Face matching vendors quote NIST FRTE ranks in almost every sales deck, but a rank on a NIST leaderboard says little about how an algorithm will behave on your customers, your cameras and your threshold. The Face Recognition Technology Evaluation (FRTE) is NIST's ongoing, open benchmark of face recognition algorithms, the successor to the Face Recognition Vendor Test (FRVT). This guide explains how the 1:1 and 1:N tracks work, what false match rate (FMR) and false non-match rate (FNMR) mean in practice, how to read the demographic results, and how to turn FRTE data into procurement requirements for identity proofing and biometric authentication. It is written for identity architects, fraud teams and buyers evaluating face matching inside onboarding or account recovery. Liveness is a separate problem covered in the Biometric Liveness and Presentation Attack Detection Guide.
Key takeaways
- FRTE measures matching, not spoofing. FRTE 1:1 and 1:N test whether an algorithm matches the right face; presentation attack detection sits in the separate FATE programme, whose passive PAD track is closed.
- Error rates come in pairs. FRTE 1:1 reports FNMR at a fixed FMR, such as 10-6; a single accuracy figure without the paired rate and dataset is not usable.
- Dataset matters more than rank. Results differ by image type (visa, border, kiosk, mugshot); pick the dataset that looks like your capture conditions.
- Demographic effects are real and measurable. NIST found false positive rates that often vary by factors of 10 to 100 across groups, and NIST SP 800-63A-4 now caps any group at 25% worse than the overall population.
- Ask for the exact algorithm. Contracts should name the submitted algorithm identifier and require the same version, or a later tested one, in production.
What it is and who it applies to
NIST split FRVT into two programmes: FRTE covers tracks about identity verification, and FATE (Face Analysis Technology Evaluation) covers tracks that process and analyse images. NIST says the existing participation and submission procedures were unchanged. The FRTE tracks are 1:1 verification, 1:N identification, FIVE (face in video) and a twins demonstration. FATE includes morph detection, image quality, PAD and age estimation.
FRTE is voluntary and open to developers worldwide. Developers sign a participation agreement, wrap their software behind NIST's C++ API and submit it; NIST runs it on sequestered government image sets the developer never sees. For the 1:1 and 1:N tracks a developer may submit no more often than once every four calendar months. As of 6 November 2026 the 1:1 page lists 1,501 algorithms from 461 developers.
FRTE matters to you if you are:
- A relying party running selfie-to-document matching in remote onboarding. See the Identity Proofing and KYC Guide.
- A credential service provider aiming at NIST IAL2 or IAL3, where SP 800-63A-4 sets numeric biometric performance requirements.
- A buyer comparing face matching suppliers, who needs to check marketing claims against the primary data.
- A risk or privacy lead who must evidence fairness testing for a data protection impact assessment.
Structure and key requirements
The two core tracks
| Item | FRTE 1:1 verification | FRTE 1:N identification |
|---|---|---|
| Question asked | Are these two images the same person? | Is this person in the gallery, and where? |
| Identity proofing use | Selfie against document photo; re-verification at account recovery | Duplicate enrolment checks; watchlist screening |
| Headline metric | FNMR at a fixed FMR (ranking at FMR 10-6) | FNIR at a threshold set for FPIR 0.003; rank-1 miss rate in investigation mode |
| Demographic reporting | FMR and FNMR by age, sex and region of birth | FPIR by group, Gini coefficient and MXOG (ISO/IEC 19795-10:2024 measures) |
| Status at 8 Nov 2026 | Open; summary updated 6 November 2026 | Closed 30 October to 30 November 2026; reopens with new datasets and a 1:1 prerequisite for new entrants |
The metrics in plain terms
| Metric | What it measures | Business meaning in identity proofing |
|---|---|---|
| FMR (false match rate) | Share of impostor comparisons wrongly accepted | A fraudster using someone else's document passes |
| FNMR (false non-match rate) | Share of genuine comparisons wrongly rejected | A real customer is turned away or sent to manual review |
| FPIR (false positive identification rate) | Share of non-mated searches returning a candidate above threshold | An innocent applicant is flagged as a duplicate or watchlist hit |
| FNIR (false negative identification rate) | Share of mated searches missing the correct person | A repeat fraudster enrols again undetected |
| Gini coefficient, max/geometric-mean ratio | Spread of error rates across demographic groups | How unevenly errors fall; smaller Gini and a ratio near 1 are better |
FMR and FNMR trade against each other through the threshold. Raising the threshold lowers FMR and raises FNMR. That is why FRTE fixes one rate and reports the other: "99.8% accurate" means nothing without the paired value.
Datasets and image quality
The 1:1 page ranks initially on the VISABORDER set, and also reports border, kiosk and mugshot results, plus airport entry photos paired with high-quality portraits. NIST states that false non-matches are strongly affected by image quality such as lighting and camera angle, while false matches can differ by demographic group even with good quality images, often because of training data imbalance. Selfies taken on consumer phones are closer to the border and kiosk sets than to visa portraits, so weigh those columns more.
Demographic findings
NISTIR 8280 (December 2019) tested 189 mostly commercial algorithms from 99 developers on 18.27 million images of 8.49 million people. Its main findings: false positive differentials are much larger than false negative ones, often 10 to 100 times across groups; women had higher false positive rates than men in most algorithms; children and older people had elevated false positive rates; and false negative differentials were generally under a factor of 3 and linked to image quality. It also found some algorithms with undetectable false positive differentials, and noted that one-to-one differentials usually, but not always, carry over to one-to-many search. The live FRTE pages continue to report demographic results per algorithm.
Two FRTE conventions matter when reading these tables. Demographic FMR on the 1:1 page uses a threshold set for 0.0003 overall FMR. On the 1:N page the threshold is set on one group and applied to all, because NIST notes subject demographics are usually unknown at capture.
Identity and NHI requirements
NIST SP 800-63A-4 (August 2025) turns benchmark thinking into requirements for credential service providers that use biometrics in proofing:
- 1:1 verification: FMR of 1:10,000 or better and FNMR of 1:100 or better.
- 1:N identification: FPIR of 1:1,000 or better, tested with a gallery at least 90% of operational size; enrolment cannot be declined on a 1:N hit without manual review.
- Demographic equity: no demographic group more than 25% worse than the overall population at a fixed threshold.
- Testing: conform to ISO/IEC 19795-1:2021 and 19795-10:2024, with periodic independent testing and publicly available results, which may be summarised.
- Consent: explicit informed consent before biometric collection, stored with the account.
The NIST SP 800-63A-4 Identity Proofing (IAL) Guide covers the rest of the standard. The machine side also needs care: the face matching service is called by your onboarding platform with an API key or client credential, often holding raw biometric templates. Treat that credential as a high-value non-human identity, scope it to the matching endpoint, and log every call. See the Secrets Management Guide.
Implementation steps
- Define your operating point. Decide the FMR your fraud risk can tolerate (for example 10-4 to match SP 800-63A-4, or tighter for high-value products) and the FNMR your customer experience can absorb.
- Pick the matching FRTE view. Use the 1:1 tables for selfie-to-document matching and the 1:N tables for deduplication. Choose the dataset column closest to your capture.
- Get the algorithm identifier. Ask each supplier which FRTE submission is in the product you would buy, its submission date and whether it is the version in production.
- Read the paired rates and demographic tables. Record FNMR at your FMR, plus the demographic FMR and FNMR spread for that exact algorithm.
- Test on your own images. NISTIR 8280 recommends operators test their chosen algorithm on their own operational images, possibly with a testing laboratory. Run a pilot with consented data, labelled by outcome.
- Set and document the threshold. Fix the threshold from the pilot, record the expected FMR and FNMR per group, and route borderline scores to trained reviewers.
- Write it into the contract. Require notice before algorithm changes, retesting after changes, and access to updated demographic results.
- Keep a rollback path. Keep the previous model version deployable and a manual review route available if live error rates drift.
Decision guidance
| Situation | What to weight most in FRTE | What to add beyond FRTE |
|---|---|---|
| Remote onboarding with phone selfies | 1:1 border and kiosk columns, FNMR at low FMR, demographic FNMR | Independent PAD and injection testing |
| Duplicate account detection | 1:N FNIR at your FPIR, demographic FPIR | Gallery-size testing near operational scale |
| Account recovery re-verification | 1:1 ageing-related results and FNMR | Fallback route for customers who fail |
| Small organisation buying an SDK | The supplier's named submission and its demographic tables | A short pilot on your own traffic |
| Large programme or government | All relevant columns across several submissions | Accredited laboratory testing to ISO/IEC 19795-10 |
Evidence and assessment
An assessor or DPIA reviewer should be able to trace the production algorithm back to public test data and forward to live performance.
- Algorithm provenance: FRTE submission name and date, plus supplier attestation that it matches production.
- Benchmark extract: saved copy of the FRTE rows used for selection, with the date retrieved, since tables change monthly.
- Pilot report: your own FMR and FNMR at the chosen threshold, broken down by demographic group where lawful.
- Independent test report: where SP 800-63A-4 or ETSI TS 119 461 applies, the laboratory report and its scope.
- Change log: every model or threshold change, with the retest result.
Questions to put to a supplier quoting FRTE
- Which track and dataset? 1:1 or 1:N, and which column the claim refers to.
- At what paired rate? The FNMR at which FMR, or the FNIR at which FPIR.
- Which submission? The exact algorithm name on the NIST page, and whether it is less than three years old (the 1:1 page splits results at that age).
- Is it the shipped version? Confirmation that the SDK or service you license runs that submission, or a later one also tested by NIST.
- What are its demographic results? The FMR and FNMR spread for that submission, not for the developer's best entry.
- What about speed? NIST notes that from 30 November 2026 template generation must take under 2,000 milliseconds per image on a single core of a named reference CPU; check the supplier's own timings on your hardware too.
Metrics to monitor in production
- Live FNMR proxy: share of genuine applicants failing face match and later passing manual review.
- Confirmed false accepts: fraud cases traced to a passed face match, per 10,000 onboardings.
- Group disparity: ratio of the worst group's failure rate to the overall rate, against the 25% ceiling.
- Manual review rate: borderline scores routed to humans; drift signals a capture or population change.
- Model currency: days since the production algorithm's FRTE submission.
Mapping to other frameworks
| Requirement area | Reference | How FRTE evidence helps |
|---|---|---|
| Identity proofing and evidence verification | NIST SP 800-53 Rev 5 IA-12, IA-12(3) | Shows the biometric comparison step is reliable |
| Proofing bound to credentials | NIST CSF 2.0 PR.AA-02 | Supports the claimed proofing strength |
| Supplier assessment | NIST SP 800-53 Rev 5 SR-6; CSF 2.0 GV.SC-07 | Independent data for supplier due diligence |
| Biometric performance testing | ISO/IEC 19795-1:2021, ISO/IEC 19795-10:2024 | FRTE demographic measures align with 19795-10 |
| EU trust service proofing | ETSI TS 119 461 (references ISO/IEC 19795-1) | Input to stated false acceptance and rejection goals |
For how face matching fits with deepfake defences, see the Deepfake-Resistant Identity Verification Guide.
Common pitfalls
- Quoting rank without rate: a "top 10" placing on one dataset tells you nothing at your threshold. Ask for FNMR at your FMR.
- Using the wrong dataset: visa portrait results flatter phone-selfie performance. Use the border and kiosk columns.
- Old or different algorithm in production: the benchmarked submission may not be the one in the SDK you license. FRTE splits results by submission age for this reason.
- Ignoring false positives by group: NISTIR 8280 found false positive differentials far larger than false negative ones, yet many teams only track rejections.
- Confusing matching with liveness: a strong FRTE result does not stop a replayed or injected video. Test PAD and injection detection separately.
- Treating a one-off pilot as permanent: populations, devices and models change; repeat testing after every significant change.
Practitioner checklist
- Write down your target FMR and acceptable FNMR before looking at any vendor data.
- Require each supplier to name the FRTE submission used in production and its date.
- Save dated extracts of the FRTE rows you relied on.
- Compare suppliers on the dataset column closest to your capture conditions.
- Review demographic FMR and FNMR for the named algorithm, not the developer's best entry.
- Pilot on your own consented images and set the threshold from that data.
- Monitor group disparity against the SP 800-63A-4 25% ceiling where it applies.
- Contract for change notice and retesting whenever the algorithm changes.
- Test presentation and injection attack detection separately from matching accuracy.
Standards and references
- NIST: Face Recognition Technology Evaluation (FRTE) 1:1 Verification
- NIST: Face Recognition Technology Evaluation (FRTE) 1:N Identification
- NIST: Face Technology Evaluations, FRTE and FATE
- NIST: NISTIR 8280 Face Recognition Vendor Test Part 3, Demographic Effects
- NIST: SP 800-63A-4 Identity Proofing and Enrollment
- NIST: FATE Presentation Attack Detection
Related NHI Mgmt Group resources: Biometric Liveness and Presentation Attack Detection Guide · Identity Proofing and KYC Guide · NIST SP 800-63A-4 Identity Proofing (IAL) Guide · DPIA Guide: Running a Data Protection Impact Assessment