In our previous experiment, we confirmed that plain face recognition can be defeated with a printed photo. So what other kinds of spoofing attacks are there, and how realistic is each one?
When you design a face recognition system, the starting point is not “block every attack.” It is deciding which attacks your system needs to withstand, given what it is used for. This article organizes the attack types to help you make that call.
Terminology: presentation attacks and PAD
An attack that impersonates someone by presenting a fake — a photo, a screen, a mask — to the camera is called a presentation attack. The technology that detects it is PAD (Presentation Attack Detection), also known as liveness detection. This terminology follows the framework used in ISO/IEC 30107, the international standard series on biometric presentation attack detection.
Attacks that bypass the camera and inject fake data directly into the system (injection attacks) are a separate class of threat, and they are where deepfakes are most often used. This article focuses on attacks that are shown to the camera.
Presentation attack: "show" a fake to the camera -> covered by PAD (liveness detection)
Injection attack: bypass the camera, inject data -> covered by channel and device protection
Five types of attack
1. Print attack
The attacker holds a printed photo of the target’s face up to the camera. This is the oldest and cheapest attack: all it takes is a printer. The photo itself is often published by the target on social media, so it is easy to obtain. As our experiment showed, face recognition without liveness detection cannot stop it.
2. Display attack (still image)
The attacker shows a photo of the face on a smartphone or tablet screen. No printing is required, so it can be done on the spot. Moiré patterns and screen reflections are possible clues, but spotting them is not the face recognition model’s job — so plain face recognition lets it through as well.
3. Replay attack (video)
The attacker plays a video of the target’s face on a screen. Unlike a still image, the video contains blinking and head movement, which can defeat simple challenge-based liveness checks such as “blink and you are real.” Video material, too, can be obtained when the target has published it.
4. 3D mask attack
The attacker wears a three-dimensional mask modeled on the target’s face. Because a mask has real depth, it can fool some depth-based defenses. However, a convincing mask requires significant cost and the target’s 3D face shape, so the attack cost is roughly an order of magnitude higher. It is only worth it against high-value targets.
5. Deepfakes
The attacker uses AI-generated or AI-manipulated face images and video. A deepfake can be shown on a screen as a presentation attack, or fed through a virtual camera as an injection attack. The latter needs system-wide defenses, not liveness detection alone. Generation costs are falling every year, making this the fastest-moving area of the threat landscape.
Attack cost vs. likelihood
| Attack | Attack cost | How easy the material is to obtain | Likelihood (our view) |
|---|---|---|---|
| 1. Print | Very low | Often available on social media | High — defend against first |
| 2. Display (still image) | Very low | Same as above | High — same as above |
| 3. Replay (video) | Low | Possible if public video exists | Medium |
| 4. 3D mask | High (fabrication, 3D shape data) | Difficult | Low — limited to high-value targets |
| 5. Deepfake (shown on a screen) | Medium to low (falling) | Can be generated from photos | Medium — increasing |
The key point: the size of a threat is set by how easy the attack is to carry out, not by how sophisticated it is. The attacks to worry about most are not elaborate 3D masks, but types 1 and 2 — which anyone can carry out today.
How far to defend depends on the use case
Every defense you add costs money and adds friction for users. The deciding question is: if impersonation succeeds, who gains, and how much?
| Example use case | Motive for impersonation | Where to draw the line (one way to think about it) |
|---|---|---|
| Time and attendance | Buddy punching (clocking in for someone else) | 1 and 2 are a must; covering 3 makes it robust |
| Door access and facility management | Unauthorized entry | 1, 2 and 3 are a must; consider 4 depending on what is protected |
| Logins to clinical and business systems | Misuse of privileges | 1, 2 and 3 are a must |
| eKYC / remote identity verification and account opening | Direct financial gain | Assume 1 through 5, plus defenses against injection attacks |
Try writing down, for your own system, what would happen if a printed photo got through. The level of defense you need usually becomes clear.
Measure the effect with accuracy metrics
When you evaluate liveness detection, look for numbers, not the words “it blocks attacks.” The field has its own accuracy metrics, defined in ISO/IEC 30107-3:
- APCER (Attack Presentation Classification Error Rate) — the share of attack samples wrongly accepted as live. Lower means stronger against attacks.
- BPCER (Bona Fide Presentation Classification Error Rate) — the share of genuine live faces wrongly rejected as attacks. Lower means better usability.
The two are a trade-off, so looking at only one of them tells you little. They also need to be read together with the test conditions — which attack samples were used, and how many.
Summary
- Presentation attacks are easiest to reason about as five types: print, display, video replay, 3D mask, and deepfake.
- The size of a threat is driven by how easy it is to carry out, not how sophisticated it is. The top priorities are print and display attacks, which anyone can carry out today.
- How far to defend depends on the use case. Work backward from who gains, and how much, if impersonation succeeds.
- Evaluate defenses with numbers such as APCER and BPCER, together with their test conditions — not with the words “it blocks attacks.”
To check item by item how far your system should go → Face Anti-Spoofing Design Checklist: 12 Items to Review Before Production
Add liveness detection with one REST API call
Our Liveness Detection API tells your face recognition or eKYC flow whether a live person is in front of the camera — from a single still image. Start with the Free plan (50 calls per month).