Deepfake injection attacks are testing liveness controls in 2025

At a glance

What this is: This is an analysis of how liveness detection and presentation attack detection are being stressed by deepfake injection attacks in identity verification.

Why it matters: It matters because IAM teams, fraud leads, and identity architects need controls that resist synthetic media while still keeping real-user verification usable and fair.

By the numbers:

• Yoti detected a total of 3.2 million injection attacks in 2025.
• The vast majority 97% of MyFace liveness transactions are completed on mobile phones.

👉 Read Yoti's analysis of deepfake injection attacks and liveness detection

Context

Liveness detection, also known as presentation attack detection, is a verification control that checks whether a real person is physically present at the camera in real time. In identity programmes, it sits between simple image capture and trust decisions, and it becomes critical whenever digital verification is used for age assurance, identity verification, digital IDs, or authentication.

The problem is that attack inputs have changed faster than many verification journeys. Printed photos and screen replays are now joined by AI-generated clones and injection attacks that can feed synthetic imagery directly into the verification stream, which means the control question is no longer whether a face exists, but whether the signal came from a live subject or a fabricated one.

Yoti's data shows both sides of the tension: stronger fraud resistance and high genuine-user completion can coexist, but only when the liveness layer is tuned for modern spoofing methods and supported by quality capture, accessibility, and fairness considerations.

Key questions

Q: How should security teams defend biometric verification against deepfake attacks?

A: Security teams should defend the entire biometric capture path, not just the matching algorithm. That means checking client integrity, validating the camera or browser source, layering liveness signals, and escalating suspicious attempts into fraud review or step-up authentication. If the capture channel is untrusted, biometric assurance is already weakened.

Q: Why do liveness checks fail even when a biometric model is accurate?

A: Liveness checks can fail when the input path is weak, because an accurate model cannot recover from a compromised or low-quality capture. Poor lighting, weak cameras, replayed media, and injected frames all reduce the reliability of the decision. The model may be sound, but the evidence reaching it is not.

Q: How should security teams reduce false declines without weakening fraud controls?

A: Start by separating hard fraud stops from soft operational failures, then improve the context used in payment decisions. The goal is not to loosen controls everywhere, but to raise decision quality by combining customer history, device signals, order details, and retry logic so legitimate activity is less likely to be treated as suspicious.

Q: What does presentation attack detection add that face matching does not?

A: Presentation attack detection checks whether the subject is genuinely present at the time of capture, while face matching checks whether two faces are similar enough to belong to the same person. Both are useful, but they solve different problems. If PAD is weak, a convincing fake can reach the matcher and undermine the whole verification flow.

Technical breakdown

How presentation attack detection works in identity verification

Presentation attack detection, or PAD, is the control layer that tries to distinguish a live human from a presented artefact such as a printed photo, replayed video, or synthetic face stream. It evaluates cues such as motion, facial texture, camera input quality, timing, and the consistency of the capture session. In practice, the control is only as strong as the input path. If the pipeline accepts injected media before capture or permits low-quality frames to pass, the model may be asked to judge an already-compromised signal. That is why client-side capture, image quality thresholds, and immediate deletion of the analysed frame all matter.

Practical implication: Treat PAD as an input-integrity control, not just a model score, and harden the capture path before the verification engine sees the image.

Deepfake injection attacks and synthetic media abuse

An injection attack bypasses the live camera feed by feeding synthetic or pre-recorded imagery directly into the verification stream. That changes the threat from spoofing a face to spoofing the whole sensor path. Deepfakes raise the quality of the false input, while injection tooling changes how the false input arrives. For identity teams, the distinction matters because a strong biometric model alone does not stop a compromised stream. The attack succeeds when the control assumes that the source is the camera, not an overlay or substituted feed. That assumption is increasingly fragile in mobile-first identity journeys.

Practical implication: Validate the capture channel itself and add anti-injection controls at the device and application layer, not only inside the liveness model.

Bias, completion rates, and fairness in liveness controls

Liveness controls do not operate in a vacuum. Image quality, camera capability, lighting, device age, and connectivity all affect whether a legitimate user completes the check, and those factors can differ by geography and demographic context. Fairness work therefore has to track not only detection performance but also failure modes and drop-off rates across user groups. The article notes that weaker performance in parts of East and West Africa likely reflects camera quality and connectivity constraints as well as the historical imbalance in training data. That is a reminder that security controls can create access friction if they are not tested against real-world conditions.

Practical implication: Measure completion and rejection patterns by region and device class so security tuning does not quietly become user exclusion.

NHI Mgmt Group analysis

Deepfake resistance is now an identity assurance requirement, not a fraud add-on. Once synthetic media can convincingly imitate a face, the trust problem moves from content quality to source authenticity. Liveness detection becomes the control that separates a real presenting subject from a generated surrogate, which makes it part of core IAM assurance rather than a niche fraud layer. Practitioners should treat this as a shift in verification design, not a tuning exercise.

Presentation attack detection only works when the capture path is trusted. The article makes clear that image quality thresholds and client-side capture shape the security outcome as much as the model itself. If injected media can enter the verification stream before analysis, the liveness decision is already weakened. The practical conclusion is that the input path, not just the classifier, defines the control boundary.

Fairness and security are converging operational requirements in digital identity. The article shows that performance remains high overall while some regional differences persist, likely because device quality, connectivity, and training data balance are uneven. That is not a side issue. It means identity teams have to govern liveness as both a security control and an access control with measurable user impact.

Identity programmes need a distinct concept of capture integrity. The useful named concept here is capture integrity, meaning the assurance that a verification sample originated from a live, local, and untampered camera session. Without capture integrity, even strong liveness models can be evaluated against synthetic inputs that should never have entered the decision path. Practitioners should recognise capture integrity as a prerequisite for trustworthy verification outcomes.

From our research:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to Ultimate Guide to NHIs.
• Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
• For lifecycle control detail, see NHI Lifecycle Management Guide for provisioning, rotation, and offboarding patterns.

What this signals

With 79% of organisations already reporting secrets leaks in our research, verification teams should assume that identity trust is being attacked from both the human and machine sides of the stack. The practical signal is that any system relying on digital proof now needs stronger capture integrity, better telemetry, and faster rollback of trust decisions.

Capture integrity: this is the control concept that will matter more as synthetic media becomes easier to generate and inject. Teams that already measure only match quality or approval rates will miss the operational failure mode, which is whether the image ever came from a live camera session at all.

For practitioners

• Harden the capture path before verification scoring Use client-side capture controls, quality thresholds, and session checks so only images meeting minimum standards reach the liveness model. This reduces the chance that replayed or injected media is analysed as if it were live camera input.
• Measure rejection and completion rates by device and region Track how often genuine users fail liveness checks across device classes, camera quality tiers, and geographies. The goal is to detect where user friction or false rejects are concentrated before they become programme-wide bias issues.
• Separate anti-injection controls from model accuracy discussions Review whether your verification stack can stop synthetic media before it reaches the liveness engine. If not, model accuracy alone is not a sufficient defence because the attack has already moved into the transport layer.
• Align liveness tuning with regulatory and fairness evidence Document how the control performs across user groups and keep the evidence ready for audits, especially where age assurance or identity verification is subject to regulatory scrutiny. This helps justify both acceptance thresholds and rejection handling.

Key takeaways

• Deepfake injection attacks shift identity verification from a face-matching problem to a capture-integrity problem.
• Yoti's 2025 figures show 3.2 million injection attacks and 97% mobile completion, which means fraud pressure and usability pressure are rising together.
• Practitioners should harden the input path, measure regional and device-level failure rates, and treat liveness as a core IAM assurance control.

Key terms

• Presentation Attack: A presentation attack is an attempt to fool a biometric system with a fake face, replayed video, mask, or other synthetic artefact. In practice, the control fails when it measures resemblance alone, because the attacker’s objective is to pass as the real user without actually being that person.
• Injection attack: An attack that inserts synthetic or manipulated data directly into the verification flow rather than fooling the sensor itself. For identity programmes, this is a control-path problem, because the attacker may bypass the visible presentation layer and exploit the software decision point.
• Capture Integrity: Capture integrity is the trustworthiness of the device, camera, and input pipeline used during identity verification. If the capture path is controlled by an attacker through emulation or injected streams, even accurate biometric analysis can be built on poisoned inputs.

What's in the full article

Yoti's full post covers the operational detail this post intentionally leaves for the source:

• The full rejection breakdown for mobile users, including the image-quality reasons that were not fully enumerated here.
• The regional success-rate table for MyFace liveness, including the NIST region groupings used to assess bias.
• The explanation of how client-side face capture reduces data sharing and removes specific rejection causes.
• The longer trend view on why attack peaks changed after the UK Online Safety Act rollout.

👉 Yoti's full post covers the rejection reasons, regional performance data, and attack trends behind the 2025 liveness findings.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.