ID Embedding Protocol: Secure Group Verification

• ID Embedding Protocol is a family of privacy-preserving, quantization-based schemes that convert high-dimensional signatures into discrete embeddings for anonymous group membership verification.
• It utilizes embedding functions with scalar quantization and aggregation techniques, such as aggregate-then-embed and embed-then-aggregate, to balance low verification error rates and high reconstruction resistance.
• The protocol demonstrates a trade-off between privacy and accuracy, where parameters like quantization threshold and subgroup size are tuned to achieve optimal k-anonymity and performance metrics (e.g., AUC).

The ID embedding protocol refers to a family of privacy-preserving, quantization-based schemes enabling secure group membership verification without disclosing fine-grained identity information. These protocols encode high-dimensional signatures (such as biometric features or cryptographic keys) into discrete embeddings that allow efficient anonymous verification while preventing reconstruction and linking attacks by an honest-but-curious server. The following sections outline the core components, mathematical formalism, operational workflow, and security-privacy trade-offs of the prototypical ID embedding protocol as analyzed in (Gheisari et al., 2018).

1. Problem Setting and Threat Model

The primary objective is to determine, for a query signature $y\in\mathbb{R}^d$, whether it is a (possibly noisy) member of a pre-enrolled set $$\mathcal{G} = \{x_1, \dots, x_N\}\subset\mathbb{R}^d$$, without revealing which member or enabling reconstruction of the enrolled signatures. The verification is delegated to an untrusted server that follows the protocol (honest-but-curious) but attempts to breach privacy through inference or reconstruction from the data it holds.

Security and privacy goals:

• Reconstruction resistance: Mean squared error (MSE) of reconstructing any $x_j$ from server-side records should be high.
• k-anonymity: Under the hypothesis that $y$ is a group member ($H_1$), the server cannot associate the query with the individual identity beyond a group of size $k$.
• Low error rates: Maintain low false positive ($\alpha=\Pr(\text{decide }H_1|H_0)$) and false negative ($\beta=\Pr(\text{decide }H_0|H_1)$) rates, bounded by application requirements.

2. Embedding and Aggregation Framework

2.1 Notation

• $d$: Signature dimension ($x_j \in\mathbb{R}^d$)
• $$\mathcal{G} = \{x_1, \dots, x_N\}\subset\mathbb{R}^d$$0: Number of enrolled signatures
• $$\mathcal{G} = \{x_1, \dots, x_N\}\subset\mathbb{R}^d$$1: Embedding function $$\mathcal{G} = \{x_1, \dots, x_N\}\subset\mathbb{R}^d$$2; $$\mathcal{G} = \{x_1, \dots, x_N\}\subset\mathbb{R}^d$$3 is a discrete alphabet of size $$\mathcal{G} = \{x_1, \dots, x_N\}\subset\mathbb{R}^d$$4 (e.g., ternary codes with $$\mathcal{G} = \{x_1, \dots, x_N\}\subset\mathbb{R}^d$$5)
• $$\mathcal{G} = \{x_1, \dots, x_N\}\subset\mathbb{R}^d$$6: Aggregation function producing a representative embedding or vector
• $$\mathcal{G} = \{x_1, \dots, x_N\}\subset\mathbb{R}^d$$7: Score function for membership computation
• $$\mathcal{G} = \{x_1, \dots, x_N\}\subset\mathbb{R}^d$$8: Membership decision threshold

2.2 Embedding (Quantization)

Each signature $$\mathcal{G} = \{x_1, \dots, x_N\}\subset\mathbb{R}^d$$9 is projected by $x_j$0 (usually with orthonormal rows), obtaining $x_j$1. Scalar quantization is performed:

$x_j$2

for $x_j$3, with $x_j$4 determining sparsity ($x_j$5, where $x_j$6 is the component variance under a Gaussian model).

2.3 Aggregation Mechanisms

Aggregation can be positioned either before or after embedding:

• Aggregate-then-Embed (HoA):
  • $x_j$7
  • $x_j$8, where $x_j$9
  • Representative $y$0
• Embed-then-Aggregate (AoH):
  • Pool binary codes $y$1 coordinate-wise:
  • Sum-and-sign: $y$2
  • Majority vote: $y$3

3. Protocol Workflow

3.1 Enrollment

1. Each client $y$4 sends $y$5 (optionally through a secure channel) to the server.
2. Server aggregates $y$6 (using one of the two aggregation modes above) into representative $y$7 (vector or code) and stores $y$8.

3.2 Verification

1. The client captures $y$9, computes $H_1$0 locally, and transmits $H_1$1 to the server.
2. The server computes similarity score $H_1$2.
3. If $H_1$3, the server reports "member" ($H_1$4); otherwise "non-member" ($H_1$5).

This process ensures that the server never sees the query in the clear and, due to the aggregation/embedding, cannot reconstruct individual group members.

4. Security, Privacy, and Anonymity Guarantees

4.1 Information-Theoretic Analysis

• Single embedding leakage: The expected reconstruction error from $H_1$6 is

$H_1$7

• Group aggregate leakage (HoA-sum): Best estimator for any $H_1$8 is $H_1$9, yielding

$k$0

• Aggregated embeddings (other schemes): Hides the mean, so $k$1, maximizing reconstruction uncertainty.

4.2 Anonymity

• Protocol delivers $k$2-anonymity: the server cannot link queries to a unique $k$3 but only to a group (subgrouping increases $k$4).

5. Verification–Privacy Trade-off and Experimental Results

Increasing sparsity (via larger $k$5) and group size $k$6 improves privacy (higher MSE, stronger anonymity) but reduces verification accuracy (lower AUC, higher error rates). Experimental evaluations (synthetic $k$7, $k$8) yield:

Mode	AUC (accuracy)	$k$9 (privacy)	Domain
HoA-pinv	≈0.98	moderate	mid sparsity
AoH-sum-sign	≈0.90	≈0.90	high privacy
HoA-pinv M>1	≈0.97 (splitting $\alpha=\Pr(\text{decide }H_1|H_0)$0 into $\alpha=\Pr(\text{decide }H_1|H_0)$1 subgroups)	≈0.99	subgrouping

For subgroup sizes $\alpha=\Pr(\text{decide }H_1|H_0)$2, $\alpha=\Pr(\text{decide }H_1|H_0)$3-anonymity is achieved with negligible drop in AUC. The ROC/AUC tradeoff can be tuned by the threshold $\alpha=\Pr(\text{decide }H_1|H_0)$4.

6. Parameter Setting and Practical Implementation

• Embedding length $\alpha=\Pr(\text{decide }H_1|H_0)$5 is typically set to $\alpha=\Pr(\text{decide }H_1|H_0)$6.
• Quantization threshold $\alpha=\Pr(\text{decide }H_1|H_0)$7: empirically, $\alpha=\Pr(\text{decide }H_1|H_0)$8 to optimize MSE; $\alpha=\Pr(\text{decide }H_1|H_0)$9 for maximal privacy.
• Aggregation size $\beta=\Pr(\text{decide }H_0|H_1)$0 and subgroup size $\beta=\Pr(\text{decide }H_0|H_1)$1: larger $\beta=\Pr(\text{decide }H_0|H_1)$2 increases privacy at some accuracy cost, but subgrouping mitigates the effect.
• $\beta=\Pr(\text{decide }H_0|H_1)$3 is calibrated for the required $\beta=\Pr(\text{decide }H_0|H_1)$4 via ROC analysis.

The protocol is robust to variations in these parameters, supporting real-world deployment across a wide range of settings.

7. Applications and Limitations

The ID embedding protocol supports anonymous group-membership verification for high-dimensional data such as biometrics, features, or cryptographic credentials. Its design is agnostic to the precise signature distribution but assumes the enrolled (and query) signatures are appropriately normalized and decorrelated. Limitations include a tunable (but unavoidable) trade-off between privacy and verification accuracy, dependence on group size (to guarantee $\beta=\Pr(\text{decide }H_0|H_1)$5-anonymity), and the requirement for inclusion of all members’ signatures at enrollment time. Further, the technique assumes an honest-but-curious threat model; malicious adversaries who deviate from protocol are not specifically addressed (Gheisari et al., 2018).

---

The protocol achieves the goal of enabling anonymous yet accurate group membership checks, with proven resistance to reconstruction and linking attacks, flexible aggregation strategies, and empirically validated privacy–accuracy guarantees for a broad class of high-dimensional signature distributions.