When INT8 was the wrong answer

VeriLens is a KYC suite that runs entirely in the browser: face detection, face matching, passive liveness, OCR and tamper forensics on ONNX Runtime Web and Tesseract WASM. Nothing leaves the device — which means every model has to be downloaded to the device, and payload size becomes a product feature.

The obvious win

Static INT8 quantisation (QDQ format) for UltraFace RFB-320 detection and MobileFaceNet embeddings brought the model payload from 16.6 MB to 5.6 MB — a 66 % cut — with the face-match margin intact: genuine pairs still land around cosine 0.85 while impostors sit near −0.01.

The one that broke

MiniFASNetV2 scores passive liveness with three-crop test-time augmentation. In FP32 it separates a live face (p ≈ 0.998) from a replayed photo (p ≈ 0.06) by a comfortable margin. Quantised to INT8, that separation collapsed. The headline accuracy on easy cases barely moved; the margin on the cases that matter did.

Accuracy is a summary. Decisions are made on margins. Quantise per model, and measure the separation you actually threshold on — not a benchmark average.

What shipped

• Detection and embeddings in INT8; liveness deliberately kept in FP32, with the measurement written down in the README rather than hidden.
• A weighted trust score — 0.35 face · 0.25 liveness · 0.25 tamper · 0.15 OCR completeness — under hard-fail rules, producing a verdict and a downloadable JSON audit report.
• About 48 ms for the three models on two vCPUs.
• Everything vendored; Playwright end-to-end tests assert both the genuine flow and the tampered flow.

The lesson generalises beyond faces. Whenever a model feeds a threshold, the quantity to protect is the distance between the classes on either side of it. Payload budgets are real, but a 5.6 MB download that cannot tell a photo from a person is not a smaller product — it is a different one.