.webp)
Liveness detection is the cornerstone of remote identity verification. When you take a selfie to open a bank account or unlock a wallet, a liveness check is what is supposed to confirm that a real, living person is in front of the camera rather than a photo or a mask. For a decade, that was enough. It no longer is. Deepfakes now pass liveness checks routinely, and the reason is not that liveness is broken so much as that it was never designed for this threat.
This piece explains why liveness checks fail against deepfakes: what liveness was actually built to do, the fundamental mismatch between confirming presence and confirming authenticity, how real-time face swaps clear challenge prompts, how injection attacks skip the camera entirely, and why a liveness certification does not close the gap. It is written for the fraud, risk, and identity teams who are discovering that a clean liveness pass is no longer proof of a genuine person.
The single idea to hold onto is this: liveness confirms that something live is in front of the sensor. It does not confirm that what the sensor sees is real. A deepfake can be entirely live and entirely fake at the same time.
- Liveness detection confirms a real person is present at the camera; it does not confirm the media is authentic, and that gap is where deepfakes operate.
- Liveness was built to defeat printed photos, screen replays, and masks, a decade-old threat model that predates real-time deepfakes.
- Active liveness is defeated because a real-time face swap can blink, turn, and smile on command, inheriting the liveness of the person driving it.
- Injection attacks bypass the camera entirely, feeding a synthetic stream into the pipeline, so the sensor liveness relies on never sees the attack.
- A MITRE ATLAS case study documented an attack that evaded both passive and active liveness.
- Injection overtook presentation as the leading attack vector in 2024, with virtual-camera attacks rising more than 2,600% that year.
- PAD certification under ISO/IEC 30107-3 covers presentation attacks, not injection or real-time deepfakes, so a certified system can still be vulnerable.
- Closing the gap requires dedicated deepfake detection, injection or device-integrity checks, and document forensics layered on top of liveness.
What Liveness Detection Was Built to Do
Liveness detection is a form of presentation-attack detection, the discipline defined and tested under the international standard ISO/IEC 30107-3. Its job is to decide whether the face at the camera is a genuine, present human or an artifact held up to the lens. It comes in two forms. Passive liveness analyzes what the camera captures without asking the user to do anything, looking for the texture, depth, and reflection cues that separate a live face from a flat reproduction. Active liveness asks the user to perform a challenge, such as blinking, turning their head, or smiling on prompt, on the logic that a static photo or a printed mask cannot respond.
Both were designed around a specific and, at the time, complete threat model: physical artifacts presented to a camera. A printed photograph, a video replayed on a phone screen, a paper cutout, a silicone mask. Against those attacks, liveness works well, and reputable vendors test against ISO/IEC 30107-3 to prove it. The trouble is that the threat model has changed, and the newer attacks do not look anything like a mask held up to a lens.
The Core Mismatch: Presence Is Not Authenticity
The deepest reason liveness fails is a conceptual one. Liveness detection answers the question "is a real, live person present at the camera?" Deepfake detection answers a different question: "is this media genuine, or was it synthetically generated or manipulated?" These sound similar but are not the same, and the difference is exactly the space a deepfake exploits.
Consider a real-time face swap. A genuine, living human sits at their computer and drives a deepfake that maps a different person's face onto their own in real time. There is a live person present, so liveness signals fire correctly. Their eyes blink, their head turns, their expressions move naturally, because a real person is producing all of it. Yet the face being verified is entirely synthetic. Liveness confirmed presence, truthfully, and told you nothing about authenticity. Passing a liveness check has stopped being evidence that the face is real, and most verification flows have not caught up to that fact.
How Real-Time Deepfakes Pass the Challenge
Active liveness was supposed to be the stronger defense, because a challenge seems hard to fake. In practice it has become a target. Modern real-time face-swap tools puppet a synthetic face using the live movements of the attacker, so when the system says "blink," the attacker blinks and the deepfake blinks with them. When it says "turn left" or "smile," the deepfake follows, because it is animated by a real person doing exactly those things. The challenge-response step, designed to prove a live human is present, is satisfied by a live human who happens to be wearing a synthetic face.
This is not theoretical. A MITRE ATLAS case study, drawn from a red-team exercise, documented an attack in which both passive and active liveness were evaded by injecting a live deepfake into a mobile KYC flow. The economics make it worse: a capable face-swap tool can cost less than a music-streaming subscription and be set up in about half an hour, which is why these attacks arrive at volume rather than as rare, sophisticated events. The uncomfortable corollary is that the friction active liveness adds to onboarding, the drop-off from asking users to perform challenges, is now often a cost paid for a control that determined attackers already clear.
Injection Attacks Bypass the Camera Entirely
The most decisive failure is architectural. Liveness assumes the image it evaluates came from the device's real camera, pointed at the real world. An injection attack breaks that assumption. Instead of showing a deepfake to the camera, the attacker bypasses the physical camera altogether and feeds a synthetic video stream directly into the verification pipeline, using a virtual camera application, an emulated device, an SDK-level hook, or interception of the video transport. The verification system believes it is receiving a live feed from the hardware camera when it is receiving fabricated video.
Because nothing is ever physically presented to a real lens, presentation-attack detection alone may not catch an injection attack. It is a fundamentally different vector, and it has become the dominant one: injection attacks overtook presentation attacks as the leading threat in 2024, with one provider recording native virtual-camera attacks rising more than 2,600% across that year. In a single documented case, one financial institution faced more than 8,000 biometric injection attempts against its KYC onboarding over eight months. Defending against injection requires something liveness does not provide: signal and device-integrity checks that confirm the feed genuinely originates from the device's real camera rather than a virtual one.
Why PAD Certification Is Not Enough
A natural response is to ask whether a certified liveness product solves this, and the answer is only partly. ISO/IEC 30107-3, and the certification programs built on it, frame testing for presentation attacks specifically, artifacts presented to a sensor. That is genuinely valuable, and a system without it is weaker. But a presentation-attack certification says little about injection attacks, which never touch the sensor, or about high-fidelity real-time face swaps rendered on a live face. A vendor can be legitimately certified against presentation attacks and still be exposed to the vectors where fraud has actually migrated.
This is why procurement questions have to be specific. When a vendor says their system handles deepfakes, it is worth asking whether they mean it stops a photograph held to a camera or an AI-generated face injected into the video stream, because those are different problems that require different technology. Security researchers have documented attackers combining AI-generated identity documents, real-time face swaps, and camera injection at once, a coordinated multi-vector approach that no single liveness check was designed to address.
Closing the Gap: Layer Deepfake and Injection Detection
Liveness is not obsolete, and it should not be removed; it still stops the physical presentation attacks it was built for. The point is that it needs company. Closing the gap means adding layers that answer the questions liveness cannot. Dedicated deepfake detection analyzes the media itself for the statistical signatures of synthetic generation, catching the real-time and injected face swaps that clear a liveness challenge. Injection or device-integrity detection verifies that the video genuinely came from the hardware camera rather than a virtual one. Document forensics checks the identity document for AI forgery. And an explainability layer that routes borderline cases to human review keeps the automated decisions accountable.
This layered approach is where DuckDuckGoose, based in Delft, focuses. Its DeepDetector analyzes images and video for the signatures of synthetic media, sitting alongside liveness to catch the deepfakes that liveness passes, with the explainable output its detection is built around and the ISO 27001, SOC 2, and GDPR compliance that regulated buyers require. For the underlying distinction this all rests on, see our guide to the real difference between liveness and deepfake detection, and for the injection vector specifically, how injection attacks feed deepfakes into verification.
Frequently Asked Questions
Why do liveness checks fail against deepfakes?
Because liveness confirms that a real person is present at the camera, not that the media is authentic. A real-time face swap is driven by a live person, so it satisfies liveness signals while showing a synthetic face, and an injection attack bypasses the camera entirely, so the sensor liveness relies on never sees the attack. Liveness answers a different question than deepfake detection.
Can active liveness challenges stop deepfakes?
Not reliably. Active liveness asks the user to blink, turn, or smile, but a real-time face swap is animated by the attacker's own movements, so it performs each challenge on command. A MITRE ATLAS case study documented an attack that evaded both passive and active liveness, so challenge-response on its own is no longer sufficient.
What is the difference between a presentation attack and an injection attack?
A presentation attack shows a fake artifact to the camera, such as a photo, a mask, or a deepfake on another screen. An injection attack bypasses the physical camera and feeds a synthetic video stream directly into the verification pipeline using a virtual camera or modified software. Presentation-attack detection may not catch injection, because nothing is ever presented to a real lens.
Does ISO/IEC 30107-3 or PAD certification mean a system stops deepfakes?
Not on its own. That standard frames testing for presentation attacks, artifacts shown to a sensor. It says little about injection attacks, which never touch the sensor, or about high-fidelity real-time face swaps. A system can be legitimately certified against presentation attacks and still be vulnerable to the deepfake vectors where fraud has migrated.
Is liveness detection still worth using?
Yes. Liveness still reliably stops the physical presentation attacks it was designed for, such as printed photos, screen replays, and masks, and removing it would reopen those doors. The point is that it is necessary but not sufficient, and it needs to be paired with deepfake detection, injection or device-integrity checks, and document forensics.
How do you stop deepfakes that pass liveness?
By layering defenses that answer the questions liveness cannot. Dedicated deepfake detection analyzes the media for synthetic signatures, injection detection verifies the feed came from the real camera, and document forensics checks the ID for AI forgery. Routing borderline cases to human review, aided by explainable output, keeps the automated decisions accountable.
How common are these attacks?
Common and rising fast. Injection attacks overtook presentation attacks as the leading vector in 2024, with virtual-camera attacks rising more than 2,600% that year, and one financial institution recorded over 8,000 biometric injection attempts in eight months. Cheap, accessible face-swap tools mean these are high-volume attacks, not rare, sophisticated ones.
About the author
