APCER, BPCER and ACER: the presentation attack error rates explained

This page is part of the deepfake detection hub and defines the error rates that the presentation attack detection page uses. It sits beside the hub's pages on liveness and face anti-spoofing, which describe the attacks and the methods; this page is only about how the results are counted.

01What is a presentation attack, and what does PAD decide?

ISO/IEC 30107-1:2023 defines a biometric presentation attack as a "presentation to the biometric capture subsystem with the goal of interfering with the operation of the biometric system", and presentation attack detection, PAD, as the "automated discrimination between bona-fide presentations and biometric presentation attacks". A bona fide presentation is one made "without the goal of interfering with the operation of the biometric system". The object used in the attack is the presentation attack instrument, PAI: a printed photograph, a replayed video, a mask, or a lifeless or altered biometric characteristic (ISO/IEC 30107-1:2023, clause 3).

Every PAD decision therefore has two ways to be wrong. It can accept an attack as bona fide, which is the security failure, or reject a genuine person as an attack, which is the convenience failure. The two error rates named in the standard count exactly these two directions, and nothing else. The standard notes that PAD "cannot infer the biometric capture subject's intent": it classifies the presentation, not the person.

02How are APCER and BPCER defined?

ISO/IEC 30107-3:2023, "Biometric presentation attack detection. Part 3: Testing and reporting", is the part that defines the metrics. Its text is sold rather than published, so the wording here follows the SC37 WG3 slides by Christoph Busch that quote it (Busch, 2024). The attack presentation classification error rate, APCER, is the "proportion of attack presentations using the same PAI species incorrectly classified as bona fide presentations in a specific scenario". The bona fide presentation classification error rate, BPCER, is the "proportion of bona fide presentations incorrectly classified as attack presentations in a specific scenario".

Two words in the APCER definition matter. "Same PAI species" means APCER is computed per attack type: a PAI species is a "class of presentation attack instruments created using a common production method and based on different biometric characteristic", so a print attack from one printer and a replay from one display are separate species with separate APCER values. "Specific scenario" means the number is tied to the test conditions, which is why a result without its protocol is not a result. The standard's catalogue abstract states that it covers "principles and methods for the performance assessment of presentation attack detection (PAD) mechanisms" and the reporting of test results, and that the attacks in scope "take place at the biometric capture device during presentation" (ISO/IEC 30107-3:2023).

03Why does APCER count per attack type?

A system that stops every printed photograph but accepts one mask design in ten has an APCER of 0 percent for prints and 10 percent for that mask species. Pooling the two into one number would hide the weakest species behind the strongest, and the weakest species is the one an attacker will use. Reporting APCER per PAI species, and taking the worst species as the headline, is the standard's answer to that. The OULU-NPU database follows the same logic in its protocols: Protocol II tests "a previously unseen print and video-replay attack in the test set", so the attack species at test time is one the method never saw (OULU-NPU).

BPCER has no species dimension, because bona fide presentations have no production method. It does depend on the scenario: the same people, cameras and lighting as the attacks, so that a method cannot look good by rejecting everything in a hard session.

04What is ACER, and what does the standard say about single figures?

ACER, the average classification error rate, is the mean of APCER and BPCER. The face anti-spoofing literature uses it as its single comparison figure: Liu, Jourabloo and Liu (CVPR 2018) report their results "with the following metrics", APCER, BPCER and "ACER = (APCER + BPCER) / 2", citing the ISO/IEC 30107 series, and state that their method "achieves the lowest ACER in 3 out of 4 protocols" of OULU-NPU (arXiv 1803.11097).

The standard's own advice points the other way. The SC37 WG3 slides on ISO/IEC 30107-3 say that a PAD mechanism "may be reported in a single figure" only at a chosen security level, and "DON'T use neither the equal error rate (EER) nor the half-total error rate (HTER)". The recommended single figure is BPCER at a fixed APCER: "One may report BPCER when APCERAP is 5% as BPCER20", with BPCER100 at APCER 1 percent and BPCER10 at APCER 10 percent. The logic is that of a false positive rate fixed in advance: the operator picks how many attacks may pass, and the test reports how many genuine users pay for it. ACER weights both errors equally, which no deployment does.

05How a result table reports them: the OULU-NPU protocols

OULU-NPU (FG 2017) holds 4,950 real access and attack videos of 55 subjects, recorded with the front cameras of six mobile phones in three sessions, with print and video-replay attacks from two printers and two displays, and four protocols of increasing difficulty: unseen session, unseen attack instrument, leave one camera out, and all three at once. The CVPR 2018 paper's Table 4 reports the leading competition entries and its own method on all four, in exactly the three columns this page defines.

Source: Liu, Jourabloo and Liu, CVPR 2018, Table 4 (arXiv 1803.11097), read 9 November 2026. Protocols 3 and 4 leave one of the six cameras out in turn, hence the spread. The four protocols do for anti-spoofing what the in-dataset and cross-dataset splits described on the deepfake detection protocols page do for detectors: each one changes what the test set shares with the training set.

The table shows why the two rates are kept apart. On Protocol 1, CPqD and GRADIANT reach the same ACER of 6.9 by opposite routes: GRADIANT lets fewer attacks through (APCER 1.3) and rejects more genuine users (BPCER 12.5). An operator who must bound attacks would choose GRADIANT; one who must bound rejected customers would choose CPqD; ACER cannot tell them apart. On Protocol 4 the same method's ACER rises from 1.6 to 9.5 percent, which is the generalisation gap the database was built to expose, and the same gap that the cross-dataset generalization page documents for deepfake detectors.

06How these rates relate to the deepfake detection metrics

A deepfake detector scored on a benchmark reports a false positive rate and a false negative rate over images or videos, usually summarised as AUC or EER. APCER and BPCER are the same two error directions, renamed for presentations at a sensor and tied to an attack species and a scenario. The vocabulary differs because the threat differs: a deepfake detector sees a file whose history is unknown, while a PAD subsystem sees a live capture it controls. Human judges have their own error pair too: the human deepfake detection studies table records each study's accuracy against its chance level and, where the paper reports it, which direction the errors ran. The 1:1 and 1:N face recognition page covers the third vocabulary, FMR and FNMR, used once the presentation is accepted and the face is compared.

One caveat carries across all three. ISO/IEC 19795-1:2021, the general biometric performance testing standard, excludes from its scope "people deliberately trying to subvert the intended operation of the biometric system (e.g. by presentation attacks)"; those are measured under ISO/IEC 30107-3. A recognition accuracy figure therefore says nothing about APCER, and a PAD figure says nothing about whether the accepted face was matched correctly. The 2023 revision adds the impostor attack presentation accept rate, IAPAR, defined in a full-system test as the "proportion of impostor attack presentations using the same presentation attack instrument (PAI) species that result in accept", to join the two.