How liveness checks get spoofed and what actually stops it

What liveness is supposed to prove

A liveness check answers one question: is a real, live person in front of the camera right now? Passive liveness analyzes a single image or short clip for signs of life. Active liveness asks the user to do something, turn their head, smile, follow a dot. Both feed an identity verification flow that is supposed to bind the account, the wallet, or the allowlist spot to a unique human. The whole sybil defense rests on that binding being hard to fake at scale.

Attackers industrialized the faking. What was once a research demo is now a service: spoofing kits sold with tutorials, priced per verification, with customer support.

The three spoof methods in the wild

Presentation attacks are the oldest: printed photos, replayed videos on screens, silicone masks. Modern liveness catches the crude versions, but high-quality masks and 4K screen replays still pass weaker implementations, especially passive checks that analyze a single frame.

Deepfake video is the second wave. Real-time face swapping lets an attacker drive someone else's face, or a fully synthetic face, through a video liveness check that expects natural motion. The output looks alive because, frame by frame, it is a plausible face in motion. Passive liveness is particularly exposed here since it never asks the face to do anything unexpected.

Injection attacks are the third and most dangerous. Instead of fooling the camera, the attacker bypasses it: synthetic video is injected into the app's video pipeline, often through a virtual camera or a compromised SDK layer. The verification system analyzes perfect deepfake footage and finds no presentation artifacts, because there was no presentation. Everything downstream of the injection point sees a legitimate capture.

What actually stops each method

Challenge-response liveness beats presentation and most deepfakes by demanding unpredictable actions: randomized head movements, spoken phrases, or light-pattern responses that a prerecorded or swapped video cannot produce on the fly. The challenge has to be genuinely unpredictable per session; a fixed sequence just becomes training data for the next kit.

Injection detection beats the third method by verifying the capture path itself: is this frame from a real camera sensor, through an unmodified pipeline? OS-level camera attestation, pipeline integrity checks, and metadata analysis catch virtual cameras and injected feeds that look perfect to the liveness model.

Neither is sufficient alone, and both degrade over time as the kits improve. Treat them as layers with a refresh cycle, not as solved problems.

Liveness as one vote, not the verdict

The resilient design treats a passed liveness check as one signal in a larger identity decision. Device fingerprinting catches the farm running a thousand verifications from one machine. Behavioral analysis catches the scripted flow around the check. Document verification binds the face to an identity document that is itself verified. And velocity limits catch the attacker who passes every check but does it four hundred times a day.

Sybil resistance was never going to come from a single clever camera trick. It comes from making every identity expensive to fabricate across every layer at once, so the cost of the attack exceeds the value of the allowlist spot, the airdrop, or the account.