Face recognition pipeline stages for an access-control camera build

Facial authentication at a door fails far more often in the software pipeline than in the camera spec sheet. The five stages — detection, best-image selection, embedding, matching and liveness — each place their own demands on resolution, exposure, wavelength and depth. A build that skips one of them rejects real staff or admits a printed photograph. Below, each stage gets its numbers: a cosine threshold near 0.5, at least 60 pixels between the eyes, 850 nm near-infrared illumination, an exposure cap set by walking speed. A worked example then sizes the capture camera for a 600 mm doorway mount from the sensor up.

The five stages, in order

Every facial-authentication product, from a vault door to a gym turnstile, runs the same five stages on each presentation:

1. Face detection. A CNN scans each frame and returns a bounding box plus landmark points for every face it finds.
2. Best-image selection. The reader keeps a short burst of frames and picks the sharpest, most frontal, best-exposed face from it.
3. Feature extraction. A CNN converts the chosen crop into an embedding — typically 128 to 512 floating-point numbers summarising the face.
4. Template matching. The embedding is compared with every enrolled template by cosine similarity, and the best score is judged against a threshold.
5. Liveness and anti-spoofing. Depth maps and near-infrared analysis decide whether a live person is presenting, not a photograph or a phone screen.

Stages 1 to 4 answer whose face is this. Stage 5 answers is a live person presenting it. Both must pass before the door release fires, and every hardware choice you make — sensor, lens, light, depth camera — serves one of these five functions.

Stage 1: detection and best-image selection

A CNN detector runs on every frame and returns a bounding box plus landmark points: eye centres, nose tip, mouth corners. The landmarks matter as much as the box, because the eye centres define the crop geometry and the pixel distance between the eyes that every later stage judges.

People do not pose, so the reader captures a short burst — three to ten frames is typical — and scores each face for sharpness, landmark symmetry about the face axis, size and exposure, then keeps the single best crop. Nothing downstream rescues a soft or heavily rotated crop, which is why this stage, not the matcher, caps final accuracy.

Two hardware consequences follow. A face in motion skews under a rolling shutter, so a global-shutter sensor keeps the crop geometry honest. A short exposure also starves the sensor of light; if the camera compensates by slowing its frame rate, the burst stretches and the person walks out of frame — the depth camera frame rate and exposure cap guide works through that trade-off.

Stage 2: feature extraction and the embedding

The best crop passes through the feature-extraction network, which folds the face into an embedding vector of typically 128 to 512 floating-point numbers. The model is a fixed function: the same network must run at enrollment and at every match, because embeddings from different models are not comparable — not even by rescaling.

Embeddings are small enough to keep the whole identity system on the door. A 512-value template at 32-bit precision is 512 × 4 bytes = 2,048 bytes, about 2 KB per person. Comparing a probe against a thousand of those is microseconds of vector arithmetic, and the door never has to hold a single face image.

Enrollment quality sets the ceiling for everything after it. A template captured live at the door is made in the same light and geometry it will be matched in; enrolling from ID photos is possible but measurably weaker — the face recognition enrollment from still images guide sets out what it costs and how to compensate.

Stage 3: matching and the similarity threshold

Cosine similarity compares two embeddings by the angle between them: 1.0 means identical direction, 0 means unrelated, negative means opposed. The same person enrolled and presented scores close to 1.

Where to put the accept threshold is the most consequential number in the system. A 2025 threshold-tuning study on a deep-learning pipeline found 0.5 cosine similarity the optimal operating point, classifying 103 of 107 test identities correctly. Practical systems tune between roughly 0.3 and 0.5: lowering the threshold recovers genuine matches under poor light or pose and also admits more impostors; raising it does the reverse. Decide from the asymmetry of your door — a data-centre cage wants a high threshold and a staffed fallback, while a gym turnstile can sit lower, because a false accept there is a membership problem, not a breach.

The score-versus-threshold trade-off is the same one that governs classical template matching score thresholds, and the discipline of reading the score distribution before setting the cut is identical.

Stage 4: liveness and anti-spoofing

Three signal families dominate deployed anti-spoofing:

• Depth. A live face is a curved 3-D surface; a photo, phone screen or laptop replay is a plane. A time-of-flight or structured-light depth map separates the two immediately. The stereo depth camera face authentication guide builds this channel from machine-vision depth hardware.
• Near-infrared plus RGB. Skin, paper and screen glass reflect 850 nm light differently, which is why dual-channel methods that compare the NIR facial image against the RGB channel catch prints and screens that fool a colour camera alone.
• Thermal. Skin carries a heat signature a print does not. Where a thermal sensor is already fitted, a thermal ROI tracked over the face adds an independent cue.

Production systems stack at least two cues — depth plus NIR is the common pair — because no single cue covers every attack.

Both depth approaches exist as machine-vision components you can integrate directly: the MV-DT01WMU is a ToF sensing camera, and the MV-DPS200P-02 is a projected structured-light 3D camera from the 3D sensors range.

Why near-infrared illumination

Doorway readers illuminate the face at 850 nm near-infrared for three reasons. It is invisible, so the reader never dazzles the person presenting. It behaves the same with lobby lights on or off, because a bandpass filter in front of the lens passes the LED wavelength and rejects visible room light. And silicon sensors are sensitive at 850 nm — it is the same near-infrared that consumer cameras filter out to keep colours clean — so a mono sensor without an IR-cut filter sees it with no special hardware. The camera sensor technologies by spectral range guide maps which sensor families cover which bands, and the M12 lens and IR-cut filter guide covers the lens side of removing the filter.

Strobe the LEDs for the short exposure and the illumination does double duty: it freezes the face and makes the lighting state of the room irrelevant. Keep the LED drive within the illuminant's rated eye-safe distance; 850 nm is invisible, so a person can stare into it without the blink reflex that protects against visible light. What still drifts is LED output and camera gain, and that drift quietly moves similarity scores week to week — the face recognition illumination drift guide shows how to catch it.

For capture, a mono near-infrared-capable sensor behind a C-mount is the standard pattern; the infrared cameras range holds the SWIR options. The MV-CI013-GS-NN is a 1.3 MP SWIR camera with a 1/2-inch sensor, C-mount, GigE interface and a fanless body, built on the IMX990 sensor.

Sizing the capture camera: a doorway reader at 600 mm

One worked case carries the whole build: a reader beside a door, people stopping an arm's length away.

Inputs

• Standoff: 600 mm from lens to face — the arm's-length design point. Measure your real bracket; every result below scales with it.
• Field-of-view target: 240 mm wide. An adult head runs 150 to 160 mm across; the remainder covers off-centre poses and hair.
• Sensor width: 6.4 mm — the standard conversion for a 1/2-inch optical-format sensor.
• Resolution: about 1,300 pixels across — √(1.3 MP × 4/3) ≈ 1,317 for a 4:3 sensor.
• Inter-pupillary distance: about 63 mm, the adult average.
• Presentation speed: about 1.4 m/s, an unhurried walk.

The arithmetic

Rule: magnification is sensor width divided by field of view, and focal length follows from standoff times magnification over one plus magnification.

• m = 6.4 mm ÷ 240 mm = 0.0267
• f = 600 mm × 0.0267 ÷ 1.0267 = 15.6 mm, so order a 16 mm C-mount lens
• Coverage check at 16 mm: field = 6.4 mm × 600 mm ÷ 16 mm = 240 mm, on target
• Pixel scale: 240 mm ÷ 1,300 px = 0.185 mm/px
• Between the eyes: 63 mm ÷ 0.185 mm/px ≈ 340 px, against the 60 px floor of the ISO/IEC 19794-5 token face image — a margin of about 5.7×
• Motion at 1 ms exposure: 1,400 mm/s × 0.001 s = 1.4 mm ≈ 7.6 px of smear — too soft for matching
• Exposure cap: 0.25 ms gives 1,400 mm/s × 0.00025 s = 0.35 mm ≈ 1.9 px, under 2 px
• Off-axis: 30° to the side projects 63 mm × cos 30° ≈ 55 mm ≈ 297 px between the eyes, still five times the floor

The decision

Order a 16 mm C-mount lens, mount it 600 mm from the presentation point, and drive the exposure at 0.25 ms or shorter with strobed 850 nm illumination. The capture stage then delivers about 340 pixels between the eyes face-on and about 297 px at 30° off-axis, both comfortably above the 60 px enrollment floor. The MV-CI013-GS-NN, a 1.3 MP camera on a 1/2-inch sensor, matches these inputs directly. The margin absorbs a sloppy install: pushed out to 1,000 mm, the same 16 mm lens gives a field of 6.4 mm × 1,000 mm ÷ 16 mm = 400 mm, a pixel scale of 0.31 mm/px, and about 205 px between the eyes — still 3.4× the floor. Re-run the numbers for your own standoff with the focal-length calculator below.

Where each stage runs

Running stages 1 to 4 at the door keeps face images inside the enclosure; the access system receives only an accept or a reject. A smart camera exists for exactly this pattern — inspection on the device, no PC — and the camera finder filters the range by interface, resolution and shutter. Detection networks now run on microcontroller-class parts too; a write-up on local face-recognition inference on an MCU shows the smallest end of that scale. Whatever computes the match, the accept output still has to drive the door release, most often through the site's access controller or PLC — integrating a face reader with a PLC covers that hand-off.

Checks before you order

• Measure the standoff on the real door. The focal-length result scales directly with it; 600 mm in the example, but brackets rarely sit where the drawing says.
• Count pixels between the eyes at the worst pose. The example gives about 340 px face-on and 297 px at 30° off-axis. If the corridor forces a steeper angle, pixels, not the lens, become the binding constraint.
• Set the exposure cap before choosing the light. 0.25 ms at a 1.4 m/s walk keeps motion under 2 px; that exposure indoors is why the strobed 850 nm illumination is on the parts list.
• Confirm depth-to-image registration. Liveness judges the depth map inside the detected face region; a mis-registered crop reads the wall behind the person.
• Plan re-enrollment from day one. Glasses, beards and ageing move embeddings; route matches landing just above the threshold to a re-enrollment prompt instead of a silent decline.

When the standard answer is wrong

Wide gates break the single-face design. Cover 2,400 mm instead of 240 mm and the pixel scale becomes 2,400 mm ÷ 1,300 px ≈ 1.85 mm/px, so the same 63 mm between the eyes carries about 34 px — under the 60 px floor. Stepping the sensor up to 5 MP, about 2,600 px across, restores 2,400 mm ÷ 2,600 px ≈ 0.92 mm/px and roughly 68 px between the eyes: enough, with nothing to spare. Wide entries need more resolution or a second reader, not a longer lens.

Sunlight defeats the filter. The bandpass passes 850 nm, and the sun delivers plenty of it, so a face against a sunlit window keeps a blown background however narrow the filter. Hood the camera or move the mount so the face is lit from the camera side and the background falls away.

Drifting scores are usually population or light, not model. If genuine matches slide toward the threshold over months, the faces have aged or the illumination has drifted; re-enroll or re-light. Lowering the threshold buys back acceptances at the cost of the door's real security.

For a single door, the build above is complete: a 16 mm C-mount lens, strobed 850 nm illumination, one depth camera for liveness, matching on the device. Pick the camera, lens and depth sensor together in the system configurator, or send the standoff and door geometry to the team through the contact page.