Binding Biometrics with AI Agent Identifiers for Delegation of Authority

\n\nJoseph Geo Benjamin\n\n \nAnil K. Jain\n\n \nKarthik Nandakumar\n\nAffiliation: Michigan State University, MI, USA\n\nAffiliation: {benja161, jain, nandakum}@msu.edu\n

\n\n

Abstract

\n \n

The proliferation of agentic artificial intelligence (AI) systems has raised serious questions about the accountability for tasks performed by AI agents. Ideally, an AI agent must not be allowed to perform critical tasks without explicit authorization by a human operator. Since biometric recognition is one of the most reliable approaches for authenticating individuals, it has the potential to enable authenticated delegation of authority to AI agents. In this work, we present a framework called BIND, which leverages ideas from the field of biometric cryptosystems, to securely bind biometric data of the human user to the AI agent identity (ID) and authority scope (task-specific constraints) at the time of agent authorization. This token/identifier can be presented by the AI agent to an Identity Auditor, who simultaneously performs biometric authentication and recovers the agent ID and scope, thereby enabling real-time user authentication and establishing a non-repudiable proof of human control and delegation of authority. We also provide a practical implementation of the proposed BIND framework based on face features extracted using standard deep neural network models. To facilitate this implementation, we propose a feature adaptation module that transforms real-valued feature embeddings into fixed-length binary representations suitable for a fuzzy commitment construct based on turbo error correcting codes. Experiments demonstrate the practical feasibility of the proposed face cryptosystem, achieving a True Match Rate of $96\\%$ at zero False Match Rate and supporting $1024$ -bit agent tokens.

\n \n

1 Introduction

\n\n

Smart cities are propelled by Internet of Things (IoT) and these connected devices are now being increasingly controlled by Large Language Model (LLM)-powered AI agents [44]. For instance, AI agents can optimize building energy systems [35] through live sensor streams and API-based tool invocation, and orchestrate real-time power grid operations across urban electrical infrastructure [24]. Agentic AI refers to autonomous systems capable of acting on behalf of humans [13]. While traditional software systems execute deterministic logic and predefined routines, agentic AI systems often exhibit adaptive and non-deterministic behavior, making decisions based on evolving context and goals [54]. Recent advancements such as the Model Context Protocol (MCP) [37] have enabled AI agents to invoke tools, access resources, and act in real-world systems on behalf of humans.\nMoreover, emerging protocols like Agent2Agent (A2A) [5] enable agents to collaborate, delegate sub-tasks, and form multi-step command chains within and across organizational boundaries.

This growing adoption of agentic AI in smart city applications introduces many fundamental challenges. One of them is the need to maintain persistent and verifiable authorization by a human operator across delegated tasks carried out by AI agents [47]. This is critical to prevent rogue agents or individuals from acting maliciously and disrupting autonomous smart city ecosystems. This is also necessary for accountability, trust, and regulatory enforcement by linking agent actions to real-world entities that can be subject to existing legal frameworks [9]. A recent technical report from the OpenID Foundation [48] highlights that existing identity frameworks are only suitable for relatively static single-entity interactions and cannot meet the emerging needs of agentic AI ecosystems. In particular, better strategies are required for delegation of authority, identity propagation, and multi-agent coordination.

\"Refer — Figure 1: The flow diagram shows a user delegating a task to a primary agent, which decomposes the task into subtasks and generates task-specific Scope and Agent IDs. These identifiers are bound to the user’s biometric credentials and delegated to the corresponding sub-agents for their respective subtasks. Each sub-agent requests authorization from the TSP, which forwards the delegation token to the ISP for biometric de-binding and verification. Upon successful token recovery, the token is returned to the TSP, which validates the delegation and authorizes the requested action.

Modern identity frameworks typically isolate authentication and authorization functions. Identity authentication protocols like OpenID Connect (OIDC) [7] establish user identity, while authorization frameworks like OAuth [19] enable delegated authorization through scoped access tokens, supporting “on-behalf-of” workflows.\nExisting mechanisms for controlled token transformation in delegated systems, such as OAuth 2.0 Token Exchange [27], provide a foundation for managing authorization across agent boundaries through token exchange, scope reduction, audience restriction, and limited token lifetimes. However, as delegation propagates across chains of tools and agents, alignment between individual actions and the authorizer’s original intent becomes increasingly difficult to verify, since conventional token-based mechanisms only encode what a token permits and fails to capture which agent may act, when, or under what task context [47]. Thus, agentic AI systems are exposed to issues like privilege escalation, confused deputy attacks, and unintended cross-boundary data disclosure because access trust is transitively extended across agents[23].

Emerging frameworks such as Delegation Capability Tokens [50] and IETF OAuth Identity Chaining [45] extend the above foundations to enable structured, cryptographically verifiable authority transfer which can be used for multi-agent orchestration.\nAgent communication protocols such as MCP [37] and A2A [5] are also progressively standardizing authentication and delegation mechanisms to address operational gaps across trust boundaries. For instance, in multi-agent workflows, OAuth access tokens may be forwarded between agents beyond the delegation boundary originally authorized by the user, particularly in asynchronous pipelines. However, the core problem is that no human-agent binding mechanism is enforced at the time of token issuance [47]. As authority transfers between agents, the link between actions, agents, and the authorizer weakens, making it unclear whether the user, orchestrator, or sub-agent bears responsibility for a given outcome [49]. Hence, there is an urgent need to address the issue of who remains accountable as delegation propagates. Thus, Identity Binding [9] can be characterized as: “Anchoring every delegated action to the originating human identity across all hops in the delegation chain to ensure accountability.”

Biometric recognition has long been used as a verifiable, non-repudiable mechanism for establishing user identity [11, 21]. While tokens or credentials generated by digital systems are inherently transferable and replayable, biometric signals are intrinsically bound to the human and can provide higher assurance of liveness and human presence. In this work, we leverage biometrics not only for user identity verification, but also as a mechanism for identity binding between humans and AI agents. Whenever the human operator delegates a new task to an agent or sub-agent, the agent/sub-agent ID and the task scope are encoded in the form of an Agent Token, which is “cryptographically” bound to the biometric data of the user to generate a Delegation Token. At the time of task execution, the agent presents the delegation token to an Identity Auditor, who validates this token based on the enrolled biometric template of the user to retrieve the agent token, thereby providing a non-repudiable mechanism for both user authentication and agent authorization. This ensures that agent actions remain verifiably linked to the originating human, while also making the information encoded within the agent token resistant to tampering. This proposed framework is henceforth referred to as Biometrics-based Identifiers for Non-repudiable Delegation of Authority (BIND).

We also propose a practical instantiation of the BIND framework based on face biometric modality. Towards this end, we develop a novel feature adaptation module that transforms real-valued face embeddings generated using existing deep neural network models into arbitrary-length binary representations through order-statistic quantization. The feature adaptation step is carefully designed to achieve a reasonable trade-off between preserving discriminability and achieving the desired invariance properties. The resulting binary face representations are securely bound to the agent token using the well-known fuzzy commitment construct, enabled by turbo error correction coding schemes. The main contributions of this work are two-fold:

• \n
\n
We propose a framework called BIND for identity binding between humans and AI agents, which enables simultaneous user authentication and auditable delegation of authority by humans to AI agents.
\n
• \n
\n
We demonstrate the practical feasibility of the BIND framework based on face biometrics by developing a feature adaptation technique that bridges the representation gap between existing deep face embeddings and the well-known fuzzy commitment scheme. The best setting achieves a $96\\%$ TMR at zero-FMR on the CFP-FF dataset and supports agent tokens of size $1024$ bits.
\n

2 Related Works

\n\n

Agentic AI Protocols:\nRecent efforts in agentic AI have led to the development of a suite of open standards and protocols to enable interoperability, tool integration, communication, and identity among autonomous agents. Protocols such as MCP [37] standardize agent access to external tools, APIs, and data sources. In parallel, A2A protocol [5] facilitates peer-to-peer communication, capability discovery, and task delegation among agentic AI systems. The Agent Communication Protocol (ACP) [2] focuses on structured messaging between agents using REST/HTTP-based communication and multimodal support. The Agent Network Protocol (ANP) [4] provides network standards for decentralized discovery and collaboration, while the Open Agent Specification (Agent Spec) [39] addresses consistent capability and metadata definitions.\nHuman-centered interaction is supported by the Agent-to-Human Protocol (A2H) [33] and Agent-to-UI (AG-UI / A2UI) [1] formalizes real-time agent–user engagement. The Agent Identity Protocol (AIP)[3] is an emerging standard for agent identity and trust, providing verifiable identities, authentication, and policy enforcement. By enabling cryptographic identities, signed actions, and fine-grained authorization, it mitigates security risks from unconstrained agent behavior. Collectively, these protocols form a layered interoperability stack for agentic AI ecosystems [14]. However, the problem of secure delegation of authority by humans to agents has not been addressed in any of these existing protocols.

Biometric Cryptosystems:\nBiometric template protection (BTP) refers to techniques that secure stored biometric representations against identity leakage and reconstruction attacks [22].\nIt is broadly achieved through two complementary approaches: cancelable biometrics, which relies on non-invertible transformations applied to raw templates, and biometric cryptosystems, which use cryptographic binding or key generation to protect biometric data [43].\nSchemes such as fuzzy commitment [29] and fuzzy vault [28] bind a cryptographic key to biometric data, allowing key recovery only when a sufficiently similar biometric is presented without exposing the underlying template. Several practical implementations of these constructs based on different biometric modalities have been proposed in the literature [40, 18, 51, 26]. Cancelable biometrics is also a key paradigm for template protection, designed to satisfy irreversibility, revocability, unlinkability, and performance preservation. Early approaches focused on transforming biometric features using mathematical mechanisms to prevent direct reconstruction [41, 16, 42, 36]. More recent methods rely on deep learning [32] and generative AI models [15, 52] to achieve similar goals. To the best of our knowledge, the application of biometrics for human control of AI agents has not been explored well in the literature.

3 BIND Framework

\n\n

3.1 Problem Formulation

\n\n

Let $\\mathcal{U}=\\{\\mathbf{u}_{1},\\mathbf{u}_{2},\\cdots,\\mathbf{u}_{N}\\}$ be the set of humans interacting with AI agents $\\mathcal{A}=\\{\\mathbf{a}_{1},\\mathbf{a}_{2},\\cdots,\\mathbf{a}_{M}\\}$ in an organization/system environment. Here, $\\mathbf{u}_{n}$ represents the user ID, $\\mathbf{a}_{m}$ denotes the agent ID, $N$ is the total number of users, and $M$ is the total number of agents. We assume that each human is enrolled with an identity service provider (ISP) based on their biometric traits. Let $\\mathbf{b}_{n}$ represent the biometric template of user $\\mathbf{u}_{n}$ stored in the ISP database. The agents in $\\mathcal{A}$ are capable of carrying out various tasks on behalf of users and can interact with tools or resources or even another agent internally or in the external environment. For example, the internal environment may consist of user devices such as laptops or mobile phones, whereas the external environment may correspond to application platforms such as banking systems or travel services.

Let $\\mathbf{s}_{\\ell}$ represent the agent scope for the specified task (including the authority delegated by the user to the agent). In this work, our first goal is to design a binding function $\\Phi$ that can create a secure and verifiable delegation token $\\mathbf{D}_{n,m,\\ell}$ for a specific agent $\\mathbf{a}_{m}$ with defined scope $\\mathbf{s}_{\\ell}$ for future authorization and auditing purposes. This delegation token is obtained by binding freshly acquired biometric data $\\mathbf{\\tilde{b}}_{n}$ from user $\\mathbf{u}_{n}$ with the agent ID and scope as follows:

\n\n\n\n\n\n\n\n

\\displaystyle\\mathbf{D}_{n,m,\\ell}:=\\Phi(\\mathbf{\\tilde{b}}_{n},\\mathbf{a}_{m},\\mathbf{s}_{\\ell})

(1)

In our formulation, successful authentication and delegation of authority is defined as the correct recovery of the agent ID and scope from the delegation token using only the corresponding user biometric template as the key. The recovered agent details can be used to establish credentials and issue session tokens within standard OAuth flows [19], but the exact formulation of these later mechanisms is beyond the scope of this work. Let $\\Omega$ denote the de-binding function that can recover the agent ID and scope only upon successful biometric authentication by a valid user. When the authentication fails, the recovery should fail and a garbage value ( $\\perp$ ) must be returned by $\\Omega$ . Thus,

\n\n\n\n\n\n\n\n

\\displaystyle\\Omega(\\mathbf{D}_{n,m,\\ell},\\mathbf{b}_{*}):=\\begin{cases}(\\mathbf{a}_{m},\\mathbf{s}_{\\ell})\\;,&\\text{if }d(\\mathbf{b}_{*},\\mathbf{\\tilde{b}}_{n})\\leq\\eta\\\\\n\\perp,&\\text{otherwise},\\end{cases}

(2)

where $d$ is an appropriate distance metric between two biometric representations and $\\eta$ is the decision threshold. The goal of this work is to design the binding ( $\\Phi$ ) and de-binding ( $\\Omega$ ) functions to satisfy the above requirements as well as withstand various adversarial threats described below.

3.2 Threat Model

\n\n

The generation and lifecycle management of identifiers within AI systems exposes multiple attack surfaces that can be exploited by adversarial actors, including malicious humans and rogue AI agents within the system. Broadly, these threats can be categorized into three types [8, 47].

1. \n
\n
Tampering: An adversary alters the delegation token while it is transmitted from the user to the agent and then to the service provider, potentially de-linking the user-agent identity binding or altering the scope.
\n
2. \n
\n
Identity Spoofing: An adversary fabricates a fraudulent user or agent ID and falsely presents the delegation token as originating from a trusted user or agent, thereby impersonating a valid delegation session or shifting responsibility to another entity.
\n
3. \n
\n
Instance Spoofing: An adversary takes a delegation token issued by a valid user and applies it to a different, unauthorized delegation instance involving a different agent or user, thereby misusing the original delegation.
\n

All these threats will eventually result in repudiation claims and erode the trust in the entire framework. Thus, any identity binding framework must be robust against these threats.

3.3 Proposed Solution

\n\n

In this work, we leverage the fuzzy commitment construct [29, 38] from the biometric template protection (BTP) literature to achieve user-agent identity binding. Fuzzy commitment is typically used for BTP in the following way. The enrolled biometric template is bound to an error correcting codeword (indexed by a secret key) to obtain a secure sketch. During authentication, the secure sketch along with the biometric query is used to recover the codeword, and hence the secret key. The authentication is successful if the secret key can be recovered correctly. Since it is computationally hard to disentangle the template or the codeword from the secure sketch, the template remains protected.

In the proposed identity binding framework, we make two key changes to the fuzzy commitment construct. First, the agent ID and scope are encoded in the form of an Agent Token, which acts as the secret key that must be protected. Second, rather than using the secure sketch to protect the biometric template, we generate the secure sketch by binding the codeword indexed by the agent token with the biometric query. This secure sketch acts as the Delegation Token provided by the human to the AI agent. The biometric template is stored in the ISP database in plaintext form. If template protection is also desired, other BTP approaches, such as cancelable biometrics, can be applied to secure the enrolled biometric template. During execution of the task by an agent, the agent presents the delegation token to the ISP. The ISP uses the biometric template in conjunction with the delegation token (secure sketch) to recover the agent token. Successful recovery of the agent token signifies both successful authentication of the user and delegation of authority by the user to the agent.

Now, We illustrate the proposed identity binding framework through a simple workflow.\nSuppose that user $\\mathbf{u}_{n}$ wants to assign a task to agent $\\mathbf{a}_{m}$ in the system. The agent interprets the assigned task and scopes out the privileges required to perform the task. This scope is encoded in the form of binary representation $\\mathbf{s}_{\\ell}$ . Note that $\\mathbf{s}_{\\ell}$ may include time limits or access rights required for executing the assigned task as well as other auxiliary information (e.g., one-time pads to ensure token liveliness, etc.)[8] and the details of this scope encoding process are beyond our scope. The agent ID $\\mathbf{a}_{m}$ and scope encoding $\\mathbf{s}_{\\ell}$ are presented to the user, who generates the agent token $\\mathbf{A}_{m,\\ell}$ as follows:

\n\n\n\n\n\n\n\n

\\mathbf{A}_{m,\\ell}=\\mathtt{{FEC}_{enc}}\\left(\\mathcal{E}_{\\kappa_{\\mathrm{TSP}}}\\left([\\mathbf{a}_{m}||\\>\\mathbf{s}_{\\ell}]\\right)\\right),

(3)

where $\\mathtt{{FEC}_{enc}}$ is the encoder module of a forward error correction (FEC) scheme that generates a valid codeword indexed by its input $x$ , $\\mathcal{E}$ is the encryption function of a public key cryptosystem, $\\kappa_{\\mathrm{TSP}}$ is the public key of a token service provider (TSP) such as OAuth, and $||$ denotes the concatenation operation. Next, a fresh biometric sample is acquired from the user $\\mathbf{u}_{n}$ and the extracted features $\\mathbf{\\tilde{b}}_{n}$ are used to generate the secure sketch as:

\n\n\n\n\n\n\n\n

\\mathbf{S}_{n,m,\\ell}=\\mathbf{\\tilde{b}}_{n}\\oplus\\mathbf{A}_{m,\\ell}

(4)

where $\\oplus$ denotes the exclusive-OR operation. Finally, the delegation token is obtained as:

\n\n\n\n\n\n\n\n

\\mathbf{D}_{n,m,\\ell}=\\Phi(\\mathbf{\\tilde{b}}_{n},\\mathbf{a}_{m},\\mathbf{s}_{\\ell}):=\\left[\\mathbf{S}_{n,m,\\ell}||\\>\\mathcal{E}_{\\kappa_{\\mathrm{ISP}}}(\\mathbf{u_{n}})\\>||\\>\\mathbf{H}_{m,\\ell}\\right],

(5)

where $\\kappa_{\\mathrm{ISP}}$ is the public key of the ISP and $\\mathbf{H}_{m,\\ell}$ is the cryptographic hash of the input to the FEC encoder, generated by $\\mathcal{H}$ . The delegation token is provided to the agent $\\mathbf{a}_{m}$ for task execution. For a complex task that requires multiple agents to work together, the primary (planner) agent can request agent/task-specific delegation tokens from the user and all these delegation tokens can be created together. For adaptive scenarios where tasks are assigned to sub-agents on the fly, sub-agents must revert back multiple times to the user for delegation of authority. Although this could be a limitation, this inefficiency can be mitigated by requiring explicit delegation by the user only for critical tasks.

During task execution, the agent $\\mathbf{a}_{m}$ presents the delegation token to the ISP, who decrypts the user identity $\\mathbf{u}_{n}$ with function $\\mathcal{D}$ using its private key ${\\kappa^{\\mathrm{pri}}_{\\mathrm{ISP}}}$ and retrieves the stored biometric template $\\mathbf{b}_{n}$ corresponding to the user ID. The ISP performs authentication as follows:

\n\n\n\n\n\n\n\n

\\Omega(\\mathbf{D}_{n,m,\\ell},\\mathbf{b}_{n}):=\\mathtt{{FEC}_{dec}}\\left(\\mathbf{b}_{n}\\oplus\\mathbf{S}_{n,m,\\ell}\\right),

(6)

where $\\mathtt{{FEC}_{dec}}$ is the corresponding decoder module of the FEC scheme. The above error correction decoding will be successful if and only if $\\mathbf{b}_{n}$ and $\\mathbf{\\tilde{b}}_{n}$ are sufficiently close, i.e., Hamming distance between the template and query binary biometric representations is less than the error correction capability of the selected FEC scheme. In this case, the correct value of $\\mathcal{E}_{\\kappa_{\\mathrm{TSP}}}\\left([\\mathbf{a}_{m}||\\>\\mathbf{s}_{\\ell}]\\right)$ will be recovered, which can be verified by computing its hash and comparing with $\\mathbf{H}_{m,\\ell}$ . If the authentication is successful, the ISP logs the user ID $\\mathbf{u}_{n}$ along with $\\mathbf{H}_{m,\\ell}$ to facilitate future audits. Thus, the ISP also plays the role of an identity auditor.

The ISP forwards the value of $\\mathcal{E}_{\\kappa_{\\mathrm{TSP}}}\\left([\\mathbf{a}_{m}||\\>\\mathbf{s}_{\\ell}]\\right)$ to the TSP, which decrypts this information with decryption function $\\mathcal{D}$ using the key ${\\kappa^{\\mathrm{pri}}_{\\mathrm{TSP}}}$ to obtain the agent ID and scope in plaintext form and issues the appropriate session credentials to the agent to execute the task. Furthermore, the TSP logs the agent ID and scope for future audits. Thus, any action taken by AI agents can be traced by the TSP to the specific agent ID, which in turn can link back to the ISP to determine the human who authorized the action. In summary, the proposed framework enables the creation of a biometric identifier for non-repudiable delegation of authority by humans to AI agents.

4 Face-based Implementation of BIND

\n\n

We now present a practical implementation of the BIND framework based on the face biometric modality. Specifically, we employ Turbo codes as the FEC scheme for fuzzy commitment. To meet the invariance requirements of the Turbo code instantiation used in this work, we propose a feature adaptation technique that transforms face embeddings generated from well-known deep neural network models into binary representations of arbitrary length.

4.1 Error Correction Codes

\n\n

Let $\\mathbf{x}\\in\\{0,1\\}^{k}$ denote an message sequence of length $k$ bits. Forward error correction codes systematically append redundant parity bits to the original message, thereby encoding the source sequence into a higher-dimensional codeword space. The resulting redundancy enables a decoder to reconstruct the original message $\\mathbf{x}$ even from a noisy codeword. A standard Turbo Code [6] consists of two parallel-concatenated recursive systematic convolutional encoders coupled through a pseudo-random interleaver. The output codeword length is $r=3k$ for rate $=1/3$ and $r=2k$ for rate $=1/2$ . Then, the codeword $\\mathbf{c}$ is given by:

\n\n\n\n\n\n\n\n

\\mathbf{c}=\\mathtt{TC_{enc}}\\left(\\mathbf{x}\\right)\\quad\\text{where}\\quad\\mathbf{c}\\in\\{0,1\\}^{r}

(7)

Let $\\mathbf{y}$ denote the received noisy vector obtained from the codeword $\\mathbf{c}$ after a stochastic process. This process is typically modeled as signal transmission with additive noise $\\mathbf{e}$ introduced onto $\\mathbf{c}$ such that $\\mathbf{y}=\\mathbf{c}\\,\\oplus\\,\\mathbf{e}$ . However, in our setting, $\\mathbf{e}$ captures intra-user biometric variability. Specifically, it denotes bit-level discrepancies between enrolled biometric template and the query biometric features introduced during the secure sketch recovery process.

The Turbo decoder $\\mathtt{TC_{dec}}(\\cdot)$ performs iterative decoding using two soft-input/soft-output decoders connected via the interleaver. The recovered codeword is obtained as:

\n\n\n\n\n\n\n\n

\\mathbf{\\hat{x}}=\\mathtt{TC_{dec}}(\\mathbf{y}),

(8)

where $\\mathbf{y}$ denotes the corrupted codeword. In this work, we use the off-the-shelf Turbo Code provided by NVIDIA’s Sionna library¹¹\n 1\n \n \n \n https://github.com/NVlabs/sionna for error correction coding [20]. A given Turbo code can only correct up to $\\tau\\%$ of bit errors, which is the operating characteristic specific to the code design. Moreover, $\\tau$ is a function of the code rate, and lower rates allow for larger $\\tau$ . Thus, the bit errors caused due to biometric intra-user variability must lie within the $\\tau$ bound.

4.2 Face Feature Adaptation

\n\n

Let $\\mathbf{f}_{n}\\in\\mathbb{R}^{D}$ be a face feature vector (embedding) extracted from a face image of user $\\mathbf{u}_{n}$ using an existing deep neural network model $\\mathcal{F}$ [12]. Typically, these face embeddings are real-valued $D$ -dimensional vectors, and the similarity between two face embeddings is computed based on cosine similarity. In order to ensure compatibility with the fuzzy commitment construct, these face embeddings must be converted into binary representations of length $r$ bits, where $r$ is determined by the selected FEC scheme.\nMoreover, the proportion of bit errors between representations extracted from two biometric samples belonging to the same user must be less than $\\tau$ . In contrast, the bit error rate for representations coming from different users must be greater than $\\tau$ . Thus, there is a need for feature adaptation techniques $\\mathcal{B}:\\mathbb{R}^{D}\\rightarrow\\{0,1\\}^{r}$ that transform $\\mathbf{f}_{n}$ to $\\mathbf{b}_{n}$ , where $\\mathbf{b}_{n}=\\mathcal{B}(\\mathbf{f}_{n})$ , while satisfying the above constraints.

Figure 2: Effect of each step in the Feature Adaptation and Binarization pipeline. Each row shows the resulting distribution shift. The first column shows genuine and impostor scores, and the second shows the ROC curve (log scale). Results indicate that discriminability is preserved without performance degradation.

\n\n

We introduce the following feature adaptation method that reduces biometric variability (lowering the bit error rate) while preserving the separability between genuine and impostor pairs. Feature adaptation involves three steps:

1. \n
\n
Gaussian Dithering: Superimposes a scaled standard Gaussian random vector onto biometric embeddings. This reduces the effective Hamming distance between biometric templates used for secure sketch, thereby brings the intra-user biometric variability under the error correction capability of the FEC scheme.
\n
2. \n
\n
Gaussian Random Projection: Projects the signal into a higher-dimensional isotropic space of $B$ -dimension. In addition to increasing the template dimensionality from $D$ to any arbitrary $B$ , this approach also improves invertibility hardness, as studied in IoM-hashing [25].
\n
3. \n
\n
WTA-Hash Binarization: Applies a non-linear, rank-based binarization that improves separation between genuine and impostor distributions by enhancing quantization stability under small perturbations. The non-linear nature of the transformation further increases resistance to inversion attacks.
\n

Assumption 1.

The biometric feature vectors $\\mathbf{f}_{n}$ are assumed to follow a Gaussian distribution with zero mean and covariance $\\sigma_{f}^{2}\\mathbf{I}$ , where $\\sigma_{f}^{2}$ depends on the feature extractor $\\mathcal{F}$ , i.e. $\\mathbf{f}_{n}\\sim\\mathcal{N}(\\mathbf{0},\\sigma_{f}^{2}\\mathbf{I})$

We preprocess feature vectors by unit-normalizing and scaling them by $\\sqrt{D}$ . Since unit-norm vectors have variance of approximately $1/D$ , this produces approximately unit-variance features for subsequent analysis.\nThe feature transformation involves a user-specific Transformation Key $\\mathbf{K}_{n}=\\{\\mathbf{W}_{n},\\mathbf{g}_{n},\\Pi_{n}^{[1]},\\Pi_{n}^{[2]}\\}$ .\nThis transformation key acts as the second factor of authentication, which typically needs to be stored by the user and must be presented during authentication. Moreover, this key $\\mathbf{K}_{n}$ provides cancelability to the enrolled biometric template.\nThe overall transformation process can be represented by the following function:

\n\n\n\n\n\n\n\n

\\mathbf{b}_{n}=\\xi(\\mathbf{\\widehat{f}}_{n},\\mathbf{K}_{n}),\\quad\\text{where}\\quad\\mathbf{\\widehat{f}}_{n}=\\frac{\\mathbf{f}_{n}}{\\|\\mathbf{f}_{n}\\|}\\cdot\\sqrt{D}

(9)

Feature transformation process $\\xi$ first projects the perturbed biometric feature into an intermediate representation as follows:

\n\n\n\n\n\n\n\n

\\mathbf{q}_{n}=\\mathbf{W}_{n}\\left(\\mathbf{\\widehat{f}}_{n}+\\lambda\\mathbf{g}_{n}\\right),

(10)

where $\\mathbf{g}_{n}\\in\\mathbb{R}^{D}$ denotes a Gaussian dithering vector, $\\mathbf{W}_{n}\\in\\mathbb{R}^{2\\times r\\times D}$ is a Gaussian random projection matrix, and $\\mathbf{q}_{n}\\in\\mathbb{R}^{2\\times r}$ is the intermediate representation. The intermediate representation is intentionally generated at twice the target template length, as required by the subsequent WTA-hashing operation. Next, the WTA-hashing is applied to the projected features. Independent random permutations are first applied to the two projection sets, after which the corresponding elements are compared to generate the final $r$ -bit binary template $\\mathbf{b}_{n}$ :

\n\n\n\n\n\n\n\n

\\mathbf{b}_{n}=\\mathbbm{1}\\!\\left[\\Pi_{n}^{[1]}(\\mathbf{q}_{n}^{[1]})<\\Pi_{n}^{[2]}(\\mathbf{q}_{n}^{[2]})\\right],

(11)

where $\\mathbbm{1}[\\cdot]$ is the indicator function applied element-wise. Here, $\\Pi_{n}^{[1]}$ and $\\Pi_{n}^{[2]}$ denote two independently sampled permutations over the index set $\\{1,\\cdots,r\\}$ . The permutations randomize the ordering of the projected coefficients prior to comparison, thereby introducing additional randomness into the generated binary template.

4.3 Determining the Optimal Dithering Factor $\\big(\\lambda\\big)$

\n\n

During feature transformation, the Gaussian dithering step can shift the similarity in the real-valued biometric representation $\\mathbf{f}$ such that the final template error is bounded within $\\tau$ . The amount of shift in $\\mathbf{f}$ can be controlled by the $\\lambda$ value. For a chosen operating threshold $\\psi$ derived from the genuine–impostor distribution of $\\mathbf{f}$ , the corresponding selection of $\\lambda$ based on $\\tau$ can be formulated by chaining the similarity shifts introduced at each step of the feature adaptation process. This allows the derivation of a single expression that relates $\\lambda$ to $\\tau$ under the constraint imposed by the operating threshold $\\psi$ .

Proposition 1 (Effect of Gaussian Dithering).

Let $\\mathbf{x},\\mathbf{y}\\sim\\mathcal{N}(\\mathbf{0},\\mathbf{I}_{D})$ be two high-dimensional vectors with cosine similarity $\\psi$ . Let $\\mathbf{g}\\sim\\mathcal{N}(\\mathbf{0},\\mathbf{I}_{D})$ be a random noise vector independent of both $\\mathbf{x}$ and $\\mathbf{y}$ . Consider the perturbed vectors\n $\\mathbf{x}^{\\prime}=\\mathbf{x}+\\lambda\\mathbf{g},\\quad\\mathbf{y}^{\\prime}=\\mathbf{y}+\\lambda\\mathbf{g}$ .\nThen, for sufficiently large $D$ , the cosine similarity $\\psi^{g}$ between $\\mathbf{x}^{\\prime}$ and $\\mathbf{y}^{\\prime}$ satisfies:

\n\n\n\n\n\n\n

\\psi^{g}\\approx\\frac{\\psi+\\lambda^{2}}{1+\\lambda^{2}}.

Proposition 2 (Effect of Gaussian Random Projection).

Let $\\mathbf{x},\\mathbf{y}\\sim\\mathcal{N}(\\mathbf{0},\\mathbf{I}_{D})$ be two high-dimensional vectors with cosine similarity $\\psi^{g}$ . Let $\\mathbf{W}\\in\\mathbb{R}^{r\\times D}$ be a random projection matrix independent of both $\\mathbf{x}$ and $\\mathbf{y}$ , where each entry satisfies $\\mathbf{W}^{[i,j]}\\sim\\mathcal{N}(0,1)$ . Consider the projected vectors\n $\\mathbf{x}^{\\prime}=\\mathbf{Wx},\\quad\\mathbf{y}^{\\prime}=\\mathbf{Wy}$ .\nThen, for sufficiently large $D$ and $r$ , the cosine similarity $\\psi^{p}$ between $\\mathbf{x}^{\\prime}$ and $\\mathbf{y}^{\\prime}$ satisfies:

\n\n\n\n\n\n\n

\\psi^{p}\\approx\\psi^{g}.

Proposition 3 (Effect of Pairwise WTA-Hashing).

Let $\\mathbf{x},\\mathbf{y}$ be two high-dimensional vectors that are jointly Gaussian with i.i.d. coordinate pairs having correlation $\\psi^{p}$ , i.e. $(\\mathbf{x}^{[k]},\\mathbf{y}^{[k]})\\sim\\mathcal{N}(0,\\Sigma)$ , and $\\mathtt{corr}(\\mathbf{x}^{[k]},\\mathbf{y}^{[k]})=\\psi^{p}$ .\nSo, their cosine similarity converges to $\\psi^{p}$ as $m$ becomes large.

Let $\\Pi_{1},\\Pi_{2}$ denote random perturbation operators acting on the coordinates of the vectors. Define the binary embeddings\n $\\mathbf{w}=\\Pi_{1}(\\mathbf{x})<\\Pi_{2}(\\mathbf{x})$ and $\\mathbf{v}=\\Pi_{1}(\\mathbf{y})<\\Pi_{2}(\\mathbf{y})$ \nwhere the comparison is applied element-wise to produce binary vectors.\nThen, for sufficiently large $r$ , the Hamming similarity $\\psi^{h}$ between $\\mathbf{w}$ and $\\mathbf{v}$ satisfies

\n\n\n\n\n\n\n

\\psi^{h}\\approx 1-\\frac{\\arccos(\\psi^{p})}{\\pi}.

Proofs of these propositions are provided in the supplementary material, along with the derivation for Eq. 12. For a distribution with operating similarity threshold $\\psi$ using an error-correcting code capable of correcting a fraction $\\tau$ of bit errors, the parameter $\\lambda$ is chosen as follows:

\n\n\n\n\n\n\n\n

\\lambda=\\sqrt{\\frac{\\mathtt{cos}(\\pi\\tau)-\\psi}{1-\\mathtt{cos}(\\pi\\tau)}}.

(12)

Figure 3: Biometric features show intra-user variability, so a fuzzy commitment scheme must tolerate such deviations. This figure demonstrates Turbo Code’s ability to correct random bit-flip errors across two code rates (

1/2

1/3

) and three message lengths (

k

). The error-free decoding threshold remains consistent for a given code rate across different

k

, enabling variable-sized Agent Tokens.

\n\n

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

			CFP-FF	LFW-a	Multi-PIE
		Agent Token Length	1024	2048	4096	1024	2048	4096	1024	2048	4096
			TMR $(\\uparrow)$	FMR $(\\downarrow)$	TMR $(\\uparrow)$	FMR $(\\downarrow)$	TMR $(\\uparrow)$	FMR $(\\downarrow)$	TMR $(\\uparrow)$	FMR $(\\downarrow)$	TMR $(\\uparrow)$	FMR $(\\downarrow)$	TMR $(\\uparrow)$	FMR $(\\downarrow)$	TMR $(\\uparrow)$	FMR $(\\downarrow)$	TMR $(\\uparrow)$	FMR $(\\downarrow)$	TMR $(\\uparrow)$	FMR $(\\downarrow)$
\n\nRate=1/3\n	\n\n $\\tau=14$ \n	IResNet101/Arc	93.40	0.00	89.80	0.00	85.00	0.00	91.31	0.00	87.56	0.00	78.27	0.00	86.35	0.00	83.53	0.00	73.49	0.00
IResNet101/Ada	92.60	0.20	93.40	0.00	83.80	0.00	93.69	0.12	92.32	0.00	85.00	0.00	96.39	0.00	89.56	0.00	85.94	0.00
KPRPE-ViTb/Ada	96.00	0.00	93.20	0.00	84.80	0.00	93.27	0.12	88.39	0.00	84.29	0.00	89.16	0.00	88.35	0.00	75.50	0.00
\n\n $\\tau=15$ \n	IResNet101/Arc	90.00	0.00	81.00	0.00	77.60	0.00	86.49	0.00	80.83	0.00	72.50	0.00	76.71	0.00	76.31	0.00	64.26	0.00
IResNet101/Ada	89.60	0.00	81.40	0.00	75.60	0.00	90.83	0.00	85.83	0.00	78.69	0.00	85.54	0.00	82.73	0.00	70.28	0.00
KPRPE-ViTb/Ada	93.00	0.20	87.60	0.00	80.60	0.00	88.81	0.00	83.99	0.00	75.30	0.00	85.14	0.00	76.31	0.00	66.67	0.00
\n\nRate=1/2\n	\n\n $\\tau=8$ \n	IResNet101/Arc	96.60	3.80	96.60	0.40	94.60	0.00	95.95	2.62	96.07	0.65	94.94	0.06	93.57	2.41	94.38	0.00	93.98	0.00
IResNet101/Ada	96.80	2.00	96.60	0.20	96.80	0.00	96.90	4.35	96.67	0.89	96.55	0.12	97.59	4.42	95.98	0.40	95.58	0.00
KPRPE-ViTb/Ada	96.40	7.80	96.40	1.20	96.40	0.20	96.25	2.14	96.25	0.54	96.13	0.12	96.79	1.20	91.57	0.40	94.38	0.00
\n\n $\\tau=9$ \n	IResNet101/Arc	91.40	0.20	90.40	0.00	89.20	0.00	88.57	0.06	88.69	0.00	86.37	0.00	85.14	0.00	80.32	0.00	80.32	0.00
IResNet101/Ada	92.60	0.20	90.60	0.00	89.60	0.00	93.04	0.36	92.50	0.00	91.85	0.00	90.36	0.00	89.16	0.00	88.35	0.00
KPRPE-ViTb/Ada	92.40	0.60	92.80	0.00	91.00	0.00	90.00	0.06	89.23	0.00	89.70	0.00	83.13	0.00	84.74	0.00	82.73	0.00

Table 1: Performance of the proposed face-based implementation of BIND across three datasets. Agent Token Length (

k

) is measured in bits; the corresponding biometric template length is either

3k

2k

, depending on the coding rate (

1/3

1/2

, respectively). Rows highlighted in green indicate the best TMR-FMR trade-off. Ideally, best setting should achieve an FMR of zero while maximizing TMR.

\n\n

5 Experimental Results

\n\n

5.1 Dataset and Feature Extraction

\n\n

We evaluate the proposed method on three standard facial recognition datasets: LFW-a [53] captures unconstrained variations in pose and illumination; CFP-FF [46] evaluates identity matching under frontal pose; and Multi-PIE [17] provides controlled variations in pose, expression, and illumination.\nFeatures are extracted using three independently trained models. Two models are based on the IResnet101 architecture and use ArcFace [12] and AdaFace [30] as loss functions, while the third model uses a KPRPE-based transformer encoder architecture [31] trained use the AdaFace loss. All models are trained on WebFace4M[55]. Each model produces discriminative face embeddings with a dimensionality of $D=512$ . All pretrained models and preprocessing were obtained from the CVLface library²²\n 2\n \n \n \n https://github.com/mk-minchul/CVLface.\nAll results reported in the paper are based on the worst-case assumption that the transformation key $(\\mathbf{K}_{n})$ of a user is not kept secret (i.e., a stolen key scenario). Hence, $\\mathbf{K}_{n}$ does not provide any additional entropy that could increase the discriminability of the biometric templates.

5.2 Main Results

\n\n

We evaluate the proposed implementation of the BIND framework by varying three key parameters and the results are summarized in Table 1. First, we consider two code rates, namely, the default code rate of $1/3$ and a higher rate of $1/2$ obtained through puncturing. Within each code rate, we consider two values of decoding thresholds $\\tau$ , one ensuring zero recovery $(15\\%,9\\%)$ for rates $(1/3,1/2)$ , respectively, and another allowing partial recovery $(14\\%,8\\%)$ for rates $(1/3,1/2)$ , respectively. These thresholds are identified from Fig. 3. Finally, we consider three message lengths ( $k=1024,2048,4096$ bits) to account for varying sizes of agent tokens ( $r=3k$ and $2k$ for rates $1/3$ and $1/2$ , respectively). The True Match Rate (TMR) and False Match Rate (FMR), expressed as a %, are evaluated for each experimental setting. Some key insights from Table 1 are:

• \n
\n
Since a higher code rate has reduced error correction capability, we need larger $\\lambda$ values to decrease the intra-class variability. While this improves the TMR marginally, the inter-class variability also gets reduced, thereby increasing the FMR significantly. In scenarios where non-repudiation is critical, the configuration with a code rate of $1/3$ and $0$ FMR should be preferred.
\n
• \n
\n
Lowering the decoding threshold $\\tau$ to allow partial recovery results in higher TMR for the same code rate. Although the zero recovery setting yields a lower TMR compared to the partial recovery setting, it ensures that there are no false accepts.
\n
• \n
\n
Increasing the message length ( $k$ ) typically increases the intra-class variability because the entropy of the underlying biometric features remains the same, but the Gaussian transformation introduces more variability. Thus, an increase in message length generally lowers the TMR without significantly affecting the FMR.
\n
• \n
\n
The loss function used to train the feature extraction model has an effect on the discriminability of face feature embeddings. Thus, it can be observed that the ArcFace loss function yields a lower TMR compared to both the AdaFace models.
\n

Overall, the AdaFace-based implementations with a default code rate of $1/3$ and the partial recovery setting for $\\tau$ ( $=14$ ) give the best performance (high TMR with almost $0$ FMR) over all three message lengths as highlighted in Table 1.

5.3 Discussion on Security

\n\n

Since the proposed BIND framework is based on the well-studied fuzzy commitment construct, its security properties directly follow from the characteristics of the underlying error correction scheme [29]. In particular, the computational complexity of reverse engineering the secure sketch depends upon the inherent entropy of the biometric feature representation [34] as well as the properties of Turbo code (especially its code rate and selected error correction threshold).\nThe only modification that we introduce in this work is the feature adaptation step, which imparts some cancelability to the stored biometric template. Given that we do not assume secrecy of the transformation key, the dithering and Gaussian projection steps do not protect against inversion.\nThe non-invertibility of the WTA-hash binarization step has already been studied in [25]. Therefore, we defer a more rigorous security analysis of the proposed framework and its specific implementation to future work.

6 Conclusion

\n\n

In this work, we address the challenge of authorizing AI agents based on biometric signals that provide strong and irrefutable evidence of user presence. We propose a framework called BIND that tightly binds biometric representations with agent identity and task-specific scope encodings, thereby ensuring that delegated actions remain cryptographically and biologically linked to the authorizing user. Through the innovative use of the fuzzy commitment construct and a novel feature adaptation method, we demonstrate that face biometric data can be reliably used for human-agent binding. Our results highlight the importance of balancing robustness and encoding capacity. Overall, this work provides a step towards more secure agentic AI systems, where delegation of authority by humans to AI agents can be reliably established.

Acknowledgment

\n\n

: This work was partially supported by the Office of Naval Research under Grant No. N00014-24-1-2168.

References

\n\n

[1]\n (2026)\n\nA2UI.\n\nNote: https://github.com/google/A2UI\n\nCited by: §2.\n
[2]\n (2025)\n\nAgent Communication Protocol (ACP).\n\nNote: https://github.com/i-am-bee/acp\n\nCited by: §2.\n
[3]\n (2026)\n\nAgent Identity Protocol.\n\nNote: https://github.com/openagentidentityprotocol/agentidentityprotocol\n\nCited by: §2.\n
[4]\n (2025)\n\nAgent Network Protocol (ANP).\n\nNote: https://github.com/agent-network-protocol/AgentNetworkProtocol\n\nCited by: §2.\n
[5]\n (2026)\n\nAgent2Agent (A2A) Protocol.\n\nNote: https://github.com/a2aproject/A2A\n\nCited by: §1,\n§1,\n§2.\n
[6]\nC. Berrou, A. Glavieux, and P. Thitimajshima (1993)\n\nNear shannon limit error-correcting coding and decoding: turbo-codes. 1.\n\nIn Proceedings of ICC’93-IEEE International Conference on Communications,\n\nVol. 2, pp. 1064–1070.\n\nCited by: §4.1.\n
[7]\nK. N. Chadwick and J. Vercammen (2022)\n\nOpenid for verifiable credentials.\n\nOpenID Foundation.\n\nCited by: §1.\n
[8]\nA. Chan, N. Kolt, P. Wills, U. Anwar, C. S. de Witt, N. Rajkumar, L. Hammond, D. Krueger, L. Heim, and M. Anderljung\n\nIDs for ai systems.\n\nIn NeurIPS 2024 Workshop on Regulatable ML,\n\nCited by: §3.2,\n§3.3.\n
[9]\nA. Chan, K. Wei, S. Huang, N. Rajkumar, E. Perrier, S. Lazar, G. K. Hadfield, and M. Anderljung (2025)\n\nInfrastructure for ai agents.\n\narXiv preprint arXiv:2501.10114.\n\nCited by: §1,\n§1.\n
[10]\nM. S. Charikar (2002)\n\nSimilarity estimation techniques from rounding algorithms.\n\nIn Proceedings of the thiry-fourth annual ACM symposium on Theory of computing,\n\npp. 380–388.\n\nCited by: Appendix C.\n
[11]\nR. Clarke (1994)\n\nHuman identification in information systems: management challenges and public policy issues.\n\nInformation Technology & People 7 (4), pp. 6–37.\n\nCited by: §1.\n
[12]\nJ. Deng, J. Guo, N. Xue, and S. Zafeiriou (2019)\n\nArcface: additive angular margin loss for deep face recognition.\n\nIn Proceedings of the IEEE/CVF conference on computer vision and pattern recognition,\n\npp. 4690–4699.\n\nCited by: §4.2,\n§5.1.\n
[13]\nH. Du, S. Thudumu, R. Vasa, and K. Mouzakis (2024)\n\nA survey on context-aware multi-agent systems: techniques, challenges and future directions.\n\narXiv preprint arXiv:2402.01968.\n\nCited by: §1.\n
[14]\nA. Ehtesham, A. Singh, G. K. Gupta, and S. Kumar (2025)\n\nA survey of agent interoperability protocols: model context protocol (mcp), agent communication protocol (acp), agent-to-agent protocol (a2a), and agent network protocol (anp).\n\narXiv preprint arXiv:2505.02279.\n\nCited by: §2.\n
[15]\nM. Ghafourian, J. Fierrez, R. Vera-Rodriguez, A. Morales, and I. Serna (2023)\n\nOTB-morph: one-time biometrics via morphing.\n\nMachine Intelligence Research 20 (6), pp. 855–871.\n\nCited by: §2.\n
[16]\nA. Goh and D. C. Ngo (2003)\n\nComputation of cryptographic keys from face biometrics.\n\nIn IFIP International Conference on Communications and Multimedia Security,\n\npp. 1–13.\n\nCited by: §2.\n
[17]\nG. Gross, R. Nagi, and K. Sambhoos (2010)\n\nSoft information, dirty graphs and uncertainty representation/processing for situation understanding.\n\nIn 2010 13th International Conference on Information Fusion,\n\npp. 1–8.\n\nCited by: §5.1.\n
[18]\nF. Hao, R. Anderson, and J. Daugman (2006)\n\nCombining crypto with biometrics effectively.\n\nIEEE transactions on computers 55 (9), pp. 1081–1088.\n\nCited by: §2.\n
[19]\nD. Hardt (2012)\n\nThe OAuth 2.0 Authorization Framework, RFC 6749.\n\n RFC Editor, IETF.\n\nNote: https://www.rfc-editor.org/info/rfc6749Ed.\n\nExternal Links: Document\n\nCited by: §1,\n§3.1.\n
[20]\nJ. Hoydis, S. Cammerer, F. A. Aoudia, A. Vem, N. Binder, G. Marcus, and A. Keller (2022)\n\nSionna: an open-source library for next-generation physical layer research.\n\narXiv preprint arXiv:2203.11854.\n\nCited by: §4.1.\n
[21]\nA. Jain, R. Bolle, and S. Pankanti (2011)\n\nIntroduction to biometrics.\n\nIn Biometrics: personal identification in networked society,\n\npp. 1–41.\n\nCited by: §1.\n
[22]\nA. K. Jain, A. Ross, and U. Uludag (2005)\n\nBiometric template security: challenges and solutions.\n\nIn 2005 13th European signal processing conference,\n\npp. 1–4.\n\nCited by: §2.\n
[23]\nZ. Ji, D. Wu, W. Jiang, P. Ma, Z. Li, Y. Gao, S. Wang, and Y. Li (2026)\n\nTaming various privilege escalation in llm-based agent systems: a mandatory access control framework.\n\narXiv preprint arXiv:2601.11893.\n\nCited by: §1.\n
[24]\nH. Jin, K. Kim, and J. Kwon (2025)\n\nGridMind: llms-powered agents for power system analysis and operations.\n\nIn Proceedings of the SC’25 Workshops of the International Conference for High Performance Computing, Networking, Storage and Analysis,\n\npp. 560–568.\n\nCited by: §1.\n
[25]\nZ. Jin, J. Y. Hwang, Y. Lai, S. Kim, and A. B. J. Teoh (2017)\n\nRanking-based locality sensitive hashing-enabled cancelable biometrics: index-of-max hashing.\n\nIEEE Transactions on Information Forensics and Security 13 (2), pp. 393–407.\n\nCited by: item 2,\n§5.3.\n
[26]\nZ. Jin, A. B. J. Teoh, B. Goi, and Y. Tay (2016)\n\nBiometric cryptosystems: a new biometric key binding and its implementation for fingerprint minutiae-based representation.\n\nPattern Recognition 56, pp. 50–62.\n\nCited by: §2.\n
[27]\nM. B. Jones, A. Nadalin, and B. Campbell (2020)\n\nOAuth 2.0 Token Exchange, RFC 8693.\n\n RFC Editor, IETF.\n\nNote: https://www.rfc-editor.org/info/rfc8693\n\nExternal Links: Document\n\nCited by: §1.\n
[28]\nA. Juels and M. Sudan (2002)\n\nA fuzzy vault scheme.\n\nIn Proceedings of the IEEE International Symposium on Information Theory,\n\npp. 408.\n\nCited by: §2.\n
[29]\nA. Juels and M. Wattenberg (1999)\n\nA fuzzy commitment scheme.\n\nIn Proceedings of the 6th ACM Conference on Computer and Communications Security,\n\npp. 28–36.\n\nCited by: §2,\n§3.3,\n§5.3.\n
[30]\nM. Kim, A. K. Jain, and X. Liu (2022)\n\nAdaface: quality adaptive margin for face recognition.\n\nIn Proceedings of the IEEE/CVF conference on computer vision and pattern recognition,\n\npp. 18750–18759.\n\nCited by: §5.1.\n
[31]\nM. Kim, Y. Su, F. Liu, A. Jain, and X. Liu (2024)\n\nKeypoint relative position encoding for face recognition.\n\nIn Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition,\n\npp. 244–255.\n\nCited by: §5.1.\n
[32]\nS. Kim, Y. Jeong, J. Kim, J. Kim, H. T. Lee, and J. H. Seo (2021)\n\nIronMask: modular architecture for protecting deep face template.\n\nIn Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition,\n\npp. 16125–16134.\n\nCited by: §2.\n
[33]\nZ. Liang, E. Cui, Q. Wei, R. She, T. Li, M. Guo, and Y. Cheng (2025)\n\nA2H: agent-to-human protocol for ai agent.\n\narXiv preprint arXiv:2602.15831.\n\nCited by: §2.\n
[34]\nM. Lim and P. C. Yuen (2015)\n\nEntropy measurement for biometric verification systems.\n\nIEEE transactions on cybernetics 46 (5), pp. 1065–1077.\n\nCited by: §5.3.\n
[35]\nR. Ly, A. Shojaei, and X. Gao (2025)\n\nSmart building operations and virtual assistants using llm.\n\nIn Proceedings of the 33rd ACM International Conference on the Foundations of Software Engineering,\n\npp. 1683–1689.\n\nCited by: §1.\n
[36]\nG. Mai, K. Cao, X. Lan, and P. C. Yuen (2020)\n\nSecureFace: face template protection.\n\nIEEE Transactions on Information Forensics and security 16, pp. 262–277.\n\nCited by: §2.\n
[37]\n (2026)\n\nModel Context Protocol (MCP).\n\nNote: https://github.com/modelcontextprotocol/modelcontextprotocol\n\nCited by: §1,\n§1,\n§2.\n
[38]\nK. Nandakumar (2010)\n\nA fingerprint cryptosystem based on minutiae phase spectrum.\n\nIn 2010 IEEE International Workshop on Information Forensics and Security,\n\npp. 1–6.\n\nCited by: §3.3.\n
[39]\n (2025)\n\nOpen Agent Specification (Agent Spec).\n\nNote: https://github.com/oracle/agent-spec\n\nCited by: §2.\n
[40]\nS. Rane, Y. Wang, S. C. Draper, and P. Ishwar (2013)\n\nSecure biometrics: concepts, authentication architectures, and challenges.\n\nIEEE Signal Processing Magazine 30 (5), pp. 51–64.\n\nCited by: §2.\n
[41]\nN. K. Ratha, J. H. Connell, and R. M. Bolle (2001)\n\nEnhancing security and privacy in biometrics-based authentication systems.\n\nIBM systems Journal 40 (3), pp. 614–634.\n\nCited by: §2.\n
[42]\nC. Rathgeb, F. Breitinger, and C. Busch (2013)\n\nAlignment-free cancelable iris biometric templates based on adaptive bloom filters.\n\nIn 2013 international conference on biometrics (ICB),\n\npp. 1–8.\n\nCited by: §2.\n
[43]\nC. Rathgeb and A. Uhl (2011)\n\nA survey on biometric cryptosystems and cancelable biometrics.\n\nEURASIP journal on information security 2011 (1), pp. 3.\n\nCited by: §2.\n
[44]\nD. Rivkin, F. Hogan, A. Feriani, A. Konar, A. Sigal, X. Liu, and G. Dudek (2024)\n\nAIoT smart home via autonomous llm agents.\n\nIEEE Internet of Things Journal 12 (3), pp. 2458–2472.\n\nCited by: §1.\n
[45]\nA. Schwenkschuster, P. Kasselman, K. Burgin, M. J. Jenkins, B. Campbell, and A. Parecki (2026)\n\nOAuth Identity and Authorization Chaining Across Domains.\n\nInternet-Draft\n\n Internet Engineering Task Force, Internet Engineering Task Force.\n\nNote: https://datatracker.ietf.org/doc/draft-ietf-oauth-identity-chaining/\n\nCited by: §1.\n
[46]\nS. Sengupta, J. Chen, C. Castillo, V. M. Patel, R. Chellappa, and D. W. Jacobs (2016)\n\nFrontal to profile face verification in the wild.\n\nIn 2016 IEEE winter conference on applications of computer vision (WACV),\n\npp. 1–9.\n\nCited by: §5.1.\n
[47]\nT. South, S. Marro, T. Hardjono, R. Mahari, C. D. Whitney, A. Chan, and A. Pentland (2025)\n\nPosition: ai agents need authenticated delegation.\n\nIn Forty-second International Conference on Machine Learning Position Paper Track,\n\nCited by: §1,\n§1,\n§1,\n§3.2.\n
[48]\nT. South, S. Nagabhushanaradhya, A. Dissanayaka, S. Cecchetti, G. Fletcher, V. Lu, A. Pietropaolo, D. H. Saxe, J. Lombardo, A. M. Shivalingaiah, et al. (2025)\n\nIdentity management for agentic ai: the new frontier of authorization, authentication, and security for an ai agent world.\n\narXiv preprint arXiv:2510.25819.\n\nCited by: §1.\n
[49]\nK. Tallam (2026)\n\nAuthorization propagation in multi-agent ai systems: identity governance as infrastructure.\n\narXiv preprint arXiv:2605.05440.\n\nCited by: §1.\n
[50]\nN. Tomašev, M. Franklin, and S. Osindero (2026)\n\nIntelligent ai delegation.\n\narXiv preprint arXiv:2602.11865.\n\nCited by: §1.\n
[51]\nM. Van Der Veen, T. Kevenaar, G. Schrijen, T. H. Akkermans, and F. Zuo (2006)\n\nFace biometrics with renewable templates.\n\nIn Security, Steganography, and Watermarking of Multimedia Contents VIII,\n\nVol. 6072, pp. 205–216.\n\nCited by: §2.\n
[52]\nT. Wang, W. Wen, X. Xiao, Z. Hua, Y. Zhang, and Y. Fang (2025)\n\nBeyond privacy: generating privacy-preserving faces supporting robust image authentication.\n\nIEEE Transactions on Information Forensics and Security.\n\nCited by: §2.\n
[53]\nL. Wolf, T. Hassner, and Y. Taigman (2008)\n\nDescriptor based methods in the wild.\n\nIn Workshop on faces in’real-life’images: Detection, alignment, and recognition,\n\nCited by: §5.1.\n
[54]\nJ. Yang, N. Yonack, K. Zyskowski, D. Yarats, J. Ho, and J. Ma (2025)\n\nThe adoption and usage of ai agents: early evidence from perplexity.\n\narXiv preprint arXiv:2512.07828.\n\nCited by: §1.\n
[55]\nZ. Zhu, G. Huang, J. Deng, Y. Ye, J. Huang, X. Chen, J. Zhu, T. Yang, J. Lu, D. Du, et al. (2021)\n\nWebface260m: a benchmark unveiling the power of million-scale deep face recognition.\n\nIn Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition,\n\npp. 10492–10502.\n\nCited by: §5.1.\n

Appendix A Effect of Gaussian Dithering

\n\n

Proposition 1.

\n\n\n\n\n\n\n

\\psi^{g}\\approx\\frac{\\psi+\\lambda^{2}}{1+\\lambda^{2}}.

Proof.

Let the perturbed vectors be

\n\n\n\n\n\n\n

\\mathbf{x}^{\\prime}=\\mathbf{x}+\\lambda\\mathbf{g},\\quad\\mathbf{y}^{\\prime}=\\mathbf{y}+\\lambda\\mathbf{g}

The cosine similarity is defined as

\n\n\n\n\n\n\n

\\psi^{g}=\\frac{\\langle\\mathbf{x}^{\\prime},\\mathbf{y}^{\\prime}\\rangle}{\\|\\mathbf{x}^{\\prime}\\|\\,\\|\\mathbf{y}^{\\prime}\\|}

Expanding the inner product in the numerator:

\n\n\n\n\n\n\n

\\langle\\mathbf{x}^{\\prime},\\mathbf{y}^{\\prime}\\rangle=\\langle\\mathbf{x}+\\lambda\\mathbf{g},\\mathbf{y}+\\lambda\\mathbf{g}\\rangle

\n\n\n\n\n\n\n

\\langle\\mathbf{x}^{\\prime},\\mathbf{y}^{\\prime}\\rangle=\\langle\\mathbf{x},\\mathbf{y}\\rangle+\\lambda\\langle\\mathbf{x},\\mathbf{g}\\rangle+\\lambda\\langle\\mathbf{y},\\mathbf{g}\\rangle+\\lambda^{2}\\langle\\mathbf{g},\\mathbf{g}\\rangle

Using results for high-dimensional Gaussian vectors,

\n\n\n\n\n\n\n

\\langle\\mathbf{x},\\mathbf{g}\\rangle\\approx 0,\\quad\\langle\\mathbf{y},\\mathbf{g}\\rangle\\approx 0,\\quad\\langle\\mathbf{g},\\mathbf{g}\\rangle\\approx d,\\quad\\langle\\mathbf{x},\\mathbf{y}\\rangle\\approx S\\cdot d

Hence,

\n\n\n\n\n\n\n

\\langle\\mathbf{x}^{\\prime},\\mathbf{y}^{\\prime}\\rangle\\approx S\\cdot d+\\lambda^{2}\\cdot d

Expanding the norms in the denominator:

\n\n\n\n\n\n\n

\\|\\mathbf{x}^{\\prime}\\|^{2}=\\|\\mathbf{x}\\|^{2}+2\\lambda\\langle\\mathbf{x},\\mathbf{g}\\rangle+\\lambda^{2}\\|\\mathbf{g}\\|^{2}

Using results for high-dimensional Gaussian vectors,

\n\n\n\n\n\n\n

\\|\\mathbf{x}\\|^{2}\\approx d,\\quad\\langle\\mathbf{x},\\mathbf{g}\\rangle\\approx 0,\\quad\\|\\mathbf{g}\\|^{2}\\approx d

\n\n\n\n\n\n\n

\\|\\mathbf{x}^{\\prime}\\|^{2}\\approx d(1+\\lambda^{2})

Similarly,

\n\n\n\n\n\n\n

\\|\\mathbf{y}^{\\prime}\\|^{2}\\approx d(1+\\lambda^{2})

Thus,

\n\n\n\n\n\n\n

\\Rightarrow\\quad\\|\\mathbf{x}^{\\prime}\\|\\approx\\|\\mathbf{y}^{\\prime}\\|\\approx\\sqrt{d(1+\\lambda^{2})}

Substituting these approximations:

\n\n\n\n\n\n\n

\\psi^{g}\\approx\\frac{d(S+\\lambda^{2})}{\\sqrt{d(1+\\lambda^{2})}\\,\\sqrt{d(1+\\lambda^{2})}}

After simplification $d(1+\\lambda^{2})$ , we obtain

\n\n\n\n\n\n\n

\\psi^{g}\\approx\\frac{S+\\lambda^{2}}{1+\\lambda^{2}}

∎

Appendix B Effect of Gaussian Random Projection

\n\n

Proposition 2.

\n\n\n\n\n\n\n

\\psi^{p}\\approx\\psi^{g}.

Proof.

The cosine similarity after projection is

\n\n\n\n\n\n\n

\\psi^{p}=\\frac{\\langle\\mathbf{Wx},\\mathbf{Wy}\\rangle}{\\|\\mathbf{Wx}\\|\\,\\|\\mathbf{Wy}\\|}

The terms can be expanded as follows

\n\n\n\n\n\n\n

\\langle\\mathbf{Wx},\\mathbf{Wy}\\rangle=\\mathbf{x}^{T}\\mathbf{W}^{T}\\mathbf{W}\\mathbf{y}

\n\n\n\n\n\n\n

\\|\\mathbf{Wx}\\|^{2}=\\mathbf{x}^{T}\\mathbf{W}^{T}\\mathbf{W}\\mathbf{x}

\n\n\n\n\n\n\n

\\|\\mathbf{Wy}\\|^{2}=\\mathbf{y}^{T}\\mathbf{W}^{T}\\mathbf{W}\\mathbf{y}

Since the entries of $\\mathbf{W}$ are i.i.d. $\\mathcal{N}(0,1)$ ,

\n\n\n\n\n\n\n

\\mathbf{W}^{T}\\mathbf{W}=\\sum_{i=1}^{m}\\mathbf{w}_{i}\\mathbf{w}_{i}^{T}

where $\\mathbf{w}_{i}$ denotes the $i$ -th row of $\\mathbf{W}$ .

The expectation for each row can be written as

\n\n\n\n\n\n\n

\\mathbb{E}[\\mathbf{w}_{i}\\mathbf{w}_{i}^{T}]=\\mathbf{I}_{d}

Thus,

\n\n\n\n\n\n\n

\\mathbb{E}[\\mathbf{W}^{T}\\mathbf{W}]=m\\mathbf{I}_{d}

Hence, for sufficiently large $m$ ,

\n\n\n\n\n\n\n

\\mathbf{W}^{T}\\mathbf{W}\\approx m\\mathbf{I}_{d}

Substituting into the numerator,

\n\n\n\n\n\n\n

\\langle\\mathbf{Wx},\\mathbf{Wy}\\rangle=\\mathbf{x}^{T}\\mathbf{W}^{T}\\mathbf{W}\\mathbf{y}\\approx m\\,\\mathbf{x}^{T}\\mathbf{y}

Similarly,

\n\n\n\n\n\n\n

\\|\\mathbf{Wx}\\|^{2}\\approx m\\,\\|\\mathbf{x}\\|^{2},\\qquad\\|\\mathbf{Wy}\\|^{2}\\approx m\\,\\|\\mathbf{y}\\|^{2}

Therefore the similarity can be written as,

\n\n\n\n\n\n\n

\\psi^{p}\\approx\\frac{m\\,\\mathbf{x}^{T}\\mathbf{y}}{\\sqrt{m\\,\\|\\mathbf{x}\\|^{2}}\\,\\sqrt{m\\,\\|\\mathbf{y}\\|^{2}}}=\\frac{\\mathbf{x}^{T}\\mathbf{y}}{\\|\\mathbf{x}\\|\\,\\|\\mathbf{y}\\|}=S

Thus, random Gaussian projection approximately preserves cosine similarity,

\n\n\n\n\n\n\n

\\psi^{p}\\approx\\psi^{g}

∎

Appendix C Effect of Pairwise WTA-Hashing

\n\n

Proposition 3.

\n\n\n\n\n\n\n

\\psi^{h}\\approx 1-\\frac{\\arccos(\\psi^{p})}{\\pi}.

Proof.

Consider a single bit of the hash. Let $(i,j)$ be the coordinate pair\nselected by the random perturbation operators $\\Pi_{1}$ and $\\Pi_{2}$ .\nThe resulting binary bits are

\n\n\n\n\n\n\n

u=\\mathbf{1}\\{x_{i}<x_{j}\\},\\qquad v=\\mathbf{1}\\{y_{i}<y_{j}\\}

which can be written equivalently as,

\n\n\n\n\n\n\n

u=\\mathbf{1}\\{x_{j}-x_{i}>0\\},\\qquad v=\\mathbf{1}\\{y_{j}-y_{i}>0\\}

Lets define

\n\n\n\n\n\n\n

\\Delta x=x_{j}-x_{i},\\qquad\\Delta y=y_{j}-y_{i}

Assume that the coordinate pairs $(x_{i},y_{i})$ and $(x_{j},y_{j})$ are jointly\nGaussian with correlation coefficient equal to the cosine similarity $\\rho=\\psi^{p}$ .\nSince differences of Gaussian random variables remain Gaussian,\n $(\\Delta x,\\Delta y)$ is a bivariate Gaussian vector.\n\n

Showing that Correlation equal to Cosine Similarity

The variance can be written as

\n\n\n\n\n\n\n

\\operatorname{Var}(\\Delta x)=\\operatorname{Var}(x_{j})+\\operatorname{Var}(x_{i})=2

and similarly

\n\n\n\n\n\n\n

\\operatorname{Var}(\\Delta y)=2

Further the covariance will be given by,

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

	$\\displaystyle\\operatorname{Cov}(X,Y)$	$\\displaystyle=\\operatorname{Cov}(x_{j}-x_{i},\\;y_{j}-y_{i})$
		$\\displaystyle=\\operatorname{Cov}(x_{j},y_{j})-\\operatorname{Cov}(x_{j},y_{i})$
		$\\displaystyle\\quad-\\operatorname{Cov}(x_{i},y_{j})+\\operatorname{Cov}(x_{i},y_{i})$

Since different coordinates are independent,

\n\n\n\n\n\n\n

\\operatorname{Cov}(x_{j},y_{i})=\\operatorname{Cov}(x_{i},y_{j})=0

and therefore

\n\n\n\n\n\n\n

\\operatorname{Cov}(\\Delta x,\\Delta y)=\\psi^{p}+\\psi^{p}=2\\psi^{p}

Hence correlation $\\rho$ can be written as,

\n\n\n\n\n\n\n

\\operatorname{Corr}(\\Delta x,\\Delta y)=\\frac{\\operatorname{Cov}(\\Delta x,\\Delta y)}{\\sqrt{\\operatorname{Var}(\\Delta x)\\operatorname{Var}(\\Delta x)}}=\\frac{2\\psi^{p}}{\\sqrt{2}\\sqrt{2}}=S

Hamming Similarity Equivalence

The bits $u$ and $v$ agree precisely when $\\Delta x$ and $\\Delta y$ have the same sign.\nFor a bivariate Gaussian pair with correlation $S$ , Sheppard’s formula\nstates that

\n\n\n\n\n\n\n

\\mathbb{P}\\Bigl(\\operatorname{sign}(\\Delta x)=\\operatorname{sign}(\\Delta y)\\Bigr)=1-\\frac{\\arccos(\\psi^{p})}{\\pi}

Therefore,

\n\n\n\n\n\n\n

\\mathbb{P}(u=v)=1-\\frac{\\arccos(\\psi^{p})}{\\pi}

The Hamming similarity is

\n\n\n\n\n\n\n

\\psi^{h}=\\frac{1}{m}\\sum_{t=1}^{m}\\mathbf{1}\\{u_{t}=v_{t}\\}

Since the bits are i.i.d. Bernoulli random variables with success\nprobability

\n\n\n\n\n\n\n

1-\\frac{\\arccos(\\psi^{p})}{\\pi},

Thus, for sufficiently large $b$ , the hamming similiarity can be written as as follows [10],

\n\n\n\n\n\n\n

\\psi^{h}\\approx 1-\\frac{\\arccos(\\psi^{p})}{\\pi}

∎

Appendix D Deriving $\\lambda$ from Similarity Contraints

\n\n

Combining the above relations, we obtain the forward model:

\n\n\n\n\n\n\n

\\psi^{h}\\approx 1-\\frac{\\arccos\\!\\left(\\frac{\\psi+\\lambda^{2}}{1+\\lambda^{2}}\\right)}{\\pi}.

Then,

\n\n\n\n\n\n\n

\\cos\\bigl(\\pi(1-\\psi^{h})\\bigr)\\approx\\frac{\\psi+\\lambda^{2}}{1+\\lambda^{2}}.

Define

\n\n\n\n\n\n\n

c:=\\cos\\bigl(\\pi(1-\\psi^{h})\\bigr).

We solve for $\\lambda^{2}$ :

\n\n\n\n\n\n\n

c(1+\\lambda^{2})=\\psi+\\lambda^{2},

\n\n\n\n\n\n\n

c+c\\lambda^{2}=\\psi+\\lambda^{2},

\n\n\n\n\n\n\n

\\lambda^{2}(c-1)=\\psi-c.

Thus,

\n\n\n\n\n\n\n

\\lambda^{2}=\\frac{c-\\psi}{1-c}.

Finally,

\n\n\n\n\n\n\n

\\lambda=\\sqrt{\\frac{c-\\psi}{1-c}},\\quad\\text{where }c=\\cos\\bigl(\\pi(1-\\psi^{h})\\bigr).

This provides a closed-form estimator for the dithering strength $\\lambda$ to obtain Hamming similarity $\\psi^{h}$ and the original cosine similarity $S$ .

For a given operating threshold $\\psi$ indicating Cosine Similarity and decoding error bound $\\tau$ , which in terms of Hamming Similarity is $1-\\tau$ . Then formula is written as

\n\n\n\n\n\n\n

\\lambda=\\sqrt{\\frac{\\cos\\bigl(\\pi\\tau\\bigr)-\\psi}{1-\\cos\\bigl(\\pi\\tau\\bigr)}}.

This $\\lambda$ is used in the feature adaptation process, ensuring that the biometric representation is compatible with the error-correction code.

Comments:	Accepted in IJCB sessions 2026
Subjects:	\n Computer Vision and Pattern Recognition (cs.CV)
Cite as:	arXiv:2608.04292 [cs.CV]
	(or \n arXiv:2608.04292v2 [cs.CV] for this version)\n
	https://doi.org/10.48550/arXiv.2608.04292 \n \n \n \n arXiv-issued DOI via DataCite \n \n

Computer Science > Computer Vision and Pattern Recognition

Title:Binding Biometrics with AI Agent Identifiers for Delegation of Authority

Submission history

Access Paper:

Current browse context:

References & Citations

BibTeX formatted citation

Bookmark

Bibliographic and Citation Tools

Code, Data and Media Associated with this Article

Demos

Recommenders and Search Tools

arXivLabs: experimental projects with community collaborators

Binding Biometrics with AI Agent Identifiers for Delegation of Authority

Abstract

1 Introduction

2 Related Works

3 BIND Framework

3.1 Problem Formulation

3.2 Threat Model

3.3 Proposed Solution

4 Face-based Implementation of BIND

4.1 Error Correction Codes

4.2 Face Feature Adaptation

Assumption 1.

4.3 Determining the Optimal Dithering Factor (λ)\\big(\\lambda\\big)

Proposition 1 (Effect of Gaussian Dithering).

Proposition 2 (Effect of Gaussian Random Projection).

Proposition 3 (Effect of Pairwise WTA-Hashing).

5 Experimental Results

5.1 Dataset and Feature Extraction

5.2 Main Results

5.3 Discussion on Security

6 Conclusion

Acknowledgment

References

Appendix A Effect of Gaussian Dithering

Proposition 1.

Proof.

Appendix B Effect of Gaussian Random Projection

Proposition 2.

Proof.

Appendix C Effect of Pairwise WTA-Hashing

Proposition 3.

Proof.

Appendix D Deriving λ\\lambda from Similarity Contraints

4.3 Determining the Optimal Dithering Factor $\\big(\\lambda\\big)$

Appendix D Deriving $\\lambda$ from Similarity Contraints