1. Introduction
A Realized Threat, The Structural Vulnerability of Commercial Face Recognition Systems
The ‘realistic face masks’ depicted in recent media are no longer a product of imagination. Academic and industrial experiments have proven that high-quality 3D masks and digital synthesis technologies can compromise Commercial-Off-The-Shelf (COTS) face recognition systems under specific conditions.
COTS engines are optimized to provide high accuracy in static image-matching environments. However, they fundamentally lack security mechanisms to verify ‘liveness,’ leading to an inherent vulnerability to Presentation Attacks (PA).
According to literature and empirical studies, when variables such as camera specifications, shooting distance, lighting, and matching thresholds are optimized in favor of an attacker, the Attack Presentation Classification Error Rate (APCER) can reach up to approximately 70%. This figure is not merely a technical error but should be interpreted as a policy-level warning. It signifies a serious ‘Structural Security Debt’ that COTS-only strategies can create when an attacker identifies system weaknesses and uses optimized attack media.
2. Background
The Proliferation of High-Risk Infrastructure and the Scope of Threats
Deployment of Biometric Infrastructure
Biometric technology has become a standard security measure in airports, financial institutions, and critical national facilities. As of 2025, the U.S. Transportation Security Administration (TSA) operates Credential Authentication Technology (CAT) systems in approximately 84 airports. CAT streamlines the identity verification process by cross-referencing a passenger’s scanned ID with their facial biometric data in real time. The TSA plans to expand deployment to more than 400 airports in the coming years.
This represents a global trend. According to a report by the International Air Transport Association (IATA), 43% of airports worldwide have already adopted biometric-based boarding systems, and 46% of passengers have used them. As this infrastructure becomes increasingly widespread, the vulnerability of a single system can translate into both national and international security risks.
Types and Threats of Presentation Attacks
Presentation Attacks are broadly classified into three types, each posing a different level of threat:
- 2D Attacks (Print, Replay): Attacks using high-resolution photos or video playback. They are the most common due to their low cost and ease of execution.
- 3D Attacks (Mask): Attacks using 3D masks made of special materials like silicone. They pose a serious threat to COTS systems lacking depth information by mimicking the three-dimensionality and surface texture of a face.
- Digital Synthesis Attacks (Deepfake): The most sophisticated form of attack, using AI-generated synthetic videos. These attacks attempt to bypass PAD technologies by precisely imitating inter-frame consistency and micro-movements.
A COTS-only strategy can lead to severe security gaps across a wide range of areas, from personal finance and corporate access control to airports, ports, and critical national infrastructure (e.g., power plants, military facilities).
3. Technical Response
The 4-Stage Evolution of Anti-Spoofing (PAD) Technology
In response to the evolution of spoofing attacks, Presentation Attack Detection (PAD) technology has also advanced rapidly, now transitioning to 4th generation integrated AI models.
- 1st & 2nd Generation PAD: Initial Responses and Clear Limitations
- 1st Gen (Rule-Based): Relied on simple rules like blinking and head movements, effective only against low-quality print attacks.
- 2nd Gen (Sensor Fusion): Introduced depth sensors (ToF) and infrared sensors (IR/NIR) to enhance performance against 2D attacks but had issues with hardware costs and could be bypassed by high-quality 3D masks.
- 3rd Generation PAD: Used Deep Learning (DL) to learn complex features, but lacked generalization and was vulnerable to new, unseen attacks.
- 4th Generation PAD: The latest generation uses multimodal fusion AI to simultaneously learn spatial, temporal, and spectral information. This paradigm shifts verification from superficial patterns to ‘intrinsic liveness.’
This evolution has established PAD as a core security component for real-world operational environments, moving it beyond a laboratory-level technology.
4. Technology Reliability Verification
UNION biometrics’ Objective Achievements
UNION biometrics has objectively validated the reliability of its 4th-generation integrated AI technology through nationally accredited testing institutions.
- Accredited Institution Verification:
- TTA (Telecommunications Technology Association): Conducted Verification & Validation tests for the UBio-X Face Pro v1.0 solution, with official results documented in a formal report.
- KTL (Korea Testing Laboratory): Received K-Mark certification for compliance with the KTL C 750-2025 standard, marking it as the first in Korea to be officially certified for face spoofing detection performance. *Access Control System with Spoofed Face Detaction
- Large-Scale Demonstration Tests: The system’s anti-spoofing performance was validated through a large-scale, repetitive test of 17,500 trials, utilizing various 2D and 3D spoofed face samples. These tests were conducted under standard face recognition distance conditions (80cm, 100cm, and 120cm) by applying performance test scenarios A, B, and C. The system successfully passed all test items, demonstrating excellent defense capabilities against spoofed faces.
- AI-Based Adaptive Update Mechanism: Ensuring Long-Term Reliability: Faces change over time due to aging and expressions, causing a long-term decline in accuracy. To solve this, UNION biometrics secured a patent for an AI-based ‘Method and Apparatus for Updating Face Information’ (Acquired Aug. 2025).
This technology enables an AI to continuously learn the trend of a user’s matching score changes, automatically calculating the most efficient time to update the registered information. This ensures not only immediate threat prevention (Liveness Assurance) but also decades of operational persistence (Long-term Authentication Accuracy).
5. Conclusion and Policy Recommendations
COTS-based face recognition systems have an inherent vulnerability to spoofing attacks, a problem that must be addressed in high-risk environments. 4th generation integrated AI-based PAD technology, through rPPG and sensor fusion, overcomes the limitations of previous generations and provides a practical, security-oriented alternative.
UNION biometrics has demonstrated the effectiveness and unique technological strength of this advancement through its K-Mark certification and multiple AI patents. This achievement reflects a vision that goes beyond meeting current security standards to leading the future security paradigm. The AI-based intelligent adaptive update mechanism is a core technology for maintaining high accuracy and reliability over long-term operation. Based on this ground breaking technology, Union Biometrics will play a pivotal role in redefining global security infrastructure standards beyond the domestic market, paving the way for a safer and more trustworthy digital future.
Data Sources:
U.S. Government Accountability Office. (2022, July). Facial Recognition Technology: CBP Traveler
Identity Verification and Efforts to Address Privacy Issues (GAO-22-106154) – U.S. GAO.
SITA (2023) Passenger IT Insights 2023. – SITA.
[2507.07795] Robust and Generalizable Heart Rate Estimation via Deep Learning for Remote Photoplethysmography in Complex Scenarios – arXiv
[2110.11525] Digital and Physical-World Attacks on Remote Pulse Detection – arXiv
K-Mark Certification Report – UNION Biometrics Co., Ltd.
TTA_Spoofed Face Detection Performance Test (UBio-X Face Pro V1.0)_Test Report and Results UNION Biometrics Co., Ltd.
