For years, 3D spoofing was considered one of the most serious threats to facial recognition. Attackers could use realistic masks, prosthetics, or other three-dimensional replicas to imitate a target person’s facial structure and attempt to defeat biometric checks.
That threat has not disappeared. But the attack surface has changed.
In modern remote identity verification, an attacker may not need to place a sophisticated 3D replica in front of a camera at all. They can manipulate the digital journey before biometric data reaches the recognition system. A virtual camera, injected video stream, manipulated image, or deepfake may allow fraudulent biometric data to bypass the capture layer entirely.
This shift is important because many traditional liveness defenses are designed to detect attacks occurring at the sensor. When an attacker bypasses the sensor, the security problem moves deeper into the system architecture.
A 2025 NIST conference presentation specifically described injection attacks as the biggest threat in mobile identity verification and noted that even authentic face images acquired from public sources could potentially be presented through sensor bypass mechanisms such as virtual cameras. NIST’s 2025 facial recognition conference materials provide a useful view of this changing threat landscape.
Why 3D Spoofing Became Such a Major Concern
Traditional biometric presentation attacks focus on what reaches the physical capture device.
For face recognition, that might mean displaying a photograph, replaying a video, wearing a mask, or presenting another artificial facial artifact. A 3D spoof attempts to reproduce enough physical structure to convince a facial biometric system that it is looking at the legitimate subject.
Three-dimensional attacks historically mattered because they could defeat simplistic anti-spoofing methods designed to identify flat photographs or basic replay attacks.
Modern presentation-attack detection is much broader. ISO/IEC 30107 defines presentation attacks and provides a framework for evaluating presentation-attack detection mechanisms. Its current Part 3 standard covers performance assessment, reporting, and classification of known attack types. ISO/IEC 30107-3:2023 reflects the continued importance of physical presentation attacks in biometric security.
The problem is that remote identity verification no longer ends at the camera.
The Attack Has Moved Beyond the Camera
A modern identity verification system can be thought of as a chain:
user → camera → capture software → biometric data → communication channel → processing engine → decision system
A 3D mask attacks the process at the first stage. The attacker presents something artificial to a legitimate sensor and hopes the detection system accepts it as a live face.
An injection attack takes a different route.
Instead of presenting fraudulent content to the camera, the attacker attempts to insert manipulated biometric data somewhere after capture or bypass the capture process altogether.
That distinction is fundamental.
FIDO’s biometric requirements explicitly distinguish presentation attacks from injection attacks. Its documentation describes injection attacks as attempts to bypass the biometric capture device by inserting face images or video that appear to be captured live. FIDO’s biometric requirements documentation also notes that deepfake material can be used in this type of attack.
In other words, better liveness detection alone may not solve the problem.
Why Sensor-Bypass Attacks Are More Concerning
A sophisticated 3D mask still has to interact with the capture system.
That gives the defensive system something physical to inspect. It may analyze movement, texture, depth-related information, lighting behavior, reflections, or other characteristics associated with genuine facial presentation.
An injected attack can be fundamentally different.
The system may receive a digital image or video that never originated from the camera in the first place. The biometric engine sees apparently valid input, but the relationship between the physical user and the submitted biometric sample has already been broken.
This creates an architectural weakness rather than simply a recognition weakness.
A facial matcher might correctly determine that an injected image resembles the enrolled customer. A liveness module might also perform well when it receives a genuine camera stream. Neither component necessarily knows that the data was inserted upstream.
That is why the security boundary must extend beyond biometric matching.
Deepfakes Are Part of the Problem, Not the Whole Problem
Deepfakes receive considerable attention because generative AI can produce highly convincing facial imagery and video.
They matter, but focusing exclusively on deepfakes can obscure the more important architectural issue.
An attacker does not necessarily need to generate an artificial person. An authentic image of the target, obtained from a public source, could be enough if the attacker can inject it into the verification pipeline.
The difference is significant.
A deepfake detector asks whether the media appears manipulated.
An injection defense asks a broader question:
Did this biometric data genuinely come through an authorized capture path?
That distinction means a system can need both media-level detection and capture-path protection.
NIST has continued to treat deepfakes, morphing, presentation attacks, and remote identity verification as distinct but related technical challenges. Its 2025 International Face and Fingerprint Performance Conference included dedicated sessions on injection attacks, remote identity verification, deepfakes, morphing, and operational testing. NIST’s IFPC 2025 program illustrates how broad the current evaluation landscape has become.
3D Spoofing Still Matters
Saying that 3D spoofing is no longer the top risk does not mean organizations should stop testing for it.
Physical presentation attacks remain relevant, particularly in environments where a fraudster can directly interact with a biometric sensor.
They can include:
- realistic masks and prosthetics
- printed or displayed facial images
- replayed videos
- partial facial artifacts
- makeup or disguises
- other artificial presentation methods
NIST has demonstrated that presentation attacks can include photographs, digital displays, makeup, and other attempts to alter or impersonate facial appearance. Its research emphasizes that attackers may attempt either to appear as another person or prevent the system from recognizing them. NIST’s overview of facial presentation attacks illustrates why these threats remain part of biometric security testing.
The difference is priority.
For remote verification, an organization should not spend most of its security effort defending the camera while leaving the data path poorly protected.
The Rise of Injection as an Architectural Threat
Injection attacks are especially dangerous because they exploit trust between system components.
Imagine a remote onboarding process where the customer opens an application, captures a selfie, and submits it to a verification server.
A traditional security model might focus heavily on whether the selfie is genuine.
A stronger model asks whether the application can prove that:
- the camera actually captured the image,
- the capture component was operating legitimately,
- the biometric sample was not replaced,
- the communication channel was not manipulated,
- downstream processing received the same biometric evidence that the capture component produced.
That is a very different security problem.
ISO is now developing dedicated work around biometric data injection attack detection. The ISO/IEC 25456 working draft addresses injection attacks, detection of injection attack instruments, mitigation, and testing approaches.
The direction of standards development is significant: injection is becoming a distinct engineering problem rather than something organizations can assume traditional presentation-attack detection will automatically solve.
What This Means for Liveness Detection
Liveness detection remains essential, but organizations need to understand what type of liveness is being tested.
A liveness system designed to operate on camera input can be highly effective against attacks presented directly to the sensor.
That does not automatically protect the system from manipulated data inserted after capture.
This is why businesses evaluating liveness technology should ask two separate questions:
Can the system detect fraudulent presentation at the camera?
Can the architecture prevent or detect biometric data being injected around the camera?
The first question concerns presentation attack detection. The second concerns system integrity.
A useful related resource is deep learning for face anti-spoofing, which explores how machine-learning approaches can strengthen defenses against facial presentation attacks.
Organizations also need to decide whether active or passive techniques are appropriate for their risk model. The active vs. passive liveness detection analysis provides broader context on the trade-offs between these approaches.
How Attackers Can Exploit the Weakest Layer
Security failures often occur because individual components are evaluated in isolation.
A company may have:
- a strong face matcher
- a high-performing liveness model
- encrypted communication
- a modern mobile application
Yet the overall system can still be vulnerable if a compromised environment allows fraudulent biometric media to bypass the intended capture path.
This is similar to protecting a physical building with excellent locks while leaving an unsecured service entrance.
The lesson for architecture teams is to identify every point where biometric data exists in a modifiable form.
That includes:
- camera input
- local processing
- SDK interfaces
- application memory
- API requests
- serialization layers
- transport channels
- server-side processing
- decision engines
Each transition represents a potential trust boundary.
A Better Security Model for Remote Face Verification
A resilient architecture should use multiple layers rather than placing all responsibility on the liveness model.
Capture integrity
The system should establish confidence that the biometric sample originated from an authorized capture component.
Presentation attack detection
The capture layer should detect physical attacks such as photographs, replay attacks, and artificial facial presentations.
Media analysis
The system can inspect images and video for manipulation, inconsistencies, or synthetic characteristics where appropriate.
Transport and application protection
Communication between the capture component and backend should prevent unauthorized modification or substitution of biometric data.
Injection detection
The architecture should look for evidence that biometric data was introduced through an unauthorized path.
Risk-based decisioning
A suspicious biometric event should not necessarily be treated as an isolated binary result. Other identity and fraud signals should influence the final decision.
This layered model reduces dependence on any single detection technique.
Why 3D and Deepfake Detection Still Need Testing
It is tempting to divide attacks into “old” and “new,” but real attackers do not follow that structure.
A single fraud attempt might combine several techniques.
For example, an attacker could use an artificial facial representation at the capture layer while simultaneously attempting to manipulate application data. Another attacker may avoid physical spoofing completely and rely on injected video.
The defensive system therefore needs attack-oriented testing rather than feature-oriented testing.
Ask:
- Can the system detect physical presentation attacks?
- Can it recognize replayed content?
- Can it identify suspicious media characteristics?
- Can the application distinguish genuine camera input from virtual-camera data?
- Is biometric data protected between capture and processing?
- Can the backend detect unexpected submission patterns?
- What happens when the capture component behaves abnormally?
ISO’s presentation attack detection framework makes an important distinction here: its PAD standards focus on attacks occurring at the biometric capture device, while attacks elsewhere in the system fall outside that specific scope.
That limitation should inform how organizations build their testing strategy.
The Business Impact of Getting This Wrong
A biometric attack is not simply a technical failure.
If an attacker bypasses remote identity verification, the consequences can include fraudulent account creation, account takeover, financial losses, regulatory exposure, and reputational damage.
There is also a customer-experience cost on the other side.
Overly aggressive defenses can reject legitimate users, increase retries, and push more applications into manual review.
The challenge is therefore to improve security without turning the onboarding process into an obstacle course.
This is where layered risk assessment becomes valuable. Straightforward applications can move through normal verification, while suspicious sessions receive stronger scrutiny.
What Businesses Should Look for in a Facial Recognition Provider
A vendor evaluation should now go well beyond the question, “How good is your liveness detection?”
Ask how the complete system addresses:
Presentation attacks: What physical spoofing scenarios have been evaluated?
Injection: Can biometric input be substituted or redirected outside the authorized capture path?
Application integrity: How does the system know the expected SDK or capture component is producing the data?
Deepfakes: What happens when synthetic imagery or video reaches the system?
Replay attacks: Can previously recorded biometric material be reused?
Operational conditions: How does performance change across devices, cameras, lighting, and network environments?
Independent evaluation: Has the technology been tested against recognized standards or certification requirements?
FIDO’s Face Verification Certification program is particularly relevant because its testing scope includes biometric matching, facial liveness, deepfakes, bias, and injection attacks rather than treating face matching as the only security question.
Choosing the Right Technical Controls
For development teams, the implementation should reflect the threat model.
A face liveness SDK can provide an important presentation-attack defense, while a broader facial recognition stack handles biometric comparison.
The key is to avoid assuming that adding a liveness component automatically secures the entire identity-verification pipeline.
Security controls should be mapped to specific attack locations.
| Attack or failure mode | Where it occurs | Example defense | Primary objective |
| Photo or printed face | At camera | Presentation attack detection | Detect artificial presentation |
| Replay video | At camera | Liveness and replay analysis | Prevent reuse of captured media |
| 3D mask | At camera | Advanced anti-spoofing | Detect physical facial replicas |
| Deepfake video | Capture or data path | Media analysis and liveness | Detect synthetic or manipulated input |
| Virtual-camera bypass | After or around capture | Capture-path integrity | Confirm legitimate sensor origin |
| Biometric injection | Data path | Injection detection and protected interfaces | Prevent unauthorized replacement |
| Credential or identity abuse | Decision layer | Risk analytics and identity controls | Detect broader fraud |
This model makes one point clear: no individual biometric feature should be expected to defend every attack.
The Direction of Biometric Security
The evolution away from 3D spoofing as the dominant concern reflects a broader change in cybersecurity.
Attackers increasingly target the connections between trusted components rather than attacking the strongest component directly.
For facial recognition, that means the camera is no longer the only security boundary.
The application, SDK, device, transport layer, backend interface, and decision engine all become relevant to biometric security.
That is why security teams should evaluate facial recognition as an end-to-end system.
For organizations exploring the practical differences between attack types, deepfake attack prevention strategies provides additional context on building defenses against manipulated biometric media.
Development teams can also use the Recognito GitHub repository as a technical resource when evaluating how biometric components fit into an application architecture.
Conclusion
3D spoofing remains a credible facial recognition threat, but it is no longer sufficient to define the modern biometric threat landscape.
Remote verification has introduced a broader problem: attackers may manipulate biometric data without ever presenting a sophisticated physical replica to the camera.
That makes injection, sensor bypass, deepfake media, replay, and application-level attacks increasingly important.
The strongest defense is therefore layered. Presentation attack detection still matters, but it must be combined with capture integrity, protected biometric data paths, injection detection, media analysis, risk-based decisioning, and appropriate testing.
For organizations building secure facial verification systems, Recognito can support biometric workflows that treat liveness and recognition as components of a broader security architecture.
Frequently Asked Questions
Is 3D spoofing still a threat to facial recognition?
Yes. Three-dimensional masks and other physical presentation attacks remain relevant. The change is that remote systems now face additional threats that can bypass the physical capture process entirely.
What makes injection attacks different from 3D spoofing?
A 3D spoof is presented to the biometric capture device. An injection attack attempts to bypass that device and introduce fraudulent biometric data into the processing path.
Can liveness detection stop injection attacks?
Not necessarily. Liveness designed for camera-level presentation attacks may not detect biometric data that is injected after capture. Injection resistance requires additional architectural controls.
Are deepfakes the biggest facial recognition threat?
Deepfakes are an important threat, but they are only one attack method. An attacker may also use authentic facial images, replay attacks, virtual cameras, or other injection techniques.
Should businesses stop testing for 3D spoofing?
No. Physical presentation attacks remain part of a complete biometric threat model. The mistake is treating them as the only major threat while overlooking attacks against the digital capture and processing path.
