Deepfake Detection Accuracy Explained in 2026: 8 Industry-Recognized Metrics Across Detection, Liveness, and Face Matching

A deepfake detection system should not be judged by one accuracy percentage. A digital KYC flow can contain at least 3 different systems: a deepfake classifier, presentation attack detection, and biometric face matching. Each system makes a different decision and produces different errors.

That is why an accuracy of 99% can reveal less than it appears to. It does not show how many attacks were missed, how many genuine customers were interrupted, which attack types were tested, or where the operating threshold was set.

Eight established metrics provide a clearer view: true positive rate (TPR), false positive rate (FPR), receiver operating characteristic area under the curve (ROC-AUC), equal error rate (EER), attack presentation classification error rate (APCER), bona fide presentation classification error rate (BPCER), false match rate (FMR), and false non-match rate (FNMR).

Which 8 Metrics Measure Deepfake Detection Accuracy?

The 8 metrics belong to 3 measurement layers. Selecting the correct layer is the first decision because a good face-match score does not prove resistance to a replay, and a good PAD score does not prove that an injected deepfake will be detected.

NIST's GenAI evaluation uses ROC-AUC, EER, and TPR at FPR. NISTIR 8491 uses APCER/BPCER for PAD; NIST SP 800-63B uses FMR/FNMR for biometric comparison.

The practical rule is simple: report classifier, PAD, and face-match performance separately before combining them into a KYC decision.

Which Metric Should Banks and Fintechs Use for Each KYC Decision?

Start with the KYC decision, not the acronym. Every decision needs 1 metric for security, 1 metric for genuine-user friction, and a defined action when the threshold is crossed.

For each control, follow 4 steps: name the failure, select the metric pair, convert rates into outcomes per 100,000 attempts, and assign an action. Passing deepfake detection, PAD, or face matching does not answer the other 2 decisions.

The resulting action should depend on which controls agree:

A weak selfie and an injection signal cannot share one retry policy: the first may be a quality problem, while the second invalidates the media source. Final KYC approval is a policy outcome, not a ninth metric.

How Do TPR and FPR Measure a Deepfake Classifier?

True positive rate measures detection; false positive rate measures friction. Report both at the same threshold because changing it normally improves one while worsening the other.

For a test in which deepfake is the positive class:

TPR = correctly detected deepfakes / all deepfakes tested

FPR = authentic samples incorrectly flagged / all authentic samples tested

Assume an illustrative test contains 1,000 deepfakes and 9,000 authentic samples. The system detects 920 deepfakes but flags 180 authentic samples.

TPR = 920 / 1,000 = 92%

FPR = 180 / 9,000 = 2%

False negatives = 80 missed deepfakes

False positives = 180 genuine samples requiring another action

The same 2% FPR creates 200 false alerts per 10,000 genuine attempts or 20,000 per 1 million. Volume turns a small rate into a large queue.

TPR should therefore be reported at one or more fixed FPR values. A statement such as TPR at 0.1% FPR is more useful than 92% detection because it states the customer-friction budget attached to the result.

What Does ROC-AUC Show That One Accuracy Number Cannot?

ROC-AUC shows how well a detector separates deepfake from authentic media across every evaluated threshold. It summarizes the receiver operating characteristic curve, where TPR is plotted against FPR.

An AUC of 1.0 represents perfect ranking on the evaluated dataset; 0.5 is random-like separation. ROC-AUC helps compare models without locking the result to one threshold.

ROC-AUC is not an operating policy. A bank cannot turn 0.97 AUC directly into an approve, review, or reject rule. It still needs a threshold and must examine the resulting TPR and FPR for the relevant attack mix.

A high ROC-AUC on profile photographs does not prove equal performance on video, replays, face swaps, injection, or voice. Break results down by modality, attack family, device, compression, lighting, and demographic group where relevant.

What Does EER Mean in Deepfake Detection?

Equal error rate is the point at which the false positive rate equals the false negative rate. If both errors are 4% at one threshold, the EER is 4%. A lower EER indicates better balanced separation on the evaluated dataset.

FNR = missed deepfakes / all deepfakes tested

EER occurs where FPR = FNR

EER is useful when a team needs one compact benchmark for comparing model versions on the same dataset. It is less useful for setting a production threshold because financial institutions rarely assign equal cost to missed attacks and interrupted customers.

A false negative may admit a synthetic applicant; a false positive may send a genuine applicant to recapture or review. Those outcomes do not have equal cost. A lender may operate below the EER threshold to catch more attacks, while a low-risk journey may prioritize lower interruption.

Use EER to compare balanced model quality. Use TPR and FPR at the intended production threshold to make the deployment decision.

How Do APCER and BPCER Measure Liveness and Presentation Attack Detection?

APCER measures presentation attacks that the PAD system incorrectly accepts as bona fide. BPCER measures bona fide presentations that the system incorrectly classifies as attacks.

APCER = accepted presentation attacks / all presentation attacks tested

BPCER = rejected bona fide presentations / all bona fide presentations tested

In an illustrative test, 6 accepted attacks from 200 produce 3% APCER; 40 rejected genuine presentations from 2,000 produce 2% BPCER.

APCER should also be broken out by presentation attack instrument. A combined 3% could hide 0% for printed photos and 15% for high-resolution screen replays. Procurement teams need the failing attack class, not only the average.

ISO/IEC 30107-3:2023 establishes testing and reporting principles for biometric PAD. Its scope is important: the attacks covered occur at the biometric capture device. A virtual camera, tampered SDK, emulator, or API-level stream injection may bypass the physical capture device and sit outside that presentation-attack scope.

This is why liveness detection and injection detection should not be treated as interchangeable. APCER and BPCER remain the right metrics for PAD, while injected deepfake media needs a separate classifier and capture-integrity test.

Does PAD Certification Prove Deepfake and Injection Resistance?

No. PAD certification proves performance against the presentation attacks included in that test, not manipulated media, virtual-camera injection, face mismatch, or the complete KYC workflow.

ISO/IEC 30107-3:2023 states that its attacks occur at the biometric capture device and that attacks outside that setting are outside scope. A certificate should therefore be read as one evidence layer, not as a universal deepfake pass.

Record 6 scope fields: test date, model version, threshold, attack classes, capture channels, and genuine-user population. Without scope, a low error rate is difficult to apply.

How Do FMR and FNMR Measure Face-Matching Accuracy?

FMR measures zero-effort impostor comparisons that incorrectly match. FNMR measures genuine comparisons that incorrectly fail to match. These metrics evaluate whether 2 biometric samples belong to the same person, not whether either sample is synthetic.

FMR = false matches / all zero-effort impostor comparisons

FNMR = false non-matches / all genuine comparisons

Suppose a face matcher makes 100,000 impostor comparisons and returns 10 false matches. Its illustrative FMR is 0.01%, or 1 in 10,000. If it also makes 10,000 genuine comparisons and rejects 300, its FNMR is 3%.

The operating threshold connects the 2 rates. Raising the similarity threshold usually reduces FMR but increases FNMR. Lowering it usually improves genuine-user matching but allows more impostor matches.

For federal authentication, NIST SP 800-63B requires an FMR of 1 in 10,000 or better and recommends an FNMR below 5%. Those values are not a universal KYC pass mark. An institution still needs testing for its onboarding population, document portraits, cameras, lighting, compression, accessibility needs, and risk tier.

FMR does not measure active impersonation. NIST explicitly notes that biometric FMR does not account for active attacks, so face matching still needs deepfake, liveness, and capture-path controls.

Signzy's face-match guide explains the selfie-to-document workflow. Report FMR and FNMR at the deployed threshold.

How Should Thresholds Be Set Without Hiding Fraud or Customer Friction?

There is no universal deepfake threshold for every KYC journey. FinCEN's deepfake alert identifies typologies and red flags, while the FATF Horizon Scan describes emerging AML/CFT risks. Neither supplies one numerical pass mark.

Set thresholds by journey risk, loss consequence, customer impact, and review capacity. Low-risk onboarding may allow one controlled recapture; lending, payments, and recovery need lower tolerance for missed attacks and independent step-up evidence.

For each candidate, calculate 5 outcomes per 100,000 sessions: attacks detected, attacks missed, genuine sessions flagged, reviews created, and genuine-user abandonment. A balanced vendor test with 50% attacks helps model analysis but does not resemble production, where FPR can dominate customer volume.

Version the model, threshold, attack class, capture channel, and reason code so a performance change can be traced to fraud, software, or policy.

How Should 2 Deepfake Detection Vendors Be Compared Fairly?

Two vendors can only be compared fairly when they process the same held-out samples under the same conditions. A headline score without a shared protocol is not a comparison.

NIST SP 800-63A-4 requires false-positive and false-negative baselines against attack artifacts and genuine media, with tested artifact types and false-negative rates documented.

Raw counts expose small tests. 2 false positives from 100 samples and 2,000 from 100,000 both equal 2%, but only the larger test supports meaningful breakdowns.

Reject any comparison that mixes FPR with FMR, treats PAD evidence as proof against injection, or uses EER as a production threshold without explaining the unequal cost of the 2 errors.

How Can Signzy Be Evaluated Across All 3 Accuracy Layers?

Signzy's Deepfake Detection combines media analysis with face match, liveness, and selfie verification. Its coverage includes injection, face manipulation, synthetic content, and altered image, video, and voice.

That architecture allows one pilot to test all 3 layers without collapsing them into one score:

Signzy reports 1B+ users verified, 2x fraud detection, and a response time below 5 seconds on its deepfake product page. Its One Touch KYC combines document OCR, database checks, face matching, liveness, and AML screening and reports support for 14,000+ document types.

Those capabilities place the controls inside a broader identity workflow. Accuracy still needs to be demonstrated at the selected threshold on the institution's attack corpus, devices, customer population, and review policy.