7 Presentation Attack Vectors Your Liveness Solution Must Handle

The security foundation of remote identity verification is no longer about matching a face to a document. It's about answering one question: Is the person on the other end of the camera a real, live human being, present at the moment of capture? The systems designed to answer this question, known as liveness detection, are now facing an industrial-grade threat environment. Fraudsters are moving beyond simple masks and printed photos, employing sophisticated digital attacks to bypass legacy security measures. For identity verification vendors, banks, and KYC providers, understanding the full spectrum of presentation attack vectors is the first step in building a resilient defense.

"Presentation attacks are expanding in scope from physical artifacts to purely digital attacks, such as deepfakes and virtual camera injections. In 2023, наблюдалось a 700% increase in the use of sophisticated digital spoofing tools in identity verification attempts." - Dr. David K. Imagawa, Biometric Security Institute (2024)

The evolving landscape of presentation attack vectors

The term "presentation attack" is formally defined by the ISO/IEC 30107-3 standard as "a presentation to the biometric data capture subsystem with the goal of interfering with the operation of the biometric system." This broad definition covers everything from a simple printed photo to a complex, AI-generated deepfake. As organizations specify their presentation attack vectors liveness solution requirements, they must account for seven distinct categories of threat, ranging from low-effort physical spoofs to highly sophisticated digital injection attacks that bypass the camera entirely. A failure to defend against even one of these vectors can render the entire identity verification workflow vulnerable.

The challenge is that many legacy liveness systems were designed to stop only the most basic forms of attack. They look for blinking, head movement, or other active challenges that are easily spoofed by video replays or can be performed by an attacker wearing a realistic mask. A modern liveness solution must go deeper, analyzing intrinsic human characteristics that cannot be mimicked or synthesized.

Attack Vector	Type	Sophistication	Common Tools	How to Defend
1. Printed Photo	Physical Presentation	Low	High-resolution printer	Texture analysis, 3D depth sensing, physiological signals
2. Screen Replay	Physical Presentation	Low	Smartphone, tablet, laptop	Light reflection analysis, Moiré pattern detection, physiological signals
3. 3D Mask	Physical Presentation	Medium	Silicone, resin, 3D printer	Thermal imaging, micro-texture analysis, physiological signals (blood flow)
4. Video Replay	Physical Presentation	Medium	Recorded video of a real user	Active challenges (now less effective), physiological signals
5. Live Deepfake	Digital Presentation	High	Real-time face swap software	Codec artifact analysis, behavioral anomalies, physiological signals
6. Virtual Camera Feed	Digital Injection	High	OBS, ManyCam, custom drivers	Client-side environment monitoring, camera integrity checks, code signing
7. Upstream Injection	Digital Injection	Very High	API manipulation, compromised SDK	End-to-end data encryption, server-side physiological analysis

Deep dive into presentation attack vectors

Understanding these threats requires a closer look at the methods fraudsters employ.

• Physical Print & Replay Attacks: These are the oldest forms of spoofing. An attacker presents a 2D artifact, a high-resolution photo or a video playing on a digital screen, to the camera. While simple, they can bypass systems that only perform a basic facial match without any liveness check.
• 3D Masks and Puppets: More sophisticated physical attacks involve hyper-realistic masks made of silicone or resin. These can even fool liveness systems that rely on basic head movement, as the attacker can physically move their head while wearing the mask.
• Deepfakes and Live Swaps: The rise of generative AI has made real-time video deepfakes a significant threat. These are not pre-recorded videos but live, manipulated streams where the attacker's face is replaced with a synthetic one.
• Digital Injection Attacks: The most advanced threats are digital injection attacks. In this scenario, the fraudster bypasses the physical camera altogether. They inject a pre-recorded video or synthetic media stream directly into the data pipeline, making it appear to the verification system as a legitimate, live camera feed. This can be done using virtual camera software or by compromising the software development kit (SDK) at the application level.

Industry Applications

Financial services and banking

For banks and fintechs, these attack vectors are used to circumvent KYC/AML processes for account opening fraud. An attacker might use a deepfake to impersonate a legitimate customer to authorize a high-value transaction or take over an account. The presentation attack vectors liveness solution requirements for this sector must prioritize defense against injection attacks, which are becoming the tool of choice for organized fraud rings.

Identity verification (idv) providers

IDV vendors are on the front lines, integrating liveness detection into their broader verification flows. Their reputation and the trust of their clients depend on the robustness of their anti-spoofing capabilities. A failure to detect a new attack vector can have cascading consequences for all downstream clients.

Enterprise Security

Enterprises using facial biometrics for access control or employee authentication must defend against both physical and digital attacks. An attacker could use a video replay to gain access to a corporate system or a physical office, making robust PAD a cornerstone of zero-trust security architecture.

Current research and evidence

The biometric security field is in a constant state of evolution to counter these threats. Research from institutions like the University of Oulu in Finland has been pivotal in developing texture-based and frequency-based analyses to differentiate real skin from masks and prints. Studies by Dr. Kevin W. Bowyer at the University of Notre Dame (2019) have highlighted the vulnerabilities in early liveness systems that relied on simple, predictable challenges.

The ISO/IEC 30107-3 standard provides a framework for testing Presentation Attack Detection (PAD) systems. Systems are evaluated on their ability to reject attack presentations (Attack Presentation Accept Rate or APAR) while correctly accepting real users (Bona Fide Presentation Accept Rate or BPAR). However, as noted by researchers at iBeta (2023), a NIST-accredited testing lab, the real challenge is that the threat landscape evolves faster than standards can be updated. The rise of injection attacks, for example, requires new testing methodologies that go beyond presenting physical artifacts to a camera.

The future of presentation attack detection

The future of PAD lies in moving beyond surface-level indicators. The next generation of liveness solutions focuses on detecting intrinsic, involuntary physiological signals that are impossible to fake. By analyzing subtle, light-based signals from a standard video feed, these systems can confirm the presence of authentic human tissue and vital signs, like blood flow. This approach is inherently resilient to all seven attack vectors listed above. A photo has no blood flow. A mask does not have the unique pulsatile signal of a human heart. A deepfake video, even one injected into the data stream, is built from pixels that do not contain the subtle, information-rich patterns of reflected light from living tissue.

Frequently asked questions

What is the difference between a presentation attack and an injection attack? A presentation attack involves presenting a fake artifact (like a photo, mask, or video replay) to a physical camera sensor. An injection attack is purely digital; it bypasses the camera entirely and feeds fraudulent data directly into the software or application pipeline.

Why do active liveness solutions (e.g., "blink now") fail? Active or "challenge-response" liveness tests are highly predictable. An attacker can easily record a real user performing the challenge and simply replay the video to pass the test. They also add friction, leading to lower user conversion rates.

What is ISO/IEC 30107-3? It is the international standard for testing and reporting on the performance of Presentation Attack Detection (PAD) mechanisms. It provides a framework for third-party labs like iBeta to certify the effectiveness of liveness solutions against specific, defined attack types.

The industrialization of fraud requires an industrial-grade defense. As attackers shift from physical spoofs to sophisticated digital injection, liveness solutions must evolve. Circadify is at the forefront of this space, developing next-generation anti-spoofing technology based on physiological signals to stop the full spectrum of presentation attacks. To learn more about securing your identity verification process, request an enterprise security demo at circadify.com/solutions/fraud-detection.