{"id":8,"date":"2026-10-14T20:39:27","date_gmt":"2026-10-14T11:39:27","guid":{"rendered":"https:\/\/tech.swallow-incubate.com\/en\/?p=8"},"modified":"2026-10-14T20:40:31","modified_gmt":"2026-10-14T11:40:31","slug":"presentation-attack-types","status":"publish","type":"post","link":"https:\/\/tech.swallow-incubate.com\/en\/liveness\/presentation-attack-types\/","title":{"rendered":"Types of Presentation Attacks on Face Recognition \u2014 and Which Ones Are Realistic Threats"},"content":{"rendered":"

In our previous experiment<\/a>, we confirmed that plain face recognition can be defeated with a printed photo. So what other kinds of spoofing attacks are there, and how realistic is each one?<\/p>\n

When you design a face recognition system, the starting point is not “block every attack.” It is deciding which attacks your system needs to withstand, given what it is used for<\/strong>. This article organizes the attack types to help you make that call.<\/p>\n

\n

Terminology: presentation attacks and PAD<\/h2>\n

An attack that impersonates someone by presenting<\/strong> a fake \u2014 a photo, a screen, a mask \u2014 to the camera is called a presentation attack<\/strong>. The technology that detects it is PAD (Presentation Attack Detection)<\/strong>, also known as liveness detection<\/strong>. This terminology follows the framework used in ISO\/IEC 30107, the international standard series on biometric presentation attack detection.<\/p>\n

Attacks that bypass the camera and inject fake data directly into the system<\/strong> (injection attacks) are a separate class of threat, and they are where deepfakes are most often used. This article focuses on attacks that are shown to the camera.<\/p>\n

Presentation attack: \"show\" a fake to the camera     -> covered by PAD (liveness detection)\nInjection attack:    bypass the camera, inject data   -> covered by channel and device protection\n<\/code><\/pre>\n
\n
Five types of attack<\/h2>\n
1. Print attack<\/h3>\n
The attacker holds a printed photo of the target’s face up to the camera. This is the oldest and cheapest attack<\/strong>: all it takes is a printer. The photo itself is often published by the target on social media, so it is easy to obtain. As our experiment showed<\/a>, face recognition without liveness detection cannot stop it.<\/p>\n
2. Display attack (still image)<\/h3>\n
The attacker shows a photo of the face on a smartphone or tablet screen. No printing is required, so it can be done on the spot. Moir\u00e9 patterns and screen reflections are possible clues, but spotting them is not the face recognition model’s job \u2014 so plain face recognition lets it through as well.<\/p>\n
3. Replay attack (video)<\/h3>\n
The attacker plays a video of the target’s face on a screen. Unlike a still image, the video contains blinking and head movement<\/strong>, which can defeat simple challenge-based liveness checks such as “blink and you are real.” Video material, too, can be obtained when the target has published it.<\/p>\n
4. 3D mask attack<\/h3>\n
The attacker wears a three-dimensional mask modeled on the target’s face. Because a mask has real depth, it can fool some depth-based defenses. However, a convincing mask requires significant cost and the target’s 3D face shape, so the attack cost is roughly an order of magnitude higher<\/strong>. It is only worth it against high-value targets.<\/p>\n
5. Deepfakes<\/h3>\n
The attacker uses AI-generated or AI-manipulated face images and video. A deepfake can be shown on a screen as a presentation attack, or fed through a virtual camera as an injection attack. The latter needs system-wide defenses, not liveness detection alone. Generation costs are falling every year, making this the fastest-moving area<\/strong> of the threat landscape.<\/p>\n
\n
Attack cost vs. likelihood<\/h2>\n\n\n\n\n\n\n\n\n\n
Attack<\/th>\nAttack cost<\/th>\nHow easy the material is to obtain<\/th>\nLikelihood (our view)<\/th>\n<\/tr>\n<\/thead>\n
1. Print<\/td>\nVery low<\/strong><\/td>\nOften available on social media<\/td>\nHigh<\/strong> \u2014 defend against first<\/td>\n<\/tr>\n
2. Display (still image)<\/td>\nVery low<\/strong><\/td>\nSame as above<\/td>\nHigh<\/strong> \u2014 same as above<\/td>\n<\/tr>\n
3. Replay (video)<\/td>\nLow<\/td>\nPossible if public video exists<\/td>\nMedium<\/td>\n<\/tr>\n
4. 3D mask<\/td>\nHigh<\/strong> (fabrication, 3D shape data)<\/td>\nDifficult<\/td>\nLow \u2014 limited to high-value targets<\/td>\n<\/tr>\n
5. Deepfake (shown on a screen)<\/td>\nMedium to low (falling)<\/td>\nCan be generated from photos<\/td>\nMedium \u2014 increasing<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
The key point: the size of a threat is set by how easy the attack is to carry out, not by how sophisticated it is<\/strong>. The attacks to worry about most are not elaborate 3D masks, but types 1 and 2 \u2014 which anyone can carry out today.<\/p>\n
\n
How far to defend depends on the use case<\/h2>\n
Every defense you add costs money and adds friction for users. The deciding question is: if impersonation succeeds, who gains, and how much?<\/strong><\/p>\n\n\n\n\n\n\n\n\n
Example use case<\/th>\nMotive for impersonation<\/th>\nWhere to draw the line (one way to think about it)<\/th>\n<\/tr>\n<\/thead>\n
Time and attendance<\/td>\nBuddy punching (clocking in for someone else)<\/td>\n1 and 2 are a must; covering 3 makes it robust<\/td>\n<\/tr>\n
Door access and facility management<\/td>\nUnauthorized entry<\/td>\n1, 2 and 3 are a must; consider 4 depending on what is protected<\/td>\n<\/tr>\n
Logins to clinical and business systems<\/td>\nMisuse of privileges<\/td>\n1, 2 and 3 are a must<\/td>\n<\/tr>\n
eKYC \/ remote identity verification and account opening<\/td>\nDirect financial gain<\/td>\nAssume 1 through 5, plus defenses against injection attacks<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
Try writing down, for your own system, what would happen if a printed photo got through. The level of defense you need usually becomes clear.<\/p>\n
\n
Measure the effect with accuracy metrics<\/h2>\n
When you evaluate liveness detection, look for numbers<\/strong>, not the words “it blocks attacks.” The field has its own accuracy metrics, defined in ISO\/IEC 30107-3:<\/p>\n