First of all, it’s pretty clear from the whitepaper that the sensor and the Secure Enclave speak over an encrypted channel - you’re not going to be able to inje

First of all, it’s pretty clear from the whitepaper that the sensor and the Secure Enclave speak over an encrypted channel - you’re not going to be able to inject valid data. Second, the point of using an IR image (in addition to the depth image) is that a simple 3D print is not going to provide valid spoofing - it will not match the IR absorption profile of a live face. Additionally, they are also likely testing for liveness by looking for changes from image to image, even if it’s just saccades of the eyes. Third, Apple implies that they are taking a sequence of images. They can, for example, look for changes in IR images associated with blood flow correlated with your heartbeat, which prove you are alive and may be distinguishing from individual to individual. The secure enclave could also request specific changes in the images that can’t be predicted in advance, thus foiling attempts at feeding in canned images. In short, I don’t think it’s anywhere near as simple as you propose.