PolyProtect: Biometric Template Protection

• PolyProtect is a biometric template protection scheme that transforms real-valued face embeddings using subject-specific multivariate polynomial mappings.
• It enables a tunable trade-off between recognition accuracy and irreversibility by adjusting overlap parameters and implementing smart key selection.
• It is applied in diverse scenarios, from mobile face verification and encrypted analytics pipelines to humanitarian biometrics, ensuring unlinkability and template renewability.

to=arxiv.search qq彩票 北京赛车冠军json {"query":"PolyProtect face embeddings biometric template protection", "max_results": 10, "sort_by": "relevance"} to=arxiv.search тәшкиരം qq彩票 аанацҳауеитjson {"query":"\"PolyProtect\" arXiv", "max_results": 10, "sort_by": "relevance"} PolyProtect is a biometric template protection scheme for neural-network-based face verification and related face analytics. In its canonical form, it transforms a real-valued face embedding into a lower-dimensional protected template by applying subject-specific multivariate polynomials to consecutive groups of embedding elements. Across the literature, it is presented as a handcrafted, feature-level protection method whose main design goals are to preserve recognition utility while strengthening irreversibility, unlinkability, and template renewability under a full-disclosure threat model (Hahn et al., 2021). Subsequent work has deepened its irreversibility analysis, proposed stronger key-selection procedures, integrated it with fully homomorphic encryption (FHE) for privacy-preserving face analytics, and extended its evaluation to identification and fingerprint biometrics in humanitarian settings (Hahn et al., 5 May 2026, Yalavarthi et al., 2024, Stragapede et al., 25 Aug 2025).

1. Research context and development trajectory

PolyProtect was introduced for mobile face verification scenarios in which a deep network converts a face image into a compact embedding that is stored or processed as a biometric template. The motivating concern is that face embeddings are sensitive: prior work cited in the PolyProtect literature had shown that embeddings can be inverted to reconstruct approximate face images, and that soft biometric attributes such as sex, age, race, or hair color can be inferred from them. The original framing therefore treated template protection not as a peripheral add-on, but as a requirement for privacy-preserving deployment of neural biometric systems (Hahn et al., 2021).

A second line of work reframed PolyProtect as a strong template-protection baseline, while also identifying a limitation: PolyProtect alone may still leak soft biometrics even when it preserves identification accuracy. This motivated a layered design in which FHE protects the embedding during computation and PolyProtect adds a template-level protection layer to the resulting representation (Yalavarthi et al., 2024). A third line of work revisited the method’s central security claim—irreversibility—under a stronger numerical attacker model and introduced a key selection algorithm intended to make protected templates harder to invert than under purely random parameter generation (Hahn et al., 5 May 2026). A fourth line of work selected PolyProtect for humanitarian biometric systems because of its effectiveness, modularity, and lightweight computational burden, and then evaluated it in verification, identification, irreversibility, and unlinkability settings for both face and fingerprint embeddings (Stragapede et al., 25 Aug 2025).

Work	Setting	Main contribution
(Hahn et al., 2021)	Mobile face verification	Introduces PolyProtect for 128-dimensional face embeddings
(Yalavarthi et al., 2024)	FHE-based face analytics	Places PolyProtect after MRL compression and FHE encryption
(Hahn et al., 5 May 2026)	Irreversibility analysis	Shows cosine-based inversion is stronger; proposes key selection
(Stragapede et al., 25 Aug 2025)	Humanitarian biometrics	Evaluates identification and fingerprint protection

2. Mathematical construction and parameterization

PolyProtect maps an embedding

$V = [v_1, v_2, \ldots, v_n]$

to a protected template

$P = [p_1, p_2, \ldots, p_k], \qquad k < n.$

Each protected component is formed from $m$ consecutive embedding values using subject-specific coefficients

$C = [c_1, c_2, \ldots, c_m]$

and exponents

$E = [e_1, e_2, \ldots, e_m].$

For the first component,

$$p_1 = c_1 v_{1}^{e_1} + c_2 v_{2}^{e_2} + \cdots + c_m v_{m}^{e_m}.$$

Successive components are defined by sliding the polynomial window across the embedding; the amount of reuse between neighboring windows is controlled by the overlap parameter (Hahn et al., 2021).

The overlap parameter is central to the construction. For $\text{overlap}=0$, the second block is disjoint: $$p_2 = c_1 v_{m+1}^{e_1} + c_2 v_{m+2}^{e_2} + \cdots + c_m v_{m+m}^{e_m}.$$ For maximum overlap $m-1$, adjacent blocks share all but one element: $$p_2 = c_1 v_{2}^{e_1} + c_2 v_{3}^{e_2} + \cdots + c_m v_{m+1}^{e_m}.$$ If the last window is incomplete, the embedding is zero-padded in later formulations of the method (Hahn et al., 5 May 2026).

In the original 128-dimensional face-verification experiments, PolyProtect used $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$0; exponents were randomly permuted unique integers in $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$1, and coefficients were randomly selected unique non-zero integers in $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$2. The choice $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$3 was motivated partly by the Abel–Ruffini theorem and partly by practical concerns about using too-large exponents (Hahn et al., 2021). With a 128-dimensional embedding and $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$4, the protected dimensionality depends on overlap: overlap $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$5-D, overlap $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$6-D, overlap $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$7-D, overlap $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$8-D, and overlap $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$9-D (Hahn et al., 2021).

Later work retained $m$0 for a 512-dimensional setting and used overlap values $m$1, yielding mappings

$m$2

for overlaps $m$3, respectively (Hahn et al., 5 May 2026). In the humanitarian study, $m$4 was increased to $m$5 because the dataset had more subjects and larger subject sets required more possible distinct exponent permutations; that work also extended the coefficient range from $m$6 to $m$7 (Stragapede et al., 25 Aug 2025).

3. Security model, irreversibility, and unlinkability

PolyProtect is evaluated under a full-disclosure threat model. In the original formulation, the attacker is assumed to know the PolyProtect algorithm, $m$8, the overlap amount, the exact user-specific parameters $m$9 and $C = [c_1, c_2, \ldots, c_m]$0, one or more protected templates $C = [c_1, c_2, \ldots, c_m]$1, and a representative distribution of embedding values. The attacker’s goal is to recover the original embedding $C = [c_1, c_2, \ldots, c_m]$2 from protected template(s) $C = [c_1, c_2, \ldots, c_m]$3 (Hahn et al., 2021). This is a deliberately severe model: secrecy of the algorithm or of generic system details is not part of the defense.

The security argument begins with non-uniqueness of the inverse problem. In the 512-dimensional setting with overlap $C = [c_1, c_2, \ldots, c_m]$4, there are only $C = [c_1, c_2, \ldots, c_m]$5 protected values but $C = [c_1, c_2, \ldots, c_m]$6 unknown embedding values, leaving $C = [c_1, c_2, \ldots, c_m]$7 degrees of freedom. This means the inverse is underdetermined and therefore not unique (Hahn et al., 5 May 2026). PolyProtect further relies on the fact that coefficients and exponents are subject-specific rather than global. This contributes to unlinkability because templates from different users are transformed differently even when the underlying embeddings are similar, and it contributes to irreversibility because the mapping is many-to-one and discards structure from the original embedding (Yalavarthi et al., 2024).

Unlinkability is treated explicitly in the original work through the Gomez-Barrero framework, with local score-wise linkability $C = [c_1, c_2, \ldots, c_m]$8 and global system linkability $C = [c_1, c_2, \ldots, c_m]$9, where $E = [e_1, e_2, \ldots, e_m].$0 denotes full unlinkability and $E = [e_1, e_2, \ldots, e_m].$1 denotes full linkability. On the development set with naive random parameter selection, $E = [e_1, e_2, \ldots, e_m].$2 was about $E = [e_1, e_2, \ldots, e_m].$3–$E = [e_1, e_2, \ldots, e_m].$4 for Facenet and $E = [e_1, e_2, \ldots, e_m].$5–$E = [e_1, e_2, \ldots, e_m].$6 for Idiap. With stricter, smarter parameter selection on the evaluation set, $E = [e_1, e_2, \ldots, e_m].$7 dropped to about $E = [e_1, e_2, \ldots, e_m].$8–$E = [e_1, e_2, \ldots, e_m].$9 for Facenet and about $$p_1 = c_1 v_{1}^{e_1} + c_2 v_{2}^{e_2} + \cdots + c_m v_{m}^{e_m}.$$0–$$p_1 = c_1 v_{1}^{e_1} + c_2 v_{2}^{e_2} + \cdots + c_m v_{m}^{e_m}.$$1 for Idiap (Hahn et al., 2021). The same user-specific parameterization also enables renewability: a compromised template can be replaced by re-protecting the same embedding with different parameters.

A persistent caveat is record multiplicity. Later analyses note that if an attacker has multiple templates of the same face, reversibility risk can rise substantially, especially with larger overlap, and even a single compromised template can be problematic when overlap is large (Yalavarthi et al., 2024). This does not negate the method’s unlinkability claims, but it constrains how aggressively overlap can be increased in pursuit of recognition accuracy.

4. Accuracy–security trade-offs and stronger inversion analyses

The original PolyProtect study established a clear overlap-dependent trade-off between recognition utility and irreversibility. At $$p_1 = c_1 v_{1}^{e_1} + c_2 v_{2}^{e_2} + \cdots + c_m v_{m}^{e_m}.$$2 in the Normal scenario, Facenet baseline TMR was $$p_1 = c_1 v_{1}^{e_1} + c_2 v_{2}^{e_2} + \cdots + c_m v_{m}^{e_m}.$$3; PolyProtect achieved $$p_1 = c_1 v_{1}^{e_1} + c_2 v_{2}^{e_2} + \cdots + c_m v_{m}^{e_m}.$$4 at overlap $$p_1 = c_1 v_{1}^{e_1} + c_2 v_{2}^{e_2} + \cdots + c_m v_{m}^{e_m}.$$5, $$p_1 = c_1 v_{1}^{e_1} + c_2 v_{2}^{e_2} + \cdots + c_m v_{m}^{e_m}.$$6 at overlap $$p_1 = c_1 v_{1}^{e_1} + c_2 v_{2}^{e_2} + \cdots + c_m v_{m}^{e_m}.$$7, $$p_1 = c_1 v_{1}^{e_1} + c_2 v_{2}^{e_2} + \cdots + c_m v_{m}^{e_m}.$$8 at overlap $$p_1 = c_1 v_{1}^{e_1} + c_2 v_{2}^{e_2} + \cdots + c_m v_{m}^{e_m}.$$9, $\text{overlap}=0$0 at overlap $\text{overlap}=0$1, and $\text{overlap}=0$2 at overlap $\text{overlap}=0$3. Idiap baseline TMR was $\text{overlap}=0$4; PolyProtect achieved $\text{overlap}=0$5, $\text{overlap}=0$6, $\text{overlap}=0$7, $\text{overlap}=0$8, and $\text{overlap}=0$9 for overlaps $$p_2 = c_1 v_{m+1}^{e_1} + c_2 v_{m+2}^{e_2} + \cdots + c_m v_{m+m}^{e_m}.$$0 through $$p_2 = c_1 v_{m+1}^{e_1} + c_2 v_{m+2}^{e_2} + \cdots + c_m v_{m+m}^{e_m}.$$1, respectively (Hahn et al., 2021). The same paper reported single-template inversion success rates at $$p_2 = c_1 v_{m+1}^{e_1} + c_2 v_{m+2}^{e_2} + \cdots + c_m v_{m+m}^{e_m}.$$2 of $$p_2 = c_1 v_{m+1}^{e_1} + c_2 v_{m+2}^{e_2} + \cdots + c_m v_{m+m}^{e_m}.$$3, $$p_2 = c_1 v_{m+1}^{e_1} + c_2 v_{m+2}^{e_2} + \cdots + c_m v_{m+m}^{e_m}.$$4, $$p_2 = c_1 v_{m+1}^{e_1} + c_2 v_{m+2}^{e_2} + \cdots + c_m v_{m+m}^{e_m}.$$5, $$p_2 = c_1 v_{m+1}^{e_1} + c_2 v_{m+2}^{e_2} + \cdots + c_m v_{m+m}^{e_m}.$$6, and $$p_2 = c_1 v_{m+1}^{e_1} + c_2 v_{m+2}^{e_2} + \cdots + c_m v_{m+m}^{e_m}.$$7–$$p_2 = c_1 v_{m+1}^{e_1} + c_2 v_{m+2}^{e_2} + \cdots + c_m v_{m+m}^{e_m}.$$8 for overlaps $$p_2 = c_1 v_{m+1}^{e_1} + c_2 v_{m+2}^{e_2} + \cdots + c_m v_{m+m}^{e_m}.$$9 through $m-1$0, leading to the practical conclusion that overlaps $m-1$1–$m-1$2 are practically irreversible, overlap $m-1$3 is partially reversible, and overlap $m-1$4 is too weak from a security standpoint. On that basis, overlap $m-1$5 was suggested as the best overall trade-off (Hahn et al., 2021).

The 2026 analysis argued that the earlier inversion methodology understated attacker capability because it optimized Euclidean distance in the protected domain and then judged success in cosine distance in the embedding domain. It implemented a stronger attack using scipy.optimize.minimize(..., method="BFGS"), minimizing cosine distance directly, and found that cosine-based inversion is stronger than Euclidean-based inversion across datasets and overlaps (Hahn et al., 5 May 2026). This sharper attacker model reframed the core controversy around PolyProtect irreversibility: theoretical non-invertibility from an underdetermined system does not by itself imply strong practical irreversibility under the matching metric that actually matters.

The same study introduced a key selection algorithm that rejects random subject-specific keys when they remain invertible under a deliberately loose threshold and keeps only key pairs that make inversion fail. At $m-1$6 FMR, random keys yielded ISR from $m-1$7 to $m-1$8 on Multi-PIE, $m-1$9–$$p_2 = c_1 v_{2}^{e_1} + c_2 v_{3}^{e_2} + \cdots + c_m v_{m+1}^{e_m}.$$0 on SOTERIA, and $$p_2 = c_1 v_{2}^{e_1} + c_2 v_{3}^{e_2} + \cdots + c_m v_{m+1}^{e_m}.$$1–$$p_2 = c_1 v_{2}^{e_1} + c_2 v_{3}^{e_2} + \cdots + c_m v_{m+1}^{e_m}.$$2 on iCarB-Face, while key selection reduced those ranges to $$p_2 = c_1 v_{2}^{e_1} + c_2 v_{3}^{e_2} + \cdots + c_m v_{m+1}^{e_m}.$$3–$$p_2 = c_1 v_{2}^{e_1} + c_2 v_{3}^{e_2} + \cdots + c_m v_{m+1}^{e_m}.$$4, $$p_2 = c_1 v_{2}^{e_1} + c_2 v_{3}^{e_2} + \cdots + c_m v_{m+1}^{e_m}.$$5–$$p_2 = c_1 v_{2}^{e_1} + c_2 v_{3}^{e_2} + \cdots + c_m v_{m+1}^{e_m}.$$6, and $$p_2 = c_1 v_{2}^{e_1} + c_2 v_{3}^{e_2} + \cdots + c_m v_{m+1}^{e_m}.$$7–$$p_2 = c_1 v_{2}^{e_1} + c_2 v_{3}^{e_2} + \cdots + c_m v_{m+1}^{e_m}.$$8, respectively (Hahn et al., 5 May 2026). At $$p_2 = c_1 v_{2}^{e_1} + c_2 v_{3}^{e_2} + \cdots + c_m v_{m+1}^{e_m}.$$9 FMR, the effect was described as approximately $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$00 ISR in almost all cases. This came with an accuracy cost: at $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$01 FMR, the FNMR degradation due to key selection was approximately $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$02–$P = [p_1, p_2, \ldots, p_k], \qquad k < n.$03 for Multi-PIE, $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$04–$P = [p_1, p_2, \ldots, p_k], \qquad k < n.$05 for SOTERIA, and $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$06–$P = [p_1, p_2, \ldots, p_k], \qquad k < n.$07 for iCarB-Face (Hahn et al., 5 May 2026). Because key selection approximately equalized irreversibility across overlaps, that work recommended overlap $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$08 as the best balance when combined with key selection and discouraged overlap $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$09 because suitable keys could not be found reliably for all templates.

A separate practical issue identified in the same paper is sensitivity to embedding range. EdgeFace embeddings lay roughly in $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$10, whereas iResNet100 embeddings lay roughly in $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$11; after PolyProtect, the corresponding protected values expanded to around $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$12 and about $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$13, respectively. This amplified intra-class variance in the protected domain and hurt recognition for unnormalized iResNet100 embeddings. Normalizing embeddings before applying PolyProtect substantially improved stability; for example, Multi-PIE at overlap $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$14 dropped from $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$15 FNMR unnormalized to $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$16 normalized at $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$17 FMR (Hahn et al., 5 May 2026).

5. PolyProtect in encrypted face-analytics pipelines

In later face-analytics work, PolyProtect was used not as a stand-alone defense but as the final template-protection layer in a larger encrypted pipeline. The workflow is explicitly: a face image is passed through a pretrained face-recognition model such as FaceNet or AdaFace to obtain a 512-dimensional embedding; the embedding is optionally compressed using Matryoshka Representation Learning down to 64 dimensions in the main setup; the compressed embedding is then encrypted using FHE with HEAAN/CKKS; PolyProtect and other required operations are applied in the encrypted domain; and the resulting PolyProtected template is used for identification or soft-biometric prediction, with outputs returned in encrypted form to the user (Yalavarthi et al., 2024). In that design, PolyProtect is deliberately placed after encryption so that the template is never exposed in plaintext during processing.

This layering addressed a concrete limitation of PolyProtect alone: preservation of recognition does not imply suppression of soft-biometric leakage. On FaceNet/CelebSet, identification accuracy without protection was $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$18; with PolyProtect, it remained $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$19, while gender, age, and ethnicity accuracies were still $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$20, $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$21, and $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$22, respectively. On FaceNet/BFW, identification accuracy was $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$23 with no protection and $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$24 with PolyProtect, while soft-biometric accuracies remained $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$25 for gender, $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$26 for age, and $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$27 for ethnicity. Comparable behavior was reported with AdaFace: on CelebSet, identification changed from $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$28 to $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$29 under PolyProtect, while gender, age, and ethnicity accuracies remained $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$30, $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$31, and $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$32; on BFW, identification changed from $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$33 to $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$34, while gender, age, and ethnicity accuracies were $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$35, $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$36, and $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$37 (Yalavarthi et al., 2024).

The same study reported that the full MRL + PolyProtect + FHE pipeline reduced soft-biometric prediction to approximately random-guess level while keeping identification accuracy close to the unprotected baseline. For FaceNet/CelebSet, identification remained $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$38, while gender accuracy dropped to $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$39, age to $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$40, and ethnicity to $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$41 (Yalavarthi et al., 2024). A common misconception is therefore that PolyProtect by itself hides all salient private information in the embedding; the data show a narrower claim. PolyProtect alone preserves recognition accuracy well and adds irreversibility and unlinkability at the template level, but suppression of soft-biometric leakage in this line of work depended primarily on the FHE-based encrypted-processing layer.

6. Identification, humanitarian deployment, and fingerprint extension

PolyProtect was later selected for a mobile biometric system designed for humanitarian and emergency settings. That study formulated functional, operational, and security/privacy requirements, including recognition accuracy, modality-independence, feature extractor-independence, on-device recognition, easy new enrolment, template revocability and renewability, computational efficiency, time efficiency, offline processing, irreversibility, and unlinkability. After comparing biometric template protection families, it identified PolyProtect as the most suitable method because of its effectiveness, modularity, and lightweight computational burden (Stragapede et al., 25 Aug 2025).

The face experiments used EdgeFace, specifically the XS version with $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$42M parameters ($P = [p_1, p_2, \ldots, p_k], \qquad k < n.$43 MB), producing 512-dimensional embeddings and cosine-distance matching. The face dataset was a real-world humanitarian field dataset from Ethiopia with $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$44 subjects and $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$45 captures per subject. The fingerprint experiments used a pretrained fixed-length deep learning extractor based on DeepPrint and an internal humanitarian field dataset from Ghana with $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$46 subjects and $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$47 samples per subject (Stragapede et al., 25 Aug 2025). This work explicitly presented itself as the first evaluation of PolyProtect for the identification scenario and for fingerprint biometrics.

For face verification, baseline performance was TMR@FMR=$P = [p_1, p_2, \ldots, p_k], \qquad k < n.$48 of $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$49, TMR@FMR=$P = [p_1, p_2, \ldots, p_k], \qquad k < n.$50 of $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$51, and EER of $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$52. With PolyProtect in the Normal scenario, the best TMR@$P = [p_1, p_2, \ldots, p_k], \qquad k < n.$53 was $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$54 at $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$55, the best TMR@$P = [p_1, p_2, \ldots, p_k], \qquad k < n.$56 was $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$57 at $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$58, and the best EER was $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$59 at $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$60. In the SCE scenario, performance was lower, but still substantial at $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$61: TMR@$P = [p_1, p_2, \ldots, p_k], \qquad k < n.$62 of $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$63, TMR@$P = [p_1, p_2, \ldots, p_k], \qquad k < n.$64 of $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$65, and EER of $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$66 (Stragapede et al., 25 Aug 2025). For face identification, baseline TPIR-1, TPIR-3, and TPIR-10 were $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$67, $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$68, and $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$69; with PolyProtect, $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$70 yielded $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$71, $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$72, and $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$73, while $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$74 yielded $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$75, $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$76, and $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$77 (Stragapede et al., 25 Aug 2025).

The fingerprint results were more variable but operationally important. Baseline fingerprint EER was $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$78, while PolyProtect in the Normal scenario reduced EER to $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$79 at $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$80, with values remaining around $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$81–$P = [p_1, p_2, \ldots, p_k], \qquad k < n.$82 for other overlaps. In the SCE scenario, fingerprint EER stayed around $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$83, similar to baseline (Stragapede et al., 25 Aug 2025). Irreversibility again showed the familiar overlap trade-off: for face, ISR for single-template inversion was $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$84 for $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$85 at both low operating points, $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$86 at $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$87 FMR and $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$88 at $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$89 FMR for $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$90, $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$91 and $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$92 for $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$93, and $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$94 at both thresholds for $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$95. Unlinkability improved sharply relative to unprotected systems: face baseline $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$96 fell to about $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$97–$P = [p_1, p_2, \ldots, p_k], \qquad k < n.$98 with naive selection and about $P = [p_1, p_2, \ldots, p_k], \qquad k < n.$99–$m$00 with strict selection; fingerprint baseline $m$01 fell to about $m$02–$m$03 with naive selection and about $m$04–$m$05 with strict selection (Stragapede et al., 25 Aug 2025).

Taken together, these studies position PolyProtect as a modular template-transformation mechanism rather than a complete privacy stack. Its durable contributions are the use of subject-specific polynomial mappings for protected-template generation, an empirically tunable trade-off between recognition and irreversibility through overlap and key choice, and strong unlinkability when parameter selection is handled carefully. Its main limitations are equally consistent across the literature: larger overlap improves recognition but weakens irreversibility, multiple protected versions of the same biometric can raise reconstruction risk, embedding range affects protected-domain behavior, and PolyProtect alone does not adequately suppress soft-biometric leakage in face analytics (Hahn et al., 2021, Hahn et al., 5 May 2026, Yalavarthi et al., 2024, Stragapede et al., 25 Aug 2025).