Innovatrics has secured renewed Substantial-level certification for its Face Liveness service and completed a separate black-box security assessment in which testers were unable to bypass the company’s Identity Verification Toolkit. The evaluations cover two different attack paths that can undermine remote biometric verification.
CLR Labs evaluated Innovatrics Liveness Service version 3.1.0 under ISO/IEC 30107-3:2023 and ISO/IEC 19989-3:2020. The CLR Cert registry lists the product at the Substantial level, with certification valid from June 24, 2026 through June 23, 2028.
Presentation attack detection, commonly abbreviated as PAD, is designed to identify an artifact placed in front of a legitimate camera, such as a printed photograph, screen replay or mask. ISO/IEC 30107-3 specifies testing and reporting for PAD, while ISO/IEC 19989-3 applies a security-evaluation methodology derived from the Common Criteria framework.
Innovatrics positions the Substantial level for remote identity proofing by banks, telecommunications providers, trust services and government identity programs. The company says it is now working toward High-level certification for both presentation attack detection and injection attack detection, or IAD, for higher-risk identity verification uses.
Injection attacks take a different route. Instead of presenting an artifact to the camera, an attacker bypasses or manipulates the capture channel and feeds prerecorded, altered or synthetic biometric data into the application. Network data published this summer found that injection attacks represented the largest category of classified identity fraud observed across one provider’s systems.
Innovatrics commissioned ethical-hacking firm Citadelo to test the Identity Verification Toolkit after a customer requested independent evidence of resistance to injection attacks. Citadelo spent 16 days examining the system without source code, internal architecture, proprietary instructions or privileged debugging access.
The assessment focused primarily on the Android Face Lite Library and its end-to-end communication with Innovatrics’ Digital Identity Service, with limited examination of the corresponding iOS implementation. Testers performed static analysis and decompilation, instrumented the running application and attempted to manipulate biometric data and network traffic.
One attack replaced the Android Camera2 feed with prerecorded video through a virtual-camera module. Citadelo said the application rejected the substituted sample and marked the session as tampered. Attempts to replace image frames in memory before encryption and to inject adversarial frames into the native image-processing pipeline were also unsuccessful.
The testers did bypass initial anti-instrumentation routines and gained control of client-side memory on the Android device. They nevertheless reported that the final injection attempts did not subvert the liveness checks, attributing the result to native code isolation, hardware-linked data correlation and server-side validation.
The Citadelo exercise was a time-bounded adversarial assessment rather than a certification. Its result documents the toolkit’s response to the attack paths attempted during the engagement, complementing the standards-based certification for presentation attacks.
The two evaluations support a layered design in which Face Liveness examines whether a real person is present in front of the camera and the toolkit applies controls to the path carrying biometric data from the device. Innovatrics technology is already used in operating environments including Air Bank’s biometric mobile-app pairing process, where liveness and face matching help confirm an existing customer’s identity.
Renewing the Substantial certification confirms the current liveness service against defined PAD requirements, while the Citadelo assessment adds evidence from active attempts to manipulate the capture and processing chain. The company’s next planned step is formal High-level PAD and IAD evaluation.
Sources: Innovatrics, Citadelo, CLR Cert, ISO, ISO
–
By the ID Tech Editorial Team
