Notes: We allowed the use of the “unknown” option, enabling participants to explicitly indicate a rejection by assigning the UID as “unknown.” Additionally, we treated all scores equal to 0.0 as explicit rejections, similar to the “unknown” option.

For further statistical analysis, we also considered a variant where only UID matching was evaluated (referred to as “UID only” in the table above), ignoring the requirement for exact password matching.

For the method proposed by sAIfer Lab, this distinction made no difference, as all accepted users were also correctly matched with their passwords. However, for the UNINA method, the Equal Error Rate (EER) slightly increased, as some UIDs were correctly recognized, but the associated password was either incorrect or unknown.