Facial biometrics
Identifying a person by the features of their face. What happens between capture and result, how verification differs from identification, and why the margin of error is tuned rather than eliminated.
In short
Facial biometrics is the set of techniques that identify or verify a person from the features of their face. The system captures an image, extracts a set of measurable features from it, converts them into a biometric template, and compares that template with another.
The result is never a plain yes or no. It is a similarity score checked against a threshold, and the organization sets that threshold.
What happens between capture and result
The sequence is short, and each step decides something the next one can no longer fix.
- Capture. The camera takes the image. The quality of this step shapes everything that follows: lighting, framing, resolution, and stability.
- Detection and normalization. The system locates the face within the image and aligns it to a reference position so that two different captures can be compared.
- Feature extraction. A model turns the aligned face into a vector of numeric values, which is the template. The image is no longer needed from this point on.
- Comparison. The system calculates the distance between that template and the one it has stored, and translates it into a similarity score.
- Decision. The similarity score is checked against a configured threshold. Above it, there is a match; below it, there is not.
Step 5 is where the organization's risk policy lives, not the model. Moving the threshold changes which errors the system makes, not how many correct results it gets.
One-to-one verification is not one-to-many identification
Both operations use the same technology and solve different problems, with different requirements.
- Verification (1:1) — the system compares the captured face against a single reference template, the one of the person claiming that identity. It is the operation behind an onboarding flow and an access check.
- Identification (1:N) — the system compares the captured face against an entire registry to determine who it belongs to, or whether the person is already enrolled. It is the operation behind biometric deduplication.
The practical difference is in the error: in a one-to-many comparison, each query runs N comparisons, and a false match rate that is acceptable at 1:1 produces false matches regularly once the registry grows. The two operations are not tuned to the same threshold.
Facial biometrics is not video surveillance
Search results blend the two uses, and the confusion reaches project conversations, where it gets expensive.
A video surveillance system with facial recognition looks for faces in a scene, over people who are not part of the operation and generally do not know about it. Its discussion is one of surveillance, public space, and consent.
Facial biometrics in identity verification works on a person who is going through a process at that moment, who knows their face is being requested, and who provides it to prove who they are. It is a one-off comparison with a declared purpose.
The underlying technology looks similar. The consent framework, the purpose, and the legal basis do not look alike at all, and treating them as the same topic is what turns an onboarding discussion into one about cameras in public spaces.
The margin of error is tuned, not eliminated
No biometric system is always right, and the design consists of choosing which side it errs on.
- **FMR** — the rate at which the system declares a match between two different people's faces. It is accepting someone who is not who they claim to be.
- **FNMR** — the rate at which the system fails to declare a match between two captures of the same person. It is rejecting someone who actually is who they claim to be.
The two move in opposite directions with the threshold: lowering one raises the other. A strict threshold stops impersonation attempts and also stops legitimate users, who abandon the process. A permissive threshold converts better and lets through more than it should.
And there is an error these two metrics do not capture: whether the captured face belongs to a person who is present. That question is answered by liveness detection, measured with its own metrics, and it is the one a deepfake exploits.
Frequently asked questions
It is the set of techniques that identify or verify a person from the measurable features of their face. The system captures an image, normalizes it, extracts a vector of numeric values called a biometric template, and compares that template against another. The result is a similarity score checked against a threshold, not a binary answer from the model.
Not necessarily, and in a correct design it is not what gets kept for comparison. What is stored to operate is the biometric template: a numeric representation derived from the face, not the image. The extraction is not designed to be reversed, and it generally does not allow the original photograph to be reconstructed. If the image is also kept, it is due to an evidence requirement of the process, and that decision is made and documented separately.
A face comparison alone, yes: if the presented image looks like the reference one, the comparison approves it. That is why the comparison is not used without a presence check. Liveness detection determines whether the captured face belongs to a real person present at that moment, and it is the control that tells apart an actual holder from a photograph, a screen, or a generated face.
Verification compares the captured face against a single reference template to confirm the person is who they claim to be. Identification compares it against an entire registry to determine who it belongs to. The second runs many more comparisons per query, so a false match rate that is acceptable in verification produces frequent errors in identification. They are not tuned to the same threshold.
