FRBench

An easy-to-use, end-to-end differentiable face-recognition module that ships 45+ pretrained weights,

• covering 25 backbones, 9 loss functions, and 3 training datasets of different types,
• spanning generations since 2015

It is designed for anti-facial-recognition (AFR) research, where the transferability of attacks across backbones, loss functions, and training datasets is a central concern. But we believe that it benefits the face recognition field just as much.

Hand it any RGB image tensor (aligned or not); it detects and aligns the face(s), runs the chosen pretrained backbone, and returns embeddings ready for cosine similarity. Because the whole pipeline (detect → crop → align → backbone) is written in pure, differentiable PyTorch, gradients flow from the embeddings all the way back to the input pixels, enabling adversarial attacks and other gradient-based methods.

Quickstart

Install with pip install frbench (or pip install "frbench[demo]" for the notebook extras).

import frbench
from frbench import FR
import torch

device = torch.device("cpu") # cpu, cuda, mps
img = torch.rand(3, 480, 640, device=device) * 255.0 # RGB, [0, 255], float32 tensor
fr = FR("mobilevitv3-s", "arcface", "ms1m").to(device)  # (backbone, loss, dataset)
result = fr(img, l2_normalize=True)          # FREmbedResult(embeddings, indices, crops)
print(result.embeddings.shape)               # (1, 512) when one face is found

for m in frbench.list_models():
    print(m.backbone, m.loss, m.dataset) # available models

Table of Contents

• Highlights
• Motivation
• Installation
• Usage
• Model Zoo
• Acknowledgement
• License
• Citation

Highlights

• Unified & consistent. One module, one API, one weight format for 45+ models — no more stitching together incompatible repos.
• Differentiable end-to-end. Detection is non-differentiable, but cropping and 5-point alignment use grid_sample and a closed-form similarity transform, so the embedding is differentiable w.r.t. the raw input image.

Motivation

In anti-facial-recognition (AFR) research, one needs to understand how well an attack transfers across face-recognition backbones, loss functions, and training datasets of different types and generations. For instance, training an attack on ResNet50 and evaluating it on SwinV2-T (same loss, same data) fairly measures generalization to a next-generation architecture; training on IRSE50 and evaluating on IRSE100 isolates the effect of model size.

However, existing model zoos such as face.evoLVe and FaceX-Zoo do not offer this controlled variation over backbones, losses, and datasets. Researchers end up collecting and deploying models from many libraries, and still cannot be confident that the "Swin Transformer" in repo A is the same as the "SwinV1" in repo B.

FRBench addresses this with a single, unified, differentiable, easy-to-use PyTorch module backed by a rich set of consistently-trained pretrained weights. (The training code may be released later.)

Installation

Dependencies

conda create -n frbench python=3.12
conda activate frbench
pip install frbench                 # core: torch, torchvision, pyyaml, tqdm
pip install "frbench[demo]"         # optional: pillow, matplotlib, seaborn

The core module needs torch, torchvision, pyyaml, and tqdm (for download progress bars). The demo notebook additionally uses pillow, matplotlib, and seaborn.

For local development, clone the repository and run pip install -e ".[demo]".

Weights download

Weights are downloaded on demand into ~/.frbench (see Notes on Configuration to change the cache location). Prefetch assets with the CLI:

frbench-download --list                         # show all manifest keys
frbench-download --list-models                  # FR models only (no detectors)
frbench-download mobilefacenet_arcface_ms1m     # download one model
frbench-download --all                          # download everything
frbench-download --all --quiet                  # no progress / logs
frbench-download --refresh --list               # re-fetch manifest, then list

The public weights are downloaded directly from GitHub Releases; no GitHub login or token is required.

Progress bars use tqdm and are controlled by set_download_verbose(bool) (or --quiet on the download script); see Notes on verbosity.

Usage

See the demo notebook for a complete, runnable walkthrough.

Face Embedding

1. Input contract: (list of) RGB and [0, 255] float tensors. The preprocessor warns if values look normalized. Can be of shape:

   • (3, H, W) — single image
   • (N, 3, H, W) — batch of N images
   • A list of (3, Hi, Wi) or (1, 3, Hi, Wi) tensors — variable-size images

2. Return type: forward / embed return a frbench.FREmbedResult named tuple, with fields accessible by name, by unpacking, and via _asdict().

   Field	Shape	Meaning
   embeddings	(M, D)	Face embeddings; empty (0, D) when no faces (never None).
   indices	len M	indices[i] is the source-image index of embeddings[i].
   crops	(M, 3, H, W)	Normalized crops fed to the backbone.

   result.num_faces gives M, and the result is truthy iff at least one face was produced.

3. Key options: (see the docstring for the full list):

   • need_crop=False — inputs are already-aligned 112×112 crops; skip detection.
   • need_align=False — crop a (loosened, see loosen_crop) square box instead of 5-point aligning.
   • keep_largest=False — return an embedding for every detected face, not just the largest.
   • discard_invalid=True — drop images with no detected face (default: fall back to the whole image).
   • tta=("flip_horizontal",) — test-time augmentations to average over (default: horizontal flip; doubles backbone cost). Pass tta=() to disable.
   • l2_normalize=True — L2-normalize the returned embeddings for direct cosine comparison.
   • eager_load=True (constructor) — download weights and build the backbone at init instead of first use.
   • detections= — pass precomputed detections from FR.detect() to skip re-detection

Face Detection

Two methods are available for detection, cropping, and alignment: FR.detect() and frbench.FaceDetector. The former is a convenience wrapper that builds a detector on the fly; the latter is a standalone detector that can be shared across multiple FR pipelines so its weights load only once — useful when benchmarking attacks across many backbones:

detector = frbench.FaceDetector().to(device)
frs = [frbench.FR(b, "arcface", "ms1m", detector=detector).to(device)
       for b in ("irse-100", "swinv2-b", "mobilefacenet")]

dets = detector.detect(imgs)                   # detect once
results = [fr(imgs, detections=dets) for fr in frs]

Note that FR.detect() doesn't build the recognition backbone — it only loads the detector weights.

1. Input contract: same as Face Embedding above.

2. Return type: FR.detect / FaceDetector.detect return a frbench.FRDetectResult whose detections field holds one entry per image — None (no face) or a (K, 16) tensor with columns:

   Columns	Meaning
   0-3	Box x1, y1, x2, y2 in input pixels.
   4	Background probability (1 - face probability).
   5	Face probability (detection confidence).
   6-15	Five landmarks x1, y1, ..., x5, y5 in input pixels: left eye, right eye, nose, left mouth corner, right mouth corner.

   You should rarely need to index those columns by hand: use the dets.boxes, dets.scores, and dets.landmarks accessors (per-image lists of (K, 4), (K,), and (K, 5, 2) tensors).

   To bring detections from your own face detector, build the named tuple with FRDetectResult.from_landmarks and pass it to FR(..., detections=...):

   import torch
   from frbench import FRDetectResult
   
   # Landmark order: left eye, right eye, nose, left/right mouth corners.
   ldm = torch.tensor([[38., 52.], [74., 52.], [56., 72.], [42., 92.], [71., 92.]])
   dets = FRDetectResult.from_landmarks([ldm, None])   # image 0: one face; image 1: none
   result = fr([img0, img1], detections=dets)          # boxes/scores default sensibly
   

Face Cropping and Alignment

FaceDetector.align returns one (K, 3, H, W) tensor per source image. Aligned faces can be reprojected into source coordinates with unalign. Request the optional masks when compositing an edited face over its original image:

dets = detector.detect(img)
aligned = detector.align(img, dets)

result = detector.unalign(
    aligned,
    dets,
    output_sizes=img.shape[-2:],
    return_mask=True,
)
canvases, masks = result

# Each face has its own source-sized canvas and boolean (1, H, W) mask.
merged_face = torch.where(masks[0][0], canvases[0][0], img)

Faces remain separate rather than being merged automatically, so applications can choose their own overlap and blending policy. Unalignment reverses the coordinates, not the information loss from cropping and interpolation; pixels outside the mask come directly from the original image in the example above.

The differentiable geometry primitives are also available as standalone functions:

frbench.ARCFACE_112_TEMPLATE            # canonical (5, 2) ArcFace template, 112x112
frbench.arcface_template((224, 224))    # template scaled to another crop size
frbench.align(img, landmarks, template) # differentiable 5-point alignment
result = frbench.unalign(
    aligned_faces,
    landmarks,
    (source_h, source_w),
    template,
    return_mask=True,
)
frbench.crop(img, boxes)                # differentiable box crop + anti-aliased resize
frbench.estimate_similarity_transform(landmarks, template)  # (F, 2, 3) closed-form fit
frbench.invert_similarity(matrix)

Notes on devices

Inference runs natively on CUDA, MPS, and CPU. For backprop on Apple MPS, PyTorch needs a CPU fallback for a couple of ops (e.g. grid_sample's backward); the package sets PYTORCH_ENABLE_MPS_FALLBACK=1 on import, which is honored as long as the package is imported before torch. If you import torch first, set it yourself beforehand:

import os; os.environ["PYTORCH_ENABLE_MPS_FALLBACK"] = "1"
import torch

Notes on configuration

All settings go through one resolution chain, from lowest to highest precedence:

1. Built-in defaults
2. The persisted config file ~/.frbench/config.json (location overridable with FRBENCH_CONFIG)
3. Environment variables
4. Runtime calls to frbench.configure(...) (or set_verbose and friends)
5. Active frbench.configure_scoped(...) blocks (innermost wins)

import frbench

# For this process only:
frbench.configure(cache="/data/frbench", verbose=False)

# Permanently (written to ~/.frbench/config.json, applies to future processes):
frbench.configure(cache="/data/frbench", verbose=False, persist=True)

# Temporarily, inside a with-block (thread-safe; restored on exit):
with frbench.configure_scoped(verbose=False, cache="/tmp/frbench"):
    fr = frbench.FR("mobilefacenet", "arcface", "ms1m")

# Reset a setting to its default (and remove it from the config file):
frbench.configure(cache=None, persist=True)

The same persistence is available from the command line:

frbench-download --set cache=/data/frbench --set download_verbose=false
frbench-download --unset cache
frbench-download --show-config      # resolved values and where each comes from

Module-level frbench.CACHE, frbench.REPO, and frbench.RELEASE are live read-only views of the resolved values (change them with configure() — assigning to them has no effect).

The face detector defaults to retinaface_mobilenetv1 and can be changed per model via FR(..., detector="retinaface_resnet50"), or shared across models by passing a frbench.FaceDetector instance.

Notes on verbosity

Output has two independent switches, both enabled by default and toggleable on the fly:

import frbench

frbench.set_warnings(False)          # silence inference warnings (e.g. no face detected)
frbench.set_download_verbose(False)  # silence download status + progress bars
frbench.set_verbose(False)           # convenience: both at once

frbench.set_verbose(False, persist=True)   # persist across processes
with frbench.configure_scoped(verbose=False):
    ...                                    # silence temporarily

• Inference warnings (no face detected, unsupported TTA, etc.) go through Python's standard warnings module under the frbench.FRBenchWarning category, so you can also filter or capture them with the usual tools, e.g. warnings.filterwarnings("ignore", category=frbench.FRBenchWarning) or with warnings.catch_warnings(record=True) as w: ....
• Download verbosity (log messages and the tqdm progress bar) is a separate channel controlled by set_download_verbose (or --quiet on frbench-download).
• Critical problems (invalid input tensors, missing manifest keys, failed downloads) raise exceptions (ValueError, frbench.FRBenchDownloadError, etc.) regardless of the switches above.

Notes on update checks

On the first FR(...) construction or frbench-download command in a process, FRBench checks whether a newer package or weights release is available. Results are cached for 24 hours, network failures are ignored, and no check runs merely from importing the package.

Set FRBENCH_UPDATE_CHECK=0 (the legacy FRBENCH_NO_UPDATE_CHECK=1 also works) or call frbench.set_update_check(False) (add persist=True to make it permanent) to disable these reminders. Installed versions remain pinned to the weights release they were tested with; updating is always explicit.

Model Zoo

Every model is addressed by the same three manifest keys you pass to FR(backbone_type, loss_type, dataset_type). All accuracies below are in percent.

Coverage of backbones

Under the same loss function (ArcFace) and the same dataset (MS1M), we have:

1. SOTA backbones from 2015-2024

   Backbone	Year	Venue
   ResNet	2015	NIPS
   ResNetV2	2016	ECCV
   DenseNet	2017	CVPR
   SE-Net(IRSE)	2018	CVPR
   EfficientNet	2019	ICML
   ECA-Net(MobileFaceNet_ECA)	2020	CVPR
   SwinV1	2021	ICCV
   ConvNeXtV1	2022	CVPR
   ConvNeXtV2	2023	CVPR
   MobileNetV4	2024	ECCV

2. Backbones of the same family across generations

   Backbone	Family	Paradigm
   SwinMLP	Swin Transformer	Transformer
   SwinV1	Swin Transformer	Transformer
   SwinV2	Swin Transformer	Transformer
   MobileViTV1	MobileViT	Transformer
   MobileViTV2	MobileViT	Transformer
   MobileViTV3V1	MobileViT	Transformer
   MobileViTV3V2	MobileViT	Transformer
   ConvNeXtV1	ConvNeXt	CNN
   ConvNeXtV2	ConvNeXt	CNN
   MobileNetV1	MobileNet	CNN
   MobileNetV2	MobileNet	CNN
   MobileNetV3	MobileNet	CNN
   MobileNetV4-Conv	MobileNet	CNN

3. Backbones of the same type across sizes

   Backbone	Type	Parameter Size (M)	Paradigm
   SwinV2-T	SwinV2	47.099	Transformer
   SwinV2-S	SwinV2	68.57	Transformer
   SwinV2-B	SwinV2	112.926	Transformer
   SwinV2-L	SwinV2	234.078	Transformer
   IRSE18	IRSE	24.115	CNN
   IRSE34	IRSE	34.303	CNN
   IRSE50	IRSE	43.824	CNN
   IRSE100	IRSE	65.549	CNN

Coverage of losses

Under the same backbone (IRSE100 for CNN, SwinV2-B for Transformer) and the same dataset (MS1M), we have SOTA loss functions from 2015-2023

Coverage of datasets

Under the same backbone (IRSE100 for CNN, SwinV2-B for Transformer) and the same loss function (ArcFace), we have 3 datasets of varying image and identity counts:

Acknowledgement

Codes in frbench/backbones/ and frbench/utils/retinaface.py are adapted from existing open-source projects:

• timm
• cavaface
• FaceX-Zoo
• InsightFace
• facebookresearch/ConvNeXt
• facebookresearch/ConvNeXt-V2
• apple/ml-cvnets
• micronDLA/MobileViTv3
• jaiwei98/mobile-vit-pytorch
• microsoft/Swin-Transformer
• HKU-TASR/Protego

License

This project is licensed under the MIT License.

Citation

If you find our project useful in your research, please consider citing:

@inproceedings{wang2026protego,
    title={Protego: User-Centric Pose-Invariant Privacy Protection Against Face Recognition-Induced Digital Footprint Exposure},
    author={Ziling Wang and Shuya Yang and Jialin Lu and Ka-Ho Chow},
    booktitle={Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition},
    year={2026}
}