Passive vs active liveness detection: what each check can and cannot prove

This page is part of the deepfake detection hub and narrows the liveness detection page to one choice: whether the check asks the user to do anything. Both approaches sit inside presentation attack detection as ISO/IEC 30107 defines it, and both inherit its boundary.

01What counts as liveness detection under ISO/IEC 30107?

ISO/IEC 30107-1:2023 defines presentation attack detection as "automated discrimination between bona-fide presentations and biometric presentation attacks", and places liveness inside it: "Liveness detection methods are a subset of presentation attack detection methods". It also fixes the scope: "The attacks to be considered in this document are those that take place at the capture device during the presentation" (ISO/IEC 30107-1:2023). Part 3, the testing part, repeats the boundary: "The attacks considered in this document take place at the biometric capture device during presentation" (ISO/IEC 30107-3:2023).

The standard does not split liveness into passive and active. It lists method families instead and leaves the mechanics to vendors. The passive and active labels come from practice, and the clearest primary description of them is in the ENISA report, which surveyed identity proofing providers across the EU.

02What does passive liveness read?

Passive liveness reads the frames and nothing else. ENISA describes it as a check where "the AI relies exclusively on verification techniques that require no user action, such as inconsistencies in resolution resulting from deepfake manipulation, flashing lights on the subject to analyse reflections on the applicant's face and surroundings, analysing microvariations in the intensity of skin colour due to pulses of blood and other involuntary human signals" (ENISA, Remote Identity Proofing). The user still aligns their face in an oval; after that the system decides alone.

The report's countermeasures chapter lists the signals in more detail: "facial expression, face warping artefacts and resolution inconsistencies resulting from a deepfake production pipeline", missing blinking, poorly generated eyes or teeth, and the blood pulse that "a physical reproduction of a face is usually not able to represent". It also records a limit on the flashed-colour variant: "some of the stakeholders consulted claim it is possible to generate semi-transparent colours instantly on the deepfake puppet, defeating this liveness method". A passive check proves that the frames carry the signals of a live face, not where the frames came from.

03What does active liveness ask for?

Active liveness adds a challenge. In ENISA's words, "the user must align their face with the camera, typically in an oval or a reticle, and is then asked to perform specific actions in response to challenges such as nodding, blinking, smiling, reading random words, following an object moving on the screen, getting their face closer or farther from the camera, turning their head left or right on command, or waving a hand in front of their face. The response must match what is challenged" (ENISA, Remote Identity Proofing).

The challenge proves something a passive check cannot: that whoever is in the frames can respond to a prompt chosen at that moment. A pre-recorded video cannot turn left on command. The report notes that many providers "believe that the active liveness approach further increases the difficulty and cost of fraud", and the price: "users can get frustrated by the challenge-response nature of the process, which in turn leads to abandonment rates". ENISA's own summary is that "The two approaches therefore differ in the active or passive participation of the user but not in the evaluation of the result".

04How are both tested, and on what data?

Both families are tested under ISO/IEC 30107-3 with two error rates. APCER is the "proportion of attack presentations using the same PAI species incorrectly classified as bona fide presentations in a specific scenario" and BPCER the "proportion of bona fide presentations incorrectly classified as attack presentations in a specific scenario", in the wording of the SC37 working group slides that quote the standard. The presentation attack detection page on this site covers the reporting conventions, including BPCER at a fixed APCER.

The public benchmarks test passive methods, because a dataset cannot issue a live challenge. OULU-NPU holds "4950 real access and attack videos" of 55 subjects, "recorded using the front cameras of six mobile devices", with print and video-replay attacks and four protocols that hold out a session, an attack instrument, a camera, or all three (OULU-NPU). On its Protocol 1, the CVPR 2018 anti-spoofing method of Liu, Jourabloo and Liu reports APCER 1.6 percent, BPCER 1.6 percent and ACER 1.6 percent, and on Protocol 4, the hardest, ACER 9.5 ± 6.0 percent (arXiv 1803.11097). Every attack in that set was held up to a camera. None was injected.

05Why does neither approach see an injected stream?

Because both read frames after they arrive, and an injection attack supplies the frames. ENISA explains that "video injection is the most promising attack method, according to market players. It is not a presentation attack instrument", but "a way to circumvent the cam of the device used to perform the remote identity proofing". There are "only two ways of getting into the system: either by being presented to the camera or by being directly injected into the camera flow", and "Deepfake videos and interactive deepfake puppets can now be created in real-time". A real-time puppet answers an active challenge: the attacker turns left, and the victim's face turns left in the injected feed. A passive check reads the puppet's frames for texture and blood pulse; ENISA notes that recreating the pulse effect in video "is also not trivial", and in the same chapter that the flashed-colour check can already be defeated, by the account of some stakeholders.

The standards bodies have drawn the line the same way. ISO/IEC 30107 covers attacks "at the capture device during the presentation", so an injected stream is out of its scope. CEN/TS 18099:2024, "Biometric data injection attack detection", valid from 16 December 2024, exists to fill the gap and lists "Presentation Attack testing (as they are covered in ISO/IEC 30107 standards)" as out of its own scope (CEN/TS 18099:2024). ENISA's conclusion names "the deepfake attack presented via video injection or high fidelity screens" as the last frontier and says the industry "lacks a clear framework for the type of testing needed" for injection defences. The injection attack test gap page follows that standard and the report in detail.

06What closes the gap?

Not a third kind of liveness, but a check on the device. ENISA records that both approaches "require verification that the device is physical hardware, not an emulator, and that the camera is indeed capturing the video feed in real time", and that a dedicated application can act "to make sure it is not an emulator, to prevent the injection of video and audio, and to measure the behaviour of the video feed". Deployments, the report says, "often involve a mixed approach that combines the strengths of both these techniques and on-device security checks of the camera feed".

A puppet is a reenactment, the kind the reenactment methods explained page describes, and a deepfake detector run on the frames is the one check that reads the content rather than the capture. Its published scores, and the scope of the word set out on the research definitions of deepfake page, are the terms on which that last check is judged. The state deepfake statutes table shows that no statute yet requires any of these checks.

Where each mode sits in a remote identity check is covered on the what identity verification standards test page.