What Presentation Attack Detection Testing Measures

A liveness vendor tells you that its product passed an independent presentation attack detection test, and sends a letter. What did the laboratory actually measure, what do the error rates and levels in the letter mean, and what does the test leave out? This article is written for a security architect or a procurement reviewer who has to read such a letter and decide how much weight it carries.

The standard behind the test

Presentation attack detection testing follows part 3 of the 30107 series of standards from the International Organization for Standardization and the International Electrotechnical Commission, in alignment with the framework in part 1 of the same series. The test laboratory whose public explanation is used here describes its method and the meaning of its confirmation letters on a public page. In the text below the laboratory is simply called the laboratory.

The US digital identity guideline, Special Publication 800-63A-4, makes the standard concrete for a regulated use case. For remote biometric collection it requires presentation attack detection that meets an impostor attack presentation accept rate below 0.07, and it requires all presentation attack detection tests to conform to the 2023 edition of part 3 of the 30107 series. It also requires providers to have their attack detection algorithms periodically tested by independent entities, such as laboratories or research institutions, including performance across demographic groups.

Step one: decide what is being tested

According to the laboratory, the first decision is the type of mechanism under test.

A subsystem test evaluates presentation attack detection only.
A data capture test evaluates the coupled presentation attack and quality checks.
A full system test evaluates the biometric comparison capabilities of the whole biometric subsystem.

The type decides which metrics the standard requires. For subsystem evaluations, the classification error rates are determined: the attack presentation classification error rate (APCER), the bona fide presentation classification error rate (BPCER) and the associated non-response rates. For full systems, the impostor attack presentation match rate and the associated false non-match and false match rates are determined.

In plain words, APCER answers "how often does an attack get through?" and BPCER answers "how often is a real person wrongly rejected as an attack?". A product can look excellent on one number and poor on the other, so a letter that states only one of them is incomplete. The laboratory says bona fide presentations also indicate how usable the product is for the people who use it.

Step two: choose a level

The laboratory defines levels of testing, and notes that they resemble but differ from the levels of another alliance's scheme.

Level 1 allows 8 hours per subject or species of attack, needs no expertise, uses artefacts from a cooperative subject and equipment readily available in a normal home or office, and allows 0% penetration or match rate.
Level 2 allows 2 to 4 days per subject or species, assumes moderate expertise, uses more expensive equipment such as a 3D printer or resin or latex masks, and allows 1% penetration or match rate.
Level 3 allows 7 days per species and 4 days per subject, assumes significant expertise, uses extensive equipment such as hyper-realistic facial masks in specialised environments, and allows 5% penetration or match rate.

Two procedural details explain the numbers. The laboratory sets a material cost limit, so that artefacts at Level 1 cannot exceed $30 and artefacts at Level 2 are limited to $300, which keeps the cost of creating attacks roughly consistent across products. And the six species of attack, called PAIS in the standard, are selected as uniformly as possible. For a Level 1 liveness-only assessment, the laboratory targets 150 attacks alternated with 50 genuine presentations.

If the product uses an active liveness detector to elicit a voluntary response from the user, the attack species are tailored the way an impostor would tailor them, to provide the movement, smile or blink the product asks for.

The usability cap

Because a test that rejects real people proves little, the laboratory limits the bona fide error rate to obtain a pass. The cap on BPCER and on the false non-match rate is 15%; it was first unconstrained, then set at 20%, then reduced to 15% for Levels 1 and 2. To qualify for Level 3 the product has to achieve 10% or less, and the laboratory reviews this limit every 6 months and may reduce it as the technology improves. If a genuine data subject cannot be recognised as live or matched to the enrolment reference, the laboratory suspends testing, because a high rate biases the result.

Step three: read the letter

The laboratory posts confirmation letters only with the written consent of the vendor. Each letter specifies the type of testing and the configuration of the vendor product that was tested, and the page lists, for each letter, the date, the vendor, the level, the product tested, the versions tested, the applicable BPCER or false non-match limit and a link to the PDF. Before the test, the laboratory records the configuration of the vendor solution and the exact device configuration, because the capture device affects the results, and both are referenced in the letter.

The laboratory is explicit about what a result is. Its testing shows whether the solution conforms with the testing and reporting requirements of the standard, and the laboratory adds that this, by itself, is not the same as a formal approval of the vendor's product. The laboratory also explains that it corrected its earlier terminology in March 2019, and that the methods stayed the same apart from a stricter limit for genuine presentations.

So a letter should be read as a dated statement about one named version, on one named device configuration, at one level, against the attacks of that level. A checklist follows from that.

Which type of test was run: subsystem, data capture or full system?
Which level, and which BPCER or false non-match limit applied?
Which product version was tested, and does it match the version you will deploy?
Which device configuration was used, and does it resemble your users' devices?
Does the letter report both error rates?
Is the date recent enough to cover the attack tools in circulation today?

What the test leaves out

Three limits come from the sources rather than from opinion.

First, the test concerns attacks presented to the sensor. The European technical specification CEN/TS 18099:2024, "Biometric data injection attack detection", states that presentation attack testing is covered by the 30107 series and is out of scope for the specification, which concerns injection attack detection. Its scope also states that no presentation attack testing is performed by the laboratory to be compliant with it. A presentation attack detection letter therefore says nothing about the injection of forged media into the data path.

Second, the US guideline warns that presentation attack detection mechanisms do not address all cases of injection and forged media attacks. See the companion article on presentation attacks, deepfakes and injection attacks.

Third, the laboratory states that it uses cooperative subjects, because artefacts made from willing volunteers are of better quality, which makes the test more conservative, and that it evaluates the vendor solution and not the ability of its testers to obtain latent prints. The test is a fixed protocol, and the protocol is the boundary of the claim.

How NeuroVision fits

NeuroVision's liveness step is active: the person moves the face closer through two ovals. NeuroVision is iBeta ready. This is a statement by the company, not a laboratory result or a certificate.

For a walkthrough of the liveness step in your own scenario, contact the team.

Sources

All sources were fetched on 27 October 2026.

Presentation attack detection test methodology and confirmation letters, explanation page of the testing laboratory.
Digital Identity Guidelines, Special Publication 800-63A-4, Identity Proofing and Enrollment, US National Institute of Standards and Technology.
CEN/TS 18099:2024, Biometric data injection attack detection, scope and general information, standards store of the Estonian standardisation body (evs.ee).