Face ID Was Built Before AI Could Fake You | Zach Meltzer, CEO@VeryAI

Deepfake biometric attacks are up by 58% this week. Are you the guy who's fixing this?

Fraud, especially in finance and banking, is not something new, but it's been massively proliferated by the amounts of AI and deepfake.

We actually in an arms race that never ends.

There are quite literally trillions of dollars being poured into AI generation and hardly even billions being poured into AI detection.

So right now I can wave at you and it's okay?

In this setting, yes, it's okay.

Hi, Zach. Hi.

At your own risk. This is a very real and valid use case, but Over the next few months or the next year, we're going to see this expand around the world.

There's one thing I don't get. Like, you shared a lot of reasons why palm works better than other biometric identification methods, but intuitively, Face ID, let's say, a face seems like a better one in a sense. It's more complex and it's more unique, maybe more data points.

Right. Yes, it really depends on the specific biometric that you're using. There's a lot of variance between different types of biometric options. So Face ID that you use on your phone is not the same type of facial biometric that you use when you show up to the airport for TSA, and it's different from CLEAR. We have all these different types of devices, and there's actually not one specific standard that we see across biometric options. The same is true for fingerprint, even. The fingerprint scanner that you use on your laptop through Apple is going to be different than the one that you use when you do a formal fingerprint with the government or at a police station. So there's a lot of variance between all of them. But when you look at it from a more simplistic level, the palm actually has a lot more data points than your fingerprint and even the face in certain aspects. So we can achieve a higher false acceptance rate than even a solution like you use on a daily basis, such as Face ID. Apple Face ID has a self-reported false acceptance rate, F.A.R., which is like a false positive, of 1 in 1 million. Our baseline minimum F.A.R. is 1 in 10 million. So we're already achieving a 10 times higher F.A.R. than a solution that's widely adopted like Face ID, and we can actually increase that significantly depending on the needs of the customer that we work with. So we can do things like use both your palms, we can do multiple scans on each palm, and we can actually bring that FAR all the way up to 1 in 100 trillion, which sounds like a fake number, but that's the number that we get to when you exponentially increase the surface area by using both palms and also the amount of scans that are performed. But you're always looking for a balance of convenience and accuracy. Mm-hmm.

Do you know, your technology actually know whether it's a real hand or not a photo or a deepfake?

Yes, absolutely. So there's a few things we do to detect AI-generated content and then also make sure that it is a live human. So when you perform a scan, you'll do a quick liveness check before we actually scan for the lines and the creases and the indentations, which is the palm print. A user will be asked to perform a randomized gesture-based liveness detection where you connect any of your two fingers together. It'll ask for this in a randomized order, and that makes sure that A, you're performing the scan live, it's not recorded, and B, someone hasn't cut off your hand, for example. Might sound extreme, but we do get that question. So we always do liveness in the registration process and in the re-verification process. before the actual scan is performed.

Can you explain what is liveness?

Liveness makes sure, again, that you're actually performing this action in real time, that it wasn't recorded, and that it's not AI-generated. Liveness detection is not something that's new, fairly familiar to most people. When you use Face ID or other facial biometrics, or if you've ever gone through a KYC with a financial platform, you'll see the traditional liveness, or one of the more common ones, that's performed with your face where you have to spin your head around. A lot of people are familiar with that. It'll ask you to tilt your head back and forth or up and down. And that's making sure that you're completing the facial biometric in real time. Part of the reason we've taken an approach with tapping your fingers together is because a lot of people find that movement where you have to spin your head around a little bit awkward or unnatural, or even if it just feels more invasive. So even in the way that we approach liveness, we really think about the convenience of the user. and what's most natural.

So— When I did my Face ID, I didn't realize it's actually checking my liveness. I thought it was just trying to collect different areas of the data. Like if you're doing a front face recording, it may not be enough data, and then that's why they're asking you to tilt your chin so you're just giving more data. I didn't realize it's actually a liveness test. What about AI agents? To start, why do AI agents need identity verification?

Yeah. AI agents have become a hot topic, especially within identity companies over the past 12 months, quite faster than anyone anticipated. So we've actually started spending a lot more time in this space over the past few months, and we actually announced a new product last week called AG9. You can find this on ag9.ai. This is our first step into the KYA space, which is called know your agent, similar to KYC, which is know your customer, but now we have this for agents. And the ultimate goal is to just give an identity to this agent so that if the agent is acting on your behalf and it's interacting with third parties, that third party can have some level of information around this agent, who owns it, who created it, when it was deployed, and what type of actions it's taken before visiting this new platform. Our specific solution focuses on the human aspect of the agent. Other KYA solutions focus on previous interactions with payments and financial institutions. Ours stays true to our roots and again, focuses on the human piece of things. So for AG9, When a user fills out their agent, they will now have the option to link their palm to that agent. So you can anonymously link your human verification to this agent. And from there, you'll have permission to approve or revoke actions as your agent acts on your behalf. This will look like a push notification that you receive on your phone, and maybe you'll get an approval to trade $500 on a platform. You get the push notification, you can scan your palm to approve or revoke, and then the agent can act on your behalf. So a third-party platform like a Robinhood or a Coinbase or a JP Morgan knows that you're giving approval to this agent, and then you don't have to remove agents entirely from a platform because the alternative is actually just removing agents from the platforms that we use. The entire internet was built today on the assumption that we know there's a human behind this interaction, and that's actually proving to not be true now. For decades, we've been using tools like Cloudflare and CAPTCHA, where you have to check the box that you are a human, not a bot. But the situation has actually become the opposite now. We want to allow bots or agents to act on our behalf, but existing infrastructure actually filters them all out. So, One of the biggest problems today is that we don't have a way to identify the difference between a malicious bot and a benign, or what I would call an intentional agent. So, AG9 and other awesome KYA infrastructure agent verification tools today are all trying to solve that same problem.

Okay, I want to talk about you and your team for a minute. How big is your team? And has AI changed how you think about how many people you need and who you hire?

We're a team of 10 today. And I think that number, if you were looking at companies maybe 3 to 5 years ago from now, we'd be at least double in size, maybe even triple, especially when you look at engineering resources, business resources, it's a much different game. You can scale quickly with just a few engineers and build everything that you need, but maybe at 5x speed. So we're able to stay very lean. We will grow more. But we can accomplish a lot with the team that we have now. We're not the only ones that are seeing this. Companies across the world are scaling down in size. So, we have the advantage of being able to start with these practices in place.

How many engineers do you have on your team?

We have an engineering team of 3.

3 engineers. What are the other 7 people? I'm curious.

It's myself. We have business resources. We have product resources. We have marketing and support.

Quite a small engineering team for doing such a complicated, high requirements on security and involve a lot of patents, to be honest. I mean, is there, is there a type of engineer that you find more valuable since AI? And can you tell us what do they look like? Maybe you can use your engineer team as examples.

Yeah, it's really important for engineering teams to have holistic approaches now. And what I mean by that is have people who can work across different aspects of engineering, less focused on just backend or frontend, and really have experienced engineers who can fill in the gaps across the board. The same thing is really true for business roles as well. As you're able to leverage more and more AI, you don't need people to be as specialized and siloed into specific pieces of the company. And you really want people to be like a Swiss Army knife in many senses so that they can use AI to complement their skillset rather than fully rely or double down on one piece of building the company. You'll start to see that across other companies and organizations as well. These highly specialized roles might start to go away. Some people actually feel the opposite, but I feel that having, you know, people with very broad skillsets is going to be incredibly important to companies as we continue to leverage more AI. and focus on building smaller, leaner teams.