Liveness, PAD and injection testing

Liveness describes confidence that a biometric sample comes from a live person; presentation-attack detection addresses artefacts shown to a sensor; injection protection addresses manipulated media introduced elsewhere in the capture chain. Buyers should ask which problem was actually tested.

For: security, fraud, procurement and assurance teams. This is independent information, not legal, compliance or security advice.

Three different questions

Question	Typical control
Is a live human at the sensor?	Active or passive liveness/PAD
Was an artefact presented to the sensor?	Presentation-attack classification
Did media bypass or replace the sensor feed?	Injection, device integrity and capture-path controls

Read the scope

• Which attack species and difficulty levels were used?
• Was the submitted production build tested?
• Which devices, cameras, browsers and SDK versions are covered?
• Are results reported at the threshold you will deploy?
• Does testing cover demographic and environmental variation?
• When must the product be retested after material changes?

Operational evidence matters

Laboratory results should be combined with production monitoring, anomaly investigation, attack intelligence, change control and rapid response. The control can also be bypassed through weak document validation, recovery or reviewer procedures.

Procurement outcome

Record a claim as narrow evidence: for example, a named version was evaluated by a named laboratory against a named test and date. Do not translate that into the unsupportable conclusion that the service is 'deepfake-proof'.

Evidence and limits

MyID separates enacted rules, official implementation material, testing and vendor claims. A source can establish what its publisher says; it does not prove that every product, deployment or interpretation works as claimed. Where Irish implementation remains unsettled, this page says so.

• ENISA Remote Identity Proofing: Attacks and Countermeasures
• NIST SP 800-63A-4 identity proofing

Sources checked 22 August 2026. Re-check the linked primary material before making a consequential decision.

Next useful pages

• Deepfake controls
• Procurement checklist
• Identity providers