Run presentation-attack detection before any face match used to authenticate, and return only the decision

TwinEthos recommendation — not law

This is TwinEthos's opinion of what a responsible AI integration does anyway. It is never a legal or standards requirement; where binding law applies, the law governs.

The recommended-guardrail rule files are open under CC BY 4.0; attribution and scope are in the terms.

Informational data, not legal advice. Summaries and rules have not been reviewed by a lawyer: always verify official law text for decisions. A suggested guard is intended to address each rule; adding it is not a statement of compliance to that law.

Trust and provenance

Lane

TwinEthos recommendation (not law) TwinEthos recommendation, not law

Official source

TwinEthos's own derivation record (from the corpus gap analysis and the incident registry), not an official source. The law, standards and incidents it cites are listed on this page with their own links.

Data release

Data release 2026.10.03.4, data as of 3 Oct 2026, schema 0.3.10. This page also reflects corpus changes made after that release; they ship in the next one.

Legal review

Not reviewed by a lawyer. Written by TwinEthos as its own recommendation: opinion, never law. No TwinEthos rule has been legally reviewed yet.

Audit standard

Audit-grade: meets all 11 checks of the TwinEthos audit standard that apply to it. The audit standard is TwinEthos's own quality bar for provenance, dates, applicability, detectors, fixtures, remediation and licences; it is not a legal review.

Detectors

2 detectors (code pattern, data flow), experimental: written from the rule's text and not yet measured for precision on real code, so treat a hit as a lead to verify.

Known limits:

Liveness checked in another function or service before this one is called is not seen; confirm the call path.
InsightFace embeddings compared with a plain dot product are not recognized.
Scores returned only to an internal, authenticated audit or tuning endpoint are acceptable.

Evidence grade

Recommended by 1 standard

1 standard or framework · 0 graded incidents.

TwinEthos recommendation, not law. Where binding law applies, the law governs. No binding law in the corpus requires this control yet. 1 standard or framework recommends it (MITRE ATLAS). 0 graded incidents cited.

Published AI security standards mapping to this control

MITRE ATLAS AML.M0002: Predictive AI Output Obfuscation · crosswalk status: covered
MITRE ATLAS AML.M0034: Deepfake Detection · crosswalk status: covered

Item ids and titles from the published standards; the mapping is TwinEthos's (standards crosswalk, docs/COVERAGE.md Part 4). Cited by id, never quoted.

The guard to add

Run liveness detection before any face match used to authenticate, and return only the decision.

On every login, unlock or identity-verification route that compares faces, run presentation-attack detection first and reject on failure: a liveness service (AWS Rekognition create_face_liveness_session / get_face_liveness_session_results, Azure AI Face liveness sessions) or a local anti-spoofing model (DeepFace anti_spoofing=True, a FasNet-style detector), preferably one whose performance was tested with the methods of ISO/IEC 30107-3. Then match, and return only accept or reject with a reason code: no distance, similarity or confidence value to the client, and rate-limit attempts per account.

Example (Python + DeepFace), before:

def login_with_face(user, frame):
    result = DeepFace.verify(frame, user.enrolled_face)
    return {'ok': result['verified'], 'distance': result['distance']}

After:

def login_with_face(user, frame):
    try:
        result = DeepFace.verify(frame, user.enrolled_face, anti_spoofing=True)  # raises on a spoof
    except ValueError:
        return {'ok': False, 'reason': 'liveness_failed'}
    return {'ok': bool(result['verified'])}   # the decision, not the distance

Control: Face verification used for authentication without presentation-attack detection. Engineering guidance, not legal advice.

Why

Face matching answers whether two faces look alike, not whether a live person is in front of the camera, so without liveness detection a photo, a replayed video or a generated face can log in as someone else. Returning the raw distance turns the endpoint into an oracle an attacker can tune a spoof against. MITRE ATLAS lists deepfake detection for biometric verification and output obfuscation for predictive models; presentation-attack detection testing is standardised in ISO/IEC 30107-3, which TwinEthos cites but does not encode.

Class: agent security · set: ai security · maturity: reviewed · confidence: medium · id guardrail.sec-face-verification-presentation-attack-detection