A compromised biometric cannot be reset like a password

What it is

Non-resettable biometric compromise means that after a face, fingerprint, iris, or usable representation is copied, a person cannot acquire an entirely new bodily characteristic as they can choose a new password. A system can revoke a device key, re-encode a protected template, or move to another modality, but it cannot retrieve the original trait from an attacker.

Why it happens

Biometric characteristics are often exposed through photographs, speech, touched surfaces, and ordinary behavior; they are not secrets. Risk grows when a system centrally stores linkable samples or templates and reuses one representation across services. One breach can support persistent impersonation, cross-database linkage, and privacy harm. A cancelable template approximates reset only when transformations are isolated, old representations become invalid, and the source sample did not leak.

Studying it

Map enrollment, matching, backup, logs, model training, and deletion, identifying which components can access raw samples, feature vectors, templates, and linkage identifiers. In an authorized breach exercise, compromise one test store and assess replay, inversion, cross-service linkage, and whether old material works after rotation. Use synthetic or specifically enrolled test subjects rather than publishing or downloading real user templates.

Where it stops holding

A template is not necessarily a raw image and may not permit reconstruction; consequences depend on representation, protection, and attack surface. Local comparison in protected hardware usually reduces centralized exposure but cannot prevent every endpoint attack. Non-resettable does not mean permanent loss of all authentication: the service can retire a modality, change device keys, add factors, or migrate the account.

Applying it

• Prefer comparison in the user's protected device environment and have the service verify a cryptographic device result instead of collecting raw biometric samples.
• Isolate and encrypt templates by device or service; restrict export, debug logs, training reuse, and staff access, with an explicit deletion period.
• Prepare breach response that retires affected templates or modalities, rotates associated keys, strengthens later authentication, and communicates persistent risk.
• Before claiming a “cancelable template,” verify that the old representation fails, services cannot link the new representations, and raw samples were not retained.

Related

• Same group: O3.03.5 Temporal drift · O3.03.7 Presentation attacks
• Adjacent: O1.07 Verifiable deletion · O3.02 Two-factor authentication
• Search terms: biometric template compromise · cancelable biometrics · local biometric matching