Testing

Testing Fingerprint and Face Recognition Systems

06 Oct 2026 — 8 min read

Biometric authentication is now a standard feature in mobile apps, access control systems, and financial applications. But unlike a password check — which is deterministic — fingerprint and face recognition systems are probabilistic. That fundamental difference makes testing them genuinely hard. A threshold that works for 99.9% of users will fail some fraction of the time in ways that are difficult to reproduce.

This guide covers the full testing surface: accuracy metrics, dataset selection, spoofing attack validation, SDK integration testing on Android and iOS, and automated strategies you can run in CI.

Understanding the Metrics: FAR, FRR, and EER

Before writing a single test, you need to understand what you're measuring.

False Acceptance Rate (FAR) — the probability that the system accepts an unauthorized user. High FAR = security risk.

False Rejection Rate (FRR) — the probability that the system rejects a legitimate user. High FRR = usability failure.

Equal Error Rate (EER) — the operating point where FAR equals FRR. It's a single-number summary of system accuracy; lower is better. Consumer devices typically target EER under 1% for fingerprint and under 0.1% for 3D face recognition.

These three metrics trade off against each other via a threshold parameter. Tightening the threshold reduces FAR but increases FRR. Your tests need to verify behavior at multiple threshold operating points, not just the default.

import numpy as np
from sklearn.metrics import roc_curve

def compute_biometric_metrics(genuine_scores, impostor_scores):
    """
    genuine_scores: similarity scores from same-person comparisons
    impostor_scores: similarity scores from different-person comparisons
    Returns FAR, FRR arrays and EER.
    """
    labels = np.concatenate([
        np.ones(len(genuine_scores)),
        np.zeros(len(impostor_scores))
    ])
    scores = np.concatenate([genuine_scores, impostor_scores])

    fpr, tpr, thresholds = roc_curve(labels, scores)
    fnr = 1 - tpr  # FRR = 1 - TPR

    # EER: point where FAR ≈ FRR
    eer_index = np.nanargmin(np.abs(fpr - fnr))
    eer = (fpr[eer_index] + fnr[eer_index]) / 2

    return {
        "FAR": fpr,
        "FRR": fnr,
        "thresholds": thresholds,
        "EER": eer,
        "EER_threshold": thresholds[eer_index]
    }

# Example usage
genuine = np.random.normal(0.85, 0.05, 1000)   # high similarity: same person
impostor = np.random.normal(0.30, 0.08, 5000)  # low similarity: different person

metrics = compute_biometric_metrics(genuine, impostor)
print(f"EER: {metrics['EER']:.4f} at threshold {metrics['EER_threshold']:.4f}")

You should be running this computation against every SDK version update and every hardware SKU you officially support.

Test Datasets

The quality of your biometric tests is bounded by the quality of your test data. There are three categories:

Public research datasets — Useful for baseline algorithm evaluation. FVC (Fingerprint Verification Competition) datasets cover 880 fingerprints per database. LFW (Labeled Faces in the Wild) and IJB-C are standard for face recognition benchmarks. These are clean, well-labeled, and well-studied.

Internal enrollment datasets — Collected from consenting employees or beta testers. These should mirror the demographic distribution of your actual users. Collect under varying conditions: different lighting for face, wet/dry fingers for fingerprint, different angles, glasses on/off.

Adversarial samples — Deliberately challenging inputs: low-quality captures, partial occlusions, twins for face recognition. These expose the edge of your system's operating envelope.

A minimal test suite requires:

At least 200 enrolled identities
5+ capture attempts per identity (for genuine score distribution)
At least 1000 cross-identity comparisons (for impostor score distribution)
Coverage of known challenging demographics and conditions

import json
import hashlib
from pathlib import Path

class BiometricTestDataset:
    def __init__(self, dataset_path: str):
        self.path = Path(dataset_path)
        self.manifest = self._load_manifest()

    def _load_manifest(self):
        manifest_file = self.path / "manifest.json"
        if not manifest_file.exists():
            raise FileNotFoundError(f"No manifest.json in {self.path}")
        with open(manifest_file) as f:
            return json.load(f)

    def get_genuine_pairs(self):
        """Return pairs of captures from the same identity."""
        pairs = []
        for identity in self.manifest["identities"]:
            captures = identity["captures"]
            for i in range(len(captures)):
                for j in range(i + 1, len(captures)):
                    pairs.append((
                        self.path / captures[i]["file"],
                        self.path / captures[j]["file"],
                        identity["id"]
                    ))
        return pairs

    def get_impostor_pairs(self, sample_size=1000):
        """Return pairs of captures from different identities."""
        import random
        identities = self.manifest["identities"]
        pairs = []
        for _ in range(sample_size):
            id_a, id_b = random.sample(identities, 2)
            cap_a = random.choice(id_a["captures"])
            cap_b = random.choice(id_b["captures"])
            pairs.append((
                self.path / cap_a["file"],
                self.path / cap_b["file"]
            ))
        return pairs

    def validate_integrity(self):
        """Check that all files exist and match expected checksums."""
        errors = []
        for identity in self.manifest["identities"]:
            for capture in identity["captures"]:
                filepath = self.path / capture["file"]
                if not filepath.exists():
                    errors.append(f"Missing: {filepath}")
                    continue
                actual_md5 = hashlib.md5(filepath.read_bytes()).hexdigest()
                if actual_md5 != capture.get("md5", actual_md5):
                    errors.append(f"Checksum mismatch: {filepath}")
        return errors

Spoofing Attack Testing

Presentation attacks (spoofing) are the main security threat against biometric systems. You need to test your liveness detection layer explicitly.

Fingerprint Spoofing

Common attack vectors:

2D printout — a printed photograph of a fingerprint
3D mold/cast — gelatin or silicone replica from a lifted latent print
Cooperative bypass — the authorized user's own finger under duress

Liveness detection (often called PAD — Presentation Attack Detection) should be tested with:

Printed paper fingerprints at 600 DPI and 1200 DPI
Gelatin casts with and without texture enhancement
Silicone replicas from commercially available molds

Document your APCER (Attack Presentation Classification Error Rate — the rate at which spoofs are accepted) and BPCER (Bona Fide Presentation Classification Error Rate — the rate at which real fingers are rejected by PAD).

Face Spoofing

The attack surface is wider for face recognition:

// Test case definitions for face liveness detection
const SPOOF_TEST_CASES = [
  {
    id: "photo_print_standard",
    description: "Printed A4 photo under office lighting",
    expectedResult: "REJECTED",
    attackType: "2D_PRINT"
  },
  {
    id: "photo_print_high_quality",
    description: "Professional print with glossy finish",
    expectedResult: "REJECTED",
    attackType: "2D_PRINT"
  },
  {
    id: "screen_replay_phone",
    description: "Face displayed on phone screen",
    expectedResult: "REJECTED",
    attackType: "REPLAY"
  },
  {
    id: "screen_replay_tablet",
    description: "Face displayed on tablet at native resolution",
    expectedResult: "REJECTED",
    attackType: "REPLAY"
  },
  {
    id: "3d_mask_paper",
    description: "Curved paper mask",
    expectedResult: "REJECTED",
    attackType: "3D_MASK"
  },
  {
    id: "genuine_with_glasses",
    description: "Real user wearing non-reflective glasses",
    expectedResult: "ACCEPTED",
    attackType: null
  },
  {
    id: "genuine_with_mask",
    description: "Real user with surgical mask (nose bridge visible)",
    expectedResult: "SYSTEM_DEFINED", // depends on SDK config
    attackType: null
  }
];

async function runSpoofTestSuite(biometricClient, enrolledUserId) {
  const results = [];

  for (const testCase of SPOOF_TEST_CASES) {
    const sample = await loadTestSample(testCase.id);
    const result = await biometricClient.verify({
      userId: enrolledUserId,
      sample,
      livenessCheck: true
    });

    results.push({
      ...testCase,
      actualResult: result.decision,
      livenessScore: result.livenessScore,
      passed: result.decision === testCase.expectedResult ||
              testCase.expectedResult === "SYSTEM_DEFINED"
    });
  }

  const failed = results.filter(r => !r.passed);
  return { results, failed, passRate: (results.length - failed.length) / results.length };
}

Android BiometricPrompt Integration Testing

Android's BiometricPrompt API abstracts over fingerprint and face recognition. Testing it requires either a physical device or an emulator with biometric enrollment, plus UI automation.

// Instrumented test using Espresso + BiometricTestRule
// Requires: testImplementation("androidx.biometric:biometric-testing:1.2.0-alpha05")

@RunWith(AndroidJUnit4::class)
class BiometricAuthFlowTest {

    @get:Rule
    val activityRule = ActivityScenarioRule(LoginActivity::class.java)

    // BiometricTestRule intercepts the system prompt in tests
    @get:Rule
    val biometricTestRule = BiometricTestRule()

    @Test
    fun successfulFingerprintAuth_navigatesToHomeScreen() {
        // Trigger authentication
        onView(withId(R.id.btn_login_biometric)).perform(click())

        // Simulate successful biometric match
        biometricTestRule.sendResult(BiometricManager.Authenticators.BIOMETRIC_STRONG,
            BiometricPrompt.AUTHENTICATION_RESULT_TYPE_BIOMETRIC)

        // Verify navigation occurred
        onView(withId(R.id.home_screen_root))
            .check(matches(isDisplayed()))
    }

    @Test
    fun failedBiometric_showsRetryPrompt() {
        onView(withId(R.id.btn_login_biometric)).perform(click())

        // Simulate failed match (e.g., wrong finger)
        biometricTestRule.sendFailure(
            BiometricPrompt.ERROR_NO_SPACE,
            "Biometric operation failed"
        )

        // Should still show the biometric prompt (not dismiss to password)
        onView(withId(R.id.biometric_prompt_container))
            .check(matches(isDisplayed()))
    }

    @Test
    fun biometricLockout_fallsBackToPin() {
        onView(withId(R.id.btn_login_biometric)).perform(click())

        // Simulate lockout after too many failures
        biometricTestRule.sendError(
            BiometricPrompt.ERROR_LOCKOUT,
            "Too many attempts. Try again later."
        )

        // App should offer PIN fallback
        onView(withId(R.id.btn_use_pin))
            .check(matches(isDisplayed()))
    }

    @Test
    fun biometricNotEnrolled_showsEnrollmentPrompt() {
        // Precondition: device has no enrolled biometrics
        // Use BiometricManager mock to simulate this state
        val mockManager = mock(BiometricManager::class.java)
        `when`(mockManager.canAuthenticate(BiometricManager.Authenticators.BIOMETRIC_STRONG))
            .thenReturn(BiometricManager.BIOMETRIC_ERROR_NONE_ENROLLED)

        onView(withId(R.id.btn_login_biometric)).perform(click())

        // Should navigate to system enrollment settings
        intended(hasAction("android.settings.BIOMETRIC_ENROLL"))
    }
}

Key things to test in Android BiometricPrompt flows:

Successful authentication with Class 3 (strong) biometric
Failed match retry behavior (up to 5 allowed before lockout)
Lockout state and fallback handling
Cancellation by user
BIOMETRIC_ERROR_NONE_ENROLLED handling
Crypto-backed authentication (verify the CryptoObject is properly validated)

iOS LocalAuthentication Integration Testing

On iOS, LAContext drives both Face ID and Touch ID. Unit testing requires mocking the framework since you cannot trigger real biometric prompts in XCTest.

import XCTest
import LocalAuthentication
@testable import YourApp

// Protocol for dependency injection
protocol BiometricAuthProviding {
    func canEvaluatePolicy(_ policy: LAPolicy) throws -> Bool
    func evaluatePolicy(_ policy: LAPolicy,
                        localizedReason: String) async throws -> Bool
}

// Production implementation wraps LAContext
class LAContextProvider: BiometricAuthProviding {
    private let context = LAContext()

    func canEvaluatePolicy(_ policy: LAPolicy) throws -> Bool {
        var error: NSError?
        let result = context.canEvaluatePolicy(policy, error: &error)
        if let error = error { throw error }
        return result
    }

    func evaluatePolicy(_ policy: LAPolicy,
                        localizedReason: String) async throws -> Bool {
        return try await context.evaluatePolicy(policy,
                                                localizedReason: localizedReason)
    }
}

// Mock for tests
class MockBiometricProvider: BiometricAuthProviding {
    var canEvaluateResult: Bool = true
    var canEvaluateError: Error? = nil
    var evaluateResult: Bool = true
    var evaluateError: Error? = nil

    func canEvaluatePolicy(_ policy: LAPolicy) throws -> Bool {
        if let error = canEvaluateError { throw error }
        return canEvaluateResult
    }

    func evaluatePolicy(_ policy: LAPolicy,
                        localizedReason: String) async throws -> Bool {
        if let error = evaluateError { throw error }
        return evaluateResult
    }
}

// Test suite
class BiometricAuthManagerTests: XCTestCase {

    var sut: BiometricAuthManager!
    var mockProvider: MockBiometricProvider!

    override func setUp() {
        super.setUp()
        mockProvider = MockBiometricProvider()
        sut = BiometricAuthManager(provider: mockProvider)
    }

    func test_authenticate_success_returnsTrue() async throws {
        mockProvider.evaluateResult = true
        let result = try await sut.authenticate(reason: "Test auth")
        XCTAssertTrue(result)
    }

    func test_authenticate_biometricNotAvailable_throwsNotAvailableError() async {
        mockProvider.canEvaluateError = LAError(.biometryNotAvailable)
        do {
            _ = try await sut.authenticate(reason: "Test auth")
            XCTFail("Expected error to be thrown")
        } catch let error as BiometricError {
            XCTAssertEqual(error, .notAvailable)
        } catch {
            XCTFail("Unexpected error type: \(error)")
        }
    }

    func test_authenticate_faceIDNotEnrolled_throwsNotEnrolledError() async {
        mockProvider.canEvaluateError = LAError(.biometryNotEnrolled)
        do {
            _ = try await sut.authenticate(reason: "Test auth")
            XCTFail("Expected error to be thrown")
        } catch let error as BiometricError {
            XCTAssertEqual(error, .notEnrolled)
        } catch {
            XCTFail("Unexpected error type: \(error)")
        }
    }

    func test_authenticate_userCancel_throwsCancelledError() async {
        mockProvider.evaluateError = LAError(.userCancel)
        do {
            _ = try await sut.authenticate(reason: "Test auth")
            XCTFail("Expected error to be thrown")
        } catch let error as BiometricError {
            XCTAssertEqual(error, .cancelled)
        } catch {
            XCTFail("Unexpected error type: \(error)")
        }
    }

    func test_authenticate_lockedOut_presentsFallback() async throws {
        mockProvider.evaluateError = LAError(.biometryLockout)
        do {
            _ = try await sut.authenticate(reason: "Test auth")
        } catch let error as BiometricError {
            XCTAssertEqual(error, .lockedOut)
            // Verify fallback was triggered
            XCTAssertTrue(sut.fallbackWasPresented)
        }
    }
}

Automated Testing Strategies

Continuous Accuracy Monitoring

Run your biometric accuracy suite in CI against every SDK update. The key insight: treat EER regression as a build-breaking failure, not a warning.

import pytest
import numpy as np

ACCEPTABLE_EER_THRESHOLD = 0.01  # 1% EER — adjust per your SLA

@pytest.fixture(scope="session")
def biometric_sdk():
    from your_biometric_sdk import BiometricEngine
    return BiometricEngine(model_path="models/current.bin")

@pytest.fixture(scope="session")
def test_dataset():
    return BiometricTestDataset("test_data/fingerprint_fvc2002_db1")

def test_eer_within_acceptable_range(biometric_sdk, test_dataset):
    genuine_scores = []
    impostor_scores = []

    for img_a, img_b, _ in test_dataset.get_genuine_pairs():
        score = biometric_sdk.compare(str(img_a), str(img_b))
        genuine_scores.append(score)

    for img_a, img_b in test_dataset.get_impostor_pairs(sample_size=2000):
        score = biometric_sdk.compare(str(img_a), str(img_b))
        impostor_scores.append(score)

    metrics = compute_biometric_metrics(
        np.array(genuine_scores),
        np.array(impostor_scores)
    )

    assert metrics["EER"] <= ACCEPTABLE_EER_THRESHOLD, (
        f"EER {metrics['EER']:.4f} exceeds threshold {ACCEPTABLE_EER_THRESHOLD}. "
        f"SDK regression detected."
    )

def test_far_at_operational_threshold(biometric_sdk, test_dataset):
    """At the default threshold, FAR must be under 0.1%."""
    default_threshold = biometric_sdk.get_default_threshold()
    impostor_accepted = 0
    total = 0

    for img_a, img_b in test_dataset.get_impostor_pairs(sample_size=5000):
        score = biometric_sdk.compare(str(img_a), str(img_b))
        if score >= default_threshold:
            impostor_accepted += 1
        total += 1

    far = impostor_accepted / total
    assert far < 0.001, f"FAR at default threshold: {far:.4f} (must be < 0.001)"

Device Matrix Testing

Biometric sensors vary significantly across device models. On Android alone, fingerprint accuracy differs between in-display optical sensors, capacitive sensors, and ultrasonic sensors. Maintain a device matrix and run your integration tests against each class.

// jest.config.js — device profiles for biometric test runs
const DEVICE_PROFILES = {
  android_capacitive: {
    platform: "android",
    sensorType: "capacitive",
    expectedMinAccuracy: 0.98,
    sdkLevel: 31
  },
  android_optical_udfs: {
    platform: "android",
    sensorType: "optical_udfps",
    expectedMinAccuracy: 0.96, // optical is generally less accurate
    sdkLevel: 33
  },
  ios_face_id_gen2: {
    platform: "ios",
    sensorType: "face_id",
    expectedMinAccuracy: 0.999,
    sdkVersion: "17.0"
  },
  ios_touch_id: {
    platform: "ios",
    sensorType: "touch_id",
    expectedMinAccuracy: 0.985,
    sdkVersion: "17.0"
  }
};

describe.each(Object.entries(DEVICE_PROFILES))(
  "Biometric accuracy on %s",
  (profileName, profile) => {
    let results;

    beforeAll(async () => {
      results = await runAccuracyBenchmark(profile);
    });

    test("meets minimum accuracy requirement", () => {
      expect(results.accuracy).toBeGreaterThanOrEqual(profile.expectedMinAccuracy);
    });

    test("enrollment completes within 3 attempts", () => {
      expect(results.avgEnrollmentAttempts).toBeLessThanOrEqual(3);
    });

    test("authentication latency under 500ms at p95", () => {
      expect(results.latencyP95Ms).toBeLessThan(500);
    });
  }
);

Common Failure Patterns to Watch For

Template aging — biometric templates degrade over time as fingers age, weight changes, or faces change. Test with samples captured 12+ months apart.

Demographic bias — FAR and FRR can differ across demographic groups. Your test dataset must include sufficient representation to detect these gaps. NIST FRVT (Face Recognition Vendor Testing) reports are the benchmark to compare against for face recognition.

Environmental sensitivity — fingerprint scanners fail with wet or dirty fingers; face recognition fails in bright sunlight or with significant illumination changes. Test each condition explicitly.

Enrollment quality gates — most SDKs expose an enrollment quality score. Verify that your application enforces a minimum quality threshold and provides clear feedback when enrollment fails.

Concurrent authentication — under load, some biometric backends serialize requests. Test behavior when multiple users authenticate simultaneously.

Summary

Testing biometric systems requires combining statistical accuracy measurement, adversarial attack simulation, SDK-level integration testing, and device matrix coverage. The FAR/FRR/EER framework gives you a principled way to quantify accuracy; treat EER regression as a hard CI gate. Spoof testing is non-optional — test at minimum with printed photos and replay attacks for face, and printed/mold attacks for fingerprint. For SDK integration, dependency injection against LAContext (iOS) and BiometricTestRule (Android) gives you fast, reliable unit tests that cover all the error paths the real hardware will eventually hit in production.