Why Presentation Attack Detection Needs Specialist Decision Models

Most face liveness products are sold on a test letter. A lab built a set of fake faces, presented them to the detector, and the detector turned them away. The letter is real and worth having. What it cannot tell you is how the detector behaves against an artifact the lab did not build, on a camera the lab did not use, with users the lab did not sample.

That gap is where presentation attacks succeed today, and it is also where real people get turned away. From building and measuring these detectors ourselves, our view is that the gap is structural. A model trained once on the datasets that exist today learns those datasets. It misses attacks from outside them, it flags genuine users who look unlike them, and both errors grow as attackers spend more on realism.

The systems that hold up will look different: several specialist models, each answering one narrow question, each retrained as new attack material arrives. One of those specialists should be a decision model. This post lays out the evidence, including our own measurements, and shows where attended NIST IAL3 fits.

Specialist decision models for presentation attack detection, in brief:

• Two attack classes, two defenses. Injection attacks go around the camera, and trusted capture hardware closes most of that route. Presentation attacks happen in front of a genuine camera, and no hardware control makes a mask stop looking like a face.
• One model is not enough. NIST tested 82 presentation attack detection algorithms against nine attack types, and "none caught them all." Public training data holds very few high-end masks.
• Specialists, retrained. In an experiment with research versions of our models, a specialist caught about 60% of attack families it had not trained on, and a decision model caught 79%. Flagging when either one fired caught at least 85%, with 1.2% of genuine selfies flagged.
• IAL3 stacks the layers. On a controlled device with a trained agent attending, a mask has to beat the sensors, the models and a person at the same time.

Presentation attacks and injection attacks are different problems

A presentation attack shows the camera something other than the live face of the right person: a printed photo, a screen, a mask. The ISO/IEC 30107 series defines the vocabulary and, in part 3, how detection is tested and reported. Two error rates matter throughout this post. APCER (attack presentation classification error rate) is the share of attacks a detector accepts as genuine. BPCER (bona fide presentation classification error rate) is the share of genuine people it rejects.

An injection attack never shows the camera anything. In NIST's words, injection attacks "insert modified or forged media between the capture point (e.g., a device) and the element conducting the comparison or other operation." A virtual camera feeding a deepfake into a selfie flow is the common example. Europe's CEN/TS 18099 covers how injection attack detection is tested, and an ISO/IEC standard (25456) is in development.

NIST SP 800-63A-4 sets separate requirements for each:

• Presentation attacks: "When collecting and comparing biometric characteristics remotely, the CSP SHALL implement presentation attack detection (PAD) capabilities that meet the impostor attack presentation accept rate (IAPAR) performance metric of <0.07."
• Injection attacks: "CSPs SHALL implement technical controls to increase confidence that digital media is being produced by a genuine sensor during the proofing process (e.g., detect the presence of a virtual camera, device emulator, or a jailbroken device)."

A CSP, or credential service provider, is the organization that performs the proofing. The two requirements are worth keeping apart, because different things stop the two attacks.

Injection attacks are mostly a hardware problem

An injection attack needs somewhere to insert the media: a virtual camera driver, an emulator, a hooked camera interface, a modified app or the network path. Every one of those is a property of the capture device or its connection, and a device can be made to prove what it is. Current phones can attest, using keys held in hardware, that a genuine, unmodified app is running on a genuine, unmodified device. NIST recommends exactly that: "CSPs SHOULD authenticate capture sensors or implement device attestation to increase the confidence in a device being used to transmit digital media."

On hardware the applicant owns, attestation narrows the route without closing it. It vouches for the device, the operating system and the app, not for every camera frame, and a desktop browser with a webcam offers far less to verify. The route closes when the verifier controls the capture device end to end. On a Trust Swiftly IAL3 Kit the device, its software and its connection are under our control, only enrolled, attested kits can run a session, and there is no camera driver for an applicant to swap. What remains is physical tampering with the unit, which NIST addresses by requiring tamper protection and periodic inspection by trained technicians.

Hardware does not end injection everywhere. It turns a cheap software trick into a hardware compromise, which is a far more expensive class of attack. We covered that reasoning in detecting nation-state-level deepfakes.

Presentation attacks have no hardware fix

A genuine camera on a genuine device records whatever is in front of it. If that is a silicone mask, attestation proves only that the mask was really there. Detection becomes a judgment about the scene, and the scene is limited only by the attacker's budget.

iBeta, the lab whose ISO/IEC 30107-3 test letters many liveness vendors cite, grades its tests by attacker effort:

Two details stand out. Levels 1 and 2 cap materials at $30 and $300 per artifact, far below what a funded attacker spends. And at Level 3, the top tier, a system passes while up to 5% of attacks get through and up to 10% of genuine users are turned away. NIST's bar for remote detection, an IAPAR below 0.07, sits in the same range. These are honest thresholds, because nobody credible claims a zero error rate against a hyper-realistic mask. They also show how hard the problem is.

People do no better than software. In a University of York study, of 280 participants who viewed hyper-realistic masks, only two reported the mask without being asked (Sanders et al., 2017). In a later mock passport check at two meters, 10% of viewers still judged that the traveler was not wearing a mask after being asked directly, and the authors concluded that "hyper-realistic masks pose an unresolved problem in identity fraud" (Robertson et al., 2020). The masks are not exotic. Fraudsters wore one to impersonate France's defense minister in a scam that took tens of millions of euros, and as we noted when describing our IAL3 fleet, ultra-realistic masks now sell on mainstream marketplaces for around two thousand dollars.

Why models trained on existing datasets fall short

The data is thinnest where the threat is greatest

A print attack costs cents, so datasets hold thousands of them. A custom silicone mask is another matter. When the Idiap Research Institute built a dataset to study them, it had six masks made by a special-effects company "at a cost of approximately USD 4,000 per mask" (Bhattacharjee et al., 2018). HiFiMask, a large public collection of realistic masks, holds 225. Most academic datasets are also released for non-commercial research only, so a commercial model often cannot train on them at all. The hyper-realistic artifacts that define Level 3 testing are the ones public data has least of.

An attacker needs one mask the model has not seen.

Models learn the dataset, not liveness

Two 2026 studies from Idiap measured this directly. The first evaluated 32 foundation models and found that vision encoders adapted to the task "achieve below 2% intra-dataset ACER in most cases, while cross-dataset ACER is substantially higher" (Lorenz et al.). ACER is the average of the two error rates above. The second benchmarked 16 open-weight multimodal language models and 30 vision encoders and reached the same conclusion: "Low intra-dataset ACER does not reliably predict cross-dataset PAD performance, even for models with billions of parameters" (Otroshi Shahreza et al.).

Independent evaluations of shipping products agree:

• NIST. Its evaluation of presentation attack detection software covered "82 software algorithms submitted voluntarily by 45 unique developers" and nine attack types. NIST's Mei Ngan: "Some developers' algorithms could catch two or three types, but none caught them all."
• DHS. The Science and Technology Directorate tested six active and fifteen passive commercial detectors with 661 volunteers, and scored each on its worst device and worst attack type. Its finding: "The median rejection rate for presentation attacks was 78%." Its goal is 99%.
• LivDet-Face 2024. In this independent competition, two attack types were withheld from competitors. The winning image algorithm still averaged 4.93% error, and two entries rejected about half or more of genuine faces. The organizers' summary: "The top competitors performed better against low-quality PAIs than high-quality ones." (A PAI, or presentation attack instrument, is the artifact used in an attack.)

We see the same thing in our own testing. We ran seven openly published face anti-spoofing models, exactly as released, against recorded attacks from five families: prints, screen replays, paper masks, mannequins and silicone masks. With each model's threshold set to flag 1% of genuine selfies, the best one caught 47% of the attacks, averaged across families. The other six caught between 1% and 29%.

Errors run in both directions

A missed attack is one failure. A genuine person flagged as an attack is the other, and it is the one customers feel first. DHS makes the point that a genuine user has to pass every check in sequence, so errors compound, "with each layer's false positive rate (misclassifying legitimate users as threats) reducing the overall system's usability."

Narrow training data produces false flags in ways that are hard to predict:

• A study of thermal detection reported: "Genuine subjects after physical effort were frequently classified as attack presentations." Exertion and sweat change the heat pattern of a face.
• An early experimental detector of ours, trained on open datasets alone, flagged about a third of genuine selfies. It never shipped, and adding closed datasets is what fixed it.
• One experimental mask detector compared a face with written descriptions of attacks and of genuine faces. In testing, older faces sat closer to the mask descriptions, because deeply lined skin resembles rubber and silicone. Adding descriptions of older faces, beards, glasses and dim light to the genuine side removed the effect.

None of these problems shows up in a benchmark score. Each one shows up in production as a real person who cannot get verified.

The attacks no dataset will contain

Every physical liveness signal invites a matching countermeasure, and none of the countermeasures needs new science.

Take heat. Thermal imaging is one of the strongest signals available, and the research already shows where it gives way. The Idiap team that built the silicone masks noted the limit themselves: "When worn by an attacker, the mask may warm up with time." A 2020 study tested it: subjects wore masks for ten minutes, "latex masks heated up very quickly during the experiment," and "the performance decreased for attacks using masks heated during the experiment." Its author added that "in real-life scenarios masks were worn long before approaching the PAD system" (Kowalski, 2020).

The next step takes no imagination. Thin heating film or micro-heaters under the surface can hold a mask at skin temperature and reproduce the warm and cool regions of a real face. Expression is a mechanical problem that film and animatronics solved long ago, with cables and fine lines under a flexible skin. We have not seen either published as an attack on identity verification. Both are ordinary engineering for a funded team, and we know of no public dataset that contains either.

A fixed detector is therefore a specification. Once attackers learn which signal is checked, they build to it, and a detector that was trained once never learns that they did. Sensors and models still matter: each one raises the attacker's cost until it has been studied. The defense has to keep moving, and it has to weigh many signals rather than one. We made the same argument about documents in our post on multi-spectral analysis.

What a decision model is

A decision model is a vision-language model that does not write. It reads a state, which can include images, and a set of typed questions (yes or no, multiple choice, a score). In a single pass it returns a probability for every allowed answer.

The category took shape in 2026. TypeSafe AI describes its Jev model as "No text generation, no parsing" (documentation). Cloudflare describes its open-weight Clef models this way: "Instead of generating text, it reads an input state and a set of typed questions, then returns a probability for every allowed answer" (changelog). Clef keeps a general vision-language model frozen and trains a small set of added parts, with a loss term "to refine probability calibration" (launch post).

Four properties make this kind of model a good specialist for presentation attacks:

1. Typed questions. Every question has a closed set of answers: yes or no to "was a live person in front of the camera?", or a choice among skin, a display, paper and a mask for "what surface is this?". Several questions can go in one request.
2. Probabilities you can threshold. A probability per answer can be held to a false-flag budget that is chosen in advance and measured on real traffic. A paragraph of generated opinion cannot.
3. Knowledge from outside the attack dataset. A model pretrained on a very large range of images knows what a mannequin or a mask is on any camera. A classifier trained on an attack dataset knows only that dataset's attacks.
4. Open weights. An open-weight model can run on your own systems, so images never leave them, and it can be tuned on your own attack material. Cloudflare describes the trade: "When you fine-tune a model, you may give up some general purpose performance in exchange for higher accuracy in a specific domain." A specialist wants exactly that trade.

A general model is not a liveness detector by default. In the Idiap benchmark, multimodal models prompted for a liveness judgment with no training averaged between 31% and 50% error, and the authors concluded that such a model "is not a reliable PAD system." The question, the threshold and the calibration data do the work, and all three have to be measured.

What our experiment showed

We ran an experiment to put numbers on this. It used research versions of our models, built for the test, and not the models we run in production. One was a specialist trained on recorded attacks from open and closed datasets. The other was an open-weight decision model, used exactly as published, with no training on our data.

The test design:

• Attacks: five families (prints, screen replays, paper masks, mannequins and silicone masks).
• Genuine selfies: two groups, one to set thresholds and one held out to count false flags. Every figure is the average of four different held-out groups.
• Specialist: leave-one-family-out. It is retrained with an entire attack family withheld, then measured on that family. The next real attack is, by definition, not in the training set.
• Decision model: two requests per selfie. The first asks whether a real, live person was in front of the camera. The second shows an unscaled close-up of the face and asks what surface it is: skin, a display, paper or a mask. The selfie is flagged when either answer crosses its threshold.

The chart shows what each model caught alone and what the two caught together.

What we found:

1. An unseen family is far harder than a seen one. With a whole family withheld from training, the experimental specialist caught about 60% of it on average, well below what the same design catches on attack types it has trained on.
2. A model that had seen none of our attacks did better. The decision model caught 79% on average, with fewer false flags: 0.50% of genuine selfies against 0.74%. It caught every mannequin and 98% of silicone masks, the two families where the specialist was weakest.
3. The two models had different blind spots. The decision model caught 6% of flat prints and no monitor replays. The specialist, which reads fine texture, caught half of the flat prints and a third of the monitor replays.
4. Together they covered more. Flagging a selfie when either model fired caught at least 85% on average, with 1.21% of genuine selfies flagged.
5. The second question earned its place. With the live-person question alone, the decision model caught 44% of phone replays. Adding the close-up and the surface question raised that to 79%.
6. Bigger was not better. A version of the decision model three times the size scored about the same on average and did worse on silicone masks, more of which it called a live person. It cost about six times as much to run and took twice as long.
7. Synthetic attacks made things worse. For the specialist, simulated prints and replays generated from genuine selfies cut detection of never-seen families by more than half, because the model learned the simulation's own artifacts. AI-generated masks and mannequins gave no net gain. Recorded attacks made with real materials are what move the number.

Each decision-model request took under a second. These are experimental results on our own test sets. They are not a certification, and they do not describe our production models. Some of the sets are small, and a new model or a new mask can move any of these numbers. That is the argument of this post.

Several specialists, retrained continuously

The design that follows from the evidence:

1. Establish capture integrity first. Use attested apps or controlled devices, so the models judge a real camera image.
2. Use one specialist per attack family. Print and screen texture, masks and mannequins, AI-generated or edited faces, and face swaps each get their own model and their own narrow question.
3. Give each specialist its own false-flag budget. Calibrate it on genuine captures from the real flow, and flag when any specialist fires.
4. Send doubt to a person. NIST: "Algorithmic analysis of media and automated decisioning SHOULD be augmented by manual reviews to address detection errors."
5. Measure on attacks the models have never seen. Keep a bank of attacks that is never used for training, and report leave-one-family-out results beside the usual ones.
6. Retrain when new attack material arrives. Then recalibrate, and recheck false flags across age and other demographic groups. NIST requires that attack detection algorithms be "periodically tested by independent entities," and adds that the provider "SHOULD conduct internal testing on biometric algorithms based on the update schedule of the provider."
7. Treat a hosted model as a dependency that changes. Record the model version with every decision and rerun the tests when it changes. Open weights on your own systems avoid the problem.

NIST's own evaluation points the same way. It found that "even the top-performing PAD algorithms worked better in tandem," and when it fused four of the best, "the group did better than any one of them alone."

Continuous retraining also changes the attacker's economics. A mask that took weeks to tune against last quarter's detector meets a different detector.

This is how we build our own detection. The models in the experiment above were held back on purpose: the specialist was trained with an attack family withheld, and the decision model was untuned. The models we run in production are better. They are trained on every attack family we hold and retrained as new material arrives, they run alongside capture-integrity and other checks the experiment left out, and they are more accurate than the experimental versions reported here. We do not publish their results or how they are built, for the same reason we do not publish thresholds.

Where IAL3 fits

A selfie taken on the applicant's own phone depends on the models alone. NIST IAL3 does not. SP 800-63A-4 says "IAL3 identity proofing SHALL only be delivered as on-site attended," and that the proofing agent may "attend the identity proofing session via a CSP-controlled kiosk or device." In practice that is a controlled kit at an approved office or home, with a trained agent attending. Three things change for an attacker:

1. The injection route closes. Capture happens on the provider's hardware. NIST requires that evidence be read "by integrated scanners and sensors," and that the devices be protected from tampering and "inspected periodically by trained technicians."
2. There are more signals than a selfie carries. A controlled unit can measure depth, infrared and heat as well as visible light, as we described for our fleet. Any one signal can be engineered around. Beating all of them at once, in agreement, on hardware the attacker does not control, is a different project. We do not publish which checks run when, or where the thresholds sit.
3. A person is in the loop by rule. NIST: "The CSP SHALL have the proofing agent view the source of the collected biometric for the presence of any non-natural materials (e.g., putty, glue)." The agent watches the whole session over high-resolution video and can ask for movement that no script anticipated.

People miss masks, as the York studies show, and models miss attacks they were never trained on. The two fail in different ways, which is why IAL3 uses both. The models and sensors direct the agent's attention, and the agent catches what the models were never trained to see.

IAL3 does not make a mask attack impossible. It makes the attacker show up in person, on record, in front of controlled sensors, changing models and a trained agent, with a biometric sample retained afterward. As we wrote about complicit identity fraud, that changes who is willing to try.

Questions to ask a liveness provider

1. Which attack families has each model been tested on without training on them, and what were the results?
2. What share of genuine users does it flag on a population like yours, and how does that vary by age and skin tone?
3. How often are the models retrained, and what triggers a retrain?
4. Does the test letter name the build that runs in production today?
5. How is capture integrity established: an attested app, a controlled device, or neither?
6. How many independent detectors run, and what happens to a result in the uncertain band?
7. If a hosted AI model is involved, where do the images go and how long are they kept?

Our guide to choosing an IAL3 provider covers the wider set of questions for attended proofing.

Frequently Asked Questions

What is a decision model?

A decision model is a vision-language model that returns typed answers with probabilities instead of generated text. It reads a state, which can include images, and a set of questions with fixed answer types such as yes or no, multiple choice or a score. Because every answer comes with a probability, software can apply a threshold that was chosen and tested in advance.

What is PAD Level 3?

PAD Level 3 is the highest tier of iBeta's presentation attack detection testing under ISO/IEC 30107-3. Testers get up to seven days per attack type and use hyper-realistic facial masks with specialized environments and accessories. A system passes if no more than 5% of attacks succeed and no more than 10% of genuine users are rejected.

Can hardware stop injection attacks?

Mostly. An injection attack has to insert media somewhere between the camera and the comparison, so a capture device that proves its own integrity removes most of the places to insert it. Attestation on a personal phone narrows the route. A device the provider controls end to end, such as an IAL3 kit, closes it apart from physical tampering, which inspection and tamper protection address.

Why do liveness models miss attacks they were not trained on?

A model learns the attacks, cameras and lighting in its training data. Public datasets hold few high-end masks because each one costs thousands of dollars to make, so a model can score under 2% error on its own dataset and far worse on a new one. In our experiment, a specialist model caught about 60% of attack families withheld from its training, well below its rate on attack types it had trained on.

Does NIST IAL3 require presentation attack detection?

NIST's numeric requirement, an impostor attack presentation accept rate below 0.07 tested under ISO/IEC 30107-3:2023, applies when biometrics are collected and compared remotely. IAL3 is delivered on-site attended. There, the proofing agent must view the source of the collected biometric for non-natural materials and collect the sample from the applicant and no other source. Automated detection on the controlled device supports that inspection.

Why not train one large model on every attack?

Larger models have not solved it. In independent benchmarks, models with billions of parameters still failed on datasets they had not seen, and in our own experiment a decision model three times the size was no better on average and worse on silicone masks. Detection depends more on the question asked, the attack material used in training and the calibration on real users than on model size. NIST also found that combined algorithms beat any single one.