We Can See Your Heartbeat
Through Your Camera

The Invisible Pulse

Every time your heart beats, it pushes a wave of oxygenated blood through your capillaries. When that wave reaches the capillaries in your face, it changes the amount of light your skin absorbs — specifically in the green channel. The change is tiny: about 0.1-0.5% of the total reflected light. Invisible to the human eye.

But not invisible to a camera sensor recording at 30 frames per second.

If you extract the average green pixel intensity from a face region across 90 frames, you get a noisy time series. Apply a bandpass filter to isolate the 0.7–4.0 Hz range (42–240 BPM), run an FFT, and a peak emerges at the person's heart rate. That peak is a physiological fingerprint that cannot be faked by a photograph, a screen replay, or a deepfake video that doesn't model subcutaneous blood flow.

This technique is called remote photoplethysmography — rPPG. It was first demonstrated by Verkruysse et al. in 2008 using a $30 webcam and ambient light. Nearly two decades later, it's one of the most powerful liveness signals available — and FaceVault runs it on every camera-based verification session.

Why It Matters for KYC

The core problem in identity verification isn't matching faces. ArcFace does that with 99.83% accuracy. The problem is: is the face real?

A printed photograph has no pulse. A screen replay of a recorded video has no pulse. A deepfake generated frame-by-frame has no pulse. Even a sophisticated real-time face swap running through OBS has no pulse — the face swapping algorithm preserves skin colour but doesn't model the micro-fluctuations caused by blood flow.

rPPG is the one signal that requires an actual cardiovascular system on the other side of the camera. You can't fake physics.

Capturing 90 Frames in 3 Seconds

rPPG capture happens client-side, inside the user's browser, during the selfie step. While the user is looking at the camera for their selfie photo, we're quietly recording 90 frames at 30 FPS in the background. The user doesn't notice — it takes exactly 3 seconds.

// 128x96 canvas — tiny frames, fast upload
const canvas = document.createElement('canvas');
canvas.width = 128;
canvas.height = 96;

// Capture at 30 FPS for 3 seconds
const interval = setInterval(() => {
  ctx.drawImage(videoStream, 0, 0, 128, 96);
  canvas.toBlob(blob => frames.push(blob),
    'image/jpeg', 0.6);
}, 33);  // ~30 FPS

// SHA-256 hash chain for tamper detection
// hash[i] = SHA256(hash[i-1] || frame[i])

Each frame is 128×96 pixels at JPEG quality 0.6 — roughly 4 KB per frame. The entire 90-frame payload is about 360 KB. That's less than a single high-res selfie.

The frames are uploaded in a single batch to POST /{session_id}/rppg. The server validates each frame has a valid JPEG SOI header (0xFF 0xD8 0xFF) and silently discards any that don't — no error messages, no oracle for attackers to probe.

The POS Method: Extracting Pulse from Pixels

The server receives 90 tiny JPEG frames. Now we need to extract a blood volume pulse signal from pixel data. We use the Plane Orthogonal to Skin (POS) method by Wang et al. (2017) — a colour-space projection specifically designed for rPPG.

Here's the pipeline, step by step:

S1 = G(t) - B(t)
S2 = G(t) + B(t) - 2×R(t)
α = std(S1) / std(S2)
pulse = S1 + α × S2

Finding the Heartbeat in the Frequency Domain

After filtering, we have a clean-ish pulse signal in the time domain. But we need to measure it. Is there actually a heartbeat in here, or just noise?

We run an FFT (Fast Fourier Transform) on the filtered signal, zero-padded to the next power of 2 (at least 256 points). This transforms the time-domain pulse into a frequency spectrum — a graph showing how much energy is present at each frequency.

We measure two things from the power spectrum:

Peak frequency — the dominant frequency in the 0.7–4.0 Hz band. Multiply by 60 to get BPM. A real person at rest will produce a peak between 50–120 BPM.

Signal-to-Noise Ratio (SNR) — how much the peak stands out above the surrounding noise. A real pulse typically produces an SNR above 5 dB. A photograph produces an SNR below 1 dB — there's nothing to detect but sensor noise.

From Spectrum to Score

The FFT gives us a peak frequency and an SNR. The scoring function converts these into a single rPPG score from 0.0 to 1.0:

rppg_score = snr_score × 0.70 + bpm_score × 0.30

# Example: SNR = 6.5 dB (score 0.8), BPM = 72 (score 1.0)
# rppg_score = 0.8 × 0.7 + 1.0 × 0.3 = 0.86

SNR carries 70% of the weight because it's the primary indicator of whether a genuine cardiac signal is present. BPM plausibility is a sanity check — even a noisy signal should produce a biologically plausible heart rate if it's real.

One Signal in a 12-Signal Orchestra

rPPG doesn't work alone. It's one of 12 anti-spoofing signals in FaceVault's fusion engine, each exploiting a different physical property that attacks can't simultaneously satisfy:

rPPG carries a 10% weight in the fusion. That might seem low — but it's by design. Not every session can generate rPPG data (file uploads from older devices, browsers that block camera access). The fusion engine normalises weights across available signals only, so when rPPG is present, it pulls its weight. When it's absent from a camera session, a missing rPPG penalty of 0.15 is injected — because a live camera session that produces no heartbeat signal is suspicious.

What It Defeats

Where It Struggles

rPPG isn't magic. It has real limitations, and we think being honest about them matters more than marketing:

By the Numbers