Five vendors clear iBeta PAD Level 2 as biometric security benchmark rises

TWYN T4ISB, Suprema, Pipo Resource, Legitimuz and Zoloz have recently completed iBeta Level 2 Presentation Attack Detection (PAD) evaluations, with each recording zero successful presentation attacks during evaluation.

iBeta Quality Assurance, accredited by NIST’s National Voluntary Laboratory Accreditation Program (NVLAP) to conduct ISO/IEC 30107-3 evaluations, evaluates systems using multi-week testing with  presentation attack instruments such as masks and other spoof artifacts designed to challenge biometric liveness detection.

Zero successful attacks

TWYN’s PAAS Personhood Analysis Assistant v3.0 completed Level 2 evaluations across Android and iOS with zero successful presentation attacks. Suprema’s Q-Face Engine and Camera System likewise recorded a zero attack success rate in Windows testing, achieving Level 2 compliance.

Pipo Resource’s Veritas platform completed Level 2 evaluations across Android and iOS without unauthorized access. Legitimuz’s LegitFace was evaluated through native browsers across multiple mobile devices and Zoloz’s Native SDK also completed Level 2 evaluations with zero successful presentation attacks.

Independent PAD testing is emerging as a procurement requirement as enterprises and government agencies seek evidence that liveness claims have been validated by accredited laboratories rather than vendor testing alone.

The results provide buyers with independent evidence of performance, but they should be interpreted within the scope of each evaluation. They apply to the specific versions, configurations and test conditions evaluated rather than proving that a system cannot be spoofed.

Level 2 becomes the baseline

The latest confirmations continue a broader shift in the biometric market. For buyers, simply asking whether a solution has “liveness detection” is increasingly insufficient. More relevant questions are whether it has been independently tested, against which standard and at what level.

As more vendors complete Level 2 testing, competitive differentiation is shifting to robustness against more sophisticated attacks. This year Yoti, Incode and Shufti have each completed iBeta Level 3 evaluations, reflecting a shift toward evaluations of protections against biometric spoofs carried out with significant background knowledge and funding like custom-made, hyper-realistic masks.

Level 3 PAD testing evaluates resistance to attacks requiring substantially greater effort, skill and resources than Level 2. Whether every deployment requires Level 3 depends on its risk, but higher-risk financial services, identity proofing and government applications may increasingly demand stronger evidence of resistance to sophisticated attacks.

From PAD to IAD

Presentation attacks are only one part of the threat landscape. PAD primarily addresses attempts to fool the camera. But attackers can also attempt to bypass the capture process altogether and inject manipulated or synthetic biometric data into the transaction. This is the focus of Injection Attack Detection (IAD).

Independent laboratories including iBeta, Bixelab, CLR Labs and Ingenium are now testing IAD against CEN/TS 18099.

The latest Level 2 results show how quickly biometric assurance expectations are evolving. As Level 2 PAD becomes more common, vendors will increasingly differentiate through Level 3 PAD and independent IAD evaluations rather than liveness claims alone.

Article Topics

biometric liveness detection  |  biometrics  |  face biometrics  |  iBeta  |  ISO/IEC 30107-3  |  Legitimuz  |  presentation attack detection  |  Suprema  |  T4ISB  |  Zoloz