Lip-Sync Attack Detection for Live Video Interviews

Assume this scenario: you ran a high-volume remote screening day. A week later, Security flags that a new hire is failing basic access hygiene and appears to be operating from an unexpected geography. Legal asks a simple question: "Who did we interview, and can you prove it?" If your only artifacts are a calendar invite, a recording, and subjective notes, you have a defensibility failure. Lip-sync attacks exploit that gap. The candidate video looks plausible, but audio-visual timing is manipulated so the speaker is not the person on screen, or the on-screen face is synthetic. Operationally, this creates four immediate costs: - Audit liability: A decision without evidence is not audit-ready. If you cannot retrieve time-stamped integrity signals and reviewer actions, you are left with opinion. - SLA damage: Teams pause the funnel when suspicion arises. Time delays cluster at moments where identity is unverified, pushing time-to-offer and increasing offer-to-start fallout. - Legal exposure: If challenged, you need a repeatable policy: what you checked, what you logged, and why you escalated or cleared the session. - Mis-hire cost: SHRM cites replacement cost estimates of 50-200% of annual salary depending on role. A single integrity miss can consume your quarterly hiring capacity in rework.

Most hiring stacks failed to solve lip-sync attacks because the workflow is fragmented across systems that do not share a single source of truth. The common failure mode looks like this: identity checks happen once (if at all), then interviews run as a separate system, then assessments run elsewhere, then background checks happen at the end. This sequential design slows everything down and still leaves gaps because the checks are not correlated to the live session. Operationally, legacy tooling tends to create: - Sequential checks that force waterfall workflows instead of parallelized checks, increasing cycle-time variance. - No immutable event log across the interview session. You have a video file, not a time-series of integrity signals. - No unified evidence packs. Notes live in one place, recordings in another, identity artifacts in a third. - No review-bound SLAs. Suspicious sessions sit in inboxes, and accountability becomes informal. - Shadow workflows and silos. Reviewers download clips, share them in chat, and create untracked decisions. Shadow workflows are integrity liabilities.

Before you deploy any detection, assign ownership and define what is automated vs manually reviewed. Otherwise, alerts become noise and review becomes discretionary. Recommended accountability model: - Recruiting Ops owns workflow design, stage SLAs, and candidate communications. They do not adjudicate fraud based on gut feel. - Security owns fraud policy thresholds, escalation rules, access control, and audit policy. They approve what constitutes sufficient evidence. - Hiring Managers own rubric discipline and scoring consistency. They are consumers of integrity signals, not sole arbiters of identity. - People Analytics owns segmented risk dashboards, time-to-event analytics, and weekly integrity reporting tied to funnel health. Sources of truth: - ATS is the system of record for stage transitions, reviewer identity, and decision timestamps. - Verification service is the system of record for biometric checks and document authentication events. - Interview layer is the system of record for AV-sync signals and session telemetry, but it must write back to the ATS to avoid silos.

Recommendation: treat the interview as a controlled access event. Identity verification should occur before access, and integrity signals should be captured continuously during the session. An instrumented workflow for lip-sync defense has five parts:

IntegrityLens AI is used as the ATS-anchored control plane so AV-sync risk signals become actionable and auditable instead of subjective. - Gate interview access with biometric identity verification: liveness, document authentication, and face matching, completed in a typical 2-3 minutes before the interview starts. - Continuously monitor for fraud signals during interviews, including deepfake detection, proxy interview detection, behavioral signals, and device fingerprinting, with step-up verification when risk thresholds are crossed. - Run AI-powered screening interviews 24/7 with structured rubrics so scoring is evidence-based and consistent across reviewers. - Create immutable evidence packs and compliance-ready audit trails so Legal and Security can retrieve who approved what, when, and based on which signals. - Keep People Analytics in control with segmented risk dashboards that tie integrity signals to time-to-event and funnel leakage.

• Recording-only forensics: relying on humans to "review the video later" without capturing time-stamped AV-sync metrics and decision logs. Manual review without evidence creates audit liabilities. - One-threshold-to-rule-them-all: using a single strict cutoff that forces false positives and trains teams to ignore alerts. Fraud defense must be risk-tiered with remediation paths. - Off-platform sharing: downloading clips to chat or email for consensus. This creates shadow workflows, breaks chain of custody, and makes your decisions non-defensible.