Fake fingerprints can be created, US researchers prove

The artificially generated fingerprints, named “DeepMasterPrints” by the researchers from New York University, were able to imitate more than one in five fingerprints in a biometric system that should only have an error rate of one in a thousand.

In order to work, the DeepMasterPrints take advantage of two properties of fingerprint-based authentication systems. Firstly, for ergonomic reasons, most fingerprint readers do not read the entire finger at once, instead imaging whichever part of the finger touches the scanner. As a result, these systems simply compare the partial scan against the partial records. That means that an attacker has to match just one of tens or hundreds of saved partial fingerprint in order to be granted access.

Secondly, some features of fingerprints are more common than others, meaning that a fake print which contains a lot of very common features is more likely to match with other fingerprints than pure chance would suggest.

Based on those insights, the researchers used a common machine learning technique, called a generative adversarial network, to artificially create new fingerprints that matched as many partial fingerprints as possible.

Besides multiple fingerprint images, the network allowed them to also create fakes which look convincingly like a real fingerprint to a human eye. However, demonstrating flaws in existing authentication systems is considered to be an important part of developing more secure replacements in the future.