Deepfake injection attacks are testing liveness controls in 2025

At a glance

What this is: Yoti’s analysis says deepfake injection attacks are rising against liveness checks, with AI-generated spoofing now a material test of presentation attack detection.

Why it matters: IAM and identity teams need to treat liveness as a security control under active adversarial pressure, not a one-time verification step, because higher assurance can still fail if synthetic input reaches the verification stream.

By the numbers:

• Yoti detected a total of 3.2 million injection attacks in 2025.
• The vast majority, 97%, of MyFace liveness transactions are completed on mobile phones.

Context

Liveness detection, also known as presentation attack detection, is the check that a real person is physically present in front of the camera in real time. In identity verification and age assurance, that control matters because a system that accepts a photo, replay, or synthetic face is no longer verifying presence, only image input.

The governance problem is that stronger assurance and usable completion are often treated as opposing goals, when they are both required for credible identity programmes. As AI-generated spoofing improves, organisations have to decide whether their liveness controls are only measuring convenience or actually resisting active attack traffic.

Yoti’s article frames this as a 2025 control pressure test for digital verification, not just a product capability discussion. The article’s central claim is that liveness checks now sit on the front line of fraud resistance, fairness, and completion quality at the same time.

Key questions

Q: What breaks when liveness checks rely on the camera feed alone?

A: They break when the attacker can intercept or replace the feed before the verification logic sees it. A convincing video can satisfy motion or face-detection tests while still being synthetic. Liveness needs independent feed-integrity and device-trust signals to stay reliable.

Q: Why are AI deepfakes a problem for identity verification?

A: AI deepfakes weaken verification because they make voice and video far less reliable as identity signals. If a helpdesk or operations team depends on a believable conversation, an attacker can impersonate authority without breaking technical controls. The answer is to shift verification toward independent proof, not human confidence.

Q: How can security teams tell false rejects from real attack attempts in liveness checks?

A: Teams should separate operational failure reasons, such as low light, small images, and connectivity problems, from indicators that suggest spoofing, such as multiple faces or a missing face in the image. That distinction matters because the first group points to usability and capture tuning, while the second points to fraud control effectiveness.

Q: What should organisations do when liveness success improves but fraud pressure is also rising?

A: They should review both completion and rejection data together, then test the control on the same mobile conditions their users actually face. Higher success rates are only meaningful if the system is still resisting injection attacks, because completion without resistance can hide a weaker trust boundary.

Technical breakdown

How presentation attack detection blocks synthetic input

Presentation Attack Detection, or PAD, is designed to decide whether the camera feed comes from a live human present at capture time. The control looks for signals that do not survive simple replay attacks, such as printed photos, screen replays, or images injected into the stream. In this article’s context, the weakness is not authentication after capture, but input integrity before the identity decision is made. If the verification pipeline accepts synthetic imagery, downstream checks can be perfectly implemented and still authenticate the wrong subject.

Practical implication: validate that the capture layer rejects synthetic or replayed input before identity decisions are made.

Why mobile capture quality changes liveness outcomes

Liveness success is partly a capture-quality problem, not only an adversarial problem. Low light, small images, camera limitations, and unstable connectivity can all reduce confidence in the result, which means the same control must distinguish between poor user conditions and presentation attack indicators. Yoti’s article links this to mobile-heavy usage, with most transactions happening on phones. That matters because mobile-device variance broadens the operational conditions under which the control must stay accurate, especially when attackers exploit weaker capture paths rather than the liveness model itself.

Practical implication: tune mobile capture thresholds so low-quality input is rejected without turning ordinary device variability into false failure.

What deepfake injection changes in verification architecture

Injection attacks are different from ordinary spoofing because synthetic or pre-recorded imagery is fed directly into the verification stream, bypassing the expected live camera path. That means the trust boundary is the capture channel, not just the model that scores the face. When generative AI lowers the cost of convincing fake imagery, the attack becomes scalable and easier to share across forums and user communities. The architectural lesson is that verification systems need to defend the full chain from capture to analysis, because a strong model cannot compensate for a compromised input path.

Practical implication: secure the capture channel itself and monitor for bypass paths, not just model accuracy.

Threat narrative

Attacker objective: The attacker aims to pass remote identity or age verification without a live human subject, enabling fraud, false enrolment, or access to restricted services.

1. Entry occurs when an attacker obtains synthetic or pre-recorded imagery that can be submitted into the identity verification stream.
2. The attacker feeds that content directly into the verification process, bypassing the expectation of a live camera feed.
3. If the liveness control fails, the attacker reaches account creation or age and identity verification outcomes without a real person present.

Breaches seen in the wild

• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Liveness is no longer a peripheral fraud check. It has become a primary trust boundary for age assurance, identity verification, and authentication flows that rely on remote capture. Once AI-generated imagery can enter the verification stream, the quality of the identity decision depends on the control that proves presence, not just on the match score. Practitioners should treat PAD as a core identity control, not a UX feature.

Adaptive attack pressure exposes the limits of static verification assumptions. The article shows that fraud rates and attack patterns move with regulatory rollout, device conditions, and the availability of generative tooling. That means liveness governance cannot be based on a fixed failure model, because the attacker’s economics change faster than policy cycles. The practitioner lesson is that verification assurance needs continuous reassessment against current spoofing methods.

Input integrity is the real control problem here. The security question is not whether a face model can recognise a person, but whether the system can prove the image came from a live capture path. That is why injection attacks matter more than simple image quality failures. Teams should frame liveness as protection of the verification boundary, not as a scoring problem inside the model.

Fairness and fraud resistance have to be managed together. The article links mobile performance, regional variation, and completion rates to the broader trust problem. If a control is too strict, genuine users fail; if it is too permissive, attackers pass. Practitioners need governance that watches both rejection reasons and completion outcomes so that security tuning does not quietly degrade access for legitimate users.

What this signals

Liveness controls now sit inside the same governance conversation as fraud, identity assurance, and user experience. When verification is deployed at scale, the control has to work across mobile variability, AI-generated spoofing, and genuine-user friction at the same time.

Verification boundary hardening: The next programme question is no longer whether a face model is accurate in isolation, but whether the full capture path can be trusted under attack. That shift makes PAD governance a boundary problem, not a model-performance problem.

Teams should expect attackers to keep adapting to the weakest capture path, the easiest device conditions, and the least defended step in the identity flow. That means the right operating model is continuous tuning, adversarial testing, and rejection-review discipline, not one-time rollout confidence.

For practitioners

• Audit the capture boundary for bypass paths Map where synthetic or pre-recorded imagery can enter the verification flow, then confirm that only live camera capture reaches the liveness decision point.
• Separate user-quality failures from attack indicators Track rejection reasons such as poor lighting, missing faces, multiple faces, and low-quality images so tuning changes do not blur usability issues with attack detection.
• Test liveness on mobile under realistic conditions Run validation on the device types, camera quality bands, and connectivity conditions your users actually have, rather than only on ideal test hardware.
• Review completion rates alongside rejection rates Use both metrics together to see whether stronger fraud controls are increasing false rejects or reducing successful genuine-user completion.

Key takeaways

• Deepfake injection attacks turn liveness detection into a frontline control for identity and age verification rather than a narrow anti-fraud feature.
• The article shows that mobile use, capture quality, and AI-generated spoofing all influence whether a liveness check protects the verification boundary.
• Practitioners need to measure both fraud resistance and genuine-user completion so stronger controls do not silently degrade legitimate access.

Key terms

• Liveness Detection: Liveness detection is the mechanism that checks whether a biometric sample comes from a real, present person rather than a spoof such as a photo, screen, or mask. In identity programmes, it is a core defence against presentation attacks and should be tested under realistic operating conditions.
• Presentation Attack: A presentation attack is an attempt to fool a biometric system with a fake face, replayed video, mask, or other synthetic artefact. In practice, the control fails when it measures resemblance alone, because the attacker’s objective is to pass as the real user without actually being that person.
• Injection attack: An attack that inserts synthetic or manipulated data directly into the verification flow rather than fooling the sensor itself. For identity programmes, this is a control-path problem, because the attacker may bypass the visible presentation layer and exploit the software decision point.
• False Reject: A legitimate user being incorrectly blocked by a verification or liveness control. False rejects matter because they can signal overly strict thresholds, poor device conditions, or accessibility problems. For identity teams, the goal is to reduce unnecessary friction without weakening resistance to spoofing and fraud.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.