Deepfake injection attacks: virtual cameras and what tests exist

This page belongs to the liveness and identity verification strand of the deepfake detection hub. It takes the second attack class from the liveness and injection overview and follows it through the standards and the one public agency study that describes it.

01What is a deepfake injection attack?

In a remote identity check the camera captures a face, the device passes the frames to an application, and the application sends them to a service that runs liveness detection and face matching. An injection attack replaces the frames somewhere after the sensor. The European Union Agency for Cybersecurity (ENISA) describes video injection as "a way to circumvent the cam of the device used to perform the remote identity proofing", and states that it "is not a presentation attack instrument, as the video will be injected and not physically presented to the camera" (ENISA, 2022).

The injected video can be anything, but the combination that matters is a deepfake. ENISA's report puts it in one sentence: deepfake attacks have "only two ways of getting into the system: either by being presented to the camera or by being directly injected into the camera flow". A face swap played on a phone screen in front of the camera is a presentation attack and leaves screen artefacts in the frames. The same face swap injected as a stream leaves none, because no camera ever filmed it.

02How does the injected video reach the application?

The report names the routes in its scope statement without describing them: injecting video into a camera feed, virtual camera software, emulators. A virtual camera is a driver that registers with the operating system as a capture device and serves frames from a file or another program, so any application that asks the system for "the camera" receives them. An emulator runs the whole device in software, with a synthetic camera built in. A modified application or an intercepted connection replaces the frames later, between the capture and the service.

ENISA lists the matching countermeasure. Running the check "exclusively through a dedicated application" lets a provider inspect the device "to make sure it is not an emulator, to prevent the injection of video and audio, and to measure the behaviour of the video feed". That is an integrity check on the capture path, not an analysis of the face. Where the path cannot be attested, as in a web browser, what remains is analysis of the frames themselves, which is a deepfake detection problem with the published limits set out on the five detection benchmarks side by side page.

03Why do presentation attack tests not cover it?

ISO/IEC 30107 is the standard series behind liveness conformance claims, and it draws its boundary at the sensor. Part 1 (2023) states that "the attacks to be considered in this document are those that take place at the capture device during the presentation". Part 3 (2023), the testing and reporting part, repeats the limit: "the attacks considered in this document take place at the biometric capture device during presentation" (ISO/IEC 30107-3:2023). Its error rates, explained on the APCER and BPCER explained page, are defined per presentation attack instrument species: a printed photograph, a replayed video, a mask. An injection has no instrument species, because nothing is presented.

The consequence for reading a certificate is direct. A conformance report under ISO/IEC 30107-3 states how often the presentation attack instruments tried were accepted and how often genuine users were rejected, for one tested configuration. It says nothing about a stream substituted behind the camera, and a product can hold such a letter while being open to injection. ENISA's stakeholders said as much in 2022: "the industry lacks a clear framework for the type of testing needed to determine whether different approaches to injection attacks can be effectively deterred".

04What does CEN/TS 18099:2024 cover?

CEN/TS 18099:2024, "Biometric data injection attack detection", is a European technical specification published by CEN in late 2024; the Estonian catalogue lists it as valid from 16 December 2024 and the British adoption, PD CEN/TS 18099:2024, as published on 30 November 2024 (EVS catalogue). Its scope, as the catalogue prints it, is an overview of definitions of biometric data injection attack, of use cases "on main biometric system hardware for enrolment and verification", and of injection attack instruments, with guidance on detection systems, on mitigating the risk from those instruments, and on "creation of test plan for the evaluation of Injection Attack Detection system".

The boundary with the ISO series is explicit. Presentation attack testing is out of scope "as they are covered in ISO/IEC 30107 standards", as are attacks not classified as Type 2 in its Figure 1, evaluation of cryptographic mechanisms such as secure elements, and injection instruments rejected for quality reasons. One presentation test does stay in: bona fide presentation testing, "in order to test the ability of the Target Of Evaluation to correctly classify legitimate users", which is the injection equivalent of BPCER. The specification is a technical specification rather than a full standard, its text is paywalled, and this page states nothing about its error-rate definitions.

05What has been measured, and what has not

No peer-reviewed benchmark, no public leaderboard and no agency evaluation reports detection rates for injection attacks. The datasets this site tracks score detectors on files; an injection is a path, and the path differs by operating system, device, browser and application, so there is no object a laboratory can film and share. ENISA's 2022 report is the closest public measurement and it is qualitative: a survey, interviews and a workshop with providers, users and researchers. It records that "video injection is the most promising attack method, according to market players", that "in recent years, the number of attacks with masks and video injection has been increasing", and that "deepfake videos and interactive deepfake puppets can now be created in real-time".

What a deepfake detector adds to a verification flow is therefore the only measurable layer, and its numbers come from file benchmarks. Detectors trained on curated fakes fall toward chance on unseen generators and on re-encoded clips, and an injected stream is both: a current generator, delivered live. The same holds for voice, where ENISA notes that a deepfake "can even simulate a different voice" and where the lab-to-world audio test measured detectors rising from 1.2 to 33.9 percent equal error rate at best. A human operator on the call is not a control either: the crowd versus model study found individuals near 66 to 69 percent on deepfake videos with no context to reason from.

06What to ask of an injection detection claim

A claim should name the specification it was tested against and the laboratory, because CEN/TS 18099:2024 is the only published test framework and it dates from late 2024. It should list the injection attack instruments tried, in the specification's vocabulary, since a result against one virtual camera on one operating system does not transfer. It should report the bona fide classification rate alongside the detection rate, because a check that rejects genuine users has not solved anything. And it should state the capture configuration: a dedicated application with device attestation and a browser session are different products.

ENISA's conclusion in 2022 was that the main attacks on remote identity proofing were "low-tech, low-probability of success", but that "the last frontier can be considered the deepfake attack presented via video injection or high fidelity screens". Nearly five years on, the test framework exists and the public numbers do not.