From the Face ID website:
With Face ID, iPhone X unlocks only when you’re looking at it. It’s designed to resist spoofing by photos or masks. Your facial map is encrypted and protected by the Secure Enclave. And authentication happens instantly on the device, not in the cloud.
and
For additional security, Face ID is attention aware, meaning it unlocks your iPhone X only when you look toward the device with your eyes open. That means Face ID can also reveal notifications and messages, keep the screen lit when you’re reading, or lower the volume of an alarm or ringer.