March 30, 2026

The Layer Deepfake Detection is Missing

AI-generated deepfakes have fundamentally changed the nature of fraud. What began as simple spoofing has evolved into real-time, highly convincing synthetic attacks.

The industry response has followed a familiar pattern: add more models.

Many of today’s solutions layer presentation attack detection, liveness checks, and deepfake detection — often bundled into multimodal systems with third-party models. On the surface, this looks like progress. More signals. More models. Better protection.

But most of these systems share the same limitation: they analyze the output.

They don’t validate the identity behind the interaction.

The problem isn’t the face, it’s the interaction

Modern identity systems are highly effective at analyzing images and video. They detect artifacts, inconsistencies, and signs of manipulation at the pixel level, constantly retrained to keep up with new generative techniques.

But this approach relies on a fragile assumption: that the input itself can be trusted.

That assumption is breaking.

The problem is no longer just determining whether a face is real or fake. It’s determining whether the interaction — and the identity behind it — can be trusted.

Deepfakes are only one piece of a broader attack surface. Today’s attacks combine virtual camera injection, replayed or manipulated video streams, and fully synthetic inputs that bypass traditional capture flows altogether.

If we only evaluate what is presented, we miss how it is presented and who (or what) is actually behind it.

What “interaction” actually means

A trusted interaction is not a single signal, but a pattern that emerges across layers.

It includes how a device is held and moves, how the camera behaves during capture, how frames evolve over time, and how a user responds to prompts. It extends to the surrounding session: device posture, network context, timing, and behavioral consistency.

Individually, these signals are weak.

Together, they form something much stronger: a coherent identity.

This is where authenticity begins to separate from simulation.

Why device signals aren’t enough

There has been a shift toward device intelligence and injection detection. This is a step forward — but it doesn’t go far enough.

The issue isn’t whether a device looks risky at a single point in time. It’s whether its behavior is consistent across the entire session.

Traditional signals are increasingly easy to spoof. Emulators mimic real devices, virtual cameras resemble physical ones, and static fingerprints can be masked or replayed.

A point-in-time device check offers only a partial view.

What matters is session integrity — whether device, network, and behavior remain consistent from start to finish, and whether the sequence of events aligns with a real user interaction.

Trust isn’t established by a single signal. It emerges from the consistency of many.

Why deepfake and liveness detection aren’t enough

The challenge isn’t just that synthetic media is getting better, it’s that attackers are learning to replicate the behavioral signals we once trusted.

No single layer — hardware checks, liveness, or deepfake detection — can stand on its own.

Image-based detection, in particular, is locked in a constant game of catch-up. As generative models improve, detection models must continuously adapt. While still necessary, they can no longer serve as the primary line of defense.

A more resilient approach focuses on signals that are fundamentally harder to fake: interaction patterns, session integrity, and cross-signal consistency.

The goal isn’t to find one perfect signal.

It’s to make the entire interaction difficult to fake — consistently, across every layer.

Asking the right questions and rethinking trust

The industry often frames this problem as a binary question: is the face real or fake?

That framing is too narrow. The more important question is whether the interaction itself can be trusted.

• Was this a real person using a real device?
• Did the capture process behave as expected?
• Was the session consistent from beginning to end?
• Did device, network, and behavior align with legitimate usage?

Answering these questions requires moving beyond static analysis toward continuous, context-aware evaluation.

Where this leads

Deepfake detection, liveness, and presentation attack detection will remain essential. But they are no longer sufficient.

The next generation of identity systems will focus on interaction as a first-class signal — correlating device behavior, camera characteristics, session integrity, network context, and user behavior in real time.

Not just analyzing what is presented, but how it is presented — and whether the surrounding context holds together.

In a world where images and videos can be generated with near-perfect realism, the strongest signal may no longer be what you see.

It’s whether the interaction, as a whole, is believable.

Posted by

Deepanker Saxena

Deepanker Saxena

Deepanker Saxena was named Okta's 2026 Identity 25 for the year 2026, one of just 25 innovators worldwide recognized for being pioneers of securing identity in the age of AI. He is currently the Head of Document Verification, Biometrics and Age Assurance Products at Socure, where he leads the vision and strategy for building scalable and secure identity verification solutions. Leveraging cutting-edge machine learning and AI technologies, Deepanker collaborates with cross-functional teams across data science, engineering, and business operations to enhance the product’s capabilities. Passionate about solving real-world challenges, he is committed to creating inclusive and impactful solutions that foster trust and security across industries.