FaceGuard-Risk

Risk-Based Adaptive Authentication for Face Recognition Access Control

FaceGuard-Risk is a research-oriented Python prototype for studying how biometric confidence and contextual signals can be combined into a risk-aware authentication decision layer. It is designed as an academic-engineering project for experimentation, reporting, and portfolio review, not as a production deployment.

Current version: v1.4

Project Overview

Many access-control systems treat face recognition as a single threshold decision: if the face match score is high enough, access is granted. In realistic environments such as campus gates, building entrances, laboratories, dormitories, and staff-only areas, that decision can be incomplete. A high face score may still be suspicious if the location, time, or device context is inconsistent; a lower face score may be acceptable when surrounding signals are coherent.

FaceGuard-Risk explores authentication as a risk modeling problem. The project generates synthetic authentication events, compares multiple scoring strategies, evaluates statistical robustness across repeated seeds, and studies how access policies change under different security and usability costs.

Not Just Face Recognition

This project does not implement a new face recognition algorithm. Instead, it assumes a biometric matcher has already produced a face similarity score and focuses on the decision layer after biometric scoring.

The central question is:

Given a biometric score and contextual evidence, should the system accept, challenge, or reject the authentication attempt?

This distinction is important for research and evaluation. FaceGuard-Risk is about risk-aware decision support on top of biometric confidence, not about replacing face embedding models, liveness detection models, or camera pipelines.

Core Idea: Risk-Based Adaptive Authentication

Each synthetic authentication event contains four confidence signals:

• face_score: biometric similarity confidence
• location_score: consistency with expected location behavior
• time_score: consistency with expected access timing
• device_score: consistency with trusted device information

The system compares:

• Face-only baseline: uses only biometric score.
• Rule-based baseline: combines biometric and contextual signals with fixed weights.
• Full risk-aware model: learns a logistic regression risk model over all signals.

The learned risk score is then passed into multi-stage policy logic:

• ACCEPT: low-risk access, allow immediately.
• CHALLENGE: uncertain or medium-risk access, require additional verification.
• REJECT: high-risk access, deny access.

Key Features

• Synthetic authentication data generation with overlapping genuine/impostor distributions.
• Context-aware risk scoring using face, location, time, and device signals.
• Face-only, rule-based, full risk-aware, and ablation model comparisons.
• Repeated-seed experiments with confidence intervals.
• Paired t-test and Wilcoxon significance testing.
• Multi-stage ACCEPT / CHALLENGE / REJECT decision policy.
• Cost-sensitive threshold optimization for security-first, balanced, and convenience-first scenarios.
• Policy-level comparison across operational assumptions.
• Interpretable risk explanation for representative decisions.
• Threshold sensitivity analysis with heatmap visualizations.
• Continuous risk-based authentication for session-level monitoring.
• Adaptive challenge policy that selects verification type based on risk source.
• Automatic markdown research summary report generation.

Result Preview

ROC curve shows classification improvement over baselines.

Session risk curve demonstrates continuous risk monitoring.

Project Structure

FaceGuard-Risk/
|-- main.py                         # End-to-end experimental pipeline
|-- requirements.txt                # Minimal Python dependencies
|-- README.md                       # GitHub-facing project documentation
|-- PROJECT_SUMMARY.md              # Detailed project summary for applications
|-- QUICK_SUMMARY.md                # One-page project summary
|-- PROJECT_METADATA.json           # Structured project metadata
|-- simulation/                     # Synthetic authentication data generation
|-- models/                         # Face-only, rule-based, and risk-aware scoring
|-- evaluation/                     # Metrics, statistics, policy evaluation, sensitivity analysis
|-- decision/                       # Multi-stage access decision policy
|-- explainability/                 # Human-readable risk explanation layer
|-- continuous/                     # Continuous/session-level risk monitoring
|-- challenge/                      # Adaptive challenge recommendation policy
|-- reporting/                      # Automatic research report generation
|-- results/                        # Core CSV, markdown, and PNG outputs for review

Installation

Python 3.10+ is recommended.

python -m venv .venv

On Windows:

.\.venv\Scripts\activate
pip install -r requirements.txt

On macOS/Linux:

source .venv/bin/activate
pip install -r requirements.txt

How to Run

From the project root:

python main.py

On Windows, if using the included virtual environment:

.\.venv\Scripts\python.exe main.py

The run regenerates the main experimental outputs under results/.

Reproducibility

Install the required dependencies:

pip install -r requirements.txt

Run the complete experiment pipeline:

python main.py

All generated outputs are saved in results/, including CSV metrics, markdown tables, research summaries, ROC plots, session risk curves, and threshold sensitivity heatmaps.

Outputs

Important generated artifacts include:

• results/research_summary_report.md
• results/metrics_aggregated.csv
• results/results_table.md
• results/significance_table.md
• results/policy_comparison_table.md
• results/continuous_session_summary.csv
• results/adaptive_challenge_summary.csv
• results/roc_curve.png
• results/session_risk_curve_*.png
• results/threshold_heatmap_*.png

These files are intentionally kept in the repository because they make the project easier to inspect on GitHub without requiring reviewers to rerun the full pipeline first.

Research Value

FaceGuard-Risk is useful as a compact research prototype because it connects several ideas that are often evaluated separately:

• biometric authentication under uncertainty
• context-aware access control
• cost-sensitive security policy design
• statistical comparison across repeated experiments
• explainable decision support
• continuous authentication after initial access

The project also demonstrates how a small experimental framework can move beyond a single demo script by producing reproducible metrics, ablations, significance tests, visualizations, and a generated research report.

Limitations

• Current validation is based on synthetic data, not real operational access logs.
• This project is not a deployed production authentication system.
• It does not improve face recognition algorithms directly.
• It focuses on the risk decision layer above biometric confidence scores.
• The face score is simulated; the project does not include camera input, face embeddings, liveness detection, or production biometric infrastructure.
• Logistic regression is used for interpretability and simplicity, not because it is necessarily the best model for all deployments.
• The repeated-seed experiment currently uses a small number of seeds, so statistical conclusions should be interpreted as early evidence rather than definitive proof.
• Policy costs are manually specified and should be calibrated with real stakeholders before any practical deployment.

Roadmap

• Increase the number of repeated seeds for stronger statistical evidence.
• Evaluate on real or semi-real authentication logs if privacy-safe data becomes available.
• Add score calibration and uncertainty analysis.
• Compare additional lightweight models such as random forest, gradient boosting, or calibrated SVM.
• Add user-specific priors and longer temporal behavior modeling.
• Build a small dashboard or notebook for policy exploration.
• Document reproducibility settings and experiment configuration more formally.

Application Value

For internship, graduate-school, and research portfolio review, this repository highlights:

• ability to frame a security/AI problem as a research question
• end-to-end Python implementation of data simulation, modeling, evaluation, and reporting
• understanding of biometric authentication trade-offs beyond raw recognition accuracy
• use of statistical testing, confidence intervals, ablation, and policy analysis
• awareness of deployment limitations and responsible claims
• clear separation between model scoring, policy decision, explanation, and reporting modules

FaceGuard-Risk should be read as a research prototype and portfolio artifact: a structured foundation for studying adaptive authentication, not a claim of production-ready security performance.