Identity Deepfake Threats to Biometric Authentication Systems: Public and Expert Perspectives

TL;DR

This study investigates deepfake threats to biometric authentication, revealing gaps in public and expert perceptions, and proposes a new attack model and mitigation framework to enhance system security.

Contribution

It introduces a novel Deepfake Kill Chain model and a tri-layer mitigation framework based on empirical data and threat analysis.

Findings

Public increasingly relies on biometrics for convenience.

Experts express concerns about static biometric spoofing.

Demographic and sector-specific awareness gaps exist.

Abstract

Generative AI (Gen-AI) deepfakes pose a rapidly evolving threat to biometric authentication, yet a significant gap exists between expert understanding of these risks and public perception. This disconnection creates critical vulnerabilities in systems trusted by millions. To bridge this gap, we conducted a comprehensive mixed-method study, surveying 408 professionals across key sectors and conducting in-depth interviews with 37 participants (25 experts, 12 general public [non-experts]). Our findings reveal a paradox: while the public increasingly relies on biometrics for convenience, experts express grave concerns about the spoofing of static modalities like face and voice recognition. We found significant demographic and sector-specific divides in awareness and trust, with finance professionals, for example, showing heightened skepticism. To systematically analyze these threats, we introduce a novel Deepfake Kill Chain model, adapted from Hutchins et al.'s cybersecurity frameworks to map the specific attack vectors used by malicious actors against biometric systems. Based on this model and our empirical findings, we propose a tri-layer mitigation framework that prioritizes dynamic biometric signals (e.g., eye movements), robust privacy-preserving data governance, and targeted educational initiatives. This work provides the first empirically grounded roadmap for defending against AI-generated identity threats by aligning technical safeguards with human-centered insights.