What a facial-recognition match actually tells you

A face can unlock a phone or appear near the top of an image-search result. Both involve facial recognition, but they leave us with different kinds of evidence. To understand a match, first ask what the system compared, what its number means and what decision follows from it.[1]

The software compares representations of faces

A useful historical example is Google’s FaceNet research from 2015. A neural network converted a face image into a compact numerical representation. Training encouraged images of the same person to sit closer together than images of different people. A comparison could then use the distance between those representations. That distance measures a relationship in the model’s learnt space; it is not, by itself, a percentage probability that two photographs show one person.[1]

The distinction remains practical in current software. Amazon Rekognition’s CompareFaces documentation describes a confidence value for whether a detected box contains a face, and a separate similarity score for how closely two faces match. A high value for detecting a face says nothing on its own about whose face it is. Even apparently familiar words such as confidence can refer to different questions within the same response.[2]

A similarity threshold is the rule for which comparisons count as candidate matches. Rekognition allows an application to change that threshold. Raising it changes the decision rule; it does not improve the underlying photograph or retrain the model. Before treating a displayed score as a calibrated probability of identity, we would need evidence establishing that interpretation for the relevant system and conditions.[2]

Verifying one identity and searching for one are different tasks

In one-to-one verification, the question is whether a new image matches a specified person’s reference. NIST measures two errors separately: a false match accepts images of different people, while a false non-match rejects images of the same person. Its evaluations compare the missed genuine matches at a threshold chosen to achieve a specified false-match rate. One impressive overall accuracy figure would conceal that trade-off.[3]

One-to-many identification searches a reference collection for possible identities. Here, NIST defines a false-positive identification by the whole search: a person absent from the collection nevertheless produces one or more candidates above threshold. That is a different denominator from the number of individual face comparisons. The size and composition of the collection belong alongside the result.[4]

A ranked list introduces another subtlety. In NIST’s unthresholded investigation test, the software returns 50 candidates. If the person is absent, the reviewer must reject every one. There is still a first-ranked candidate, but first-ranked means closest among the returned alternatives. It does not establish that the correct person was available to be found.[4]

One threshold adjustment can change both kinds of result

An October 2025 National Physical Laboratory report tested Cognitec FaceVACS-DBScan ID v5.5. Its threshold comparison makes the choice concrete.[5]

The stricter setting reduced false-positive searches while missing more genuine matches. Zero observed errors in a finite sample does not mean errors are impossible. These numerical thresholds belong to this algorithm and evaluation; another supplier’s score scale cannot be assumed equivalent.[5]

The camera helps determine the outcome

NIST’s demographic analysis explains why capture conditions matter. Poor exposure can make faces harder to match, and a camera positioned badly for a person’s height can change the viewing angle. False-match differences between demographic groups can also occur with good images. Better photography can address part of the problem; the model’s error patterns still require measurement across the people who will encounter it.[3]

This helps explain why a phone is a specific system rather than a generic facial-recognition score. Apple describes Face ID as using an infrared image and depth information from its TrueDepth camera, converted into a mathematical representation and compared with enrolled data. The capture hardware, matching process and rules for accepting authentication work together. Performance from an unrelated collection of ordinary two-dimensional photographs cannot simply be attached to that complete device.[6]

Matching a face also differs from checking a live presentation

There is a further question: is the camera seeing an authentic presentation, or an attempt to impersonate somebody using an image or other artefact? Presentation-attack detection addresses that problem. A photograph could resemble the enrolled person very closely while still being the wrong thing to accept at an authentication step. Identity similarity alone does not answer whether the presentation should be trusted.[7]

NIST evaluates this separately. Its 2023 passive-software exercise used conventional two-dimensional imagery and excluded hardware solutions. That scope is useful when comparing claims: a face matcher, a software anti-spoofing method and a camera-equipped authentication product need evidence matched to their own jobs.[7]

Where the comparison happens matters too. Apple says Face ID’s facial data is encrypted, protected by the Secure Enclave and kept on the device. An app receives the authentication result rather than access to the enrolled facial data. That arrangement has a different data flow from submitting photographs to a remote comparison service or searching a centrally held collection.[6]

A candidate becomes evidence through the surrounding process

The Home Office’s December 2025 description of retrospective facial recognition illustrates the distinction. It treats search results as intelligence, with visual assessment by trained users and investigators, and requires additional corroborating enquiries before operational or investigative decisions. Those are stated process requirements, not a measurement proving that every investigation follows them perfectly.[8]

When a facial-recognition claim sounds impressive, reconstruct the task behind it. Was the system checking a known identity or searching for an unknown one? Was the person present in the reference collection? What imagery, threshold and follow-up process produced the result? Those details let us understand what a successful match contributes, and what still has to be established before acting on it.[8]

Report an error or suggest a correction