How do deepfake video feeds try to defeat live remote proctoring?

How the attack works

The setup needs three pieces: the registered test-taker's face, a stand-in who knows the material, and real-time face-swap software running on the test-taker's machine. The stand-in sits in front of the camera, and the software replaces their face with the registered person's face in the outgoing video stream. To the proctor watching the feed, the right person appears to be taking the exam. The technique is a consumer-grade version of the face swaps in social media filters, tuned for the low frame rates and compression of proctoring video, where artifacts are hardest to spot.

The cruder variant skips the stand-in: a pre-recorded or synthetic video loop of the test-taker nodding and looking at the screen plays into the virtual camera. This fails against any proctor who interacts, but against fully automated review it can survive, because the loop shows a plausible face doing plausible things. The attack's sophistication tracks the proctoring model's weakness: human proctors get face swaps, automated systems get loops.

Why proctoring video is an easy target

Proctoring video is low resolution, heavily compressed, and small on screen, which is exactly the environment where deepfake artifacts hide. The compression that makes remote proctoring bandwidth-feasible also smooths over the blending boundaries and texture mismatches that detection looks for. A face swap that would look fake in a high-definition video call looks fine in a 480p proctoring tile.

The interaction model helps the attacker too. Most of the exam is the test-taker staring at questions, which is a low-motion scenario where synthetic video is most convincing. The moments that would expose the fake, speaking, turning the head, reacting to something unexpected, are rare. Attackers know this and coach stand-ins to minimize movement, producing the calm, still test-taker that automated systems score as low risk.

Signals that expose the synthetic feed

Liveness checks are the first line. Asking the test-taker to perform an unpredictable action, turn their head, hold up a handwritten code, read a phrase aloud, forces the synthetic feed to generate something it was not prepared for. Face swaps handle static poses well and novel motions badly; the artifacts spike exactly when the challenge is issued. Randomized challenges during the exam turn the whole session into a series of liveness tests the attacker cannot rehearse.

Passive signals add a second layer. Real video has consistent lighting, shadows that match the room, and micro-movements, blinking patterns, subtle head drift, that synthetic feeds approximate poorly. Device-level checks help too: virtual camera software leaves traces in the device fingerprint, and a feed coming from a virtual device instead of a physical webcam deserves scrutiny. No single signal is decisive, but the combination of a failed challenge and passive anomalies is strong evidence.

How proctoring programs adapt

The structural response is to make the video channel untrusted by default. Programs are moving toward multi-factor identity: the video feed plus keystroke dynamics, plus challenge responses, plus ID verification at multiple points. A deepfake that defeats the camera still has to defeat the typing pattern and the random challenges, and defeating all three simultaneously is a much harder attack to stage.

Detection models are also improving specifically for the proctoring environment. Rather than generic deepfake detectors trained on high-resolution video, the effective models are trained on compressed proctoring footage, learning the artifact patterns that survive compression. And the programs share intelligence: an attack technique seen against one exam vendor is briefed to the others, because the tooling is commoditized and the same software shows up everywhere. The race favors the defenders here, because the proctor controls the challenge and the attacker has to answer it live.