) where Dect ∈ {Accept, Reject} is the server decision at time t. The guarantee in Eq. (19) is understood modulo L: the protocol does not aim to hide (L, d, b, T ) nor the final decision sequence, since these are either public configuration values or explicit outputs. We also emphasize that side channels (e.g., fine-grained timing, cache attacks, or physical compromise of C revealing sk) are outside the scope of this work. Remark on blinding under the semi-honest server model. The blinding values (β t , rt ) are generated by S and thus are included in ViewS . Accordingly, under the honest-but-curious server model, blinding is not introduced to further hide inputs from S, but rather to (i) avoid unnecessary exposure of raw scores to the client and (ii) support a unified protocol interface that can be extended to stronger adversarial models without changing the TFHE inference core. The server-side privacy goal of this paper remains Eq. (19), grounded in the semantic security of TFHE encryption.

5

Experimental Evaluation

This section evaluates FBAN in terms of both authentication utility and cryptographic deployability. We (i) compare FBAN with representative methods in touchscreen-based continuous authentication, reporting AUC (area under the receiver operating characteristic curve), EER (equal error rate), and FRR@FAR= 0.001 (false reject rate at false accept rate 0.001) together with Params and

FBAN: FHE-Compatible Bottleneck Attention Network

13

FLOPs, and (ii) analyze the effect of the ensemble size N by reporting Pretrain, QAT, and TFHE results across varying N . Datasets. We use two public touchscreen-based continuous authentication datasets and follow a unified split protocol to ensure fair and reproducible evaluation. TouchPitfalls [11] is collected on iPhone devices from 470 users in a remote setting, where participants perform two realistic scenarios: social-media style vertical scrolling and gallery-like horizontal swiping. Touchalytics [9] is collected on Android devices from 41 users, covering both natural browsing/reading interactions and a controlled image-comparison task that elicits repeated swipe gestures. For each dataset, we partition the samples into disjoint subsets with a 65%/15%/20% ratio for training/validation/test, respectively; the validation split is used for model selection and threshold calibration, while all reported results are obtained on the held-out test split. Metrics. We report the area under the ROC curve (AUC), equal error rate (EER), and false reject rate (FRR) at a fixed operating point (i.e., FRR@FAR= ρ). To quantify deployability, we additionally report the number of parameters (Params) and computational cost (FLOPs/PLOPs, following a consistent counting convention across methods). Implementation. All experiments are run on a Linux server equipped with an Intel Xeon Platinum 8352S CPU (32 cores, 64 threads) and an NVIDIA L40 GPU with 48 GB of memory. Implementations were in Python 3.9.21 using PyTorch 1.13.1 for deep learning and Concrete-ML [30] for TFHE-based homomorphic encryption [7]. Experimental configuration. For both datasets, each input sample is constructed by concatenating L = 3 consecutive strokes into a single behavioral window, yielding flattened input dimensions D = L × d = 3 × 27 = 81 for TouchPitfalls and D = 3 × 41 = 123 for Touchalytics, where d denotes the number of per-stroke features covering stroke geometry/timing, kinematics, touch-signal statistics, and device orientation. For each target user, impostor (negative) samples are constructed by pooling the strokes of all remaining users in the same dataset split, preserving the natural impostor distribution without cross-split leakage. The decision threshold τ̂uid is calibrated per user on the validation split at the target operating point: we compute the ROC curve over validation scores, use linear interpolation to identify the threshold at which FAR equals the target (ρ = 0.001), and fix this threshold when reporting FRR on the held-out test split. 5.1

Comparative Analysis

We compare FBAN with representative baselines including classical SVM-based methods [11] [14] and recent deep backbones (CNN- [22] and Transformerbased [23] models). We report AUC, EER, and FRR at FAR= 0.001 on both TouchPitfalls and Touchalytics, and summarize model complexity by FLOPs and Params when available. As shown in Table 1, FBAN achieves the best AUC on both datasets (98.93 on TouchPitfalls and 99.87 on Touchalytics); moreover, it attains the lowest

14

Jichao Xiong, Atsuko Miyaji, and Jiageng Chen

Table 1. Overall comparison on TouchPitfalls and Touchalytics datasets. The best and second-best results are highlighted in color. Method

TouchPitfalls [11]

Touchalytics [9]

FLOPs

Params

AUC↑ FRR∗ ↓ EER↓ AUC↑ FRR∗ ↓ EER↓ SVM TA† [11] SVM DA† [14] PatchTST† [16] TimesNet† [24] OS CNN† [22] TSCA† [23]

93.97 92.80 95.76 96.33 95.85 97.59

18.47 31.43 13.82 10.79 12.17 8.16

8.66 9.49 5.95 4.51 5.16 2.42

98.81 98.79 97.82 99.11 99.14 99.45

10.34 13.07 6.31 5.48 6.52 3.62

4.22 3.58 5.57 1.55 2.28 1.12

– – 0.078G 13.709G 0.382G 0.098G

– – 0.313M 8.288M 0.763M 0.225M

FBAN (Ours)‡

98.93

9.07

1.18

99.87

5.07

1.65

3.44 × 10−3 G

0.0271M

∗ FRR is reported at FAR= 0.001. † Baseline results are taken from the TSCA [23]. ‡ Our results are obtained with encrypted inputs under TFHE-based secure inference.

EER on TouchPitfalls (1.18), while remaining competitive on Touchalytics (EER= 1.65). In addition, FBAN is substantially more efficient than heavy Transformer baselines in terms of FLOPs/Params, while preserving strong authentication accuracy. Most importantly, unlike all compared baselines whose results are reported under plaintext inference, our FBAN results are obtained with encrypted inputs under TFHE-based secure inference, meaning that the server never observes raw behavioral features in the clear during authentication. This demonstrates that FBAN delivers state-of-the-art continuous authentication performance together with a cryptographic privacy guarantee (privacy-in-use) that is absent from existing baselines. 5.2

Effect of Ensemble Size

We study the impact of the ensemble size N on authentication performance under three deployment pipelines: PreTrain (floating-point), QAT (integeronly quantized), and FHE (TFHE encrypted inference). We vary N ∈ {1, . . . , 7} and report AUC, EER, and FRR at FAR= 0.001 on both TouchPitfalls and Touchalytics. Table 2 summarizes the results. Table 2 shows that increasing the ensemble size N typically improves robustness from small to moderate ensembles (e.g., N = 1 to N ≈ 4–6), mainly reflected by lower FRR/EER, while AUC exhibits smaller but consistent gains. The improvement, however, quickly saturates as ensemble members become more correlated; overly large N may even slightly degrade FRR/EER due to an “overconfident” aggregation effect at the fixed operating point (FAR= 0.001). Overall, a moderate N yields the best accuracy–efficiency balance in our setting. We further quantify the deployment overhead: one authentication instance takes 561.43 ms under plaintext inference, whereas TFHE end-to-end execution takes 73.25 s when including encryption, communication, server evaluation, and

FBAN: FHE-Compatible Bottleneck Attention Network

15

Table 2. Impact of ensemble size N under PreTrain, QAT, and FHE (TFHE). PreTrain

Dataset N

QAT

FHE

TouchPitfalls

1 2 3 4 5 6 7

98.85 98.89 98.90 98.90 98.91 98.91 98.91

15.33 12.94 11.57 12.09 11.69 11.06 11.33

1.89 1.69 1.57 1.56 1.49 1.52 1.50

98.88 98.92 98.92 98.93 98.93 98.93 98.94

13.04 10.93 9.93 9.81 9.48 9.05 9.33

1.58 1.35 1.26 1.24 1.16 1.18 1.16

98.88 98.91 98.93 98.93 98.93 98.93 98.93

13.04 11.23 10.20 10.06 9.73 9.07 9.38

1.58 1.42 1.26 1.28 1.19 1.18 1.16

Touchalytics

AUC↑ FRR∗ ↓ EER↓ AUC↑ FRR∗ ↓ EER↓ AUC↑ FRR∗ ↓ EER↓

1 2 3 4 5 6 7

99.85 99.87 99.87 99.88 99.88 99.88 99.88

5.03 4.87 4.76 4.74 4.73 4.70 4.66

1.69 1.58 1.59 1.54 1.56 1.55 1.55

99.83 99.85 99.86 99.87 99.87 99.87 99.87

5.68 5.45 5.26 5.07 5.18 5.20 5.12

1.88 1.76 1.71 1.65 1.62 1.61 1.60

99.83 99.85 99.86 99.87 99.87 99.87 99.87

5.68 5.45 5.26 5.07 5.18 5.20 5.12

1.88 1.76 1.71 1.65 1.62 1.61 1.60

∗ FRR is reported at FAR= 0.001.

decryption. Although this latency is intrinsic to bootstrapped FHE, it is acceptable for continuous authentication as a supplementary security layer (e.g., periodic or risk-triggered re-verification) rather than a replacement for the instantaneous primary unlock, allowing the cryptographic cost to be amortized over longer interaction windows. Scalability discussion. Our protocol maintains a per-user template Tuid comprising N TFHE-compiled circuits and an N -dimensional integer stacking-weight vector (N ≤ 7 integers, negligible storage). Each user’s ensemble members are independently compiled offline and loaded on demand. For large-scale deployments, standard lifecycle strategies can bound the server-side working set: lazy loading and LRU caching of active user circuits, offline parallel compilation during enrollment, periodic re-enrollment to accommodate behavioral drift, and evaluation-key rotation aligned with organizational policy.

6

Security Analysis

We provide a cryptographic security analysis of ΠFBAN . The analysis covers (i) confidentiality of behavioral features against an honest-but-curious (HbC) server, and (ii) resistance against external malicious adversaries, including replay and user impersonation. Throughout, we reuse the notation established earlier: the client C holds the TFHE secret key sk; the server S holds the TFHE evaluation key ek and the enrolled policy Tuid = ({Cuid,i }N i=1 , ŵuid , τ̂uid ). At time step t, C quantizes Xt into X̃t := Qb (Norm(Xt )) ∈ ZL×d and the server samples fresh b 2 session identifier sidt and input mask β t ∈ ZL×d . In all experiments, TFHE 2b parameters are selected to meet a target security level of at least 128 bits (λ ≥ 128) using the backend library’s parameter-selection routine.

16

6.1

Jichao Xiong, Atsuko Miyaji, and Jiageng Chen

TFHE Assumptions

We rely on the standard guarantees of TFHE: (i) IND-CPA security of TFHE.Enc, and (ii) correctness of homomorphic evaluation, i.e., for any circuit F and message m,
TFHE.Dec sk, TFHE.Eval(ek, F, TFHE.Enc(sk, m)) = F(m) except with negligible probability in λ. 6.2

Correctness of Encrypted Authentication $

At time t, S samples sidt and β t ← ZL×d and sends (sidt , β t ) to C. The client 2b ⋆ forms X̃t := X̃t + β t and sends ctx,t := TFHE.Enc(sk, X̃⋆t ) to S. The server performs in-circuit unblinding (subtracting β t ), evaluates {Cuid,i }N i=1 , and computes the stacked score St =

N X

(i)

ŵuid,i · st ,

(i)

st = Cuid,i (X̃t ).

(21)

i=1

By TFHE correctness, the encrypted execution yields the same St (and thus the same accept/reject decision) as the corresponding plaintext computation, up to negligible probability. 6.3

Confidentiality Against an Honest-but-Curious Server

We capture unavoidable service leakage at time t as Lt := (uid, sidt , L, d, b, N, Dect ), where Dect ∈ {Accept, Reject} is the server decision. Let ViewS denote the full view of S, including ek, Tuid , all server randomness, and all received messages. Theorem 1 (Feature Confidentiality w.r.t. an HbC Server). Assume TFHE is IND-CPA secure. For any PPT HbC server S, there exists a PPT simulator Sim such that, for any behavioral stream {X̃t }t , the distributions
ViewS ≈c Sim ek, Tuid , {Lt }t are computationally indistinguishable. Proof sketch. For each time step t, the only feature-dependent message received by S is ctx,t = TFHE.Enc(sk, X̃t + β t ). By IND-CPA security (even given ek), ctx,t is indistinguishable from TFHE.Enc(sk, 0) for a zero tensor 0 of the same shape. Replacing real ciphertexts with encryptions of 0 yields a standard hybrid argument; applying the (public) PPT procedure TFHE.Eval preserves indistinguishability. The simulator samples the same server-side randomness and outputs a simulated transcript consistent with the declared leakage {Lt }t .

FBAN: FHE-Compatible Bottleneck Attention Network

6.4

17

Impersonation Security: Formal Experiment and Bound

We now formalize resistance to impersonation by an external adversary without sk. Intuitively, ΠFBAN requires the client to decrypt the server-produced ciphertext and return a value consistent with the current session; without sk, an impersonator can neither (i) generate fresh well-formed TFHE encryptions, nor (ii) decrypt the server’s ciphertext to produce the correct response. Impersonation experiment. Fix a user identity uid. Consider the following experiment Expimp ΠFBAN (A, λ): 1. The challenger runs (sk, ek) ← TFHE.KeyGen(1λ ) and gives ek and Tuid to A. 2. A is given oracle access to an enrollment oracle (optional) that returns the public enrollment transcript for uid, and to an execution oracle Oauth that simulates honest sessions with the legitimate client C for adaptively chosen time steps (i.e., the full transcript of a run of ΠFBAN with honest C, including the messages exchanged).3 3. Eventually, A outputs a purported client message strategy for a fresh time step t⋆ with a fresh session identifier sidt⋆ (not previously used by Oauth ). The challenger runs the server-side algorithm with fresh randomness, interacts with A as the client, and outputs 1 iff the server outputs Accept. Define the impersonation advantage as h i imp Advimp (A, λ) := Pr Exp (A, λ) = 1 . ΠFBAN ΠFBAN Bound (protocol-level impersonation resistance). Our interactive design enforces decrypt-and-return: the server sends a ciphertext that decrypts to a sessiondependent masked value, and the client must return the corresponding plaintext. Without sk, the best possible strategy is to guess a response. To make this statement precise, we use the masked decision return in Algorithm 2 (Eq. (16)). At each t, the server computes an encrypted decision bit $

dt := I[St ≥ τ̂uid ] ∈ {0, 1} under TFHE, samples a fresh pad rt ← − Z2ℓ , and sends a ciphertext of Ut := rt + dt mod 2ℓ to the client. The client must decrypt and return Ut in the clear; the server accepts iff (Ut − rt ) mod 2ℓ = 1. Theorem 2 (Impersonation Soundness in a Fresh Session). Assume (i) TFHE is IND-CPA secure and (ii) rt is uniform over Z2ℓ and hidden from the adversary. Then for any PPT adversary A without access to sk, −ℓ Advimp + negl(λ). ΠFBAN (A, λ) ≤ 2 3

This is a strong model: the adversary may observe prior authentication transcripts.

18

Jichao Xiong, Atsuko Miyaji, and Jiageng Chen

Proof sketch. In a fresh session, the server’s message to the client is a TFHE ciphertext of Ut = rt + dt with a fresh, secret rt . Any adversary without sk cannot decrypt this ciphertext; thus its returned value Û is independent of rt except with negligible probability (otherwise one could break TFHE security). The server accepts only if Û = rt + 1 mod 2ℓ , which occurs with probability exactly 1/2ℓ for a uniform rt . The negligible term accounts for standard reduction loss and TFHE correctness failure events. Interpretation. Theorem 2 formalizes that, without sk, a transcript-level impersonator cannot force an Accept outcome in a fresh session except with negligible probability. In practice, choosing ℓ ≥ 64 makes this probability negligible. 6.5

Replay and Transcript Reuse

A replay adversary that resends a previously recorded ciphertext ctx,t0 at time t ̸= t0 faces a fresh (sidt , β t , rt ). Even if the adversary replays an old ciphertext, the server’s final message in the session is a fresh ciphertext of the masked decision Ut = rt + dt (Eq. (16)), which must be decrypted and returned by the client. Without sk, the adversary cannot answer this fresh decrypt-and-return challenge, so replay does not yield a valid accepting transcript for a fresh session except with probability bounded by Theorem 2. The server additionally rejects reused session identifiers sid. 6.6

Summary

Under standard TFHE assumptions, ΠFBAN provides privacy-in-use of behavioral features against an HbC server. Moreover, we formalize impersonation resistance via Expimp and show that, without sk, any PPT adversary can succeed only with essentially random-guess probability (plus negligible terms), while replay is prevented by session freshness and the decrypt-and-return structure. All reported experiments correspond to TFHE parameter sets selected at a target security level of at least 128 bits.

7

Conclusions

This paper studied privacy-preserving continuous behavioral authentication and presented FBAN, an FHE-compatible bottleneck-attention network tailored to TFHE-style integer-only computation. By integrating quantization-aware training with homomorphic-friendly attention design, FBAN enables end-to-end encrypted inference while maintaining a lightweight model footprint practical for periodic or risk-triggered re-verification scenarios. Our experiments on TouchPitfalls and Touchalytics show that FBAN achieves competitive authentication accuracy under a unified evaluation pipeline, and remains effective across Pretrain, QAT, and TFHE settings. From a cryptographic perspective, we formalized feature confidentiality against an honest-butcurious server under standard TFHE assumptions and provided a protocol-level

FBAN: FHE-Compatible Bottleneck Attention Network

19

impersonation experiment, showing that an adversary without the TFHE secret key can succeed only with negligible (random-guess) probability. Overall, FBAN demonstrates that strong continuous-authentication performance can be obtained without exposing sensitive behavioral traces to the server, making it a practical step toward cryptography-grade privacy in behavioral biometrics.

Acknowledgment This work is partially supported by JST BOOST, Japan Grant Number JPMJBS2402, JSPS KAKENHI Grant Number 26H02496 and SECOM Science and Technology Foundation.

References 1. Abuhamad, M., Abusnaina, A., et al.: Sensor-based continuous authentication of smartphones’ users using behavioral biometrics: A contemporary survey. IEEE Internet of Things Journal 8(1), 65–84 (2020) 2. Ayeswarya, S., Singh, K.J.: A comprehensive review on secure biometric-based continuous authentication and user profiling. IEEE Access 12, 82996–83021 (2024) 3. Bai, J., Zhang, X., et al.: Cryptomask: Privacy-preserving face recognition. In: International Conference on Information and Communications Security. pp. 333– 350 (2023) 4. Baig, A.F., Eskeland, S.: Security, privacy, and usability in continuous authentication: A survey. Sensors 21(17), 5967 (2021) 5. Chen, T., Bao, H., et al.: The-x: Privacy-preserving transformer inference with homomorphic encryption. arXiv preprint arXiv:2206.00216 (2022) 6. Cheon, J.H., Kim, A., Kim, M., Song, Y.: Homomorphic encryption for arithmetic of approximate numbers. In: International conference on the theory and application of cryptology and information security. pp. 409–437. Springer (2017) 7. Chillotti, I., Gama, N., et al.: Tfhe: fast fully homomorphic encryption over the torus. Journal of Cryptology 33(1), 34–91 (2020) 8. Dilshan, S., Sanuja, T., et al.: Behaveformer: a framework with spatio-temporal dual attention transformers for imu enhanced keystroke dynamics. Proceedings in Computer Science, Cryptography and Security (2023) 9. Frank, M., Biedert, R., et al.: Touchalytics: On the applicability of touchscreen input as a behavioral biometric for continuous authentication. IEEE Transactions on Information Forensics and Security 8(1), 136–148 (2013) 10. Gentry, C.: A fully homomorphic encryption scheme. Stanford university (2009) 11. Georgiev, M., Eberz, S., et al.: Common evaluation pitfalls in touch-based authentication systems. In: Proceedings of the 2022 ACM on Asia Conference on Computer and Communications Security. pp. 1049–1063 (2022) 12. Georgiev, M., Eberz, S., et al.: Techniques for continuous touch-based authentication. In: International Conference on Information Security Practice and Experience. pp. 409–431 (2022) 13. Gilad-Bachrach, R., Dowlin, N., et al.: Cryptonets: Applying neural networks to encrypted data with high throughput and accuracy. In: International conference on machine learning. pp. 201–210 (2016)

20

Jichao Xiong, Atsuko Miyaji, and Jiageng Chen

14. Incel, Ö.D., Günay, S., et al.: Dakota: Sensor and touch screen-based continuous authentication on a mobile banking application. IEEE Access 9, 38943–38960 (2021) 15. Lin, J., Chen, J., et al.: A lightweight privacy-preserving federated learning framework for heterogeneity-resilient skin cancer diagnosis. IEEE Journal of Biomedical and Health Informatics (2025) 16. Nie, Y.: A time series is worth 64words: Long-term forecasting with transformers. arXiv preprint arXiv:2211.14730 (2022) 17. Ometov, A., Bezzateev, S., et al.: Multi-factor authentication: A survey. Cryptography 2(1), 1 (2018) 18. Park, D., Lee, E., et al.: Powerformer: Efficient privacy-preserving transformer with batch rectifier-power max function and optimized homomorphic attention. Tech. rep., Cryptology ePrint Archive (2024) 19. Sagi, O., Rokach, L.: Ensemble learning: A survey. Wiley interdisciplinary reviews: data mining and knowledge discovery 8(4), e1249 (2018) 20. Sitová, Z., Šeděnka, J., et al.: Hmog: New behavioral biometric features for continuous authentication of smartphone users. IEEE Transactions on Information Forensics and Security 11(5), 877–892 (2015) 21. Stylios, I., Kokolakis, S., et al.: Behavioral biometrics & continuous user authentication on mobile devices: A survey. Information Fusion 66, 76–99 (2021) 22. Tang, W., Long, G., et al.: Omni-scale cnns: a simple and effective kernel size configuration for time series classification. arXiv preprint arXiv:2002.10061 (2020) 23. Wang, Y., Hu, R.: Tsca: Enhancing smartphone security with a touchpointssensitive and context-aware model for touchscreen-based authentication. In: 2025 28th International Conference on Computer Supported Cooperative Work in Design (CSCWD). pp. 1937–1942 (2025) 24. Wu, H., Hu, T., et al.: Timesnet: Temporal 2d-variation modeling for general time series analysis. arXiv preprint arXiv:2210.02186 (2022) 25. Xiong, J., Chen, J., Liu, H., Zhou, G., Cui, J., Lin, J., Jiao, D.: A privacy-preserving computer-aided diagnosis framework for medical applications using federated learning and homomorphic encryption. In: International Conference on Attacks and Defenses for Internet-of-Things. pp. 90–106. Springer (2024) 26. Xiong, J., Chen, J., et al.: Enhancing privacy-preserving machine learning with self-learnable activation functions in fully homomorphic encryption. Journal of Information Security and Applications 86, 103887 (2024) 27. Xiong, J., Chen, J., et al.: Stresssentry-fhe: A transformer-based privacy-preserving framework for stress detection using quantized attention. In: International Conference on Knowledge Science, Engineering and Management. pp. 300–311. Springer (2025) 28. Yang, D., Xu, B., et al.: A novel biometric authentication scheme with privacy preserving. In: 2012 Eighth International Conference on Computational Intelligence and Security. pp. 452–456 (2012) 29. Yao, J., Wang, D.: Strokepin: Enhancing pin authentication with keystroke dynamics for mobile devices. IEEE Transactions on Dependable and Secure Computing (2026) 30. Zama: Concrete ML: a privacy-preserving machine learning library using fully homomorphic encryption for data scientists (2022) 31. Zhang, J., Yang, X., et al.: Secure transformer inference made non-interactive. Cryptology ePrint Archive (2024) 32. Zhu, H., Xiao, M., et al.: Soundlock: A novel user authentication scheme for vr devices using auditory-pupillary response. In: NDSS (2023)

Related documents

• FBAN: A Fully Homomorphic Encryption Compatible Bottleneck Attention Network for Privacy-Preserving Behavioral Authentication#1217909
• Contextual Chain: Lightweight Continuity Authentication for Intermittently Connected Devices#1217997
• Contextual Chain: Lightweight Continuity Authentication for Intermittently Connected Devices#1210198
• MIRAGE: Full-Body Bystander Privacy for Smart Glasses with Consent-Based Restoration#1050951
• MIRAGE: Full-Body Bystander Privacy for Smart Glasses with Consent-Based Restoration#1028585