IDEMIA Public Security’s WebCapture software development kit recorded no successful bypasses across 900 biometric injection attack attempts in an independent BixeLab assessment. The laboratory evaluated version 3.38 against requirements aligned with the Substantial, or Level 2, assessment in CEN/TS 18099:2024, a European technical specification for testing biometric injection defenses.
The evaluation covered 10 injection attack instrument species, meaning distinct types of tools used to substitute or manipulate biometric input. Attack methods included deepfakes, face swaps, replay attacks, morphing and avatar reenactment. BixeLab concluded that the tested version satisfied the aligned requirements for the instruments and methods within the evaluation’s defined scope.
Genuine-user testing comprised a separate 300 transactions. Two classification errors were recorded, producing a bona fide classification error rate of 0.67 percent. That measure describes errors involving legitimate input, rather than the proportion of attacks that bypassed the system.
Injection attacks introduce fabricated biometric data into a verification process instead of relying solely on something presented to a camera. They can substitute synthetic or previously recorded imagery for a live capture. Testing those defenses addresses a different attack path from presentation attack detection, which checks whether a sensor is encountering a live person or an artifact.
The CEN/TS specification has also been used to assess other identity-verification products. Aware’s Intelligent Liveness underwent a BixeLab injection assessment covering multiple attack instruments and methods, including virtual cameras and function hooking. Such evaluations test resistance to manipulated inputs alongside the handling of genuine transactions.
IDEMIA Public Security has separately reported leading placements in NIST face-recognition accuracy tests, including mugshot identification and visa-border scenarios. Those benchmarks measure matching performance across image galleries; the WebCapture assessment instead examines attempts to compromise the input used during identity verification.
WebCapture forms part of IDEMIA’s identity-verification technology, which combines biometric liveness detection with fraud-prevention functions to check that a person completing a remote verification is present. BixeLab CEO Ted Dunstone described testing against recognized specifications as a means of providing objective evidence of protection. The assessed configuration was WebCapture SDK v3.38.
IDEMIA Public Security supplies biometric and identity systems to 600 government, state and federal agencies, alongside organizations with physical and digital identity and access requirements.
Sources: PR Newswire
–
By the ID Tech Editorial Team
