Detect every face in a frame, turn each one into a 512-dimension vector, and ask a FAISS index who it belongs to. The architecture was sound. The code had never once run end to end — and the evidence for that was sitting in the backup archive.
The README opened with "a production-grade real-time face recognition system with integrated liveness detection and mask awareness." The directory told a different story: eight Python files adding up to 4.2 KB, an empty camera.py, and a FAISS index of zero bytes.
The interesting evidence was not in the source at all. It was in the compiled bytecode inside the February 2026 backup archive:
__pycache__ provedAI_Pipelined_Projects/smart_face_recognition/app/__pycache__/
api.cpython-310.pyc 155 bytes
database.cpython-310.pyc 1,538 bytes
detection.cpython-310.pyc 755 bytes
recognition.cpython-310.pyc 978 bytes
__init__.cpython-310.pyc 160 bytes
liveness — no .pyc
mask_detection — no .pyc
run_camera — no .pyc
Python writes a .pyc the first time a module is successfully imported. Four modules had been imported. The two that run_camera.py needs, and run_camera.py itself, never had been. The main loop had never been executed on this machine, not once.
That reframed the job. This was not "fix a regression" — it was "finish a build that had never completed", and then be honest on the portfolio about which parts still do not work.
facenet-pytorchIndexFlatL2, exact nearest neighbour-1 sentinelThe original computed raw FaceNet embeddings and compared them against a hardcoded L2 distance threshold of 0.8. Un-normalised FaceNet vectors have magnitudes around 10, so squared L2 distances between any two faces land far above 0.8. Every query would have returned Unknown, forever, including a photo matched against itself. The threshold was not merely mistuned — it was unreachable. Normalising to unit length puts distances in the range the threshold was clearly written for.
| # | File | Defect | Effect if run |
|---|---|---|---|
| 1 | recognition.py | cv2 used but never imported | NameError on the first call — hard stop |
| 2 | recognition.py | Crops embedded at whatever size they arrived | Embeddings not comparable to one another |
| 3 | recognition.py | Embeddings not L2-normalised | 0.8 threshold mathematically unreachable |
| 4 | detection.py | Box coordinates not clamped to frame | Faces at frame edges produced zero-size crops |
| 5 | database.py | FAISS -1 "no neighbour" not handled | IndexError on a sparse index |
| 6 | database.py | No embedding-shape validation | Wrong dimension aborted the process inside C++ |
| 7 | liveness.py | Variance scales with crop resolution | One threshold meant a different thing on every frame |
Three files were not repairs, because there was nothing to repair. Each carries a header in the source saying so:
app/camera.pyscripts/enroll_faces.pybuild_augmented_database.py--dry-runtests/test_pipeline.pyThe suite runs offline so the pipeline can be verified on a machine with no webcam, which is also what makes it useful in CI. It covers real MTCNN detection against a photograph, unit-norm assertion on the embedding, and a full FAISS write-read-search round trip.
| Stage | Checked | Result |
|---|---|---|
| Imports | All 6 modules import cleanly | Pass |
| Capture | Still-image and video-file sources open | Pass |
| Detection | MTCNN finds a face in a real photograph | Pass |
| Crop | Edge boxes clamp without zero-size output | Pass |
| Embedding | Shape is (1, 512) | Pass |
| Embedding | L2 norm == 1.0 | Pass |
| FAISS | Add, save, reload, search round trip | Pass |
| FAISS | Empty index returns Unknown, not a crash | Pass |
| Liveness | Resolution-independent after fix | Pass |
| Total | 22 checks | 22 pass |
python -m venv .venv && .venv\Scripts\activate pip install torch==2.2.2 torchvision==0.17.2 --index-url https://download.pytorch.org/whl/cpu pip install -r requirements.txt python -m tests.test_pipeline # offline, no camera python run_camera.py # webcam python run_camera.py --source clip.mp4 # video file
FaceNet and MTCNN weights (~107 MB) download on first run. Source is not published — see Privacy.
This section exists because the original README claimed the opposite. Everything below is a documented gap, not a caveat.
The system has never been evaluated against a labelled verification set. No FAR, no FRR, no ROC curve, no benchmark. The 0.8 match threshold is inherited from the original code and remains uncalibrated. Any accuracy number attached to this project would be invented, so there is none anywhere on this page.
The liveness stage computes Laplacian variance — a standard image-sharpness measure. It scores focus, and nothing else. There is no trained anti-spoofing model and no evaluation against any spoof dataset. A sharp photograph, or a replay on a decent screen, passes it. It is a cheap first filter that rejects blurred frames. Calling it a security control would be false.
The module loaded haarcascade_mcs_nose.xml from cv2.data.haarcascades. That file has never shipped with opencv-python — verified directly: it is not present, and no nose cascade of any kind is bundled. The classifier object was therefore always empty and detectMultiScale raised on it every time.
The module now reports n/a instead of raising. No replacement classifier was substituted. Training or importing one would be building a feature that never existed and filing it as recovered work.
No deployment, no liveness validation, no threshold calibration, no bias evaluation across demographics, no audit trail. It is a working research pipeline on a laptop. The word "production-grade" has been removed from the project's own README.
The project directory sits under the website's document root. The parent Irfana/.htaccess carried a recursive rule allowing every .png, .jpg and .pdf through so the awards and research-figure sections could load images.
Because <FilesMatch> applies to a directory and all its subdirectories, that rule was also serving 104 photographs of real people's faces over HTTP, at a guessable path, with no consent record. The same rule was exposing unpublished thesis manuscripts and personal CVs.
Closed on 2026-08-10 with explicit deny rules on the source tree, the thesis directory and the client-work directory. This was the most serious finding of the whole recovery pass, and it had nothing to do with the machine learning.
The Dockerfile targets a CUDA base image and was not tested in this pass. It is listed here as present, not as verified.
The fastest way to understand this project was reading compiled bytecode timestamps in a backup ZIP. If you have a research system nobody is sure ever worked, that question is usually answerable from evidence already on disk.