Anti-spoofing is the security layer that answers a deceptively simple question at the front of a biometric check: is this a real, live person, or a fake? It is the technology that stops a printed photo, a video replayed on a screen, or a silicone mask from passing a face verification, and it is often called liveness detection or, in its formal form, presentation attack detection. Against the attacks it was designed for, it works well. The problem is that the attacks have changed, and anti-spoofing has a hard boundary that modern deepfakes and injection attacks live just past.
This piece explains both halves: how anti-spoofing actually works, meaning the signals it reads to tell a live face from a spoof, and where it stops working, meaning the specific attacks that slip through by design rather than by accident. It is written for the fraud, risk, and engineering teams who rely on a liveness check and need to know exactly what it does and does not cover.
The one idea that explains the boundary is this: anti-spoofing confirms that a live person is at the sensor. It does not confirm that the face is authentic, or that the video even came from a real camera. Everything it catches, and everything it misses, follows from that.
- Anti-spoofing is the biometric layer that confirms a live, genuine person is at the sensor, rather than a photo, screen, mask, or deepfake; it is also called liveness detection or PAD.
- It works by reading signals a spoof struggles to reproduce: skin texture, 3D depth, light and moire patterns, involuntary micro-movements, blood-flow pulse, and thermal or infrared cues.
- Active anti-spoofing prompts the user to blink or turn; passive anti-spoofing analyzes a single capture with no action and is now the industry direction.
- Against the physical spoofs it was built for, printed photos, screen replays, and many masks, anti-spoofing works well, and ISO/IEC 30107-3 provides the testing standard.
- It stops working against real-time deepfakes, because a live-driven synthetic face produces the very live signals anti-spoofing looks for, blinking and responding to prompts.
- It also stops working against injection attacks, which bypass the sensor entirely, and it can miss novel or high-fidelity spoofs and degrade under compression.
- The boundary is conceptual: anti-spoofing answers is a live person at the sensor, not is the media authentic or did this come from a real camera.
- A complete defense pairs anti-spoofing with dedicated deepfake detection and injection detection, so a live-looking or injected fake is still caught.
What Anti-Spoofing Is Trying to Do
At its core, anti-spoofing proves there is a live human at the sensor before any face matching happens. It is the anti-fraud layer that sits in front of recognition, and its job is narrow and specific: separate a genuine, present person from an artifact or manipulated sample. Recognition then handles a different question, whether that face matches a claimed identity. Anti-spoofing is only concerned with liveness, that the biometric sample is coming from a living subject right now, and not from a photo, a replay, a mask, or pre-recorded media.
That framing is worth pausing on, because it defines the boundary. Anti-spoofing was conceived for presentation attacks, the class of attacks where a fake artifact is presented to a camera. The whole paradigm assumes that a physical sensor is capturing a physical scene, and that a spoof will therefore carry physical tells, the flatness of a photo, the glow of a screen, the lifelessness of a mask. Those assumptions are what its detection signals are built to exploit, and they are also, as we will see, exactly where it runs out of road.
How Anti-Spoofing Works: The Signals It Reads
Modern anti-spoofing is a multi-signal problem. Rather than one test, it combines several cues that a spoof struggles to reproduce all at once. Texture analysis examines skin at close range, because real skin has a micro-texture that printed paper and screens do not. Depth and 3D sensing, using structured light or time-of-flight where hardware allows, checks for genuine three-dimensional structure, since a flat photo or a video played on a screen cannot model the real ridges of a face; a 2D result is a strong sign of a photo or a screen. Light and reflection analysis looks for the moire patterns of a display and for the fact that a screen emits light while a real face reflects it, which behave differently. Motion analysis watches for the involuntary micro-movements of real eyes and muscles. More advanced systems add remote photoplethysmography, which detects the faint pulse of blood flow beneath the skin, and, where the hardware exists, thermal or infrared sensing, because a mask or screen does not reproduce the heat distribution of a living face.
These signals are combined, often by deep-learning models, into a single live-or-spoof decision, and the quality of a system is measured by how well it holds up against a defined set of attacks. The recognized standard for this is ISO/IEC 30107-3, which defines how presentation attack detection should be tested and reported, so that vendor claims can be compared on a like-for-like basis, with accredited labs testing at Level 1 for photos and replays and Level 2 for 3D masks and more sophisticated artifacts.
The two ways these signals are gathered define the two families of anti-spoofing. Active liveness prompts the user to perform an action, blinking, turning the head, following a dot, or saying a phrase, and analyzes the response. It is intuitive and strong against basic 2D attacks, but it adds friction that increases onboarding abandonment, it can wrongly reject legitimate users, and, counterintuitively, it hands an attacker a predictable script. Passive liveness asks nothing of the user, inferring liveness from a single capture using texture, depth, reflections, and micro-motion. Because it lowers abandonment while matching or beating active methods on detection, passive liveness has become the industry direction.
Where Anti-Spoofing Stops Working
Everything above works because a physical spoof leaves physical evidence. The failures begin when the attack no longer behaves like a physical artifact presented to a camera. There are three distinct edges.
The first, and most important, is the real-time deepfake. A deepfake is not a static, lifeless artifact; a live-driven face swap can blink, move, and respond to prompts, letting it pass basic liveness checks. This is the crux of where anti-spoofing stops working: its signals are designed to confirm that something live is happening in front of the camera, and a real-time deepfake, animated by a live human, genuinely produces those live signals while showing a synthetic face. Active liveness makes this worse, not better, because its challenge script is exactly what the attacker's live movements can follow. Anti-spoofing asks "is this a live capture?" and answers yes, correctly, even though the face is fake.
The second edge is the injection attack, which bypasses the sensor entirely by feeding a synthetic video stream directly into the software rather than showing anything to the camera. Since anti-spoofing assumes it is analyzing a genuine capture from a physical lens, an injected feed defeats the assumption at its root: there is no physical scene to carry the tells anti-spoofing hunts for. The third edge is a set of quieter failures: high-fidelity 3D masks that defeat weaker texture and depth checks, novel spoof types the model was never trained on, and the ordinary degradation of compression, which strips the subtle cues these signals depend on.
Why It Stops Working: The Boundary Explained
The pattern across all three edges is the same, and it is conceptual rather than a matter of a better algorithm. Anti-spoofing answers exactly one question well: is a live person present at the sensor? It does not answer two others that today's attacks turn on. It does not answer whether the media is authentic or synthetically generated, because a live-driven deepfake is a live capture of a fake face. And it does not answer whether the feed genuinely came from the device's real camera, because an injected stream never touched a lens. A liveness pass is truthful about liveness and silent about authenticity and origin, and attackers have simply moved into that silence.
This is why anti-spoofing should be understood as necessary but not sufficient. It remains the right tool for the large volume of physical presentation attacks that are still attempted every day, and dropping it would reopen those doors. But treating a liveness or PAD certificate as proof that a system stops deepfakes is a category error, because it certifies performance against a threat class that no longer describes the fastest-growing attacks.
Completing the Picture: Anti-Spoofing Plus Detection
Closing the gap means adding the layers that answer the other two questions, so that a fake is caught no matter which edge it exploits. Anti-spoofing, or PAD, keeps handling the physical spoofs shown to the camera. Injection attack detection, using device and session-integrity checks to confirm the feed comes from real hardware, handles the streams that bypass the sensor. And dedicated deepfake detection analyzes the media itself for the statistical signatures of synthetic generation, which is what catches a live-looking face swap that sails through liveness. The industry has converged on this pairing: passive liveness combined with dedicated deepfake detection to flag AI-generated faces that look live.
This is the layer DuckDuckGoose, based in Delft, provides. DeepDetector analyzes images and video for the signatures of synthetic media, catching the live-looking deepfakes that anti-spoofing passes, with explainable output and ISO 27001, SOC 2, and GDPR compliance, and it complements rather than replaces the liveness and injection detection a complete system also needs. For the specific way liveness is defeated, see our guide to why liveness checks fail against deepfakes, and for the attack that skips the sensor, how presentation attacks differ from injection attacks.
Frequently Asked Questions
What is anti-spoofing in biometrics?
It is the security layer that confirms a biometric sample comes from a live, genuinely present person rather than a spoof, such as a printed photo, a screen replay, a mask, or a deepfake. It is commonly called liveness detection, and its formal form is presentation attack detection (PAD), tested under ISO/IEC 30107-3. It runs before face matching to keep fakes out.
How does anti-spoofing work?
By reading signals that a spoof struggles to reproduce: skin micro-texture, three-dimensional depth, moire patterns and how screens emit light, involuntary micro-movements, the faint pulse of blood flow (rPPG), and, with the right hardware, thermal or infrared cues. These are combined, often by deep-learning models, into a live-or-spoof decision.
What is the difference between active and passive anti-spoofing?
Active liveness prompts the user to act, such as blinking or turning their head, and analyzes the response. Passive liveness asks nothing and infers liveness from a single capture. Passive is now the industry direction because it reduces friction and abandonment while matching or beating active methods, and because active prompts can be followed by a live deepfake.
Where does anti-spoofing stop working?
Against real-time deepfakes, which produce the live signals anti-spoofing looks for while showing a synthetic face; against injection attacks, which bypass the sensor entirely so there is no physical capture to analyze; and against novel or high-fidelity spoofs and heavily compressed media, which can erode the subtle cues it depends on.
Why can't anti-spoofing catch deepfakes?
Because it answers the wrong question for that threat. It confirms a live person is present, but a real-time deepfake is driven by a live person, so it passes as live while the face is fake. Anti-spoofing checks liveness, not authenticity, so catching deepfakes requires dedicated deepfake detection layered on top of it.
Does a PAD or liveness certificate mean a system stops deepfakes?
No. ISO/IEC 30107-3 certifies performance against presentation attacks shown to a camera, not against injection attacks or live-looking deepfakes. A system can hold a strong PAD certificate and still be defeated by a virtual camera or a real-time face swap, so a certificate is necessary evidence but not proof of deepfake resistance.
How do you cover what anti-spoofing misses?
By layering three defenses that answer three questions: anti-spoofing (PAD) for physical spoofs at the camera, injection attack detection for feeds that bypass the sensor, and dedicated deepfake detection for the synthetic content itself. Together they catch a fake whether it is presented, injected, or made to look live.
About the author
