Zero-knowledge proofs let a verifier confirm a face matches an ID, or that a liveness check passed, without ever holding the raw biometric data. Here's how the mechanism actually works, what it prevents, and how close the identity industry is to shipping it in production KYC.
Every biometric verification vendor holds a face. Somewhere in its pipeline, encrypted at rest or not, sits the selfie captured at onboarding, or at minimum the feature vector extracted from it, the data a face-match algorithm needs to compare against an identity document's photo. That data has to exist somewhere for the comparison to run, or so the assumption goes, and it's the assumption behind every biometric vendor's retention policy, every breach-notification clause in a KYC contract, and every regulator's demand for encryption-at-rest audits on data GDPR already classifies as special category. Zero-knowledge proofs applied to biometric data start from a different premise: the comparison can happen and a verifier can trust the result without the verifier, or anyone downstream of the enrollment step, ever holding the raw face data that produced it.
This is a narrower and newer problem than the zero-knowledge work most identity teams have already encountered. Verifiable Credentials and Zero-Knowledge Proofs, Explained covers zero-knowledge proofs applied to a credential's fields, proving a birthdate claim without revealing the birthdate itself. Applying the same cryptographic idea to biometric data, a face template or a liveness result rather than a declared attribute, is a different and less-covered piece of the same puzzle. This post works through what zero-knowledge biometric verification actually is, how it differs from the credential-level version, and how close the identity industry actually is to shipping it in a production KYC flow rather than a research paper.
Biometric Verification vs. Zero-Knowledge Proofs: Where They Meet
Biometric verification today runs the same basic pipeline across nearly every vendor: a user captures a selfie or a short video, the system compares it against the photo on a submitted identity document, a similarity score comes back, and a liveness check confirms the person is physically present rather than a photo, a screen replay, or a synthetic video. Hypersign's own biometric verification stack runs this exact chain, face match, active and passive liveness, deepfake detection, and anti-spoofing, and so does every established competitor in the category. Nowhere in that chain does the raw face data need to stop existing after the check completes. Most vendors retain a template, a derived selfie, or both, for audit and dispute purposes, which is precisely the data a breach would expose.
A zero-knowledge proof, briefly, is a cryptographic technique that lets one party prove a statement is true to another party without revealing anything beyond the truth of that statement, covered in more depth in the post linked above. The gap this post addresses is that nearly all production zero-knowledge identity work so far proves something about a credential's declared field, age over 18, residency in a given jurisdiction, a KYC tier already reached. Proving something about biometric data itself, that a live capture matches a stored template, or that a liveness check passed, without either capture ever crossing the wire, is a different application of the same underlying math, and one that has barely reached production anywhere in the identity industry.
Hypersign sits at an unusual starting point for that gap. Its biometric verification product runs face match, liveness, and anti-spoofing in production today, and its selective disclosure layer already runs zero-knowledge threshold proofs in its KYC widget today, just over credential attributes rather than biometric templates. That is not a claim that the two are combined yet, they are not, but it is a different position than either a KYC vendor with no zero-knowledge work at all, or a cryptography project with no production biometric pipeline to attach it to.
How Zero-Knowledge Biometric Verification Actually Works
The mechanism starts at capture. Instead of transmitting a selfie or its extracted feature vector to a verifier, the system generates a cryptographic commitment to the template, a one-way binding that can be checked against later without being reversible back to the original face. BioZero, an academic protocol for on-chain biometric authentication, describes exactly this construction: homomorphic commitments paired with zero-knowledge proofs, producing an authentication decision that's publicly verifiable while the underlying biometric template stays hidden from every party, including the verifier.
At verification time, a new capture runs through a proving circuit, typically a zk-SNARK, that proves the distance between the new capture and the committed template falls under a matching threshold, without revealing either the new capture or the stored template to the party checking the proof. ZKP-Identity, an open-source attribute-verification system, builds this kind of circuit with Circom and the Groth16 proving system, a concrete example of the tooling this class of proof actually runs on rather than an abstraction. zkBiometric applies the same idea specifically to biometric identity, using RISC Zero's zkVM so a service provider can verify an identity claim without ever accessing the sensitive biometric data behind it.
Not every ZK-adjacent identity project operates at this exact layer. Rarimo's passport-zk-circuits is a real, working, open-source implementation, and it deserves credit as one, but it proves something narrower: that a passport's embedded chip signature is valid and tied to a unique identity, letting a holder skip re-scanning a physical document. That's zero-knowledge work over a document's cryptographic signature, not over a face template, a useful and shipped piece of the identity stack, just not the same proof this post is describing.
The same construction extends to liveness. A circuit can attest that a capture passed a liveness check, blink detected, head movement validated, texture and depth signals consistent with a real human, as part of the same proof, without the video or image that produced that result ever leaving the device or the verification enclave.
What This Actually Prevents
GDPR Article 9 classifies biometric data used for unique identification as a special category, subject to stricter processing conditions than ordinary personal data, precisely because it carries a risk a password does not: a face cannot be rotated after a breach the way a credential can. Every biometric vendor holding raw templates or selfies at scale is a concentrated target, and the retention itself, not just weak security around it, is the exposure. A zero-knowledge biometric proof removes that target by design, there is no centrally held template to exfiltrate, only a one-way commitment that reveals nothing about the underlying face even if it leaks.
Where This Fits with Liveness Detection and Deepfakes
As covered in Deepfakes in 2025: How Liveness Detection Stays Ahead, the raw video or image a liveness check produces is itself becoming a liability worth minimizing, not just a technical artifact to secure. Every stored liveness capture is one more piece of biometric data that could inform a future deepfake targeting the same subject, or simply another record a vendor has to defend under the same GDPR Article 9 obligations described above. A zero-knowledge liveness proof would let the pass or fail result travel to a verifier while the capture that produced it never leaves the device or the enclave it was generated in. This is a forward-looking framing rather than a description of standard practice, no major liveness engine ships this today, but it follows directly from the same commitment-and-proof mechanism already running in projects like zkBiometric.
Why This Isn't Mainstream in KYC Yet
A direct search for zero-knowledge biometric verification today surfaces academic papers, open-source repositories, and Web3-native identity projects, not a single established KYC or identity-verification vendor. None of the major players in document and biometric verification have a shipped, production zero-knowledge biometric proof in market. What exists in production lives almost entirely in on-chain identity projects, passport-zk-circuits, zkBiometric, and research work like BioZero, rather than mainstream fintech or exchange onboarding flows.
Part of the reason is operational, not just inertia. A KYC audit trail traditionally rests on a retained record a compliance team can point to later, a stored selfie, a match score, a decision log. A zero-knowledge proof, by design, discards the underlying data that produced the result, which means the industry still has to work out what a defensible audit trail looks like when the thing being audited is a cryptographic proof rather than a retained transcript. That's an open regulatory and operational question, not a solved one, and any post claiming otherwise is overselling where the category actually stands..
Where Hypersign's Two Halves Meet
Hypersign runs production biometric verification, face match, active and passive liveness, deepfake detection, and anti-spoofing, at /platform/biometric-verification. It also runs production zero-knowledge threshold proofs today through Selective Disclosure and Zero-Knowledge Age Proofs, proving a credential attribute like age or KYC tier without revealing the underlying value. Extending that same proof infrastructure to run directly over biometric template data, rather than a credential's declared field, is the next logical application of cryptography Hypersign already has live, not a new capability requiring new tooling from scratch. To be precise about where that stands today: Hypersign does not have a zero-knowledge proof running over raw biometric templates in production, and neither does any other identity verification vendor surveyed for this post. What Hypersign has is both halves of the eventual combination already shipped separately, a position closer to production than either a pure biometric vendor with no zero-knowledge work, or a zero-knowledge research project with no biometric verification pipeline to run it on.
Where This Leaves You
A zero-knowledge biometric proof lets a verifier trust that a face matched a document, or that a liveness check passed, without ever holding the data that produced that result. The cryptographic pieces, commitments, zk-SNARK circuits, proving systems like Groth16, are already running in open-source projects like zkBiometric and research protocols like BioZero. What's missing is production deployment inside a mainstream KYC flow, and a settled answer on what an audit trail looks like once the underlying capture is never retained. Evaluate any vendor's zero-knowledge biometric claims against that gap specifically: ask whether the proof runs over the biometric data itself or only over a credential's declared field, and ask what happens to the audit trail a compliance team would need six months later.
References
Primary sources for the citations above:
BioZero: Privacy-Preserving and Publicly Verifiable On-Chain Biometric Authentication (arXiv)
Academic protocol combining homomorphic commitments and zero-knowledge proofs to keep biometric templates hidden while authentication stays publicly verifiable.
passport-zk-circuits (GitHub, Rarimo)
Open-source zero-knowledge circuits proving passport chip-signature validity, cited as an adjacent but distinct document-level ZK implementation.
Regulation (EU) 2016/679, Article 9 (GDPR, EUR-Lex)
Classifies biometric data used for unique identification as a special category of personal data.
