Very

3.1Biometric Modality Comparison

For a biometric technology to be globally adopted for a human identity system, the technology must also protect privacy, be user-friendly, and respect social norms and traditions.

3.2Comparative Analysis of Alternative Modalities

Face Recognition. Face recognition can be applied to standard cameras. It is touchless and delivers a good user experience. However there are serious privacy concerns. Human face is exposed and can be used for tracking in public spaces. Moreover a person’s facial image can be found online, which makes it easy for ID theft to obtain the base sample for creating a fake face. Regarding social acceptance, some indigenous cultures are against taking facial photos, the traditions of some areas also discourage certain groups from exposing faces in public areas.

Fingerprint. Fingerprint requires a scanner. While a lot of smartphones have built-in fingerprint scanners, their outputs are in different formats that are specifically designed for its own embedded fingerprint algorithm. Moreover the phone fingerprint scanner is designed to be used by a single user. Its accuracy is not high enough to distinguish billions of people. Scanning fingerprints requires touching the scanner, which can cause hygiene concerns when used on shared devices in public space.

Iris Recognition. Iris recognition has the advantages of being computationally efficient and accurate. However high accuracy iris recognition requires a dedicated narrow field of view infrared camera. Moreover, the poor user experience makes it unsuitable to be used for identity verification of daily transactions.

DNA. As a biological characteristic, DNA has high accuracy and can be used to distinguish every individual in the world. However, DNA encoding contains all information about a person, which raises the most serious privacy concern among all biometric modalities.

3.3Palm Print Advantages

Key advantages include:

• High Distinctiveness: Palm prints are highly unique, with a vast number of distinctive features such as principal lines, wrinkles, and ridges, including differentiation between identical twins.
• Contactless and Hygienic: Users simply present their palm to a standard smartphone camera. Touchless scanning from a distance eliminates hygiene concerns.
• Pseudonymous Biometric Trait: Palm biometrics are “unofficial,” unlike faces or fingerprints that are linked to passports or law enforcement records, making it difficult to trace the physical identity of a user. Not tied to government ID databases.
• Inclusiveness: No bias to skin colors, a common issue with facial recognition.
• Privacy-Centric: Palm scan data does not leave the local device, which guarantees that personal biometric data remains private and secure from external threats.
• No Dependency on Specialized Hardware: Operates using standard RGB smartphone cameras.

4.1Platform Architecture

The Very platform consists of three primary components:

Very ID has two aspects: (1) Literal — a unique identifier assigned to each human user; (2) Conceptual — a biometric-based identity network that provides Proof of Personhood to new users at the time of enrollment and Proof of Ownership to enrolled users afterwards.

Very App is the frontend of Very. Currently, the Very App implements the workflows for user enrollment and verification and serves as a sample project for external developers to learn how to access Very ID via the Very API.

Very API is the interface for accessing Very ID. Through the API, external applications can query Very ID for services related to Proof of Personhood or Proof of Ownership.

4.2System Stack

The Very system stack is divided into local and remote components. All biometric processing occurs on the local device, with only encrypted signatures communicated to the remote server.

5.1FAR and FRR

To provide Proof of Personhood, any human user enrolled in the Very system needs to be unique. This uniqueness consists of two requirements:

1. Distinguishing Individuals: No two people should be identified as the same entity. Each person will be able to enroll and receive a unique ID.
2. Detecting Duplication: Duplicate enrollment attempts need to be detected. One person can only register once. If a person attempts another enrollment, the new biometric scan needs to match the existing one.

These requirements are tied to two fundamental KPIs of biometrics:

• False Acceptance Rate (FAR): The likelihood of a false match given two biometric samples from different individuals.
• False Rejection Rate (FRR): The likelihood of a false non-match given two biometric samples from the same individual.

When a true new user registers, a FAR or false match between the new user and an existing user will result in the rejection of the legitimate enrollment. Conversely, when an existing user attempts a duplicate registration, an FRR or false non-match of the new and registered biometrics of the same user will result in a duplicated enrollment. At the scale of the global population, both FAR and FRR need to be minimized.

5.2Baseline Accuracy

The accuracy of the Very palm print algorithm has been verified using public datasets. At a FAR of 1 over 10 million (10⁻⁷), the FRR is less than 1.5 percent (0.015). To accumulate the large number of samples required to validate the very low FAR, multiple public datasets were merged. Moreover, all left palm images were mirrored into right palm images. This operation effectively created a mirrored user for each real user. Finally, all right palm images of both real and mirrored users were cross-matched to compute the FAR. Please note that due to the use of mirrored palm datasets, the calculation of FAR already took into account the similarities or correlations between the left and right palms of the same person.

The FAR shown above is state-of-the-art. It is 10 times better than the reported FAR of Apple Face ID, which leverages special hardware. However, our FAR still falls short on “distinguishing” everyone on the earth. The global population is 8.1 billion. A satisfactory FAR should be significantly lower than 1/8,100,000,000.

An FRR of 2% or lower is typically considered good practice for most applications. In Very, due to the requirement on uniqueness, the target FRR needs to be much lower to eliminate the chance of a registered user from not being matched or recognized in a duplicated registration attempt and thereby creating a second account.

As explained above, a global human identity system demands extremely low FAR and FRR at the same time. This is challenging because the two parameters are always in a state of equilibrium. For any biometric matching algorithm, the similarity measurement between two biometric samples is represented as a numeric value called matching score. Matching result is determined by comparing the matching score to a pre-set threshold. A higher than threshold score indicates a positive match, otherwise a negative match. Lowering FAR requires increasing the threshold, which will result in the increase of FRR.

5.3Multi-scan and Dual-palm Enhancement

Very’s innovation to reduce both FAR and FRR simultaneously comes from two techniques: (1) taking multiple scans of each palm and (2) scanning both left and right palms.

Assumptions

Before delving into the accuracy analysis, two key assumptions ensure the analysis reflects performance under operational conditions:

1. Independence of Scans from the Left and Right Hands: Left and right palms are indeed correlated to a certain degree. The palm print patterns of the left and right palms of the same person bear more similarities than those of two different individuals. The following analysis assumes independent left and right palm print patterns. This assumption is justified by the fact that in our study, all left palm images are mirrored to create synthetic right palm images. As a result, the computed FAR and FRR have already taken into account the correlations between the left and right palms of the same person.
2. Reasonable Palm Scanning Conditions: We assume that palm scanning occurs under reasonably good lighting conditions. The Very algorithm checks all palm images to ensure that the brightness and contrast in the palm area are sufficient, thereby not adversely affecting the 1.5 percent FRR calculated from the public dataset.

Multi-scan

Given two palms P_a and P_b, we take n scans each and perform one-to-one matching n times. If any of the n matches is positive, we consider P_a and P_b to be the same. If no scans match, P_a and P_b are considered different. Assume the FAR and FRR of a single scan are x and y respectively.

False Acceptance Rate (FAR): The system will falsely accept an unauthorized user if it falsely accepts any of the n attempts. Thus, the probability of at least one false acceptance across n attempts is:

When n is small, the above equation can be simplified as:

False Rejection Rate (FRR): The system will falsely reject a legitimate user if it falsely rejects on every one of the n attempts. Thus, the probability of false rejection across n attempts is:

Dual-palm

Given two users U_a and U_b, we compare their left palms and right palms separately. The combined FAR of the left and right palms matching result is the product of the FAR of each palm:

False Rejection Rate (FRR) with dual-palm and multi-scan: the FRR of the combined matching result of left and right palms is the sum of the FRR of each palm:

5.4Achieved Accuracy for Global Deployment

In the Very app, the user is asked to take 10 scans (5 left and 5 right) during registration. Applying the single palm single scan metrics FAR as 10⁻⁷ and FRR as 0.015 into the equations, the overall accuracy can be calculated as:

This level of accuracy is sufficient to guarantee uniqueness even for global deployment.

It is important to note that multi-scan and dual-palm are only used in the registration workflow. In the verification workflow, the user only needs to scan once using either the left or the right palm.

6.1Liveness Detection Approaches

Hardware-Based. Most liveness detection solutions rely on specialized hardware. For instance:

• Apple’s Face ID: Uses a depth camera to capture a 3D facial map, which can be used to reject 2D photos.
• Ultrasonic Fingerprint Sensors: Use sound waves to capture the ridges and valleys of a finger, measuring the 3D details of fingerprints to detect 2D replicas.
• Advanced Iris Scanners: Check for the involuntary oscillation of the pupil (pupillary reflex), which is hard to fake.
• Palm Vein Recognition: Utilizes infrared cameras to capture the subdermal vein pattern, barely visible in standard RGB camera images.

Hardware-based liveness detection offers robust security and high accuracy but comes with higher costs and greater dependency on specialized components.

Software-Based. To eliminate the dependency on specialized hardware, pure software-based liveness solutions have been developed. For instance:

• Flash Screen Technique: Advanced facial recognition algorithms flash the screen to change illumination on the face, differentiating real 3D faces from faked 2D replicas. However, its effectiveness depends on environmental lighting.
• Interactive Movement Tests: Facial recognition algorithms display instructions asking the user to make certain movements, such as blinking eyes or turning heads, then verify these movements in the video.

6.2Very’s Touch Point Gesture-Based Liveness Detection

Very has developed a proprietary gesture-based liveness detection algorithm. The system prompts the user to touch specific points using the thumb tip. In each session, the location of the touch points is randomly selected.

Security Analysis. The system randomly selects which points to touch and in what order. This randomness is key to securing the system against video replay attacks.

Given 12 randomly selected touch points, the probability of the attacker successfully guessing the target touch point is 1/12. To enhance security, the user is prompted to touch a sequence of touch points with their thumb tip. The number of possible combinations of the sequence of touch points are 12^k where k is the sequence length. Therefore, the probability of the attacker successfully guessing a sequence is 1/12^k. In practice, a sequence of three touches will provide enough security for registration. For verification, a sequence of 1 to 2 touches will suffice.

Trade-off Between Security and Convenience. The touch point gesture scheme is designed to maximize security while maintaining a fluid user experience. Various types of gestures can be made by hand. For instance, digit gestures (opening a specific number of fingers) provide 1/6^k odds of guessing. Compared to the touch point gesture, to reach the same level of security, the user needs to perform a longer sequence of digit gestures. User studies show that users feel more comfortable making touch point gestures than making digit gestures.

7.1Why a Pure Software Solution

Specialized hardware is expensive and can only be produced in limited quantities, making it impractical to distribute biometric scanners to every individual globally for proof of personhood. The absence of personal biometric scanners presents significant challenges:

• Costly Deployment: Projects that utilize specialized hardware can only enroll users at designated registration centers staffed by trained technicians. The inconvenience for users, combined with high operational and logistical costs, severely limits enrollment rate. This challenge has been demonstrated by projects like WorldCoin.
• Lack of Proof of Ownership: Without personal possession of the specialized hardware, users cannot use biometrics to verify their ownership in daily transactions, creating exploitable loopholes.

7.2Device Requirements

Very has successfully developed a highly accessible solution that operates on any smartphone:

• Camera Requirements: For palm print scanning, a 200 × 200 pixel resolution in the palm area (excluding the fingers) is sufficient. A VGA resolution of 640 × 480 pixels (0.3 MP) already meets this requirement.
• Computing Power Requirement: The system is optimized for smartphones released in the last five years but can run on virtually any smartphone with a quad-core 1.6 GHz CPU and 1 GB memory.
• Operating System: Android 8 or newer, iOS 12 or newer.

7.3Compatibility Testing

Very has tested and verified a number of phone models released after 2018 from several popular brands covering over 85% of the global market.

8.1Registration Pipeline

During registration, feature extraction is performed locally. Raw biometric information remains on the edge device and is never transferred elsewhere, securing the data at the point of capture. Only encrypted palm signatures are sent to the remote server for 1-to-all matching.

The secure API protects encrypted biometrics during data transmission through:

• All API parameters shielded by a signature created with HMAC-SHA256 encryption.
• Time-bound nonce to limit the timeframe for any unauthorized attempts or replay attacks.
• All data transmission protected with secure SSL/TLS encryption.

8.2Verification Pipeline

During verification:

• End-to-End Encryption: The biometric signature is extracted and encrypted locally on the device, and remains encrypted during transit and at rest.
• Zero-Knowledge Proof (ZKP): Ensures that the user performing the verification is indeed the same one registered, by verifying the actions and results without revealing the actual data.

8.3Account Lifecycle

Revocation. Users can revoke their Very account at any time. Upon receiving a revocation request, the user will be prompted to scan their palm again to verify ownership. Once verified, the user can confirm the deletion of their account. Very will then permanently remove the encrypted palm signatures from the system. The previous Very ID will be archived but labeled as expired.

Expiry. If a Very account remains inactive for a prolonged period, such as one year, it will be subject to automatic expiration. In such cases, the user will be notified and prompted to verify their identity through a palm scan. If the user does not respond, Very will proceed to cancel the account. The encrypted palm signatures and Very ID will be permanently removed from the system to comply with GDPR regulations.

9.1False Acceptances and False Rejections

The inherent complexity of machine learning algorithms means that no system can achieve absolute perfection. Our algorithm exhibits a FAR of 10⁻⁷ and FRR of 0.015 per single scan, primarily due to variations in palm positioning during scanning, temporary changes in skin condition (e.g., injuries, moisture), and environmental factors affecting image capture quality. These challenges highlight the need for continuous algorithm optimization.

9.2Biometric Security and Deep Fake Arms Race

The evolution of Artificial Intelligence Generated Content (AIGC), particularly deepfake technology, presents escalating challenges. As deepfake technology improves, the potential risk of bypassing biometric authentication through synthetic biometric data increases. While our current liveness detection is effective, this is a continuing arms race that requires constant vigilance and adaptation.

9.3Environmental Factors

Optimal palm scanning requires reasonably good lighting conditions. Extreme environmental conditions, such as insufficient lighting or strong direct sunlight, may impact the quality of the palm image, affecting the performance of the biometric verification.

9.4Ethical and Regulatory Compliance

Biometric data collection and processing are subject to stringent regulations, including the General Data Protection Regulation (GDPR) and similar frameworks globally. Ensuring compliance with these regulations while maintaining a global and inclusive system is an ongoing challenge that requires continuous attention.