• Attackers now bypass cameras entirely via injection attacks, so camera-based liveness checks no longer catch them.
• The fix is attested hardware, not better software — AI can fake 2D images, not sub-surface signals.
• Verification must bind to a specific action, not just a session, or it can be replayed — as the $25M Arup scam showed.

Digital identity systems were built around one question: is this person who they claim to be? Biometrics improved the answer, and liveness detection improved it further by separating a real person from a photograph, a video, or a mask.

Generative AI has not defeated that logic. It has moved the attack somewhere the logic does not look.

Liveness answers a question about the sample, not the channel

Presentation attack detection, standardized in ISO/IEC 30107-3:2023, is explicitly scoped to attacks at the biometric capture device. The standard states: “The attacks considered in this document take place at the biometric capture device during presentation.” Other attacks are outside of its scope.

Injection attacks discard the assumption. Virtual cameras, device emulators, instrumented mobile applications, and manipulated API traffic insert a synthetic sample directly into the pipeline. Nothing is spoofed at the lens, because the lens is not part of the attack.

A presentation attack is manual and scales poorly. An injection attack is software: it runs in parallel and improves with each iteration. iProov’s 2026 Threat Intelligence Report states that injection attacks targeting iOS devices “surged by 1,151% in the second half of 2025,” contributing to a 741% annual increase. Those are vendor figures, not industry-wide measurements.

The root cause is a general-purpose capture path

Injection is cheap because the capture path is general-purpose. A camera, an OS API, and an SDK are shared, documented, instrumental surfaces, and the modality they carry, a two-dimensional image, is what generative models are trained to produce at scale.

This points to a second control alongside attestation. A dedicated sensor with its own secure element, carrying a modality for which no rendering pipeline and no large training corpus exists, does not merely raise the cost of injection; it breaks the equivalence between what an attacker can generate and what the system will accept. Sub-surface physiological sensing is the clearest current example. A surface image, however live, remains a projection that can be synthesized. Signals originating beneath the skin have no software-generatable counterpart today.

The standards base has already moved

NIST’s final SP 800-63-4 suite, released in July 2025, now explicitly addresses deepfakes, forged media and injection attacks. SP 800-63A-4 requires presentation attack detection for remote biometric collection and states: “A biometric comparison performed with a captured sample does not prevent these attacks.” SP 800-63B-4 also requires biometrics to be used only as part of multi-factor authentication with a physical authenticator.

That pairing requirement deserves more attention than it receives. It is usually satisfied with two separate devices, which leaves the link between them exposed to relay. Collapsing the biometric sensor and the possession factor into a single attested device removes that class of attack rather than mitigating it.

Is the biometric PAD-tested? is no longer a sufficient procurement question. What attests the capture path, against which injection attack detection criteria, and at what attack difficulty? is where the standards are converging.

Presence, path and binding

Stronger authentication is not the same as certain biometrics. Three properties are separable and should be evaluated as such.

Presence is evidence that a living human participated, and it has depth: detecting that a face moves is a far weaker claim than detecting a signal only a living body produces. Path integrity is evidence that the sample originated at a trusted sensor and arrived unaltered, extending to the sensor what attestation already does for cryptographic keys. Binding is evidence that a result belongs to a specific action rather than to a session. An assertion stating that a user authenticated is replayable in a way that an assertion signing the transaction’s parameters is not.

Path integrity is evidence that the sample originated at a trusted sensor and arrived unaltered, extending to the sensor what attestation already does for cryptographic keys.

Binding failures are already expensive. CNN Business reported in May 2024 that engineering firm Arup was the victim of a deepfake scam in which an employee transferred approximately $25 million after a video conference with synthetic participants. No biometric system was defeated, because none stood in the path. The lesson runs both ways: authentication must bind to the action, and consequential actions need a presence signal worth binding to.

Minimize what is worth stealing

Stronger assurance should not mean collecting more biometric data. Centralized stores are high-value targets, and biometric characteristics cannot be reissued after compromise. Where the architecture permits, matching should remain local to an attested endpoint, with only a signed assertion leaving it, which shrinks both privacy exposure and the injection surface.

The agentic turn

Pressure will increase as software acts on behalf of humans. When an agent initiates a payment or changes a configuration, the question is no longer only identity but authority: who delegated what, within which limits, and whether the human was present at the moment of consequence rather than at the start of the session. The same shift in threat model is already visible in enterprise impersonation. In the RSAC blog, Closing the Door on AI Impersonation with Synchronization Scoring, Halil Ibrahim Dursunoglu emphasized that “Organizations must now defend not only infrastructure and credentials, but also the authenticity of communications, identities, and interactions across enterprise environments.”

Liveness remains necessary. It is simply no longer the answer. The next generation of identity systems will be judged less on how convincingly they detect a fake face, and more on how tightly they bind a real human, a trusted device and a single consequential action.