Know Me by My Pulse: Toward Practical Continuous Authentication on Wearable Devices via Wrist-Worn PPG

Know Me by My Pulse: Toward Practical Continuous Authentication on Wearable Devices via Wrist-Worn PPG

Speakers: Wei Shao

Conference: NDSS Symposium 2026

YouTube: https://www.youtube.com/watch?v=yIKVM1Ko2FM

Overview

Wearable devices store increasingly sensitive data -- health information, messages, and payment credentials -- yet their authentication systems only verify the user once (via PIN, fingerprint, or face unlock), leaving the device trusted indefinitely afterward. If the device is stolen, removed, or handed to someone else, access persists. This talk presents the first practical continuous authentication system for wearable devices using low-rate, multi-channel Photoplethysmography (PPG) -- the optical blood volume sensing already built into most commercial smartwatches. The key insight is that 25 Hz, 4-channel PPG is sufficient for biometric authentication, achieving 88% average test accuracy with an Equal Error Rate (EER) of approximately 3%, a False Acceptance Rate of 0.48%, and a battery life of 26+ hours with continuous authentication enabled. The system uses a bidirectional LSTM with attention mechanism and rejects impostors within 4 seconds (one sliding window), demonstrated in real-time on actual wearable hardware.

Background

▶ Watch: Key insight: low-rate multi-channel PPG is all you need (1:00)

Traditional authentication on wearable devices is a one-time gate: authenticate once, and the device remains trusted until explicitly locked. This creates a security gap for devices that are easily removed, handed off, or stolen. Continuous authentication -- ongoing verification that the current wearer is the authorized user -- addresses this gap but faces severe constraints on wearable hardware: limited battery, limited computation, and limited sensing modalities.

Prior approaches explored behavioral biometrics (motion patterns), which are highly context-dependent, and ECG (electrocardiogram) signals, which are accurate but require user interaction (touching a sensor) and are not available on most commercial devices. PPG is the most promising alternative: it is non-intrusive (no user action required), measures blood volume changes under the skin using optical sensors, and is already embedded in most commercial smartwatches. However, prior PPG authentication research assumed high sampling rates (75-500 Hz), which drain battery rapidly, and lacked real-world evaluation.

Key Findings

▶ Watch: 25 Hz multi-channel PPG achieves 88% accuracy, 3% EER (5:30)

25 Hz is the practical sweet spot: Comparing sampling rates from 5 Hz to 512 Hz, performance drops significantly below 25 Hz but gains above 25 Hz are marginal. Meanwhile, 512 Hz doubles power consumption compared to 25 Hz, and 128 Hz consumes 25% more. Further reduction to 20 Hz provides only marginal power savings with sharp performance degradation.

Multi-channel sensing is essential at low frequencies: Single-channel PPG at 25 Hz performs notably worse than 4-channel PPG. Multiple channels compensate for the lower resolution by providing complementary views of blood volume dynamics.

Activity-diverse training is necessary for robustness: Models trained only on resting data perform significantly worse in real-world conditions. Training with diverse activities (walking, typing, exercising) enables generalization to unseen activities (driving, gym workouts) in a zero-shot manner.

Cross-session stability confirmed: Performance remains stable across multiple sessions over 10 days, with no degradation over time when using multi-channel data with activity-diverse training.

Battery life exceeds one day: With continuous authentication enabled at 25 Hz, the WB Band smartwatch achieves approximately 26 hours of battery life -- more than sufficient for daily use.

Technical Deep Dive

▶ Watch: Activity-diverse training essential for real-world robustness (7:30)

The system architecture consists of four stages: data collection, signal segmentation, sequential modeling, and sliding window authentication.

Data collection uses a 4-channel PPG sensor at 25 Hz on the WB Band research-oriented smartwatch. Two datasets were used: a custom WB dataset (26 subjects, uncontrolled environment, multiple sessions, natural daily activities) and the PTBXL public dataset (512 Hz, controlled environment) for sampling rate comparison.

Signal segmentation divides the continuous PPG stream into 4-second windows with 50% overlap, providing authentication decisions every 2 seconds.

Sequential modeling uses a Bidirectional Long Short-Term Memory (BiLSTM) with attention mechanism. The BiLSTM processes the time series in both forward and backward directions, capturing temporal dependencies from both directions. The attention mechanism weights the importance of different time points. This architecture was selected through systematic comparison: regular LSTM performed well at high frequencies but poorly at 25 Hz; Transformer performed better than LSTM but worse than BiLSTM+attention; the bidirectional processing and attention weighting compensate for the lower resolution of 25 Hz signals.

Sliding window authentication makes a binary decision (authentic/impostor) every 4 seconds. The evaluation protocol uses subject-disjoint train/test splits and cross-session evaluation to prevent data leakage.

Demo / Proof of Concept

▶ Watch: Long-term evaluation: stable performance over 10 days, 26-hour battery (10:30)

A real-time demonstration deploys the full system on the WB Band smartwatch. The protocol: the authenticated user wears the device for 4.5 minutes, then two impostors each wear it for 2.5 minutes, followed by the authenticated user returning for 2.5 minutes. The system correctly authenticates the legitimate user, rejects both impostors within one sliding window (under 4 seconds), and re-authenticates the legitimate user upon return. The system stabilizes quickly after initial wear and runs in real-time on actual wearable hardware with no performance issues.

Defensive Implications

▶ Watch: Real-time demo: impostors rejected within 4 seconds (12:00)

For wearable device manufacturers, this research demonstrates that continuous authentication is now practical with existing hardware. The 25 Hz multi-channel PPG approach works with sensors already present in commercial devices, requiring no additional hardware. The 26-hour battery life with continuous authentication removes the primary adoption barrier.

For healthcare and enterprise security, continuous authentication on wearable devices ensures that collected biometric data is associated with the correct individual, preventing data contamination. In clinical trials or enterprise health monitoring programs, this guarantees data provenance.

For device security architects, the 0.48% FAR means that an unauthorized user has less than a 1-in-200 chance of being accepted per authentication window. With authentication checks every 4 seconds, the probability of sustained unauthorized access drops rapidly. The 11.77% FRR means occasional legitimate user rejections, which may require re-authentication.

Key Takeaways

• 25 Hz, 4-channel PPG is sufficient for continuous biometric authentication on wearable devices
• Multi-channel sensing is essential to compensate for lower sampling rates
• Activity-diverse training enables zero-shot generalization to unseen activities
• BiLSTM with attention outperforms both regular LSTM and Transformer architectures at 25 Hz
• Impostors are rejected within 4 seconds in real-time demonstration
• Battery life exceeds 26 hours with continuous authentication enabled
• 0.48% FAR and 3% EER demonstrate practical security for wearable deployment

About the Speaker(s)

Wei Shao is a researcher working on biometric authentication, wearable security, and signal processing for physiological signals. The research demonstrates both theoretical contributions (low-frequency PPG authentication) and practical engineering (real-time deployment on commercial-grade wearable hardware).