Purpose
PAD is a biometric control layer; claims are bounded to certificate scope.
PLATFORM · CHECKID
Presentation Attack Detection
PAD is a biometric control layer; claims are bounded to certificate scope.
CAPABILITYInput → Processing → Output
CONTROLPolicy · risk · standard
EVIDENCEResult · trace · scope
PLATFORM
Presentation Attack Detection
PAD is a biometric control layer; claims are bounded to certificate scope.
Trust boundary
Capability is published only within source/evidence scope.
Developer integration
SDK · REST API · evidence contract
↗PRESENTATION ATTACK DETECTION
PAD is an evaluation problem, not simply a “liveness” label
ISO/IEC 30107-3:2023 focuses on PAD performance assessment and reporting. It does not prescribe a specific anti-spoofing algorithm or overall system security.
source
Bona fide presentation
Legitimate presentations used to evaluate normal-user behaviour.
InputGenuine user
OutputBona fide result
exception
Attack presentation
A presentation intended to interfere with or deceive the capture/PAD subsystem.
InputPresentation attack instrument
OutputPAD response
verify
PAD subsystem
Evaluates capture evidence within the assessed component boundary.
InputCapture signal
OutputPAD score / decision
assure
Testing & reporting
Results must remain bound to test protocol, attack set, platform, version and certificate scope.
InputTest set
OutputReport + limitations
PAD ASSURANCE
Metric and certificate basis
The current reference edition and the certificate basis must be shown separately.
| Item | Meaning | Publication rule |
|---|---|---|
| APCER | Attack presentations classified as bona fide | Publish numbers only with matching report/evidence |
| BPCER | Bona fide presentations classified as attack | Not equivalent to face-match accuracy |
| ISO/IEC 30107-3:2023 | Current PAD testing/reporting reference | REFERENCE |
| ISO/IEC 30107-3:2017 | Basis stated on PCEB 26/04/06 | CERTIFICATE BASIS |
| PAD Level 2 | Level in the applicable assessment/certification scheme | Do not describe as a universal ISO product level |
Technical basisSOURCE-BACKED
SourceISO + TAYLLORCOX PCEB evidence
StandardISO/IEC 30107-3
Version2023 current / 2017 certificate basis
ApplicabilityPAD evaluation and publication boundary
EvidencePCEB 26/04/06 + standards register
TECHNICAL REFERENCE
PAD & identity attack model: correct scope, correct evidence
Presentation attack ≠ capture injection ≠ client compromise ≠ API attack
Presentation layer
ISO/IEC 30107-3:2023 addresses PAD performance testing and reporting for attacks occurring at the biometric capture device during presentation. It explicitly does not constitute an overall system vulnerability assessment.
Capture injection
Virtual camera, injected image/video and emulator paths may bypass normal capture and are not automatically equivalent to presentation attacks. CheckID anti-injection controls are claimed only with security architecture or test evidence.
Client integrity
Root/jailbreak, application hooking and payload tampering belong to the client-integrity layer. A PAD certificate does not establish these controls.
Channel/API
Replay, credential theft, request substitution and API misuse belong to channel/API security. Authentication, request signing, token handling and replay controls require separate evidence.
Identity fraud
Stolen evidence, document substitution, synthetic identity and source conflict are broader fraud scenarios that belong in proofing/risk/source policy rather than being labeled liveness attacks.
Evaluation evidence
PCEB 26/04/06 remains bound to the ISO/IEC 30107-3:2017 basis, Level 2, module/platform scope and validity stated on the certificate. The current 2023 technical reference does not rewrite the certificate basis.
Authoritative technical references
- ISO/IEC 30107-3:2023 — PAD testing and reportingPublished; current reference
- NIST SP 800-63-4 — Digital Identity GuidelinesFinal; July 2025
IDENTITY ATTACK MODEL
PAD is one control layer, not the complete security model
The threat taxonomy separates presentation attacks at capture from injection, client compromise, API/channel attacks and identity fraud so ISO/IEC 30107-3 or a PAD certificate is not stretched beyond scope.
| Layer | Examples | Evidence boundary |
|---|---|---|
| Presentation | Print, display replay, mask/presentation artefact | ISO/IEC 30107-3/certificate only for the evaluated module/platform/scope. |
| Capture injection | Virtual camera, injected media, emulator path | Requires separate security/test evidence; not inferred from PAD. |
| Client compromise | App tampering, hooking, rooted/jailbroken | Controls are published only from mobile/client security sources. |
| Channel/API | Replay, credential abuse, request substitution | API authentication does not prove all replay controls. |
| Identity/evidence fraud | Stolen evidence, source conflict, impersonation | Requires corresponding proofing/source/policy controls. |