AUC is the wrong number for identity verification

When AUC is used as the headline statistic, it misleads procurers on the efficacy of a model in real-world deployment. The correct statistic to optimize for depends on where failure is most catastrophic. In identity verification that is the false negative, so we measured recall instead, and nine of thirteen detectors changed position.

The correct statistic to optimize for is dependent on the area where failure is most catastrophic, or at the very least a strong understanding of the tradeoffs involved. In this study we focus specifically on model performance in KYC, an area where a false negative spells the highest catastrophe. We used two frontier models, Qwen Image Edit and HiDream-O1, to generate 4,632 synthetic faces from 2,316 bona fides across 628 identities, capped at five images per identity, in a style similar to photos required for government IDs. We then ran those 6,948 images through 19 perturbations that mimic real world conditions.

The goal was to assess the difference in false negatives, and to determine whether models remained effective when attacked under varied conditions.

What “98%” is actually measured on

Most published accuracy is measured on clean files directly from the generator. Attackers know this. At the least technical level in this domain, an attacker is skilled enough to pass their output through perturbations that mimic realistic conditions. We see this on social media, where content farmers add light layers of perturbation to make synthetic artifacts less visible. In identity verification several of those perturbations are simply expected: before reaching a system, a photo could be printed, photocopied, compressed, or changed in file type. Each of these removes the artifacts that models trained on clean conditions are built to detect.

Grid of synthetic passport-style face photos after phone capture, photocopy, print-and-scan and a chained print-scan, each labelled with its demographic cell. — Fig. 1Identity-preserved synthetic images passed through platform-realistic conditions in KYC: phone cameras, printers, scanners.

In academia, model performance is typically reported in AUC, an assessment of a model's ability to discriminate a real image from a synthetic one. In KYC the highest area of concern is the false negative, where poor performance leads to monetary losses and the disintegration of client trust. For this study we focused on recall as the core statistic instead, and to protect against models that enthusiastically label every image as synthetic, we set a ceiling of a 5% false-alarm rate on clean images. With a BPCER ceiling in place, recall shows a model's ability to detect synthetic images.

The same detectors, scored two ways

Table of thirteen detectors on clean images ranked by AUC, with inline bars for AUC and for synthetic IDs caught, and a change-in-rank column showing nine detectors moving position. — Fig. 2All thirteen detectors on clean images, no perturbation. Ranked by AUC, the number the field publishes, with what each actually catches beside it. Both columns describe the same detector on the same images.

Nine of thirteen detectors sit in a different position depending on which number you read. The third-best by AUC catches twenty-one points fewer forgeries than the fourth-best. Further down, the sixth and seventh, UFD at 24.9% and Corvi at 15.1%, are beaten by the eighth, EfficientNet-B4 at 40.3%. The single largest gap in the field sits between second and third place, and nothing in the AUC column tells you it is there.

None of that required a single perturbation. It is visible on clean images, in the same kind of evaluation the published numbers come from.

And it gets worse once the document moves

Grouped bar chart of the five strongest detectors showing synthetic IDs caught on clean images and after fax chain, photocopy, phone capture chain and print-then-scan conditions. — Fig. 3Photocopy, print then scan, a chained print-scan, and a phone capture chain, applied to the same 6,948 images. Each detector keeps the threshold it was given on clean.

From a quick look at the top performing models on clean conditions, not only do they collapse under platform emulation, but their performance under clean conditions is not a reliable predictor of how they will fare against perturbed images. The outcome is bleak. These models were selected for their high levels of performance on diffusion images. Bombek1 and SwinV2-Small both used diffusion-era off-the-shelf and generated datasets including frontier models like FLUX and DALL-E. Both of them make the cut on AUC. The error is in treating AUC as a reliable statistic in real-world deployment, especially in KYC.

Bombek1 holds an AUC of 0.904 on a printed and scanned document and catches 49% of the forgeries in front of it. The ranking survived. The decision did not. On a photocopy the same detector holds 0.787 AUC and catches 1.2%.

Measure what you will deploy, not what ranks well

AUC is a perfectly valid statistic for assessing a model's performance from an academic perspective. It measures how effectively a model discriminates real images from synthetic ones. The issue in vendor procurement is that “accuracy” is treated as a catch-all term without focus on the problem the detector is meant to solve. Sometimes it refers to AUC, other times to recall, other times to whichever statistic fits the marketing headline. When assessing a model's fit for your use case, understanding the relevant metrics is just as important as due diligence on its performance against realistic attacks.

The next articles on this benchmark will continue to assess model performance across different factors in the data generated and the approaches used in building the detectors.

If you want to know whether your own detector falls into this failure class, there are two ways to find out. Generate an API key and pull the open sample to reproduce these conditions yourself, or read the data card first for full composition and labeling detail. The rest of the corpus is held out so that nothing scored against it has been trained on it, and is measured through a managed evaluation rather than delivered as raw data. For a full report against your model, write to daniel@margensoftware.com.

Models used in this benchmark

Sumsub-ffs-synthetic-2.0 is a 2023 open research release under CC-BY-SA-3.0, not the vendor's production detector. Xception, F3Net and EfficientNet-B4 are the standard FaceForensics++ baselines run from the DeepfakeBench release with its published weights.

Method.Thirteen published detectors scored against 6,948 passport-style images, 2,316 genuine and 4,632 synthetic generated by HiDream-O1 and Qwen Image Edit, across 628 identities and 20 capture and reproduction conditions, for 1,806,480 scores in total. Each detector's threshold is the 95th percentile of its scores over the clean genuine images, giving a 5% false-alarm rate on clean, then held fixed across every condition. AUC is tie-corrected. Genuine images are licensed from commercial stock-media providers.