iBeta Level 3 PAD Certification

iBeta Level 3 is the strictest tier of presentation attack detection (PAD) certification administered by iBeta Quality Assurance, an independent NIST-NVLAP-accredited testing laboratory. Announced by iBeta in early 2026, Level 3 evaluates whether face recognition and liveness detection systems can defeat the most sophisticated 3D mask attacks: including rubber and high-fidelity 3D resin masks custom-manufactured to replicate specific individuals. Compliance with iBeta Level 3 is performed under the ISO/IEC 30107-3 international standard and signals production-grade defense against ultra-realistic spoofing attacks for biometric authentication systems in regulated industries

iBeta Level 2 evaluates biometric systems against silicone, latex, wrapped 3D paper, and advanced paper mask attacks, already a significant step up from 2D paper and replay attacks tested at Level 1. iBeta Level 3 goes further by introducing high-fidelity rubber and 3D resin masks that are custom-manufactured to replicate specific individuals' facial geometry with high precision. These advanced masks defeat anti-spoofing techniques that previously worked against silicone or latex, particularly those relying on texture analysis, depth cues, or basic motion-based liveness detection. Level 3 also requires stricter APCER and BPCER thresholds than Level 2

In early 2026, Incode Technologies became the first company in the biometric industry to pass iBeta Level 3 PAD certification on both iOS and Android platforms with a 0% error rate. Shortly after, Veridas - a Spanish biometric identity verification provider, also achieved iBeta Level 3 certification. As of 2026, these two companies represent the leading edge of L3-compliant face recognition and liveness detection systems entering production. Industry analysts expect more biometric companies to pursue L3 certification in regulated banking, fintech, and government identity verification verticals

iBeta Level 3 testing targets the most advanced 3D mask presentation attacks, including high-fidelity rubber masks, 3D resin masks custom-manufactured per individual, and combinations of these with active liveness countermeasures (head movements, blinking via eyeholes). The testing methodology, defined under ISO/IEC 30107-3, also includes the attack types from Levels 1 and 2 as baseline coverage, so passing L3 effectively means passing all three levels

iBeta certification timelines vary by system complexity and the number of platforms being tested (iOS, Android, web, etc.), but Level 3 testing is typically more time-intensive than Levels 1 and 2 due to the higher number of attack vectors, larger sample sizes, and stricter reporting requirements. Companies typically need 4–8 weeks for formal L3 testing once their face anti-spoofing system is ready, plus an extended preparation phase of several months for training and internal validation against advanced 3D mask datasets

iBeta Level 3 testing follows the metrics defined in ISO/IEC 30107-3:

• APCER (Attack Presentation Classification Error Rate) - measures how often a PAD subsystem incorrectly classifies an attack as bona fide
• BPCER (Bona fide Presentation Classification Error Rate) - measures how often genuine faces are incorrectly classified as attacks
• IAPMR (Impostor Attack Presentation Match Rate) - measures full-system performance combining PAD with the biometric matching subsystem

Level 3 requires stricter thresholds than Level 2 across all metrics. Specific thresholds are confirmed by iBeta during test scoping and depend on the type of PAD evaluation (subsystem, data capture, or full-system)

Yes. Preparing a face recognition or liveness detection system for iBeta Level 3 requires training data that covers the high-fidelity 3D mask attack vectors specifically tested at Level 3 - primarily rubber, and 3D resin masks. Public academic datasets (Idiap CSMAD, Idiap 3DMAD, MSU-MFSD) cover earlier attack categories but lack the high-fidelity mask realism required for L3. Commercial datasets such as the Axon Labs iBeta Level 3 Dataset provide 12+ custom-manufactured rubber and resin masks specifically designed for L3 preparation

In practice, no, iBeta Level 3 testing includes Level 1 and Level 2 attack categories as part of the baseline evaluation, so a biometric system that fails on basic 2D paper attacks or standard silicone masks cannot pass L3. Most companies pursuing L3 have typically already passed L1 and/or L2 first, then trained additional defenses against high-fidelity 3D rubber and resin masks before attempting L3. Companies like Incode and Veridas built their L3 readiness on top of existing L1/L2-certified face anti-spoofing systems