On-device and browser AI: why it matters for privacy, not just speed

The usual pitch for on-device AI is speed — no network round trip. The pitch that matters more, especially for anything touching biometric data, is that data which never leaves the device can never leak from a server.

The architecture decision, concretely

In FaceVision, detection, embedding and liveness checks run entirely client-side via ONNX Runtime Web. The backend receives a 512-dimension embedding, never an image. If that backend is ever breached, there are no faces to steal — only vectors that can match, not reconstruct.

What you give up

Model size is constrained by what a browser can reasonably load and run, and you lose the ability to centrally update inference logic without a client update. For anything privacy-sensitive, that tradeoff is usually worth it.

Where this pattern applies beyond faces

Any input a user would reasonably not want stored — voice, handwriting, location patterns — is a candidate for on-device inference producing a derived, non-reversible representation instead of storing the raw input.