Not all biometric attacks are created equal. Understanding the difference between presentation attacks and injection attacks is essential for building effective defenses. This technical guide breaks down both.
The biometric security industry has historically focused on a single threat category: presentation attacks. Someone holds up a printed photo, a screen, or a mask to a camera. The entire field of Presentation Attack Detection (PAD) was built around this threat model.
But the threat landscape has shifted. A second category — injection attacks — now represents a larger and more dangerous threat than presentation attacks. Many verification systems that achieve excellent PAD scores are completely blind to injection attacks.
Understanding both categories, their mechanics, and the required defenses is essential for anyone responsible for biometric security.
A presentation attack occurs when a physical artifact is presented to a genuine camera sensor. The camera captures what it sees, and the resulting image or video contains the artifact.
Printed photo — The simplest attack. A high-resolution photo printed on paper or a rigid surface. Detected by analyzing surface texture, the absence of depth cues, and paper/print-specific artifacts.
Screen replay — A digital photo or video displayed on a screen (phone, tablet, monitor). Detected by analyzing moiré patterns, screen pixel grid, refresh rate artifacts, and backlighting characteristics.
3D mask — A physical replica of the target's face, typically made from silicone, resin, or 3D-printed materials. More difficult to detect than 2D attacks because the mask has genuine 3D depth. Detected by analyzing material properties — silicone reflects light differently than skin.
Partial overlay — A mask or printed layer covering specific facial features while leaving others exposed. Designed to confuse facial recognition by blending real and fake elements.
Presentation attacks have a fundamental limitation: the artifact exists in the physical world and must pass through a genuine camera sensor. This means the captured image contains physical evidence of the attack:
Modern PAD systems achieve 99%+ detection rates against presentation attacks because the physical evidence is reliably present in the captured data.
An injection attack bypasses the camera entirely. Instead of presenting a physical artifact to a real camera, the attacker injects synthetic data directly into the verification pipeline. The system receives data that appears to come from a camera but was actually generated or manipulated by software.
The attack chain typically follows this pattern:
This is the critical insight: PAD analyzes the content of the captured image for physical evidence of presentation artifacts. An injection attack produces an image that was never captured by a camera — it was generated by software.
The injected image can be a perfect photograph of a real face. It contains no screen pixels, no paper texture, no mask artifacts, no moiré patterns. It is indistinguishable from a genuine camera capture because it was designed to be indistinguishable from a genuine camera capture.
A verification system with perfect PAD scores will fail completely against injection attacks if it lacks injection detection.
Virtual camera injection — The most common method. A virtual camera driver (such as OBS Virtual Camera or ManyCam) intercepts the camera API call and substitutes a synthetic feed. The application believes it is reading from a physical camera.
Rooted/jailbroken device manipulation — On a compromised device, the attacker can modify the camera driver at the OS level, intercepting and replacing the data before it reaches any application.
SDK tampering — If the verification SDK can be decompiled and modified, the attacker can alter it to accept injected data instead of camera data.
API-level injection — For server-side verification APIs that accept image uploads, the attacker simply uploads a synthetic image. No camera is involved at any point.
Man-in-the-middle — The attacker intercepts the data stream between the camera and the verification server, replacing genuine captures with synthetic content in transit.
Effective against physical artifacts presented to real cameras:
Effective against synthetic data injected into the pipeline:
The mistake many organizations make is implementing PAD without IAD, or vice versa. Both are necessary:
deepidv's biometric security combines both PAD and IAD in a single verification flow:
The result is a defense that covers both the physical and digital attack surfaces — the full spectrum of modern biometric threats.
Go live in minutes. No sandbox required, no hidden fees.
Standard e-signatures prove intent. Identity-verified e-signatures prove intent and identity. Here is why the distinction matters and how to implement it.
Regulated industries cannot afford document chaos. Learn how secure digital document management reduces compliance risk while streamlining operations.
From exam integrity to dormitory access, educational institutions are turning to biometric security to protect students and maintain academic standards. Here's what the shift looks like.
