Liveness detection: what it is, how it works and how it is tested

This page is part of the deepfake detection hub. It defines the task, separates it from face matching and from deepfake detection, and explains how a liveness system is tested; the liveness and injection attacks page covers the attack that bypasses the camera altogether.

01What is liveness detection?

In the vocabulary of ISO/IEC 30107, a presentation attack is a "presentation to the biometric capture subsystem with the goal of interfering with the operation of the biometric system", and presentation attack detection, or PAD, is "automated discrimination between bona-fide presentations and biometric presentation attacks". Liveness detection is the everyday name for PAD on a face camera. The object used to attack is a presentation attack instrument, defined as a "biometric characteristic or object used in a presentation attack"; a printed photograph, a replayed video on a phone and a silicone mask are the common instruments for faces.

The decision is binary and it is made before any identity is checked. A liveness system does not ask who is in front of the camera; it asks whether what the camera sees came from a live human present at that moment. The face verification metrics page covers the second question, which the standard treats as a separate measurement with separate error rates.

02How does liveness detection differ from deepfake detection?

Both answer a real-or-not question about a face, and they answer it about different objects. A liveness check runs at capture time on a live camera stream and decides whether the presentation is bona fide. A deepfake detector runs on a recorded image or video, often long after capture, and decides whether the content was manipulated. ISO/IEC 30107-3 covers only the first: its catalogue abstract states that "the attacks considered in this document take place at the biometric capture device during presentation" and that any other attack is outside its scope.

That boundary matters for an identity check built around a phone camera. A deepfake fed into the system as a virtual camera feed never passes through the capture device, so it is not a presentation attack under the standard, and a liveness score says nothing about it. Both checks are needed in such a flow, and the bridge page on this site, from face recognition to deepfake detection, explains why they share a pipeline and still measure different things.

03How does a liveness check work?

Methods divide by what they ask of the user. Active liveness asks for an action, such as turning the head or following a dot, and checks that the response is consistent with a three-dimensional moving face. Passive liveness asks for nothing and analyses the frames the camera already captured. The OULU-NPU database's baseline is a passive method of the texture kind: it takes ten frames per video, extracts local binary pattern histograms from 64 by 64 face crops in the YCbCr and HSV colour spaces, and averages the classifier's scores over the ten frames (OULU-NPU project page).

The standard itself takes no position on method. Its abstract lists "detailed information about countermeasures (i.e. anti-spoofing techniques), algorithms or sensors" among the topics outside its scope, so a product can satisfy ISO/IEC 30107-3 with any approach, provided the test is run and reported as the standard describes. What is standardised is the measurement, not the mechanism.

04How is liveness detection tested under ISO/IEC 30107-3?

ISO/IEC 30107-3:2023 is a 39-page standard published in January 2023 by ISO/IEC JTC 1/SC 37, the biometrics committee, and it replaces the 2017 first edition (ISO/IEC 30107-3:2023). Its abstract says it establishes "principles and methods for the performance assessment of presentation attack detection (PAD) mechanisms", the reporting of test results, and "a classification of known attack types (Annex A)". Two error rates carry the result. APCER, the attack presentation classification error rate, is the proportion of attack presentations using one kind of instrument that the system wrongly accepts as bona fide. BPCER, the bona fide presentation classification error rate, is the proportion of genuine presentations that the system wrongly rejects as attacks.

APCER is reported per instrument type, called a PAI species, because a system that stops prints may still pass replays. The standard's reporting convention is BPCER at a fixed APCER: a report of the BPCER when APCER is 5 percent is written BPCER20, the 20 being one over 0.05. The SC 37 working group material on the standard advises against summarising a PAD test with a single equal error rate or half total error rate, since those hide the operating point a deployment would use. A deployment reads the pair together: a low APCER with a high BPCER turns away genuine users; the reverse admits attacks.

The companion standard for the matching stage, ISO/IEC 19795-1:2021, measures error and throughput rates of biometric systems and explicitly excludes "people deliberately trying to subvert the intended operation of the biometric system (e.g. by presentation attacks)" (ISO/IEC 19795-1:2021). A full face verification report therefore carries both: false match and false non-match rates from 19795-1, APCER and BPCER from 30107-3.

05What do the public benchmarks test?

OULU-NPU (FG 2017) is the reference academic set for mobile face liveness. It holds 4,950 real access and attack videos of 55 subjects, recorded with the front cameras of six phones in three sessions with different lighting and backgrounds, with print attacks from two printers and video-replay attacks from two displays. The subjects are split into disjoint training, development and test sets, and four protocols test generalisation: to an unseen session, to an unseen printer or display, to an unseen camera (leave one camera out across the six phones), and to all three at once. Access is by a signed licence agreement from an institutional address.

The protocol design is the same idea the deepfake benchmarks arrived at later. A liveness model trained on one phone, one printer and one room can score well on more of the same and fail on a new phone; the cross-dataset drop by detector page lists how much deepfake detectors lose under the equivalent change of dataset. The quotable caveat for both fields is the same: no single benchmark score predicts how a system performs against instruments or generators outside its test.

06What liveness detection does not do

It does not identify anyone, verify a document, or judge a recording made elsewhere. A liveness pass means the capture looked like a live presentation at that device at that moment, measured against the instrument types in the test, and the result is only as broad as the species listed in the APCER report. It also says nothing about speech: the deepfake voice page covers how cloned audio is benchmarked, and the human or AI page covers what unaided viewers manage on faces and video, which a live check is designed to replace rather than imitate.

A vendor's ISO 30107-3 letter covers one tested configuration; the what an ISO 30107-3 letter means page reads one line by line.