{"id":"cd105382-d698-458c-855c-5baa0fa72109","arxiv_id":"2607.26432","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"FAS-R1 combines long-CoT supervised fine-tuning with difficulty-aware GRPO and degradation-simulated augmentation to improve multi-task face anti-spoofing and explainable rationales.","lead":"FAS-R1 is a two-stage face-anti-spoofing model that first fine-tunes a vision-language model on a long chain-of-thought dataset and then trains it with a custom reinforcement-learning step to keep reasoning stable under image-quality changes. The paper reports state-of-the-art multi-task accuracy, attack-type recognition, spoof-region localization, and rationale quality across three face anti-spoofing benchmarks.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"In-domain evaluation splits the merged dataset at image level, so the same subject appears in train and test; this likely inflates the headline 98.75% ACC and should be re-tested subject-disjoint.","rationale":"The reader's weakest assumption was that re-implemented baselines (FaceShield, PA-FAS) might be suboptimally tuned, which would affect the comparison but not necessarily the absolute validity of FAS-R1's own numbers. The identity-leakage concern is more load-bearing because it undermines the central quantitative claims even if the method and baselines are correctly reproduced. A subject-disjoint split is standard for face anti-spoofing evaluation precisely because appearance cues can be identity-specific, and the paper's explicit 'image level' split makes this a concrete, verifiable flaw. I therefore identify this as the single most important concern. The paper's cross-domain results are still valuable, and the method may indeed work, so the verdict remains conditional rather than rejection: the authors should be required to re-evaluate under subject-disjoint splits (and ideally provide code/data to enable verification). The reader's concern about baselines remains valid, but it is secondary and partly a reproducibility issue, not an internal correctness issue. Thus I do not change the overall conditional verdict, but I add a specific technical condition that should be satisfied before the in-domain SOTA claim is accepted.","tokens_in":13311,"tokens_out":8404,"duration_ms":93345,"concrete_test":"Re-run the in-domain evaluation with a subject-disjoint split: for each dataset (WMCA, PADISI-Face, SiW-Mv2), assign all images of a given subject to either train or test (or use the official subject-disjoint protocols if available). Retrain FAS-R1 and the key compared methods (FaceShield, PA-FAS, discriminative baselines) under this protocol and compare ACC/HTER and AP@40/AP@50 to Table 2. If the numbers drop materially (e.g., >2–3 pp), the image-level split was a data-leakage source and the in-domain SOTA claim should be revised or explicitly re-scoped.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's in-domain protocol states (Evaluation Protocols): 'the merged images are split at the image level into training, validation, and test sets with an 8:1:1 ratio.' WMCA, PADISI-Face, and SiW-Mv2 each contain multiple images per subject. An image-level random split therefore places the same identity in both training and test sets, allowing the model to exploit identity-specific appearance (e.g., glasses, skin texture, lighting) rather than generalizable spoof cues. This directly inflates the central in-domain claims: 98.75% authenticity ACC, 93.33% attack-type ACC, and 96.30/94.73 AP@40/AP@50 in Table 2. It also makes the comparison with FaceShield and PA-FAS less meaningful as a measure of generalization to unseen subjects, because all models are evaluated on test images of identities seen during training. The cross-domain results (Table 3) are less affected since training and test domains are disjoint, but the abstract's headline numbers are not trustworthy as stated. This is a more fundamental threat than baseline re-implementation: even if baselines are perfectly tuned, the absolute and relative in-domain numbers may not reflect real-world subject-independent FAS performance.","agreement_with_reader":"disagree"},"referee_report":{"model":"deepseek-v4-flash","summary":"FAS-R1 proposes a two-stage training framework for a 3B/7B multimodal LLM (Qwen2.5-VL) that unifies face anti-spoofing authenticity classification, attack-type recognition, spoof-region localization, and generated rationales. Stage 1 performs cold-start SFT on a newly constructed 22,996-sample long-CoT corpus (FAS-R1-23K) built from WMCA, PADISI-Face, and SiW-Mv2; Stage 2 applies GRPO with Degradation-Simulated Augmentation (paired clean/degraded rollouts) and Difficulty-Aware GRPO (task–attack subgroup advantage reweighting). The paper reports in-domain coarse ACC 98.75%, fine-grained ACC 93.33%, AP@40/AP@50 of 96.30/94.73%, several cross-domain authenticity generalization results, and higher judged rationale quality than compared systems, concluding that an MLLM can match discriminative FAS accuracy while providing inspectable semantics.","tokens_in":13623,"tokens_out":4821,"duration_ms":53413,"significance":"The task and proposed interface are timely: moving FAS from label-only output to evidence-grounded, multi-task MLLM prediction is a natural next step, and the two-stage SFT-plus-FAS-specific-GRPO recipe is a reasonable engineering contribution with a clear motivation. The paper scores well on internal consistency: the central classification metrics are grounded in external benchmark labels rather than generated labels, the ablation study is controlled (same rewards, prompts, and verifier across RL variants), and the cross-domain protocols are standard. If the reported numbers held up under a stricter evaluation, the paper would make a useful empirical contribution. However, as it stands, the headline in-domain claims are compromised by a subject-overlap protocol, and the comparison to prior MLLM FAS methods rests on unreleased re-implementations. The rationale-quality conclusions also rely largely on self-referential judge models.","major_comments":[{"comment":"The in-domain split is described as 'the merged images are split at the image level into training, validation, and test sets with an 8:1:1 ratio.' WMCA, PADISI-Face, and SiW-Mv2 each contain multiple images per subject, so an image-level random split places the same identities in both training and test sets. This allows the model to exploit identity-specific appearance (glasses, skin texture, lighting) rather than generalizable spoof cues, and it directly inflates the headline numbers in Table 2 (98.75% coarse ACC, 93.33% attack ACC, 96.30/94.73 AP@40/AP@50) and the comparison to FaceShield/PA-FAS. The cross-domain results in Table 3 are less affected because domains are disjoint. The authors should re-evaluate with a subject-disjoint split, or at minimum report the train/test identity overlap and the corresponding metrics. Without this, the abstract's in-domain claims are not trustworth","section":"Evaluation Protocols; Table 2"},{"comment":"The paper states that since other MLLM-based FAS methods have not released code/checkpoints, FaceShield and PA-FAS are trained with FAS-R1-23K. The head-to-head comparisons in Tables 2 and 3 therefore depend entirely on how faithfully and how well those baselines are re-implemented, but the paper gives no hyperparameters, training lengths, or validation-based checkpoint selection for the re-implemented baselines, and no sensitivity analysis. A suboptimal re-implementation would make the reported improvements over previous MLLM methods overstated even if FAS-R1 works. Please provide full training details for the re-implementations, an ablation of their training budget, or comparison against published numbers where available, and ideally release the baseline checkpoints to make the comparison reproducible.","section":"Implementation Details; Tables 2–3"},{"comment":"The rationale-quality evaluation is not independent of the training pipeline. Training rationales in FAS-R1-23K were generated by Gemini 2.5 Flash and verified by GPT-5; the judges in Table 4/Fig. 5 are Claude-Sonnet-4.5 and Gemini-3-Pro, and the judge models themselves are also included as candidate systems. This creates a risk of style-matching bias: a judge may prefer outputs that resemble its own generation style or the style of the same model family. The claim that FAS-R1 produces better answer-and-rationale quality is a central contribution, so the authors should add human evaluation or at least an independent judge not used anywhere in the pipeline, together with a bias check (e.g., which tokens/features drive judge preferences).","section":"Answer-and-Rationale Quality; Table 4, Fig. 5"},{"comment":"Most of the reported gains over the strongest baseline PA-FAS are small in absolute terms: e.g., coarse ACC 98.75 vs 97.93, attack ACC 93.33 vs 91.82, and cross-domain ACC differences of roughly ±1 pp in some protocols. No error bars, multiple seeds, or significance tests are reported for any of the tables. Given the stochasticity of RL training and the small margins, this is insufficient to support a state-of-the-art claim. The authors should report mean ± std over at least three seeds, or otherwise justify why the comparisons are stable. This is especially important because the re-implemented baselines may also vary with seed.","section":"Tables 2–3, Tables 5–6"}],"minor_comments":[{"comment":"The text says 'Bona fide samples are correct by construction, so this score should be read together with authenticity accuracy.' This makes the fine-grained attack-type accuracy difficult to interpret. Please state explicitly whether the denominator for fine-grained ACC includes bona fide samples and, if so, how the trivial 'real' class is handled.","section":"Table 2, fine-grained ACC"},{"comment":"Token indices are suppressed in the policy ratio r_{i,j}; please clarify whether the ratio is computed over full trajectories and whether the KL term is per-token. Also, Algorithm 1 refers to the degraded operator A but not to how n_c/n_d is chosen; please define these in the pseudocode.","section":"Eq. (5) and Algorithm 1"},{"comment":"The caption text '167 W → C / 1 C → W' is unclear/truncated. It should state the actual protocol and the meaning of 'hard' vs 'easy' subgroups.","section":"Fig. 6(b)"},{"comment":"Please define how AP is computed for coarse boxes: whether it is the fraction of test samples with IoU > threshold (as appears to be the case) or a precision-recall area under the curve. The current notation is ambiguous.","section":"AP@40/AP@50 definition"},{"comment":"The paper says 'The code will be released soon' but no code, data, or trained checkpoints are available. FAS-R1-23K is a claimed contribution, so its release plan should be stated concretely (license, access, annotation format).","section":"Reproducibility"},{"comment":"The judge scores (e.g., Gemini-3-Pro judging its own outputs) may be inflated because the judge is also a candidate. This is related to Major Comment 3 and should at least be acknowledged in the text.","section":"Table 4"}],"recommendation":"major_revision","confidential_remarks":"The subject-overlap issue in the in-domain protocol is the most serious problem: it directly undermines the abstract's headline numbers. The cross-domain results and controlled ablations still provide a useful signal, so the paper is worth pursuing, but I would not recommend acceptance until an identity-disjoint in-domain evaluation is reported and the baseline re-implementations are documented or released. The rationale-quality evaluation also needs strengthening with human ratings or an independent judge."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things to know. The system is real: a two-stage pipeline (long-CoT SFT on a new 23K dataset, then FAS-specific GRPO with DSA and DA-GRPO) that gives structured authenticity, attack-type, localization, and rationales. The ablations are clean and each component contributes; the cross-domain numbers are competitive. But the headline in-domain results are inflated by the evaluation protocol. The text says the merged data is split at image level 8:1:1. WMCA, PADISI-Face, and SiW-Mv2 all have multiple images per subject, so the same identity sits in train and test. That leaks appearance cues and makes 98.75% ACC and the AP numbers look better than they would for unseen subjects. The cross-domain results are largely immune to this, so I'd trust those more.\n\nThe new stuff: FAS-R1-23K is a genuinely useful resource if released, and DSA is a neat idea — pairing clean and degraded rollouts in one group so the policy anchors on stable cues. DA-GRPO is a reasonable hard-subgroup reweighting, not a breakthrough. The paper does not oversell it.\n\nThe soft spots beyond the split: the rationale-quality evaluation is self-referential. Gemini-3-Pro and Claude both act as judges and are themselves compared systems; GPT-5 was used to verify training rationales and is also in the tables. An external judge or a human preference study would fix this. Also no code, data, or checkpoints yet; FaceShield and PA-FAS are re-implemented; no error bars or multiple seeds. Those are standard reproducibility gaps, but they matter here because the baselines are re-implementations rather than official checkpoints.\n\nFor whom: anyone working on MLLM-based FAS or on RL post-training for visual-language models. The methodology section is clear, the figures are helpful, and the failure mode is instructive. Worth a serious referee, but the authors should not get away with the current in-domain protocol. I'd send it to review with a request for subject-disjoint splits, released artifacts, and a cleaner rationale evaluation — then the paper could be solid.","headline":"Solid RL-based FAS system with clean ablations, but the image-level in-domain split leaks identity and inflates the headline numbers; the rationale evaluation is self-referential, so the central claims need a fix before they can be trusted.","tokens_in":14110,"tokens_out":2958,"would_cite":false,"duration_ms":30699,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A single 3B multimodal language model can match discriminative face-anti-spoofing accuracy while also producing inspectable, image-grounded rationales.","keywords":["face anti-spoofing","presentation attack detection","multimodal large language model","chain-of-thought reasoning","reinforcement learning","GRPO","domain generalization","spoof-region localization"],"falsifier":"Run the same training and evaluation protocol using the original released checkpoints of the two compared MLLM baselines (instead of the re-implementations), and check whether FAS-R1's accuracy, localization, and Elo-rationale gaps persist. A second check: ablate DA-GRPO on a held-out hard subgroup (e.g., makeup/mask attacks) and see whether the large coarse-ACC gain from 94.45% to 98.75% reproduces; if it does not, the difficulty-reweighting claim fails.","tokens_in":13225,"feed_emoji":"🛡️","tokens_out":8233,"duration_ms":463425,"temperature":0.7,"pith_summary":"Face anti-spoofing has mostly been a label-only 'real or spoof' classification problem, and explainable variants have tended to sacrifice either accuracy or genuine image grounding. FAS-R1 claims to close that gap with a multimodal large language model that, from a single interface, judges authenticity, names the attack type, draws the spoof region, and writes an image-grounded rationale. Training is two-stage: a cold-start supervised fine-tune on FAS-R1-23K, a curated 23K-sample chain-of-thought dataset, then a face-specific reinforcement-learning stage. Two mechanisms do the work there: Degradation-Simulated Augmentation (DSA) pairs clean and degraded views of the same image inside one rollout group so spoof cues must be quality-stable, and Difficulty-Aware GRPO (DA-GRPO) reweights task–attack subgroups so hard cases are not neglected. On in-domain tests the 3B model reaches 98.75% authenticity accuracy, 93.33% attack-type accuracy, and 96.30/94.73% AP@40/AP@50, and it outperforms compared systems on cross-domain authenticity and answer-and-rationale quality; the 7B version scales further.","feed_headline":"98.75% accuracy with explainable face-spoof detection","feed_subtitle":"A two-stage SFT+RL pipeline also names attack type, finds the spoof region, and transfers across domains.","key_machinery":"Key machinery: (1) FAS-R1-23K — a 22,996-sample dataset pairing authenticity labels, attack categories, manual spoof-region boxes, and long chain-of-thought rationales in an annotation-constrained <think>/<answer> format, generated by one vision model, verified by another, and rule/manual filtered; (2) FAS-specific GRPO — group-relative policy optimization whose rollout groups mix clean and synthetically degraded views of the same image (DSA) so spoof cues must be quality-stable, and whose advantages are rescaled by an EMA task–attack subgroup proficiency (DA-GRPO) so easy subgroups do not dominate. Rewards cover format, correctness, localization IoU, and rationale–answer consistency.","core_discovery":"The paper's central claim is that a multimodal LLM can match discriminative face-anti-spoofing accuracy while also naming the attack type, drawing the spoof region, and giving a rationale. The recipe: cold-start SFT on a 23K long-CoT dataset, then a GRPO stage with degraded-pair rollouts (DSA) and task–attack subgroup reweighting (DA-GRPO). Ablations show DA-GRPO is the largest lever, lifting coarse accuracy from 94.45% to 98.75% and cutting HTER to 1.17%; the 7B version improves further.","pith_inferences":["A direct testable extension is to apply DSA to other vision tasks where outputs must survive sensor-quality shifts (deepfake detection, medical imaging); the mechanism is not face-specific.","DA-GRPO's subgroup proficiency maps could be adapted to any multi-task generative model with known semantic classes; the paper leaves open the optimal grouping granularity and reweighting schedule.","Because FAS-R1-23K is constructed with commercial generative and verifying models, an open-source replication of the data pipeline would clarify how much of the gain is the dataset versus the algorithm.","If the rationale-quality judgments hold, a natural next experiment is a human user study measuring whether reviewers catch spoofs faster or more reliably with FAS-R1's rationales than with a label-only system; the paper does not run that study."],"forward_implications":["Security deployments can get a binary decision and an inspectable explanation from a single model, without the accuracy loss that has previously separated discriminative and explainable FAS.","DSA's paired clean/degraded rollouts improve all five reported metrics over plain GRPO, so quality-stable evidence is learnable from on-policy augmentation rather than from extra augmentation models.","DA-GRPO produces the biggest single accuracy gain (94.45% → 98.75% coarse ACC), indicating that easy-sample dominance, not capacity, was the main bottleneck on subtle attacks like makeup and mask.","The SFT+RL recipe transfers to larger backbones: 7B improves every in-domain metric and most cross-domain results, so the approach is scalable.","Cross-domain authenticity results are competitive with or better than compared methods, suggesting the reasoning supervision does not simply memorize training-domain artifacts."],"fun_headline_variants":["Explainable face-spoof AI names attack type and pinpoints region","Reasoning MLLM wins face-spoof accuracy with built-in rationale","98.75% spoof detection, plus attack type and region, via GRPO","FAS-R1: Multi-task MLLM that explains its face-spoof calls","DA-GRPO lifts face-spoof accuracy to 98.75% with full evidence"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The reported advantage over the two prior MLLM-based FAS methods rests on the authors' re-implementations of those baselines, because the original code and checkpoints are not public; if those re-implementations are undertuned or misaligned with the new training data, the performance gap could be overstated.","fun_headline_variants_meta":{"raw":{"variants":["Explainable face-spoof AI names attack type and pinpoints region","Reasoning MLLM wins face-spoof accuracy with built-in rationale","98.75% spoof detection, plus attack type and region, via GRPO","FAS-R1: Multi-task MLLM that explains its face-spoof calls","DA-GRPO lifts face-spoof accuracy to 98.75% with full evidence"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000191,"raw_usage":{"total_tokens":1206,"prompt_tokens":798,"completion_tokens":408,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":542,"completion_tokens_details":{"reasoning_tokens":317}},"tokens_in":542,"tokens_out":408,"duration_ms":5068,"temperature":1.0,"reasoning_tokens":317,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-01T15:55:11.080749+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the same training and evaluation protocol using the original released checkpoints of the two compared MLLM baselines (instead of the re-implementations), and check whether FAS-R1's accuracy, localization, and Elo-rationale gaps persist. A second check: ablate DA-GRPO on a held-out hard subgroup (e.g., makeup/mask attacks) and see whether the large coarse-ACC gain from 94.45% to 98.75% reproduces; if it does not, the difficulty-reweighting claim fails.","supporting_citations":[],"review_version":1}