Biometric face recognition: standards, error rates and how systems are tested

This page belongs to the face recognition section and explains the biometric framing that the face verification metrics explained page assumes: what the four stages are, which standard governs their testing, and how the two error rates are set against each other.

01What makes face recognition a biometric?

A biometric system recognises a person from a measurable bodily characteristic rather than from something they know or carry. A face recognition system does this in four stages. At enrolment a reference image is converted by a feature extractor into a template, a vector of numbers; at capture a live image of one face is converted the same way; at comparison the two templates produce a similarity score; and at decision the score is tested against a threshold. NISTIR 8280 describes the algorithm as "a face detector followed by a feature extraction algorithm that converts one or more images of a person into a vector of values", with recognition proceeding by comparing two such vectors to emit a similarity score (NISTIR 8280, pages 4 to 5).

Two modes share those stages. Verification, written 1:1, compares one probe with one claimed reference and answers a yes or no question. Identification, written 1:N, searches a probe against a gallery of enrolled templates and returns candidates above a threshold or a fixed-length list. The error rates differ between the two modes, which is why the standard treats them separately.

02Which standard governs biometric testing?

ISO/IEC 19795-1:2021, "Information technology. Biometric performance testing and reporting. Part 1: Principles and framework", is the second edition of the base standard, published in May 2021 by ISO/IEC JTC 1/SC 37 and 76 pages long. Its catalogue entry says it "establishes general principles for testing the performance of biometrics systems in terms of error rates and throughput rates" and that it "specifies performance metrics for biometric systems" (ISO/IEC 19795-1:2021). It excludes deliberate subversion: measuring error rates for "people deliberately trying to subvert the intended operation of the biometric system (e.g. by presentation attacks)" is out of scope and belongs to the ISO/IEC 30107 series, whose Part 3 (second edition, January 2023) covers presentation attack detection testing and reporting.

NIST states the standard's main consequence for face recognition in one sentence: "The ISO/IEC 19795-1 performance testing and reporting standard requires different metrics to be reported for identification and verification implementations" (NISTIR 8280, section 3). The report then defines the four rates it uses, and those definitions are the ones below.

03What are the error rates, and how are they defined?

Verification has two. The false non-match rate, FNMR, is the proportion of mated comparisons, two images of the same person, whose score falls below the threshold. The false match rate, FMR, is the proportion of impostor comparisons, two images of different people, whose score lands at or above it. NISTIR 8280 writes both as functions of the threshold T: FNMR(T) is the share of N genuine scores below T and FMR(T) the share of M impostor scores above T, where "Genuine scores are produced from mated pairs; imposter scores are produced from non-mated pairs" (section 3.1).

Identification has the matching pair. FPIR, the false positive identification rate, is "the proportion of non-mated searches producing one or more candidates above threshold"; FNIR, the false negative identification rate, is "the proportion of mated searches failing to return the mate above threshold" (NIST FRTE 1:N). The 1:N page adds that each person is enrolled with one image only and that the threshold is set for each algorithm and each gallery separately.

04Why report FNMR at a fixed FMR?

Because the two rates trade against each other through the threshold, and only a pair means anything. Raise the threshold and false matches fall while false non-matches rise. NIST's FRTE 1:1 page therefore reports FNMR "at a threshold set to achieve the false match rate (FMR) specified", and orders its table by FNMR at FMR of 10^-6 on the VISABORDER set. NISTIR 8280 explains the choice of scale: thresholds are generated from quantiles of the impostor scores, spaced evenly on a logarithmic axis, "because typical operations target false match rates spanning several decades 10^-6 to as high as 10^-2" (section 3.1).

The same report warns about the alternative. In deployment "the vast majority of biometric systems are configured with a fixed threshold against which all comparisons are made", so a fair demographic comparison has to report both rates for each group at that one threshold; most academic studies instead report false negative rates at fixed false positive rates, which hides differences in FMR. Its own headline finding across 18.27 million images of 8.49 million people and 189 algorithms from 99 developers was that false positive rates "often vary by factors of 10 to beyond 100 times" across demographic groups, while false negatives vary by factors usually below 3. The NIST FRTE evaluations page covers how the ongoing test publishes these numbers.

05How does NIST test to the framework?

FRTE 1:1 has run since 2017 and, as of 6 November 2026, had evaluated 1,501 algorithms from 461 developers; FRTE 1:N has run since 2018 with 713 algorithms from 224 developers as of 6 October 2026. Developers may submit "no more frequently than four calendar months", every test image contains one face only, and from 30 November 2026 template generation must take under 2,000 milliseconds per image on a single core. Identification results are reported "at the threshold that limits the False Positive Identification Rate (FPIR) to 0.003", which the 1:N page describes as the operating point that "supports use of face recognition in making mostly automated decisions".

Academic benchmarks have adopted the same conventions. The WebFace260M benchmark's FRUITS protocol scores matchers under inference time limits of 100, 500 and 1,000 milliseconds, the last chosen to follow NIST FRVT, and reports FNMR at a fixed FMR across baselines that include the EfficientNet family (arXiv 2103.04098). Its authors placed their best model third of 430 entries on NIST FRVT at the time of writing. The EfficientNet-B4 detector page shows the same network family scored by AUC in the neighbouring field.

06How does this differ from deepfake detection scoring?

A biometric test needs two images of a person to form a mated pair, so its datasets are organised by identity and its errors are counted over pairs. A deepfake detector judges a single image or clip and its errors are counted over items, as false positives and false negatives, usually summarised by AUC over every threshold rather than by one rate at a fixed level of the other. The CNN detectors scored page shows Xception and EfficientNet-B4 under that convention; under the biometric one the same networks would be reported as FNMR at FMR.

The consent and capture conditions also differ. ISO/IEC 19795-1 tests are run on images collected under known conditions, and NISTIR 8280 notes that its four datasets "were collected for authorized travel, immigration or law enforcement processes". Detection datasets range from found YouTube footage to studio recordings of consenting actors; the DeeperForensics-1.0 dataset, with 100 paid actors under nine lighting conditions, is the detection set closest to a controlled biometric capture.