Remote identity verification asks two separate questions. Does this face match the document — a matching problem, largely solved. And is there actually a live person here right now — a liveness problem, which became much harder when real-time face synthesis became accessible.
The second question is where the attacks concentrate, and the attack surface is broader than the imagery.
What changed in 2026
- Injection attacks overtook presentation attacks. Feeding synthetic video directly into the capture pipeline, bypassing the camera, became more common than holding a screen up to a lens.
- Active challenges lost effectiveness. Real-time generation capable of responding to instructions undermined turn-your-head and blink-on-command checks.
- Passive detection improved. Analysis of subtle signals — skin texture under motion, micro-expressions, lighting consistency — advanced as the primary defence.
- Device attestation entered the stack. Verifying that the camera and application are genuine, and the video path unmodified, became part of serious verification systems.
Attack categories
| Attack |
Method |
Primary defence |
| Printed photo |
Hold a picture to the camera |
Trivially detected; depth and texture |
| Screen replay |
Play a video on a display |
Screen artifacts, reflection analysis |
| Mask |
Physical mask of the target |
Texture and thermal analysis where available |
| Presented deepfake |
Play generated video to the camera |
Passive liveness signals |
| Injection |
Virtual camera feeding synthetic video |
Device attestation; imagery analysis cannot see it |
| Real-time puppeteering |
Attacker's movements driving a synthetic face |
Hardest; needs layered controls |
Injection is the category that changes the problem. Every defence based on analyzing the video assumes the video came from a camera pointed at something. If an attacker inserts a synthetic stream directly into the application's video pipeline, there is no capture to analyze — the imagery can be arbitrarily good because it was never photographed.
Defending against that means verifying the integrity of the capture path itself: attesting that the application is genuine and unmodified, that the camera is a real hardware device, and that no virtual camera sits between them. That is a platform security problem rather than a computer vision one.
Layering the controls
Liveness alone is insufficient for high-value verification. The workable architecture combines several independent checks.
Document verification with its own authenticity signals — security features, chip data where available — is a separate channel an attacker must also defeat.
Device and behavioural signals provide context: is this device known, is the network consistent with the claimed location, does the interaction timing look human.
Out-of-band confirmation for high-value actions — a callback, a code to a registered channel, or an in-person step — provides a factor synthetic video cannot supply.
And risk-based escalation ties it together: routine verifications pass on liveness plus document, high-value ones require more. That is the same reasoning as voice print authentication, applied to a different modality, and the same conclusion follows — a biometric signal is one input, not a gate.
Common mistakes
- Relying on active challenges. Real-time generation responds to them.
- Ignoring injection. Imagery analysis cannot detect what never came from a camera.
- No device attestation. Leaves the capture path unverified.
- Single-factor verification for high-value onboarding. The economics favour the attacker there.
- Never re-testing against current techniques. Detection ages; synthesis improves continuously.
FAQ
Is passive or active liveness better?
Passive is now generally stronger against synthetic attacks and gives a better user experience. Active challenges retain some value against simple replay.
Can liveness detection be defeated reliably?
By a determined attacker with current tooling, sometimes. That is why layering matters — each additional independent control multiplies the attacker's cost.
Does better camera hardware help?
Depth-sensing cameras add a signal that is harder to fake, and they are unavailable on most consumer devices, so systems cannot depend on them.
How often should detection models be updated?
Continuously. This is an adversarial domain where a model that worked last year is measurably weaker now.
Where to go next
For the audio equivalent, read voice print authentication. For consumer-side detection, how to spot deepfakes, and for provenance approaches, content credentials and C2PA.