FMR and FNMR
The two ways a biometric comparison gets it wrong: accepting someone who isn't and rejecting someone who is. What each one measures, why they move in opposite directions, and which other metrics they get confused with.
In short
FMR, false match rate, is the rate of false matches: the proportion of comparisons between samples from different people in which the system declares a match. It's accepting someone who isn't who they claim to be.
FNMR, false non-match rate, is the rate of false non-matches: the proportion of comparisons between two samples from the same person in which the system declares they don't match. It's rejecting someone who is who they claim to be.
Both describe the behavior of the biometric comparison, and no system brings both to zero at the same time.
The two ways of getting it wrong
A biometric system doesn't answer yes or no. It calculates a similarity score between two templates and checks it against a threshold. The two errors appear at the edges of that decision.
- FMR — two different people produce a similarity high enough to clear the threshold. The system declares a match that doesn't exist, and an impersonation gets through.
- FNMR — two captures of the same person produce a similarity too low, because the lighting, the angle, the device or the person themselves changed. The system rejects a legitimate user, who retries or gives up.
The first is a security error and the second is a conversion error. Both have a cost, and both costs fall on the same organization.
The threshold moves one at the expense of the other
It's the central property of the term, the one that turns these two metrics into a business decision rather than a vendor spec sheet.
Raising the threshold demands more similarity to declare a match. It lowers the FMR, because it costs more for two different people to clear it. And it raises the FNMR, because a legitimate capture with poor lighting stops reaching it.
Lowering it produces the opposite effect: more legitimate users get through, and so does more of what shouldn't. How much each one moves isn't proportional: it depends on how the scores are distributed in that system and that population, which is why the two are requested together.
The point where the two rates equal each other is called the equal error rate, and it's used to compare algorithms against each other. It doesn't work as an operating point, because almost no organization considers accepting an impostor and rejecting a customer to cost the same. A bank and a content platform, using the same engine, should operate at different thresholds.
That's why a comparison between vendors based on just one of the two figures says nothing: anyone can show a very low FMR if they don't disclose the FNMR they got it at.
FMR and FNMR are not FAR and FRR
The four acronyms show up together, get used as synonyms, and they aren't. The distinction is worth making because it changes what's actually being measured.
- FMR and FNMR describe the comparison subsystem: what the algorithm does when it's given two samples.
- FAR and FRR, false acceptance and false rejection rates, describe the result of the complete system in the context of a decision: not just the comparison, but also what happens before it, like captures that fail or samples discarded for quality.
In practice a system can have an excellent comparison and still reject users in volume, because the problem is in the capture, not the algorithm. It's the difference that explains why lab report figures don't match what a team measures in production.
The operational recommendation is simple: when reading a figure, confirm which of the four you're looking at and on what population it was measured. When writing one, say so.
These aren't the errors of liveness detection
It's the confusion with the most practical consequence, because it makes a team believe it measured something it didn't.
FMR and FNMR account for similarity between two samples. They say nothing about whether the sample came from a real person present at the moment of capture.
That question is answered by liveness detection, and it has its own metrics, defined in the ISO/IEC 30107-3 standard, which are three: APCER, how many presentation attacks got through; BPCER, how many legitimate presentations were mistakenly rejected; and IAPMR, how many attack presentations ended up producing a match. The test that produces them is called PAD.
A system with a very low FMR and no presence control accepts a photograph of the holder without objection: the comparison works perfectly, and it answers a question the attacker already solved.
Frequently asked questions
FMR is false match rate, the rate of false matches: the proportion of comparisons between samples from different people in which the system declares a match. It's accepting someone who isn't who they claim to be. FNMR is false non-match rate, the rate of false non-matches: the proportion of comparisons between two samples from the same person in which the system declares they don't match. It's rejecting someone who is who they claim to be. Both describe the behavior of the comparison subsystem.
FMR describes the comparison subsystem: what the algorithm does when it compares two samples. FAR, false acceptance rate, describes the result of the complete system in the context of a decision, and factors in what happens before the comparison, like failed captures or samples discarded for quality. That's why lab report figures and what a team observes in production don't match: they're not always measuring the same thing.
Not by moving the threshold, which is what most teams have at hand: raising it lowers the FMR and raises the FNMR, though not in the same proportion. Improving both at once requires changing something else, like capture quality, the enrollment process or the algorithm itself. The threshold decision is a business decision, because it defines which of the two errors the organization is willing to absorb.
No. They measure the similarity between two samples, not whether the sample came from a person who was present. Liveness detection is measured with the metrics from the ISO/IEC 30107-3 standard, mainly APCER and BPCER, in a presentation attack detection test. They're two different controls with two different tests, and a system can have excellent comparison rates and no presence control at all.
