We enabled FACEIO Presentation Attack Detection (PAD) to protect authentication sessions against presentation attacks such as printed photos, smartphone displays, and video replays.
During testing, several attempts were correctly rejected with a Presentation Attack Detection error.
We would like to better understand the recommended security architecture for applications that require stronger protection against repeated presentation attempts.
Specifically:
1. How should PAD be combined with other FACEIO security mechanisms?
2. Is there any additional configuration recommended?
3. Will the upcoming PAD update improve smartphone-screen detection?
4. When is the new model expected to be deployed?
5. What role should PIN confirmation play alongside facial authentication and PAD?
FACEIO Liveness Detection, PAD and Smartphone Presentation Attacks
✓ Accepted Solution
FACEIO PAD is designed to detect common presentation attacks, including smartphone displays, printed photographs, and video replays.
For applications with elevated security requirements, FACEIO recommends using a layered authentication architecture rather than relying on a single security mechanism.
Recommended Security Layers
The recommended setup is:
-
PIN confirmation as the first security layer
-
Facial authentication for biometric identity verification
-
Presentation Attack Detection / Liveness Detection
-
Application-level retry and rate-limiting controls
Each layer serves a different purpose.
-
PIN confirmation verifies knowledge of a secret associated with the legitimate user.
-
Facial authentication verifies the user's biometric identity.
-
PAD / Liveness Detection analyzes the capture for presentation attacks such as photographs, screens, or replayed content.
-
Retry controls prevent repeated automated or manual attempts against the authentication flow.
For security-sensitive applications, we recommend terminating the authentication flow or introducing a cooldown after several failed attempts instead of allowing unlimited retries.
Upcoming PAD Update
A new PAD model is scheduled for progressive deployment during November 2026.
The update includes further improvements for:
-
Smartphone-screen presentation attacks
-
Static-image attacks
-
Close-range presentation scenarios
-
Challenging capture conditions
Deployment will be rolled out progressively across the FACEIO processing infrastructure.
Configuration
There is currently no additional PAD sensitivity setting that developers need to configure.
The recommended approach is to:
-
Keep PAD enabled
-
Keep PIN confirmation enabled for critical applications
-
Apply reasonable authentication retry limits
-
Keep the FACEIO SDK updated
Why Use PIN Together With Facial Authentication?
PIN confirmation does not replace facial authentication.
It acts as an additional security factor.
Facial authentication verifies who the user is, while the PIN verifies something the user knows, and PAD verifies that the biometric capture is being presented through an expected live-authentication scenario.
Combining these mechanisms provides a stronger authentication flow than using any one of them independently.
Developers currently evaluating PAD can continue using the existing protection, or contact FACEIO Support regarding plan options while waiting for the November model rollout.
