iPhone Face ID Failed to Recognize Users’ Morning Faces

The Face ID feature on iPhone allowing users to unlock their phones via facial recognition was reported by users for not recognizing their faces in the morning.

Risk classification

• Primary risk domain: 1 Discrimination & Toxicity
• Primary risk subdomain: 1.3 Unequal performance across groups

The incident involves potential unequal performance across demographic groups, as a user of Chinese ancestry highlighted that the system's failure to recognize morning puffy faces and eye shapes disproportionately affected her and potentially others of similar ancestry.

Additional risk subdomains

• 7.3 Lack of capability or robustness: The Face ID system lacks robustness to natural, temporary variations in human facial features such as morning swelling or allergy-induced puffiness.

Causal factors

• Entity: AI
• Intent: Unintentional
• Timing: Post-deployment

The failure was caused by the Face ID AI system unexpectedly failing to recognize authorized users after the product was deployed.

EU AI Act risk tier

• Risk tier: 4 Minimal or No Risk

Minimal or No Risk: The Face ID system is a consumer-grade biometric lock used for personal device security, posing minimal risk to society compared to public surveillance or law enforcement facial recognition.

AI system and alleged parties

• AI system: Face ID (Apple)
• AI purpose: Face Recognition; Image Verification
• Behaviour type: Tool
• Alleged developer: Apple
• Alleged deployer: Apple
• Alleged harmed parties: iPhone X Face ID users, iPhone Face ID users

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Negligible. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Negligible, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

People affected

• Occurrences reported: 1
• People reportedly harmed: 10
• People reportedly exposed: 10

Potential causes

Management

• Underestimating Usability Impacts: Releasing Face ID without fully resolving common morning false-negatives.

Technology

• Eye State Sensitivity: Face ID requires eyes to be wide open, failing when eyes are half-closed.
• Rigid Depth Map Thresholds: Mathematical representation fails to match when minor morning swelling occurs.
• Inflexible Adaptability: Machine learning failed to adapt to natural daily biological facial variations.

Data Inputs

• Unrepresentative Enrollment Data: Initial setup only captures normal faces, lacking morning or swollen variations.
• Lack of Diverse Training Data: Algorithms may lack training on diverse facial swelling patterns across races.

Human Factors

• Natural Morning Facial Swelling: Fluid pooling and allergies cause temporary facial changes after sleeping.
• Half-Closed Eyes Upon Waking: Users trying to unlock phones while still sleepy with partially closed eyes.

Process and Methods

• Strict False Positive Prevention: Prioritizing security over usability leads to high false negative rates.
• Inadequate Edge Case Testing: Testing failed to account for common morning facial changes and allergies.

Information quality

• Classification confidence: High
• Reason for confidence: The report clearly outlines the user experiences, the technical mechanism of Face ID, and the specific nature of the failure (morning puffiness/swollen eyes). The details are consistent across multiple sources cited in the article.
• Ambiguities identified: The exact statistical prevalence of the issue across different demographic groups is not quantified, relying instead on individual anecdotes and user speculation regarding race.
• Alternative interpretations: The failure could be interpreted purely as a lack of robustness to physical changes (7.3) rather than having a demographic/bias dimension (1.3), given that non-Chinese users also reported the issue.

A minor technical limitation in Apple's Face ID consumer biometric authentication system caused failures for users with morning facial puffiness. The incident is a consumer-level usability issue with negligible national security implications.

• Overall national security impact: Negligible
• Scope: Multiple nations
• Primary target: No clear primary
• Other affected: Multiple nations
• Alleged perpetrator: Unknown

Threat characteristics

• Imminence: Long-term. This is a minor, historical technical issue in a consumer product, posing no immediate national security threat.
• Autonomy: Human-controlled. The AI functions strictly as a tool for biometric verification, initiated and controlled by the device owner.
• Novelty: Established threat. Biometric authentication failures and robustness issues with changing facial features are well-known, established technical limitations.

Impact by dimension

• Physical security: Negligible. Consumer biometric lock failure on personal devices has no impact on physical security or critical infrastructure.
• Information security: Negligible. No classified systems, intelligence methods, or information warfare operations were involved in this consumer device issue.
• Sovereignty: Negligible. The incident involves consumer smartphones and does not affect state authority, electoral systems, or government decision-making.
• Economic security: Negligible. While a minor technical flaw in a commercial product, it does not threaten strategic industries, critical supply chains, or national technological competitiveness.
• Societal stability: Negligible. Minor user frustration and unverified anecdotal reports of potential demographic bias do not pose a threat to large-scale social cohesion or human rights.