Biometric Recognition Systems

A biometric recognition system recognizes a person from a measurement of the body or of behaviour: a face image, an iris image, a fingerprint, a voice recording, a walking pattern. NIST’s digital identity guidelines define biometrics as the automated recognition of individuals based on their biological and behavioural characteristics, and list fingerprints, voice patterns, facial features, keystroke patterns, typing speed, mouse movements and gait among them (Temoshok et al., 2025). The everyday names are biometric authentication (unlocking a phone, passing an e-gate) and biometric identification (searching a database for a person). Three of the main modalities are images, so most of a biometric system is computer vision: finding the face, eye or finger, checking image quality, extracting a template and comparing templates.

This article covers the system around the matcher: enrolment, verification and identification as operations; the face, iris and fingerprint modalities and what NIST’s evaluations measured for each; the vocabulary of error rates and how capture failures enter it; the equal error rate and detection error trade-off (DET) curves in biometric practice; presentation attacks and their detection; template protection; demographic differentials; and the rules that official documents set for deployment. The face matcher itself, its benchmarks and NIST’s face demographic study in detail are in face recognition. This article gives no guidance on deploying surveillance; it describes methods, evidence and documented limits.

Problem

A biometric system answers one of two questions, and the difference decides almost everything else about it.

• Verification (one-to-one, 1:1). A person claims an identity, by presenting a card or account name or simply by holding their own phone, and the system compares a new sample with the template stored for that identity. The answer is accept or reject.
• Identification (one-to-many, 1:N). No identity is claimed. The system searches the sample against a gallery of $N$ enrolled templates and returns zero or more candidates. IREX IX points out that a person presenting themselves to an access-control system that uses identification still makes an implicit claim: that they are enrolled (Quinn, Grother & Matey, 2018).

Both start with enrolment: capture one or more samples, check their quality, extract a template and store it with an identity label. NIST’s FRVT Part 3 report defines the vocabulary used here, for faces: a sample is one or more images of a person’s face; a template is the data a recognition algorithm produces from a sample, including a feature vector; a comparator produces a similarity score from two templates; a searcher returns a candidate list from a gallery; a threshold turns scores into decisions (Grother, Ngan & Hanaoka, 2019, FRVT Part 3). Some samples cannot be turned into templates at all, which creates errors that the comparator never sees (see Evaluation).

The two questions differ in scale. In verification each attempt is one comparison. In identification each search is $N$ comparisons, and a non-enrolled person is falsely matched if any of them succeeds. Daugman (2004) wrote the consequence down for independent comparisons: if one comparison falsely matches with probability $P_1$, a search of $N$ unrelated templates falsely matches with probability

$$P_N = 1 - (1 - P_1)^N .$$

His example is a verifier with a false match rate of 0.1%: searched against 200 unrelated faces it falsely matches someone 18% of the time, and against 2,000 faces 86% of the time. A system for large galleries therefore needs a matcher whose impostor scores have a very thin tail, or a threshold that tightens as $N$ grows. Daugman’s iris system does the latter: its threshold adapts to keep $P_N$ below $10^{-6}$, which for a database of a million irises means lowering the Hamming-distance criterion only from 0.33 to 0.27 (Daugman, 2004).

Visual Data

Face

Face images come from ordinary cameras, from passport and visa photographs to phone cameras and video. They can be captured at a distance and without the subject’s cooperation, which makes face convenient to collect and also raises the privacy concerns discussed below. NIST’s face evaluations run on sequestered government photographs: mugshots, visa and immigration application photographs and border-crossing images (Grother, Ngan & Hanaoka, 2019, FRVT Part 3). The pipeline of face detection, alignment with facial landmarks and an embedding network is described in face recognition.

Iris

Iris images are taken in near-infrared light. Daugman’s systems used monochrome cameras with near-infrared illumination in the 700–900 nm band, because it is unobtrusive and because even darkly pigmented irises show rich texture at those wavelengths; he recommends that the iris radius span at least 70 pixels, and 80–130 pixels was typical in field trials (Daugman, 2004). NIST’s FRVT Part 3 report adds that recognizing irises in purely visible-light images is highly problematic for brown-eyed people, because melanin absorbs visible light, and that the difficulty and expense of imaging the iris at long distances limit its use in applications such as surveillance (Grother, Ngan & Hanaoka, 2019, FRVT Part 3). Most current cameras capture both eyes at once; IREX IX reports accuracy for two-eye templates for that reason (Quinn, Grother & Matey, 2018).

Fingerprint

Fingerprints are captured by live-scan sensors (single-finger, four-finger slaps, ten-print) or, in older records, by scanning inked cards. NIST’s NBIS user guide explains that two fingerprints have traditionally been compared using minutiae, points where a friction ridge ends (a ridge ending) or splits (a bifurcation), each recorded with its location and the orientation of its ridge; a ten-print card has on the order of 100 minutiae, a latent print left at a crime scene perhaps a dozen (Watson et al., 2007). Fingerprint images are a computer vision problem of their own (ridge-flow estimation, binarization, minutia detection), but they are not taken with a general-purpose camera, and this article treats them mainly through their evaluations.

Other modalities

Voice, gait, keystroke dynamics and the way a phone is held are in NIST’s list of biometric characteristics (Temoshok et al., 2025). Voice is audio rather than vision; gait, recognizing people from how they walk, is a video modality.

Vision Tasks Involved

• Detection and localization of the face, eye or finger. Daugman’s iris system localizes the pupil and the limbus (the outer boundary of the iris) with an integro-differential operator, a blurred derivative with respect to radius of the image integrated along circles, searched over centre and radius from coarse to fine; the pupil and iris circles are estimated separately because they are often not concentric, and the pupil radius can range from 0.1 to 0.8 of the iris radius. Eyelids are then fitted as arcs (Daugman, 2004). For faces this step is face detection.
• Segmentation and masking of regions that do not belong to the trait: eyelids, eyelashes, specular reflections, the boundary artefacts of hard contact lenses (Daugman, 2004).
• Quality assessment. Daugman’s system measures focus in real time from the spectral power in middle and upper frequency bands, and rejects images in which less than 50% of the iris is visible between the eyelids (Daugman, 2004). IREX IX found that the accuracy of iris recognition is dominated by the small fraction of samples with significant quality problems such as motion blur or eyelid occlusion (Quinn, Grother & Matey, 2018).
• Normalization and feature extraction: unwrapping the iris, aligning the face, enhancing ridges, then computing a template (image quality assessment and image segmentation cover the general methods).
• Comparison and search, by a distance between templates or a learned comparator, and fast search over large galleries.
• Presentation attack detection, a classification of whether the sample comes from a live person presenting their own trait (see below).

Common Methods

Iris codes

Daugman’s phase code was, by his 2004 account, the software used in all iris recognition systems deployed commercially or in tests up to then (Daugman, 2004).

1. Rubber-sheet normalization. Each iris point is mapped to dimensionless polar coordinates: an angle, and a radius running from the pupil boundary (0) to the limbus (1). Because the radius is normalized, the mapping models pupil dilation as the stretching of a homogeneous rubber sheet and removes the effects of iris size and position.
2. Phase demodulation. The normalized iris is projected onto complex-valued 2D Gabor wavelets at many positions, scales and frequencies, and the phase of each complex coefficient is quantized to its quadrant, two bits per coefficient. Only phase is kept, because amplitude depends on contrast, illumination and camera gain and is not very discriminating. Altogether 2,048 phase bits (256 bytes) are computed, with an equal number of mask bits flagging bits under eyelids, eyelashes or reflections.
3. Comparison by masked Hamming distance. Two codes $A$ and $B$ with masks are compared by the fraction of usable bits that disagree,

$$\mathrm{HD} = \frac{\lVert (\mathrm{code}_A \oplus \mathrm{code}_B) \cap \mathrm{mask}_A \cap \mathrm{mask}_B \rVert}{\lVert \mathrm{mask}_A \cap \mathrm{mask}_B \rVert},$$

so HD is a dissimilarity: 0 for identical codes, about 0.5 for unrelated ones. Head tilt and eye rotation rotate the iris, so the codes are compared at several relative rotations by cyclically shifting the angular coordinate, and the smallest HD is kept.

Daugman calls recognition the failure of a test of statistical independence. In 9,060,003 comparisons between different eyes (4,258 images from trials in Britain, the USA, Japan and Korea), the Hamming distances had mean 0.499 and standard deviation 0.0317, and followed a binomial distribution with $N = p(1-p)/\sigma^2 = 249$ degrees of freedom. Had all 2,048 bits been independent, the standard deviation would have been only 0.011; internal correlations, especially radial ones, leave the equivalent of 249 coin tosses. Keeping the best of seven relative rotations shifted the impostor distribution down to a mean of 0.458, as extreme-value sampling predicts. The left and right eyes of the same person (648 eyes of 324 people) were as different as unrelated eyes, mean HD 0.497 (Daugman, 2004).

Fingerprint minutiae

Fingerprint matchers compare sets of minutiae, which must be paired up despite rotation, translation, skin distortion and partial overlap. NBIS documents NIST’s minutia detector (MINDTCT), in the open-source part of the distribution, and its matcher (BOZORTH3), in the export-controlled part (Watson et al., 2007). Commercial matchers are evaluated by NIST as black boxes in its Fingerprint Vendor Technology Evaluation (FpVTE), whose results are summarized under Evaluation.

Face embeddings

Face matchers moved from eigenfaces through DeepFace and FaceNet to embeddings trained with margin-based losses such as ArcFace and compared by cosine similarity, a history told in face recognition. One difference from iris codes is the score convention: NIST’s FRVT Part 3 report notes that face and fingerprint algorithms traditionally compute similarities, iris algorithms dissimilarities (Grother, Ngan & Hanaoka, 2019, FRVT Part 3), so a stricter threshold is a higher face score but a lower iris Hamming distance.

Combining samples and modalities

More samples per person lower error rates. In FpVTE the most accurate ten-finger searches had about a twentieth of the single-index-finger miss rate, against galleries 30 to 50 times larger (see the table below). IREX IX found that two-eye comparisons do not improve accuracy as much as independent eyes would, because blinks, squints, dilation and head roll affect both eyes of one capture together; the shared roll is also an advantage, since it can be compensated once for both eyes (Quinn, Grother & Matey, 2018). NIST’s FRVT Part 3 report describes a compound “face-and-iris” biometric, possible with cameras that capture both at once, in which both must match against their own thresholds so as to limit false positives, unlike convenience-driven systems that accept either one (Grother, Ngan & Hanaoka, 2019, FRVT Part 3).

Challenges

• Intra-class variation from capture. Pose, illumination, expression and ageing for faces; blur, dilation, occlusion and camera differences for irises; skin condition and pressure for fingers. Daugman’s decision environments show how strongly the genuine distribution depends on capture: in a laboratory with one camera, fixed distance and fixed lighting more than half of same-eye comparisons scored HD 0.00 and the mean was 0.019, while images from different cameras and distances gave a mean of 0.110 and a much wider spread (decidability $d' = 14.1$ against 7.3; Daugman, 2004). For the second case the text says the impostor side is the same 9.1 million comparisons as before, while the figure is labelled 2.3 million comparisons with an impostor mean of 0.458.
• Impostor tails. Large-scale identification depends on the few highest-scoring impostor comparisons. By NIST’s account, contemporary marketplace face algorithms do not distinguish identical twins, while published iris feature extraction algorithms do (Grother, Ngan & Hanaoka, 2019, FRVT Part 3).
• Attacks. A biometric is not a secret: NIST notes that a facial image can be obtained by taking a picture, latent fingerprints from objects someone touches and iris patterns with high-resolution cameras (Temoshok et al., 2025).
• Irrevocability. A password can be changed; a face or fingerprint cannot, which is the motivation for template protection.

Evaluation

Matching errors: FMR and FNMR

A verification test forms two sets of scores: genuine (mated) scores from comparisons of samples of the same person, and impostor (non-mated) scores from different people. NIST notes that “genuine” and “impostor” are verification terms, while “mate” and “nonmate” are traditional in identification (Grother, Ngan & Hanaoka, 2019, FRVT Part 3). For a similarity score and threshold $T$, with $N$ genuine scores $u_i$ and $M$ impostor scores $v_i$, the report defines

$$\mathrm{FNMR}(T) = 1 - \frac{1}{N}\sum_{i=1}^{N} H(u_i - T), \qquad \mathrm{FMR}(T) = \frac{1}{M}\sum_{i=1}^{M} H(v_i - T),$$

where $H$ is the unit step with $H(0) = 1$: a false non-match is a genuine score below threshold, a false match an impostor score at or above it. For a dissimilarity such as the iris Hamming distance the inequalities reverse; IREX IX accepts a claim when the score is at or below the threshold (Quinn, Grother & Matey, 2018). NIST generates thresholds from quantiles of the impostor scores, so that FMR values are evenly spaced on a logarithmic axis, because operational targets span false match rates from $10^{-6}$ to $10^{-2}$ (Grother, Ngan & Hanaoka, 2019, FRVT Part 3).

Transactional errors: FAR and FRR

FMR and FNMR describe comparisons of samples by an algorithm. A deployed system makes decisions about transactions, which may involve several capture attempts and can fail before any comparison happens. NIST’s FRVT Part 2 report separates the terms this way: FMR and FNMR for 1:1 matching, the false accept rate (FAR) and false rejection rate (FRR) for 1:1 transactions, and FPIR and FNIR for 1:N matching (Grother, Ngan & Hanaoka, 2019, FRVT Part 2); both NIST face reports point to the ISO/IEC 19795 testing standard for the formal metrics. IREX IX prefers FMR and FNMR to the “analogous but less general” FAR and FRR, which by its account apply only when an authoritative claim is made about the origin of the sample (Quinn, Grother & Matey, 2018). Benchmark papers often say FAR where NIST would say FMR, as the face recognition article notes.

Failures to enrol and to extract

When an algorithm cannot make a template from an enrolment image, that is a failure to enrol (FTE); the failure on a search or probe image is a failure to extract (FTX) in FRVT Part 3 and a failure to acquire (FTA) in IREX IX. NIST’s FRVT Part 3 report folds these failures into its accuracy figures. In verification it treats any comparison that involves a failed template as producing a zero similarity score, which raises FNMR and lowers FMR; in identification a failed enrolment makes mated searches fail and, to first order, reduces FPIR by a factor $1 - \mathrm{FTE}$. The report calls this the correct treatment for cooperative access control, but not for negative identification such as visa fraud detection, where a template failure should be investigated as though a false alarm had occurred (Grother, Ngan & Hanaoka, 2019, FRVT Part 3). IREX IX asked algorithms to return “blank templates” that compare at effectively infinite dissimilarity, and remarks that this does not reflect operation, where a cooperative user would be asked for a new sample or offered another modality (Quinn, Grother & Matey, 2018). The two conventions answer different questions, and the example below prints both.

DET curves, the equal error rate and $d'$

Plotting FNMR against FMR as the threshold varies gives the error trade-off. NIST notes that such plots are called DET or ROC curves and differ in whether they plot an error rate or its complement and in how the axes are transformed, usually logarithmically (Grother, Ngan & Hanaoka, 2019, FRVT Part 2); IREX IX states that DET curves have become the standard in biometric testing, superseding ROC curves, because logarithmic axes show the low-error region where good matchers differ (Quinn, Grother & Matey, 2018). The original DET curve with normal-deviate axes and the definition of the equal error rate (EER), the error rate where the two curves cross, are in ROC curve and AUC. The EER is a convenient single number, but no deployed system needs to operate there: NIST’s guidelines, for example, fix the FMR at $10^{-4}$ or better and ask for FNMR below 5% (Temoshok et al., 2025), so the operating point is FNMR at a fixed low FMR. Daugman (2004) also reports the decidability index

$$d' = \frac{|\mu_1 - \mu_2|}{\sqrt{(\sigma_1^2 + \sigma_2^2)/2}},$$

the separation of the genuine and impostor means in units of their pooled standard deviation, which does not depend on any threshold.

How low an FMR can be measured. An FMR is estimated from impostor scores, so the lowest measurable value is limited by the number of impostor comparisons $M$. NIST plots FMR down to a level that should be somewhat higher than the “rule of three” limit $3/M$, because comparisons are not independent when the same image is used in many of them (Grother, Ngan & Hanaoka, 2019, FRVT Part 3); IREX IX accounts for the correlation between comparisons in its confidence intervals (Quinn, Grother & Matey, 2018). The general issue is discussed in statistical significance in evaluation.

Identification errors

Identification is scored by the false positive identification rate $\mathrm{FPIR}(N, T)$, over searches by people who are not enrolled, and the false negative identification rate $\mathrm{FNIR}(N, R, T)$, over searches by enrolled people, both defined in NIST’s FRVT Part 2 report and explained, with the closed- and open-set settings and the CMC, in face recognition. IREX IX computes false positives only from searches by people who are not enrolled, rather than from mated searches with the correct candidate removed, as more reflective of operation (Quinn, Grother & Matey, 2018).

NIST’s evaluations by modality

NIST runs separate technology evaluations for each modality, on sequestered operational data that participants never see. Each result below holds only for its dataset, gallery size and operating point; NIST itself warns against extrapolating the iris numbers to other conditions (Quinn, Grother & Matey, 2018).

Modality	Evaluation	Data	Most accurate result reported
Iris (two eyes)	IREX IX Part One (2018), 46 algorithms from 13 developers	673,662 field-collected iris samples of 260,809 people (OPS-III, 2007–2015)	1:1: FNMR 0.0057 at FMR $10^{-5}$; 1:N: FNIR 0.0067 at FPIR $10^{-3}$, 160,000 enrolled
Fingerprint, single index finger	FpVTE (2014)	Operational data, about 10 million subjects in the test sets; 10,000 mated and 20,000 non-mated searches	FNIR 1.9% at FPIR $10^{-3}$, 100,000 enrolled
Fingerprint, two index fingers	FpVTE	as above	FNIR 0.27% at FPIR $10^{-3}$, 1.6 million enrolled
Fingerprint, ten-finger identification flats	FpVTE	as above	FNIR 0.09% at FPIR $10^{-3}$, 3 million enrolled
Fingerprint, ten-finger rolled-to-rolled	FpVTE	as above	FNIR 0.1% at FPIR $10^{-3}$, 5 million enrolled

Sources: Quinn, Grother & Matey (2018); Watson et al. (2014). The fingerprint numbers are from FpVTE’s first report, based on 30,000 search subjects; NIST announced a larger search set so that lower FPIR could be reported. FpVTE flags as needing further study its finding that two index fingers were more accurate than four-finger identification flats, and suggests that image quality may have played a role (Watson et al., 2014). IREX IX attributes its much lower error rates than earlier iris evaluations to removing ground-truth errors (samples filed under the wrong person), better algorithms and better-quality data from newer two-eye cameras (Quinn, Grother & Matey, 2018). Face results are tabulated on NIST’s continuously updated FRTE pages, summarized in face recognition.

Example: Iris Codes, Error Rates and a Protected Template

The example builds a small iris recognizer on synthetic eye images and evaluates it as NIST’s reports describe. Each of 200 identities is a random iris texture, smooth and streaked along the radius, on a polar grid. Each of four captures per identity renders a $128 \times 128$ eye image with a random pupil dilation, iris size, centre, in-plane rotation of up to $\pm 10^\circ$ (head tilt), a mild radial distortion that the rubber-sheet model does not undo, an upper eyelid at a random height, blur, gain and noise. Segmentation is not part of the example: the encoder receives the true circles and eyelid line with errors of up to one pixel.

The encoder follows Daugman’s design at small scale: rubber-sheet unwrapping onto a $16 \times 256$ grid, a complex Gabor filter along the angle (after slight radial smoothing), two phase bits at $8 \times 128$ points (2,048 bits), and mask bits for points above the estimated eyelid. A capture fails the quality gate, and counts as a failure to enrol, when less than half its bits are usable, after Daugman’s 50% visibility rule. All $800 \times 799 / 2$ pairs are compared by masked Hamming distance.

Two choices that the sources leave open are printed both ways: whether codes are compared at one orientation or at the best of cyclic shifts of up to $\pm 5$ code columns ($\pm 14^\circ$), and whether captures that fail the quality gate are excluded (as if the person had been recaptured) or kept with the worst possible score, as in NIST’s convention. The script then prints DET points, an identification test with a 100-person gallery against Daugman’s formula for $P_N$, and the fuzzy commitment of Hao, Anderson and Daugman (2005) described under Template Protection. It shows full output for seed 0 and a summary for seeds 0–2. NumPy 2.3.5 and SciPy 1.16.3; the three seeds take about a minute on a laptop CPU.

import numpy as np
from scipy import ndimage

H, NR, NT = 128, 16, 256                       # image size; rubber-sheet grid (radius x angle)
yy, xx = np.mgrid[0:H, 0:H].astype(float)
rr = np.linspace(0.05, 0.95, NR)[:, None]      # normalized radius, pupil (0) to limbus (1)
tt = np.arange(NT)[None, :] * 2 * np.pi / NT

def identity(rng):
    """An iris texture: smooth random field on (radius, angle), streaked radially."""
    f = ndimage.gaussian_filter(rng.standard_normal((48, 512)), (4, 1.5), mode=("nearest", "wrap"))
    return f / f.std()

def capture(tex, rng):
    """One 128x128 eye image of an identity, and the (slightly wrong) segmentation."""
    cx, cy = 63.5 + rng.uniform(-3, 3, 2)
    rp, ri = rng.uniform(14, 24), 52 * rng.uniform(0.97, 1.03)     # pupil dilation, iris size
    rot, gam = np.deg2rad(rng.uniform(-10, 10)), rng.uniform(0.9, 1.1)
    rho = np.hypot(xx - cx, yy - cy)
    th = (np.arctan2(yy - cy, xx - cx) - rot) % (2 * np.pi)          # head tilt rotates the iris
    r = np.clip((rho - rp) / (ri - rp), 0, 1) ** gam                 # not quite a rubber sheet
    t = ndimage.map_coordinates(tex, [r * 47, th / (2 * np.pi) * 512], order=1, mode="grid-wrap")
    img = np.where(rho < rp, 0.08, np.where(rho < ri, 0.45 + 0.12 * t, 0.75))
    lid = cy - ri * rng.uniform(-0.05, 1.0)                          # upper eyelid line
    img = np.where(yy < lid, 0.6, img)
    img = ndimage.gaussian_filter(img, rng.uniform(0.5, 1.2)) * rng.uniform(0.8, 1.2)
    img = img + 0.03 * rng.standard_normal(img.shape)
    seg = np.array([cx, cy, rp, ri, lid]) + rng.uniform(-1, 1, 5)   # segmentation error +-1 px
    return img, seg

k = np.arange(NT); k = np.where(k > NT // 2, k - NT, k)
lam, sig = 16.0, 6.0                                                 # Gabor wavelength, width (samples)
gabor = np.exp(-k**2 / (2 * sig**2)) * (np.exp(2j * np.pi * k / lam) - np.exp(-2 * (np.pi * sig / lam)**2))
G = np.fft.fft(gabor)

def encode(img, seg):
    """Rubber-sheet unwrap, complex Gabor along the angle, 2 phase bits at 8 x 128 points."""
    cx, cy, rp, ri, lid = seg
    rho = rp + rr * (ri - rp)
    x, y = cx + rho * np.cos(tt), cy + rho * np.sin(tt)
    P = ndimage.map_coordinates(img, [y, x], order=1)
    P = ndimage.gaussian_filter1d(P, 1.0, axis=0, mode="nearest")
    z = np.fft.ifft(np.fft.fft(P, axis=1) * G, axis=1)[::2, ::2]   # 8 x 128 complex
    code = np.stack([z.real > 0, z.imag > 0], -1)                    # 8 x 128 x 2 = 2048 bits
    mask = np.repeat((y >= lid + 2)[::2, ::2, None], 2, -1)          # bits not under the eyelid
    return code, mask

def hamming(X, M, shifts):
    """Masked fractional Hamming distance for all pairs, best over cyclic shifts of the angle."""
    A, Ma = (X * M).reshape(len(X), -1), M.reshape(len(X), -1)
    best = np.full((len(X), len(X)), 1.0)
    for s in shifts:
        Xs, Ms = np.roll(X, s, axis=2), np.roll(M, s, axis=2)
        cnt = Ma @ Ms.reshape(len(X), -1).T
        agree = A @ (Xs * Ms).reshape(len(X), -1).T                 # agreements - disagreements
        hd = np.where(cnt > 0, (cnt - agree) / (2 * np.maximum(cnt, 1)), 1.0)
        best = np.minimum(best, hd)
    return best

def thr_at_fmr(imp, f):                     # largest threshold with FMR <= f (accept if HD <= t)
    s = np.sort(imp)
    return np.nextafter(s[int(f * len(s))], -np.inf)

def eer(gen, imp):
    t = np.unique(np.concatenate([gen, imp]))
    fmr = np.searchsorted(np.sort(imp), t, side="right") / len(imp)
    fnmr = 1 - np.searchsorted(np.sort(gen), t, side="right") / len(gen)
    i = np.argmin(np.abs(fmr - fnmr))
    return (fmr[i] + fnmr[i]) / 2, t[i]

def run(seed, n_id=200, n_cap=4, verbose=True):
    rng = np.random.default_rng(seed)
    ids = np.repeat(np.arange(n_id), n_cap)
    codes, masks = [], []
    for i in range(n_id):
        tex = identity(rng)
        for _ in range(n_cap):
            c, m = encode(*capture(tex, rng))
            codes.append(c); masks.append(m)
    X = np.where(np.array(codes), 1.0, -1.0).astype(np.float32)
    M = np.array(masks, dtype=np.float32)
    fail = M.mean((1, 2, 3)) < 0.5            # quality gate: under half the iris usable
    iu = np.triu_indices(len(ids), 1)
    same = ids[iu[0]] == ids[iu[1]]
    either_fail = fail[iu[0]] | fail[iu[1]]
    out = {"FTE": fail.mean()}
    if verbose:
        print(f"images {len(ids)}, failed quality gate {fail.sum()} (FTE {fail.mean():.4f}); "
              f"genuine pairs {same.sum()}, impostor pairs {(~same).sum()}")
        print("shifts  failures   gen mean  gen sd  imp mean  imp sd   d'   dof  min imp   EER     "
              "FNMR@1e-2 @1e-3  @1e-4")
    for S in (0, 5):
        D = hamming(X, M, range(-S, S + 1))[iu]
        for policy in ("excluded", "NIST"):
            if policy == "excluded":
                keep = ~either_fail; d = D[keep]; sm = same[keep]
            else:                              # failed template = worst possible score
                d = np.where(either_fail, 1.0, D); sm = same
            gen, imp = d[sm], d[~sm]
            dp = abs(gen.mean() - imp.mean()) / np.sqrt((gen.var() + imp.var()) / 2)
            dof = imp.mean() * (1 - imp.mean()) / imp.var()
            e, te = eer(gen, imp)
            fn = [np.mean(gen > thr_at_fmr(imp, f)) for f in (1e-2, 1e-3, 1e-4)]
            out[(S, policy)] = (e, fn[1])
            if verbose:
                print(f"{S:6d}  {policy:9s} {gen.mean():8.3f} {gen.std():7.3f} {imp.mean():9.3f} "
                      f"{imp.std():7.4f} {dp:5.2f} {dof:5.0f} {imp.min():8.3f} {e:7.4f}   "
                      f"{fn[0]:.4f}  {fn[1]:.4f} {fn[2]:.4f}")
            if S == 5 and policy == "excluded":
                g5, i5, D5 = gen, imp, D
    if verbose:
        print("DET points (shifts 5, failures excluded): threshold  FMR  FNMR")
        for t in (0.30, 0.33, 0.36, 0.39, 0.42, 0.45):
            print(f"   {t:.2f}  {np.mean(i5 <= t):.6f}  {np.mean(g5 > t):.4f}")
    # 1:N search: gallery = first good capture of identities 0..99; identities 100.. not enrolled
    Dm = np.full((len(ids), len(ids)), 1.0); Dm[iu] = D5; Dm = np.minimum(Dm, Dm.T)
    gal = np.array([np.flatnonzero((ids == i) & ~fail)[0] for i in range(n_id // 2)
                    if np.any((ids == i) & ~fail)])
    t3 = thr_at_fmr(i5, 1e-3)
    nonmated = np.flatnonzero((ids >= n_id // 2) & ~fail)
    mated = np.setdiff1d(np.flatnonzero(np.isin(ids, ids[gal]) & ~fail), gal)
    fpir = np.mean(Dm[np.ix_(nonmated, gal)].min(1) <= t3)
    hit = Dm[mated][:, gal]
    mate_col = np.searchsorted(ids[gal], ids[mated])
    fnir = np.mean(hit[np.arange(len(mated)), mate_col] > t3)
    fmr3 = np.mean(i5 <= t3)
    out["FPIR"] = fpir
    if verbose:
        print(f"1:N, N={len(gal)}, threshold {t3:.3f} (FMR {fmr3:.5f}): FPIR {fpir:.4f} over "
              f"{len(nonmated)} non-mated searches, predicted 1-(1-FMR)^N = "
              f"{1 - (1 - fmr3)**len(gal):.4f}; FNIR {fnir:.4f} over {len(mated)} mated searches")
    # template protection: fuzzy commitment with a Hadamard code (Hao, Anderson & Daugman)
    Hd = np.array([[1.0]])
    for _ in range(6):
        Hd = np.block([[Hd, Hd], [Hd, -Hd]])
    Hc = np.vstack([Hd, -Hd]).astype(np.float32)             # 128 codewords of 64 bits (+-1)
    blocks = lambda x: x.transpose(1, 0, 2).reshape(32, 64)    # 32 angular sectors of 64 bits
    shifts = range(-5, 6)
    refs = [np.flatnonzero(ids == i)[0] for i in range(n_id)]
    refs = [r for r in refs if not fail[r]]
    probes = np.array([j for j in range(len(ids)) if not fail[j] and j not in refs])
    pid = ids[probes]
    first = np.r_[True, pid[1:] != pid[:-1]]                   # one impostor probe per identity
    Q = np.array([[blocks(np.roll(X[j], s, axis=1)) for s in shifts] for j in probes])
    worst_gen, worst_imp = [], []
    for r in refs:
        key = rng.integers(0, 128, 32)
        lock = Hc[key] * blocks(X[r])                          # XOR of codeword and reference
        own, other = pid == ids[r], first & (pid != ids[r])
        for sel, store in ((own, worst_gen), (other, worst_imp)):
            dec = np.argmax((lock * Q[sel]) @ Hc.T, axis=-1)   # decode every block, every shift
            store += list((dec != key).sum(-1).min(-1))        # best shift: fewest wrong blocks
    worst_gen, worst_imp = np.array(worst_gen), np.array(worst_imp)
    if verbose:
        print(f"fuzzy commitment: {len(worst_gen)} genuine and {len(worst_imp)} impostor unlock attempts")
        print("  t_s  key bits   FRR      FAR")
    for ts in (0, 2, 4, 6, 8, 10, 12):
        frr, far = np.mean(worst_gen > ts), np.mean(worst_imp <= ts)
        out[("fc", ts)] = (frr, far)
        if verbose:
            print(f"  {ts:3d}  {7 * (32 - 2 * ts):8d}  {frr:.4f}  {far:.6f}")
    return out

out = run(0)
print("seed  FTE    EER(S=0) EER(S=5) FNMR@1e-3(S=5) FPIR   FRR/FAR(t_s=6)")
for seed in (0, 1, 2):
    o = out if seed == 0 else run(seed, verbose=False)
    print(f"{seed:4d}  {o['FTE']:.4f} {o[(0, 'excluded')][0]:.4f}   {o[(5, 'excluded')][0]:.4f}   "
          f"{o[(5, 'excluded')][1]:.4f}         {o['FPIR']:.4f} {o[('fc', 6)][0]:.4f}/{o[('fc', 6)][1]:.6f}")

images 800, failed quality gate 81 (FTE 0.1013); genuine pairs 1200, impostor pairs 318400
shifts  failures   gen mean  gen sd  imp mean  imp sd   d'   dof  min imp   EER     FNMR@1e-2 @1e-3  @1e-4
     0  excluded     0.454   0.191     0.500  0.0386  0.33   168    0.331  0.4691   0.5823  0.6255 0.6564
     0  NIST         0.557   0.275     0.596  0.2003  0.16     6    0.331  0.5534   0.6592  0.6933 0.7217
     5  excluded     0.171   0.050     0.446  0.0239  6.96   434    0.305  0.0062   0.0062  0.0082 0.0123
     5  NIST         0.328   0.328     0.552  0.2195  0.80     5    0.305  0.1908   0.1942  0.1958 0.1992
DET points (shifts 5, failures excluded): threshold  FMR  FNMR
   0.30  0.000000  0.0226
   0.33  0.000074  0.0123
   0.36  0.001987  0.0072
   0.39  0.022053  0.0031
   0.42  0.144547  0.0010
   0.45  0.524459  0.0000
1:N, N=100, threshold 0.353 (FMR 0.00100): FPIR 0.0752 over 359 non-mated searches, predicted 1-(1-FMR)^N = 0.0952; FNIR 0.0154 over 260 mated searches
fuzzy commitment: 491 genuine and 36235 impostor unlock attempts
  t_s  key bits   FRR      FAR
    0       224  0.9695  0.000000
    2       196  0.9308  0.000000
    4       168  0.8798  0.000000
    6       140  0.8065  0.000000
    8       112  0.7332  0.000000
   10        84  0.5927  0.000000
   12        56  0.4358  0.000000
seed  FTE    EER(S=0) EER(S=5) FNMR@1e-3(S=5) FPIR   FRR/FAR(t_s=6)
   0  0.1013 0.4691   0.0062   0.0082         0.0752 0.8065/0.000000
   1  0.0725 0.4845   0.0097   0.0097         0.0743 0.7784/0.000000
   2  0.0813 0.5114   0.0089   0.0167         0.0792 0.7879/0.000000

Running the script twice gives identical output. The plan written before the first run stated a hypothesis for each part; the script was not changed after its first run.

Impostor scores behave as Daugman describes. Compared at one orientation, codes of different irises disagree in half their usable bits on average (mean 0.500), with a spread equivalent to 168 independent bits rather than 2,048, because the Gabor filter and the radially streaked texture make neighbouring bits correlated, the same reason Daugman gives for his 249. Searching over shifts keeps the minimum of eleven correlated distances, which moves the impostor mean down to 0.446 and narrows it, the extreme-value effect of his Fig. 7. The plan written before the first run had guessed the degrees of freedom at “200-600” and the impostor mean after the search at “~0.46-0.47”; both came out lower.

Rotation compensation is what makes the system work. Without the shift search, a head tilt of up to $10^\circ$ moves the code by up to about four columns, genuine pairs disagree almost as much as impostors (mean 0.454), $d'$ is 0.33 and the EER is 0.47 to 0.51 across the seeds, close to chance. With it, the genuine mean falls to 0.171, $d'$ rises to 6.96, and the EER is 0.62% to 0.97% across the three seeds.

FNMR at a fixed FMR is the useful number, and it has a floor of measurability. With failures excluded, the 719 captures that passed give fewer than 258,000 impostor pairs, so the lowest FMR in the DET table that is not zero, $7.4 \times 10^{-5}$, corresponds to only about twenty pairs, and the threshold for FMR $10^{-4}$ is set by roughly the 25 lowest impostor scores. The “rule of three” bound $3/M$ is about $10^{-5}$, but every capture appears in hundreds of pairs, so by NIST’s caution FMR around $10^{-4}$ is at the edge of what this test measures.

Counting failures changes the answer more than the matcher does. About 10% of captures (7% to 10% over the seeds) failed the 50% rule. Excluded, they leave FNMR at FMR $10^{-3}$ of 0.0082. Kept with the worst score, as NIST’s convention prescribes, they turn every genuine pair that involves a failed capture into a false non-match, about one pair in five if failures are spread evenly over identities, and FNMR rises to 0.196 at the same FMR. The NIST rows’ impostor means, spreads, $d'$ and degrees of freedom are not meaningful, because they include the scores set to 1.0. A report that gives FNMR without saying which convention it used cannot be compared with one that does.

Identification is harder, though not quite as Daugman’s formula predicts. At the threshold that gives FMR $10^{-3}$, a search of a 100-person gallery by someone not enrolled returned a false candidate 7.5% of the time, against 9.5% predicted by $1 - (1 - \mathrm{FMR})^N$; the other two seeds gave 7.4% and 7.9%, also below the formula’s 9.5% for FMR $10^{-3}$ and $N = 100$ (the summary line does not print their own predictions). The plan expected the formula’s value “within sampling error”; by our estimate the binomial standard error with 359 searches is about 1.5 percentage points, and three seeds all below the prediction do not fit that. The formula assumes independent comparisons. Our reading, which the script does not test, is that false matches cluster in some probes, for example heavily masked captures whose Hamming distances, computed from fewer bits, vary more, so fewer searches contain at least one false match than independence implies. Either way, a 0.1% false match rate in verification became a 7.5% false alarm rate in a search of only 100 people.

Presentation Attacks and Liveness

A matcher compares whatever sample reaches the sensor. The ISO/IEC 30107 series defines a presentation attack as the presentation of an artefact or of human characteristics to a biometric capture subsystem in a fashion intended to interfere with system policy; NIST quotes this definition in its evaluation of face attack detection (Ngan, Grother & Hom, 2023). Attacks are aimed at impersonation, being accepted as someone else (unlocking another person’s phone, entering a building), or at evasion, avoiding recognition (escaping a watch list, enrolling twice under different names). The presentation attack instruments (PAIs) form an open-ended set limited by the attacker’s effort and ingenuity: artificial “gummy” fingers, a photo or video of a face held to the camera, iris photographs and contact lenses, silicone masks (Ngan, Grother & Hom, 2023). NIST’s guidelines define presentation attack detection (PAD) as the automated determination of a presentation attack, and liveness detection as the subset of PAD methods that measure anatomical characteristics or voluntary or involuntary reactions to determine that the sample comes from a living subject who is present (Temoshok et al., 2025).

PAD is a binary classifier with its own two errors, which NIST uses and attributes to ISO/IEC 30107-3 (Ngan, Grother & Hom, 2023):

• the attack presentation classification error rate (APCER), the proportion of attack presentations classified as bona fide, which NIST calls the PA miss rate and treats as the security measure;
• the bona fide presentation classification error rate (BPCER), the proportion of genuine presentations classified as attacks, the false detection rate and the measure of inconvenience.

NIST reports both at fixed values of the other: APCER at BPCER $= 0.01$ for applications that cannot reject many legitimate users, such as e-gates, and BPCER at APCER $= 0.01$ where fraud is costly, such as bank account access. NIST’s guidelines state their recommendation in a different measure, the impostor attack presentation accept rate (IAPAR), which testing should show to be below 0.07 (Temoshok et al., 2025).

What NIST measured. FATE Part 10 (Ngan, Grother & Hom, 2023) tested 82 passive, software-only face PAD algorithms from 45 developers, submitted between January and February 2023, on about 20,000 attack attempts in nine categories and 21,000 bona fide presentations, mostly still images. Its findings:

• Accuracy varied widely across algorithms, PA types and the impersonation and evasion tasks, and only a small percentage of algorithms showed notable detection capability.
• Photo print and replay attacks, protective face masks and flexible silicone masks were detected well by several developers (APCER at most 0.01 at BPCER $= 0.01$, and the reverse), but when the view was zoomed in so that the frame of the photo or tablet and the attacker’s hands were not visible, error rates rose for all algorithms. Some PA types, which the report does not describe, produced high error rates for every algorithm.
• Many algorithms did better on video than on a single still from the same session.
• Sum-rule fusion of four of the more accurate algorithms beat the best single algorithm in every impersonation category and most evasion categories.
• In a first-order demographic analysis of BPCER at a threshold giving 0.03 for white males, false detection rates varied across algorithms with no obvious trend for any group. The bona fide stills were unevenly spread over six race–sex groups, from 9,265 images of White women to 665 of Asian men.

The report’s limits matter as much: it did not test digital injection attacks, which feed an image or video into the software directly, for example through a virtual camera, bypassing the sensor; hardware-based PAD using near-infrared illumination, time-of-flight or other sensors; or active challenge-response methods that ask the user to blink or turn the head. NIST’s guidelines respond to injection with requirements on the sensor rather than on the image: a verifier should determine the integrity of the sensor, for example by sensor authentication or signed attestation, and central comparison requires an authenticated, protected channel from the sensor (Temoshok et al., 2025).

Template Protection

A stored template is a liability that a password is not. NIST lists the reasons its guidelines allow only a limited use of biometrics: a biometric comparison is probabilistic; biometric characteristics are not secrets; and template protection schemes, which could make a biometric revocable like a password or certificate, exist but are of limited availability (Temoshok et al., 2025). Hao, Anderson and Daugman (2005) add key diversity: a person may want separate keys for a bank account and a workplace computer, so that revoking one leaves the other intact.

The difficulty is that biometric samples are noisy and cryptography needs exact keys. Hao, Anderson and Daugman survey the approaches that bridge the gap:

• Fuzzy commitment (Juels and Wattenberg): a random key is encoded with an error-correcting code and the codeword is XORed with the enrolled binary template; only the result is stored, so the key is independent of the biometric.
• Fuzzy vault (Juels and Sudan), applied to fingerprints by Clancy, Kiyavash and Lin: minutia locations lock a secret polynomial among chaff points, and a matching fingerprint recovers it with a Reed–Solomon code; that system derived a 69-bit key with a 30% false rejection rate.
• Fuzzy extractors (Dodis, Reyzin and Smith): a theoretical primitive that applies an error-correcting code and a hash to extract a key from noisy data, with a proof that little information leaks. Hao and colleagues observe that such proofs assume the biometric stays secret, while fingerprints are left everywhere and irises can be photographed.

Their own scheme is a fuzzy commitment designed for iris codes. Same-eye iris codes usually disagree in 10% to 20% of bits and different eyes in 40% to 60%. A random key is encoded with a Reed–Solomon code that corrects up to $t_s$ wrong blocks among 32, each block is encoded with a Hadamard code (64-bit codewords, correcting up to 15 wrong bits, about 25%), and the resulting 2,048-bit “pseudo-iris code” is XORed with the reference iris code and stored on a token with a hash of the key. To unlock, a fresh iris code is XORed with the stored data and decoded; the key is accepted if its hash matches. The key length is $7 \times (32 - 2t_s)$ bits. They did not use the mask bits, because the probe’s mask is unknown at enrolment, and the mean same-eye distance rose from 3.37% with masks to 12.7% without. On 700 images of 70 eyes taken in a laboratory with one camera at fixed distance, with the first sample of each eye as reference and up to seven octet shifts tried, $t_s = 6$ gave a 140-bit key with a false rejection rate of 0.47% (3 of 630 genuine attempts) and no false acceptances; false acceptances first appeared at $t_s = 8$ (Hao, Anderson & Daugman, 2005, Table 1). They argue that an attacker who stole the token and knew the correlations in the victim’s iris code would still face at least about $2^{44}$ trials, and suggest a password as a third factor.

The example applies the same scheme, with the Reed–Solomon layer simulated as “accept if at most $t_s$ of the 32 blocks decode wrongly” rather than implemented, to its synthetic codes: one reference per identity, the other captures of the same identity as genuine attempts, and one capture of every other identity as impostor attempts, each tried at eleven shifts. The trade-off has the expected direction, with FRR falling from 0.97 at $t_s = 0$ to 0.44 at $t_s = 12$ while no impostor ever recovered a key, but the false rejection rates are far above Hao and colleagues’ 0.47%. The plan had expected “FRR falls, FAR rises with t_s”; FRR fell, but no false acceptance appeared up to $t_s = 12$. By our reasoning, the cause is the error rate of unmasked codes: the synthetic captures have eyelids covering up to half the iris, and without masks the bits under the eyelid are random, so several 64-bit sectors exceed the Hadamard code’s 25% and more than $t_s$ blocks fail. The same matcher with masks had an FNMR below 1% at FMR $10^{-3}$. Template protection inherits the matcher’s error rates at its own fixed operating point, and the masks that make iris matching robust are hard to carry into an error-correcting code.

Demographic Differentials

NIST’s FRVT Part 3 report measured face recognition error rates by sex, age, race and country of birth for 189 algorithms; its findings, that false positive rates varied by factors of 10 to beyond 100 across groups while false negative rates varied far less, are summarized in face recognition, with the report’s case for reporting both error rates per group at the one fixed threshold that most systems use. Two further points from the same report matter for system design:

• Threshold elevation. If an audit finds that one group’s FMR at the policy threshold is, say, five times the target, raising the threshold until that group meets the target restores the security objective but raises FNMR for everyone; the report illustrates this with a DET construction (§9.5).
• Iris as a mitigation. The report cites a 2019 Department of Homeland Security study that found iris false positives no higher within people of the same sex, age and race than across those groups, unlike face, and proposes face records with adjunct iris images, or the face-and-iris compound biometric described above (§9.4).

For iris itself, IREX IX broke accuracy out by sex, eye colour and race; its race analysis, limited to the White, Black and Asian categories of the dataset’s metadata (“Asian” including most of the Middle East), rests on about 30,000 mated comparisons between White subjects, 6,216 between Black and 2,858 between Asian subjects. It reported that sex had a significant but inconsistent effect (some matchers better on males, others on females; for one participant’s matchers FNMR for females was double that for males) and that matchers tended to perform best on white and poorest on Asian subjects, with comparisons between white subjects less likely to false non-match but more likely to false match. The report cautions that its data were collected in various environments over years, so confounding factors cannot be ruled out (Quinn, Grother & Matey, 2018). For face PAD, see the BPCER analysis above.

NIST’s digital identity guidelines turn the measurement into a requirement: a biometric system used for federal authentication must reach an FMR of 1 in 10,000 or better for all demographic groups, including sex and skin tone where these affect performance, with a fixed threshold, since changing the threshold per demographic is not feasible (Temoshok et al., 2025). The face report, written in 2019, had noted that the degree to which differentials could be tolerated had never been formally specified for any biometric application (see dataset bias for the general problem of unrepresentative data).

Failure Modes and Risks

• False matches in identification. In identification for fraud detection or surveillance, a false positive could lead to a false accusation, detention or deportation, as NIST’s face report notes (see face recognition); the identification penalty above makes this error grow with gallery size.
• Capture failures and exclusion. People whose samples repeatedly fail quality checks are not served by the system; reports that drop failures overstate accuracy.
• Poor-quality samples. IREX IX attributes most iris errors to a small fraction of samples with motion blur or occlusion (Quinn, Grother & Matey, 2018), and FpVTE attributes an unexpected result to image quality (Watson et al., 2014).
• Ground-truth errors in evaluation. Samples filed under the wrong identity inflate measured error rates; both IREX IX and FpVTE invested in removing them.
• Presentation and injection attacks, as above, including those outside what was tested.
• Template theft. A stolen template cannot be revoked unless it was protected, and samples can be gathered without consent (Temoshok et al., 2025).
• Function creep and surveillance. A template collected for one purpose can be searched for another. Both documents described below single out biometric data: NIST’s guidelines as sensitive personal information, the UK GDPR as a special category.

Deployment Considerations

NIST’s federal authentication guidelines. SP 800-63B-4 (July 2025) sets the conditions under which U.S. federal agencies may use biometrics for authentication (Temoshok et al., 2025). It was written for federal information systems and states that nongovernmental organizations may use it on a voluntary basis. Its requirements include:

• biometrics only as part of multi-factor authentication together with a physical authenticator (“something you have”), with a non-biometric alternative always offered;
• an FMR of 1 in 10,000 or better for all demographic groups under zero-effort impostor attempts, an FNMR below 5% (recommended), testing according to ISO/IEC 19795-1 and a fixed threshold;
• PAD recommended for iris and fingerprint and required for face; voice must not be used;
• limits on consecutive failed attempts (five, or ten with PAD), followed by delays of at least 30 seconds and, after 50 (or 100) failures, disabling the biometric;
• comparison preferably on the user’s device rather than at a central verifier, because central stores invite attacks at scale; biometric data to be treated as sensitive personal information; and samples erased immediately after any template adaptation.

Data protection law. The UK GDPR, the United Kingdom’s version of the EU General Data Protection Regulation as published on legislation.gov.uk (revised version, read November 2026), defines biometric data as personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that person, “such as facial images or dactyloscopic data” (Article 4(14)). Article 9(1) lists biometric data processed for the purpose of uniquely identifying a natural person among the special categories of personal data whose processing is prohibited, unless one of the conditions in Article 9(2) applies. This article draws no legal conclusions from these texts; other jurisdictions have their own rules.

Engineering choices that follow from the evaluations. Set thresholds from impostor scores at the gallery size and population of the deployment, not from a benchmark’s EER; report FNMR at the operating FMR together with FTE and the convention used for failures; measure error rates by demographic group at the operating threshold; use more fingers or both eyes where capture allows; and treat PAD results as specific to the attack types tested.