Injection Attack Detection Standards: CEN/TS 18099, ISO/IEC 25456 and NIST SP 800-63-4

What Is Injection Attack Detection?

An injection attack feeds fake biometric data into an identity system without presenting anything to the real camera. The attacker uses a virtual camera driver, an emulator, a hooked app or an intercepted network call to insert a pre-recorded video, a face swap or a fully synthetic face directly into the data stream. NIST SP 800-63A-4 describes these attacks as inserting modified or forged media between the capture point and the component that performs the comparison.

Injection attack detection (IAD) is the set of controls that catch this: checks that the media came from a genuine sensor, integrity protection on the capture-to-server path, and analysis of the media itself for signs of manipulation or generation. It is distinct from presentation attack detection (PAD), which tests whether a person in front of the camera is live rather than a printed photo, a screen replay or a mask.

Why ISO/IEC 30107-3 PAD Certification Does Not Cover Injection

ISO/IEC 30107-3 defines how presentation attack detection is tested and reported, and it underpins most liveness certifications. Its scope is presentation attacks: artefacts shown to the sensor. A system can pass PAD testing and still accept a deepfake video injected through a virtual camera, because that video never passes in front of the lens. CEN/TS 18099 makes the boundary explicit by leaving presentation attack testing out of scope and pointing to ISO/IEC 30107.

NIST SP 800-63A-4 reflects the same split. Section 3.11 requires PAD for remote biometric collection with an impostor attack presentation accept rate below 0.07, tested in conformance with ISO/IEC 30107-3:2023. Section 3.14 adds separate requirements for injection and forged media, noting that PAD and live document capture provide some protection by making viable forged media harder to inject but are not sufficient to address all cases.

What Does CEN/TS 18099 Require?

CEN/TS 18099:2024, Biometric data injection attack detection, is a European technical specification valid from 16 December 2024. It gives an overview of injection attack definitions, explains how such attacks apply to biometric systems used for enrolment and verification, and describes injection attack instruments across single- and multi-modality systems. It then offers guidance on detecting those instruments, mitigating the associated risk, and building test plans to evaluate injection attack detection systems.

Two scope details matter when reading vendor claims. Bona fide presentation testing is in scope, so an evaluation must show that genuine users are still accepted, not only that attacks are caught. Presentation attack detection systems that also defend against injection are in scope, but presentation attack testing itself is not, and neither is evaluation of cryptographic mechanisms such as secure elements. As a technical specification, it gives a common method for test laboratories; a claim of conformance should come with a test report that names the attack instruments used.

What Is ISO/IEC 25456?

ISO/IEC 25456, Information technology: Biometric data injection attack detection, is the international standard under development on the same subject. DIN's project listing shows it as a working draft, ISO/IEC WD 25456, handled by ISO/IEC JTC 1/SC 27/JWG 7, the joint working group of the cybersecurity and biometrics subcommittees on testing and evaluating biometric security, with the German mirror project starting on 7 February 2025.

Until it is published, organisations outside Europe that want a written test method for injection defences generally refer to CEN/TS 18099. Expect procurement language to move to ISO/IEC 25456 once it reaches publication, and check which document a vendor's test report actually follows.

Does NIST SP 800-63-4 Require Deepfake and Injection Attack Detection?

Yes, for remote identity proofing. NIST released the final SP 800-63 Revision 4 in July 2025, and its summary lists new controls for injection attacks and forged media such as deepfakes. Section 3.14 of SP 800-63A-4, Digital Injection Prevention and Forged Media Detection, applies to all remote proofing, attended and unattended, that uses optical capture, remote biometric capture or video sessions.

It sets three SHALL requirements: implement technical controls to increase confidence that media comes from a genuine sensor, for example detecting a virtual camera, device emulator or jailbroken device; analyse all digital media submitted during proofing for artefacts of modification, manipulation, tampering or forgery, with automated analysis tested against attack artefacts and genuine media to establish false positive and false negative rates that are documented and available to relying parties on request; and use only authenticated protected channels. It adds SHOULD recommendations to use passive detection of forged media for all capture scenarios, authenticate capture sensors or use device attestation, augment automated decisions with manual review, and analyse media for signatures of generative AI algorithms and deepfake tools.

How to Meet Injection Attack Detection Requirements in Practice

No single product satisfies every control, because the standards span device, transport and media. A practical architecture layers them:

• Capture layer: device attestation, emulator and virtual-camera detection, and app integrity checks in the mobile SDK or browser capture component.
• Transport layer: authenticated, protected channels and signed capture payloads so media cannot be swapped in transit.
• Media layer: passive analysis of every image and video for face swaps, synthesis, pixel-level manipulation and generative model traces, with measured error rates.
• Review layer: routing of uncertain or high-risk results to trained reviewers, as SP 800-63A-4 recommends.
• Evidence layer: test reports against CEN/TS 18099 and ISO/IEC 30107-3, plus documented false negative rates per attack type for relying parties.

Where NeuroVerify Fits in Injection Attack Defence

NeuroVerify covers the media layer that SP 800-63A-4 section 3.14 asks providers to analyse. One API call checks a face image, video or audio with six signals, including Live Presence Verification, Face Manipulation Detection, AI Generative Model Analysis and AI Pixel-Level Manipulation, and returns one unified risk score with signal-level evidence in under 200 ms p95 on eligible image requests. Because it analyses the content itself, it can flag a synthetic or swapped face whichever route the media took into your system, and it runs alongside the device and transport controls in your capture stack rather than replacing them. NeuroVerify does not analyse ID documents.

For the documented error rates the NIST text requires, Neural Defend publishes benchmark evidence: on the public VendorBench-100 still-image benchmark Neural Defend ranked first of 36 systems with MCC 0.876, recall 0.987 and specificity 0.857. That benchmark does not test injection attacks or video, and one of its authors also co-wrote Neural Defend's ARCAS 1B paper, so providers should still measure performance on their own attack artefacts. NeuroVerify integrates through Android, iOS and Flutter SDKs and deploys in the cloud, a private VPC, on premises or air-gapped.