The two secrets of facial recognition technology

Facial recognition technology (FRT) typically is used to compare an unknown subject person’s photograph against a larger database of photos, in order to determine whether the subject’s photo matches to a known person in the database. For example, say an unknown person robbed a gas station that has a video security system. The police might obtain a screengrab photo of the robber from the security video (called the “probe image”) and load it into an FRT system that is linked to a database of booking photos of persons arrested in California. Using the magic of artificial intelligence (AI), the FRT program might determine that the photo of the unknown robber matches a known person in the booking photo database—case solved. Right?

Not so fast. Like much involving AI, the reality is messier and less precise than the glossy promise. In the case of FRT, there are two secrets—practices that are not widely known—that lawyers handling cases involving FRT should be aware of. The first issue is potential editing of the probe image. The second issue is discarding of other potential matches that were returned at the same or higher confidence level as the selected match.

These two topics are rarely affirmatively disclosed by the proponent of the FRT match. Indeed, many prosecutors are unaware of these issues because police agencies tend not to discuss them. (Presently, it is mainly the prosecution in criminal cases that seeks to introduce FRT evidence, though that may change as defense counsel realize that FRT can be used to cast doubt on claimed identifications.)

Secret 1: Editing probe images

Most databases of booking photos, or driver’s license photos, contain facial shots that are straight-on, close-up, and taken from a level angle. (Increasingly, booking photo sets now also include 90-degree side-view photos.) In contrast, security cameras are generally located near the ceilings of buildings, and the views they show are both angled downwards and are rarely straight-on. The police may take a screengrab from such an angled video, run it through an FRT program, and get no matches (or only get matches at such a low confidence level as to be useless).

But many programs now allow digital adjustment of probe images. The programs allow rotation and straightening of the image, and can fill in pixels of missing areas using predictive algorithms. For example, DataWorks Plus LLC sells an FRT program, FACE Plus, that is widely used by police agencies in California, and which is connected to California booking photo databases containing at least 17 million images. DataWorks affirmatively markets its FRT’s ability to manipulate probe images: “Probe images can be edited using pose correction, light normalization, rotation, cropping, brightness, and marking exact eye locations for more accurate facial matching.” See https://www.dataworksplus.com/bioid.html (last visited 7-20-2024).

“Pose correction” refers to using 3D modeling to rotate an angled image so that the adjusted image is facing straightforward (technically, correcting the yaw, tilt, and roll of the original image). To do this, the computer necessarily fills in facial features that are not visible in the original unedited photo. See 3D Pose Correction to Improve Automated Facial Recognition Search Results, v. 1.0, 2019.10.25, Facial Identification Scientific Working Group. For example, if only the left side of the subject’s face is visible in the probe image, then when the computer rotates the image so the subject is facing forward the program may symmetrically fill in the right side of the subject’s face.

Moreover, it generally is a police officer who is adjusting the probe image, and who is making a subjective decision as to when the photo has been edited “enough.” Furthermore, many police agencies require no training for officers to use FRT systems. Even where some training is required, there are no widely-agreed upon standards.

Thus, a hypothetical officer may testify: “I took a still photo from the security video, and our department’s facial recognition program matched it to the defendant’s booking photo from a prior case.” But this may really be shorthand for: “I took a still photo from the security video [then I used our FRT system’s editing program to ‘pose correct’ the original photo, until I personally was satisfied with how the altered photo looked], and [then] our department’s facial recognition program matched [the photo as I had edited it, not the original photo] to the defendant’s booking photo from a prior case.”

Once the edited photo has been matched by FRT to a booking photo in the database, the police officer typically will visually compare the original, unedited probe image to the matched booking photo, to make sure that (in the officer’s personal opinion) they look alike. But that comparison is subjective, is no more accurate than any other person’s subjective opinion, and now may be tainted by the officer’s confirmation bias. In any event, the FRT did not match the booking photo to the unedited probe image.

To state the obvious, there is a difference between an FRT match made with an edited photo as opposed to an unedited photo. The edited photo is not an image of the actual person. It may, or may not, be a close representation. But opposing counsel who are unaware of how FRT works will not know to explore these issues.

Secret 2: Discarding alternative matches

FRT determines the likelihood—i.e., the percentage chance or “confidence level”—that a probe image matches photos in the FRT’s known-photo database. This leads to two corollary effects. First, at any confidence level, the FRT will likely return multiple photos that it concludes are equally likely statistical matches to the probe image. Second, the police officer using the FRT can adjust the FRT’s confidence level to obtain more, or fewer, potential matches.

For example, a police officer may set the FRT to identify all photos in the database that the FRT determines have a confidence level of 95 percent or higher for matching the probe image. The FRT may return, say, ten potential matches. But if the officer lowers the confidence level to 90 percent, the FRT may return thirty potential matches. Note that FRT systems will return potential matches even if the true subject’s photo is not in the database: the FRT is making statistical percentage predictions. It is not making a definitive and omniscient pronouncement.

What does the officer do when, in our hypothetical example, she receives the ten potential matches at the 95 percent confidence level? She visually compares each FRT-identified booking photo to the probe image to see which one, if any, she thinks actually matches. Again, this process is entirely subjective, is no more reliable than if any other person was doing the comparison, and is vulnerable to the confirmation bias that one of these ten photos in fact is a true match. And, importantly, if the officer believes that one of the FRT-identified photos matches the probe image, then she generally discards the other nine photos. Those alternative potential matches, which the FRT made at the same confidence level, are not mentioned again, and likely will not be disclosed to either the prosecutor or the defense counsel. They disappear from the investigation.

Moreover, sometimes the officer may not feel that any of the ten photos returned at the 95-percent confidence level (in our example) match the probe image. She may then ask the FRT to identify all potential matches at a 90-percent, or lower, confidence level. If the officer subjectively determines that one of those booking photos matches the probe image, no one else will know that the FRT returned other photos at a higher confidence level that were discarded.

Why are alternative potential matches important? After all, at present FRT is almost never used in court as the sole basis for identification, but rather is used to explain why the police started looking at the defendant in the first place. There are at least two reasons. First, even though there may be subsequent corroborating witness identifications of the defendant (e.g., from six-pack photo lineups), the fact that FRT initially “identified” the defendant typically will be sprinkled over the later identifications like a blessing, lending its AI imprimatur to bolster subsequent witness identifications.

Second, arguably both the prosecution and the defense should at least have the opportunity to investigate the other potential matches, should they desire to do so. Using our gas station robbery example: assume that the detective used FRT to obtain ten potential matches to the screengrab from the security video. The detective subjectively determined that one of the ten booking photos was a true match, and used that information to obtain a search warrant for that person’s cell phone location data. That data revealed that the suspect’s cell phone was within a half-mile radius of the gas station at the time of the robbery. This appears to corroborate the hypothesis that the suspect was the robber.

But what about the nine other potential FRT matches that the detective discarded? What if a search of those persons’ cell data showed that one of them also was within a half-mile of the gas station at the time of the robbery? While this may be rare, are we prepared to say it could never occur? It takes no great imagination to recognize that this could alter the nature of the case dramatically. Without further information, it now means there are two equally likely suspects who are mutually exclusive. But this possibility is foreclosed if neither the prosecution, nor the defense, are ever informed of the discarded alternative matches.

FRT has other issues

These two secrets by no means exhaust the issues with FRT. For example, two different FRT algorithms, using the same probe image and same database, may return completely different sets of potential matches, none of which may overlap. See Garvie, Clare, A Forensic Without the Science: Face Recognition in U.S. Criminal Investigations, Center on Privacy & Technology at Georgetown Law (2022), p. 19 (referencing a 2022 criminal case from New Jersey where a probe image was run through both NEC and Rank One Computing’s FRT algorithms: the top ten results from each system were composed of entirely different people).

Furthermore, if police and prosecutors use FRT, defense counsel can too. In theory, in a case where identification is the issue, a defense attorney could take a screengrab from a relevant security video, use FRT to compare it to photos of known persons in a commercial database, and start investigating the potential matches to present as possible alternative suspects. FRT is not limited to searching government-compiled databases of booking photos and driver’s license photos. Use of face identification to unlock cell phones is creating enormous corporate databases of photos of known persons, and social media companies already have photos of their known users. At some point, the temptation to use FRT in connection with those commercial photo databases may prove irresistible. There may not even be a need to access a private database of photos. Clearview AI advertises an FRT program for law enforcement, boasting it searches “the largest known database of 50+ billion facial images sourced from public-only web sources, including news media, mugshot websites, public social media, and many other open sources.” See https://www.clearview.ai/clearview-2-0 (last visited 7-21-2024). Perhaps a similar commercial FRT service, available to anyone who pays a subscription fee, is not far off. While such defensive use of FRT presumably would not be done routinely, the possibility cannot be foreclosed. It might then be the prosecution who argues against the reliability of FRT.

In any event, lawyers involved in cases where FRT is used should, at minimum, seek two pieces of information. First, how was the probe image edited, if at all, before it was used to make an FRT match? Second, how many alternative potential matches did the FRT return at the same or higher confidence level; and what investigation, if any, was conducted regarding those alternative matches?