Signature Models

Model Card for Model ID

Model Details

Model Description

This model is an imagee-embedding network developed for offline signature verification. It determines whether two scanned signature images are likely to have been written by the same person by mapping each image into a 256-dimensional embedding space.

Rather than directly predicting a signer identity or producing a binary genuine/forged classification, the model learns a similarity representation using deep metric learning. Signature pairs can then be compared using cosine similarity.

The model uses an EfficientNetV2-S backbone and was trained with $L_{SC+}$, a modified metric-learning objective that emphasises difficult negative examples while also encouraging genuine signatures from the same signer to form compact clusters.

The model was developed as part of a university final-year research project on offline signature verification.

• Developed by: Me!
• Funded by: Independently developed as an academic final-year project
• Shared by: Me!
• Model type: Convolutional neural network image encoder / deep metric-learning model
• Input modality : Greyscale signature images
• Output: 256-dimensional L2-normalised embedding
• Language: Not applicable; the model processes images
• License: GNU General Public License v3.0
• Finetuned from model: timm/tf_efficientnetv2_m.in1k

Model Sources

• Repository: GitHub
• Write-Up Project Garden
• Demo: streamlit

Uses

Direct Use

The model can be used to:

• Extract feature embeddings from offline signature images.
• Compare two signatures using cosine similarity.
• Rank candidate signatures by similarity.
• Support research experiments involving writer-independent signature verification.
• Explore deep metric learning for biometric image matching.

A typical verification workflow is:

1. Preprocess two signature images.
2. Pass each image through the encoder.
3. Obtain two normalised 256-dimensional embeddings.
4. Calculate their cosine similarity.
5. Compare the similarity score against a threshold calibrated for the target dataset and operating conditions.

The model does not include a universally valid verification threshold. Users should select a threshold using validation data representative of their deployment environment.

Downstream Use [optional]

The model may be incorporated into:

• Signature-verification research systems.
• Document-processing prototypes.
• Signature retrieval or matching applications.
• Embedding visualisation and clustering experiments.
• Transfer-learning experiments on other handwriting or biometric datasets.

Additional fine-tuning is recommended before using the model on signature styles, writing systems, scanners, cameras, or document formats that differ substantially from the training data.

Out-of-Scope Use

The model is not intended for:

• Use as the sole basis for legal, financial, forensic, or identity-related decisions.
• Authentication of high-value transactions without additional safeguards.
• Definitive authorship attribution.
• Verification of online signatures captured as pen trajectories.
• Identifying the signer from a known list of individuals.
• Evaluating signatures from writing systems or populations not represented during development without additional validation.
• Replacing examination by trained forensic document specialists.
• Production deployment without domain-specific testing, calibration, monitoring, and human review.

The model should not be treated as proof that a signature is genuine or forged.

Bias, Risks, and Limitations

The model was primarily evaluated using the CEDAR signature dataset, which contains Latin-script signatures collected under controlled conditions. Its performance may not generalise to other populations, scripts, acquisition devices, document backgrounds, compression levels, or image qualities.

Important limitations include:

• Dataset size: CEDAR contains a relatively small number of writers compared with large-scale biometric datasets.
• Script limitation: The model was not comprehensively evaluated on Chinese, Arabic, Indic, or other non-Latin signature styles.
• Domain shift: Performance may decrease on photographs, mobile scans, noisy documents, low-resolution images, or signatures extracted from complex backgrounds.
• Skilled forgeries: A high similarity score does not guarantee that a signature is genuine, especially when a forgery closely imitates the genuine writer.
• Threshold sensitivity: Verification results depend on the decision threshold selected by the user.
• Preprocessing sensitivity: Cropping, padding, resizing, background artefacts, and binarisation may influence the generated embeddings.
• Writer-independent evaluation: Results from one evaluation split may not transfer directly to unseen datasets or deployment populations.
• Interpretability: Similarity scores do not provide a complete explanation of which handwriting characteristics caused a match or mismatch.
• Security: The model has not been evaluated against adversarial attacks, deliberate image manipulation, replay attacks, or model-extraction attacks.

Grad-CAM analysis conducted during development indicated that the network could sometimes attend to image boundaries, padding regions, and isolated marks. This suggests that acquisition and preprocessing artefacts may influence some predictions.

Recommendations

Users should:

• Calibrate the verification threshold using a representative validation set.
• Report false acceptance and false rejection behaviour alongside aggregate metrics.
• Evaluate performance separately for genuine pairs, random forgeries, and skilled forgeries.
• Test the model on the intended population, writing system, scanner, and document format.
• Retain human review for consequential decisions.
• Avoid interpreting a similarity score as conclusive evidence of identity or fraud.
• Monitor for performance degradation when the input distribution changes.
• Use multiple reference signatures where possible rather than relying on a single comparison.
• Apply consistent image extraction, cropping, and normalisation procedures.
• Document any threshold, preprocessing, or fine-tuning changes made in downstream systems.

How to Get Started with the Model

The model produces normalised feature embeddings rather than final genuine/forged labels.

The following example illustrates the intended inference process. The exact checkpoint-loading code may need to be adjusted to match the keys stored in the published checkpoint.

from pathlib import Path

import timm
import torch
import torch.nn as nn
import torch.nn.functional as F

from PIL import Image
from torchvision import transforms


class SignatureEncoder(nn.Module):
    def __init__(self, embedding_dim: int = 256) -> None:
        super().__init__()

        self.backbone = timm.create_model(
            "tf_efficientnetv2_m.in21k_ft_in1k",
            pretrained = False,
            in_chans=1,
            num_classes = 0,
            global_pool = "avg"
        )

        feature_dim = self.backbone.num_features

        self.embedding_head = nn.Sequential(
            nn.Linear(feature_dim, 512),
            nn.BatchNorm1d(512),
            nn.ReLU(inplace=True),
            nn.Dropout(p=0.4),
            nn.Linear(512, embedding_dim),
            nn.BatchNorm1d(embedding_dim),
        )

    def forward(self, images: torch.Tensor) -> torch.Tensor:
        features = self.backbone(images)
        embeddings = self.embedding_head(features)
        return F.normalize(embeddings, p=2, dim=1)

def load_signature_image(image_path: str | Path) -> torch.Tensor:
    preprocessing = transforms.Compose(
        [
            transforms.Grayscale(num_output_channels=1),
            transforms.Resize((384, 384)),
            transforms.ToTensor(),
            transforms.Normalize(mean=[0.5], std=[0.5]),
        ]
    )
    image = Image.open(image_path).convert("L")
    return preprocessing(image).unsqueeze(0)

device = torch.device("cuda" if torch.cuda.is_available() else "cpu")

model = SignatureEncoder(embedding_dim = 256)

checkpoint = torch.load(
    "signature_encoder.pt",
    map_loction=device,
    weights_only=True,
)
# Adjust this line if the checkpoint stores the state dictionary
# under a key such as "model_state_dict".

state_dict = checkpoint.get("model_state_dict", checkpoint)
model.load_state_dict(state_dict)

model.to(device)
model.eval()

signature_a = load_signature_image("signature_a.png").to(device)
signature_b = load_signature_image("signature_b.png").to(device)

with torch.inference_mode():
    embedding_a = model(signature_a)
    embedding_b = model(signature_b)

    cosine_similarity = F.cosine_similarity(
        embedding_a,
        embedding_b,
    ).item()

print(f"Cosine similarity: {cosine_similarity:.4f}")

A higher cosine similarity generally indicates that the two images are more likely to originate from the same signer. However, the score must be compared with a threshold calibrated on representative validation data.

# Example only; do not use without calibration
threshold = 0.75

prediction = (
    "likely same signer"
    if cosine_similarity >= threshold else
    "likely different signer"
)

print(prediction)

The example threshold above is illustrative and is not a recommended deployment threshold

Training Details

Training Data

The model was developed using the CEDAR offline signature dataset.

CEDAR contains:

• 55 writers.
• 24 genuine signatures per writer.
• 24 skilled forgeries per writer.
• 2,640 signature images in total.

The dataset includes genuine signatures and skilled forgeries produced by individuals attempting to imitate another person's signature.

A small self-collected signature set was also used during the broader project for demonstration and exploratory testing. It should not be interpreted as a statistically representative benchmark.

Users must obtain CEDAR separately and comply with its original licence and usage conditions. The dataset is not redistributed with this model.

Training Procedure

The model was trained as a writer-independent metric-learning system. During training, signature images were converted into embeddings, and online mining was used to identify informative positive and negative relationships within each batch.

The training procedure used a PK-style sampler to include multiple signatures from multiple writers while balancing genuine signatures, skilled forgeries, and negative examples.

Preprocessing

Training images were converted to greyscale and resized to approximately 384 × 384 pixels.

Training-time augmentation included:

• Random affine transformation of approximately ±5 degrees.
• Translation of up to approximately 10%.
• Scaling between approximately 0.95 and 1.05.
• Shearing of approximately ±5 degrees.
• Random resized cropping.
• Pixel normalisation using a mean of 0.5 and standard deviation of 0.5.

Evaluation preprocessing was deterministic and consisted primarily of:

• Grayscale conversion.
• Resizing.
• Tensor conversion.
• Normalisation using a mean of 0.5 and standard deviation of 0.5.

Exact preprocessing should be kept consistent between model evaluation and downstream inference.

Training Hyperparameters

• Backbone: EfficientNetV2-M
• Input channels: 1
• Input resolution: Approximately...