Biometric authentication has become the default identity layer for fintech apps, crypto exchanges, and digital banks. Every selfie login, every KYC onboarding, every remote account opening relies on a biometric system that must distinguish a real human face from an attacker presenting a printed photo, a 3D mask, or a video replay. The standard against which these systems are tested is iBeta certification and in 2026, passing it has become a prerequisite for selling biometric solutions to regulated markets
What iBeta Certification Actually Tests
iBeta Quality Assurance is an independent biometric testing laboratory accredited by NIST NVLAP. iBeta evaluates biometric systems against ISO/IEC 30107-3, the international standard for Presentation Attack Detection (PAD). Certification comes in three levels: Level 1 covers 2D attacks (printed photos, paper masks, video replay), Level 2 adds 3D mask attacks (silicone, latex, paper-wrapped), and Level 3 – newly introduced and first achieved by Incode in 2026, covers high-fidelity attacks engineered to closely resemble human faces
Each level uses strict performance metrics: APCER (Attack Presentation Classification Error Rate) measures how often the system accepts an attack as genuine, and BPCER (Bona Fide Presentation Classification Error Rate) measures how often it rejects a real user. For Level 2 and 3, IAPMR (Impostor Attack Presentation Match Rate) is also evaluated. Failing any threshold means failing certification
For biometric vendors, achieving iBeta certification is no longer optional, it has become the entry ticket to enterprise contracts in banking, government identity programs, and FIDO Alliance Level A/B certified ecosystems
Why Most Models Fail on First Attempt
In practice, most face anti-spoofing models trained on public academic datasets: CASIA-FASD, OULU-NPU, Replay-Attack, CelebA-Spoof, fail iBeta certification on first attempt. The reason is simple: public datasets cover narrow attack types and were not designed to match the iBeta test protocol
A model that performs well on the Replay-Attack academic dataset may completely fail against silicone mask attacks captured under iBeta-protocol conditions. A model trained on OULU-NPU may collapse under multi-ethnic demographic distributions because the training data was demographically narrow. The result is wasted certification cycles, each iBeta retest typically takes 4–8 weeks and costs significant engineering resources
This is why a growing number of biometric companies turn to specialized commercial datasets aligned specifically to the iBeta test protocol
The Role of Specialized iBeta Datasets
Axon Labs is one of the leading providers of iBeta datasets, with collections used by 21% of iBeta-certified biometric companies in 2026. Their datasets are structured specifically to match the test protocol at each certification level. The Axon Labs iBeta Level 1 alone contains 35,000+ attack videos covering paper attacks, print attacks, cutout paper attacks, smartphone replay, and PC replay attacks, all required attack types for ISO/IEC 30107-3 Level 1 PAD testing. The collection was captured from 85+ unique participants across iPhone 14, iPhone 13 Pro, Galaxy S23, Pixel 7, and other current-generation devices
Demographic balance is a critical factor that public datasets often lack. iBeta evaluation includes Caucasian, African, Asian, and Latin American demographic groups, and a model that fails on any underrepresented group typically fails the certification as a whole. Axon Labs iBeta datasets are designed with multi-ethnic
representation and balanced gender distribution from the start
A Typical iBeta Preparation Workflow
A typical workflow for biometric vendors targeting iBeta certification follows four phases:
1. **Gap analysis** — identify which attack types the existing model has not been trained against
2. **Dataset acquisition** — license iBeta-aligned data covering the gap
3. **Re-training and validation** — augment training data, fine-tune the model, validate APCER/BPCER on held-out subsets approximating iBeta conditions
4. **Submit for testing** — engage iBeta Quality Assurance for the official lab evaluation
Companies pursuing iBeta Level 2 PAD certification typically need 4–8 weeks of data preparation plus 4–12 weeks of iBeta lab testing, a total certification path of 2–5 months when done well. Companies that skip the preparation phase often spend longer cycling through retests
Resources
Companies preparing for iBeta certification can access detailed dataset specifications on the Axon Labs platform – including the Axon Labs iBeta Level 2 dataset documentation for advanced 3D mask attack training, and the broader liveness detection datasets catalog covering related collections