Topic starter
02/09/2026 1:29 pm
TL;DR: Presentation attack detection is being measured against spoofing techniques such as printed photos, video replays, and masks, with passive liveness balancing fraud resistance and user experience, according to Incode’s DHS S&T RIVR Track 3 results. For IAM and identity verification teams, the lesson is that liveness quality, testing methodology, and point-in-time validation matter as much as headline accuracy numbers.
Editorial analysis by NHI Mgmt Group, based on content published by Incode: “Incode Among Top Performers in DHS S&T RIVR Track 3 Presentation Attack Detection”.
Key questions
Q: What breaks when identity verification relies on a single liveness check?
A: A single liveness check breaks when attackers can replay video, inject synthetic streams, or automate challenge responses across many sessions.
Q: Why do spoof resistance and user friction need to be measured together?
A: Because a system can be hard to spoof and still reject too many genuine users, or be easy to use and still accept fraudulent presentations.
Q: How should teams govern liveness controls after independent testing?
A: Teams should treat the published result as a baseline, then govern the live configuration, update cadence, and revalidation triggers.
Practitioner guidance
- Separate passive and active liveness decisions Set different acceptance thresholds for passive selfie capture and challenge-based flows, because the two modes produce different user friction and spoof resistance profiles.
- Review APCER and BPCER together Require vendors and internal teams to report both spoof acceptance and genuine-user rejection, then test whether the balance matches the risk tier of the journey.
- Treat evaluation results as configuration-specific Document the model version, device assumptions, and tuning state used in every independent test so production changes can be compared against the tested baseline.
Bottom line: Remote identity verification is only as strong as its ability to distinguish real users from spoofed presentations under realistic attack conditions.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
02/09/2026 1:30 pm
Presentation attack detection is now a trust-boundary control, not a cosmetic biometric feature. Once deepfakes and replay attacks enter the identity journey, liveness becomes the gate that determines whether the rest of the proofing stack is authenticating a person or an artefact. That shifts PAD from a user-experience discussion into an assurance problem for onboarding, account recovery, and step-up verification. Practitioners should treat liveness quality as a control design choice, not a vendor checkbox.
A few things that frame the scale:
- Gartner predicts that by 2026, 30% of enterprises will consider identity verification solutions unreliable in isolation because of AI-driven attacks.
A question worth separating out:
Q: What is the difference between active and passive liveness checks?
A: Active liveness checks ask the user to perform a task such as blinking, smiling, or turning the head. Passive liveness checks work in the background by analyzing facial texture, depth, light response, and micro-movements without explicit prompts. Active methods are generally stronger against spoofing, while passive methods are smoother for users and faster to complete.
👉 Read our full editorial: Remote identity verification needs stronger liveness against spoofing
This post was modified 2 days ago by NHI Mgmt Group