PAD

In short

PAD stands for presentation attack detection. It is a biometric system's ability to determine whether what was presented to the sensor comes from a real, present person or from an instrument built to impersonate one.

It is the name used by standards and test reports. Liveness detection is the name the same control goes by in the product and in the sales conversation.

What counts as a presentation attack

A presentation attack is any attempt to fool the sensor by showing it something. The object shown is called a presentation attack instrument, and the list is broader than the word "photo" suggests.

• Two-dimensional reproduction — a printed photograph, a high-quality paper image, a cutout with the eyes punched through.
• On-screen reproduction — a video or an image displayed on a phone, a tablet or a monitor in front of the camera.
• Three-dimensional instruments — masks made of various materials, face models, replicas built from photographs.
• A synthetic face presented — a deepfake played back on a screen and shown to the device's camera.
• Instruments for other modalities — a fingerprint made of elastic material for a fingerprint reader, a recording played back in front of the microphone in voice biometrics.

What all of these share is the point of entry: the sensor works normally and captures whatever is in front of it. The attack is in what gets placed in front of it, not in the software.

PAD is broader than liveness detection, and that is why the standard uses that word

The two terms are used as synonyms and in practice cover the same control, but they do not say exactly the same thing.

• Liveness detection — names the question of presence: whether there is a live person in front of the sensor.
• PAD — names the detection of any attack instrument, including cases where vitality is not what is at stake. A mask worn over a live face is a presentation attack committed by a live person.

PAD is also modality-agnostic: it applies to face, fingerprint, voice or iris under the same conceptual framework. That is why it is the term standards and lab reports use, and liveness detection is the one the product uses. When comparing providers it is worth reading the two as the same control and asking for the test data, not the word.

What a PAD test measures

The ISO/IEC 30107-3 standard defines the metrics a test is reported with. There are three, and they answer different questions.

• APCER — the proportion of attack presentations the system incorrectly classified as legitimate. It is how many attacks got through.
• BPCER — the proportion of legitimate presentations the system incorrectly classified as an attack. It is how many real users were rejected.
• IAPMR — in a full-system evaluation, the proportion of attack presentations that ended up producing a match.

The first two move in opposite directions, just like FMR and FNMR in biometric matching: a system stricter with attacks rejects more legitimate users. A PAD result that reports only one of the two does not allow any real evaluation.

The standard sets the method and these metrics. It does not define conformance levels. The levels usually cited alongside it belong to the iBeta testing program, which applies that methodology.

PAD does not cover injection attacks

This is the boundary of the term, and the one that causes the most confusion when comparing providers.

PAD reasons about what reaches the sensor. A video injection attack does not present anything to the sensor: it replaces the video stream before it reaches the application, using a virtual camera, an emulator or a manipulation of the device itself. The image never passed through a lens.

A system with PAD measured and passed can still be vulnerable to injection, because these are problems at different layers. Injection is covered by verifying the origin of the stream and the integrity of the execution environment, controls that also depend on what the operating system exposes and that no biometrics provider solves on its own.