Remote identity verification needs stronger liveness against spoofing

At a glance

What this is: This is a review of DHS S&T RIVR Track 3 results showing how presentation attack detection and liveness testing perform against modern biometric spoofing attempts.

Why it matters: It matters because identity verification teams need evidence that liveness controls can resist spoofing without creating unacceptable friction for legitimate users.

Context

Presentation attack detection is the control layer that tries to distinguish a real person from a fake presentation such as a printed image, replayed video, or synthetic mask. In remote identity verification, that control becomes part of the fraud boundary, not just a biometric quality check, because attackers increasingly combine visual spoofing with deepfake-assisted social engineering.

The governance problem is that many programmes treat liveness as a binary feature when it is really a measurement regime with different user experiences, attack assumptions, and error profiles. For identity teams, the key question is whether the verification stack can hold up under real adversarial conditions while still fitting onboarding and authentication workflows.

In this case, the article is about identity verification rather than IAM or NHI governance, but the intersection is clear: the strength of the identity proofing layer determines how much trust later access decisions can safely inherit.

Key questions

Q: What breaks when identity verification relies on a single liveness check?

A: A single liveness check breaks when attackers can replay video, inject synthetic streams, or automate challenge responses across many sessions. The control proves little if it cannot verify the capture path, the device context, and the continuity of the session. Fraud prevention needs layered assurance, not one biometric moment.

Q: Why do spoof resistance and user friction need to be measured together?

A: Because a system can be hard to spoof and still reject too many genuine users, or be easy to use and still accept fraudulent presentations. Identity teams need both sides of the error profile to set workable policy. If only one metric is reviewed, the programme will overstate either security or usability and misjudge operational risk.

Q: How should teams govern liveness controls after independent testing?

A: Teams should treat the published result as a baseline, then govern the live configuration, update cadence, and revalidation triggers. A tested model can drift after deployment as devices, attack patterns, and policy settings change. Governance needs a record of what was tested, what changed, and when the control was last rechecked.

Q: What is the difference between active and passive liveness checks?

A: Active liveness checks ask the user to perform a task such as blinking, smiling, or turning the head. Passive liveness checks work in the background by analyzing facial texture, depth, light response, and micro-movements without explicit prompts. Active methods are generally stronger against spoofing, while passive methods are smoother for users and faster to complete.

Technical breakdown

How presentation attack detection works in remote identity verification

Presentation attack detection, or PAD, is the mechanism used to spot when a camera feed is carrying an impersonation attempt instead of a live user. In remote identity verification, PAD looks for signals that a presented face is not physically present, such as replay artefacts, flat images, mask cues, or unnatural motion patterns. Liveness can be passive, where the system judges the selfie with no user action, or active, where it asks for a guided response. The technical trade-off is between friction and attack coverage, not between security and convenience in the abstract.

Practical implication: test passive and active liveness separately, because they fail differently and support different risk thresholds.

Why APCER and BPCER need to be read together

APCER measures how often spoofing attempts are accepted, while BPCER measures how often genuine users are rejected. Those two metrics describe opposite errors, and improving one can worsen the other. That is why PAD evaluations are not useful if teams only look at a single headline number. A low spoof acceptance rate is not enough if legitimate users are rejected too often, because the business then absorbs avoidable abandonment and manual review cost. Conversely, a smooth user experience is not strong evidence of fraud resistance unless attack acceptance is also low.

Practical implication: evaluate liveness by both fraud resistance and false rejection, not by one score in isolation.

Why point-in-time testing can diverge from production reality

The DHS RIVR results reflect a fixed configuration submitted for evaluation, which means they describe one tested state, not an always-current production environment. That distinction matters because identity systems are often tuned after launch as attack patterns, device mixes, and customer behaviour change. A point-in-time result is still valuable, but only if buyers understand that operational performance depends on configuration drift, model updates, and control governance after the test window closes. Independent testing therefore proves a baseline, not a permanent guarantee.

Practical implication: pair independent liveness testing with ongoing revalidation after configuration or model changes.

Threat narrative

Attacker objective: The attacker wants to impersonate a legitimate person well enough to pass identity verification and gain fraudulent access or onboarding approval.

1. Entry occurs when an attacker presents a printed image, replayed video, mask, or deepfake face stream to the verification workflow.
2. Credential access is attempted by making the biometric check accept a fraudulent presentation as if it were a real user.
3. Impact follows if the spoofed identity is enrolled, authenticated, or allowed into downstream onboarding or access decisions.

Breaches seen in the wild

• Arup deepfake fraud 2024: Deepfakes of Arup's CFO and colleagues on a video call led a Hong Kong employee to transfer HK$200 million (about US$25.6m) to fraudsters.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Presentation attack detection is now a trust-boundary control, not a cosmetic biometric feature. Once deepfakes and replay attacks enter the identity journey, liveness becomes the gate that determines whether the rest of the proofing stack is authenticating a person or an artefact. That shifts PAD from a user-experience discussion into an assurance problem for onboarding, account recovery, and step-up verification. Practitioners should treat liveness quality as a control design choice, not a vendor checkbox.

The real governance gap is overconfidence in a single verification score. Identity teams often compare solutions as if one aggregate accuracy result captures risk, but spoof resistance and genuine-user usability move in different directions. That makes threshold setting, test design, and scenario coverage more important than a headline pass rate. A credible programme has to understand which attack classes were tested, under what conditions, and with what failure trade-offs. Practitioners should insist on metric-level transparency before operational rollout.

Point-in-time certification does not eliminate the need for control lifecycle management. Independent testing can show that a system performed well under a fixed configuration, but the threat changes after deployment, not during the lab exercise. That means the assurance model must include retraining, revalidation, and drift monitoring, especially where model behaviour can be tuned quickly. Practitioners should govern liveness as a living control, not a one-time procurement proof.

Deepfake pressure is pushing identity verification toward continuous evidence, not static assurance. As impersonation techniques become more convincing, programmes need evidence that survives adversarial adaptation rather than only benign-user testing. In that sense, PAD and liveness are converging with broader identity verification governance, where the question is whether the control can hold up under active attack. Practitioners should align verification policy with adversarial test regimes, not consumer-grade demo results.

Attack simulation quality matters as much as the control itself. If the testing corpus underrepresents realistic spoofing methods, a programme may overestimate resilience and underinvest in fallback checks. That is why structured evaluation frameworks and repeatable adversarial tests matter for identity proofing maturity. Practitioners should demand test conditions that resemble the threat, not the marketing claim.

From our research library:

• Gartner predicts that by 2026, 30% of enterprises will consider identity verification solutions unreliable in isolation because of AI-driven attacks.

What this signals

Identity proofing teams should stop treating liveness as a static feature and start treating it as an adversarial control. The operational question is whether the control still works after configuration changes, attack evolution, and model tuning. Programmes that cannot answer that question will overestimate assurance and underprepare for spoofing escalation.

Remote verification is moving toward evidence-based governance. Buyers now need documented test conditions, error trade-offs, and revalidation triggers before they can rely on a liveness result in production. That shifts procurement conversations from claims to control evidence.

Presentation attack detection is becoming part of the broader identity assurance stack. As spoofing becomes more realistic, organisations will need to connect proofing policy, fraud review, and step-up authentication into one governed decision path. That is where identity verification maturity will increasingly be judged.

For practitioners

• Separate passive and active liveness decisions Set different acceptance thresholds for passive selfie capture and challenge-based flows, because the two modes produce different user friction and spoof resistance profiles.
• Review APCER and BPCER together Require vendors and internal teams to report both spoof acceptance and genuine-user rejection, then test whether the balance matches the risk tier of the journey.
• Treat evaluation results as configuration-specific Document the model version, device assumptions, and tuning state used in every independent test so production changes can be compared against the tested baseline.
• Add drift monitoring to identity proofing governance Revalidate liveness performance after major model updates, attack pattern shifts, or policy changes instead of assuming the test result remains current.

Key takeaways

• Remote identity verification is only as strong as its ability to distinguish real users from spoofed presentations under realistic attack conditions.
• The most useful liveness results balance spoof resistance with false rejection, because both errors affect trust and customer experience.
• Independent testing is essential, but production governance still needs revalidation, drift monitoring, and configuration control.

Key terms

• Presentation Attack: A presentation attack is an attempt to fool a biometric system with a fake face, replayed video, mask, or other synthetic artefact. In practice, the control fails when it measures resemblance alone, because the attacker’s objective is to pass as the real user without actually being that person.
• Liveness Detection: Liveness detection is the mechanism that checks whether a biometric sample comes from a real, present person rather than a spoof such as a photo, screen, or mask. In identity programmes, it is a core defence against presentation attacks and should be tested under realistic operating conditions.
• Attack Presentation Classification Error Rate: Attack Presentation Classification Error Rate, or APCER, measures how often a spoofing attempt is wrongly accepted as legitimate. It is a security-facing metric, but it must be interpreted alongside false rejection measures because a low attack score alone does not prove the full control is usable.
• Bona Fide Presentation Classification Error Rate: Bona Fide Presentation Classification Error Rate measures how often a biometric system wrongly rejects a genuine user as suspicious or non-genuine. It is an important usability signal because strong attack resistance should not come at the cost of locking out legitimate users or creating excessive friction during verification.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.