Behavioral biometrics — typing rhythm, gait, speech, touchscreen dynamics, even the sound of blowing at a phone microphone — are attractive because they are dynamic (continuous authentication), implicitly live, and hard to steal like a password. They are also brittle in exactly the way the literature keeps complaining about: matching engines use similarity metrics, fixed thresholds and supervised classifiers, all of which degrade when the user’s behavior shifts with stress, fatigue, posture, device angle or ambient noise.
LABBA (SUTD) inserts a different component into that pipeline: an LLM as the decision layer rather than the feature extractor. Spectral and temporal features of a blow-acoustic interaction are aggregated into discrete categories (VERY_GOOD…BAD) or continuous normalized scores, turned into structured prompts, and handed to a small reasoning model that returns ACCEPT or REJECT plus a natural-language justification.
The Numbers
The study is deliberately real-world: 50 participants (40 men, 10 women, 22–65), each performing 10 sessions of 5 seconds — 500 attempts — in their own chosen environments, with no acoustic booth, in both sitting and standing postures. The model is Phi-3 Mini Instruct (Q4), and the whole system runs on a Dell XPS 15 CPU with no GPU.
The headline comparison is against the same pipeline without the LLM:
| Method | Accuracy | FAR | FRR | EER |
|---|---|---|---|---|
| Without LLM | 99.09% | 0.13% | 43.64% | 21.89% |
| LLM, rule-based (fused) | 99.46% | 0.21% | 18.27% | 9.24% |
| LLM, score-based (fused) | 99.38% | 0.38% | 13.80% | 7.09% |
Accuracy barely moves — it is already saturated. False rejection is where the LLM matters: 43.64% → 18.27% (rule-based) or 13.80% (score-based), an improvement of 25–30 percentage points for a 0.08–0.25 point rise in false acceptance. EER falls by 12.65 to 14.80 points. In practice that means the difference between a security system that locks out its own users and one that does not.
Score-based mode trades a little more impostor risk for fewer rejections, which the authors argue suits usability-sensitive deployments; rule-based suits false-acceptance-critical ones.
Why Not Just Feed Audio To The LLM?
The attack analysis is the interesting part. Because LABBA’s LLM never sees raw audio — only structured similarity features from trusted components — the near-ultrasonic acoustic jailbreak channel (where an adversary hides prompts recovered only after microphone nonlinearity) does not apply. There are no natural-language prompts to inject, and the reasoning is bounded to authentication decisions.
Caveats: attack resilience is argued largely from design properties rather than measured against a full adversarial suite; 50 participants and 500 attempts is a modest corpus; and the prompt surface still warrants constrained fine-tuning and trusted-input validation. The authors also note that trusted training and contextual consistency checks may still be needed.
The takeaway is a pattern worth stealing: use an LLM where thresholds are brittle — not to extract features, but to arbitrate when context matters.
Paper: arXiv:2611.08343