HyperVerge says its HyperKYC software and facial-liveness backend passed two BixeLab evaluations, one against presentation attacks and one against digital injection attacks, with no attack accepted as genuine in either. The two evaluations used different software versions and test procedures.
Presentation attacks place an artifact, such as a photograph or mask, in front of a camera; injection attacks instead insert manipulated imagery through software or a substituted camera feed.
The presentation-attack assessment followed ISO/IEC 30107-3:2023 and BixeLab’s internal Level C sophistication framework, labeled Level 3 in its confirmation letter. Conducted in September, it used five attack-instrument species derived from six consenting subjects and recorded zero attack-classification errors across 150 attempts.
Genuine-user testing recorded two misclassifications in 50 presentations, giving a transaction-level bona fide presentation classification error rate of four percent. Every participant nevertheless completed at least one valid transaction, producing a user-level error rate of zero.
The separate injection evaluation, aligned with CEN/TS 18099 at the Substantial level, ran from July 1 through September 10. It covered four injection methods and 10 attack instruments, including face swaps, deepfake videos and avatar reenactment. All 630 injected transactions were rejected, while 300 genuine runs produced a bona fide error rate of 1.33 percent.
Testers partially bypassed root-detection routines by hooking software functions, but the application did not capture the virtual-camera frames. BixeLab explicitly states that the injection result is not an NVLAP-accredited outcome or a certification, benchmark or endorsement by NIST or a government agency.
The presentation test covered Android SDK 2.10.0 and iOS 1.6.1 on Samsung Galaxy S25 devices running Android 15 and iPhone 13 devices running iOS 26.2. The injection evaluation covered Android SDK 2.12.1, iOS 1.6.1 and Web 11.0.0, with results limited to the stated versions, configurations, datasets and laboratory conditions.
“BixeLab’s evaluators approached our system the way a well-resourced attacker would,” said Hariprasad PS, HyperVerge’s head of AI. He said they rooted a device and concealed the root, decompiled and hooked the company’s SDK to intercept the camera feed, and injected deepfake and face-swap video through virtual cameras and emulators. The 630 injected transactions were delivered through an OBS virtual camera on a Mac, HDMI capture on Windows and an iOS virtual-camera module. Both evaluations took place at BixeLab’s laboratory in the Australian Capital Territory.
Sources: BixeLab PAD letter, BixeLab injection letter, CXO Digitalpulse
–
By the ID Tech Editorial Team
