Face unlock looks almost effortless from the user's side: glance at your phone, and it opens. Underneath that simplicity sits a specific engineering problem that early face-recognition systems struggled with badly, which is telling a real, physically present face apart from a photograph or video of that same face held up to the camera.
The solution most reliable phone face-unlock systems settled on is depth. Rather than relying only on a flat, two-dimensional image the way a regular photo works, these systems use dedicated hardware to measure the actual three-dimensional shape of the face in front of them, including the physical distance of different facial features from the sensor. A flat photo or screen simply does not have that three-dimensional shape to measure.
This page explains how that depth-sensing approach works, how it is combined with pattern matching similar in spirit to fingerprint recognition, and why security quality can vary quite a bit between a system built around genuine depth sensing and one relying only on an ordinary front camera image.
Why a flat photo comparison alone is not enough
An early, simpler kind of face recognition works by comparing a photo taken by a front camera against a stored reference photo, looking for similarities in the arrangement of facial features such as the eyes, nose, and mouth. This approach can work reasonably well for casually telling faces apart, but it has an obvious weakness: a flat printed photo or a photo displayed on another screen can sometimes satisfy the same comparison, since the system is only looking at a two-dimensional image either way.
Because of this weakness, face-unlock systems intended for actually securing a device, rather than just sorting photos in a gallery app, add a crucial extra ingredient that a flat photo cannot replicate: measuring real, physical depth.
How depth sensing works
A common approach for capturing facial depth is called structured light, where the phone projects a pattern of tiny, usually infrared, light points onto the face that are invisible to the human eye but visible to a dedicated sensor built for this purpose. Because faces are not flat, parts of the face closer to the phone, like the tip of the nose, distort this projected pattern differently than parts farther away, like the ears or the background behind the head.
By analyzing exactly how the projected pattern is distorted, the system calculates the physical distance from the sensor to many individual points across the face, producing what is effectively a three-dimensional depth map rather than a flat picture. An alternative approach, called time-of-flight sensing, measures depth by timing how long it takes a pulse of light to bounce off the face and return to the sensor, with closer points returning faster than farther ones. Both techniques arrive at the same kind of result: a map of the face's actual three-dimensional shape.
Building and storing a facial template
Once the system has a depth map along with an image of the face, it extracts a set of distinguishing measurements, similar in concept to a fingerprint template, covering things like the distance between the eyes, the shape and depth of the nose bridge, and the contours of the cheekbones and jaw. These measurements get converted into a mathematical representation and stored securely on the device as a facial template, generally without storing an easily reconstructed picture of your actual face.
During every later unlock attempt, the system builds a fresh depth map and measurement set from whatever face is currently in front of the camera and compares it against the stored template, looking for a close enough match within an allowed tolerance, exactly the same basic logic used in fingerprint matching.
Why depth defeats a photo or video attack
A printed photograph or a photo or video displayed on another screen is, physically, completely flat. When a depth-sensing system projects its structured light pattern or times its light pulses against a flat surface like a photo, every point across that surface returns essentially the same distance reading, because there is no actual three-dimensional variation to detect.
A genuine face, by contrast, always produces a rich, varied depth map because real facial features sit at different physical distances from the sensor. This difference between a flat, uniform depth reading and a varied, face-shaped depth reading is what lets a properly designed system reject a photo attempt even if that photo looks convincing in a normal two-dimensional image.
Not all face unlock systems are built the same way
It is important to understand that not every face-unlock feature on every device uses this kind of dedicated depth-sensing hardware. Some lower-cost or software-only implementations rely only on the regular front camera image, without any dedicated depth sensor, which generally makes them considerably easier to fool with a photo, a video, or in some documented cases a very close physical look-alike, and this limitation is a known and accepted trade-off of that simpler, cheaper design.
Systems built with genuine depth-sensing hardware are generally considered meaningfully more resistant to these simple spoofing attempts, though like fingerprint matching, no biometric system should be treated as a perfect, unbeatable guarantee of identity. The right way to think about any face-unlock system is as a convenience feature with a tuned, imperfect balance between usability and security, not as an infallible lock.
Conditions that affect accuracy
Lighting conditions, the angle of the face relative to the sensor, and physical changes to the face, such as wearing glasses, growing facial hair, or significant changes over time, can all affect how closely a new depth map and measurement set matches the originally stored template. Most systems account for some of this by allowing a bit of tolerance in the matching threshold and sometimes by updating the stored template gradually as they observe small, consistent changes in your face over repeated successful unlocks.
Extreme changes, poor lighting that interferes with the depth sensor, or unusual angles can still cause the system to fail a legitimate match, which is why most devices offer a backup unlock method such as a passcode or fingerprint alongside face unlock rather than relying on it alone.
Flat-image face matching versus depth-based face unlock
| Aspect | Flat-image matching only | Depth-based face unlock |
|---|---|---|
| What it measures | A single two-dimensional picture from the front camera | A three-dimensional depth map plus a facial image |
| Vulnerability to a printed photo or screen | Can potentially be fooled since both are flat images | Resistant, because a flat surface produces a uniform depth reading |
| Hardware required | Standard front-facing camera only | Dedicated projector or time-of-flight depth sensor |
| Typical intended use | Casual convenience features, like photo app face grouping | Securing device unlock and payment authorization |
Common Mistakes
- Assuming all face-unlock features offer the same level of security, when systems without dedicated depth-sensing hardware are generally easier to fool with a photo or video.
- Believing face unlock stores an actual photo of your face, when most systems store a mathematical summary of measurements instead.
- Treating face unlock as an absolute, unbeatable security guarantee rather than a convenience feature with a tuned, imperfect balance between ease of use and protection.
- Not realizing that lighting, angle, and physical changes to your face can affect matching accuracy, and mistaking a failed match for a system malfunction.
Frequently Asked Questions
Can a photo of me unlock my phone's face recognition?
With a properly implemented depth-sensing system, a flat photo generally will not work because it lacks the three-dimensional shape the system checks for, though systems without dedicated depth hardware can be more vulnerable to this kind of attempt.
Does face unlock work in the dark?
Many depth-sensing systems use their own infrared light source rather than relying on visible light, which lets them continue working in low light or complete darkness.
Why does face unlock sometimes fail when I'm wearing a mask or sunglasses?
Covering key facial features removes much of the distinguishing detail the system relies on for a confident match, so many systems are designed to fail safely in these cases rather than risk a false match.
Is face unlock data stored anywhere other than my own device?
On most phones, facial templates are stored and matched within a secure, isolated area of the device's own hardware rather than being sent elsewhere for the basic unlock function.
Sources
- NIST — research and standards on facial recognition and biometric evaluation — https://www.nist.gov/
- IEEE Spectrum — explainers on biometric and depth-sensing technology — https://spectrum.ieee.org/