Sumsub’s Liveness service has passed iBeta’s Level 3 presentation attack detection testing, rejecting all 900 spoofing attempts in an evaluation conducted under the ISO/IEC 30107-3 standard.
The test measures whether an artifact made from a genuine person’s biometric, such as a mask, can be accepted as a live user. Level 3 is the most rigorous of iBeta’s three levels, giving evaluators extended preparation time to build sophisticated attack artifacts.
The laboratory accessed the Sumsub Liveness application through the native browsers on a Samsung Galaxy S24 Ultra running Android 16 and an Apple iPhone 13 running iOS 16.6. Both connected to the same cloud backend, identified in the confirmation letter as release 2026.08.13-release-da915906. Active-liveness testing ran from August 20 through September 17.
Test subjects cooperated with the evaluators and were willing to provide any requested biometric samples, including high-quality facial samples. Sumsub said evaluators had access to equipment such as hyper-realistic facial masks when preparing their spoofing attempts. The test effort allowed up to 56 hours for each presentation-attack-instrument species.
The procedure alternated one genuine-user presentation with three artifact presentations. For each species, evaluators conducted 150 attack presentations and 50 genuine presentations, subject to the time limit. Three species across the two devices produced 450 attacks per device and 900 overall, with an attack presentation classification error rate of zero percent.
The confirmation letter does not give the genuine-user error rate, which iBeta says is calculated in its final report. “In this industry, standing still is the same as falling behind,” said Vyacheslav Zholudev, Sumsub’s chief technology officer and co-founder. “You have to move faster than the people trying to break your systems.”
iBeta, a testing laboratory in Aurora, Colorado, is accredited through the NIST-administered National Voluntary Laboratory Accreditation Program to test and report against the PAD standard. Its confirmation covers the stated application, cloud backend and device configurations.
Sumsub’s earlier testing recorded zero attack acceptance across 1,500 Level 1 attacks in 2021 and 1,530 attempts in a February 2025 retest. The company then completed Level 2 testing in March 2025, with zero attack acceptance across 1,500 attempts using more sophisticated artifacts.
–
By the ID Tech Editorial Team
