Threat Model

The design principle is that nothing the client says is trusted. The prompts, timers and camera metadata the capture page reports are user experience only: every liveness fact that reaches a verdict is re-derived server-side from the uploaded video and frames, and the challenge is generated and verified server-side.

What the layer raises the cost of

• Replay. A capture recorded earlier and played back to the camera has to answer a challenge that did not exist when it was made, within a window the server measures on its own clock.
• Montages of prepared stills. Answering the head-direction targets by pasting one prepared still per target is not enough: the server also reads video frames from inside each interval between two stills and requires the head to be genuinely between the two poses there, which a montage cannot produce.
• Injection. A stream fed through a virtual camera or a rendering pipeline faces the same challenge, plus signals derived from the media itself. Every active profile carries the full challenge, on a laptop webcam as on a phone; a passive profile carries none of it.
• Synthetic media. Face swaps and generated video are put through a third-party forensic analysis, on the capture and on the reference photo.
• Substitution and reuse. Frames that do not belong to the video, a change of person during the capture, and media the platform has already seen are all detected server-side.
• Degrading the capture on purpose. Head angles are only decided on the platform's precise face measurement, never on a coarser fallback that a blurred, backlit or masked face could steer. A capture that cannot be measured is retaken on a fresh challenge, three attempts at most per session, and a session whose three attempts all failed to measure ends in fail (images_unmeasurable), not in a review. Unreadable images buy an attacker neither a pass, nor a free retry, nor a human's attention; a genuine failure on any measured check fails the session whatever else could not be read.

What it does not cover

• Physical masks are partially covered. A crude mask trips the forensic stage or the face match; a high-grade one, of the kind ISO/IEC 30107-3 level 2 testing uses, may pass both. Dedicated mask detection is on the roadmap.
• Printed photos and screens are addressed by the active prompts only: use an active profile whenever the subject can follow prompts, and expect no protection from a passive one.
• A real-time face swap driven by a cooperative operator answers the prompts, because the operator's own head movement is preserved in the output. Only the forensic stage and the face match stand against it.
• Audio deepfakes are out of scope: the capture has no audio channel.
• Adversarial inputs crafted to evade the forensic detectors are not defended against.

A pass is evidence to combine with your other onboarding measures, not proof of a genuine presentation. The detection design, the thresholds and the benchmark results are shared under NDA.