A deepfake in liveness detection is the use of synthetic video as the content of a biometric attack. A deepfake does not bypass liveness on its own; it bypasses liveness when a compromised channel delivers it to the SDK without passing through the physical camera. The delivery vector determines which control must block it.
This post explains what a deepfake is in the technical context of biometric authentication, how the same synthetic content can be used in two technically distinct types of attack, and which security layer addresses each one.
What is a deepfake in the context of biometric authentication?
A deepfake is synthetic video generated by an artificial intelligence model using the face of a real person. In biometric authentication, the deepfake is the attack content—the raw material. The vector is the method used to deliver that content to the verification system.
This distinction matters because the same deepfake can be used in technically opposite ways: displayed on a screen in front of the physical camera, or injected directly into the data channel before the SDK (software development kit) receives any frame. The content can be identical in both cases. What changes is where the attack enters—and what must block it.
Real-time deepfake generation tools run on consumer GPUs and are publicly available. An attacker with public photos or videos of an account holder can generate a synthetic stream of the target face with enough quality to fool visual checks. The limiting factor for a successful attack is no longer deepfake quality; it is the delivery method.
How does liveness assess a deepfake presented physically?
Low-friction liveness (biometric liveness detection) analyzes incoming frames for signs of artifacts: screen texture, a moiré pattern, paper edges, screen reflections, a lack of three-dimensional depth, and other indicators the analysis can identify. A deepfake displayed on a screen and presented to the camera is a presentation attack to the liveness module—the same type of attack as a printed photo or a 2D mask.
The certification that documents resistance to this vector is ISO/IEC 30107-3 (PAD, Presentation Attack Detection). The iBeta laboratory certified Fortface at Level 1 and Level 2 under this standard in 2024. At Level 1, 1,800 attacks were tested with an APCER of 0%. At Level 2, 1,500 attacks using advanced artifacts—silicone masks, 3D prosthetics, and realistic mannequins—were tested with an APCER of 0%. Fortface was the first Brazilian company to obtain iBeta Level 2 certification.
Deepfakes presented on high-resolution screens are within the scope of Level 2. The liveness module blocked every tested attack.
What happens when the deepfake does not pass through the camera?
When a deepfake is injected into the data channel before the SDK, the physical camera is not part of the equation. The synthetic stream reaches the SDK through a virtual camera driver installed on the device, code that intercepts the camera call at the operating system level, or full device emulation. From the SDK’s perspective, the camera is working normally.
Liveness (biometric liveness detection) analyzes frame content, not its source. A deepfake built with facial micro-movements, adaptive lighting, and simulated depth gives the module exactly what it was trained to recognize as a valid capture of a real person.
A deepfake delivered through injection bypasses liveness because liveness does not control the capture channel. Controlling the channel is the responsibility of the anti-injection module—and requires separate certification, with a different methodology and laboratory.
Which controls verify the channel before a frame reaches liveness?
Anti-injection acts before the content is analyzed. The SDK checks whether the device responding to the camera request is a real physical sensor. Virtual camera drivers have a communication signature with the operating system that differs structurally from hardware sensors—the difference is detectable.
The check runs at runtime. RASP (Runtime Application Self-Protection) techniques identify tampering during the active session, before any frame is processed. Device emulators have an environment fingerprint that differs from physical hardware: battery cycles and inertial sensor behavior diverge in characteristic ways.
SDK obfuscation prevents the code from being analyzed to map entry points through reverse engineering. The result: an injected deepfake does not reach liveness. The channel is identified as compromised before the frame is processed.
None of these checks appear in the legitimate user interface. The control operates entirely at the infrastructure layer.
Which standard certifies resistance to deepfakes delivered through injection?
CEN/TS 18099:2024 is the first technical standard specifically for biometric anti-injection controls. Published by the European Committee for Standardization, it defines a test methodology for attacks conducted with an IAI (Injection Attack Instrument): any synthetic content—including deepfakes—injected into the capture channel before the SDK.
The standard has three levels; High is the highest. To obtain High-level certification, a system must resist at least 15 distinct IAI species, with a maximum BPCER (Bona fide Presentation Classification Error Rate) of 15%.
Certification is not self-declared. The recognized laboratory defines the attacks, runs the protocol, and signs the report. The vendor does not control which IAI species are tested within the set required by the standard.
The Antisec laboratory conducted certification of Fortface’s anti-injection module from July 30 to August 18, 2026. Results: 18 attacks executed, 15 distinct IAI species, 3 distinct IAM methods, 0 bypasses. BPCER: 2%, against the standard’s 15% limit. High-level certification obtained.
What do certification results show about deepfakes in production?
Two perimeters, two independent reports.
For deepfakes presented physically (shown to the camera as a presentation attack): APCER was 0% in the ISO/IEC 30107-3 Level 1 and Level 2 certifications conducted by iBeta from July to August 2024. The liveness module blocked all tested attacks, including advanced artifacts that cover high-resolution deepfakes.
For deepfakes injected into the capture channel (delivered before the SDK): 0 bypasses in 18 attacks across 15 distinct IAI species in the CEN/TS 18099:2024 High-level evaluation conducted by Antisec in August 2026. The anti-injection module blocked all attacks before the frame reached liveness.
A vendor with only the first certification and without the second has an open injection perimeter. The two reports cover distinct vectors, and neither replaces the other.
“A well-made deepfake can fool the human eye and may fool liveness. What it cannot fool is channel verification. Anti-injection acts before the frames—and that is where a deepfake delivered through injection is blocked.” (Ricardo Fristche, CTO of Fortface by Payface)
