Liveness detection

Liveness detection establishes that a living person is present at the lens. Face recognition answers a narrower question: are these two faces the same face. A high-resolution photograph of the right person answers that question perfectly, because it is the right person's face, and the matcher was never asked whether it was attached to anybody.

That gap is what makes the attack cheap. A photograph lifted from a public profile and angled toward a laptop camera defeats recognition on its own, with no technical skill and no budget behind it. Telling a person apart from a reproduction of one is the job liveness exists to do.

In an identity system the placement matters as much as the technique. A liveness check that runs after a match, or as an advisory risk score somebody reviews later, is a report. A liveness check that gates the credential is a control.

Every technique hunts for the same evidence: signs that whatever the lens is pointed at behaves like living tissue rather than like paper, glass or silicone. What separates the two families is whether the person is asked to participate, and that difference is felt by the user far more than by the attacker.

On user experience the passive family has largely won, because a check that costs the user nothing gets deployed across every flow rather than reserved for high-risk ones. Active methods keep a place where a slower, more deliberate ceremony is acceptable, or where the flow needs a visible signal that something was verified.

One goal, two vocabularies. The standards call it presentation attack detection and abbreviate that to PAD. Everyone in a product meeting says liveness.

The formal vocabulary is worth knowing when reading a datasheet. ISO/IEC 30107-3:2023 fixes the way presentation attack detection has to be tested and the way results are written down: which artifact types are in scope, how attempts are counted, and what form the numbers take. Citing it points at a test methodology, and that is a materially firmer claim than naming a technique.

Deepfakes have changed the conversation about face verification, and the change is often described imprecisely. A synthetic face shown on a screen in front of a camera is a presentation attack, and it is within the scope of a laboratory-tested liveness system. A synthetic face injected directly into the video pipeline, through a virtual camera or a compromised application, never reaches the lens at all and is a different class of problem.

The distinction is not academic. In February 2024 an Arup finance employee authorized about 25 million US dollars after a video call with deepfaked colleagues. No biometric system was defeated in that incident, because none was in the path: the attack targeted a human approval workflow directly.

The practical response is layered. Liveness handles what is presented to the camera. Application and device integrity handle what is allowed to produce a capture in the first place. Approval design handles the decisions that a convincing video can still influence.

Because the face is the credential here, liveness cannot be an optional risk signal attached to a login. It executes inside the same ceremony as the comparison, and a capture that fails it produces neither a session nor a token.

The SenseCrypt liveness detection is tested by iBeta to ISO/IEC 30107-3 Levels 1 and 2. Capture runs on an ordinary 2D RGB camera, so the method works on whatever handset a person already carries instead of on a single hardware tier. Recognition accuracy is a separate question with separate evidence: the algorithm is evaluated in the NIST Face Recognition Technology Evaluation under Seventh Sense's own name, participation since 2021, and the public report card is at https://pages.nist.gov/frvt/reportcards/11/seventhsense_000.html