 hosted by Darius Montvila, Sales Director North America and Paolo Gasti, Associate Professor at NYIT and our CTO, explored the growing challenge of deepfakes and their implications for identity verification in the digital age. The session delved into the evolution of deepfakes, the threats they pose, and innovative solutions to counter these threats.

The AI Evolution and the Beginnings of Deepfakes

The webinar kicked off with a historical overview of AI and deepfakes. Darius highlighted that the exploration of AI for image manipulation dates back to the 1990s, with a significant milestone in 2014 when Ian Goodfellow introduced Generative Adversarial Networks (GANs). Paolo provided insights into how GANs work, explaining that they involve two neural networks – a generator and a discriminator – that work in tandem to create increasingly realistic images.

In 2017, the term "deepfake" was coined on a subreddit dedicated to videos using face-swapping technology. Today, deepfakes have evolved from crude manipulations to hyper-realistic content, raising concerns about extortion, blackmail, misinformation, and political subversion. The dual-edged nature of deepfakes was emphasized, with their potential for both creative and malicious applications.

Darius discussed several high-profile deepfake incidents, including a fake Biden robocall urging New Hampshire Democrats to stay home, a Hong Kong company worker losing £20 million in a deepfake video call scam, and the CEO of WPP, the world's largest advertising firm, being targeted. These examples underscore the growing sophistication of deepfake attacks and their potential impact.

The webinar then shifted to the specific threats deepfakes pose to identity verification. Paolo explained presentation attacks and injection attacks, where fake images or videos are used to spoof identity verification processes. One notable example mentioned was using a deepfake of Elon Musk to bypass security checks.

Liveness detection emerged as a critical defense against deepfakes. Paolo differentiated between traditional detection methods and the more advanced passive liveness detection used by Keyless. Passive liveness detection identifies subtle indicators such as skin color variations, textural patterns, light reflections, and unique traits in the periocular region. These indicators help distinguish between live individuals and static images or videos.

Keyless employs a multi-layered defense strategy against deepfake threats, as recommended by Gartner. Darius emphasized Keyless' commitment to privacy-preserving, multi-factor authentication, leveraging passive liveness detection. This approach ensures robust authentication while maintaining user privacy.

The aim of the Deepfake Dilemma webinar was to provide valuable insights into the origins, risks, and countermeasures associated with deepfakes. If you didn't get a chance to watch the webinar live, you can access the webinar recording 

Keyless Webinar Recap: The Deepfake Dilemma

We are delighted to share findings from Gartner’s recent 

Innovation Insight on Biometric Authentication

, published in December 2023, which examines the innovative landscape of biometric authentication technologies. This report underscores the critical role that Keyless and other decentralized biometrics vendors play in identity and access management frameworks.

How Keyless fits into the decentralized model

A central principle of decentralized systems is non-collusion, ensuring that parties involved in authentication act independently without sharing unnecessary information. No single party should be able to access a complete biometric template or any authentication samples, whether in use, stored, or during transit.

Keyless’ flagship Zero-Knowledge Biometrics™ (ZKB) technology uses the cryptographic technique known as secure Multi-Party Computation (sMPC) to split biometric data between our backend and the user’s device, which ensures no data is stored system-wide and prevents us from testing whether an image matches user profiles.

Comparison with traditional biometric authentication approaches

The Gartner report compares Keyless’ approach to local and centralized biometrics, highlighting that the decentralized model has the most well-rounded approach as it combines the benefits of both local and centralized biometrics.

Keyless: Privacy-Preserving Decentralized Biometrics

Gartner's endorsement of decentralized biometric techniques underscores the significance of these methods in identity and access management strategies, validating Keyless's strategic vision. Keyless goes beyond typical decentralized biometric storage by ensuring that no biometric data is stored at all, setting us apart from other vendors. Our commitment to privacy-preserving authentication that combines the benefits of existing systems without compromising on user privacy not only aligns with current technological trends but also sets a new standard for the future of digital identity protection.

We encourage industry leaders to delve into the 

 to better understand the technological advancements and strategic recommendations that will define the future of biometric authentication. For a more comprehensive overview, you are welcome to download the full report from our website or contact us directly for more information on how Keyless is leading the charge in secure, decentralized biometric authentication.

Gartner Names Keyless as a Leading Decentralized Biometrics Vendor in Latest Report

Welcome to the fourth and final installment of our "Smile for AI" series. In this edition, we’ll take a high-level overview of the challenges facing the facial biometrics industry. As the technology carves its niche in sectors from banking and fintech to healthcare and hospitality, it's crucial to understand its headwinds below.

The Legal Landscape: Navigating BIPA and Beyond

One of the most pressing challenges for facial biometrics is heightened litigation, demonstrated by the Biometric Information Privacy Act (BIPA) mentioned in our second Smile for AI blog. With BIPA lawsuit settlements exceeding $900M in 2023, the legal risks associated with facial biometrics have become more pronounced. This surge in litigation not only brings to light the potential financial implications but also raises questions about user consent and data privacy. Such concerns may prompt private sector platforms to reconsider or slow down the adoption of facial biometrics technology.

The Regulatory Maze: Compliance in a Global Context

As facial biometrics become more prevalent, regulatory compliance is turning into a complex puzzle. Whether geography (GDPR, CCPA) or industry-specific (PSD2 SCA, HIPAA), new legislation is emerging across the globe, increasing the regulatory burdens on the capture, use, and storage of biometric data. The challenge here is not just legal but operational, requiring vendors to continuously update their technologies and policies.

AI-Generated Threats: The Deepfake Challenge

Perhaps one of the most technologically challenging headwinds is the rise of AI-generated threats, notably deepfake technology. Stable diffusion and generative AI are rapidly changing the landscape of authentication methods that, until recently, were considered secure against fraud. 

While fake verification photos have long been available on the dark web, the advent of these technologies represents a significant shift. Now, verification and ID pictures can be customized and generated in bulk with ease, presenting new challenges in ensuring the integrity of facial biometric platforms. In response, vendors and users must invest in advanced countermeasures, such as liveness detection and anti-spoofing technology, to maintain the reliability and security of their biometric systems.

The journey of facial biometrics is one marked by incredible potential and significant challenges. As the industry navigates these winds of change, the balance between innovation, privacy, and security becomes ever more critical. The future success of facial biometrics will largely depend on how effectively the industry can adapt to legal and regulatory changes, counter technological threats, and maintain public trust.

Smile for AI Blog Series: The Winds of Change

Welcome back to the Smile for AI series. In this third installment, we’ll provide a high-level overview of the ways facial biometrics are reshaping our world. From national electronic IDs to border security and mobile payments, facial biometrics are seemingly everywhere. That’s not too far from the truth; facial biometrics are now at the forefront of a true technological revolution that is improving the security and convenience of our daily lives.

National eID Verification: A Leap into Digital Identity

 are pioneering the integration of facial biometrics into national eID systems. This move is driven by the need for secure, accurate, and efficient identity verification methods. With facial biometrics, governments are able to improve data privacy and streamline civil identity processes, making digital governance safer and simpler.

Border Control and Travel: Redefining Security and Efficiency

, facial recognition technology is revolutionizing how we travel. It's not just about security; it's about creating a seamless, frictionless travel experience. By partnering with government agencies, facial biometric vendors are providing solutions that balance rigorous security with the convenience travelers demand.

Law Enforcement: Safeguarding Public Safety

The use of facial recognition by law enforcement agencies underscores its importance in maintaining public safety. By cross-referencing surveillance footage with databases of known individuals, agencies can swiftly identify suspects and respond to threats. This technology is crucial in event security and criminal investigations, balancing the need for safety with responsible use.

Customer Onboarding: The Future of Digital Engagement

In some industries such as banking and online gaming it’s now almost impossible to sign up without showing your face in one way or another. This is KYC, the digital transformation of customer onboarding, which has put facial biometrics center stage. By checking that a person’s face matches their ID card, businesses can be more sure than ever before that the person enrollment is really 

, reducing fraud and protecting existing customers.

Mobile Payment Authorization: Securing Digital Transactions

As digital payments become the norm, facial biometrics are being employed to add an extra layer of security to prove the person making the payment is the person associated with the payment information used. From traditional wallets from the likes of Google and Apple to emerging mobile payment providers, facial recognition is key to complying with transaction monitoring regulations and enhancing customer security.

In our next blog, “The Winds of Change”, we will look at the dual nature of facial biometrics. From legal compliance issues, the growth of deepfakes, and private market barriers, we will explore the challenges that shape the field.

Smile for AI Blog Series: The Faces of Innovation

Welcome back to our Smile for AI series, where we continue to unravel the rapidly evolving world of facial biometrics. In this installment, we explore a pressing question: Why is facial biometrics gaining such significant traction right now? After all, commercial application of the technology has been around for decades. From headline-making litigation like BIPA to the growing sophistication of deepfake technology, the landscape is shifting quickly. Let's dive in.

The public's desire for biometric solutions in everyday life is evident. For instance, 73% of airline passengers are now willing to share their biometric data to streamline airport processes​​, a significant increase from 46% in 2019. Moreover, 56% of U.S. adults trust law enforcement to use facial recognition responsibly​​. These statistics indicate a growing acceptance and trust in facial biometrics.

Deepfakes and related technologies, such as face swaps and generative adversarial networks, are becoming increasingly prevalent. In 2022, attacks involving these technologies surged by 149% from the first to the second half of the year​​. This alarming trend highlights the need for more robust and effective biometric systems. However, the performance analysis of state-of-the-art deepfake detectors shows a worrying variance in efficacy, ranging from 97% down to 30%.

The BIPA Litigation Wave: A Catalyst for Change

Last year saw a huge surge in biometric litigation under the Illinois-based Biometric Information Privacy Act (BIPA). While this is of course a US-based case, the US is often seen as a pioneer in both technology and its regulation, meaning that legal precedents set there often influence global norms and policies.

An astonishing 74 of 182 total lawsuits filed under BIPA sprouted in just two months from December 2022 to February 2023​​. This legal spotlight has not only heightened public awareness but has also pushed companies to reconsider their biometric data practices. With big tech giants like Facebook, Google, and Snapchat settling BIPA cases for a whopping $203.5M​​, the message is clear: the legal implications of biometric technology are vast and critical.

Legislative and Technological Developments

On the legislative front, the EU is poised to enact the Artificial Intelligence Act by spring 2024, which includes provisions against the unauthorized use of biometric data​​. Technologically, we're seeing innovations like the Pan-European Entry/Exit System, set to replace traditional passport stamping with facial biometrics by the end of 2023​​. Companies like Eurostar, the channel tunnel train operator, are also adopting these systems for cross-border travel.

The Path Forward: Navigating Challenges and Opportunities

As the technology advances and becomes more accessible, creating basic facial deepfakes has become easier due to open-source frameworks and tutorials. This presents a dual challenge of ensuring robust security while maintaining ethical standards. The rulings of Illinois' supreme court, affirming individual penalties for each BIPA infringement, underscore the legal seriousness of these concerns.

Facial biometrics is at a crucial juncture. The demand and enthusiasm for its benefits in security and convenience are counterbalanced by concerns over privacy, legal compliance, and the threat of deepfakes. As we continue to navigate these waters, the importance of responsible innovation and rigorous compliance cannot be overstated. The future of facial biometrics hinges not only on technological advancements but also on the industry's ability to align with ethical standards and legal requirements.

In our next blog, “The Many Faces of Innovation” we turn our focus to the expansive use cases of facial biometrics. From national eID systems in countries like India to enhancing security at borders and in law enforcement, we explore how this technology is reshaping identity verification. We'll also delve into its role in customer onboarding and mobile payment security, highlighting the industry's innovative approaches amidst evolving privacy and regulatory landscapes.

Smile for AI Blog Series: Why Now?

To kick off the new year with excitement, we're thrilled to introduce our new blog series, "Smile for AI". Throughout Q1 of 2024, we'll delve into the factors fueling its popularity, draw insightful comparisons with other biometric methods, and highlight the most impactful use cases. Stay tuned for a captivating journey into the fascinating realm of AI and facial biometrics!

Even within the rapidly evolving world of cybersecurity, facial biometrics has truly become a cutting-edge technology rapidly transforming how we approach identification and security. According to leading digital identity strategy firm Liminal, the facial biometrics market is not just growing—it's booming, with a projected value of $42.1 billion by 2028.

Driven by widespread adoption in both the public and private sectors, facial biometrics is at the forefront of technological innovation. However, this journey isn't without its challenges. The evolving global regulatory landscape and the rise of AI-generated deepfakes and spoofing technologies present hurdles that the industry must navigate. 

Nonetheless, the demand for seamless and secure identification processes, especially among younger consumers, continues to propel this market forward. In this blog, we will cover the basics of the facial biometric process - what happens, and when.

The journey begins with the capture of an individual's facial images using devices like cameras, webcams, or smartphones. This step is crucial as it lays the foundation for further processing.

Once captured, these images undergo preprocessing. This involves enhancing image quality by removing noise, cropping, resizing, and filtering, ensuring the data is primed for accurate analysis.

Normalization follows, where images are adjusted to a standard scale. This step prevents certain features from dominating others, maintaining a balanced analysis.

Now comes the detection and alignment phase. Algorithms work tirelessly to identify the position and orientation of the face, aligning it to a standardized format. This consistency is vital for accurate feature extraction.

Here, the system identifies distinct facial landmarks. The distance between the eyes, the shape of the nose, and the curvature of the lips are meticulously analyzed using both 2D and 3D modeling.

The extracted features are then transformed into mathematical templates. This involves several normalization processes like adjusting pixel intensities (gray level normalization), correcting for light impact (illumination normalization), and adjusting for position and scale (geometry normalization).

This final phase is crucial. The biometric system matches the created template against a database of pre-registered templates or a previously stored personal reference. This step is pivotal in determining identity or verifying a user's authenticity. The system uses sophisticated algorithms to calculate a similarity score. If this score surpasses a predetermined threshold, a match is declared; otherwise, it results in an inconclusive outcome. It's a delicate balance of precision and accuracy, ensuring reliable results while maintaining privacy and security.

The facial biometrics field is rapidly evolving, facing both technological advancements and challenges. Deepfake technology, which creates highly realistic and deceptive images, poses a significant threat to the integrity of facial biometrics systems. However, the industry is responding with advanced countermeasures, constantly improving the technology to stay ahead of such threats.

In the final stage, these templates are compared against a database of pre-registered templates or a stored personal reference sample. The decision hinges on whether the similarity score surpasses a predetermined threshold. If it does, a match is declared; if not, the result is deemed inconclusive.

As facial biometrics technology advances, so does its application spectrum. It's no longer confined to traditional security realms; it's making waves in areas like mobile payment authorization and digital onboarding, providing a frictionless user experience. This expansion, however, brings to light the critical issue of regulatory compliance. With legislation like BIPA influencing the industry, facial biometric vendors are compelled to adapt and innovate, ensuring their solutions are not only technologically advanced but also legally compliant.

Despite these challenges, the demand for facial biometrics remains robust, especially in public-facing industries that prioritize secure and seamless identity verification. The technology's ability to provide enhanced security while offering a user-friendly experience is a key factor driving its adoption. It is a testament to the technology's potential and its critical role in shaping the future of digital identity verification.

In our next blog, we will discuss "Why Now?" — an insightful look at the current landscape of facial biometrics. We'll delve into the reasons behind its rising prominence, fueled by headline-grabbing BIPA litigation, the growing challenge of deepfake spoofing, and the adoption of facial biometrics in public-facing industries for cross-border solutions.

Smile for AI Blog Series: What Really Happens When You Take That Selfie?

In today's digital world, verifying a user's real identity is crucial, not just when they first sign up but throughout their entire interaction with a service. With the rise of more complex threats using advanced technologies like automation and AI, businesses are finding it increasingly difficult to continuously confirm the authenticity of user identities. This situation highlights the need for more advanced methods to ensure identity security at all times, not just at the start.

KYC (Know Your Customer) is a process businesses use to identify their clients and prevent financial crimes. It involves verifying personal identification documents when a customer first registers. Though crucial, KYC is just the beginning of a comprehensive approach to maintaining identity security.

Why Continuous Identity Verification Matters

After the KYC process, identity fraud and account takeovers do not simply disappear. It's essential to keep verifying a user's identity as they use a service, to protect against sophisticated cyber threats that might not be caught by initial KYC checks. Ongoing identity verification is vital for security and trust, making sure users are who they say they are at every stage of their journey.

Key Strategies for Continuous Identity Verification

We’ve identified five key considerations we believe all businesses should keep top of mind when implementing ongoing identity verification checks.

Seamless Integration with Initial Onboarding

The process should smoothly transition from the initial identity verification done during onboarding. Using the biometric data captured at the onboarding step for continuous authentication is the most seamless and user friendly way to continually verify someone’s identity.

Dynamic Verification Across User Interactions

The system should be able to dynamically verify users at key interaction points — such as logging in, making high-value transactions, recovering accounts, or changing account details.

Combining multiple security layers, such as facial recognition that respects privacy, device verification, and liveness detection, can greatly enhance protection against unauthorized access.

Regularly comparing biometric templates ensures that the person interacting is the same as the one registered initially. But this must be done in a way that protects their privacy by not putting their PII at risk.

The system should help businesses adhere to the latest regulatory requirements related to data privacy and security. Within Europe, the GDPR puts several restrictions on biometric data - any data that leaves the device should not contain PII. The upcoming PSD3 will put further requirements on implementing Strong Customer Authentication (SCA) for digital payments.

As digital threats become more advanced, businesses must enhance their identity verification methods beyond just the first KYC steps. This involves implementing innovative strategies to reinforce identity security throughout the customer's entire relationship with the business. By doing so, companies can better defend against cyber threats, meet regulatory requirements, and provide a secure and smooth experience for users.

Continuous Identity Verification: Navigating the Digital Landscape Beyond KYC

Keyless Emerges as an Independent Entity: Brings Total Funding to US $26m to Stop Identity Fraud

The London-headquartered scaleup announces a mutually beneficial departure from Sift as it secures funds to accelerate adoption of its biometric authentication solutions beyond Europe

Keyless, the leader in privacy-preserving biometric authentication, secures an additional $6 million in funding from prominent European venture capitalists, led by Rialto Ventures. This funding injection elevates Keyless' total funding to $26 million, with previous backing from distinguished investors such as P101, Primo Ventures, gumi Cryptos Capital, and Ripple's Xpring.

Stefano Quintarelli, General Partner at Rialto VC, underscores Keyless' potential, noting, 

Keyless unifies the entire end-to-end identity lifecycle with privacy-preserving biometric authentication, helping to continuously assure the genuine identity of the user from the initial onboarding and account creation, through to step-up actions, transaction signing (including PSD2 SCA compliance), and account recovery. Its patented technology not only fortifies protection against account takeover attacks and identity theft but also ensures compliance with global data protection and privacy regulations, such as the GDPR.

Andrea Carmignani, co-founder and CEO of Keyless, emphasizes the shifting authentication landscape in Europe, stating, 

Thanks to its privacy-preserving cryptographic capabilities, Keyless can create universal biometric profiles that can be used to assure the identity of the genuine user at any point in the identity lifecycle without needing to store biometric data anywhere, delivering superior security while preserving user privacy. This addresses the challenge faced by vendors relying on device-bound biometric capabilities such as FaceID, which do not authenticate the genuine person behind the device, but rather authenticate the device itself, making it difficult to prove that it is the authorized account holder.

Carmignani highlights the need for a transition in authentication, stating, 

Server-side biometric solutions, which solve the identity portability issues with device-based authentication, come with the challenge of storing sensitive biometric data in centralized databases. Even if the data is encrypted at rest, it still represents personal identifiable information (PII) and poses a massive risk to the business. Emerging private-by-design solutions, such as Keyless, are solving this trade off and for the first time, enabling businesses to balance seamless user experiences with compliance needs and strong security.

This latest round is also the startup’s first as a newly independent company. In a strategic move, Keyless mutually agreed to separate from parent company Sift earlier this year. The separation comes after the two companies found that their respective products were best suited to servicing differing markets. 

Thanks to increasing adoption of its flagship Zero-Knowledge Biometrics™ technology, Keyless continues to lead the charge in privacy-preserving biometric authentication, with this latest funding serving as a testament to its commitment to reshaping the authentication landscape in a rapidly evolving digital era.

Keyless Brings Total Funding to US $26m to Stop Identity Fraud; Emerges as an Independent Entity

In the ever-evolving landscape of financial services, staying up to date with regulatory changes is crucial, especially when it comes to payment services. The Payment Services Directive (PSD2) has been a game-changer, introducing Strong Customer Authentication (SCA) and promoting open banking. 

Now, as the European Commission proposes to replace PSD2 with PSD3 and introduce the Payment Services Regulation (PSR1), it's essential to understand the implications for financial institutions, particularly banks, and how innovative solutions like passwordless authentication can help.

The most significant change introduced by PSD3 is the transition from a directive to a regulation. This means that most of the payment rules from PSD2 will fall under the Payment Services Regulation 1 (PSR1). Unlike directives, which can be interpreted differently by each EU country, regulations apply uniformly across all member states. This shift will lead to a more harmonized payments market with fewer differences and inequalities between countries. 

In addition to PSR1, PSD3 will focus specifically on licensing and authorization for payment and e-money institutions.

The changes aim to address the gaps and shortcomings identified in the previous version, PSD2. By modernizing payment services and opening up financial services data, PSD3 and PSR1 strive to ensure improved consumer protection, foster competition, enhance security, and build trust within the industry. The proposal seeks to streamline and standardize payments across the EU, making transactions more efficient and secure.

One of the significant updates introduced by PSD3 is the merger of e-money institutions and payment institutions, simplifying the licensing process and promoting a more efficient and competitive market. This consolidation aims to streamline operations and provide a more comprehensive regulatory framework for these institutions.

PSD3 proposes an implementation of a risk-based approach to fraud prevention, leveraging technologies such as IBAN and name matching. This measure aims to enhance security and protect consumers from fraudulent activities, ensuring a safer payment ecosystem.

PSD3 seeks to clarify and refine the requirements for Strong Customer Authentication, which aims to strengthen the security of online payments. By setting clear guidelines, PSD3 aims to strike a balance between security measures and user convenience, ensuring smooth and secure transactions.

Transparency is a cornerstone of the proposed changes. PSD3 aims to introduce transparency reforms that empower consumers with greater visibility into their payment transactions, fees, and charges. This transparency fosters trust and enables customers to make informed decisions.

PSD3 aims to enhance access to bank account services for payment institutions, promoting competition and innovation. By facilitating access to account information and payment initiation services, PSD3 aims to create a more dynamic and open financial ecosystem.

The proposed changes from PSD2 to PSD3, accompanied by PSR1, reflect the European Commission's commitment to modernizing payment services, improving consumer protection, and fostering innovation. The introduction of PSD3 will bring about significant advancements in the efficiency, security, and transparency of payments within the European Union. It is an important step towards shaping the future of the financial sector and ensuring a seamless and secure payment experience for all stakeholders involved.

The evaluation of PSD2 revealed that Strong Customer Authentication had a significant impact on reducing fraud, a clear win in bolstering the payment ecosystem's security. However, as fraudsters adapt, regulatory measures must follow suit. 

In our next blog, we’ll be looking closely at the evaluation of Strong Customer Authentication as well as proposed amendments to SCA under PSR1.