Binding Biometrics with AI Agent Identifiers for Delegation of Authority

Source: arXiv:2608.04292 · Published 2026-08-04 · By Joseph Geo Benjamin, Anil K Jain, Karthik Nandakumar

TL;DR

This paper addresses the challenge of securely and verifiably delegating authority from human users to autonomous AI agents using biometric authentication. Existing identity frameworks for agentic AI lack binding between delegated tokens and the human authorizer, exposing systems to spoofing and repudiation risks. The authors propose BIND, a novel framework that cryptographically binds biometric data of a user to an AI agent's identifier and scope of authority, producing a delegation token that supports real-time authentication and auditable delegation. BIND uses biometric cryptosystems and fuzzy commitment constructs to ensure that an Identity Service Provider (ISP) can authenticate the user biometrically and simultaneously recover the agent ID and task scope securely for authorization and audit.

A practical implementation of BIND is demonstrated using face biometrics. The authors develop a feature adaptation module converting real-valued deep face embeddings into binary vectors compatible with turbo-code-based fuzzy commitments. Extensive experiments on standard face datasets (CFP-FF, LFW-a, Multi-PIE) show that BIND achieves a True Match Rate (TMR) of up to 96% at zero False Match Rate (FMR) for 1024-bit agent tokens. This confirms the feasibility of securely binding biometric identity with AI agent identities for delegation of authority in real-world scenarios.

Overall, this work introduces a new method to enforce accountable human control over autonomous AI agents through biometric identity binding, enhancing trust and security for critical task delegation scenarios involving agentic AI.

Key findings

• The proposed BIND framework achieves 96% True Match Rate at zero False Match Rate on CFP-FF dataset for 1024-bit agent tokens using face biometrics.
• The fuzzy commitment scheme based on turbo error correcting codes can reliably decode agent tokens up to 4096 bits in length with successful recovery above 90% under intra-user biometric variability thresholds.
• Feature adaptation involving Gaussian dithering, random projection, and WTA-hash binarization reduces intra-user bit error rates below the turbo codes' error correction capability τ, ensuring stable decoding.
• The delegation token securely binds agent ID and task scope with fresh biometric samples, enabling simultaneous biometric authentication and agent authorization via the Identity Service Provider.
• The framework defends against tampering, identity spoofing, and instance spoofing attacks by cryptographic binding of user biometrics to delegation tokens.
• Binary embedding transformation preserves discriminability of face features with negligible performance degradation compared to original real-valued embeddings (e.g., TAR@FAR=0% above 91%).
• Use of a user-specific transformation key in feature adaptation ensures cancelability and template protection.
• Experimental results cover three datasets (CFP-FF, LFW-a, Multi-PIE) and three pretrained face models (IResNet101 with ArcFace and AdaFace, KPRPE-ViTb), demonstrating robustness across modalities.

Threat model

The adversary can be a malicious human or rogue AI agent attempting to tamper with delegation tokens, impersonate users or agents by fabricating credential tokens, or reuse tokens illegitimately (instance spoofing). However, the adversary cannot forge biometric inputs that match enrolled templates, cannot access private cryptographic keys held by the ISP or TSP, and cannot recover the secret agent token without valid biometric authentication. The threat model assumes communication channels are vulnerable but mitigations like digital signatures and encryption protect against undetected modifications.

Methodology — deep read

1. Threat Model & Assumptions: The adversary may attempt tampering with delegation tokens, identity spoofing by forging user or agent IDs, or instance spoofing by replaying tokens to unauthorized agents or delegations. The system assumes that biometric templates are enrolled securely, and adversaries cannot forge biometric inputs or compromise private keys of Token Service Provider (TSP) or Identity Service Provider (ISP). The adversary cannot learn the binding secret without biometric authentication.

2. Data: The evaluation uses three standard face recognition datasets—CFP-FF (frontal faces), LFW-a (unconstrained images), and Multi-PIE (controlled pose and illumination). Features are extracted with three pretrained models: IResNet101 with ArcFace and AdaFace losses, and KPRPE-ViTb transformer with AdaFace loss, all trained on WebFace4M. Each embedding is 512-dimensional real-valued.

3. Architecture/Algorithm: The core is a biometric cryptosystem using a fuzzy commitment scheme based on turbo error correcting codes. The agent ID and task scope are concatenated, encrypted with TSP public key, then encoded with turbo code to produce a codeword (agent token). Fresh biometric samples are transformed into binary codes via a feature adaptation module involving Gaussian dithering, random projection, and WTA-hash binarization, producing stable binary biometric templates. The delegation token is formed by XORing the binary biometric template with the agent token codeword, concatenated with encrypted user ID and cryptographic hash of the encrypted agent token.

4. Training regime: The paper uses pretrained face recognition models without further training. The feature adaptation parameters (Gaussian dithering factor λ, projection matrices, permutations) are generated per user as a transformation key (second factor of authentication). Turbo codes are standard implementations from NVIDIA’s Sionna library, with tested code rates (1/3, 1/2) and message lengths (1024, 2048, 4096 bits). Specific epoch counts or optimizer configurations are not applicable.

5. Evaluation Protocol: Metrics used include True Match Rate (TMR) vs False Match Rate (FMR), operating at zero FMR for strict security. Experiments evaluate recognition performance before and after feature adaptation, error correction decoding success rates under varying bit error rates, and final authentication accuracy on multiple datasets and face models. Ablations include varying code rates, token lengths, and dithering factors. Statistical significance tests are not explicitly reported.

6. Reproducibility: The feature extractor models and preprocessing come from public CVLface library. Turbo code implementations use NVIDIA's Sionna library. The authors provide proofs and derivations for key propositions related to similarity preservation in the supplementary materials. However, code and frozen weights for the full BIND framework or token service integration are not publicly released. Dataset usage is standard and public.

Concrete example: A user wishes to delegate a task to an AI agent with specific scope. The agent ID and scope are concatenated and encrypted under the Token Service Provider’s public key. This message is then encoded using turbo codes to yield an error-corrected codeword. The user’s fresh biometric face embedding is extracted, adapted to a binary vector using Gaussian dithering, random projection, and WTA-hash binarization processes, generating a stable binary representation. XOR of the binary biometric vector and codeword forms a secure sketch, which together with encrypted user ID and hash creates the delegation token. This token is given to the agent. When the agent acts, it presents the token to the ISP, which decrypts the user ID, retrieves the enrolled biometric template, performs fuzzy commitment decoding (using XOR with the secure sketch), and recovers the encrypted agent scope and ID. Successful decoding confirms that the current biometric matches the enrolled user, authenticating the user and binding delegated authority to the specific agent and task scope.

Technical innovations

• Use of fuzzy commitment biometric cryptosystem constructs for binding a human user's biometric template to AI agent identifiers and task scopes.
• A novel feature adaptation pipeline for real-valued deep face embeddings involving Gaussian dithering, Gaussian random projection, and WTA-hash binarization to produce stable binary templates suitable for fuzzy commitment decoding.
• Integration of turbo codes as forward error correction schemes to tolerate intra-user biometric variability during secure sketch recovery for delegation tokens.
• Cryptographic token structure supporting non-repudiable proof of human control with simultaneous biometric authentication and agent authorization in multi-agent delegated task scenarios.

Datasets

• CFP-FF — 7,000+ images — public domain
• LFW-a — 13,000+ images — public domain
• Multi-PIE — >750,000 images — public domain face dataset with controlled variations

Baselines vs proposed

• Original real-valued face embeddings: TAR@FAR=0% = 94.83% (CFP-FF, IResNet101/ArcFace)
• After feature adaptation binarization: TAR@FAR=0% = 98.80% (CFP-FF, same model), showing preservation or slight improvement in discriminability
• BIND 1024-bit tokens with rate=1/3 Turbo code: TMR at zero FMR between 93%-96% across different datasets and models
• BIND with longer tokens (2048, 4096 bits) shows reduced TMR at zero FMR but remains >80% on CFP-FF with Turbo code rate=1/3
• Turbo code error correction capacity thresholds consistently correct bit error rates up to 14-15% in experiments for chosen parameters

Figures from the paper

Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2608.04292.

Fig 1: The flow diagram shows a user delegating a task to a primary agent, which decomposes the task into subtasks and generates

Fig 2 (page 2).

Fig 3 (page 2).

Fig 4 (page 2).

Fig 5 (page 2).

Limitations

• The biometric template stored in ISP is in plaintext; while cancelable biometrics can be added, this is out of scope.
• No explicit adversarial or active attack simulations (e.g., sophisticated spoofing or replay) are shown in experiments.
• The approach currently requires user interaction for delegation token generation for each agent or sub-agent; this may limit scalability in dynamic multi-agent workflows.
• Evaluation is limited to face biometrics; generalization to other biometric traits or multi-modal fusion is unexplored.
• No detailed latency or computational cost analysis of the feature adaptation and decoding pipeline is provided.
• The system assumes secure key management and trust in ISP and TSP which may be bottlenecks or targets in real deployments.

Open questions / follow-ons

• How can automatic delegation to multiple sub-agents without repeated user involvement be enabled while preserving non-repudiation?
• What are the impacts of adversarial biometric attacks or presentation attacks on BIND security?
• Can the framework be extended to multimodal biometrics or continuous authentication for long-running delegated tasks?
• How to optimize computational overhead and latency of the feature adaptation and fuzzy commitment to support real-time agentic AI operations?

Why it matters for bot defense

For bot-defense and CAPTCHA practitioners, this paper offers a novel approach to securely bind human biometric identities with agentic AI systems performing delegated actions. It demonstrates how biometric cryptosystems can enforce non-repudiable human control over autonomous AI agents, mitigating spoofing and privilege escalation risks that are critical in bot-defense. The use of stable binary embeddings compatible with fuzzy commitments illustrates a practical pathway to incorporate biometrics into secure token issuance and verification workflows.

Practitioners designing bot-detection or agent authorization mechanisms can draw on BIND's techniques to tightly couple human verification with delegated privileges, helping ensure that automated agents only act under explicit, verifiable human authorization. The feature adaptation approach may inspire improved embedding transformations for robust biometric-based access controls. However, it is primarily a backend authentication framework rather than a user-facing CAPTCHA, so direct application requires integration with identity services and token protocols. Overall, this work deepens understanding of biometric token binding as a foundational security primitive for trustworthy agentic AI ecosystems.

Cite

@article{arxiv2608_04292,
  title={ Binding Biometrics with AI Agent Identifiers for Delegation of Authority },
  author={ Joseph Geo Benjamin and Anil K Jain and Karthik Nandakumar },
  journal={arXiv preprint arXiv:2608.04292},
  year={ 2026 },
  url={https://arxiv.org/abs/2608.04292}
}

Read the full paper

• arXiv:2608.04292 (abstract)
• arXiv:2608.04292 (PDF)