Aware announced that its Intelligent Liveness solution recorded zero successful injection attack bypasses across 900 test scenarios in an independent evaluation conducted by BixeLab, an NVLAP-accredited biometric testing laboratory. The evaluation was performed in alignment with CEN/TS 18099:2024, the European technical specification for injection attack detection in biometric systems.
The evaluation covered 600 injection attack transactions spanning 10 Injection Attack Instrument species and four attack methods: virtual camera, USB camera, function hooking, and rooted device scenarios with tamper-detection bypass. No successful injection bypass was recorded across any combination. An additional 300 bona fide transactions were tested, yielding a Bona Fide Presentation Classification Error Rate of 0 percent, meeting the thresholds recommended by CEN/TS 18099 Annex A.
The BixeLab evaluation extends a run of independent validations, following Aware’s earlier BixeLab PAD and DHS RIVR results that confirmed zero successful attacks at ISO/IEC 30107-3 Levels 2 and 3, zero false rejections at Levels 1 and 2, and 100 percent user completion at Level 3. In the DHS 2025 Remote Identity Validation Rally, Aware (operating under the alias MTDS1) was among only five vendors meeting all high-performance goals, achieving zero failure-to-extract rates and the lowest false match rate among the top three performers.
Aware also holds ISO/IEC 19795-10 bias certification confirming consistent performance across age, sex, and ethnicity demographic groups, and FIDO2 Server Certification for passkey-based authentication combined with biometric verification. Intelligent Liveness, which debuted at Identity Week America in September 2025, is positioned for identity proofing, digital onboarding, and account recovery use cases in financial services, government, and enterprise markets.
CEN/TS 18099:2024 was developed to test biometric system resilience against injection attacks, which are internal, data-level assaults that bypass the camera sensor entirely and are invisible to standard presentation attack detection measures. The standard has become a key benchmark in liveness detection as injection attacks using deepfake tools have proliferated, including sophisticated iOS video injection tools capable of replacing live camera feeds with synthetic video.
Aware CEO Ajay Amlani said deepfakes and injection attacks have become a systemic risk and called on customers to demand that vendors comply with industry-standard certifications. CTO Dr. Mohamed Lazzouni noted that independent testing is critical because attack techniques evolve constantly. BixeLab CEO Ted Dunstone said third-party validation ensures biometric systems are secure, fair, and transparent across populations. Aware is headquartered in Burlington, Massachusetts.
Sources: Aware, GlobeNewswire, StockTitan
–
By the ID Tech Editorial Team
