Cybersecurity Experts Develop Universal Fingerprints Using DeepMasterPrints

Researchers from New York University and the University of Michigan have published a report on DeepMasterPrints, a generative adversarial network capable of creating universal fingerprints—similar to master keys that can unlock multiple locks. Essentially, this tool opens the door to a new kind of “dictionary attack” against biometric security systems.

The researchers explain that most modern fingerprint scanners found in smartphones, laptops, and other devices are small and only scan a portion of a user’s fingerprint, comparing that segment to a database. Moreover, certain fingerprint features are repeated and share very similar characteristics. This led the experts to consider whether it would be possible to generate an artificial fingerprint composed of different segments from various individuals, allowing it to trick biometric systems and “match” multiple real fingerprints in the database.

DeepMasterPrints is a logical continuation of the MasterPrints project introduced by the same experts last year. However, MasterPrints relied on modifying details of existing fingerprints and could not create new ones. In contrast, DeepMasterPrints uses a database of 6,000 real fingerprints to generate entirely new prints.

The researchers tested DeepMasterPrints against the classic NIST fingerprint dataset, which was collected using ink, as well as a dataset from modern digital sensors. According to the report, DeepMasterPrints performed much better with digital fingerprints than with the ink-based database.

Levels of Biometric Security and DeepMasterPrints’ Effectiveness

The experts divided the possible security levels into three tiers:

• Highest security: 0.01% false match rate
• Medium (most common): 0.1% false match rate
• Lowest: 1% false match rate

When working with the lowest security level and digital fingerprints, DeepMasterPrints achieved an impressive success rate of nearly 77%. However, the researchers acknowledge that biometric sensors rarely operate at such a low security level. For the medium security level (0.1% false match rate), the success rate was about 23% for digital fingerprints. As for the highest security settings, DeepMasterPrints was only able to fool the system in 1.2% of cases, as expected.