1 Introduction↩︎

Iris recognition is considered one of the most accurate biometric modalities and is widely deployed in high-security systems [1]. Iris patterns are highly distinctive and stable due to epigenetic randomness during fetal development, resulting in iris codes that exhibit high entropy and near-random bit distributions [2], [3]. These characteristics provide stable discriminative capability for individual identification and contribute to the high accuracy of iris-based biometric systems. Despite these advantages, iris template compromise remains a critical security challenge. Because biometric traits are permanent, a leaked iris template cannot be resolved simply by re-enrollment. This limitation exposes authentication systems to long-term security risks.

Consequently, several cancelable biometric techniques have been proposed to transform biometric templates into revocable representations while preserving recognition performance [4]–[7]. BioHashing-based methods [7] generate protected templates using external tokens or salts. Lee et al. [8] proposed an alignment-robust cancelable biometric, while Zheng et al. [9] introduced a slicing-based method that generates revocable iris templates through transformation, allowing compromised templates to be replaced without requiring new biometric samples. However, these methods rely on external tokens, introducing a secondary attack surface; if the token is compromised, system security is significantly weakened. Hence, Ouda et al. [10] proposed a tokenless scheme that eliminates the need for external secrets. These approaches effectively improve template security and revocability; however, they are primarily designed for single-instance iris systems and do not exploit the rich information available from both irises.

Meanwhile, there is limited research on bilateral cancelable iris templates. Rafiq and Selwal [11] proposed a scheme that combines left and right iris templates using a block-XOR operation. While this method enhances security and recognition robustness, its fusion strategy increases computational complexity. Later, Arepalli and Boobalan proposed a multi-instance framework, termed the Compressed Transformed Fused template [12]. Although their method achieves an average processing time of \(0.1\) seconds and an Equal Error Rate (EER) of \(0.15\)%, it focuses only on compression and computational speed rather than optimal security. Furthermore, the aforementioned methods remain restricted to either cancelable mechanisms or multi-instance frameworks, rather than integrating both. Because the field still relies on single-iris templates, most systems fail to leverage the potential of multi-instance fusion to simultaneously enhance recognition accuracy and template security.

Therefore, this paper introduces a tokenless, multi-instance cancelable iris recognition framework that integrates bilateral information from both the left and right irises. Since the left and right iris patterns of an individual are statistically independent [2], [3], bilateral irises serve as complementary sources of biometric information, enabling mutual verification [13]. We employ contralateral XOR fusion to strengthen template protection, along with Majority Vote Fusion to create a stable enrollment template, ROI-based iris code slicing to improve recognition accuracy, and salt-based bit permutation for template randomization. Ultimately, this scheme fully satisfies the requirements of ISO/IEC 24745 [14].

2 Proposed Method↩︎

This section describes the proposed Cancelable Contralateral Fusion Scheme, which consists of preprocessing, feature extraction, region-of-interest selection, and the subsequent enrollment and authentication phases.

2.1 Preprocessing and Feature Extraction↩︎

The preprocessing and feature extraction are built based on an open-source library [15], consisting of three steps:

2.1.1 Segmentation and Normalization↩︎

The iris, pupil, and sclera boundaries are identified through segmentation, yielding an inner circle (pupil–iris boundary) and an outer circle (iris–sclera boundary). The iris texture is then projected from Cartesian to polar coordinates [15], producing a fixed-size two-dimensional rectangular array invariant to pupil dilation.

2.1.2 Feature Extraction↩︎

Following normalization, two scales of two-dimensional Gabor wavelet filtering are applied to extract a binary iris code following Daugman’s method [1]. The phase response is quantized into binary values, stored in an array of shape \([2, 16, 256, 2]\), where the first index represents two sizes of filter which are high-frequency and low-frequency filters, the second index represents each ring of the iris, the third index represents angular positions, and the last index represents the real and imaginary parts of the Gabor filter response [15].

2.2 Region of Interest Selection↩︎

The inner rows of the iris code (rows 0–1, nearest the pupil boundary) are susceptible to artifacts from pupil dilation, while the outer rows (rows 7–15, near the iris–sclera boundary) are more frequently occluded by eyelids and eyelashes. Rows 2 through 6 capture the most stable and discriminative iris texture. Hence, we select these five rows as the Region of Interest (ROI) to distinguish between genuine and impostor samples. The feature vector consists of 5,120 bits per iris (\(2~\text{filter sizes} \times 5~\text{rows} \times 256~\text{angular positions} \times 2~\text{phases (real and imaginary parts)}\)). The justification is reported using the sensitivity metric (Section 4.2.1), and analysis in Section 3.1.1.

2.3 Cancelable Contralateral Fusion Scheme↩︎

The proposed method combines both left and right iris codes into a single Protected Fused Template (PFT). Because contralateral iris patterns are statistically independent even in the same person or twin [2], [3], binding both canceled iris codes requires an attacker to possess both sides of the codes and their associated salts to recover any meaningful information.The method operates in two phases:

2.3.1 Enrollment Phase↩︎

As shown in Fig. 1, three enrolled iris images per eye side are captured and fused by Majority Vote to establish the stable template for each eye. An eye-side-specific salt is applied to the stable template, permuting the bit positions to get the permuted bits. A bitwise exclusive-OR (XOR) operation is applied to the left and right sides of the permuted bits to create the PFT. Finally, only the PFT is stored, and all enrolled iris images are discarded.

2.3.2 Authentication Phase↩︎

As shown in Fig. 2, a new pair of iris images is captured. The same salts derived from the enrollment ID for each side are applied to the new template, permuting the bit locations to get the permuted bits. Left and right side permuted bits are applied to the XOR operation to get the probed template. Finally, the PFT is compared with the stored PFT by using the Hamming Distance score. If the score is below the threshold, the system will accept the authentication.

3 Security Analysis↩︎

This section analyzes how the proposed method satisfies the three security requirements of ISO/IEC 24745 [14]: irreversibility, unlinkability, and confidentiality.

3.1 Irreversibility↩︎

The Protected Fused Template (PFT) is defined as: \[\text{PFT} = \pi_R(T_R \oplus S_R) \oplus \pi_L(T_L \oplus S_L),\] where \(T_R, T_L \in \{0,1\}^{5120}\) are sliced iris templates (one per eye), \(S_R, S_L\) are per-eye 5,120-bit pseudorandom salts, \(\oplus\) is the XOR operation, and \(\pi_R, \pi_L\) are bit permutations that are derived from the subject’s enrollment ID. Only the PFT is stored; the original iris captures and sliced templates \(T_R, T_L\) are all discarded. In addition, the enrollment phase utilizes a majority vote from iris templates. The irreversibility of this method consists of three layers:

3.1.1 Layer 1: ROI selection↩︎

Only rows 2–6 of the iris code, the 5,120-bit ROI, are utilized, and rows 0–1 (inner zone) and 7–15 (outer zone) are permanently discarded. The full iris code cannot be recovered. Although the attacker can reverse all transformations, they can recover only ROI sliced template.

3.1.2 Layer 2: Majority Vote Fusion↩︎

During the enrollment phase, the sliced iris templates (\(T_R\) and \(T_L\)) are not derived from a single iris capture. It is a per-bit majority vote over \(n=3\) independent captures. This voted template is a many-to-one function of the enrollment images. This does not reveal any information about any individual capture, and the original enrollment images cannot be reconstructed from them.

3.1.3 Layer 3: Salt permutation and contralateral XOR↩︎

To recover \(T_R\) from the PFT, an attacker must know \(S_R\), \(S_L\), \(\pi_L\), and \(T_L\). Even if an attacker already knows \(T_R\), the XOR with \(\pi_L(T_L \oplus S_L)\) still hides \(T_L\) completely. Since each salt is a 5,120-bit pseudorandom string derived from the enrollment ID, reconstructing the salt requires knowing the enrollment ID. The method assumes that the enrollment ID is kept confidential and not stored in the same database as the PFT.

3.2 Unlinkability↩︎

A pair of \((S_R, S_L)\) is issued independently for each database. Suppose the same user is enrolled in two databases with salt pairs \((S_R^{(1)}, S_L^{(1)})\) and \((S_R^{(2)}, S_L^{(2)})\), producing \(\text{PFT}_1\) and \(\text{PFT}_2\). Because of the salt differentiation, each side of the permuted templates is statistically independent. Under this assumption, the expected Hamming distance should be approximately 0.50 [1]: \[\text{HD}(\text{PFT}_1,\, \text{PFT}_2) \approx 0.50.\] This guarantees that the same user’s templates across different databases are statistically indistinguishable, satisfying the unlinkability requirement.

3.3 Confidentiality↩︎

The proposed method satisfies confidentiality because only the PFT is stored in the database. All original iris and sliced templates, \(T_R\) and \(T_L\), are permanently discarded after enrollment. A leaked PFT reveals no raw biometric data. To recover any iris template from the PFT, one needs to know both salts and the other side’s iris code, as derived above. The enrollment ID is assumed to be kept confidential and not in the same location as the PFT. Thus, an attacker who obtains only the stored PFT cannot gain any usable biometric information, satisfying the confidentiality requirement of ISO/IEC 24745 [14].

4 Results and Discussion↩︎

4.1 Dataset↩︎

Three datasets, CASIA-IrisV4-Interval, CASIA-IrisV2, and CASIA-Iris-Thousand, were used. The first dataset is the CASIA-IrisV4-Interval, containing 2,639 iris pictures with a resolution of \(320 \times 280\) pixels from 249 subjects. 121 subjects, with a total of 2,621 images and more than three image pairs for both eyes. The second dataset, CASIA-IrisV2, contains 1,200 iris images per device, each at a resolution of \(640 \times 480\) pixels, from 30 subjects. All subjects are used with separate devices. The first device uses 1,187 pictures, and the second uses 1,181 pictures. The last dataset is the CASIA-Iris-Thousand, which contains 20,000 iris images with a resolution of \(640 \times 480\) pixels from 1,000 subjects. There are 997 subjects (18,483 images in total) with contralateral irises used in the proposed method.

For each enrolled subject, the remaining iris images not used in the three-shot enrollment are paired into genuine and impostor test inputs at a 1:4 genuine-to-impostor ratio. A genuine pair consists of one right iris and one left iris probe image from the same enrolled subject. The impostor pool is constructed from three categories of equal size:

1. Cross-subject impostors: both right iris and left iris probes are drawn from a different enrolled subject.

2. Mixed-eye impostors (genuine R, impostor L): the right iris probe belongs to the enrolled subject, while the left iris probe is drawn from a different enrolled subject.

3. Mixed-eye impostors (genuine L, impostor R): the symmetric case, where the left iris probe is genuine and the right iris probe is from a different subject.

The second and third categories directly model the mixed-eye attack, in which an attacker possessing one genuine iris attempts to authenticate by pairing it with a stolen or synthetic contralateral iris. These categories constitute two-thirds of the impostor pool, ensuring that the reported EERs reflect resistance to this attack scenario, not only conventional cross-subject impostors.

4.2 Evaluation Metrics↩︎

The evaluation metrics were used as follows:

4.2.1 D-prime, \(d'\)↩︎

The \(d'\) is the sensitivity metric for distinguishing between genuine and impostor Hamming distance distributions. \[d' = \frac{|\mu_G - \mu_I|}{\sqrt{\frac{1}{2}(\sigma_G^2 + \sigma_I^2)}},\] where:

• \(\mu_G, \sigma_G\): Mean and standard deviation of the Genuine (intra-class) Hamming distances.

• \(\mu_I, \sigma_I\): Mean and standard deviation of the Imposter (inter-class) Hamming distances.

4.2.2 Equal Error Rate (EER)↩︎

The EER is the error rate at the operating point where the False Match Rate (FMR) equals the False Non-Match Rate (FNMR): \[\text{EER} = \text{FMR}(\tau^*) = \text{FNMR}(\tau^*),\] where \(\tau^*\) is the Hamming Distance threshold where both FMR and FNMR are equal, and \[\begin{align} \text{FMR}(\tau) &= \frac{|\{\text{impostor pairs} : \text{HD} < \tau\}|}{|\{\text{all impostor pairs}\}|}. \\ \text{FNMR}(\tau) &= \frac{|\{\text{genuine pairs} : \text{HD} \geq \tau\}|}{|\{\text{all genuine pairs}\}|}. \end{align}\] The probe is accepted as genuine when \(\text{HD} < \tau\). The lower the EER, the better the separation between genuine and impostor.

4.2.3 Detection Error Tradeoff (DET) Curve↩︎

The DET curve plots FNMR against FMR across all decision thresholds \(\tau\), providing a comprehensive view of the trade-off between false non-matches and false matches at every operating point. Unlike a single EER value, the DET curve reveals the system’s full operating characteristics. A curve closer to the origin indicates better overall performance.

4.2.4 Hamming Distance↩︎

The Hamming Distance (HD) measures the bit-level dissimilarity between two binary iris templates \(\mathbf{A}, \mathbf{B} \in \{0,1\}^N\): \[\text{HD}(\mathbf{A}, \mathbf{B}) = \frac{1}{N}\sum_{i=1}^{N} A_i \oplus B_i,\] To compensate for rotational misalignment during capture, the minimum HD over small cyclic shifts \(k\) is taken: \[\text{HD}^*(\mathbf{A}, \mathbf{B}) = \min_{k}\; \text{HD}\!\left(\mathbf{A},\, \sigma^k(\mathbf{B})\right),\] where \(\sigma^k(\cdot)\) denotes a cyclic shift by \(k\) positions.

4.3 ROI Selection↩︎

To identify the most discriminative region between genuine and impostor, we compute the sensitivity index \(d'\) per row across all datasets, as shown in Table 1. The inner zone (rows 0 and 1) shows significantly lower \(d'\) than row 2, while the outer zone (rows 7 to 15) demonstrates the lowest \(d'\) compared to other zones. Rows 2 to 6 (the middle zone) show the highest \(d'\) across all datasets and are therefore selected as the ROI.

4.4 Ablation Study↩︎

As shown in Table 2, the ablation study was conducted under 1:4 genuine-to-impostor test inputs for observing the trade-off between accuracy and security. The permutation slightly increases EER but strengthens the security guarantee. The salt does not affect EER since it only permutes bit positions, but is essential for unlinkability. Majority Vote Fusion and ROI selection both contribute to recognition performance.

4.5 DET Curve Evaluation↩︎

Fig. 3 demonstrates the DET curves of the proposed method across all three datasets. On CASIA-IrisV4-Interval, the curve approaches the origin closely, consistent with its \(0.36\)% EER, showing strong separation between genuine and impostor. On CASIA-IrisV2 Device 1 and CASIA-Iris-Thousand, both curves remain close to the origin with their EERs of \(4.88\)% and \(3.35\)%, respectively. On CASIA-IrisV2 Device 2, the curve is shifted toward the upper right due to the dataset’s low separability with its \(10.80\)% EER. The DET curves confirm consistent separability across all datasets at every operating point, not only at the EER.

4.6 Comparison with Prior Works↩︎

Table 3 compares the proposed method against prior cancelable iris schemes and unprotected baselines. Prior works are evaluated only on CASIA-IrisV4-Interval (equivalent to CASIA-IrisV3-Interval: 2,639 images, 249 subjects); “–” indicates the unreported values. Because the proposed method fuses both irises, whereas all prior works operate on a single eye, contralateral binding provides an additional security layer not captured by single-iris EER alone. Across all datasets, the Proposed Method achieves the lowest EER compared to both unprotected baselines. The elevated EER of 10.80% on CASIA-IrisV2 Device 2 reflects the dataset’s low separability, even with an unprotected baseline that already reaches 16.63%. Additionally, its per-row \(d'\) values in Table 1 are the lowest across all datasets. The proposed method still reduces the EER by approximately one-third relative to both unprotected baselines.

4.7 Computation Time↩︎

All experiments were conducted on an Apple MacBook Pro equipped with an Apple M5 chip (10-core CPU comprising 4 performance cores and 6 efficiency cores) and 16 GB unified memory, running macOS Tahoe 26.3. Each phase was measured and averaged over \(100\) trials. Table 4 demonstrates the time each processing stage takes separately.

Table 5 demonstrates that the time difference between the proposed method and the unprotected baselines is negligible. The most time-consuming step across all methods is the feature extraction step from open-iris [15], which accounts for over \(99\)% of the total time in both enrollment and authentication. The cancelable steps, such as Majority Vote Fusion, salt permutation, and XOR fusion, shown in Table 4, total only about \(0.97\) ms for enrollment, \(1.79\) ms for authentication, and \(1.05\) ms for Hamming Distance comparison. This demonstrates that the overhead introduced by the protection steps is negligible compared to feature extraction.

4.8 Security Evaluation↩︎

Each permutation \(\pi_R\) and \(\pi_L\) comes from a 5,120-bit salt that makes the search space per eye to be upper-bounded by \(\log_2(5120!)\) bits. An attacker needs to know both \(\pi_R\) and \(\pi_L\) simultaneously without knowing either the salt or the raw iris code. Even if one iris code is fully known, for example, \(T_R\) is leaked, the XOR with \(\pi_L(T_L \oplus S_L)\) still completely hides \(T_L\); thus, knowing one eye gives no advantage in recovering the other. Beyond the mathematical security bound, as shown in Table 3, the proposed method satisfies the three ISO/IEC 24745 requirements (irreversibility, unlinkability, and confidentiality), and additionally provides multi-instance fusion and contralateral binding. All prior methods [8], [9], [11], [12], [16], [17] operate on a single eye and do not use contralateral binding. Only [11] and [12] employ multi-instance fusion, yet they still rely on a single eye. No prior scheme simultaneously combines contralateral and multi-instance protection.

5 Conclusion↩︎

This paper presents a cancelable contralateral iris template protection scheme using Majority Vote Fusion (\(n\,=\,3\) captures per eye), salt-based bit permutation, and contralateral XOR fusion to produce a single Protected Fused Template. To the best of our knowledge, this is the first scheme to combine tokenless multi-instance fusion and contralateral binding under ISO/IEC 24745. The proposed method was evaluated on three datasets (CASIA-IrisV4-Interval, CASIA-IrisV2 (device 1 and 2), and CASIA-Iris-Thousand), achieving EER of \(0.36\)%, \(4.88\)%, \(10.80\)%, and \(3.35\)%, respectively. The proposed method outperforms both the unprotected full-iris and ROI baselines on all datasets.

The proposed scheme satisfies three ISO/IEC 24745 requirements: irreversibility, confidentiality, and unlinkability. For irreversibility, reconstructing either iris code requires knowing both salts and the other eye’s iris code. For confidentiality, original iris captures are permanently discarded after enrollment, and the stored PFT reveals no raw biometric data without knowing the enrollment ID. For unlinkability, the same subject enrolled in two databases with different enrollment IDs yields templates with an HD of approximately \(0.50\), demonstrating complete statistical independence and preventing cross-database tracking.

However, it has a few limitations. Firstly, although the ROI selection (iris’s rows 2–6) was optimized for CASIA datasets, it may not generalize to other datasets. Secondly, the scheme depends on a binary iris code produced by a 2D Gabor wavelet extractor, and the compatibility with other iris code extractors, such as deep learning-based feature extraction, has still not been evaluated. Lastly, the scheme is designed for scenarios in which both irises are available. Individuals with a single functional eye are excluded. Future work will address these limitations by evaluating the method with different sensors or in real-world deployment settings, exploring deep learning-based feature extraction, and extending it to multimodal biometric fusion.

Acknowledgment↩︎

This research was financially supported by the Fundamental Fund under grant number FFB690024/0337, the National Research Council of Thailand (NRCT), the Thailand Advanced Institute of Science and Technology (TAIST), the National Science and Technology Development Agency (NSTDA), the Institute of Science Tokyo, the Sirindhorn International Institute of Technology (SIIT), Thammasat University (TU) under the TAIST–Science Tokyo Program.

References↩︎