Innovatrics strengthens biometric defenses with PAD, injection attack validation

As deepfakes and synthetic identities become easier to create, identity verification vendors face a new challenge: proving their systems can defend against attacks both in front of the camera and behind it.

Traditional presentation attacks rely on printed photos, masks or video replays shown to a camera. Injection attacks are different. Instead of fooling the camera, attackers inject manipulated or AI-generated video directly into the biometric capture pipeline, making the system believe the footage originated from a legitimate device.

As highlighted in Biometric Update and Goode Intelligence’s 2026 Injection Attack Detection Market Report & Buyer’s Guide, software-based injection attacks are rapidly emerging as one of the biggest threats to remote identity verification as generative AI makes sophisticated fraud easier to execute.

Against this backdrop, Innovatrics announced two independent validations of its identity verification technology. Its Identity Verification Toolkit successfully withstood an independent black-box assessment against video injection attacks, while its Face Liveness solution renewed its Level 2 Presentation Attack Detection (PAD) certification and is advancing toward Level 3 (High).

The video injection attack assessment was conducted by ethical hacking firm Citadelo during a customer engagement requiring independent proof that the platform could withstand software-based attacks. Over a 16-day evaluation, Citadelo tested the system without access to source code, internal architecture or proprietary documentation, mirroring the approach of a determined attacker. According to the companies, attempts including reverse engineering, runtime instrumentation, camera-feed replacement and digital frame injection failed to bypass facial liveness detection.

Separately, CLR Labs, the biometrics evaluation laboratory of Cabinet Louis Reynaud, renewed Innovatrics’ Level 2 Face Liveness certification following testing under ISO/IEC 30107-3, the international standard for presentation attack detection, and ISO/IEC 19989-3, which applies a Common Criteria-based security evaluation methodology to PAD implementations. Unlike the Citadelo assessment, the CLR evaluation validates the platform’s ability to detect physical presentation attacks such as printed photographs, screen replays and masks.

The certification also carries regulatory significance. The Substantial assurance level aligns with European remote identity proofing frameworks, including ETSI TS 119 461 and eIDAS, making it relevant for banks, telecom operators, fintechs, trust service providers and government identity programs.

Innovatrics said its platform addresses both attack vectors through a layered architecture. Face Liveness detects presentation attacks occurring in front of the camera, while Video Injection Detection verifies that captured video originates from the device’s physical camera rather than a manipulated software source.

The dual announcements reflect a broader shift across the identity industry. Buyers are increasingly looking beyond biometric accuracy to understand how identity verification platforms perform against real-world adversarial attacks. Independent penetration testing, formal certification and emerging injection attack standards are becoming key evaluation criteria alongside biometric performance. Innovatrics is now working toward Level 3 (High) certification for both presentation attack detection and injection attack detection, targeting the highest assurance levels expected under eIDAS 2.0 for remote identity verification.

Article Topics

biometric liveness detection  |  biometric testing  |  Citadelo  |  CLR Labs  |  ETSI TS 119 461  |  injection attack detection  |  Innovatrics  |  ISO/IEC 19989-3  |  ISO/IEC 30107-3  |  presentation attack detection