Presentation attacks require liveness-detection defenses

What it is

Presentation attack detection (PAD), often called liveness detection, distinguishes a bona fide presentation of the target body characteristic from an attack instrument such as a photograph, display replay, mask, or artificial fingerprint. Ordinary matching asks whether a sample resembles the template; a copy may resemble it enough, so a low false-match rate does not establish active-spoof resistance.

Why it happens

Attackers exploit the gap between what a sensor observes and a living body. PAD can inspect texture, depth, reflection, heat, movement, or response to a random challenge, but every cue depends on hardware and known attacks. Predictable actions such as a fixed blink can be replayed, while demanding challenges raise accessibility cost and false rejection. Software injection can bypass the presentation layer entirely and requires endpoint-integrity controls.

Studying it

Build an attack-instrument inventory from the modality, deployment, and feasible attacker capabilities. In an authorized lab, test materials, display devices, illumination, angle, and known and novel attack types. Report attack-presentation acceptance, bona fide PAD rejection, capture failure, and completion time separately and by device and population. Training-set spoof accuracy does not replace independent evaluation, and zero-effort impostors do not represent presentation attacks.

Where it stops holding

PAD mitigates specified presentation attacks; it does not prove the claimed identity or cover template compromise, post-sensor injection, a malicious endpoint, or coercion of the genuine person. Lower-risk local uses may select other control combinations, but high-impact uses need an explicit active-attack model. Liveness signals can themselves be sensitive and must not become unlimited inputs for emotion or health inference.

Applying it

• Maintain a realistic attack taxonomy and coverage evidence per sensor instead of one “liveness enabled” flag.
• Layer passive cues, randomized challenge when needed, authenticated sensors, and injection detection, with bounded retries.
• Offer a non-punitive alternative for people who cannot perform the action or are falsely rejected, and monitor stratified completion impact.
• Re-evaluate independently after model, camera, or attack-material changes; retain versioned decision evidence for response while minimizing raw samples.

Related

• Same group: O3.03.1 Probabilistic matching · O3.03.4 Threshold tradeoff · O3.03.6 Biometric compromise
• Adjacent: O3.04 Phishing-recognition cues · O3.06 Trusted path
• Search terms: presentation attack detection · biometric liveness · injection attack