Biometric spoofing and deepfake detection: two tests, one flow

This page is part of the deepfake detection hub. It narrows the liveness detection and injection attacks page to one question: what each test covers, and what falls between them.

01What is biometric spoofing?

A biometric spoof is an object or characteristic presented to the capture device to interfere with the system: a printed photograph, a video replayed on a screen, a silicone or paper mask. ISO/IEC 30107-1:2023 defines a presentation attack as a "presentation to the biometric capture subsystem with the goal of interfering with the operation of the biometric system", and presentation attack detection (PAD) as the "automated discrimination between bona-fide presentations and biometric presentation attacks". The object used is a presentation attack instrument, and instruments made the same way form a species.

Part 3 of the same standard, ISO/IEC 30107-3:2023, is the test and reporting method: its catalogue page gives "principles and methods for the performance assessment of presentation attack detection (PAD) mechanisms" and "a classification of known attack types" in its Annex A (iso.org/standard/79520). It is explicit about its boundary: "The attacks considered in this document take place at the biometric capture device during presentation. Any other attacks are considered outside the scope of this document." A deepfake sent as a file or a stream never meets the camera, so it is one of those other attacks.

02What does deepfake detection test instead?

Deepfake detection scores a video or image that has already been captured or generated, asking whether the face in it was manipulated or synthesised. There is no capture device in the test: a detector is trained on a dataset of real and forged clips and scored on another, usually by the area under the ROC curve. DeepfakeBench (NeurIPS 2023 Datasets and Benchmarks) standardises that protocol for 36 detectors and reports frame-level AUC, video-level AUC, accuracy, equal error rate and average precision (arXiv 2307.01426).

Its results show what the test measures and what it does not. Xception trained on FaceForensics++ c23 scores a frame-level AUC of 0.9637 on that set and 0.7365 on Celeb-DF v2, a drop that comes from the generator and the footage changing, not from any camera. No PAD species, no attack potential level and no bona fide presentation appear anywhere in the protocol, because the forged media is the whole input. Where a joint face-and-voice forgery is scored, the multimodal detection page gives the equivalent numbers.

03How is each test scored?

PAD's two rates are, in the wording of the SC37 working group slides that quote the standard, APCER, the "proportion of attack presentations using the same PAI species incorrectly classified as bona fide presentations", and BPCER, the "proportion of bona fide presentations incorrectly classified as attack presentations". The slides advise reporting BPCER at a fixed APCER, written BPCER20 at 5 percent or BPCER100 at 1 percent, and warn: "DON'T use neither the equal error rate (EER) nor the half-total error rate (HTER)". Deepfake benchmarks report exactly the EER that PAD avoids, alongside AUC, because they have no attack species to fix a rate against; the APCER, BPCER and ACER page sets the two vocabularies side by side.

04Where does a deepfake enter a verification flow?

Between the camera and the comparison. NIST SP 800-63A describes the attack in its section on digital injection and forged media: "Injection attacks insert modified or forged media between the capture point (e.g., a device) and the element conducting the comparison or other operation" (pages.nist.gov/800-63-4). It states that "a biometric comparison performed with a captured sample does not prevent these attacks", that PAD mechanisms "do provide some protection" by making viable forged media harder to inject, and that "even these mechanisms are not sufficient to address all possible cases".

The same document requires both tests. For remote collection it mandates PAD meeting an impostor attack presentation accept rate below 0.07, with "all biometric presentation attack detection tests" conformant to ISO/IEC 30107-3:2023, and separately requires technical controls to confirm media comes from a genuine sensor, such as detecting "a virtual camera, device emulator, or a jailbroken device", plus analysis of all submitted media for artifacts of modification. The first requirement is the spoofing test. The second is where a deepfake detector, and the controls around it, sit.

05Is there a standard for the deepfake side?

Not one with error rates, yet. CEN/TS 18099:2024, valid from 16 December 2024, covers biometric data injection attack detection: it defines the injection attack and its instruments and provides a "Creation of test plan for the evaluation of Injection Attack Detection system", while placing "Presentation Attack testing" out of scope "as they are covered in ISO/IEC 30107 standards". It is a technical specification with a test plan, not a conformance scheme with published rates, and its text is paywalled; no figure from it is used here.

ENISA's 2022 review of remote identity proofing classified the attacks it found as "photo attack, video of user replay attack, 3D mask attack, deepfake attack", three of which are presentation attacks and one of which is not, and reported that the industry "lacks a clear framework for the type of testing needed" for injection. The gap between a PAD letter and a deepfake benchmark is that framework.

06Why does a flow need both tests?

Because each test is blind to the other's attack. A PAD system certified against a listed set of print, replay and mask species at one level has been tested on objects in front of a lens; a forged stream bypasses the lens, so the certificate says nothing about it, and the standard says so. A deepfake detector scored at 0.9637 AUC on FaceForensics++ has been tested on manipulated files; a printed photograph is an unmanipulated image of a real face, so the detector has no reason to flag it. The face embedding that the comparison step computes is equally indifferent: it matches the face it is given, whether that face arrived on paper, on a screen or in an injected stream.

The comparison step has the best public evidence of the three, because NIST's FRTE reports the false non-match rate at a threshold set for a specified false match rate across hundreds of algorithms on operational images, and the NIST FRTE pages explain how to read it. A deployment's accuracy claim that quotes only that number has described one box of four.