{"id":"cca82ab8-f5ec-4d62-9f9b-0a280036ab13","arxiv_id":"2506.21895","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":6,"one_line_summary":"Reinforcement fine-tuning of a 7B vision-language model with GRPO and task-specific rewards achieves state-of-the-art cross-domain face anti-spoofing and interpretable reasoning.","lead":"This paper presents a reinforcement fine-tuning method that teaches a vision-language model to distinguish real from fake faces by exploring rewarded reasoning paths instead of memorizing training patterns. It reports stronger cross-domain generalization than earlier methods and adds interpretable explanations, while using only real/fake labels rather than text annotations.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The reported SOTA gains rest on an uncontrolled comparison: baseline HTERs are threshold-dependent, while Ours uses a threshold-free text decision rule, and the paper gives no threshold/protocol details for the baselines.","rationale":"The reader's weakest_assumption correctly identifies the comparability of the empirical comparison as the most load-bearing issue. The central claim is that reinforcement fine-tuning with binary labels achieves state-of-the-art cross-domain face anti-spoofing; that claim lives entirely in Table 1. The paper's own evaluation for Ours is threshold-free text classification, while every baseline's HTER is a function of a score threshold. The paper does not disclose how those thresholds were set, nor whether the baseline numbers were re-computed under the same source-target split, same image preprocessing, same decision rule, or simply quoted from prior work. Without this information, the large claimed improvements could be an artifact of inconsistent evaluation protocols rather than genuine algorithmic gains. I considered alternative concerns: pretraining contamination of Qwen2.5-VL on the target datasets, reward hacking of the length-based reasoning reward, and lack of error bars. These are real but less decisive: contamination would weaken the novelty of 'generalization to unseen attacks' but not necessarily invalidate the SOTA claim; reward hacking would weaken the interpretability claim but not the classification numbers; missing error bars would affect confidence but not the point estimate. The threshold/protocol mismatch, however, directly affects every number in the headline table and is therefore the single most load-bearing concern. The reader's CONDITIONAL verdict is appropriate: the direction is promising, but the empirical foundation is not yet verifiable. My read does not change that verdict, so I mark UNCHANGED with agreement on the identified weakness.","tokens_in":13060,"tokens_out":10304,"duration_ms":112968,"concrete_test":"Reproduce Table 1 with released code: for each baseline (Flip, FoundPAD ViT-FS, FoundPAD FE, FoundPAD, MS-LBP, Color texture, CNN), compute continuous scores on the four target test sets; select the decision threshold on the source-domain validation set (no target-domain adaptation) and recompute FRR/FAR/HTER using exactly the same sample set and protocol as Ours. Also report Ours' text-prediction HTER under the same code. If the ranking or the claimed improvement percentages change materially (e.g., any of the four protocols flips to a different best method), the state-of-the-art conclusion is not established. If code is not released, an analytical check is to compare the reported baseline FRR/FAR values against the original Flip and FoundPAD papers to determine whether the same threshold rule and target-domain protocol were used.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Table 1 is the sole support for the central claim of state-of-the-art cross-domain face anti-spoofing. In the 'Training and Inference Process' section, the authors state: 'we do not adopt traditional threshold-based evaluation methods; instead, we directly assess the correctness of the prediction by comparing whether the predicted class is equal to the ground truth class.' This is a hard, threshold-free decision rule. In contrast, every baseline in Table 1 (MS-LBP, Color texture, CNN, Flip, FoundPAD variants) is a score-based classifier: HTER is computed by sweeping or fixing a decision threshold, and the resulting FRR/FAR are threshold-dependent. The 'Comparison Methods' paragraph lists methods but never specifies how thresholds were chosen for the baselines — whether on source-domain validation data, on target-domain test data (oracle/EER), or taken from original publications. If baselines were tuned on the target test set, their HTERs are optimistically biased; if they used a fixed 0.5 threshold, they may be pessimistically biased relative to Ours, which effectively learns a calibrated decision rule through the class-consistent reward. Without this information, the reported improvements of 18.48%, 60.75%, 18.17%, and 28.28% over 'second-best' methods are not verifiable. A secondary, related issue is base-model disparity: Ours uses Qwen2.5-VL-7B (a large MLLM) while Flip and FoundPAD use smaller foundation models. Table 2 partially controls for this by comparing against same-model SFT, so the unresolved load-bearing gap is the baseline evaluation protocol itself.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper proposes a reinforcement fine-tuning framework for cross-domain face anti-spoofing. The method uses Qwen2.5-VL-7B-Instruct as the base model and optimizes it with GRPO using three verifiable rewards: a format reward, a class-consistent reward based on binary real/spoof labels, and a reasoning-consistent reward based on reasoning length. The authors evaluate on four cross-domain protocols (CeFa to HQ-WMCA, CeFa to SiW-Mv2, CASIA-SURF to HQ-WMCA, CASIA-SURF to SiW-Mv2) and report state-of-the-art HTER results, along with ablations, training-data-volume and sampling-quantity studies, and qualitative reasoning examples. The central claim is that reinforcement fine-tuning with only class labels learns transferable decision policies for unseen attack types, without requiring textual reasoning annotations.","tokens_in":13434,"tokens_out":3906,"duration_ms":38758,"significance":"If the empirical claims hold, this is a useful contribution: it demonstrates that binary-label verifiable rewards can adapt a multimodal large language model to face anti-spoofing while producing interpretable reasoning, and it provides a direct comparison against supervised fine-tuning on the same base model in Table 2. The reward design is simple and the ablations are informative. However, the significance is currently limited by unresolved evaluation-protocol concerns, missing uncertainty quantification, and a reward that may encourage verbosity rather than improved reasoning. The central state-of-the-art claim is plausible but not yet rigorously established.","major_comments":[{"comment":"The central SOTA claim rests on an uncontrolled comparison of decision rules. The paper states in the Training and Inference Process section that 'we do not adopt traditional threshold-based evaluation methods; instead, we directly assess the correctness of the prediction by comparing whether the predicted class is equal to the ground truth class.' Ours is therefore a threshold-free text classification rule, while every baseline in Table 1 (MS-LBP, Color texture, CNN, Flip, FoundPAD) is a score-based classifier whose HTER depends on a decision threshold. The Comparison Methods paragraph does not specify how baseline thresholds were selected: whether on source-domain validation data, on target-domain test data as an oracle/EER, or from original publications. Without this information, the reported improvements of 18.48%, 60.75%, 18.17%, and 28.28% over the second-best method are not verifiable. Please provide the exact threshold-setting protocol for each baseline and, ideally, evaluate Ours under the same threshold-based HTER procedure as well as the threshold-free rule.","section":"Training and Inference Process / Table 1"},{"comment":"No uncertainty quantification is reported for any result. Tables 1, 2, and 3 and Figures 4 and 5 appear to report a single run per configuration, with no repeated seeds, standard deviations, or statistical tests. Given that reinforcement fine-tuning is stochastic and that several HTER differences are small (e.g., Table 2, CeFa to SiW-Mv2: Ours 8.89% vs SFT 9.76%), the reported differences may fall within run-to-run noise. Please report multiple seeds with means and variances, and apply a significance test or confidence intervals for the headline comparisons.","section":"Experiments / Tables 1-3, Figures 4-5"},{"comment":"The reasoning-consistent reward explicitly rewards longer reasoning when the class prediction is correct and penalizes longer reasoning when it is incorrect. As written, this reward can be maximized by verbose correct responses and terse incorrect responses, without any direct measure of whether the reasoning is valid or causally supports the decision. The paper's mechanism story that the model 'distills highly generalizable decision-making rules' is therefore not directly supported by Rres; the experiments only measure classification accuracy, not reasoning quality. Please either measure reasoning quality directly (e.g., human or automated evaluation of the generated rationales) or weaken the claim about distilled decision rules, and consider a reward that penalizes irrelevant or unsupported reasoning rather than length per se.","section":"Eq. (5)"},{"comment":"The comparison in Table 1 mixes model families: Ours uses Qwen2.5-VL-7B-Instruct, a large multimodal model, while the strongest baselines (Flip, FoundPAD) use smaller or specialized models. Table 2 partially controls for this by comparing Qwen-based SFT and RFT, and that comparison is useful evidence. However, the abstract and conclusion state 'state-of-the-art' based on Table 1, where the gain may partly reflect base-model capacity rather than the proposed reinforcement fine-tuning method. Please make this confound explicit, and consider adding a Qwen2.5-VL baseline evaluated under the same threshold-free protocol, or clarify that the SOTA statement is relative to previously published methods with different base models.","section":"Table 1 / Comparison Methods"}],"minor_comments":[{"comment":"The notation is inconsistent: the equation uses oi in the text but defines o_i for the policy group. Please unify the notation and explicitly define len(·) and L.","section":"Eq. (5)"},{"comment":"The sentence 'When the format reward Rformat and reasoning consistent reward Rres are removed, the HTER metric increases by 16.89% and 24.39%, respectively' is ambiguous: these percentages appear to be computed relative to the ablated HTER values (3.20/18.95 and 5.08/20.83) rather than relative to the full method's HTER of 15.75%. Please state whether the increases are absolute or relative, and to which reference value.","section":"Ablation Study and Visualization Analysis"},{"comment":"Figure 6 is very crowded: the attack-type labels, colored bars, and numeric values are difficult to read, especially for SiW-Mv2. Please enlarge fonts, use separate panels per protocol, or provide a table with the per-attack error rates.","section":"Figure 6"},{"comment":"Several GRPO hyperparameters named in Eq. (1) (epsilon, beta, and the reference model) are not reported. Please list all hyperparameters, including the KL penalty coefficient, clipping coefficient, number of GRPO iterations, and the training dataset sizes after filtering.","section":"Implementation details"}],"recommendation":"major_revision","confidential_remarks":"The paper is within scope for the journal and the core idea is interesting, but the experimental validation currently does not support the strong SOTA claim because of the threshold-protocol mismatch and missing uncertainty quantification. I would be willing to accept after the authors provide the exact baseline evaluation protocol, multi-seed results, and the missing implementation details. No concerns about novelty disclosure arose beyond the authors' prior IJCV work being cited appropriately."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Dear colleague,\n\nThis paper applies GRPO reinforcement fine-tuning to face anti-spoofing, using only binary real/spoof labels and a length-based reasoning reward, on a Qwen2.5-VL-7B base. That's new in this domain, as far as I can tell, and it's a sensible direction: the comparison against supervised fine-tuning on the same base model (Table 2) is a fair control, and the ablations on reward components, training data size, and sampling quantity give a decent picture of what matters.\n\nThe main problem is the evaluation. Table 1 reports HTER for baselines like Flip and FoundPAD, but never says how their decision thresholds were set. The authors state that for their own method they eschew thresholds and directly compare the predicted text class to the ground truth. That's a coarser decision rule than a score threshold, and HTER values for the baselines are threshold-dependent. If the baselines were tuned on target-domain data or used a default 0.5 threshold, the reported improvements of 18.48%, 60.75%, 18.17%, and 28.28% are not meaningful. This is a load-bearing gap, not a nitpick. The paper also omits error bars and any mention of multiple seeds, so we can't assess variance of the GRPO run. No code is released, which makes reproduction harder.\n\nThe reasoning-consistent reward—rewarding longer reasoning for correct predictions and penalizing it for incorrect ones—is a reasonable heuristic but it doesn't verify the quality of the reasoning. The claim that the model 'distills decision rules' is not directly evidenced beyond a few cherry-picked examples. That's a minor issue relative to the evaluation protocol.\n\nI'd send this to a serious referee if I were an editor, because the direction is promising and the core idea deserves scrutiny. The authors should be asked to provide detailed baseline evaluation protocols, release code or at least multiple seed results, and ideally add a few more recent DG-FAS baselines. But the central novelty is real and the writing is clear.","headline":"A genuinely new application of RL fine-tuning to face anti-spoofing, with a promising idea and a readable write-up, but the headline SOTA numbers rest on an underspecified baseline comparison that needs to be pinned down before the claims can be trusted.","tokens_in":756,"tokens_out":899,"would_cite":true,"duration_ms":41405,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Reinforcement fine-tuning with binary real/spoof labels alone lets a multimodal vision-language model generalize across face-spoofing domains and beat supervised baselines on four cross-domain protocols.","keywords":["face anti-spoofing","cross-domain generalization","reinforcement fine-tuning","group relative policy optimization","multimodal large language model","presentation attack detection","interpretable reasoning","reward design"],"falsifier":"Re-run the four cross-domain protocols with every baseline scored by the same direct text-prediction rule, or with thresholds set identically on the source domain only, and check whether the relative HTER gains of 18.48%, 60.75%, 18.17%, and 28.28% persist; if the gaps shrink or reverse, the state-of-the-art claim is falsified.","tokens_in":12887,"feed_emoji":"🎭","tokens_out":7765,"duration_ms":67883,"temperature":0.7,"pith_summary":"The paper tries to establish that a multimodal large language model can learn to solve face anti-spoofing as a task, rather than memorize training patterns, by fine-tuning it with reinforcement learning on binary real/spoof labels alone. It reports that the resulting model, Qwen2.5-VL-7B-Instruct fine-tuned with GRPO and three verifiable rewards, beats prior supervised methods on four cross-domain protocols, with relative HTER reductions of 18.48%, 60.75%, 18.17%, and 28.28% over the second-best method. If this holds, anti-spoofing systems could be built without labor-intensive textual reasoning annotations, and they would generalize to unseen attack types such as makeup, masks, and mannequins while giving interpretable explanations for each decision. The paper's contribution is therefore a learning paradigm shift, reward-guided exploration of decision policies, rather than a new spoof-feature descriptor.","feed_headline":"Reward fine-tuning beats supervised training on unseen spoof faces","feed_subtitle":"Fine-tuning a vision-language model with binary labels and RL cuts error by up to 60.75% on unseen attacks.","key_machinery":"The load-bearing mechanism is Group Relative Policy Optimization (GRPO) applied to a multimodal policy model, with three verifiable rewards: a format reward that enforces the <think>/<answer> structure, a class-consistent reward that gives 1 when the predicted class matches the ground truth and 0 otherwise, and a reasoning-consistent reward that scales positively with reasoning length for correct predictions and negatively for incorrect ones. GRPO samples N responses per image, normalizes each response's total reward by the group mean and standard deviation to get an advantage, and updates the policy with a clipped objective plus a KL-divergence constraint to the reference model. This reward structure is what forces the model to explore many reasoning policies and retain only those that classify correctly, distilling generalizable decision rules rather than memorized answer formats.","core_discovery":"On the paper's own terms, the discovery is that reinforcement fine-tuning with only real/fake labels lets a vision-language model discover transferable decision rules for face anti-spoofing. The model is prompted to reason in <think>...</think> tags and answer real or spoof; its responses are scored by format, class consistency, and reasoning-consistency rewards, and GRPO keeps only high-reward trajectories while discouraging drift from the reference policy. Across CeFa to HQ-WMCA, CeFa to SiW-Mv2, CASIA-SURF to HQ-WMCA, and CASIA-SURF to SiW-Mv2, the method reports HTER values of 15.75%, 8.89%, 16.48%, and 9.74%, which the paper states are relative improvements of 18.48%, 60.75%, 18.17%, and 28.28% over the second-best method, using direct text-prediction accuracy without any threshold. The same model also handles unseen attacks such as makeup, transparent masks, paper glasses, and mannequins, and its visible reasoning lines up with standard anti-spoofing cues like texture unnaturalness, lighting, distortion, and 3-D appearance.","pith_inferences":["Editorial inference: if the reported gains survive a matched decision-rule comparison, reward design rather than feature engineering would become the main lever in face anti-spoofing research.","Editorial inference: the reasoning-consistent reward's length-based penalty for wrong answers could create a shortcut where the model learns to guess quickly; a testable extension would be to randomize target labels and check whether reasoning still tracks the correct cues.","Editorial inference: the same GRPO-plus-binary-label recipe is a natural candidate for other visual anomaly tasks such as deepfake detection or document tampering, where attack types are open-ended and textual explanations are expensive."],"forward_implications":["A face anti-spoofing model can be trained from binary real/spoof labels alone, removing the need for manually written reasoning annotations.","The same fine-tuning recipe should transfer to other unseen attack families: the paper shows low error on makeup, masks, paper glasses, mannequins, and wigs.","Decisions come with readable chain-of-thought explanations that refer to texture, lighting, distortion, and 3-D appearance, which is what deployment and auditing would want.","More training data and larger policy sampling group sizes both improve HTER, suggesting the method scales with exploration rather than with annotation effort.","Evaluation can be done by comparing direct text predictions to labels, avoiding threshold selection."],"supporting_citations":[{"why":"Supplies the GRPO optimization algorithm that the whole fine-tuning loop is built on.","marker":"Shao et al. 2024"},{"why":"Provides Qwen2.5-VL-7B-Instruct, the base multimodal model that is reinforcement-fine-tuned.","marker":"Bai et al. 2025"},{"why":"Motivates the claim that supervised fine-tuning memorizes while reinforcement learning generalizes, the paper's core contrast.","marker":"Chu et al. 2025"},{"why":"FLIP is the strongest baseline it must beat on three of the four protocols.","marker":"Srivatsan, Naseer, and Nandakumar 2023"},{"why":"FoundPAD is the other multimodal-large-model baseline in the comparison.","marker":"Ozgur et al. 2025"},{"why":"CASIA-SURF is one of the two source-domain training sets.","marker":"Zhang et al. 2019"},{"why":"CeFa is the other source-domain training set.","marker":"Liu et al. 2021"},{"why":"HQ-WMCA is one of the two unseen target datasets.","marker":"Heusch et al. 2020"},{"why":"SiW-Mv2 is the other unseen target dataset.","marker":"Guo et al. 2022"}],"fun_headline_variants":["RL fine-tuning generalizes face anti-spoofing to unseen attacks","Binary labels plus RL beat supervised on unseen spoofs","VLM reasons its way to cross-domain face anti-spoofing","RL fine-tuning yields interpretable rules for unseen spoofs","GRPO-based tuning teaches VLM transferable spoof rules"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the baselines were scored under the same decision rule and threshold logic as the proposed method; the paper reports no details on how baseline thresholds were set, while the proposed method uses direct text-prediction without any threshold.","fun_headline_variants_meta":{"raw":{"variants":["RL fine-tuning generalizes face anti-spoofing to unseen attacks","Binary labels plus RL beat supervised on unseen spoofs","VLM reasons its way to cross-domain face anti-spoofing","RL fine-tuning yields interpretable rules for unseen spoofs","GRPO-based tuning teaches VLM transferable spoof rules"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001052,"raw_usage":{"total_tokens":4451,"prompt_tokens":1012,"completion_tokens":3439,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":628,"completion_tokens_details":{"reasoning_tokens":3352}},"tokens_in":628,"tokens_out":3439,"duration_ms":28580,"temperature":1.0,"reasoning_tokens":3352,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T22:16:13.909088+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Re-run the four cross-domain protocols with every baseline scored by the same direct text-prediction rule, or with thresholds set identically on the source domain only, and check whether the relative HTER gains of 18.48%, 60.75%, 18.17%, and 28.28% persist; if the gaps shrink or reverse, the state-of-the-art claim is falsified.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"FLIP is the strongest baseline it must beat on three of the four protocols."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"CASIA-SURF is one of the two source-domain training sets."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"CeFa is the other source-domain training set."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"HQ-WMCA is one of the two unseen target datasets."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"SiW-Mv2 is the other unseen target dataset."}],"review_version":1}