EarAuth: Towards Practical Cardiac Vibration Authentication on COTS Wireless Earbuds

True Wireless Stereo earbuds (TWS) have evolved into multifunctional devices with biometric sensing and motion tracking, making secure authentication essential. However, existing methods often require user interaction or access to specific hardware, limiting their applicability in commercial TWS earbuds like AirPods. In this paper, we propose EarAuth, an in-ear Ballistocardiogram-based authentication system that uses the built-in IMU to capture cardiac vibrations for passive, continuous authentication. Unlike movement-dependent IMU methods, EarAuth requires no user effort and is resistant to spoofing, leveraging internal physiological signals. To improve signal reliability, we develop signal processing modules and introduce a personalized heartbeat simulator for increasing physiological diversity. Additionally, using a Siamese network-based metric learning framework, we map in-ear Ballistocardiogram signals to a discriminative embedding space, ensuring robust authentication and adaptation to long-term cardiac feature drift. Our solution is scalable, energy-efficient, and integrates seamlessly with COTS TWS earbuds, preserving core functionalities.