Face ID & Passive Liveness
Single-Frame Anti-Spoofing & Biometric Auth
An integrated, zero-friction biometric authentication engine. In a single capture under 150ms, our model evaluates passive liveness first to block presentation spoof attacks, then generates an immutable 256-bit encrypted facial key for passwordless login.
Liveness-First Pipeline, Demoed With Our Team
The Face ID engine is not exposed as a public sandbox yet. Book a session and we will run your own captures through it live.
Face ID sandbox is not public yet
Passive liveness and 256-bit key generation run on our hosted engine, which we have not opened for anonymous uploads. Rather than show you a scripted result, we would rather put the real pipeline in front of you.
- Live walkthrough against real capture conditions
- Print, replay and 3D-mask attack testing
- Sandbox API keys for your own integration
- Deployment options including on-premise
We do not publish simulated output for this engine — you will see results from a real run, or nothing at all.
One Capture, Two Gates, No Prompts
Most biometric stacks ask the user to blink, smile or turn their head, then run identity separately. We collapse both into a single frame: the same capture that proves the person is physically present is the capture the facial key is derived from, so an attacker never gets a gap between the two steps to slip a stored image into.
Capture
One ordinary frame from a webcam or phone camera. No prompt sequence, no video upload, no instruction the user has to read and follow before they can log in.
Stage 1 — Passive Liveness
The frame is scored for physical presence: micro-texture of real skin, screen pixel moiré, print grain and the flat light response of a mask. A fail ends the request here.
Stage 2 — 256-Bit Face Key
Only a live capture reaches this stage. The face is reduced to an encrypted 256-bit vector, which is what gets stored and compared on every later login.
If stage one fails, stage two never runs. A spoofed capture cannot produce a facial key, so a rejected attack leaves nothing enrolled and nothing to revoke.
What the Liveness Gate Is Actually Looking For
Presentation attacks each leave a different physical signature. The model is trained on all of them at once rather than on a single trick, so defeating one signal does not get an attacker through.
| Attack Vector | How It Is Attempted | Signal Used to Reject It |
|---|---|---|
| Paper Print | A printed photograph of the legitimate user held in front of the camera. | Print grain, ink dot structure and the absence of real sub-surface skin texture. |
| Screen Replay | A selfie or video played back from a phone, tablet or monitor. | Pixel moiré, display refresh artefacts, bezel geometry and specular screen glare. |
| Cut-Out & Paper Mask | A print with eye or mouth holes worn over a real face to fake depth. | Depth discontinuity at the cut edges and mismatched lighting between layers. |
| 3D Silicone Mask | A moulded prosthetic reproducing the target's facial geometry. | Material reflectance and light falloff that do not match living tissue. |
| Stored-Image Injection | Skipping the camera and posting a previously captured frame straight to the endpoint. | Liveness runs on the same frame the key is derived from, so an injected image never yields a key. |
Passive Liveness vs. Prompt-Based Checks
Active liveness — blink now, turn left, follow the dot — is where onboarding funnels lose people, and it is also learnable: an attacker who knows the prompt set can rehearse it on a replayed video.
The user performs for the camera
- — Multi-second sequence of head turns, blinks or spoken digits
- — Drop-off concentrates on the users least comfortable with the flow
- — Fails in poor lighting, on older devices and for users with limited mobility
- — A fixed prompt set can be pre-recorded and replayed
The capture proves itself
- One ordinary frame, zero instructions on screen
- Under 150ms end to end, including key generation
- Nothing for an attacker to rehearse, because nothing is asked
- Same flow in browser and native mobile, no separate UX to maintain
Where a Liveness-First Face ID Belongs
Anywhere a face currently stands in for a password, a signature or a supervisor's word.
Digital Account Opening
Confirm a real person is behind the application before the account exists, without adding a prompt sequence that costs you completions at the last step of the funnel.
Passwordless Login
Replace passwords and SMS OTP with the facial key. Nothing to phish, nothing to SIM-swap, and no shared secret sitting in a support agent's reach.
High-Risk Transaction Step-Up
Re-verify at the moment of a large transfer, a payee change or a credential reset, rather than trusting a session that was authenticated hours earlier.
Workforce & Attendance
End buddy punching on shift-based sites. A photo of a colleague on a phone screen is rejected before an attendance record is ever written.
Remote Proctoring & Field Audit
Prove the same live person is present throughout an exam, an inspection or a field survey, on the device already in their hand.
Access to Physical & Restricted Systems
Gate turnstiles, kiosks and operator terminals on a live face instead of a badge that can be lent, lost or cloned.
One API Call for Liveness & Face ID
Call a single endpoint with the user's video frame. Receive both liveness validation telemetry and the 256-bit encrypted facial key in one JSON object.
- Single-frame passive evaluation — zero user head turns required
- Automatic rejection of presentation attacks before key generation
- Cross-platform Web SDK, React Native, Flutter, iOS & Android wrappers
curl -X POST https://api.dynsimulation.com/v1/vision/face-id/verify \ -H "Authorization: Bearer YOUR_API_KEY" \ -F "image=@live_user_frame.jpg" \ -F "user_id=usr_991823a" \ -F "require_liveness=true"
The Photograph Is Never the Asset
Face databases are attractive targets because a stolen photo is reusable forever. Our pipeline is built so there is no photo library to steal: captures are processed in memory and discarded, and only the encrypted 256-bit key persists.
No Raw Photo Retention
Captures exist only for the duration of the request. Nothing is written to disk, so there is no gallery to breach.
Encrypted Vector Only
What persists is a 256-bit encrypted key. It is not a picture and cannot be rendered back into one.
Revocable Enrolment
A key can be revoked and re-enrolled, which is exactly what a stored photograph can never be.
Your Data Is Not Training Data
Production traffic is not used to train the model. What you send through the endpoint stays yours.
Managed Cloud API
A single REST endpoint returning liveness telemetry and the facial key in one JSON response. Sandbox keys, then production, with nothing to host yourself.
Native Mobile SDK
Web SDK plus React Native, Flutter, iOS and Android wrappers, so capture quality and the pipeline behave identically across every client you ship.
On-Premises GPU Container
The same engine in an air-gapped container inside your own network, for deployments where biometric data cannot cross an external boundary.
Request Face ID & Liveness API Keys
Connect with our engineering team to receive sandbox API keys, native mobile SDKs, or on-premises container licenses.
Frequently asked questions
How does the liveness check work?
It is passive and single-frame: the model evaluates liveness from one ordinary capture, with no head turns, blinks or on-screen prompts, and rejects 2D paper prints and screen replays before any identity step runs.
What is the 256-bit facial key?
Once liveness passes, the model generates an encrypted 256-bit vector that represents the face. That key is what gets stored and compared for passwordless login — not the original photograph.
How long does the whole pipeline take?
Under 150ms end to end, covering both the liveness check and the facial key generation in a single capture.
Which platforms are supported?
A cross-platform Web SDK plus React Native, Flutter, iOS and Android wrappers, so the same pipeline runs in browser and native mobile applications.
Can it run without internet access?
Yes. Alongside the managed API there is an on-premises air-gapped GPU container for deployments that cannot call an external endpoint.
Is the original photo kept?
No. Captures are processed in memory and discarded; only the encrypted facial key persists, and production traffic is not used to train the model.
Which spoof attacks does it block?
Paper prints, screen and video replays, cut-out paper masks and 3D silicone masks. Each leaves a different physical signature — print grain, screen moiré, depth discontinuity, material reflectance — and the model is trained on all of them together rather than on one trick.
What stops someone posting a stored image straight to the endpoint?
Liveness is evaluated on the same frame the facial key is derived from, so there is no gap between the two steps. An injected image that fails liveness never reaches key generation, which means nothing is enrolled and nothing has to be revoked.
What happens if a facial key is compromised?
It can be revoked and the user re-enrolled. That is the practical advantage of storing an encrypted vector rather than a photograph, which can never be reissued.