Face Matching

Face matching is the process of determining whether the images of two faces belong to the same person. This is particularly useful in onboarding scenarios when we want to check if the holder of the document is present during onboarding.

Another typical use case is login, when the user is verified with a previously stored face.

Face matching is provided by mobile app libraries:

Note: On-device face matching should be used only in special cases in offline mode when connectivity to DIS is not possible. Face matching in DIS provides higher accuracy, leading to better UX and higher security.

The Digital Identity Service (DIS) provides the face matching functions in two ways. Either as dedicated face API functions, or as part of the onboarding API.

Onboarding APIFace API
Face matching is performed when both the customer’s selfie and document image is uploaded, and the inspect function is called. This matches the document portrait with the selfie.Face matchinng is performed when the face photo is provided and a reference photo is in the similarity function.
DOT Digital Identity Service - Customer OnboardingDOT Digital Identity Service - Face Biometrics
Swagger: customers/{id}/inspect API callSwagger: faces/{probe_face_id}/similarity API call

Innovatrics face biometric algorithm ranks among the top in the NIST FRVT

Matching steps

In order to verify two faces, the following steps must be performed:

  • Face detection - find the position of the face in the image
  • Template extraction - compute representation of the face used for matching
  • Matching - compare two face templates and output similarity score

Face detection

The first step when performing face matching is face detection. This is an important step, because there might be no face or multiple faces present in the picture. Once a face is detected, it can be used in the matching process. There are various face detection modes available, fast mode provides lower latency, in accurate mode detection is more precise. Mobile devices only support fast mode, server components are configured by default to accurate mode.

Template extraction

Once the face has been detected, the face template can be generated. These templates can be cached on the application level to speed up the matching. Once the reference image is uploaded to the server, the template can be generated and cached. When a user logs in, face detection and extraction is only performed on the probe image from the user and the reference template is pulled from the cache. For extraction fast and accurate modes are available too. Similarly to detection, on mobile devices only fast mode is supported. Only templates generated by the same mode and product version can be matched. During major product upgrades, templates must be regenerated as mentioned in the respective product changelog.

Matching

Matching is a very fast operation, and it calculates the similarity of two templates, providing a matching score. The higher the score, the more similar the faces.

Matching threshold

The final decision if the two faces belong to the same person should be determined by the similarity score and threshold. If the score is above the threshold this can be interpreted as accepted, if the score is below the threshold it is rejected.

The following characteristics have been measured on our ICAO face quality testing dataset using DOT Digital Identity Service (accurate extraction mode):

FAR levelsFAR [%]FRR [%]Score threshold
1:5000.2000.0200.252
1:10000.1000.0220.271
1:50000.0200.0400.322
1:100000.0100.0580.345
1:500000.0020.1710.413
eer0.0340.0340.304

Example

If we require a FAR level of 1:5000 with Digital Identity Service, we have to set the threshold of the resulting score of the matching function to 0.322. If we have a representative set of 10,000 matching face pairs, statistically 4 will in this case be incorrectly marked as not matching, even though they are. If we have 10,000 not matching pairs, statistically 2 will be wrongly marked as matching.


We recommend following matching thresholds based on the use case:

  • 0.27 Low quality input images or when expecting significant appearance change of individuals
  • 0.322 Standard setting for matching selfie with document portrait
  • 0.413 Matching selfies aiming for high security

The following characteristics have been measured on our ICAO face quality testing dataset using the DOT Face mobile library for Android and iOS (fast extraction mode):

FAR levelsFAR [%]FRR [%]Score threshold
1:5000.2000.8670.276
1:10000.1001.2050.297
1:50000.0202.4830.358
1:100000.0103.2160.378
1:500000.0025.2500.428
eer0.5730.5730.243

Setting the correct threshold depends on the security/convenience balance that is required for the specific use case. We recommend to use server side matching whenever possible as it has significantly higher accuracy, leading to better security and user experience. Please note that if images are of very low quality (e.g. selfie in a dark room, worn off document portrait) matching score can be lower even for matching pairs and threshold must be adjusted accordingly.

During the initial configuration of the system, two thresholds can be set. If the score is below the bottom threshold, the result is automatically set to reject. If the score is above the top threshold it is automatically accepted. If the score is between the two thresholds, images go for review to a back office operator for a final decision. Over time, the range between the two thresholds can be minimized or even eliminated by setting a single decision threshold if not needed anymore.


NOTE

To add matching to your workflow, please consider the following:

  • Image quality - if image quality is low, accuracy of the matching decreases
  • Age difference between the images - time difference between the capture of the two images is several years, the person’s appearance might have changed significantly.

Image vs template usage

When performing matching using images, face detection is always called internally and a template is generated. When using templates, face detection is skipped.

Using images

If you do not need the result of the face detection for other purposes, you can simply invoke matching with images. This is particularly useful when matching is performed only once during the flow. An example would be a simple selfie vs identity document face comparison.

Using templates

If you need more data about the face, such as age estimation or passive liveness, the recommended approach is as follows:

  1. Invoke face detection with all the needed attributes and also with template extraction enabled
  2. Cache this template
  3. Use it for matching

This approach can be used when we want to evaluate passive liveness and also perform face matching. Calling verify with at least one template reduces processing time.

Templates can also be cached on the application level for use cases like login, where the same reference face is needed. Please note that templates are incompatible across major product upgrades, and must be regenerated by invoking the face detection on the source images again.