Integrated Pipeline: Passive Liveness First → 256-Bit Face ID Key

Face ID & Passive Liveness
Single-Frame Anti-Spoofing & Biometric Auth

An integrated, zero-friction biometric authentication engine. In a single capture under 150ms, our model evaluates passive liveness first to block presentation spoof attacks, then generates an immutable 256-bit encrypted facial key for passwordless login.

2-in-1
Liveness + Face ID Pipeline
<150ms
End-to-End Latency
256-Bit
Encrypted Vector Key
0 Head Turns
Frictionless UX
Sandbox Access

Liveness-First Pipeline, Demoed With Our Team

The Face ID engine is not exposed as a public sandbox yet. Book a session and we will run your own captures through it live.

Face ID sandbox is not public yet

Passive liveness and 256-bit key generation run on our hosted engine, which we have not opened for anonymous uploads. Rather than show you a scripted result, we would rather put the real pipeline in front of you.

  • Live walkthrough against real capture conditions
  • Print, replay and 3D-mask attack testing
  • Sandbox API keys for your own integration
  • Deployment options including on-premise
Request Face ID access

We do not publish simulated output for this engine — you will see results from a real run, or nothing at all.

How It Works

One Capture, Two Gates, No Prompts

Most biometric stacks ask the user to blink, smile or turn their head, then run identity separately. We collapse both into a single frame: the same capture that proves the person is physically present is the capture the facial key is derived from, so an attacker never gets a gap between the two steps to slip a stored image into.

01

Capture

One ordinary frame from a webcam or phone camera. No prompt sequence, no video upload, no instruction the user has to read and follow before they can log in.

1 frame · Web, iOS, Android
02

Stage 1 — Passive Liveness

The frame is scored for physical presence: micro-texture of real skin, screen pixel moiré, print grain and the flat light response of a mask. A fail ends the request here.

PASSED / SPOOF_DETECTED
03

Stage 2 — 256-Bit Face Key

Only a live capture reaches this stage. The face is reduced to an encrypted 256-bit vector, which is what gets stored and compared on every later login.

AES-256 · no photo retained

If stage one fails, stage two never runs. A spoofed capture cannot produce a facial key, so a rejected attack leaves nothing enrolled and nothing to revoke.

Attack Coverage

What the Liveness Gate Is Actually Looking For

Presentation attacks each leave a different physical signature. The model is trained on all of them at once rather than on a single trick, so defeating one signal does not get an attacker through.

Attack VectorHow It Is AttemptedSignal Used to Reject It
Paper PrintA printed photograph of the legitimate user held in front of the camera.Print grain, ink dot structure and the absence of real sub-surface skin texture.
Screen ReplayA selfie or video played back from a phone, tablet or monitor.Pixel moiré, display refresh artefacts, bezel geometry and specular screen glare.
Cut-Out & Paper MaskA print with eye or mouth holes worn over a real face to fake depth.Depth discontinuity at the cut edges and mismatched lighting between layers.
3D Silicone MaskA moulded prosthetic reproducing the target's facial geometry.Material reflectance and light falloff that do not match living tissue.
Stored-Image InjectionSkipping the camera and posting a previously captured frame straight to the endpoint.Liveness runs on the same frame the key is derived from, so an injected image never yields a key.
Why Passive

Passive Liveness vs. Prompt-Based Checks

Active liveness — blink now, turn left, follow the dot — is where onboarding funnels lose people, and it is also learnable: an attacker who knows the prompt set can rehearse it on a replayed video.

Prompt-Based (Active)

The user performs for the camera

  • Multi-second sequence of head turns, blinks or spoken digits
  • Drop-off concentrates on the users least comfortable with the flow
  • Fails in poor lighting, on older devices and for users with limited mobility
  • A fixed prompt set can be pre-recorded and replayed
Single-Frame (Passive)

The capture proves itself

  • One ordinary frame, zero instructions on screen
  • Under 150ms end to end, including key generation
  • Nothing for an attacker to rehearse, because nothing is asked
  • Same flow in browser and native mobile, no separate UX to maintain
Applied Use Cases

Where a Liveness-First Face ID Belongs

Anywhere a face currently stands in for a password, a signature or a supervisor's word.

Digital Account Opening

Confirm a real person is behind the application before the account exists, without adding a prompt sequence that costs you completions at the last step of the funnel.

Passwordless Login

Replace passwords and SMS OTP with the facial key. Nothing to phish, nothing to SIM-swap, and no shared secret sitting in a support agent's reach.

High-Risk Transaction Step-Up

Re-verify at the moment of a large transfer, a payee change or a credential reset, rather than trusting a session that was authenticated hours earlier.

Workforce & Attendance

End buddy punching on shift-based sites. A photo of a colleague on a phone screen is rejected before an attendance record is ever written.

Remote Proctoring & Field Audit

Prove the same live person is present throughout an exam, an inspection or a field survey, on the device already in their hand.

Access to Physical & Restricted Systems

Gate turnstiles, kiosks and operator terminals on a live face instead of a badge that can be lent, lost or cloned.

Developer First

One API Call for Liveness & Face ID

Call a single endpoint with the user's video frame. Receive both liveness validation telemetry and the 256-bit encrypted facial key in one JSON object.

  • Single-frame passive evaluation — zero user head turns required
  • Automatic rejection of presentation attacks before key generation
  • Cross-platform Web SDK, React Native, Flutter, iOS & Android wrappers
curl -X POST https://api.dynsimulation.com/v1/vision/face-id/verify \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -F "image=@live_user_frame.jpg" \
  -F "user_id=usr_991823a" \
  -F "require_liveness=true"
Privacy & Deployment

The Photograph Is Never the Asset

Face databases are attractive targets because a stolen photo is reusable forever. Our pipeline is built so there is no photo library to steal: captures are processed in memory and discarded, and only the encrypted 256-bit key persists.

No Raw Photo Retention

Captures exist only for the duration of the request. Nothing is written to disk, so there is no gallery to breach.

Encrypted Vector Only

What persists is a 256-bit encrypted key. It is not a picture and cannot be rendered back into one.

Revocable Enrolment

A key can be revoked and re-enrolled, which is exactly what a stored photograph can never be.

Your Data Is Not Training Data

Production traffic is not used to train the model. What you send through the endpoint stays yours.

Managed Cloud API

A single REST endpoint returning liveness telemetry and the facial key in one JSON response. Sandbox keys, then production, with nothing to host yourself.

Fastest path to a working integration

Native Mobile SDK

Web SDK plus React Native, Flutter, iOS and Android wrappers, so capture quality and the pipeline behave identically across every client you ship.

Consumer apps and field workforce tools

On-Premises GPU Container

The same engine in an air-gapped container inside your own network, for deployments where biometric data cannot cross an external boundary.

Banking, defence and data-residency mandates
Deploy Integrated Face ID

Request Face ID & Liveness API Keys

Connect with our engineering team to receive sandbox API keys, native mobile SDKs, or on-premises container licenses.

Frequently asked questions

How does the liveness check work?

It is passive and single-frame: the model evaluates liveness from one ordinary capture, with no head turns, blinks or on-screen prompts, and rejects 2D paper prints and screen replays before any identity step runs.

What is the 256-bit facial key?

Once liveness passes, the model generates an encrypted 256-bit vector that represents the face. That key is what gets stored and compared for passwordless login — not the original photograph.

How long does the whole pipeline take?

Under 150ms end to end, covering both the liveness check and the facial key generation in a single capture.

Which platforms are supported?

A cross-platform Web SDK plus React Native, Flutter, iOS and Android wrappers, so the same pipeline runs in browser and native mobile applications.

Can it run without internet access?

Yes. Alongside the managed API there is an on-premises air-gapped GPU container for deployments that cannot call an external endpoint.

Is the original photo kept?

No. Captures are processed in memory and discarded; only the encrypted facial key persists, and production traffic is not used to train the model.

Which spoof attacks does it block?

Paper prints, screen and video replays, cut-out paper masks and 3D silicone masks. Each leaves a different physical signature — print grain, screen moiré, depth discontinuity, material reflectance — and the model is trained on all of them together rather than on one trick.

What stops someone posting a stored image straight to the endpoint?

Liveness is evaluated on the same frame the facial key is derived from, so there is no gap between the two steps. An injected image that fails liveness never reaches key generation, which means nothing is enrolled and nothing has to be revoked.

What happens if a facial key is compromised?

It can be revoked and the user re-enrolled. That is the practical advantage of storing an encrypted vector rather than a photograph, which can never be reissued.