  Mobile authentication using behavioral biometrics has been an active area of
research. Existing research relies on building machine learning classifiers to
recognize an individual's unique patterns. However, these classifiers are not
powerful enough to learn the discriminative features. When implemented on the
mobile devices, they face new challenges from the behavioral dynamics, data
privacy and side-channel leaks. To address these challenges, we present a new
framework to incorporate training on battery-powered mobile devices, so private
data never leaves the device and training can be flexibly scheduled to adapt
the behavioral patterns at runtime. We re-formulate the classification problem
into deep metric learning to improve the discriminative power and design an
effective countermeasure to thwart side-channel leaks by embedding a noise
signature in the sensing signals without sacrificing too much usability. The
experiments demonstrate authentication accuracy over 95% on three public
datasets, a sheer 15% gain from multi-class classification with less data and
robustness against brute-force and side-channel attacks with 99% and 90%
success, respectively. We show the feasibility of training with mobile CPUs,
where training 100 epochs takes less than 10 mins and can be boosted 3-5 times
with feature transfer. Finally, we profile memory, energy and computational
overhead. Our results indicate that training consumes lower energy than
watching videos and slightly higher energy than playing games.
