There is some similar work in the space of checking if the credentials being used by the user are compromised or not.

Example: https://arxiv.org/pdf/1905.13737.pdf