Separate verification from identification
In one-to-one verification, someone claims an identity and the system compares a candidate with that person’s enrolled reference. In one-to-many identification, the system searches eligible references to find a candidate identity. Both require attention to error outcomes and the consequences for workers.
Attendify’s personal-device matching is optional and controlled. Its kiosk searches eligible enrolled workers at the kiosk’s site. It does not search an unrestricted public face database or provide general surveillance functionality.
A similarity score is not a probability
A face model converts a capture into a numerical representation. The comparison produces a score under a particular metric. A threshold determines the decision, but the score is not the probability that the person is the correct worker.
The OpenCV face-recognition tutorial includes dataset-specific SFace examples. Its 0.363 cosine threshold is not a recommended attendance rollout setting or a 36.3% certainty estimate. Calibration must address the proposed use and capture conditions.
Measure both kinds of error
A false acceptance and a false rejection have different consequences. A rejected genuine worker may face delay, missing records or an incorrect pay/access decision if no review path exists. A high acceptance rate alone does not tell you whether identities are correct.
NIST’s demographic evaluation shows why algorithm and capture conditions matter. It does not establish Attendify’s performance. A pilot needs representative, consented data and an explanation of its sample limitations.
Ask where inference and decisions happen
Attendify computes candidate representations on the device and compares them against server-held references. The server owns its reference and threshold decision. A modified client could nevertheless send a fabricated candidate rather than one derived from a fresh camera capture.
Device attestation and trusted inference can address particular threats; neither should be described as “full protection” against every attack. Liveness and injection threats also need separate evaluation.
Treat templates as sensitive data
An enrollment template is not an ordinary password that a worker can simply replace after exposure. Avoid claims that templates are harmless or necessarily irreversible. In Attendify, enrollment photos are not uploaded, but accepted attendance selfies are stored privately. An administrator reset removes the active matching profile and requires fresh enrollment.
Before enabling matching, resolve notice, appropriate grounds, retention, calibration and a usable alternative/review path. See the security overview, liveness distinctions and the kiosk deployment guide. A working demonstration is not evidence of general rollout readiness.