Why static liveness checks fail
Traditional liveness detection asks the user to take a selfie or hold still for a moment. These approaches are vulnerable to:- Pre-recorded video replayed on a screen held in front of the camera
- Real-time deepfake generators that render a synthetic face over a live camera feed
- 3D-printed masks and silicone replicas
- Photo injection attacks that bypass the camera entirely and inject a static image into the video stream
Interactive liveness analysis
FaceSign uses interactive challenges during theLIVENESS_DETECTION node. Instead of asking for a static selfie, the avatar directs the user through randomized, unpredictable prompts that require real-time physical responses.
What the system checks
Why interactive challenges defeat deepfakes
Pre-rendered deepfakes are generated in advance. The attacker produces a synthetic video and replays it during the verification session. This approach fails against interactive challenges because:- The challenge is randomized — The avatar selects from a pool of prompts at runtime. The attacker cannot predict what will be asked.
- The response must be immediate — The system measures the latency between the challenge and the user’s physical response. Real-time deepfake generators introduce measurable processing delay.
- The response must be physiologically consistent — When a real person turns their head, hundreds of micro-movements occur in facial muscles, skin folds, and lighting angles. Deepfake generators approximate these but introduce statistical artifacts detectable across multiple frames.
FaceSign’s liveness detection is not a single check. It runs continuously throughout the
LIVENESS_DETECTION node, analyzing every frame. The longer the interaction, the more data points the system collects and the higher the confidence.iBeta PAD Level 2
FaceSign’s deepfake detection meets the iBeta Presentation Attack Detection Level 2 standard:
PAD Level 2 is the higher of the two iBeta testing levels. It includes advanced attack types (3D masks, video injection) that Level 1 does not test.
Attack types and detection
Integration
Deepfake detection runs automatically in two node types:LIVENESS_DETECTION— Dedicated interactive liveness check with randomized challengesFACE_SCAN— Liveness analysis runs alongside biometric capture
Next steps
Coercion Detection
FaceSign’s crown jewel: detecting when a user acts under duress.
Security Architecture
The full data flow from capture through HSM tokenization to results.
Flows
Add LIVENESS_DETECTION and FACE_SCAN nodes to your verification flow.