Face anti-spoofing and liveness

Standardised metrics#

ISO/IEC 30107-3 defines PAD performance for subsystem evaluation. For a threshold $\tau$, with PAI species indexed by $s$:

$$ \text{APCER}_s(\tau) = \frac{1}{N_s}\sum_{i=1}^{N_s} \mathbb{1}\big[ f(x_i^{(s)}) \geq \tau \big], \qquad \text{APCER}(\tau) = \max_s \text{APCER}_s(\tau) $$

$$ \text{BPCER}(\tau) = \frac{1}{N_{bf}}\sum_{i=1}^{N_{bf}} \mathbb{1}\big[ f(x_i^{bf}) < \tau \big] $$

$N_s$ is the number of attack presentations of species $s$, $N_{bf}$ the number of bona fide presentations, and $f$ the liveness score. The maximum over species is normative, not a convention.

For full-system evaluation the standard uses IAPMR — impostor attack presentation match rate — the proportion of attacks that both survive PAD and produce a biometric match against the targeted identity. IAPMR is the number that describes end-to-end risk; APCER describes the PAD subsystem alone.

BPCER@APCER=x% and APCER@BPCER=x% are the reporting forms that carry information. A single ACER figure does not.

Method families#

Texture and quality cues. Early work used LBP, colour-space statistics and image-quality measures (Boulkenafet et al., 2015; Galbally et al., 2014). Cheap, interpretable, and brittle across capture devices.

rPPG. Remote photoplethysmography extracts the faint periodic colour change caused by blood flow. A print or mask has no pulse. Liu et al., CVPR 2018, Learning Deep Models for Face Anti-Spoofing, supervise a network with both a depth map and an rPPG signal, using auxiliary physical targets rather than a binary label. rPPG degrades badly with compression, low frame rate and motion.

Depth supervision. Predicting a pseudo-depth map — flat for attacks, facial geometry for bona fide — is a stronger training signal than a binary label, and it survives the loss of a real depth sensor at deployment.

Multi-channel input. George et al., IEEE TIFS 2019, Biometric Face Presentation Attack Detection with Multi-Channel CNN (arxiv.org/abs/1909.08848), combine colour, depth, near-infrared and thermal. This is the strongest published direction against masks, and it requires hardware the deployment must actually have.

Domain generalisation. Because the failure mode is cross-dataset, the field has moved toward meta-learning and domain-adversarial training over multiple capture domains. Progress is real and modest; leave-one-dataset-out remains far below within-dataset performance.

Benchmarks and their limits#

• OULU-NPU (Boulkenafet et al., 2017) — four protocols isolating unseen lighting, unseen PAI, unseen camera, and all three.
• SiW-M (Liu et al., 2019) — 13 spoof types, designed for leave-one-type-out evaluation.
• CelebA-Spoof (Zhang et al., ECCV 2020) — over 600k images with rich annotation.
• CASIA-SURF — multi-modal RGB, depth and infrared.

Protocol 4 of OULU-NPU is the one to read. Within-protocol numbers on the easier protocols are not predictive of deployment.

Independent certification against ISO/IEC 30107-3 is performed by accredited labs, most visibly iBeta, at Level 1 (low-cost instruments) and Level 2 (higher-effort instruments including custom masks). A Level 2 confirmation letter is a meaningful signal about mask resistance; a self-reported APCER is not.

Injection attacks#

The threat model that PAD does not address is injection: substituting the capture stream rather than the presented artefact. A virtual camera, a hooked capture API, an emulator, or a manipulated network payload delivers frames that are internally self-consistent, so texture, depth and rPPG cues are all reproducible by the generator.

Reporting through 2025 and 2026 has consistently placed injection among the fastest-growing vectors against remote identity verification, and the World Economic Forum's 2026 material on digital identity verification documents virtual-camera injection defeating a broad range of active liveness implementations.

Mitigations sit outside computer vision:

• Hardware-backed key attestation and platform integrity attestation.
• Secure camera paths and trusted execution environments.
• Server-side capture with signed frames and timestamps.
• Detection of emulators, rooted devices and hooked APIs.
• Cryptographic binding of the capture session to the account.

The correct framing is that PAD defends the sensor's front side and attestation defends its back side. Deploying one without the other leaves an open path.

Papers and standards#

• ISO/IEC 30107-1:2016 and 30107-3:2023 — PAD framework and testing methodology.
• Galbally et al., Image Quality Assessment for Fake Biometric Detection, IEEE TIP 2014
• Boulkenafet et al., Face Anti-Spoofing Based on Color Texture Analysis, ICIP 2015
• Liu et al., Learning Deep Models for Face Anti-Spoofing, CVPR 2018 — arxiv.org/abs/1803.11097
• George et al., Biometric Face Presentation Attack Detection with Multi-Channel CNN, IEEE TIFS 2019 — arxiv.org/abs/1909.08848
• Zhang et al., CelebA-Spoof, ECCV 2020 — arxiv.org/abs/2007.12342

What to learn next#

• Adversarial attacks — the wider family of inputs designed to defeat a model.
• Model evaluation — thresholds, error trade-offs and why one number is never enough.
• Responsible deployment — shipping a system whose failures have consequences.