Skip to content

QIF-T0096

critical

Multi-modal biometric fusion attack (cross-sensor identity correlation for persistent tracking)

Tier 4 — Demonstrated (Case Study / Observational)

Legacy status: EMERGING

By fusing biometric signatures from multiple consumer sensors — ear canal acoustics (T0079), gait pattern (T0088), BLE RF fingerprint (T0091), PPG waveform (T0093), and eye tracking (T0085 if VR/AR) — an attacker creates a multi-modal biometric profile that is virtually impossible to evade. Each individual biometric can potentially be disrupted (change earbuds, alter gait, disable Bluetooth), but the fusion of 3+ biometric channels provides robust identification even if individual channels are degraded. The fusion operates at the feature level (concatenated feature vectors) or decision level (majority voting across classifiers). This technique weaponizes the ubiquity of consumer sensors: the average person carries 10+ sensors across phone, watch, and earbuds. The combination creates a biometric surveillance net that no single privacy measure can defeat.

Technique Details

Tactic
QIF-S.CH
Status
EMERGING
Bands
S1, S2, S3

Therapeutic Application

Fusion of biometric signatures from multiple consumer sensors (acoustic, IMU, RF, optical) to create robust multi-modal identity profile resistant to individual channel disruption

Clinical Analog

Multi-modal patient identification for medication safety

Treats

  • patient identification in hospitals (multi-factor biometric)
  • elderly person identification in care facilities
  • clinical trial participant verification

Neural Impact

3 of 7 neural bands affected

S1 S2 S3

Drag to rotate. Click a region to learn more.

Click or hover over a glowing region to see the attack techniques targeting it and their severity.

Scoring

NISS v1.1 NISS:1.1/BI:N/CR:N/CD:N/CV:I/RV:F/NP:N
CVSS v4.0 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
2.0Low
BICRCDCVRVNP
 

Governance

Neurorights at Risk

This technique threatens 3 of the 4 proposed neurorights (Ienca & Andorno, 2017).

Consent Complexity
1.35 / 4.0

FDORA §3305 Compliance

Cyber Device
Regulatory Coverage
0.4 / 1.0
524B Requirements
TM VA SBOM SA PM
Regulatory Gaps
  • ! CVSS partially captures risk; neural dimensions missing
  • ! No FDA pathway for consumer sensor exploitation

Population Vulnerability

CRB vulnerability adjustment (γ=0.30) accounts for age, diagnosis severity, consent capacity, and device dependency.

Population NISS Base Adjusted Severity Delta
Adult (Default) 2.0 2.0 Low -
Child (10yr) + ADHD 2.0 2.4 Low +0.35
Adult with ALS 2.0 2.3 Low +0.32

Validation Status

Theoretical / Not yet validated. This technique has not been independently tested. See the validation dashboard for what has been tested.

Qinnovate Neural Security Atlas Edit this on GitHub