  Much of the success of fingerprint recognition is attributed to
minutiae-based fingerprint representation. It was believed that minutiae
templates could not be inverted to obtain a high fidelity fingerprint image,
but this assumption has been shown to be false. The success of deep learning
has resulted in alternative fingerprint representations (embeddings), in the
hope that they might offer better recognition accuracy as well as
non-invertibility of deep network-based templates. We evaluate whether deep
fingerprint templates suffer from the same reconstruction attacks as the
minutiae templates. We show that while a deep template can be inverted to
produce a fingerprint image that could be matched to its source image, deep
templates are more resistant to reconstruction attacks than minutiae templates.
In particular, reconstructed fingerprint images from minutiae templates yield a
TAR of about 100.0% (98.3%) @ FAR of 0.01% for type-I (type-II) attacks using a
state-of-the-art commercial fingerprint matcher, when tested on NIST SD4. The
corresponding attack performance for reconstructed fingerprint images from deep
templates using the same commercial matcher yields a TAR of less than 1% for
both type-I and type-II attacks; however, when the reconstructed images are
matched using the same deep network, they achieve a TAR of 85.95% (68.10%) for
type-I (type-II) attacks. Furthermore, what is missing from previous
fingerprint template inversion studies is an evaluation of the black-box attack
performance, which we perform using 3 different state-of-the-art fingerprint
matchers. We conclude that fingerprint images generated by inverting minutiae
templates are highly susceptible to both white-box and black-box attack
evaluations, while fingerprint images generated by deep templates are resistant
to black-box evaluations and comparatively less susceptible to white-box
evaluations.
