What is Facial Liveness Detection?

Facial liveness detection is a set of technologies and processes that businesses use to determine whether a selfie or video belongs to a real, live person or some kind of spoof, like a mask or AI-generated asset. It’s often used in conjunction with other techniques to reduce the risk of fraud.

For example, on its own, selfie verification can be an extremely helpful identity verification (IDV) method for businesses, adding an extra layer of security against fraud. As just one example, Instacart pairs selfie verification with government ID verification to help protect against stolen, forged, or counterfeit documents while seamlessly reverifying users in high-risk scenarios, such as logging in from a new location or device, changing account details, or accessing sensitive information.

But as bad actors increasingly add AI to their toolkits to engage in identity theft, account takeovers (ATO), and other types of fraud, it’s natural to ask: How can online businesses detect AI-generated selfies and protect themselves from the types of fraud those images enable?

Facial liveness detection is a crucial technology that can help fight AI-generated selfies.

Below, we explain what liveness detection is, how it works, and why it’s so important. We also walk through the different types of this technology you may want to consider adding to your IDV processes.

What is liveness detection?

Liveness detection refers to a collection of different methods and technologies used to evaluate a selfie captured for identity verification. The goal of facial liveness detection is to determine whether the selfie is of a real, living person or if it was in some way faked (e.g. if it was a mask, print, digital replay, recording, or an AI-generated selfie or deepfake). 

At its simplest, liveness detection may simply involve a member of your risk team manually reviewing selfies looking for spoofs or altered images. Today, however, it more often leverages automated systems powered by sophisticated image analysis algorithms.

What gets analyzed depends on the specific techniques, algorithms, and models being used. That said, facial liveness detection often considers:

• Image data like skin texture, facial ratios, the presence (or absence) of light, shadows, glares, and more

• Metadata contained within the image file, such as geolocation data about where the photo was taken and what kind of device captured the image

• Reflexive signals that monitor human reflexes (breathing, blinking, eye dilation, etc.) before and after an image is captured

Why is liveness detection needed?

Liveness detection is a necessary part of determining whether a selfie is from a live person or some form of spoof. Without this process, it would be easy for fraudsters and bad actors to fake selfies in order to gain access to accounts, products, services, and content that they shouldn’t have access to. 

For industries required to perform identity verification by law, liveness detection offers increased assurance that a person actually is who they say they are. 

This is an essential part of Anti-Money Laundering (AML) regulations that financial institutions are subject to, as well as Know Your Seller (KYS) regulations that online marketplaces must comply with. It also facilitates age verification, which companies in social media, gaming, adult entertainment, and other spaces are increasingly required to perform. 

However, keep in mind that liveness detection is not always a strict legal mandate. According to the latest NIST Digital Identity Guidelines, liveness detection is only mandated when facial recognition is used for identity proofing under SP 800-63A-4. If facial recognition is not used, facial liveness detection is more of a recommended effective method to help businesses meet regulatory standards.

Even industries not required to perform IDV by law can benefit from incorporating facial liveness detection into their workflows. For example:

• Employers with remote workers can leverage workforce IDV with selfie verification and liveness detection whenever an employee attempts to log into their work accounts from a new device or an atypical location. 

• Digital health services and online education platforms can deploy liveness detection to avoid healthcare and education fraud. 

It’s also worth noting that the National Institute of Standards and Technology (NIST) considers liveness detection a critical piece of achieving identity assurance level 2 (IAL2). This means any provider looking to meet this standard should build liveness detection into their approach from the start.

Types of liveness detection

While liveness detection is often discussed as a singular technique, there are actually multiple types of facial liveness detection methods that offer different benefits and drawbacks, such as: 

Passive liveness detection

Passive liveness detection prompts the individual to capture and submit a selfie for verification. Once submitted, the selfie is then processed by a number of algorithms designed to analyze things like skin texture, shading, facial dimensions, and more. It’s “passive” because the individual doesn’t need to do anything other than take a selfie for the liveness detection to work. 

Active liveness detection

Active liveness detection requires the individual to follow specific instructions while taking a selfie, such as turning their head, smiling, blinking, or holding up a hand or a certain number of fingers. Because these prompts (also called challenges) are difficult to anticipate, they can offer an additional layer of protection against AI-generated face spoofs. 

Single vs. multi-image liveness detection

Single-image liveness detection relies on one photo to assess liveness, while multi-image detection analyzes multiple images.

Because it captures more data and risk signals for analysis, multi-image liveness detection can provide additional assurance over a single image. But it can also introduce additional friction and hamper the user experience. 

When determining whether to use single-image or multi-image liveness detection, businesses should consider their risk tolerance as well as their users’ expectations. In many cases, businesses can adjust the number of images requested based on real-time risk signals. 

Document liveness detection

While liveness detection is most often used to talk about selfies, you can also use it to analyze documents to ensure that they are unaltered physical documents and IDs — not some form of digital spoof. In this context, however, this analysis type is typically lumped under the overall umbrella of document verification or government ID verification. 

Challenges in implementing liveness detection

While liveness detection is a powerful tool, implementing it can come with challenges, especially if you choose the wrong solution provider to work with. Some challenges to consider include:

• Complexity of integration: Any liveness detection solution you choose will, by its nature, need to be embedded within your onboarding flow (and potentially your account login flow, if used for reverification purposes). In some instances, this integration can be complex and require significant resources to get right.

• False rejections: While liveness detection solutions are constantly improving, there is always the risk — however slight — of false rejections, where a legitimate user is flagged as being potentially fraudulent. This can harm the user experience and conversion rates if not handled properly. 

• Device availability: A liveness detection solution can only be as good as the images that the user captures and uploads. Older devices may result in photos of poor quality, which can be difficult to effectively evaluate — potentially requiring alternative strategies for users with those devices. 

When evaluating potential solutions, it can be helpful to ask how they address these challenges.

The future of facial liveness detection

While it can be difficult to know exactly where liveness detection technologies are moving in the future, some trends we’re seeing here at Persona include:

• Greater variability in challenges: Challenges, as noted above, are the prompts sometimes given to users, telling them how to pose in a selfie for liveness detection. Having a larger variety of prompts to pull from means that it will be harder for fraudsters to anticipate — and therefore more difficult to create AI-generated assets. In the future, we expect to see a much wider catalog of challenges used in liveness detection.

• Deployment of micromodels: A micromodel is an algorithm that is trained to detect a very specific fraud signal. In the context of liveness detection, you might create a micromodel that is very good at detecting unnaturally smooth skin textures, for example. These smaller models often allow for more effective analysis versus a single larger model. We expect to see wider deployment of micromodels in the future. 

• Leveraging ensemble models: Ensemble models are models that blend together multiple algorithms, micromodels, and sources of training data. They often allow for a more nuanced understanding of whether or not liveness is detected, or if other forms of fraud are present. Like micromodels, ensemble models are likely to be used to a greater extent in the future. 

Liveness detection is just one piece of the puzzle

Liveness detection is a powerful barrier against AI-generated selfies, documents, deepfakes, and other fake, forged, or spoofed images, but it shouldn’t be your only line of defense. A comprehensive identity verification strategy should include multiple layers of overlapping protection against each fraud risk your business faces, and that includes AI-generated media. 

For example, just because facial liveness detection can help you detect fraudulent images doesn’t mean you should make it easy for a fraudster to upload those images during verification. By following best practices and implementing robust security protocols that prevent nefarious uploads, you make it more difficult for novice fraudsters to even get their images into your system to begin with. 

And by collecting passive signals during the selfie submission, it becomes possible to detect when a person has jailbroken their device, if they are using an emulator or virtual camera, or if they’re doing anything else that may point to fraud. All of this helps you detect and keep out more tech-savvy fraudsters who may slip past your first layer of security. 

Likewise, pairing selfie verification with government ID verification, database verification, and other methods provides you with additional opportunities to collect risk signals that can help you identify fraud. 

Leverage the best liveness detection software with Persona

At Persona, we understand just how challenging it can be for businesses to protect themselves against AI-generated images during verification. That’s why we’ve built liveness detection into our entire platform of identity tools. Whether you deploy selfie verification, government ID verification, document verification, or a combination of methods, you can rest easy knowing that Persona’s liveness detection software was specifically designed to prevent fraudsters from slipping through. 

Want to learn more about how Persona can help you protect your business against generative AI? Download The Strategic Guide to Fighting GenAI Fraud or contact us for a demo today.