1 Introduction↩︎

Four-finger SLAP fingerprints are flat live-scan impressions acquired by simultaneously capturing the index, middle, ring, and little fingers of one hand. These impressions are widely used for identity verification in high-stakes operational settings, including border control, immigration screening, law enforcement, criminal background checks, and national identity management. In U.S. border operations, SLAP impressions support traveler identity verification against large-scale biometric repositories such as the DHS Automated Biometric Identification System (IDENT) [1].

Despite their operational importance, SLAP fingerprints remain largely unexplored in recent evaluations of multimodal large language models (MLLMs). Existing fingerprint-oriented MLLM benchmarks primarily evaluate individual rolled or plain fingerprint impressions [2]. For example, FPBench evaluates 20 MLLMs across eight fingerprint tasks, but its evaluations are based on single-finger rolled or plain impressions drawn from Fingerprint Verification Competition (FVC) datasets and NIST SD302d/SD301a [2]. These settings differ substantially from SLAP verification. A four-finger SLAP image contains multiple fingers in a single frame and exhibits variation in ridge clarity, contact pressure, finger placement, inter-finger spacing, and local distortion. Consequently, SLAP verification requires not only fine-grained ridge comparison but also spatial reasoning over the relative structure and correspondence of multiple fingers.

NIST Special Database 302b (SD302b) provides a particularly relevant basis for studying this problem. Unlike curated benchmarks designed primarily for controlled algorithmic evaluation, SD302b reflects operational live-scan acquisition and includes images captured across multiple devices and resolutions. This makes it a challenging and deployment-relevant testbed for evaluating whether general-purpose MLLMs can perform identity verification from four-finger SLAP fingerprint images.

A second open question concerns the role of prompting. Prior biometric MLLM benchmarks for face and fingerprint recognition have reported positive-bias collapse, in which a model repeatedly predicts “same person” regardless of the input pair [2], [3]. On a balanced verification set, such behavior can yield 50% accuracy while concealing a critical failure mode. In high-stakes biometric applications, however, this behavior would be unacceptable because it corresponds to accepting every comparison as genuine. Binary forced-choice prompting is commonly used in biometric MLLM evaluation, but it remains unclear whether this format induces similar collapse on SLAP fingerprint images, or whether alternative prompt designs can mitigate the problem.

To address these gaps, we introduce SLAPBench, an evaluation benchmark for MLLM-based four-finger SLAP fingerprint verification. SLAPBench is intended as an evaluation probe of current MLLM behavior, not as a proposed deployment system for operational biometric verification. Our goal is to characterize how these models succeed and fail on SLAP-format fingerprint images, and to examine how prompting strategy affects verification behavior, collapse, and discriminative performance.

This paper makes the following contributions:

1. SLAPBench, the first benchmark for MLLM evaluation on four-finger SLAP fingerprint verification, built on NIST SD302b, an operational dataset that no prior fingerprint MLLM work has used.

2. A reproducible evaluation protocol of 7,832 fixed pairs (176 mated, formed across resolution because SD302b provides a single SLAP capture per finger position; 7,656 non-mated, covering all \(\binom{88}{2}\) subject combinations per FRGP), released as a fixed pair manifest with demographic metadata that supports a stratified analysis across gender, race, and age.

3. Systematic evidence of positive-bias collapse on SLAP data. Five of ten binary prompting configurations collapse to accepting nearly every pair as genuine. All four open-source models collapse under task-description prompting and Gemma-3-12B collapses under zero-shot as well, while the proprietary Claude Opus 4.8 resists collapse under both prompts. Collapse is therefore largely a property of the prompt format, but a sufficiently capable model can overcome it.

4. A similarity-scoring prompt that exposes model capability. Scoring eliminates collapse in all four open-source models, yet discrimination still ranges from functional (Claude Opus 4.8, Gemma-3-12B) to near-random or inverted (Qwen2.5-VL-7B, InternVL3-8B). Scoring is thus necessary but not sufficient, and model architecture sets the ceiling (Table 1).

5. A cautionary analysis of a perfect benchmark score. Qwen3-VL-8B attains AUC \(= 1.000\) under scoring. A matched-resolution control that removes resolution as a class cue leaves the perfect separation intact, which excludes the resolution shortcut; the single-capture design of SD302b nonetheless leaves near-duplicate detection in place, and no configuration of the dataset can separate it from identity matching. We offer this as evidence that near-perfect MLLM biometric results warrant a protocol audit before they are read as capability.

6. Public release of the evaluation code, the fixed pair manifest, the raw result CSVs, and the per-pair score files, so that every number reported here can be recomputed. Code and data: https://github.com/bibeshpyakurel/SLAPBench.

2 Related Work↩︎

Fingerprint recognition. Classical pipelines of acquisition, enhancement, feature extraction, and matching [4] have been advanced at each stage by deep learning: FingerNet unifies ridge-orientation and minutiae extraction [5], DeepPrint learns fixed-length embeddings for scalable verification [6], and commercial matchers such as VeriFinger [7] provide operational FAR/FRR baselines. SLAP segmentation is studied separately [8]; to our knowledge no prior work evaluates end-to-end MLLM performance on SLAP images.

MLLM biometric benchmarks. FaceXBench [9] evaluates 28 models on 5,000 face-task questions and finds chain-of-thought prompting consistently degrades performance, a caution against assuming more context helps. FaceRecBench [3] benchmarks 27 MLLMs on face verification and reports two findings we revisit for fingerprints: many models collapse to 50% accuracy by always accepting or rejecting, and the best model carries the strongest demographic bias; a follow-up extends this to heterogeneous face recognition with similar capability gaps [10]. FPBench [2] is closest to us, evaluating 20 MLLMs on eight single-finger fingerprint tasks under MCQ prompting. We differ in three ways: four-finger SLAP images requiring spatial reasoning; continuous similarity scoring alongside binary classification; and the operational SD302b dataset. Across these benchmarks, response collapse recurs and has been attributed to training-data priors favouring “same” together with the ambiguity of biometric comparison in language; we give the first quantitative account on SLAP images and show that continuous scoring removes it.

3 Dataset and Data Preparation↩︎

3.1 NIST Special Database 302b↩︎

NIST SD302b [1] is a subset of the Nail-to-Nail (N2N) Fingerprint Challenge dataset collected by the Intelligence Advanced Research Projects Activity (IARPA). The database contains fingerprint images from 201 participants captured using multiple devices at two resolutions: 500 PPI (standard operational resolution) and 1000 PPI (high resolution for research). Participants span diverse demographics including age (range: 18–70), gender, race, and occupational background (work type), enabling stratified fairness analysis. We focus exclusively on FRGP 13 (right four-finger SLAP) and FRGP 14 (left four-finger SLAP) images captured by Device R. Device R images in SD302b are captured natively at 1000 PPI, and the corresponding 500 PPI versions are supplied for compatibility with 500 PPI fingerprint algorithms. The 500 PPI image is therefore a downsampled version of the same capture rather than a second, independent impression. We confirmed this directly against the distributed file structure: each (subject, FRGP) combination is represented by exactly one capture, available at two resolutions, and SD302b offers no repeat SLAP impression for any subject and finger position. This database property, not a choice of ours, fixes the form of a mated pair: a same-capture cross-resolution comparison between the native 1000 PPI image and its 500 PPI counterpart, not two independent impressions (Sections 4.1 and 6).

Data preparation. Following the SD302b documentation we exclude errata-flagged subjects (labeling errors), roll images (devices U, V), FRGP 15 thumb-slaps, and pre-cropped segmented crops, and keep only subjects with both R-500 and R-1000 captures. Of the 201 participants, 92 have Device R four-finger SLAP at both FRGP 13/14 and both resolutions; removing errata/incomplete subjects leaves 88 clean subjects. The verification experiment therefore uses 352 Device R images (88 subjects \(\times\) 2 FRGP \(\times\) 2 resolutions). For each image we record image-level metadata, per-finger segmentation ground truth (bounding boxes and rotation angle \(\theta\) from the SD302b segmentation CSVs), and participant demographics.

Ground-truth segmentation. SD302b ships per-image segmentation CSVs giving bounding-box coordinates and a rotation angle for each finger (dedicated SLAP segmentation systems address the same step [8]); a representative overlaid image appears in Fig. 4. For verification we use the full SLAP images without cropping, as operational pipelines do. Because a single frame holds four overlapping fingers of similar morphology, any two SLAP images look globally alike whether mated or not, which underlies the positive-bias collapse analyzed in Section 6.

4 Evaluation Protocol and Methodology↩︎

4.1 Pair Construction↩︎

We construct mated and non-mated verification pairs following the all-pairs protocol used in FaceRecBench [3] and FPBench [2].

Mated (genuine) pairs. For each FRGP \(\in \{13, 14\}\), we pair each subject’s native 1000 PPI image with the corresponding downsampled 500 PPI version of the same capture. With 88 clean subjects, this yields 88 mated pairs per FRGP and 176 mated pairs in total, fixed by the structure of the database rather than by a sampling decision.

Non-mated (impostor) pairs. For each FRGP, we form all pairings of distinct subjects. With 88 subjects, this yields \(\binom{88}{2} = 3{,}828\) unique non-mated pairs per FRGP, and \(3{,}828 \times 2 = 7{,}656\) non-mated pairs in total.

The resulting 7,832 pairs (176 mated \(+\) 7,656 non-mated), released as a fixed manifest, form an intentionally impostor-heavy protocol; as is standard in biometrics, we emphasize FAR, FRR, AUC, EER, and TAR at low FAR rather than overall accuracy, which the non-mated majority dominates.

Resolution structure and its consequence. Mated pairs are cross-resolution (1000 PPI vs. PPI), whereas non-mated pairs are drawn from the 500 PPI pool and are therefore same-resolution (500 PPI vs. PPI). The two classes consequently differ in a property that has nothing to do with identity, and a model could in principle separate them by reading resolution or appearance statistics instead of comparing ridge structure. We state this plainly at the outset because it governs how the strongest results in Section 5 may be read. To settle it we also build a matched-resolution variant in which the non-mated pairs are formed as 1000 PPI vs. PPI, so both classes share the same resolution structure; Section 6.3 reports that the strongest result is unchanged under this control, so the ranking is not an artefact of resolution mismatch. The collapse results are not affected either, for the reason given in Section 6.5: FAR is computed on non-mated pairs, which are same-resolution by construction and involve no cross-resolution comparison at all. Each pair record also carries demographic metadata (age, gender, and race of both subjects), which supports the stratified analysis in Section 5.3.

4.2 Models↩︎

The four open-source models span the systems that lead recent fingerprint and face benchmarks: InternVL3-8B-Instruct [11] (bfloat16, \(\sim\)​16 GB), a top open-source performer in FPBench; Qwen2.5-VL-7B-Instruct [12], the architecture strongest in FaceRecBench; its successor Qwen3-VL-8B-Instruct [13]; and Gemma-3-12B-IT [14], the largest local model. The latter three use 4-bit NF4 quantization (\(\sim\)​6–8 GB). We add Claude Opus 4.8 [15] (Anthropic API, undisclosed weights) as a high-capability proprietary reference. Exact identifiers are InternVL3-8B-Instruct, Qwen2.5-VL-7B-Instruct, Qwen3-VL-8B-Instruct, Gemma-3-12B-IT, and claude-opus-4-8; all runs were collected in June 2026.

The open-source models run via HuggingFace transformers on a single NVIDIA RTX 4080 SUPER (16.9 GB) with deterministic decoding (temperature\(=0\)); Claude is queried as independent stateless requests. The two images and the text prompt are the only inputs to any model: no filenames, subject IDs, resolution labels, or demographics appear in a request, so no model has access to ground-truth identity at inference.

4.3 Prompting Strategies↩︎

We evaluate three prompting strategies, using a fixed system prompt “You are an expert fingerprint examiner.” across all settings. Before inference, every image is converted to grayscale, contrast-normalized (autocontrast), and resized to \(448\times448\) pixels, identically for all five models; this common preprocessing also equalizes the pixel dimensions of the 500 and 1000 PPI images, though it does not remove the underlying near-duplicate relationship between a mated pair (Section 6). Under zero-shot the model receives the two images and the binary question “Do these two images belong to the same person? (A) Yes (B) No.” Task description prepends a sentence explaining that repeated captures of one finger vary slightly while ridge patterns persist, before the same binary question. Similarity scoring instead asks for a single integer from 0 (certainly different) to 100 (certainly the same). The three templates are reproduced verbatim in Fig. 6.

4.4 Response Parsing and Metrics↩︎

For binary prompts we parse responses with the three-step fallback of VLMEvalKit [16] (leading A/B; then A/B anywhere; then keyword matching on SAME/YES/GENUINE vs.DIFFERENT/NO/IMPOSTOR), marking anything unmatched INVALID. For the scoring prompt we take the first integer via regex and clamp it to \([0,100]\). We report standard verification metrics: for binary prompts, accuracy, FAR, FRR, and collapse detection (any answer chosen \(>\)​95% of the time); for scoring, mean confidence on mated and non-mated pairs, their separation \(\Delta\), EER, and AUC from a threshold sweep over \([0,100]\).

5 Results↩︎

5.1 Binary Prompting: Collapse Under Task Description↩︎

Positive-bias collapse appears in five of ten binary configurations, with FAR reaching 96.4–100% (Table 1). All four open-source models collapse under the task-description prompt, and Gemma-3-12B collapses under zero-shot as well. The proprietary Claude Opus 4.8 is the sole exception, resisting collapse under both prompts.

4.5pt

All five collapsed runs sit at 2.2–5.7% accuracy rather than 50%: accepting all 7,832 pairs scores only the 176 mated pairs (2.25%) correct, so FAR, at 96.4–100%, is the meaningful measure of a complete verification failure.

Under zero-shot prompting, four models avoid collapse (FAR 20.2–72.3%, Table 1). Claude Opus 4.8 gives the strongest binary result overall (80.3% accuracy, FAR 20.2%), ahead of the best open-source model, Qwen3-VL-8B (74.1%, FAR 26.5%); InternVL3-8B and Qwen2.5-VL-7B trail at FAR 72.3% and 69.6%. Gemma-3-12B is the exception, collapsing even under zero-shot (FAR 96.4%). Across these non-collapsed runs nearly every mated pair is accepted (FRR \(\leq\)​0.6%), so “different” answers fall almost exclusively on impostor pairs.

Adding domain context (TD) collapses all four open-source models to near-100% FAR, including Qwen3-VL-8B which had the best open-source ZS result. Claude Opus 4.8 is the lone exception: under TD it remains balanced (50.2% accuracy, FAR 50.9%, answering “same person” on only 52% of pairs), neither collapsing nor degrading to the open-source failure mode. For the open-source models, prompting complexity increases the false accept rate rather than reducing it, confirming the FaceXBench and FPBench observation that additional context does not help and actively hurts in biometric binary tasks [2], [9].

5.2 Similarity Scoring: Discriminative Signal Revealed↩︎

The similarity-scoring prompt eliminates collapse across all four open-source models: no model produces a single constant output, and mated and non-mated pairs occupy distinguishable (though not always separable) score ranges. Figure 1 shows the distributions for all five models, and the scoring block of Table 1 gives the metrics.

The models split into two tiers (Table 1). Qwen3-VL-8B separates the classes completely (AUC \(= 1.000\), EER \(= 0.0\%\)); a result this clean calls for scrutiny rather than celebration, and we examine it in Section 6.3. Claude Opus 4.8 is the strongest graded discriminator (AUC \(= 0.953\)), with the widest mated-to-non-mated gap of any model (\(+\)​42.9 points), and Gemma-3-12B is functional but weaker (AUC \(= 0.837\)). The other two fail in opposite ways: InternVL3-8B is inverted, reporting higher confidence on impostors than on genuine matches (\(\Delta = -21.4\), AUC \(= 0.590\)), while Qwen2.5-VL-7B is compressed, over 90% confident on nearly every pair regardless of identity (\(\Delta = +4.9\), AUC \(= 0.567\)). Both are near chance and neither admits a threshold that accepts a mated pair before an impostor, so both reach TAR \(= 0.0\%\) at FAR \(= 0.1\%\). Per-hand behaviour is symmetric for every model, so we omit the FRGP 13/14 split.

Scoring therefore eliminates collapse in all four open-source models without guaranteeing meaningful discrimination: Qwen3-VL-8B, Claude, and Gemma separate the classes, whereas InternVL3-8B and Qwen2.5-VL-7B stay effectively random. The binary collapse in Table 1 is thus a prompt-format artifact; whether discriminative capability can be unlocked by scoring depends on model architecture. Two real pairs in Fig. 5 illustrate this: on a mated pair only InternVL3-8B fails (returning 9), and on a non-mated pair only InternVL3-8B (85) and Qwen2.5-VL-7B (95) falsely accept.

Figure 2 plots the full ROC curves for the four open-source models and Claude Opus 4.8. The inset shows the low-FAR operating region (FAR \(\leq 0.05\)), where Qwen3-VL-8B achieves TAR \(= 100\%\) even at FAR \(= 0.1\%\). The TAR_0.1% column of Table 1 reports TAR at FAR \(= 0.1\%\), the standard operational stringency target in border biometrics. InternVL3-8B and Qwen2.5-VL-7B reach 0% here because their score distributions offer no threshold that holds FAR below 0.1% while still accepting any mated pair, a direct consequence of inverted calibration (InternVL3) and compressed scoring (Qwen2.5).

5.3 Demographic Fairness↩︎

FaceRecBench reports that the best face-verification MLLM also carries the strongest demographic bias [3]; we test the pattern on SLAP by recomputing similarity-scoring performance within gender, race, and age subgroups for the three discriminating models (Fig. 3; full protocol and per-subgroup table in Appendix 9). The pattern runs opposite to FaceRecBench’s: on SLAP data the stronger models look fairer. Claude Opus 4.8 varies by at most 1.5 AUC points across gender, whereas the weakest discriminator, Gemma-3-12B, shows the widest spread; Qwen3-VL-8B is uniformly perfect, equally consistent with a group-invariant representation and with the non-identity shortcut of Section 6.3. To the extent the small subgroups support any reading, disparity tracks model weakness rather than strength. We treat this as an initial, hypothesis-generating probe on a single database rather than an audit.

6 Discussion↩︎

6.1 Why Binary Prompts Collapse on SLAP Data↩︎

Collapse follows a consistent signature: every collapsed run has FRR \(= 0\%\) and FAR \(\geq 96.4\%\), the mark of a model whose prior for “same person” is so strong that no visual evidence moves it toward “B.” Two structural factors make this prior stronger for SLAP than for the single-finger images of FPBench. First, any two SLAP images share the same gross morphology (four fingers, similar spacing, skin texture, and orientation), so their global similarity is far higher than between two isolated rolled impressions, whether the pair is mated or not; the surface-level similarity prior is thus satisfied for every pair regardless of identity. Second, the task-description prompt, which states that “the same person’s fingers produce slightly different images each time,” increases collapse: it primes a schema in which variation is a property of mated pairs and lowers the “same” threshold across all inputs, the model having read “same person” twice before seeing either image. The lesson for benchmark design is that naturalistic domain descriptions can worsen collapse by legitimizing visual differences.

This also explains the exception. Claude Opus 4.8 resists collapse under both prompts exactly as the mechanism predicts, rejecting about half of impostors even under task description (FAR 50.9%) and four-fifths under zero-shot (FAR 20.2%). A model with identity evidence strong enough to overcome the similarity prior is not forced into the degenerate “same” response. Collapse is therefore a capability threshold, not a fixed property of the binary format: the same format that collapses four open-source models leaves the strongest one balanced.

6.2 Why Similarity Scoring Breaks Collapse↩︎

The scoring prompt resolves the same underlying problem by changing what the model is asked to optimize. Under binary prompting, the model must commit to a categorical label against its own prior; the prior wins. Under scoring, the model places a continuous estimate on a calibrated scale, a task that requires reporting a degree of confidence rather than crossing a decision boundary. This framing lets the model’s uncertainty about impostor pairs surface as a lower score instead of being suppressed into the same “A” response it gives to mated pairs.

The scoring prompt eliminates collapse in all four open-source models, but the resulting distributions show that scoring is necessary without being sufficient. It reveals whether discriminative capability exists; it does not confer it. The two models that lack it are InternVL3-8B and Qwen2.5-VL-7B (Fig. 1, rightmost panels).

The two failures differ in kind. InternVL3-8B is inverted, scoring impostors above genuine pairs; we suspect its encoder keys on fine-grained ridge texture, which contrasts more strongly across two different subjects than between two renderings of one capture, so scoring faithfully reports this signal in the wrong direction. Qwen2.5-VL-7B is instead compressed: correctly ordered but confined to a narrow high-confidence band, the scoring-domain echo of the same similarity prior that drives its binary collapse. In neither case can scoring manufacture discrimination the representation does not encode.

Why does scoring unlock the stronger models but not these? The most actionable explanation is that its calibrated anchors tell the model where to look (ridge flow, minutiae) and what to report (a value on a fixed scale) rather than forcing a binary commit, and only models with sufficient visual reasoning (Qwen3, Claude) can act on them. The practical implication is that a calibrated scoring prompt is a more effective probe of MLLM biometric capability than binary forced choice, but only when the architecture can exploit it.

6.3 A Perfect Score Is a Diagnostic, Not a Capability Claim↩︎

Qwen3-VL-8B attains AUC \(= 1.000\) with EER \(= 0.0\%\). We do not read this as a capability result: the number is explained by the structure of the protocol rather than by verification ability, and the episode is the paper’s most useful finding for benchmark designers, because it shows how readily a SLAP protocol can manufacture a perfect score.

The behavior underlying the number is revealing. Qwen3-VL-8B assigns exactly 100 to all 176 mated pairs, while its non-mated scores take only seven distinct values (\(\{0, 30, 45, 65, 85, 90, 95\}\), mean 63.8) and never exceed 95. Perfect separation is therefore not a finely graded judgment but a coarsely quantized output in which the single response 100 is reserved for the mated class; any mechanism that saturates the mated class this way reproduces AUC \(= 1.000\) whether or not it compares ridge structure. A model doing genuine forensic comparison would show some graded uncertainty across 176 subjects, as Claude Opus 4.8 does (nine distinct mated and 48 non-mated values on the same pairs).

The resolution shortcut is the most economical explanation and the one we set out to test: mated pairs are cross-resolution (1000 vs. PPI) while non-mated pairs are same-resolution (500 vs.), so a model that merely detects downsampling could separate the classes without comparing identity. We therefore ran the matched-resolution control of Section 4.1, rebuilding every non-mated pair as 1000 PPI vs. PPI so both classes share the same structure and differ only in identity (FRGP 13: 88 mated, all 3,828 non-mated). The result is essentially unchanged: exactly 100 on every mated pair, no non-mated pair above 95, AUC \(= 1.000\) with the non-mated mean moving only from 65.6 to 65.3. Making resolution non-diagnostic had no measurable effect, so we exclude the resolution shortcut.

What the control cannot remove is near-duplicate detection: a mated pair is one capture rendered at two scales, so the two images share far stronger low-level correspondence than a deployed matcher sees between independent impressions, and rearranging resolutions cannot disturb this. SD302b cannot adjudicate it, because Device R holds one capture per subject and finger and the Device R and Device S pools are disjoint, so no mated pair can be formed from two independent impressions; settling the question needs a database with repeat SLAP captures. Memorization we set aside: had the model memorized identity labels the knowledge should transfer across prompts, yet its zero-shot FAR is 26.5% and it collapses under task description, and no other model (not even Claude at AUC \(= 0.953\)) reproduces the result.

The honest summary is narrow: Qwen3-VL-8B separates SLAPBench’s pairs perfectly under scoring; the resolution shortcut has been tested and ruled out; near-duplicate detection remains and cannot be excluded within SD302b; and genuine identity discrimination, though consistent with the control, cannot be separated from it here, so no operational verification capability should be inferred. Near-perfect MLLM biometric results warrant a protocol audit before they warrant belief.

6.4 The Left-Hand / Right-Hand Asymmetry↩︎

A modest per-hand asymmetry appears under zero-shot prompting, but its direction is model-specific: Qwen3-VL-8B favours the left hand by 5.0 FAR points while Claude Opus 4.8 favours the right by 4.7, and the other three models are near-symmetric (FAR gaps \(\leq\)​3.6 points). Since both FRGPs draw identical pair counts from the same 88 subjects, this reflects model-specific pretraining priors rather than any property of SLAP images; disentangling it would need a second dataset.

6.5 Limitations↩︎

Three limitations bound what the present results establish, and we state them alongside the findings each one does and does not touch.

Mated-pair construction. SD302b provides a single SLAP capture per subject and finger position, so a mated pair can only be formed across the two resolutions of that one capture (Section 3). Our matched-resolution control shows this asymmetry does not drive the results (Section 6.3); what the single-capture design leaves in place is that a mated pair is one exposure rendered twice, so near-duplicate detection cannot be separated from identity matching within this dataset, and settling it requires a database with repeat captures. This is why we decline to read Qwen3-VL-8B’s AUC \(= 1.000\) as verification capability. It does not bear on the central findings: collapse is measured on non-mated pairs alone, so the collapse of the open-source models, Claude Opus 4.8’s resistance, and the removal of collapse by scoring are all unaffected.

Model coverage. Our proprietary coverage is a single system. FPBench reports that Gemini 2.5 Pro leads open-source models by roughly 4 percentage points on single-finger tasks [2], and whether the collapse resistance we observe in Claude Opus 4.8 is a property of frontier-scale models generally or specific to Claude cannot be settled with one data point.

Scope. The fairness analysis (Section 5.3) rests on 88 subjects with several small subgroups, so it is an initial probe rather than an audit; and SLAPBench compares MLLMs against one another, not against a deployed matcher such as VeriFinger [7], so it places models on a relative rather than an absolute scale. Both are left to future work.

6.6 Future Work↩︎

Several directions follow. The most immediate is the matched-resolution control of Section 6.3, rebuilding the non-mated pairs as 1000-vs-500 comparisons (in both orderings) so that resolution no longer signals class, alongside a mated set from a database with repeat impressions to remove the near-duplicate cue. Beyond that: broader proprietary evaluation (GPT-series, Gemini) to test whether Claude’s collapse resistance is general; domain-adaptive fine-tuning, which FPBench shows adds 7–39% on single-finger tasks [2]; larger-scale fairness on a balanced multi-database pool; algorithmic-baseline calibration against a matcher such as VeriFinger; and benchmark extension to the seven further SLAPBench tasks (finger counting, laterality, localization, position, quality, rotation, and segmentation-challenge identification).

7 Conclusion↩︎

We introduced SLAPBench, the first benchmark for evaluating multimodal large language models on four-finger SLAP fingerprint verification, built on NIST SD302b with 7,832 pairs (176 mated, 7,656 non-mated). Task-description prompting collapses all four open-source models to near-100% FAR and Gemma-3-12B collapses under zero-shot as well, while Claude Opus 4.8 resists collapse under both prompts and records the strongest binary result (FAR \(= 20.2\%\)). Similarity scoring eliminates collapse across the open-source models and shows that architecture sets the ceiling, with discrimination ranging from functional (Claude Opus 4.8, Gemma-3-12B) to near-random or inverted (Qwen2.5-VL-7B, InternVL3-8B; full metrics in Table 1). Collapse is thus an artifact of the prompt format, whereas unlocking discriminative capability through scoring requires sufficient visual reasoning. Qwen3-VL-8B’s perfect separation (AUC \(= 1.000\)) we deliberately do not claim as capability: a matched-resolution control rules out the resolution shortcut, but SD302b’s single-capture design still admits near-duplicate detection, so whenever a dataset offers only one capture per subject the synthesized mated class can itself become the cue a model reads, and near-perfect results call for a protocol audit before belief. With the first SLAP-specific baseline established, domain-adaptive fine-tuning is the natural next step, consistent with the gains FPBench reports on single-finger tasks [2].

8 Supporting Figures↩︎

This appendix collects the supporting figures referenced in the main text, together with the full protocol for the fairness analysis. It introduces no new claims; every result it illustrates is stated and quantified in the main text.

None

9 Demographic Fairness Detail↩︎

This section gives the full protocol and per-subgroup table for the fairness analysis summarized in Section 5.3. We recompute similarity-scoring performance within demographic subgroups: a mated pair is assigned to a subgroup by its subject’s attribute, and a non-mated pair is counted within a subgroup only when both subjects share that attribute. The analysis is restricted to the three discriminating models (subgroup breakdowns of the two near-random models are uninformative) and to subgroups with sufficient support among the 88 clean subjects (gender; White and Black race; three age bands); Asian, “other,” and “no answer” race groups (\(\leq 6\) subjects) are too small to evaluate reliably.

5pt

Claude Opus 4.8 varies by at most 1.5 AUC points across gender (male 0.945, female 0.960) and 0.7 across White/Black. Gemma-3-12B shows the widest spread, with a 4.4-point gender gap and an EER swing from 18.3% to 4.4% between White and Black; that Black subgroup rests on only 272 within-group non-mated pairs from 17 subjects, so neither its values nor any disparity from them should be over-read.

References↩︎