Yoti’s passive biometric liveness detection first to pass iBeta Level 3 PAD test

Yoti is the first biometrics company to successfully pass a Level 3 presentation attack detection (PAD) compliance assessment from iBeta Quality Assurance.

The test result with Yoti’s new biometric liveness detection technology places the company amongst the global leaders in the technology, CEO Robin Tombs told Biometric Update in an exclusive interview ahead of the announcement.

What iBeta Level 3 means

iBeta announced Level 3 PAD testing in June, as an extension of its popular testing program for compliance to the ISO/IEC 30107-3 standard. At the time, iBeta  executives told Biometric Update the new level was introduced largely in response to the kinds of biometric spoof attacks AI has made easier and more scalable, driving a wave of fraud.

Yoti’s passive, single-selfie liveness, which Tombs refers to as “the easiest way of doing it,” is the first to pass an assessment to the new level.

The requirement to pass iBeta Level 3 is 95 percent success – but not in aggregate.  A successful PAD system must stop 95 percent or more of every attack species attempted. Each species is used in up to 20 attempts, which means the system fails if there is any repeatable success with an attack.

Attacks are carried out with sophisticated presentation attack instruments (PAIs), such as resin masks costing thousands of dollars. “They’re been trying their hardest for several weeks to beat Yoti,” says Tombs.

He points out that 108 companies have passed iBeta’s Level 1 PAD test and 66 have Level 2.  For age assurance, Level 1 provides assurance about the technology’s reliability to prevent spoof attempts by an average 8 or 12-year old, Tombs says, “but you can’t also reassure people that it’s extremely hard to get through.”

“Level 2 is good, but it doesn’t stop expert attackers with masks costing more than $300. If you’re a serious criminal, you’re going to spend more than $300 and you’re going to spend more than a day attacking the system.”

Those are the attacks iBeta Level 3 tested Yoti’s liveness against.

Establishing liveness leadership

18 months ago Yoti started to rearchitect its liveness detection to make it strong enough to detect the sophisticated attacks that make up Level 3, Tombs says. The company’s Level 1 and 2-compliant PAD will be retired in favor of the more robust model.

“We couldn’t necessarily be sure that by doing more with what we had – our training and approach – that we would get to level 3,” he admits. “The R&D team said to me ‘to try and pass iBeta Level 3 we really need to go back to basics, rebuild a new approach to spot the hardest masks, the best attacks from experts.”

The company was making progress on its new system when iBeta announced the new testing level. Having passed the assessment, Tombs says Yoti has demonstrated that its liveness detection is among the strongest in the world, providing fraud protection beyond most other PAD systems, whether passive or active.

Changing the conversation

That assurance allows the company to push back on a common line of argument against the proportionality of age assurance regulations.

Tombs sums up the age check opponents argument as: “’Age checks are irrelevant if many kids can beat liveness. But kids aren’t going to beat iBeta Level 3.”

“Nobody yet has been able to say ‘well, if hundreds of millions  of people can easily do level 3 liveness with a single selfie, you’ve got a pretty inclusive way of doing age checks highly effectively’” Tombs says. “That isn’t the answer anyone could have credibly given a week ago.”

He will be joining a panel to address the question as a panelist at the FTC Age Verification Workshop on January 28 to discuss that, amongst other topics.

Tombs notes that during the launch of the Online Safety Act, many people read about kids gloating that they easily beat liveness on some sites using video game characters like “Death Stranding.” Whilst Tombs points out that there is no such thing as perfect security, iBeta Level 3 now means it will be extremely difficult to beat liveness checks.

Beyond age assurance, iBeta Level 3 liveness detection will provide robust protection against sophisticated spoof attacks and will increasingly be seen as essential for authentication, stopping account takeovers (ATOs) and detecting bots. Some ticketing sites say they have bots under control, but the bots are beating their current measures, Tombs points out. They won’t easily beat an authentication process with iBeta Level 3 proven liveness and injection attack prevention.

“iBeta Level 3 gives us the opportunity to talk to more sectors,” Tombs says.  Liveness is also central to the company’s longer-term digital identity play, he believes. “We want to be one of the world’s leading identity platforms, and world class liveness is essential for that.”

Up until now, probably many people would have picked Yoti as leaders in facial age estimation and reusable digital ID but not for liveness detection. But given this breaking iBeta news Yoti’s presentation attack liveness is now clearly one of the best in the market.

This is a sponsored post. For information about advertising, please contact us.

Article Topics

biometric liveness detection  |  biometric testing  |  biometrics  |  iBeta  |  ISO/IEC 30107-3  |  presentation attack detection  |  spoof detection  |  Yoti