arXiv subjects

Salvatore Stolfo

Publications and source records attributed to Salvatore Stolfo.

4 recordsLinked to original sources

arXiv2026

Video-Based Palm-Vein Authentication under Challenging Conditions

Palm-vein biometrics are increasingly used for secure, contactless authentication. Yet real-world deployment exposes them to surface noise (sweat, dirt), illumination and motion variation, and temperature-driven changes in vascular visibility, which remain underexplored for lack of data captured under such conditions. To study these effects, we introduce the Columbia University Palm-vein (CUP) dataset, to our knowledge the first public video-based palm-vein dataset. CUP records every palm under four surface conditions (a clean baseline, warm, wet, and dirty) and pairs each subject with physiological and demographic metadata. On it we benchmark twenty-one recognizers spanning static, video, and multi-frame aggregation architectures. Models that verify reliably on clean palms lose most of their accuracy on dirty ones, and the mean equal error rate (EER) roughly quadruples. We recover much of that robustness along both axes of the capture. Temporally, a consensus over the few frames the sensor already returns cancels transient corruption; spatially, a test-time matcher that adds no learned parameters fuses the global cosine with a saliency-steered region-level optimal transport that routes the comparison around corrupted regions. The full design leads on every surface of CUP in EER, TAR@FAR=0.01, and Rank-1, at 4.3M parameters and 3.1 GFLOPs, a fraction of the video models' cost. Attached to four frozen state-of-the-art backbones it cuts their mean EER by 29-37% without retraining, and on four public single-image datasets the regional matching alone still helps. A preliminary audit across ten demographic and physiological traits finds two warm-condition gaps, along body water and gender, that survive multiple-comparison correction. CUP will be released for non-commercial research use at https://github.com/MobileX-CU/CUP_v1 upon publication.

cs.CV↗

arXiv2025

Quantum Computer Fingerprinting using Error Syndromes

As quantum computing matures and moves toward broader accessibility through cloud-based platforms, ensuring the authenticity and integrity of quantum computations becomes an urgent concern. In this work, we propose a strategy to leverage the byproducts of quantum error correction (QEC) to verify hardware identity and authenticate quantum computations for "free", without introducing any additional quantum computations or measurements. By treating syndrome measurements as a source of metadata, we embed verification seamlessly into standard QEC protocols and eliminate the need for separate challenge-response pairs. We validate our approach using multiple error-correcting codes, quantum states, and circuit compilation strategies on several generations of IBM quantum computers. Our classifiers achieve 99% accuracy with only 500 shots in distinguishing among five backends. Overall, we re-purpose the intrinsic overhead of error correction to be a mechanism for securing quantum computation.

quant-ph↗

arXiv2017

Tug-of-War: Observations on Unified Content Handling

Modern applications and Operating Systems vary greatly with respect to how they register and identify different types of content. These discrepancies lead to exploits and inconsistencies in user experience. In this paper, we highlight the issues arising in the modern content handling ecosystem, and examine how the operating system can be used to achieve unified and consistent content identification.

cs.CR↗

arXiv2014

Unsupervised Anomaly-based Malware Detection using Hardware Features

Recent works have shown promise in using microarchitectural execution patterns to detect malware programs. These detectors belong to a class of detectors known as signature-based detectors as they catch malware by comparing a program's execution pattern (signature) to execution patterns of known malware programs. In this work, we propose a new class of detectors - anomaly-based hardware malware detectors - that do not require signatures for malware detection, and thus can catch a wider range of malware including potentially novel ones. We use unsupervised machine learning to build profiles of normal program execution based on data from performance counters, and use these profiles to detect significant deviations in program behavior that occur as a result of malware exploitation. We show that real-world exploitation of popular programs such as IE and Adobe PDF Reader on a Windows/x86 platform can be detected with nearly perfect certainty. We also examine the limits and challenges in implementing this approach in face of a sophisticated adversary attempting to evade anomaly-based detection. The proposed detector is complementary to previously proposed signature-based detectors and can be used together to improve security.

cs.CR↗