Biometric Authentication Attacks

Attack Console

Match threshold 0.55

Attack rate 30%

Spoof sophistication 40%

Traffic 30

FAR (attacks accepted)

–

FRR (users rejected)

–

Overall accuracy

–

Breaches (accepted spoofs)

How it works

Every presented sample — a genuine fingerprint/face or a forged one (photo, mask, silicone cast, replayed sensor data) — is compared against the stored template and scored on similarity, 0 to 1. The matcher accepts anything at or above the match threshold; everything below is rejected. Because genuine and spoofed score distributions overlap, no threshold is perfect: push it up and forgeries get rejected but so do more real users (higher FRR); pull it down and convenience improves but more forgeries slip through (higher FAR).

accept ⇔ similarity(sample, template) ≥ threshold  AND  not flagged by liveness check
FAR = accepted_spoofs / total_spoofs      (security failure)
FRR = rejected_genuine / total_genuine    (convenience failure)

Match threshold — the core security/convenience dial; watch FAR fall and FRR rise together as you raise it.
Attack rate — what fraction of presentations are forgeries rather than the real enrolled user.
Spoof sophistication — better fakes (high-res printed iris, silicone fingerprint, deepfake face) push the impostor score distribution closer to genuine, shrinking the safe margin.
Liveness (PAD) — Presentation Attack Detection: an independent check (pulse, depth, texture, blink) that can catch a forgery even if its similarity score alone would pass — but sophisticated attacks partially evade it too.

Real-world relevance: this is why production biometric systems layer a match-score threshold with liveness detection rather than relying on either alone — and why raising security always trades away some convenience.

Genuine user Spoof attempt Caught by PAD Breach (spoof accepted)

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.