Toward Sub-1 kB Identity-Preserving Face Compression: A Benchmark of Codecs, a Custom Learned Codec, and Studies of Resolution, Demographic Fairness, Recompression, and Adversarial Robustness

1.1 Motivation and use cases

• The deployment target is a signed face payload embedded in a space-constrained 2D barcode or other low-bandwidth credential, where verification—not perceptual quality—is the binding requirement.The workflow compresses an aligned face to a hard byte budget, signs and encodes it, then decodes and matches it against a live capture.Source: §1.1 · pp. 6–7, Figure 2 · p. 7

1.2 Problem statement

• The task fixes detection and alignment, then requires every aligned crop to produce a self-contained bitstream of at most B bytes whose decoded embedding verifies against the same subject.The primary metric is EER, supported by FNMR at fixed operating points and statistical significance testing; experiments use B = 1024 and B = 512 across five resolutions, with 112 px as the working resolution.Source: §1.2 · p. 7

1.3 Goals and scope

• The scope combines uniform codec and matcher comparisons with a custom identity-focused codec and deployment studies of resolution, demographic bias, recompression, and no-box adversarial sanitization.The custom variants are Ours-FAST and Ours-ACCURATE; both enforce the hard budget through binary search over a frozen 64-entry gain table and emit self-describing containers.Source: §1.3 · pp. 7–8

1.4 Contributions

• At 1024 and 512 bytes, the study benchmarks ten codecs on two datasets and four face-recognition models under a uniform protocol, with broader matcher analysis testing ranking stability.The benchmark reports EER and FNMR with confidence intervals and significance tests; fourteen-model agreement reaches Kendall’s W = 0.85 overall and 0.89 excluding EdgeFace-family matchers.Source: §1.4 · p. 8
• Ours-ACCURATE’s advantage over Ours-FAST comes from its wider transform rather than its identity side-stream.Reallocating the side-stream’s 90–175 B leaves independent-matcher identity unchanged within Δid-cos ±0.005 while improving reconstruction PSNR by ∼0.8 dB.Source: §1.4 · pp. 8–9

1.5 Report roadmap

• The report progresses from related work, datasets, and protocol through codec benchmarking, custom-codec studies, ablations, fairness, recompression, adversarial robustness, statistical analysis, and conclusions.The roadmap assigns the benchmark to Section 5, the custom codec to Section 7, fairness to Section 11, recompression to Section 12, and adversarial robustness to Section 13.Source: §1.5 · p. 9

2 Background and Related Work

• At sub-1 kB, perceptual quality and biometric utility diverge; modern codecs outperform legacy JPEG, while downsampling damages identity less than aggressive lossy compression.These findings motivate the codec, resolution, and identity-preservation studies.Source: §2 · p. 9

2.1 General-purpose image codecs

• Modern codecs follow transform–quantise–entropy-coding pipelines; at matched quality, AVIF is roughly half JPEG’s size and WebP saves roughly 30%.JPEG is the baseline, while JPEG 2000, WebP, HEIF, AVIF, and JPEG XL provide progressively different transform and deployment trade-offs.Source: §2.1 · pp. 9–10

2.2 Learned image compression

• Learned codecs replace fixed transforms with jointly trained autoencoders and entropy models, while gain units enable continuous rate control; our codec uses binary search over a frozen 64-entry gain table.The learned-compression lineage progresses from factorised priors to hyperpriors, autoregressive models, and attention [6] [7] [15] [33].Source: §2.2 · p. 10

2.3 Face-specific compression

• Face-specific codecs exploit strong facial priors but risk identity hallucination; fine-tuning a learned backbone with ArcFace or CurricularFace identity loss preserves verification better at equal rate [10] [45].This literature motivates Ours-FAST and Ours-ACCURATE and requires validating embedding cosine similarity rather than perceptual metrics alone.Source: §2.3 · pp. 11–12

2.4 Face-recognition models

• Modern face-recognition systems map aligned crops to embeddings compared by cosine similarity; ArcFace, LVFace, TopoFR, and EdgeFace span accuracy and compute trade-offs [17] [19] [21].Using four anchor matchers avoids tying conclusions to one embedder and motivates demographic fairness evaluation.Source: §2.4 · p. 12

2.5 Image-similarity and quality metrics

• PSNR, SSIM, LPIPS, and DISTS provide fidelity or perceptual context, but embedding cosine similarity is the primary distortion criterion and verification EER the ultimate one [19, 28, 32, 46].Perceptual metrics only partially proxy biometric utility, and generative codecs can produce identity-altering reconstructions.Source: §2.5 · pp. 12–13

2.6 No-box adversarial attacks

• No-box attacks assume no victim-model access or queries and rely on transferability from tiny surrogates, foundation models, or training-free frequency manipulation [38] [47] [48].Because compression is low-pass and requantising, the study tests whether sub-1 kB coding incidentally sanitises perturbations or preserves them.Source: §2.6 · p. 13

3 Datasets

• The datasets bracket operating conditions: Color FERET is controlled and frontal, whereas AI-Solutions-KK is uncontrolled and demographically annotated, with identical framing isolating imaging conditions.Table 3 contrasts their complementary roles in the benchmark.Source: §3 · p. 14

3.1 Color FERET

• Color FERET provides 11,335 aligned crops from 994 identities as the clean, frontal benchmark where compression artefacts dominate identity loss.Its studio conditions and dataset-supplied attributes also make it the confirmatory fairness anchor.Source: §3.1 · p. 14

3.2 AI-Solutions-KK

• AI-Solutions-KK provides 17,534 aligned crops from 105 identities under varied pose, expression, illumination, background, and source-resolution conditions.Its per-identity Monk skin-tone, age, and gender attributes support the demographic-fairness analysis.Source: §3.2 · p. 15

3.3 Alignment and resolutions

• Both datasets use the same five-point similarity-transform template at 64, 96, 112, 168, and 224 px, isolating resolution while making 112 px the working setting.Color FERET reads landmarks from annotations, whereas AI-Solutions-KK predicts them with a detector and landmarker.Source: §3.3 · p. 16

3.4 Verification pairs

• Verification enumerates every unordered pair, scores all mated pairs, and uses a fixed seeded sample of at most 5×10^6 impostor pairs across conditions.Pairs are stored as integer index pairs, enabling vectorized cosine scoring and slicing by pose, identity, or demographic group.Source: §3.4 · p. 17

3.5 Demographic attributes

• KK demographic labels are automatically estimated and highly imbalanced: MST6 and MST7 contain 71% of identities, so fairness reports only MST5–MST10.Because labels are model-estimated and sparse groups cannot support subgroup error rates, KK fairness findings are exploratory alongside the Color FERET anchor.Source: §3.5 · p. 18

4 Evaluation Protocol

• Every codec is evaluated on 2 datasets, 12 configurations, 5 resolutions, and 2 byte budgets, with identity and pixel fidelity reported as separate axes.Figure 7 defines the five-stage measurement pipeline; all comparisons use a lossless aligned reference.Source: §4 · p. 19, Figure 7 · p. 20

4.1 Face-recognition roster

• Four anchor matchers span high-capacity and lightweight architectures, while a 14-model roster checks that identity conclusions do not hinge on one matcher.The anchors are arcface_antelopev2, lvface_l, topofr_r100, and edgeface_xs; identity-cosine tables additionally use the held-out inno-balanced embedder.Source: §4.1 · p. 20

4.2 Verification-accuracy metrics

• Verification uses compressed-vs-original cosine pairs and reports EER, FNMR at FMR 10^-2, 10^-3, and 10^-4, plus compression-induced ∆EER against the aligned reference.All genuine pairs are scored, while impostors use one fixed seeded sample capped at 5.0×10^6 across codecs, budgets, and matchers.Source: §4.2 · p. 21

4.3 Reconstruction-quality metrics

• Reconstruction quality is measured against aligned sources with PSNR, SSIM, MS-SSIM, LPIPS, and DISTS, without collapsing fidelity and verification into one score.PSNR, SSIM, and MS-SSIM are larger-is-better; LPIPS and DISTS are distances where lower is better.Source: §4.3 · p. 22

4.4 Operating points

• The operating grid crosses 1024- and 512-byte ceilings with 64, 96, 112, 168, and 224 px crops, using 112 px as the verification resolution.Encodes are selected at the largest setting fitting the ceiling; non-fitting crops are retained and their fit-rates reported separately.Source: §4.4 · pp. 22–23

4.5 Statistical methodology

• Paired McNemar and DeLong tests compare verification decisions and correlated ROC-AUCs, with Benjamini–Hochberg correction controlling false discoveries at q = 0.05.Kendall’s W measures cross-matcher codec-ranking agreement, while Cliff’s δ reports effect size.Source: §4.5 · pp. 23–24

4.6 Environment and per-codec settings

• All latency and codec comparisons use a fixed hardware/software environment and pinned encoder settings, while maximum-effort WebP, default modern-codec speeds, and default chroma handling remain explicit confounds.The quality search selects the largest setting at or below B and is capped at quality 94.Source: §4.6 · p. 24, Table 6 · p. 25

5 Benchmark of Existing Codecs

• At 512 B, AVIF, HEIF, JPEG XL, JPEG and JPEG 2000 mostly collapse to 28–99% FNMR@10^-4, while JPEG-AI, Ours-ACCURATE and WebP degrade more gracefully.WebP reaches 6.0% on Color FERET and 24.3% on AI-Solutions-KK, whereas JPEG-AI reaches 2.86% on Color FERET.Source: §5 · p. 25, §5.3 · p. 34, Figure 13 · p. 37
• The benchmark evaluates 1024- and 512-byte aligned crops using pixel-level identity cosine, PSNR, SSIM and LPIPS, then measures end-to-end EER across five resolutions and four anchor matchers.Tables 7–8 summarize rate–identity trade-offs, while Tables 9–16 provide the resolution/budget EER grids for Color FERET and AI-Solutions-KK.Source: §5.1 · p. 25, §5 · p. 25, §5.2 · p. 26

5.1 Rate-identity trade-off at the byte budget

• At 1024 B, JPEG-AI leads identity cosine at 224 px with 0.958 on Color FERET and 0.948 on AI-Solutions-KK, while Ours-ACCURATE leads at 112 px with 0.948 and 0.938, respectively.At 512 B, Ours-ACCURATE retains 0.797 on Color FERET and 0.776 on AI-Solutions-KK; JPEG collapses to 0.069 on Color FERET at 112 px.Source: §5.1 · pp. 25–26, Table 7 · p. 27, Table 8 · p. 28
• JPEG-FzT is mid-field at 1024 B but degrades fastest when the budget halves, reaching 0.104 identity cosine at 224 px/512 B on Color FERET; JPEG 2000 is more consistently poor across the grid.At 112 px/512 B, the identity ordering is JPEG 0.069 < JPEG 2000 0.193 < HEIF 0.309 < JPEG-FzT 0.466.Source: §5.1 · p. 26

5.2 Equal-error rate across the grid

• At 1024 B, Plain JPEG has 0.25% EER and is borderline, while JPEG 2000 reaches 3.23% EER, already an order of magnitude worse.At 512 B and 112 px, WebP and JPEG-AI remain low at 0.46% and 0.27% EER, respectively.Source: §5.2 · p. 28
• Ours-ACCURATE’s EER decreases with resolution, from 1.36% at 64 px to 0.07% at 224 px at 1024 B on Color FERET/ArcFace, reaching 0.14% at 112 px.At 512 B and 112 px, Ours-ACCURATE reaches 0.22% EER and Ours-FAST 0.55%; both variants are covered under all four anchor matchers.Source: §5.2 · pp. 28–29

5.3 Operating-point accuracy: FNMR at fixed FMR

• 6.93% FNMR at FMR=10^-4 on AI-Solutions-KK makes Ours-ACCURATE best at 512 B and 112 px, beating WebP by 17.35 percentage points; it also leads Color FERET at 1.83%.At 1024 B, JPEG-AI leads Color FERET at 1.00% and AI-Solutions-KK at 2.92%, with Ours-ACCURATE effectively tied in-the-wild at 2.93%; at 224 px/512 B, WebP leads instead.Source: §5.3 · p. 34, Table 20 · p. 35, Table 21 · p. 36

5.4 Operating points at the 224 px source resolution

• Ours-FAST cannot reliably reach 512 B at 224 px, with only 80% of Color FERET and 14% of AI-Solutions-KK crops fitting the budget.Its high-resolution rate floor causes over-budget outputs, while Ours-ACCURATE remains within budget through its low-rate levels and identity-only fallback.Source: §5.4 · p. 39
• At 224 px and 512 B, WebP leads while Ours-ACCURATE falls to fifth on Color FERET and worst among budget-compliant modern codecs on AI-Solutions-KK.Ours-ACCURATE reaches 4.17% ArcFace FNMR on Color FERET versus WebP’s 2.60%, and 30.43% on AI-Solutions-KK versus WebP’s 6.64%.Source: §5.4 · p. 39, Table 22 · p. 40, Table 23 · p. 41
• Across codec-specific optimal resolutions, learned codecs lead at both budgets: Ours-ACCURATE reaches 0.57% at 1024 B and 1.83% at 512 B.At 1024 B, the learned codecs prefer 224 px, whereas at 512 B Ours-ACCURATE prefers 112 px and JPEG-AI 168 px.Source: §5.4 · p. 39, Table 24 · p. 41

5.5 The sub-1 kB error floor

• Ours-ACCURATE holds 0.14%/0.15%/0.15%/0.22% EER across 1024/960/768/512 B, while AVIF rises 0.11% to 2.71% and JPEG 0.28% to 33.4%.The intermediate-budget sweep confirms a classical-codec error floor below approximately 800 B, whereas byte-budgeted learned codecs degrade gracefully.Source: §5.5 · p. 42, Table 25 · p. 43, Figure 15 · p. 43

5.6 Per-matcher consistency

• The codec ranking remains stable across all fourteen matchers and both resolutions, although absolute EER is higher for weaker matchers and in-the-wild data.At 224 px, JPEG and JPEG 2000 still collapse at 1.7–7.6% EER, while strong codecs reach 0.03% under CVLface IR-101 and 0.07% under ArcFace.Source: §5.6 · p. 44, Table 26 · p. 44, Table 27 · p. 47

5.7 Budget compliance: can the codec even hit the target?

• At 512 B, standard block codecs fit essentially no AI-Solutions-KK crops at 168 or 224 px, whereas JPEG-AI and learned codecs reliably meet the budget.JPEG 2000 also fits through genuine rate control, but it sacrifices identity; Ours-ACCURATE maintains 80% compliance at 96 and 168 px, while Ours-FAST can fall to 9% at 168 px.Source: §5.7 · p. 50, Figure 20 · p. 51, Table 30 · p. 51

5.8 Headline ranking and discussion

• At 1024 B, JPEG-AI leads identity preservation, modern block codecs remain practical, and at 512 B standard codecs sharply degrade while the JPEG family becomes unusable.Our codec sits between JPEG-AI and AVIF at 1024 B and ahead of AVIF at 512 B on Color FERET; identity cosine and verification EER matter more than PSNR.Source: §5.8 · p. 54

6 Reconstruction Quality

• At 1024 B, Ours-ACCURATE leads LPIPS/DISTS but trails classical codecs on PSNR/SSIM, while quality metrics do not reliably predict verification EER.At 112 px, Ours-ACCURATE scores LPIPS 0.012 and DISTS 0.095, versus WebP 0.045 / 0.142, but PSNR 28.63 dB and SSIM 0.834; at 512 B, perceptual metrics track EER most tightly.Source: §6 · p. 54, §6.1 · p. 55, §6.2 · pp. 55, 57

6.1 Full-reference metric matrix

• JPEG-AI and WebP lead structural fidelity, whereas Ours-ACCURATE leads learned perceptual quality; plain JPEG ranks near-last, with CompressAI results limited to 300 crops.JPEG-AI reaches SSIM 0.920 and MS-SSIM 0.984 at 112 px / 1024 B, while WebP reaches PSNR 33.45 dB on 11,335 crops.Source: §6.1 · pp. 54–55, Table 33 · p. 56

6.2 Distortion does not predict identity

• At 1024 B, PSNR does not significantly predict EER across twelve codecs (ρ=−0.45, p=0.14), but at 512 B DISTS correlates most tightly with EER (ρ=+0.96).Removing partial-coverage neural baselines makes PSNR predictive at 1024 B (ρ=−0.82, p=0.004), while JPEG 2000 reaches 3.23% EER despite 27.77 dB PSNR and Ours-ACCURATE reaches 0.14% EER despite roughly 5 dB less PSNR than WebP.Source: §6.2 · pp. 55, 57, Figure 22 · p. 57

6.3 Face image quality (FIQ)

• At 1024 B, all codecs preserve near-original face image quality except legacy JPEG at 224 px; at 512 B, JPEG and JPEG-FzT degrade sharply while learned codecs remain stable.Ours-FAST and Ours-ACCURATE maintain FIQ ≥0.946 across every resolution-budget cell, while legacy JPEG falls from 0.95→0.80 at 112 px on Color FERET.Source: §6.3 · pp. 57–58, Table 34 · p. 58

6.4 Visual comparison

• Montages show JPEG-AI retaining the most facial structure, classical codecs preserving skin tone while softening texture, JPEG blocking worst, and learned codecs degrading gently with a tone-shift caveat.At 112 px / 1024 B, Ours-ACCURATE preserves sharper identity cues than WebP/AVIF, but slightly darkens or shifts colour on mid- and dark-skin crops.Source: §6.4 · pp. 59–60, Figure 24 · p. 60

6.5 Budget and resolution sweeps

• Halving the budget makes WebP lose 30.46→26.78 dB PSNR, whereas Ours-ACCURATE loses only 27.26→25.78 dB and keeps LPIPS nearly flat at 0.014→0.022.At 1024 B, larger crops carry more detail but compress harder; 112 px is adopted as the working point, and Ours-FAST often cannot reach 512 B at 224 px.Source: §6.5 · pp. 60–61, Table 35 · p. 61

6.6 Codec properties and deployment characteristics

• Deployment separates codecs by licensing, hardware support, and budget fit: JPEG 2000, HEIF, JPEG-FzT, JPEG-AI, and both Ours variants reach 1 kB on ≥99.9% of crops.WebP reaches 94% on Color FERET and 29% on AI-Solutions-KK at 224 px, while JPEG XL reaches 87% and 38%, respectively; strongest codecs generally lack decoder silicon.Source: §6.6 · pp. 61–62

6.7 Encode and decode speed

• Classical encode latency spans 0.26 ms for JPEG to 172 ms for HEIF, while JPEG-AI takes 2934 ms; learned codecs are GPU-accelerated but remain slower and near-symmetric.Ours-ACCURATE falls from 262/365 ms CPU encode/decode to 54/63 ms on GPU, whereas JPEG-AI still takes 1824/959 ms on GPU.Source: §6.7 · p. 62, Table 36 · p. 63

6.8 Why is JPEG-AI so slow, and can it be sped up?

• JPEG-AI measurements use 1108–1113 B operation points, approximately 8.5% over the 1024 B target, so the decoder-profile conclusion is slightly non-compliant.The timing study uses ISO/IEC 6048-1 reference software at the rate-matcher’s nearest point to the budget.Source: §6.8 · p. 63
• 0.57–1.19 s decode and 2.7–9.3 s encode per crop put JPEG-AI 10^3–10^4 times slower than classical codecs.The comparison uses one CPU thread for sub-1 kB 2242 crops; JPEG encodes in 0.26 ms and decodes in 0.27 ms, while HEIF encodes in 172 ms.Source: §6.8 · p. 63
• Sequential autoregressive context coding and arithmetic coding dominate decode, while bitrate-matching rate search makes encoding several times slower.JPEG-AI’s VAE transforms add computation, but the sequential coder prevents effective GPU parallelization and small crops limit GPU amortization.Source: §6.8 · p. 64
• 1192 ms →572–599 ms CPU decode cuts roughly half the latency when moving from HOP to SOP/BOP, costing only 0.6–0.9 dB PSNR and 0.004 identity cosine.A GPU cuts encode time by 1.4–4.8× but provides little SOP/BOP decode benefit and only 1.8× at HOP; even optimized GPU decoding remains about 0.63 s per crop.Source: §6.8 · p. 64
• ArcFace EER remains 0.140/0.147/0.140% across SOP/BOP/HOP, so SOP is recommended at no verification-accuracy cost.On n=600 AI-Solutions-KK faces, reconstruction identity cosine rises 0.935→0.941 while verification EER stays flat; SOP is about twice as fast as HOP on CPU.Source: §6.8 · p. 64, Table 38 · p. 65

7.1 Architecture

• Both variants use a third hyper-downsample to reduce the hyperprior latent from x/64 to x/128, lowering the byte floor from roughly 524 B to about 48 B at 112 px.Ours-FAST is a 1.35 M-parameter attention-free network, whereas Ours-ACCURATE is an approximately 18.7 M-parameter model with attention, an identity side-stream, and a refinement head.Source: §7.1 · p. 70

7.2 Hard byte-budget container

• The codec enforces a hard ≤B-byte ceiling by binary-searching a frozen 64-entry gain table against measured rANS output, then storing the selected rate index in a self-describing container.The container has 7 B fixed overhead and includes an identity-only fallback for pathological crops or budgets too small for spatial latents.Source: §7.2 · pp. 70–71, Figure 31 · p. 71, Table 39 · p. 71

7.3 Variable-rate gain and training

• A single model spans rate and resolution settings by sampling gain levels and resolution buckets during training, optimizing rate, perceptual, pixel, structural, and warmed-up identity-cosine losses.Training uses WebFace42M, while Color FERET and AI-Solutions-KK are evaluation-only; the supplied checks found celebrity-identity overlap in AI-Solutions-KK but no image overlap signal.Source: §7.3 · pp. 71–73

7.4 Identity side-stream and refine head

• The ACCURATE side-stream compresses a frozen EdgeFace-S embedding into an approximately 90–175 B identity payload that modulates decoding through FiLM and a gated refinement head.On independent matchers, removing it changes median identity cosine by only +0.0002 on average while improving PSNR by 0.82 dB, so the same bytes favor the spatial latent outside the EdgeFace family.Source: §7.4 · pp. 73–74
• The stored side-code is linkable biometric data: mean-centering enables re-identification with EER 17.0% and ROC-AUC 0.914, versus 50.2% and 0.498 for a random code.A naive cosine attack is weaker at EER 35.8% and ROC-AUC 0.63, but the side-channel still requires template protection.Source: §7.4 · pp. 74–75

7.5 Results versus classical and JPEG-AI

• At 224 px and 1024 B, Ours-ACCURATE reaches identity cosine 0.947 on Color FERET and 0.934 on AI-Solutions-KK, ranking behind JPEG-AI and ahead of AVIF and WebP on Color FERET.At 512 B its identity cosine falls to 0.797 and 0.776, while Ours-ACCURATE and JPEG-AI are the only codecs that consistently meet the 224 px budget.Source: §7.5 · p. 75, Table 40 · p. 76

7.6 Held-out independent-matcher evaluation

• At 512 B, Ours-ACCURATE is the best codec on both datasets under the independent cvlface_ir101 matcher, reaching EERs of 0.08% on Color FERET and 0.92% on AI-Solutions-KK.At 1024 B it ranks fourth on Color FERET at 0.05% EER and first on AI-Solutions-KK at 0.51%, while preserving the ACCURATE > FAST and modern-codec rankings.Source: §7.6 · pp. 76–77

7.7 Known limitations

• Ours-FAST frequently cannot meet 512 B at high resolution, with only 14% of AI-Solutions-KK and 80% of Color FERET crops fitting the 224 px target.Its rate floor also causes overflow in parts of the 96/168 px grid, whereas Ours-ACCURATE overflows on approximately 20% of crops in the reported 512 B grid cells.Source: §7.5 · p. 75, §7.7 · p. 77
• Budget compliance failures occur mainly at 96 and 168 px because the frozen gain table cannot reduce rANS output below the fixed 7 B container overhead.The encoder emits the smallest valid reconstruction rather than a blank identity-only frame, so over-budget outputs remain clean but count as violations.Source: §7.7 · p. 78
• At 224 px, Ours-ACCURATE keeps at least 99.98% of crops within budget across datasets and budgets, while both variants remain fully compliant at 64 and 112 px.Ours-ACCURATE does not show the 224 px compliance problem; the remaining misses are concentrated in the 96/168 px buckets, with FAST also missing at 224 px/512 B.Source: §7.7 · p. 78
• At 1024 B, Ours-ACCURATE’s Color FERET ArcFace EER decreases from 1.36% at 64 px to 0.07% at 224 px, but 512 B performance is non-monotonic.At 512 B, the same sequence includes 0.22% at 112 px, 0.57% at 168 px, and 0.37% at 224 px because larger crops are starved by the byte ceiling.Source: §7.7 · p. 78

7.8 Worst-case identity tail

• At 512 B, Ours-ACCURATE achieves the highest identity-cosine 5th percentile on both datasets, reaching 0.802 on Color FERET and 0.763 on AI-Solutions-KK.Its worst-case tail exceeds WebP’s median, while WebP and AVIF fall to p5 values of 0.60/0.58 and 0.33/0.31, respectively.Source: §7.8 · p. 79, Table 43 · p. 79

Difficulty is only moderately codec-shared

• Difficulty is only moderately shared across codecs, with mean pairwise ρ=0.33 on Color FERET and 0.38 on KK; legacy JPEG is an outlier, while learned codecs avoid its widespread failures.Modern block codecs agree more strongly, whereas legacy JPEG correlates at most 0.22 with other codecs and has median id-cosine 0.05 at 512 B.Source: §8 · pp. 80–81

Setup

• At 512 B, the analysis uses 300 aligned crops per dataset and defines difficulty as 1−id-cos against each crop’s clean counterpart, isolating compression loss from pose, expression, and illumination.Descriptors are computed on clean crops, and difficulty is averaged over nine codecs for image-level significance testing.Source: §8 · p. 80

What makes a crop hard — and what does not

• On Color FERET, fine detail predicts greater difficulty (Laplacian variance ρ=+0.39; luma contrast +0.30), while colourfulness predicts lower difficulty (ρ=−0.36); no descriptor is significant on KK.The detail effect is dataset-specific: KK correlations remain |ρ| ≤0.10, with Laplacian variance ρ=+0.10 and p=0.08.Source: §8 · pp. 79–80

Trivial vs. difficult crops

• Ours-ACCURATE’s hardest five Color FERET crops retain id-cosine 0.75–0.80, versus 0.42–0.52 for WebP, showing its advantage is concentrated on the hard tail.The codecs agree only partly on hard crops, with rank ρ=0.32 and one crop shared between their hardest-five sets.Source: §8 · p. 80, Figure 32 · p. 81

What makes a crop hard — and what does not

• On Color FERET, pose is uninformative (|yaw| ρ=−0.02, p=0.74), while glasses appear in 2 of 30 hardest versus 3 of 30 easiest crops (Fisher exact p=1.0).Source: §8 · pp. 80–81, Table 45 · p. 82

9.1 Resolution–information trade-off

• 112 px preserves nearly all identity information while improving 1 kB allocation: AC energy is 0.9997, strong-match­er cosine remains ≥0.98 at 96 px, and ArcFace EER rises from 0.21% to 0.39% at 64 px.The study therefore adopts 112 px, where clean accuracy is essentially saturated relative to 224 px while fewer pixels must be reconstructed.Source: §9.1 · p. 84, Table 46 · p. 85, Figure 34 · p. 85

9.2 Preprocessing, measured through the codec

• Chroma reduction (A3) is identity-neutral through compression, whereas denoising raises EER and Ours-ACCURATE is most robust to preprocessing.WebP A3 changes ArcFace EER only from 0.42% to 0.39%, while WebP A1 increases it from 0.42% to 1.41%; Ours-ACCURATE’s worst operator costs +0.63 pp.Source: §9.2 · pp. 85–86, Table 47 · p. 86

9.3 Alignment tightness

• Tightening the crop monotonically harms clean 112 px verification, with EdgeFace-XS EER increasing from 0.39% at standard to 26.71% at fill.Extreme crops clip the forehead and jawline, especially damaging the compact matcher; the standard crop remains the correct default.Source: §9.3 · pp. 88–89, Table 50 · p. 89

9.4 JPEG-FzT radius

• At approximately 1005 B and PSNR 28.1, JPEG-FzT radius 2 lowers LPIPS from 0.188 to 0.117 versus radius 1, making it the preferred default.PSNR is nearly unchanged, while the perceptual improvement remains substantial; the triangle kernel reaches LPIPS 0.118 at 1022 B.Source: §9.4 · pp. 89–90, Figure 39 · p. 91

10.3 Experiment 1 — are the annex parameters better than ours?

• At 1024 B, two thirds of Annex E/F head-to-head comparisons are statistically indistinguishable, while their JPEG 2000, JPEG, HEIF and AVIF choices produce the documented exceptions.The annex JPEG 2000 entry is better by 1.38 pp on Color FERET and 4.65 pp on AI-Solutions-KK; their JPEG and HEIF entries are better in the wild, while 56 px AVIF is worse on Color FERET.Source: §10 · p. 91, §10.3 · pp. 92–93, Table 51 · p. 93

10.1 How the annex parameters were derived

• The annexes optimize self-similarity rather than verification, using one matcher and one-factor-at-a-time searches that omit interactions among resolution, colour and masking.Every case maximizes same-image cosine similarity without impostor pairs, mated cross-capture pairs or EER, while the search fixes 112 px and varies one flag at a time.Source: §10.1 · pp. 91–92

10.2 Protocol

• The protocol evaluates both self-similarity and EER under symmetric and asymmetric compression, using the annex matcher separately from four anchor matchers and confirming conclusions under both protocols.Cells are compressed to ≤1024 B by binary search, decoded and embedded after resizing to 112 px; quoted results use the symmetric convention.Source: §10.2 · p. 92

10.4 Experiment 2 — is there a better set than either?

• A joint sweep improves over both parameter sets only reliably for JPEG 2000 and JPEG, while its WebP winner becomes significantly worse on held-out AI-Solutions-KK.The selection-set sweep wins in 5 of 6 codecs, but full-population confirmation finds significant gains only for JPEG 2000 on both corpora and JPEG in the wild; WebP worsens by 0.16 pp.Source: §10.4 · pp. 93–94, Table 53 · p. 94

10.7 Recommendation to WG 3

• Resolution dominates the joint sweep: mean EER is 0.92% at 56 px versus 0.43% at 96–168 px, making the annexes’ small resolutions the clearest correctable error.The 56 px AVIF entry is also the only measurably harmful head-to-head annex choice, and JPEG-AI reaches its optimum at 168 px.Source: §10.4 · p. 94, §10.7 · p. 97
• Greyscale and masking should be codec-specific: greyscale meaningfully helps JPEG 2000 but frees little for modern codecs and nothing for JPEG-AI, while masking transfers inconsistently.Greyscale frees up to 66% for JPEG 2000 at 224 px versus 5–17% for AVIF, JPEG XL and HEIF; only two of five manipulated winners reproduce on held-out data.Source: §10.4 · pp. 94–95, §10.7 · p. 97

10.5 Does self-similarity predict verification error?

• Self-similarity is a useful coarse proxy for verification error but cannot resolve near-optimal configurations, with Spearman ρ = −0.77 and systematic preference for blur and lower resolution.It selects configurations up to 1.9× worse than the EER optimum, including WebP at 0.160 versus 0.085%, HEIF at 0.186 versus 0.108%, and JPEG at 0.408 versus 0.241%.Source: §10.5 · pp. 95–96, Table 57 · p. 96

10.6 JPEG-AI

• JPEG-AI does not benefit from Annex E/F greyscale or masking: greyscale roughly doubles EER without freeing bytes, while full blur is worst and contour masking matches no manipulation.At 1024 B, the learned entropy model uses essentially the same median size for colour and greyscale, 979 versus 980 B.Source: §10.6 · pp. 96–97

11 Demographic Fairness

• The fairness evidence is strongest on Color FERET ground-truth labels; KK skin-tone findings are exploratory because tones are model-estimated, cohorts are small, and EdgeFace-anchored Ours scores are confounded.Independent ArcFace, LVFace-L, and TopoFR comparisons are the trustworthy learned-codec fairness results, while MST8 and sparse Color FERET cells require caution.Source: §11 · p. 98, §11.1 · p. 100, Table 61 · p. 102

11.1 Subgroup equal-error rates

• Subgroup EERs remain low for strong codecs, but every lossy codec exceeds the uncompressed baseline and JPEG 2000 raises errors by an order of magnitude.At 1024 B on Color FERET, overall skin-tone EER is 0.70% for WebP and AVIF versus 6.08% for JPEG 2000; Ours-ACCURATE records 0.64%.Source: §11.1 · pp. 98–99, Table 59 · p. 99, Table 60 · p. 99

11.2 Skin-tone effects

• Compression preserves demographic ordering rather than creating a monotonic darker-is-worse effect: MST8 remains hardest, while MST10 remains among the easiest on model-estimated KK tones.On Color FERET, Asian and Black remain hardest and White and Hispanic easiest; Ours-ACCURATE is fairer than Ours-FAST across tabulated cohorts.Source: §11.2 · pp. 100–101

11.3 Pose, age, and gender

• Profile pose is the largest within-attribute swing, sex shows a small stable female-over-male gap, and age effects are modest without compression-induced reordering.Profile EER reaches 5.18% under JPEG 2000 versus approximately 0% frontal; AI-Solutions-KK gender gaps stay below 0.7 pp except for JPEG 2000.Source: §11.3 · p. 101

11.4 Disparity summary

• At 1024 B, JPEG 2000 produces the largest demographic disparity on every attribute and dataset, while WebP, AVIF, and HEIF remain closest to baseline but still widen gaps.JPEG 2000 reaches 3.74–6.49 pp on KK skin tone, 4.66 pp on Color FERET ethnicity, and 2.89 pp on pose; strong codecs still increase disparity over baseline.Source: §11.4 · p. 102, Table 61 · p. 102, Table 62 · p. 103

11.5 Fairness at the tighter 512-byte budget

• At 512 B, Ours-ACCURATE is lowest or near-lowest on independent anchors, with 0.93–1.17 pp KK skin-tone disparity and 0.4–0.5 pp Color FERET ethnicity disparity.Legacy JPEG reaches 8.3–12.3 pp on Color FERET ethnicity, while Ours-ACCURATE’s fairness advantage grows rather than erodes at the recommended budget.Source: §11.5 · pp. 105–106, Figure 41 · p. 106
• At 512 B, differential FMR remains codec-invariant: every codec stays within 1.7–2.9 pp at FMR=10^-2, and all codecs remain below 0.64 pp on ArcFace at FMR=10^-3.This extends the 1024 B pattern and finds no learned-codec fairness problem at the tighter budget.Source: §11.5 · p. 106

11.6 Differential false-match rate (imposter acceptance)

• Color FERET is the trustworthy FMR axis; AI-Solutions-KK is not reported because sparse Monk-tone cohorts yield coarsely quantised rates and many exact-zero cells.The KK cohorts contain only 4–7 identities each, with 274 or 413 within-group impostor pairs for the two matchers.Source: §11.6 · p. 107
• Chroma-subsampling effects are not isolated: codecs use their defaults, so reported disparities represent codec-choice effects rather than controlled 4:2:0-versus-4:4:4 effects.A fixed-codec comparison is left for future work.Source: §11.6 · p. 107
• The learned codec shows a mild directional brightness shift toward brighter reconstructions for darker skin tones, but it remains below the level affecting verification EER and is only a watch item.For Ours-ACCURATE at 112 px/1024 B, bright_delta is +1.28% for the dark tertile, +0.71% for mid, and +0.23% for light; the shift is stable across budget and resolution.Source: §11.6 · p. 107
• At 1024 B, compression preserves the ordering of hardest demographic groups but inflates absolute gaps from negligible-to-mild for WebP, AVIF, HEIF and JPEG-AI to severe for JPEG 2000.JPEG and JPEG XL produce moderate inflation, making demographic-gap magnitude codec-dependent.Source: §11.6 · p. 107
• At 10^-2 FMR, every codec and the uncompressed baseline occupies a 0.7–3.6 pp ethnicity-disparity band, with JPEG 2000 unremarkable despite being the EER-disparity outlier.The largest FMRs occur for Black cohorts and the smallest for White cohorts under every codec, indicating matcher-by-population effects rather than codec effects.Source: §11.6 · p. 107, Table 65 · p. 109

12.1 Setup

• The study evaluates all 8×8 ordered codec pairs at 112 px and 1024 bytes, reporting chain EER and delta-EER against the second codec’s single-pass baseline on two datasets.The matrix includes six standard codecs, JPEG-FzT, and Ours-ACCURATE; JPEG-AI and CompressAI neural baselines are excluded because reference decoding makes the full matrix intractable.Source: §12.1 · p. 110

12.2 Delta-EER results

• On Color FERET, modern-to-modern chains stay within roughly 1 pp delta-EER, whereas JPEG XL→HEIF reaches 17.14% EER and JPEG 2000-bearing chains add about 4.9–5.0 pp.AVIF→AVIF and WebP→WebP achieve 0.68% and 0.71% EER, respectively; the JPEG XL spikes arise from interaction with HEVC/AV1 intra coding, while JPEG 2000’s damage is additive.Source: §12.2 · pp. 111–112

12.3 Generalization to AI-Solutions-KK

• The AI-Solutions-KK matrix reproduces the Color FERET ordering: JPEG XL→HEIF and JPEG XL→AVIF are catastrophic, JPEG 2000 remains poor, and modern-to-modern chains stay near baseline.JPEG XL→HEIF reaches 24.17% EER and JPEG XL→AVIF 15.34%; WebP→WebP and AVIF→AVIF are 2.31% and 2.66%.Source: §12.3 · p. 113, Table 67 · p. 114

12.4 Worst-case chains

• 17.14%/24.17% EER for JPEG XL→HEIF and 8.00%/15.34% for JPEG XL→AVIF make these the worst 1024-byte chains on Color FERET/AI-Solutions-KK, respectively.The corresponding delta-EERs are +16.31/+21.01 pp and +7.38/+12.69 pp; JPEG 2000-bearing chains also remain consistently poor.Source: Table 66 · p. 111, §12.4 · p. 114, Table 67 · p. 114
• ArcFace rescoring confirms the recompression pattern independently: JPEG XL→HEIF is worst at 14.2% EER, modern pairs stay at or below 0.39%, and JPEG 2000-bearing chains remain poor.At 512 bytes, JPEG 2000→JPEG reaches 45.7% EER, while Ours-ACCURATE→Ours-ACCURATE is 0.64% on ArcFace.Source: §12.4 · pp. 114–115

12.5 Tighter 512-byte budget

• At 512 bytes, JPEG 2000→JPEG reaches 46.64% EER on Color FERET and 41.03% on AI-Solutions-KK, while same-codec and modern-to-modern chains remain comparatively safer.Ours-ACCURATE→Ours-ACCURATE is 1.09%/2.42% EER in the EdgeFace-scored matrices, and its 512-byte ArcFace rescore is 0.64%.Source: §12.5 · p. 115, Table 68 · p. 116, Table 69 · p. 116

13.3 Compression as a defense

• At 512 B and ε ≥0.06, trained codecs are the weakest sanitizers, whereas JPEG 2000 is strongest; at 1024 B, Ours-FAST is mid-pack and Ours-ACCURATE remains weakest.Ours-ACCURATE has the highest mean residual in all six attack × dataset tables, while neither trained codec approaches JPEG 2000.Source: §13 · p. 116, §13.4 · p. 123

13.1 Threat model

• The no-box attacker has no access to matcher architecture, parameters, training data, or queries, and perturbs aligned crops under ε ∈{0.03,0.06,0.10}.The defender uses four anchor matchers: arcface_antelopev2, lvface_l, topofr_r100, and edgeface_xs.Source: §13.1 · p. 117

13.2 Attacks

• Li-AE and HFC are statistically interchangeable and stronger than CLIP transfer, with Color FERET identity cosine reaching 0.40 and 0.41 respectively at ε = 0.10.The ordering is Li-AE ≈HFC > CLIP-transfer; the Li-AE proxy used a 1.38 M-parameter model trained on held-out identities.Source: §13.2 · p. 118

13.3 Compression as a defense

• Compression sanitizes attacks by reducing residual identity-cosine gaps, but tighter classical-codec budgets trade away clean identity; trained codecs remain nearly budget-independent.For JPEG at ε = 0.06, the residual drops from 0.261 at 1024 B to 0.056 at 512 B, while trained-codec budgets are essentially tied.Source: §13.3 · pp. 119, 121

13.4 Ours-as-defense

• The higher-quality Ours-ACCURATE model consistently sanitizes less than Ours-FAST, indicating that its refine head re-injects fine detail rather than breaking the sanitization–quality trade-off.At ε = 0.06/1024 B, residuals are 0.333 for Ours-ACCURATE, 0.267 for Ours-FAST, and 0.069 for JPEG 2000.Source: §13.3 · p. 121, §13.4 · pp. 122–123

13.5 Generalization to AI-Solutions-KK

• On AI-Solutions-KK, the Color FERET ordering reproduces: tighter budgets sanitize harder at ε ≥0.06, JPEG 2000 is strongest, and Ours-ACCURATE is weakest.At ε = 0.10/1024 B, JPEG 2000 remains at residual ≤0.14, while Ours-ACCURATE peaks at 0.416.Source: §13.5 · pp. 123–124, Table 75 · p. 124
• The study evaluates only no-box attacks; codec-aware attacks using BPDA or straight-through gradients are deferred to future work.A deployed credential codec is public, so an attacker could potentially differentiate through an approximation of its non-differentiable quantization.Source: §13.5 · p. 124

14.2 Pairwise codec comparisons

• Modern codecs are operationally interchangeable at 112 px/1024 B, with fourth-decimal AUC gaps, while every codec significantly beats JPEG and JPEG 2000.On Color FERET, only nine of 220 tests fail significance; on AI-Solutions-KK, only seven of 440, including JPEG-AI≈Ours-ACCURATE on ArcFace.Source: §14 · p. 125, §14.2 · pp. 126–127, §14.4 · p. 129
• The aligned reference significantly outperforms every codec, whereas JPEG 2000 significantly underperforms every other method, with AUC falling from 0.9998 to 0.9868 on Color FERET.The comparisons use paired McNemar tests on accept/reject decisions and DeLong tests on ROC areas, with Benjamini–Hochberg correction.Source: §14.2 · pp. 125–126, §14.1 · p. 125, §14.3 · p. 128

14.3 Multiple-comparison correction

• Benjamini–Hochberg correction leaves only near-tied modern-codec pairs non-significant, confirming that the multiplicity adjustment does not drive the conclusions.There are 55 pairwise tests per cell, totaling 220 on Color FERET and 440 on AI-Solutions-KK.Source: §14.3 · pp. 127–128

14.4 Significance on AI-Solutions-KK

• On AI-Solutions-KK, only seven of 440 pairwise tests fail significance, as the roughly 2 million trials per cell resolve near-ties that remain undecided on Color FERET.AVIF versus WebP is significant in all eight KK cells despite AUC differences of only 0.8–4.0×10^-4 on independent anchors.Source: §14.4 · pp. 128–129, Table 77 · p. 129
• The accurate trained codec’s advantage over the fast variant is large at 112 px but shrinks at 224 px, reaching χ2 = 4.2 and padj = 0.040 on EdgeFace-XS.At 112 px, the cross-anchor χ2 range is 10,440–18,244; at 224 px, it is 4–134.Source: §14.4 · pp. 129–130

14.5 Rank-based analysis across the matcher roster

• Across fourteen matchers, codec rankings agree strongly with Kendall’s W = 0.85, strengthening to W = 0.89 after removing EdgeFace-family matchers.Ours-ACCURATE ties WebP and AVIF by Cliff’s δ, while beating JPEG 2000 with δ = −1.00.Source: §14.5 · p. 130, Table 78 · p. 131

15.1 What we have established

• The benchmark applies identical crops, byte budgets, embedding matchers, and verification scoring across ten off-the-shelf codecs, two datasets, and four anchor matchers.It reports EER, FNMR, image-quality metrics, and Color FERET paired significance tests under the same protocol.Source: §15.1 · p. 132
• At 1024 B, modern codecs keep Color FERET 112 px ArcFace EER near the aligned baseline at 0.09–0.19% versus 0.04%, while JPEG 2000 reaches 3.23% and JPEG reaches 33.35% at 512 B.JPEG also rises to 2.75% at 224 px; at 112 px and 1024 B, identity cosine is 0.851 for JPEG versus 0.921 for WebP.Source: §15.1 · p. 132
• At 1024 B, Ours-ACCURATE leads JPEG-AI at 112 px on both datasets and budgets, but trails it at 224 px; it also beats JPEG-AI at 512 B on Color FERET FNMR.At 112 px on KK, identity cosine is 0.938/0.874 for Ours-ACCURATE versus 0.921/0.850 for JPEG-AI at 1024/512 B; at 224 px, JPEG-AI leads.Source: §15 · p. 131, §15.1 · p. 132

15.2 Limitations and threats to validity

• The main validity limits are EdgeFace dependence for one evaluator and restricted coverage to two datasets and four matchers, although held-out cvlface_ir101 preserves the codec ranking and graceful 512 B degradation.The remaining scope is evidence within this protocol, not every face matcher or capture condition.Source: §15.2 · pp. 133–134

15.3 Current pipeline state

• Table 79 reports the custom codec, recompression, adversarial studies, and significance analyses as complete on both datasets, while wider-roster learned-codec cells at non-112 px KK resolutions remain incomplete.The remaining KK gaps do not affect the headline codec ranking; proposed follow-ups include print-scan simulation, codec-aware attacks, deduplication checks, a two-seed Ours-FAST retrain, and a KK budget sweep.Source: §15.2 · pp. 133–134, Table 79 · p. 135, §15.4 · p. 135

Benchmark conclusion

• At 1024 bytes, modern transform and learned codecs preserve identity, with JPEG-AI strongest at 224 px and Ours-ACCURATE leading JPEG-AI at 112 px while legacy JPEG and JPEG 2000 collapse in adverse settings.At 112 px/1024 B on Color FERET under ArcFace, JPEG-AI, WebP, and AVIF achieve 0.09% EER versus 0.04% aligned; Ours-ACCURATE reaches identity-cosine 0.948 versus JPEG-AI’s 0.930.Source: §16 · pp. 135–136

Budget sweep

• At 512 bytes, classical codecs cross an error floor while byte-budgeted learned codecs remain stable: Ours-ACCURATE stays at 0.14–0.22% EER across budgets, whereas JPEG rises from 0.28% to 33.4%.The custom codec enforces the byte budget through binary search over a frozen gain table in a self-describing container and degrades more gracefully as the budget tightens.Source: §16 · p. 136

Resolution analysis

• 112 px is the practical verification resolution: downsampling from 224 px retains 99.97% of AC spectral energy and over 0.99 embedding cosine, whereas clean EER roughly doubles by 64 px.The lower resolution frees storage budget while preserving the matcher signal for strong matchers.Source: §16 · p. 136

Demographic fairness

• JPEG 2000 is the dominant fairness hazard, amplifying skin-tone EER disparity by 11.2–20.0× on three anchors, while every other codec, including the custom variants, adds at most 1.7 percentage points.On ArcFace, LVFace-L, and TopoFR-R100, JPEG 2000 adds 3.4–5.0 percentage points of disparity.Source: §16 · p. 136

Recompression and robustness

• Deployment should avoid JPEG 2000 entirely and avoid transcoding JPEG XL into HEIF or AVIF: JPEG XL→HEIF reaches 17.14% EER on Color FERET and 24.17% on AI-Solutions-KK at 1024 bytes.Every other modern recompression chain costs under about 1 percentage point, and compression’s no-box adversarial sanitization is incidental because stronger sanitization accompanies greater identity destruction.Source: §16 · p. 136

Robustness and coverage

• The ranking is backbone-invariant, with Kendall’s W = 0.85 across fourteen matchers, although remaining AI-Solutions-KK coverage gaps and unrun CompressAI cells limit completeness without overturning the conclusions.Color FERET is complete across fourteen matchers, five resolutions, and both budgets; all four anchor matchers are populated across KK resolutions for codecs compressed there.Source: §16 · pp. 136–137

• The report is generated rather than transcribed: scripts read the indexed files, whose paths are relative to the output root and whose datasets and crops are documented separately.The AI-Solutions-KK 112 and 224 px aligned crops are published separately in Section 3.3.Source: §17 · p. 137
• accuracy/metrics.csv contains 4,632 verification cells with error metrics, operating-point FMRs, pair counts, aligned-reference deltas, and selected bootstrap confidence intervals.NaN FNMR values deliberately mark cells where an operating point is not estimable; achieved byte sizes are stored separately in codec_comparison/file_size_summary.csv.Source: §17 · p. 137
• quality/quality_summary.csv stores full-reference quality metrics and sample counts, while report_summary/key_findings.csv provides the derived register for headline claims with a JSON twin and documented schema.Quality metrics include PSNR, SSIM, MS-SSIM, LPIPS, and DISTS per dataset, codec, resolution, and budget cell.Source: §17 · p. 137
• Table 80 indexes report artifacts by pipeline stage, with every table and figure generated from listed files or committed embedding arrays for two Section 9 ablations.The preprocessing and crop-tightness ablations are recomputed directly from committed embedding arrays by their generator.Source: Table 80 · p. 138