{"id":9,"date":"2026-10-14T20:39:28","date_gmt":"2026-10-14T11:39:28","guid":{"rendered":"https:\/\/tech.swallow-incubate.com\/en\/?p=9"},"modified":"2026-10-14T20:40:31","modified_gmt":"2026-10-14T11:40:31","slug":"anti-spoofing-checklist","status":"publish","type":"post","link":"https:\/\/tech.swallow-incubate.com\/en\/liveness\/anti-spoofing-checklist\/","title":{"rendered":"Face Anti-Spoofing Design Checklist: 12 Items to Review Before Production"},"content":{"rendered":"

When you build face recognition into a business system and only check whether the face matches, it can be defeated with a printed photo<\/a>. This article turns the anti-spoofing points you should review before running face recognition in production into a checklist that keeps gaps out of your design and procurement<\/strong>.<\/p>\n

If you cannot check off an item, follow the linked article or the explanation under it for the background.<\/p>\n

\n

What is face spoofing \u2014 and what do you need to detect to stop it?<\/h2>\n

Face spoofing<\/strong> is an attempt by someone other than the enrolled user to pass face recognition by showing the camera a photo, a screen, or a video of the user’s face. The technical term is presentation attack<\/strong> (see Types of Presentation Attacks on Face Recognition<\/a>).<\/p>\n

Face recognition decides whether a face belongs to the same person as the enrolled one, so a photo still matches as long as the user’s face is in it (see our experiment<\/a>). To stop spoofing, you therefore add a separate component that decides whether what is in front of the camera is a live person or a fake: liveness detection (PAD)<\/strong>.<\/p>\n

Three approaches to liveness detection<\/h3>\n\n\n\n\n\n\n\n
Approach<\/th>\nHow it works<\/th>\nBurden on the user<\/th>\nWatch out for<\/th>\n<\/tr>\n<\/thead>\n
Active (challenge-response)<\/td>\nAsks the user to blink, turn their head, or speak, and checks the response<\/td>\nHigh (the user must follow instructions)<\/td>\nIf it only checks that something moved, a replayed video can reproduce the motion<\/td>\n<\/tr>\n
Dedicated sensors<\/td>\nUses depth or infrared cameras to check 3D shape or material<\/td>\nLow<\/td>\nRequires special hardware; cannot be added to existing standard cameras<\/td>\n<\/tr>\n
Passive, single frame<\/td>\nA trained model decides live or fake from one ordinary camera image<\/td>\nNone (just take the picture)<\/td>\nAccuracy depends on the model; check APCER \/ BPCER together with the test conditions<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Whichever approach you choose, the rule is to decide based on the attacks you expect in your use case and on numbers (APCER \/ BPCER)<\/strong> \u2014 not on the words “it blocks attacks.” The 12 items below make sure that decision is made without gaps during design and procurement.<\/p>\n

\n

A. Define your threat model<\/h2>\n

\u2610 1. Have you written down who gains \u2014 and how much \u2014 if impersonation succeeds?<\/strong>
\nThe right level of defense depends on the use case: time-and-attendance and account opening need very different lines of defense. Start by putting your system’s attacker motive into words. \u2192 Types of Presentation Attacks<\/a><\/p>\n

\u2610 2. Have you decided which attack types to defend against?<\/strong>
\nPrint, display, video replay, 3D mask, deepfake \u2014 defending against everything means over-investing. Treat print and display attacks<\/strong> (which anyone can carry out today) as the minimum. \u2192 Attack cost vs. likelihood<\/a><\/p>\n

\u2610 3. Have you considered injection attacks, not just attacks shown to the camera?<\/strong>
\nFor high-value systems such as financial services, also assume attacks that bypass the camera and inject video directly. These are covered by channel and device protection, not by liveness detection alone.<\/p>\n

\n

B. Add liveness detection as a separate component<\/h2>\n

\u2610 4. Have you designed face matching and liveness detection as separate functions?<\/strong>
\nFace matching answers “whose face is this?”; liveness detection answers “live person or fake?” They are different technologies<\/strong>. A matching face does not mean a live person. \u2192 Why face recognition is fooled by a photo<\/a><\/p>\n

\u2610 5. Do you know how your chosen liveness approach can be defeated?<\/strong>
\nBlink challenges, motion challenges and depth cameras each have a weak point \u2014 video replay, injection, and 3D masks respectively. Choose an approach with its limits in mind.<\/p>\n

\u2610 6. Have you decided between asking users to perform actions and a passive (no-action) check?<\/strong>
\nChallenge-response hurts the user experience and puts a burden on older users and users with disabilities. A passive, single-frame check works without asking the user to do anything.<\/p>\n

\n

C. Evaluate accuracy with numbers<\/h2>\n

\u2610 7. Have you checked APCER and BPCER as a pair, together with the test conditions?<\/strong>
\nA single number, or a number without its conditions, cannot be evaluated. Always read it together with the presentation attack instruments (PAIs) used \u2014 print, screen, mask and so on \u2014 and the sample counts. \u2192 APCER and BPCER explained<\/a><\/p>\n

\u2610 8. Have you distinguished an internal evaluation based on ISO metrics from independent third-party testing?<\/strong>
\n“An internal evaluation using the metrics defined in ISO\/IEC 30107-3” and testing by an independent accredited lab (for example, ISO\/IEC 30107-3 PAD conformance testing, or FIDO Biometric Component Certification) mean different things. Check how the vendor’s product page phrases it.<\/p>\n

\u2610 9. Have you measured it in your own operating environment (camera, lighting, distance)?<\/strong>
\nPublished figures reflect the vendor’s test conditions. Results change with your actual cameras, lighting and capture distance. Validate in your own environment before you deploy.<\/p>\n

\n

D. Fit your operating environment<\/h2>\n

\u2610 10. Is sending face images to an external service allowed in your environment?<\/strong>
\nIf you use a cloud API, check where images are processed, whether they are stored, and whether a Data Processing Agreement (DPA) is available. Some environments do not allow face images to leave the premises at all. Face images may also be regulated as biometric data in your jurisdiction (for example under GDPR in the EU or BIPA in Illinois), so involve your privacy or legal team early.<\/p>\n

\u2610 11. Does the round trip fit your latency budget \u2014 and have you decided what happens on a timeout?<\/strong>
\nMeasure the end-to-end response time from your own network, not just the vendor’s stated target. Decide in advance whether a failed or timed-out check blocks the user (fail closed) or is retried.<\/p>\n

\u2610 12. Do you send the whole camera frame, not a face crop?<\/strong>
\nCues such as paper edges, screen bezels, reflections and the background around the face are part of what a single-frame model looks at. Cropping the image down to the face rectangle before sending it throws those cues away. Also check image brightness and resolution in your real capture conditions. \u2192 Example: our API’s image guidelines<\/a><\/p>\n

\n

Index: background articles for this checklist<\/h2>\n\n\n\n\n\n\n
Topic<\/th>\nArticle<\/th>\n<\/tr>\n<\/thead>\n
Face recognition is fooled by a photo (experiment)<\/td>\nWe Built Face Recognition with OpenCV \u2014 and a Printed Photo Got Right Through<\/a><\/td>\n<\/tr>\n
Attack types, threat levels and accuracy metrics<\/td>\nTypes of Presentation Attacks on Face Recognition \u2014 and Which Ones Are Realistic Threats<\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
\n

Summary<\/h2>\n
    \n
  • Anti-spoofing starts where “does the face match?” ends. Design in four stages without gaps: threat model \u2192 liveness approach \u2192 accuracy evaluation \u2192 operating environment<\/strong>.<\/li>\n
  • The minimum line is rejecting print and display attacks<\/strong>. This is required whatever the use case.<\/li>\n
  • Read accuracy as APCER and BPCER, as a pair, with test conditions<\/strong> \u2014 and measure in your own environment.<\/li>\n
  • Whether images may leave your environment, how much latency you can afford, and how you capture the image decide whether a deployment succeeds just as much as accuracy does.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"

    A 12-item face anti-spoofing checklist to review before production: threat model, liveness detection approach, APCER\/BPCER, and operating environment.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-9","post","type-post","status-publish","format-standard","hentry","category-liveness"],"_links":{"self":[{"href":"https:\/\/tech.swallow-incubate.com\/en\/wp-json\/wp\/v2\/posts\/9","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tech.swallow-incubate.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tech.swallow-incubate.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tech.swallow-incubate.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tech.swallow-incubate.com\/en\/wp-json\/wp\/v2\/comments?post=9"}],"version-history":[{"count":2,"href":"https:\/\/tech.swallow-incubate.com\/en\/wp-json\/wp\/v2\/posts\/9\/revisions"}],"predecessor-version":[{"id":15,"href":"https:\/\/tech.swallow-incubate.com\/en\/wp-json\/wp\/v2\/posts\/9\/revisions\/15"}],"wp:attachment":[{"href":"https:\/\/tech.swallow-incubate.com\/en\/wp-json\/wp\/v2\/media?parent=9"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tech.swallow-incubate.com\/en\/wp-json\/wp\/v2\/categories?post=9"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tech.swallow-incubate.com\/en\/wp-json\/wp\/v2\/tags?post=9"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}