BixeLab clarifies levels in biometrics testing, launches compliance platform

A financial institution that BixeLab recently worked with found a new digital service was “inundated” with deepfakes and other fraud attacks enabled by generative AI within a week of turning it on, CEO Dr. Ted Dunstone revealed during a webinar hosted by Biometric Update this week.

BixeLab General Manager Somya Singh joined Dunstone in sharing insights from their extensive experience building and carrying out assessments and standards-based tests for biometrics and other digital identity technologies, with a focus on “Deepfakes, Digital Deception, and the Future of Biometric Assurance.”

Dunstone’s story illustrates how the shift in identity fraud brought on by AI is about the speed and scale of threats as much as it is about new types. In that context, continuous assurance is necessary to defend the expanded identity attack surface.

That continuous assurance comes from careful selection, measurement and testing of fraud protection technologies.

Biometric presentation attack detection (PAD) and injection attack detection (IAD) can be considered equally necessary at this point, Singh says, as attackers use bypasses to deliver deepfakes.

But the standards behind evaluations of both technologies include levels which are imperfectly understood. Singh explained that the concept of “attack potential,” which comes originally from Common Criteria methodology, and considers factors like the time and expertise that goes into a given attack.

“A high level does not mean a more dangerous artefact” or attack, Singh says.

Organizations should also bear in mind that while PAD and IAD both have levels and address spoof attacks, the levels mean different things, and assessment for each have different processes. And of course, evidence of effectiveness against these types of attacks needs to be current to be meaningful.

Compliance management platform launches

As the number of assessments, tests and evaluations technology providers are participating in increases, keeping track of all of them has become difficult for all stakeholders, Dunstone says. Understanding how they fit together is even harder.

The new Birdix assurance management platform from BixeLab is launching to beta to provide organizations with a way to examine comprehensive evidence on compliance and risk detection capabilities. It includes assessments from labs including BixeLab and competitors, as well as NIST benchmarks, industry certification bodies like FIDO and based on ISO standards.

Dunstone invites industry participants to join Birdix as beta users.

BixeLab also published a white paper and an extensive blog post within the past month to help clear up market confusion around biometrics testing.

Article Topics

AI fraud  |  biometric testing  |  Birdix  |  BixeLab  |  deepfake detection  |  injection attack detection  |  presentation attack detection