  One of the main challenges faced by Biometric-based authentication systems is
the need to offer secure authentication while maintaining the privacy of the
biometric data. Previous solutions, such as Secure Sketch and Fuzzy Extractors,
rely on assumptions that cannot be guaranteed in practice, and often affect the
authentication accuracy.
  In this paper, we introduce HoneyFaces: the concept of adding a large set of
synthetic faces (indistinguishable from real) into the biometric "password
file". This password inflation protects the privacy of users and increases the
security of the system without affecting the accuracy of the authentication. In
particular, privacy for the real users is provided by "hiding" them among a
large number of fake users (as the distributions of synthetic and real faces
are equal). In addition to maintaining the authentication accuracy, and thus
not affecting the security of the authentication process, HoneyFaces offer
several security improvements: increased exfiltration hardness, improved
leakage detection, and the ability to use a Two-server setting like in
HoneyWords. Finally, HoneyFaces can be combined with other security and privacy
mechanisms for biometric data.
  We implemented the HoneyFaces system and tested it with a password file
composed of 270 real users. The "password file" was then inflated to
accommodate up to $2^{36.5}$ users (resulting in a 56.6 TB "password file"). At
the same time, the inclusion of additional faces does not affect the true
acceptance rate or false acceptance rate which were 93.33\% and 0.01\%,
respectively.
