An injection attack is a spoofing technique that inserts fake or manipulated biometric data directly into the capture flow before the authentication system can verify it. Instead of presenting a real face, voice, or fingerprint to the sensor, the attacker feeds synthetic frames, replayed video, cloned audio, or altered sensor data into the app, SDK, or device interface.
This matters because it can bypass controls that only inspect what arrives after capture. A system may appear to see a live user while it is actually processing injected media. In practice, attackers may use virtual cameras, audio drivers, malware, or modified client software to reach the pipeline. Defenders counter this with secure capture paths, device attestation, sensor binding, anti-tamper checks, challenge-response liveness tests, and independent testing for injection resistance. In biometrics, a strong matcher is not enough if the input channel can be fooled.