Presentation Attack Detection (Liveness / PAD)

Techniques and tests that detect spoofed biometric samples (e.g., masks, replays, synthetics) to ensure the sample is from a live, consenting subject.

Overview

Presentation Attack Detection (PAD) protects biometric systems from spoofs such as printed photos, silicone fingerprints, recorded voices, or AI-generated samples. It’s a cross-cutting layer used with face, voice, fingerprint, iris and other modalities.

How it works

Capture: Sensor or camera acquires the sample.
Signal analysis: Algorithms look for cues inconsistent with live traits (e.g., texture, reflectance, micro-motions, audio artifacts).
Decision & score: The PAD subsystem outputs a score or decision (bona fide vs attack).
Policy: Systems combine PAD with biometric matching and business rules to accept/deny or request step-up verification.

Common use cases

Remote onboarding / selfie match
Contactless border checks
KYC and high-risk transactions
Access control and workforce auth

Strengths and limitations

Strengths: Mitigates common spoofs; complements matching; standard metrics for evaluation.
Limitations: Attack diversity; new synthetic media; environment variability; false rejections at strict thresholds.

Key terms

APCER/BPCER: Core PAD error metrics from ISO/IEC 30107-3.
PAI (Presentation Attack Instrument): The artifact used to attack.
Attack potential: Effort/resources required to mount an attack.

References

Vendors using Presentation Attack Detection (Liveness / PAD)

Thales Group

Latest Data Cards

Data Card
Secured Signing Adds Reality Defender ‘Realify’ Deepfake Checks for RON
2025-11-07CC-BY-4.0padfacial-recognition
Secured Signing partnered with Reality Defender to offer ‘Realify,’ a deepfake detection add‑on that strengthens liveness and fraud controls in Remote Online Notarization workflows.
- Deepfake and spoof detection integrated into RON sessions
- Complements selfie match and liveness checks
- Aims to reduce synthetic‑ID and impersonation risk

See more data cards

Frequently Asked Questions

What metrics does ISO/IEC 30107-3 define?

APCER (attack presentations misclassified as bona fide) and BPCER (bona fide misclassified as attacks). Vendors often report operating points across attack species and attack potential.

Is PAD the same as liveness?

‘Liveness’ is commonly used, but PAD is broader: it covers detecting presentation attacks of many kinds (physical and digital), not only vitality cues.

How is PAD evaluated in practice?

Independent labs test across PAI types and attack potentials, reporting APCER/BPCER at defined thresholds; results are separate from core matcher accuracy.