diff --git a/world-id/credentials/11.mdx b/world-id/credentials/11.mdx index 40ee9bf..4095737 100644 --- a/world-id/credentials/11.mdx +++ b/world-id/credentials/11.mdx @@ -62,7 +62,7 @@ user completes the camera flow again before returning another proof. Anyone with World ID App can use Selfie Check. No Orb, passport or other prerequisite credential is required. -## Understand the Sybil score +## Uniqueness Risk Signal Each Selfie Check response includes a versioned `sybil_score` that can help an app assess the risk of repeated enrollment. It is a risk signal, not @@ -70,6 +70,44 @@ a uniqueness verdict, and should be considered alongside other evidence. The response also includes an `integrity_bundle` that lets the Developer Portal verify it came from an authentic World ID App. +### Understanding Sybil Score + +The score measures how far the observed number of face matches exceeds the number expected from the model’s False Match Rate (FMR), expressed in standard deviations. A higher score indicates more matches above that baseline and a stronger signal of possible repeated enrollment. + +At enrollment, the new face’s embedding is compared privately against the existing embeddings in the database. The number classified as a match is `match_count`. The FMR is the probability that the model incorrectly matches two different people. + +For a database containing `db_size` entries, the expected number of false matches is `db_size × FMR`. Under the model’s assumptions, the standard deviation is `√(db_size × FMR × (1 − FMR))`. + +The raw score is calculated as: + +$$ +z = \frac{\text{match\_count} - \text{db\_size} \times \text{FMR}} +{\sqrt{\text{db\_size} \times \text{FMR} \times (1 - \text{FMR})}} +$$ + +The returned score is clipped to the range `0` to `10`: negative values are returned as `0`, and values above `10` are returned as `10`. + +$$ +\text{score} = \max(0, \min(z, 10)) +$$ + +**Model assumptions.** This calculation treats `match_count` as following a `Binomial(db_size, FMR)` distribution. It assumes each comparison is independent and has the same false-match probability. It does not account for dependencies between database entries or subgroups whose FMR differs from the population average used in the calculation. + +A nonzero match count does not establish that someone is already enrolled, and a low score does not guarantee uniqueness. The score is recalculated at enrollment and each credential renewal, so it can change as credentials enter or expire from the database. + +#### Interpreting the score + +**Guidance for integrators:** The bands below provide a high-level explanation of the score. They are illustrative risk categories, not validated decision thresholds or probabilities of prior enrollment. Choose and validate your own thresholds based on your application’s risk tolerance, and consider the score alongside other evidence. + +| Returned score | Technical interpretation | High-level guidance | Illustrative risk level | +| --- | --- | --- | --- | +| **0 to less than 2** | The raw value is below 2 standard deviations above the expected false-match count. Negative raw values are also returned as `0`. | Little or no excess-match signal. This does not establish uniqueness. | Low | +| **2 to less than 4** | The observed count is 2 to less than 4 standard deviations above the expected count. | An elevated signal that may reflect lookalikes or repeated enrollment. Assess alongside other signals. | Medium | +| **4 to less than 6** | The observed count is 4 to less than 6 standard deviations above the expected count. | A stronger excess-match signal. Consider additional verification based on your risk policy. | High | +| **6 to 10** | The raw value is at least 6 standard deviations above the expected count. Values above 10 are capped at `10`. | A substantial excess-match signal that warrants closer assessment. It does not prove prior enrollment. | Very high | + +These standard-deviation bands should not be read as normal-distribution confidence levels or as the probability that a person is already enrolled. + ## Choose your integration Use **session proofs** if users need to complete Selfie Check more than once—for