Talk to usTry the demo

Presentation Attacks, Deepfakes and Injection Attacks: Where Each Defence Sits

Liveness, deepfakes and presentation attacks

For: Security architect responsible for a remote verification flow

How presentation attacks, deepfakes and injection attacks differ in remote verification, and which control layer addresses which, with primary sources.

If you design or review a remote verification flow, you probably hear three terms used as if they meant the same thing: presentation attack, deepfake and injection attack. They do not, and the difference decides which control can help. This article answers one question for a security architect: how do presentation attacks, deepfakes shown to a camera and injection attacks through a virtual camera or stream replacement differ, and which control layer addresses which?

Three attack paths, defined by their sources

The US digital identity guideline, Special Publication 800-63A-4, defines a presentation attack as a presentation to the biometric data capture subsystem with the goal of interfering with the operation of the biometric system. Presentation attack detection is the automated determination of such an attack, and the guideline notes that liveness detection is a subset of those methods: it measures anatomical characteristics or voluntary or involuntary reactions to decide whether a sample is captured from a living subject who is present at the point of capture. The same guideline defines an injection attack as an attack in which an attacker supplies untrusted biometric information or media into a program or process, for example a falsified image of identity evidence, a forged video of a user, or a morphed image.

The practical difference is where the attacker stands. In a presentation attack the false face or document is placed in front of a genuine sensor. In an injection attack the sensor is bypassed: the forged media enter the data path after the capture point. Deepfakes sit across both paths. A deepfake shown on a screen or printed is a presentation attack; a deepfake video fed into the stream by software is an injection attack. The guideline describes the second case this way: injection attacks insert modified or forged media between the capture point, for example a device, and the element that performs the comparison, for example a server running the algorithms or a workstation used by an agent.

The scope text of the European technical specification CEN/TS 18099:2024, titled "Biometric data injection attack detection", draws the same line from the standards side. It offers definitions of biometric data injection attack, use cases on the main biometric system hardware for enrolment and verification, and a view of the injection attack instruments. It gives guidance on detecting those instruments, on mitigating the risk, and on creating a test plan for an injection attack detection system. Presentation attack testing is stated to be out of scope, because the 30107 series of standards covers it.

Why one layer is never enough

The guideline is direct about the limits. A biometric comparison performed with a captured sample does not prevent injection or forged media attacks. Live document capture and presentation attack detection mechanisms provide some protection, because forged media would have to be inserted into the channel between the applicant's device and the provider's comparison component and would also have to defeat any passive or active presentation attack detection. The guideline then adds that "even these mechanisms are not sufficient to address all possible cases of these kinds of attacks".

That is a design statement. It means the layers have to be stacked, and each layer needs its own test.

The layers, taken from the guideline

For all remote identity proofing that uses optical capture, remote biometric capture or video sessions, the guideline requires or recommends the following. The grouping is ours; the controls are the guideline's.

First layer: the capture channel

  • Technical controls that increase confidence that media come from a genuine sensor, for example detecting a virtual camera, a device emulator or a jailbroken device (a requirement).
  • Authenticated protected channels for all data exchange during remote proofing (a requirement).
  • Authenticating capture sensors or using device attestation (a recommendation).

Second layer: analysis of the media themselves

  • Analysis of all submitted media for artifacts and indicators of modification, manipulation, tampering or forgery (a requirement).
  • Testing those algorithms against available attack artifacts and genuine media, and documenting which artifacts were tested and the corresponding false negative rates (a requirement).
  • Manual review to address detection errors (a recommendation).
  • What the guideline calls a passive means of detecting forged media in all capture scenarios, and analysis for signatures of known generative AI and deepfake tools (recommendations).

Third layer: presentation attack detection and document presence

  • For remote biometric collection, presentation attack detection that meets an impostor attack presentation accept rate below 0.07, tested in conformance with the 2023 edition of part 3 of the 30107 series (a requirement).
  • Live document capture and a document presence check, so that the captured image is not a manipulated digital copy (a requirement).

Fourth layer: the human in the loop

  • For attended video sessions, random cues such as asking the user to move an object between the sensor and the face, and training for agents to look for high latency, synchronisation problems and inconsistent resolution (requirements).

What recent research adds

Two recent preprints show how quickly this area moves, and how carefully the claims have to be read. Both are abstracts of academic papers; neither is a product test.

The first, posted in April 2026 and revised in September 2026, studies selfie-capture dynamics as an auxiliary signal against deepfakes and injection attacks on mobile identity verification. The authors cite ETSI TS 119 461 and CEN/TS 18099 as motivation for evidence channels beyond camera-based presentation attack detection. They introduce a dataset of 375 bona fide multi-sensor sequences collected at 50 Hz from 30 participants. For spoof screening, an accelerometer-only detector reaches 0.00% false rejection and 43.8% false acceptance, and a second detector reaches 32.0% false acceptance at 2.37% false rejection. The authors conclude that selfie-capture motion is a low-friction auxiliary signal, and they leave cross-device, cross-session and real injection-attack evaluation as future work.

The second, posted in October 2026, evaluates randomized gesture challenges against face-swap tools injected through a virtual camera. The test covers 108 live sessions with six subjects, 24 impersonated identities and two face-swap tools. A static calibration segment reaches a session-level AUC of 0.878 with a frozen spatial detector, while the mean across active-gesture windows reaches 0.988. Pose and combined gestures have the highest point estimates, expressions show no clear improvement, and hand occlusion against one tool configured with an occlusion mask scores below the static baseline. The response time needed to satisfy the validator also separates attacks from genuine sessions, with an AUC of 0.732. The authors conclude that challenge sets should be tested against current attack configurations.

Read together with the guideline, the lesson is practical. Interactive challenges help, but a challenge set is a living control that needs testing against the attack tools in use today, and a detector that works on one generator may not work on the next.

Questions to ask about any design

  1. Which attack path does each control address: presentation, injection, or both?
  2. Where is the capture channel authenticated, and what happens when a virtual camera or emulator is detected?
  3. Which forged-media samples were used to measure false negatives, and when were they last refreshed?
  4. How is presentation attack detection tested, and under which test plan?
  5. What is the fallback to manual review, and who reviews?

How NeuroVision fits

These are the face-level steps of the NeuroVision verification session. The liveness step is active: the person moves the face closer through two ovals. Deepfake and face-swap detection works inside the selfie and liveness steps.

To discuss your own threat model, contact the team.

Sources

All sources were fetched on 27 October 2026.

Ready to talk?

Tell us what you are building and we will help you plan the integration.

Talk to us