The 90th meeting of IFIP Working Group 10.4 was hosted by Bojan Cukic and Marco Vieira at the University of North Carolina at Charlotte. It featured a workshop on Trustworthy Identity and Biometric Systems, organised by Homa Alemzadeh from the University of Virginia and Stephanie Schuckers from UNC Charlotte.
The workshop brought together experts in biometrics, identity management, security and dependable computing. Across four sessions, participants explored benchmarking and evaluation; ethics, policy and responsible deployment; behavioural biometrics and human factors; and adversarial robustness and applications.
Discussion examined how identity is established, verified and protected at a time when generative AI can convincingly fabricate the signals on which biometric systems rely. It also addressed an emerging challenge: the identities to be verified increasingly include not only people, but AI agents acting on their behalf.
Biometric recognition is “solved” only under ideal conditions
Two decades of independent, transparent benchmarking at NIST have shown that face recognition can approach perfect accuracy, but only when conditions align. This requires a recent algorithm, an enrolled match in the database and current, unmanipulated images of adequate quality and pose.
Difficult cases remain. Twins, look-alikes, poor image quality, extreme angles and long-term ageing continue to challenge biometric systems, particularly when people were enrolled as children or teenagers.
False-match rates are also highly uneven across demographic groups, varying by more than two orders of magnitude. These differences can have serious real-world consequences, including documented wrongful arrests. The problem is compounded by evidence that human reviewers comparing unfamiliar faces typically perform worse than the algorithms they are expected to check.
The research frontier has therefore shifted from raw accuracy to difficult cases, fairness, privacy and trust. This includes recognition at a distance using fused facial, body and gait modalities. While accuracy benchmarking is mature, these newer areas do not yet have comparable benchmarks.
Generative AI cuts both ways
Generative models present both opportunities and threats for trustworthy identity systems.
Synthetic identities can substitute for real faces in training data, helping to mitigate the consent and privacy concerns associated with datasets containing real people. Research suggests that synthetic data can approach the utility of real facial data for training purposes.
However, generative AI also enables increasingly sophisticated attacks. Deepfakes can give stolen images the appearance of liveness through realistic motion, expression and real-time face swapping. Digital injection attacks pose a different threat, bypassing the sensor entirely to insert manipulated biometric data directly into a system.
Defences are evolving in parallel. These include deepfake detection, manipulation localisation and model-parsing techniques that attempt to reverse-engineer the generator used to create false content.
However, presentation attack detection and injection attack detection require distinct evaluation methodologies. Both remain unresolved challenges as attacks continue to evolve.
Liveness, not secrecy, is the foundation of biometric trust
Unlike passwords, biometrics cannot be kept secret. They also cannot be revoked or replaced once compromised.
Biometric security must therefore rest on liveness. A stolen biometric should be useless without a live sample, making presentation attack detection an essential companion to biometric comparison.
LivDet benchmarks, conducted since 2009, show that liveness detection has improved. However, it remains an ongoing contest between attackers and defenders, requiring continuous evaluation rather than one-time compliance.
Another barrier to responsible deployment is the immature certification ecosystem. Standards such as ISO/IEC 30107 and FIDO biometric certification exist, but a broad ecosystem of certified biometric products, evaluated for security, accuracy, bias, liveness and interoperability, has yet to emerge.
Deployments involving vulnerable populations make these issues particularly important. Infant biometrics used for birth registration and vaccination tracking, for example, amplify concerns about accuracy, privacy, consent and ethics.
Biometrics are a trust boundary, not a password replacement
Biometrics do not simply replace passwords. Instead, they relocate where trust, risk and complexity reside within an identity and access management system.
Passkeys reduce reliance on passwords but shift the security debate towards device trust, recovery processes and lifecycle assurance. Identity assurance must cover the full lifecycle, from onboarding to offboarding.
Recovery paths are frequently the weakest link and are often targeted by attackers. They should therefore be made safer than the primary authentication path, rather than easier to exploit.
Biometric systems are also deployed for very different purposes, with widely varying consequences when they fail. Governance should begin with a clear taxonomy of use cases, architectures and potential consequences. How biometric data are captured, stored, verified and recovered ultimately determines the ethical impact of a deployment.
Behavioural biometrics offer promise but demand scientific rigour
Behavioural signals such as mouse movements and keystroke dynamics can enable continuous, unobtrusive authentication. Research presented during the workshop demonstrated the value of grounding their analysis in established principles of human motor control.
Segmenting mouse dynamics using Fitts’ law, for example, captures the “pure movements” without clicks that constitute approximately half of user activity. This approach can significantly improve authentication when only limited behavioural evidence is available, particularly in early-detection scenarios where misuse must be identified as quickly as possible.
Controlled keystroke experiments also demonstrated the importance of rigorous methodology. Subtle differences in equipment, such as USB versus PS/2 keyboard timing, can dominate the behaviour being measured.
The experiments also highlighted the limitations of current LLMs. When asked to explain these anomalies, the models produced superficial or misleading hypotheses that could only be identified and filtered through domain expertise.
A courtroom case study reinforced the importance of scientific rigour. A forensic image-attribution tool presented at trial was claimed to have an error rate of one in a million. Principled testing subsequently found that its error rate was closer to one in eight.
This discrepancy was sufficient to establish reasonable doubt. It also demonstrated that identity evidence must be validated with the same discipline the dependability community applies to other systems.
Identity now extends beyond humans to AI agents
The next major identity challenge is not simply user authentication. It is establishing identity, authorisation and trust in agentic LLM systems.
Many current deployments exhibit an “identity gap”. Agents lack cryptographic identities, constrained delegation and verifiable peer trust. Consequently, a correctly authenticated user can still be harmed if an agent is manipulated by hidden instructions embedded in untrusted content and exceeds the intended scope of its delegated authority.
Agents should therefore be treated as first-class security principals across two distinct but related planes.
The first is delegation identity, which governs how authority passes from a person to an agent, including its scope, constraints and revocation. The second is peer identity, which governs how agents verify one another.
Existing mechanisms, including OAuth, RBAC/ABAC, capability tokens, SPIFFE, mTLS and MCP, each address part of the challenge. However, none fully covers recursive delegation, provenance and verification of intent.
For consequential actions, systems should verify not only whether an agent has permission to act, but whether the proposed action reflects the user’s intent. This might involve deterministic policy checks, human-in-the-loop approval or independent model-based judges.
Questions surrounding liability, interpretation of intent and the safe combination of protocols never designed for agentic systems represent a largely greenfield research agenda for the group.
Trustworthy identity is a full-stack challenge
Taken together, the workshop demonstrated that trustworthy identity has become a full-stack dependability and security problem. It encompasses sensors and liveness; algorithms and their uneven error rates; system architectures and recovery paths; governance and certification; and, increasingly, the machine agents acting on our behalf.
The community’s established tools of benchmarking, assurance and lifecycle thinking remain directly relevant. However, they must now be extended to address adversaries equipped with generative AI and identities that are no longer exclusively human.