Identity verification under AI attack: what RIVR Track 2 showed

At a glance

What this is: Incode’s analysis of DHS S&T’s RIVR Track 2 says modern identity verification is being tested against deepfakes, fraudulent documents, and injection attacks rather than legacy spoofing patterns.

Why it matters: For IDV, IAM, and fraud teams, the signal is that assurance now depends on resisting synthetic media and capture-layer bypass methods, not just matching document images or faces.

Context

Identity verification is shifting from document checking to adversarial testing of the full capture and decision chain. The article frames that shift through DHS S&T’s RIVR Track 2, which evaluates whether commercial IDV systems can withstand synthetic faces, tampered documents, and direct stream injection. For identity programmes, the question is no longer whether a system can compare images, but whether it can survive deliberate attempts to defeat the capture process itself.

That matters because fraud pressure now reaches the boundary between human identity proofing and machine-mediated intake. When attackers can use generative AI, replay media, and injection tooling, traditional checks become less about assurance and more about whether the control can resist active subversion. The article’s subject is a regulated IDV test, but the implications extend to any programme that relies on remote onboarding or high-stakes verification.

Key questions

Q: Why do deepfake and injection attacks create such a high risk for identity verification programmes?

A: They create risk because they attack different points in the identity flow and defeat single control assumptions. Presentation attacks target what the sensor sees, while injection attacks feed fake media directly into the processing stream. That means a system can appear to be performing well while still accepting manipulated input. Independent testing and layered controls are necessary to reduce that blind spot.

Q: Why do synthetic media and capture bypass methods create more risk for IDV?

A: They reduce the cost of presenting convincing evidence while increasing the attacker’s ability to automate attempts at scale. That shifts fraud from manual deception to repeatable technical abuse of the onboarding path. When the verification workflow assumes honest capture, synthetic media turns that assumption into a liability.

Q: What are the signs that identity verification is failing as a control?

A: Common signs include onboarding exceptions, repeated manual overrides, inconsistent document checks, service desk approvals without revalidation, and fraud cases discovered after access has already been granted. When downstream teams keep finding bad identities, the verification gate is not doing its job.

Q: How should businesses detect deepfake fraud in remote onboarding and authentication flows?

A: Businesses should combine liveness checks, AI-based anomaly detection, and step-up verification for high-risk actions. Deepfakes are designed to defeat human judgment, so controls must look for manipulated image artifacts, duplicate identities, and suspicious behavioral patterns. The most effective approach is layered: verify identity, validate session risk, and require stronger checks when confidence drops or the transaction is unusually sensitive.

Technical breakdown

Why synthetic media changes IDV assurance

Deepfake-driven identity fraud changes the problem from matching a face or document to testing whether the capture workflow can distinguish live presentation from generated or replayed content. Liveness detection, document validation, and capture-integrity controls each address a different attack surface. If any one of those checks assumes the attacker must present physically and honestly, generative tooling breaks that assumption. The practical challenge is that IDV assurance now depends on resisting adaptive deception, not just evaluating static artefacts.

Practical implication: treat remote onboarding as an adversarial control problem, not a simple verification flow.

Injection attacks and capture-stream bypass

Injection attacks do not try to fool the camera in the traditional sense. They attempt to insert fraudulent imagery or media directly into the capture stream, bypassing the device, sensor, or user interaction layer entirely. That means the control boundary has moved upstream from model scoring to session integrity, source validation, and capture-path hardening. Once the stream itself can be substituted, even strong liveness logic can be reduced to checking the wrong input.

Practical implication: validate the capture path, not only the content that reaches the verifier.

Controlled government evaluations as assurance signals

A controlled evaluation such as RIVR matters because it measures performance against known threat classes with defined targets, rather than relying on marketing claims or lab-only demonstrations. For identity teams, that kind of testing is useful only if it maps to their own threat model, risk tolerance, and regulated use case. The point is not to chase benchmark status. The point is to understand which attack patterns were actually resisted and where residual risk remains.

Practical implication: use independent testing to inform acceptance criteria, then test your own onboarding path against the same threat classes.

Threat narrative

Attacker objective: The attacker wants a false identity to pass verification and gain trusted access to a service or programme that assumes the applicant is genuine.

1. Entry occurs through a remote identity verification flow that the attacker can reach without physical presence, using synthetic media or tampered documents to begin the attempt.
2. Credential or evidence abuse follows when the attacker supplies deepfake faces, fraudulent documents, or injected capture content to bypass liveness and verification controls.
3. Impact is the acceptance of a false identity into a regulated or high-trust service, creating downstream fraud, account abuse, or access to sensitive workflows.

Breaches seen in the wild

• iOS apps leaking hard-coded secrets: Cybernews found 71% of 156,080 iOS apps leak hard-coded secrets, with open cloud storage and Firebase databases exposing user data.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Remote IDV now has a capture-integrity problem, not just a matching problem. The article shows why conventional document and face checks are no longer sufficient when attackers can generate believable inputs or insert them into the stream. The meaningful control question is whether the verification path can prove the signal came from a real, live, untampered capture session. Practitioners should treat that as a governance requirement, not a model tuning issue.

Deepfake resistance is becoming a boundary control for digital identity programmes. The more remote onboarding depends on AI-assisted evidence, the more identity assurance depends on resisting synthetic input at the point of capture. That is a direct identity verification governance issue, because fraud prevention and proofing now overlap at the same control boundary. Teams need explicit assurance criteria for presentation attacks, replay, and injection bypass. The programme should be measured against current attack conditions, not legacy spoofing assumptions.

RIVR-style testing creates a more realistic trust baseline for regulated identity use cases. Government-defined evaluation targets matter because they replace vendor self-attestation with adversarial testing against known threat classes. That does not eliminate residual risk, but it does clarify whether a control can withstand contemporary fraud tooling. For identity teams, the practitioner conclusion is simple: if a verification workflow cannot survive synthetic media and stream injection, it should not be treated as a high-assurance control.

What this signals

Capture-integrity is the new IDV control boundary. Once fraud can enter through synthetic faces, replay media, or injected streams, the control that matters most is no longer simple matching but proof that the verification session itself was genuine. Teams should review whether their onboarding path validates source integrity before any scoring or decisioning occurs.

The practical implication for programmes is that assurance criteria need to move closer to the threat model. A workflow that looks strong in a normal test can still fail under adversarial conditions, so acceptance should be based on live attack classes, not just expected user behaviour.

For practitioners

• Test against synthetic media and replay Build evaluation cases for 2D spoofs, 3D artifacts, video replays, and tampered documents so your acceptance criteria reflect current fraud tooling rather than historical spoof patterns.
• Harden the capture path Review whether your IDV workflow can detect injected imagery or substituted streams before model scoring begins, then require controls that validate source integrity as part of the session.
• Define assurance thresholds for regulated onboarding Set explicit pass-fail criteria for liveness, document verification, and injection resistance so procurement and risk teams can compare platforms against the same threat model.
• Re-test after fraud tooling shifts Re-run adversarial verification tests when deepfake quality, replay techniques, or injection methods change, because a control that passed last year may not hold against current attack conditions.

Key takeaways

• Identity verification now has to withstand active adversarial input, not just compare documents and faces.
• The article’s core evidence is that deepfake presentation attacks, fraudulent documents, and injection methods are all in scope for modern IDV assurance.
• Programmes should test capture integrity, liveness, and document verification together, because a weakness in any one of them can undermine the whole verification flow.

Key terms

• Liveness Detection: Liveness detection is the mechanism that checks whether a biometric sample comes from a real, present person rather than a spoof such as a photo, screen, or mask. In identity programmes, it is a core defence against presentation attacks and should be tested under realistic operating conditions.
• Injection attack: An attack that inserts synthetic or manipulated data directly into the verification flow rather than fooling the sensor itself. For identity programmes, this is a control-path problem, because the attacker may bypass the visible presentation layer and exploit the software decision point.
• Document Verification: Document verification is the process of checking whether an identity document is genuine, valid, and appropriate for the claimed user. In digital onboarding, it often combines template analysis, authenticity checks, and data extraction to support a trust decision before account creation.
• Capture Integrity: Capture integrity is the trustworthiness of the device, camera, and input pipeline used during identity verification. If the capture path is controlled by an attacker through emulation or injected streams, even accurate biometric analysis can be built on poisoned inputs.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and identity lifecycle fundamentals. It helps security and identity practitioners connect control design to the broader access governance issues their programmes face.