Presentation attack detection
Presentation attack detection is the set of techniques a biometric system uses to recognise a fake sample presented to its sensor: a printed photo, a screen replay, a silicone mask. ISO/IEC 30107-3 defines how such defences are tested and reported, so vendor claims can be compared rather than self-defined.
What is the difference between PAD and liveness detection?
The two terms describe the same defence from different angles. Liveness detection is the everyday name and asks whether the subject is alive and present. Presentation attack detection is the standards term used in ISO/IEC 30107 and asks whether an artefact was presented to the sensor. Test reports and procurement documents use PAD; product pages usually say liveness.
What attack instruments is PAD tested against?
- Printed photographs, flat or curved, in colour and greyscale.
- Digital displays replaying a still or a video of the target.
- Paper masks and cut-outs, including versions with the eyes removed.
- Rigid resin and flexible silicone masks moulded to a face.
- Partial artefacts such as printed eye regions worn over a real face.
An attack instrument is the physical or digital object presented, and the species of instrument matters more than the count. A system tested against fifty printed photos and nothing else has been tested against one attack, repeated. This is why ISO/IEC 30107-3 reports describe the instruments used rather than only a headline detection figure.
What do the PAD evaluation levels mean?
| Scope | Typical instruments | What it demonstrates |
|---|---|---|
| Level 1 | Print, screen replay, paper mask | Resistance to attacks anyone can assemble in an afternoon |
| Level 2 | Custom silicone and resin masks, professionally made | Resistance to a funded, prepared attacker |
| Injection testing | Video fed into the pipeline, no lens involved | Whether the capture path itself is trusted |
Levels are a convention used by evaluation laboratories rather than a certification ladder. A result is only as strong as the instruments listed in the report, so read the instrument list before the conclusion.
The boundary worth naming explicitly is the lens. Every instrument in a PAD evaluation is something held in front of a camera, so a strong result says nothing about video inserted after the camera. Defending that path is a different control: authenticating the capture device, signing the stream, or physically securing the cable between the camera and whatever reads it.
Frequently asked questions
- What is presentation attack detection?
- Presentation attack detection is the set of techniques a biometric system uses to recognise a fake sample presented to its sensor, such as a printed photo, a screen replay or a silicone mask. ISO/IEC 30107-3 defines the attack instruments and metrics used to test and report those defences.
- Is PAD the same as liveness detection?
- They describe the same defence in different vocabularies. Liveness detection is the common product term and asks whether the subject is present and alive. PAD is the standards term from ISO/IEC 30107 and asks whether an artefact was presented. Procurement documents and test reports generally use PAD.
- What is an attack instrument?
- An attack instrument is the object presented to the sensor in place of a real face: a printed photograph, a display showing a video, a paper cut-out, a resin or silicone mask. Test reports list the instruments used, because a result only covers the attacks that were actually attempted.
- Does PAD protect against injection attacks?
- Not on its own. PAD analyses what arrives at the sensor, while an injection attack feeds video directly into the processing pipeline and never passes a lens. Defending against injection means authenticating the capture device and the transport path, which is an architectural control rather than an image-analysis one.
- Can PAD be added to an existing face recognition system?
- Often, if the system exposes the captured frame and accepts a decision from an external component. The practical limits are frame quality and where the analysis runs: a passive check needs enough pixels on the face, and running it after compression discards the texture cues it depends on.
- Is there a PAD certification?
- No certification body awards a general PAD certificate. Independent laboratories run evaluations against ISO/IEC 30107-3 and publish reports describing what was tested and what happened. A vendor should be able to name the laboratory, the date and the instrument list; a claim without those is not a result.