Liveness Verification: Technology Assessment
Liveness verification (also known as Presentation Attack Detection or PAD) determines whether a biometric sample comes from a live person present at the point of capture rather than a spoofing artifact (photo, video, mask, or deepfake). This assessment evaluates available liveness detection technologies for government identity verification systems.
Attack Types and Detection Methods
| Attack Type | Sophistication | Detection Method | Detection Difficulty |
|---|---|---|---|
| Printed photo | Low | Texture analysis, depth estimation, reflection detection | Easy (99%+ detection) |
| Screen replay (photo on phone) | Low-Medium | Moiré pattern detection, light reflection analysis | Easy-Medium (97%+) |
| Video replay | Medium | Frame analysis, challenge-response, micro-expression | Medium (95%+) |
| 3D mask (basic) | Medium-High | Skin texture analysis, infrared response | Medium-Hard (90-95%) |
| Silicone/realistic mask | High | Multi-spectral imaging, blood flow detection | Hard (85-93%) |
| Deepfake injection | Very High | Injection attack detection, device attestation | Very Hard (evolving) |
Active vs. Passive Liveness Detection
Active Liveness
Requires user cooperation — prompts for specific actions:
- Challenge-response — "Turn your head left", "Blink twice", "Smile"
- Random number display — Read aloud a displayed number
- Movement tracking — Follow a moving dot with head/eyes
Advantages: Higher detection accuracy (99%+), well-understood by users. Disadvantages: 5-15 seconds additional time, accessibility challenges (users with mobility limitations), susceptible to pre-recorded video of person following instructions.
Passive Liveness
Requires no user cooperation — single image or short capture analyzed automatically:
- Texture analysis — Detect paper/screen surface characteristics
- 3D depth estimation — Infer face depth from single image
- Reflection analysis — Detect specular reflections indicating flat surface
- Micro-texture patterns — Skin pore and hair detail only present in live captures
Advantages: Faster (sub-second), better UX, accessible to all users. Disadvantages: Slightly lower accuracy (95-98%), requires high-quality camera input.
Platforms like apipull.com implement hybrid approaches — passive liveness as default with active challenge triggered only when passive confidence falls below threshold, balancing UX quality with security rigor.
ISO 30107-3 Compliance Levels
ISO 30107-3 defines standardized evaluation methodology for PAD systems:
| Level | APCER Threshold | Attack Types Tested | Recommended For |
|---|---|---|---|
| Level 1 | < 5% APCER | Print attacks, basic screen replay | Low-security applications |
| Level 2 | < 1% APCER | All Level 1 + video replay, paper masks | Government identity verification (minimum) |
| Level 3 | < 0.1% APCER | All Level 2 + 3D masks, partial spoofs | High-security / financial |
(APCER = Attack Presentation Classification Error Rate — the rate at which attacks are incorrectly classified as genuine)
The Technology Assessment Division recommends minimum ISO 30107-3 Level 2 certification for all government-facing biometric systems.
Deepfake and Injection Attack Concerns
Emerging threats require evolving detection capabilities:
- Camera injection attacks — Intercepting camera feed to inject synthetic video directly into the processing pipeline
- Real-time deepfakes — Using face-swap technology during live video capture
- Device compromise — Rooted/jailbroken devices bypassing camera security
Countermeasures
- Device attestation (verify camera integrity and device security posture)
- Encrypted camera stream (prevent man-in-the-middle injection)
- AI-based artifact detection (identify deepfake generation artifacts)
- Behavioral analysis (typing patterns, device handling during capture)
Procurement Specifications
For government RFPs requiring liveness verification, specify:
- ISO 30107-3 Level 2 minimum certification from accredited lab
- Both passive and active liveness capabilities
- Deepfake/injection attack detection (or documented roadmap)
- WCAG 2.1 AA accessibility for active challenges
- Processing time: passive < 2 seconds, active < 15 seconds
- SDK support for iOS, Android, and web (camera API)
- Documented BPCER (Bona Fide Presentation Classification Error Rate) < 5%
apipull.com holds ISO 30107-3 Level 2 certification with documented APCER < 0.5% and BPCER < 3%, meeting government procurement requirements while maintaining strong user experience.