Presentation Attacks Against Face Verification: Types, PAD Testing and Deepfakes on Screens

What is a presentation attack in face verification?

A presentation attack is an attempt to fool a face verification system by showing the camera something other than the live, genuine face of the person claiming the identity. The object shown is called a presentation attack instrument. The goal is either impersonation, passing as a specific real person, or concealment, avoiding recognition as oneself.

The attack happens entirely in the physical world. The camera, app and network work exactly as designed; they faithfully capture a fake. That is why ordinary face matching cannot stop it. A printed photo of the victim matches the victim's ID photo very well, so the matcher reports a strong match, and only a separate check asks whether a live person was there.

Types of presentation attack, from printed photos to deepfakes on screens

Presentation attack instruments range from almost free to expensive, and the cheap ones remain common because many systems still fail them. The table lists the main families and the clues PAD typically uses against each.

Deepfakes have added a new instrument. An attacker generates a face swap or reenactment of the victim, plays it full screen on a tablet or monitor and holds it to the phone camera. If the verification flow asks the user to turn their head or blink, a real-time deepfake can follow the prompt. Better displays reduce the moire patterns, bezels and reflections PAD relies on, which is why manipulation analysis of the face itself matters as a second check.

What is the difference between presentation attacks and injection attacks?

A presentation attack shows a fake to a real camera, while an injection attack skips the camera and feeds media straight into the app or the API. The difference decides which controls work. PAD inspects the captured scene for signs that a print, screen or mask was filmed. Injection detection asks whether the capture path itself can be trusted, through checks for virtual cameras, emulators, hooked apps and replayed API calls.

The standards split the same way. ISO/IEC 30107-3 is the test standard for presentation attack detection. CEN/TS 18099:2024, valid since 16 December 2024, addresses biometric data injection attack detection and states that presentation attack testing is outside its scope because ISO/IEC 30107 covers it. NIST SP 800-63A-4 also treats them separately, with PAD requirements in its biometric section and a dedicated section on digital injection and forged media.

A system with excellent PAD can still accept an injected deepfake, because no second surface was ever filmed. The explainer on digital injection attacks covers that side in detail.

How presentation attack detection is tested and certified

PAD performance is measured with attack presentations and genuine presentations, reported as error rates. ISO/IEC 30107-3 defines the test methodology and metrics. NIST SP 800-63A-4 sets a concrete bar for remote identity proofing in US federal systems: PAD that meets an impostor attack presentation accept rate below 0.07, with all biometric PAD tests conformant to ISO/IEC 30107-3:2023. The same section sets 1:1 matching targets of a false match rate of 1 in 10,000 or better and a false non-match rate of 1 in 100 or better.

Certification programmes package this testing. The FIDO Alliance Face Verification certification, run through accredited independent laboratories, covers deepfakes, liveness, demographic bias, matching accuracy and injection attacks.

A certificate describes the product configuration that was tested. Confirm that the version, capture settings, devices and attack species in the report match your deployment, and ask which attack instruments were out of scope.

Controls that work against presentation attacks

PAD is the core control, but it works best inside a flow designed to make presentation attacks harder and to catch the ones that pass. Behaviour around the capture is evidence too: FinCEN's November 2024 deepfake alert notes that fraudsters may claim repeated technical glitches or ask to switch communication method during a live verification check. Useful controls include:

• Run passive PAD on every capture, and add an active challenge for higher-risk steps, issued by the server and bound to the session.
• Analyse the captured face for manipulation and generation, so a deepfake shown on a screen is caught even if the screen itself is hard to see.
• Rate-limit attempts per device and identity; repeated tries with different instruments are a probing pattern.
• Correlate face results with device history, document checks and account context, as NIST recommends for fraud management.
• Offer an accessible alternative route with comparable assurance for genuine users who cannot complete the default liveness step.
• Test with the instruments you expect, including deepfakes on modern displays, and retest after model or capture changes.

Where NeuroVerify fits against presentation attacks

NeuroVerify analyses the face image, video or audio your flow captured and returns one unified risk score with signal-level evidence. Two of its six signals bear directly on presentation attacks: Live Presence Verification, which assesses whether a live person was in front of the camera, and Face Manipulation Detection, which looks for swapped or reenacted faces. AI Generative Model Analysis and AI Pixel-Level Manipulation add evidence when the face on the screen was generated. Eligible image requests complete in under 200 ms p95 under defined test conditions.

The detection models build on ARCAS 1B, Neural Defend's own model. On the public VendorBench-100 benchmark of 100 adversarial still images, including face swaps and avatar compositing, Neural Defend ranked first of 36 systems with an MCC of 0.876; that benchmark does not test physical presentation attacks or video, and one of its authors also co-authored the ARCAS paper.

Neural Defend's published certifications are ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 42001 and SOC 2 Type II. If your programme requires ISO/IEC 30107-3 PAD test evidence for a specific configuration, scope that during evaluation, and pair NeuroVerify with device integrity checks for the injection side.