Pith. sign in

REVIEW 3 major objections 6 minor 91 references

In-context Learning of Vision Language Models for Detection of Physical and Digital Attacks against Face Recognition Systems

T0 review · 3 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Open-source vision-language models under 8 billion parameters can detect physical and digital face attacks from a few prompt examples, with no training on biometric data, and in the paper's tests they halve the error of CLIP-based…

desk verdict First systematic quantitative look at sub-8B open VLMs for face PAD and S-MAD; the zero-shot PAD numbers are promising, but the training-free claim needs a contamination check before it holds. read the letter →

arxiv 2507.15285 v1 pith:V5ZC3HW3 submitted 2025-07-21 cs.CV

Lazaro Janier Gonzalez-Soler , Maciej Salwowski , Christoph Busch This is my paper
classification cs.CV
keywords visionlanguagemodelsin-contextlearningpresentationattackdetectionmorphingzero-shotfaceanti-spoofingbiometricsecurity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper sets out to show that small open-source vision-language models (VLMs) under 8 billion parameters can detect both physical attacks on face recognition (printed photos, video replays) and digital morphing attacks, using only in-context learning: a few example images placed in the prompt, with no gradient-based training on biometric data. Across four presentation-attack databases and two morphing databases, the best model, Qwen2-VL, reports a cross-database average half-total error rate of 28.53% for presentation attack detection, roughly half the 43.97% of the CLIP-based FoundPAD baseline, and a zero-shot D-EER of 29.11% for single-image morphing attack detection on uncropped FERET images. The paper also finds that detection generally degrades as more demonstration shots are added, and that morphing detection improves substantially when faces are shown uncropped with surrounding context. If these results hold, attack detection for face recognition could be deployed without collecting large labelled attack datasets, easing privacy and generalisation concerns that currently limit PAD and MAD systems.

What carries the argument

The load-bearing object is the in-context learning prompt: a demonstration set $C$ containing up to 9 reference images per category, each paired with a reference answer ("No, this is valid biometric input" for bona fide samples; "Yes, this is a [presentation attack/morphed image]" for attacks), followed by a binary text prompt asking the model to answer yes or no for an unknown query. The model's score for a video is computed as the fraction of frames classified as attack, $V_i = \#\text{BPs}/(\#\text{BPs}+\#\text{Attacks})$, which converts free-form VLM outputs into a calibrated score and suppresses hallucinated answers. The argument runs through Qwen2-VL, a 7-billion-parameter instruction-tuned VLM, which the paper identifies as the best of the three tested model families; it is evaluated in known-attack, unknown-attack, and cross-database protocols against the CLIP-based FoundPAD and MADation baselines.

What would settle it

Search the pretraining corpora of Qwen2-VL, Idefics3, and MiniCPM-V for near-duplicates of images from CASIA-FASD, REPLAY-ATTACK, OULU-NPU, MSU-FASD, FERET, and FRGCv2; if overlap appears, rerun the zero-shot protocols on attacks fabricated with tools released after the models' pretraining cutoffs and check whether the D-EER/HTER advantages over CLIP baselines persist.

Watch

Extended reading notes

Core claim

The central claim is that an in-context learning framework built on open-source VLMs delivers competitive or state-of-the-art detection of unknown physical and digital attacks without updating model weights. The framework constructs a demonstration set of up to nine reference images per category (bona fide samples plus each presentation attack instrument species or morphing tool), pairs each reference with a yes/no answer, and asks the VLM "Is this a presentation attack/morphed image?" for each test image; the final video-level score is the fraction of frames the model labels as attack, a scoring rule designed to suppress hallucinated answers. In the authors' experiments Qwen2-VL outperforms Idefics3 and MiniCPM-V, achieves an average HTER of 28.53% across CASIA-FASD, REPLAY-ATTACK, OULU-NPU and MSU-FASD in zero-shot cross-database PAD—about half the error of the FoundPAD CLIP baseline—and attains the lowest D-EER (29.11%) among benchmarked approaches for zero-shot S-MAD on uncropped FERET images. The paper further claims that performance trends downward as the number of demonstration shots grows, and that providing uncropped faces improves S-MAD substantially, cutting D-EER from roughly 44.57% to 34.18% on average.

Load-bearing premise

The results assume the test attack images were not already seen by the VLMs during pretraining, so the reported accuracies reflect generalisation to new attacks rather than memorisation of familiar photos.

Editorial extensions

If this is right

  • Face attack detection could be delivered as a frozen-model service: no training data, no gradient updates, and no per-deployment retraining, with performance still competitive with trained CNNs.
  • The sub-8-billion-parameter models run on local hardware, so biometric data never needs to leave the deployment site for the detector to be configured.
  • If fewer shots help rather than hurt, deployment can be nearly prompt-free: zero-shot or one-shot configurations are both cheaper and more accurate in the tested protocols.
  • Cross-database PAD error around 22% D-EER (except OULU-NPU above 40%) suggests the framework generalises to unseen environments and PAI species without domain adaptation.
  • S-MAD in practice should present full images rather than tightly cropped faces, since background context is what lets the VLM spot morphing artefacts.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper's own explanation for the S-MAD gains—pretraining exposure to landmark-based morphed images—implies the framework will struggle with morphs generated by newer tools not represented in pretraining; a direct test would be to benchmark against diffusion- or GAN-based morphing pipelines released after the model's training cutoff.
  • The observation that detection degrades with more shots suggests the mechanism here is closer to label priming than to analogical reasoning: demonstrations mostly tell the model which category label to emit, so a single good reference may be all that is needed.
  • Nothing in the framework is face-specific, so the same prompt-and-vote scheme could be transferred to other biometric modalities (iris, fingerprint, voice) or to other one-class security inspections where labelled attack data is scarce.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper proposes an in-context learning framework for zero- and few-shot presentation attack detection (PAD) and single morphing attack detection (S-MAD) using open-source vision-language models with fewer than 8 billion parameters. The framework constructs a demonstration prompt from up to 9 reference images per category, asks a binary yes/no question about the query image, and scores videos by frame votes and single images by repeated queries. The authors evaluate three VLM families on four PAD databases and two MAD databases under known-attack, unknown-PAI, and cross-database protocols, and benchmark against the CLIP-based FoundPAD and MADation approaches.

Significance. If the zero-shot results are genuine, the framework is practically valuable: it offers training-free generalization to unseen physical and digital attacks with lightweight open-source models, and the evaluation is conducted with standard ISO metrics on public databases. The zero-shot PAD benchmark against FoundPAD is a fixed protocol and shows a large improvement, which supports the central framework claim. The observation that uncropped facial context substantially improves S-MAD is interesting and falsifiable. However, the central generalization claim depends on the test images being out-of-distribution for the pretrained VLMs, and the paper does not demonstrate this; in addition, several headline numbers are selected maxima over demonstration compositions and shot counts, which weakens the strength of the stated comparison.

major comments (3)
  1. [Sec. V-D, Tables V–VI] The zero-shot generalization claim is load-bearing on Qwen2-VL not having memorized the evaluation databases, but the paper contains no contamination check. Because the VLM weights are frozen and no gradient updates are performed, any task knowledge in the zero-shot setting must come from pretraining; the paper itself attributes the uncropped S-MAD gain to the possibility that pretraining involved landmark-based morphed images. This is not a purely hypothetical concern: the models were selected from the Hugging Face leaderboard (Sec. IV-C), and the evaluation databases CASIA-FASD, REPLAY-ATTACK, OULU-NPU, MSU-FASD, FERET, and FRGCv2 are public and widely used in vision-language training corpora. Please add a concrete overlap analysis (for example, near-duplicate retrieval of test images against the known pretraining corpora of the selected models, or evaluation on a newly acquired holdout set) and, if overlap is found, re-state the claims with appropriate caveats.
  2. [Secs. V-A–V-C, Tables II–IV] Many reported numbers are selected maxima over demonstration compositions and shot counts: Table II shows the best performers per test PAI species, Sec. V-C states that the cross-database results show the best performing demonstration-test combinations, and Table IV selects a different number of shots for each row and condition. This selection bias makes the headline D-EER and HTER values optimistic and prevents assessing the robustness of the framework. Please report results for a fixed protocol (for example, all shot counts with mean and standard deviation over multiple demonstration subsets) or provide a supplementary table with every evaluated configuration, and state explicitly how the reported values were selected.
  3. [Sec. V-D, Table V] The comparison with FoundPAD may not be apples-to-apples because the scoring protocols differ: the proposed framework aggregates P=5 frames per video and K=5 repeated queries for single images, while the FoundPAD numbers are taken from the original paper without a description of their exact frame- or video-level protocol under the same splits. To support the claim that the framework 'significantly outperforms' FoundPAD by roughly half the HTER, please clarify whether the baseline numbers were recomputed under identical conditions, and if not, re-run both methods under the same code, preprocessing, and evaluation pipeline.
minor comments (6)
  1. [Abstract and Sec. V-D] The abstract says the framework outperforms 'some of the traditional CNNs', while Sec. V-D claims it 'significantly outperforms the state of the art by a wide margin'; the latter is too strong given that only two CLIP-based baselines are compared.
  2. [Sec. III-B, Eq. (1)] The vote-based score in Eq. (1) assumes binary Yes/No responses, but it is not described how non-binary or refusal responses are mapped to the #BPs and #Attacks counts; please specify the handling of such outputs.
  3. [Fig. 4] The caption 'Performance trends worsen with the number of shots' is a conclusion; the figure would be more informative if it showed per-model curves or error bars instead of only the average across models.
  4. [Table IV] For rows with Shots=0 the reference morphing-tool label is void, yet the same zero-shot values are repeated across reference rows; consider presenting zero-shot as a separate column or noting explicitly that the reference label is irrelevant when no demonstrations are used.
  5. [Sec. V-C] The text says 'Fig. 3 shows the Qwen2 response' but the cropped/uncropped example is in Fig. 6; please correct the cross-reference.
  6. [Sec. IV-C, Fig. 3] The claim that all selected models 'are able to understand the concepts of presentation and morphing attacks' is only weakly supported by Fig. 3; MiniCPM's answer about presentation attacks is generic and not specific to biometric systems.

Circularity Check

1 steps flagged · score 2.0 of 10

No constructional circularity: the zero-shot PAD benchmark is an external, parameter-free comparison; only the few-shot tables select shots on the test data, and the paper itself flags a pretraining-exposure caveat for S-MAD.

  1. fitted input called prediction [Sec. V-A (Tabs. II-III), Sec. V-C (Tab. IV), synthesis in Sec. VI]
    "we evaluate all PAI species combinations in the demonstration set selected from the CASIA-FASD training set and show the best performers per test PAI species (Sec. V-A); The best results per training-testing database combination and testing morphing tool are highlighted in bold (Tab. IV caption); Qwen2 reported ... using only a few samples during inference: D-EERs for PAD are in the range 10%-26% for unknown PAI species (Sec. VI)."

    The number of shots (0-9) and the demonstration composition are chosen per test PAI species/database by evaluating every configuration on the very test sets whose D-EER/BSCER values are then reported. The bolded best results in Tabs. II-IV are therefore, by construction, the minima of the searched shot/demonstration grid on those test sets, not the performance of a fixed configuration. The conclusions section then relabels these post-selection optima as framework properties (only a few samples yield D-EERs in the range 10%-26%), i.e., the fitted argmin is reported as a capability. This is partial: the zero-shot PAD benchmark (Tab. V, HTER 28.53%) uses no demonstrations and no shot selection, so the headline PAD comparison is not forced by this step.

full rationale

The paper contains no mathematical derivation chain that could be self-referential: the VLM weights are frozen, and the only inputs are a fixed yes/no prompt, up to nine demonstration images, and images from public databases, scored with ISO/IEC metrics against externally developed baselines (FoundPAD, MADation). The headline PAD result (average HTER 28.53%, Sec. V-D, Tab. V) is a zero-shot measurement with no demonstrations and no fitted parameters, so it cannot reduce to its inputs by construction; the S-MAD benchmark (Tab. VI) is reported as zero-shot, although its relationship to the best-of-shot configurations in Tab. IV is not documented, which is a missing-support concern rather than circularity. Self-citations sharing authors with this paper ([2], [8], [11], [12], [18]) appear only as related-work context and are not load-bearing; the comparison rests on independent external work (FoundPAD [4], MADation [3]) and public databases. Two non-independencies are weighed and keep the score at 2 rather than 0: (i) the few-shot tables select shots and demonstration compositions on the test data and report the best per test species/tool, a post-hoc selection bias that inflates those tables but does not affect the zero-shot PAD benchmark; and (ii) the paper itself attributes the uncropped S-MAD gains to pretraining exposure (possibly because their pretraining involved landmark-based morphed images, Sec. V-D), an unverified contamination risk for the generalization claim that is a validity threat, not constructional circularity. Neither step makes the framework's output equivalent to its inputs.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The paper introduces no invented entities. Its central claim rests on domain assumptions about VLM pretraining knowledge and data contamination, on the validity of a binary answer-frequency score, and on the appropriateness of the chosen benchmarks. It also depends on hand-selected constants: 5 frames per video, K=5 repeated queries for single-image scoring, and the number of shots N chosen per test setting from {0,1,3,5,7,9}.

free parameters (3)
  • Number of in-context shots (N) = 0 to 9, selected per database and test category as best from {0,1,3,5,7,9}
    The reported D-EER and HTER values depend on choosing N per row or per PAI species; the paper shows the best performers and selects best shots, so N is fitted to test performance rather than fixed a priori.
  • Repeated query count K for single-image scoring = 5
    K=5 is a hand-chosen constant in Vi = #BPs / (#BPs + #Attacks), used to reduce hallucinations; no sensitivity analysis is provided.
  • Frames sampled per video = 5
    Videos are subsampled to 5 evenly spaced frames before MTCNN detection; the frame count is a choice that affects video-level scores.
assumptions (4)
  • domain assumption The VLM has not seen the evaluation databases or equivalent attack imagery during pretraining.
    Zero-shot generalization is only meaningful if test images are out-of-distribution; no contamination check is performed. The authors attribute S-MAD gains to pretraining exposure to landmark-based morphed images (Sec. V-D).
  • domain assumption Binary yes/no answers can be aggregated into a reliable likelihood score.
    The framework defines Vi as the fraction of bona fide answers over frames or K=5 queries and treats it as a confidence score; this aggregation is asserted, not validated against logits or calibrated probabilities.
  • domain assumption Demonstration images from one public database transfer to another database for in-context learning.
    Cross-database experiments use FERET demonstrations for FRGCv2 tests and vice versa; demonstration selection details and subject overlap are not controlled.
  • domain assumption The chosen public datasets and ISO metrics measure the security-relevant deployment scenario.
    Results are tied to these benchmarks and to the cropped or uncropped input format; the cropped condition, which matches passport-style input, yields much worse S-MAD performance.

how reviews work

0 comments
Cite this review

Pith. "Pith review of In-context Learning of Vision Language Models for Detection of Physical and Digital Attacks against Face Recognition Systems." pith.science (2026). https://pith.science/paper/V5ZC3HW3

@misc{pith2026250715285,
  author       = {Pith},
  title        = {Pith review of: In-context Learning of Vision Language Models for Detection of Physical and Digital Attacks against Face Recognition Systems},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/V5ZC3HW3}},
  note         = {Machine review of arXiv:2507.15285}
}
read the original abstract

Recent advances in biometric systems have significantly improved the detection and prevention of fraudulent activities. However, as detection methods improve, attack techniques become increasingly sophisticated. Attacks on face recognition systems can be broadly divided into physical and digital approaches. Traditionally, deep learning models have been the primary defence against such attacks. While these models perform exceptionally well in scenarios for which they have been trained, they often struggle to adapt to different types of attacks or varying environmental conditions. These subsystems require substantial amounts of training data to achieve reliable performance, yet biometric data collection faces significant challenges, including privacy concerns and the logistical difficulties of capturing diverse attack scenarios under controlled conditions. This work investigates the application of Vision Language Models (VLM) and proposes an in-context learning framework for detecting physical presentation attacks and digital morphing attacks in biometric systems. Focusing on open-source models, the first systematic framework for the quantitative evaluation of VLMs in security-critical scenarios through in-context learning techniques is established. The experimental evaluation conducted on freely available databases demonstrates that the proposed subsystem achieves competitive performance for physical and digital attack detection, outperforming some of the traditional CNNs without resource-intensive training. The experimental results validate the proposed framework as a promising tool for improving generalisation in attack detection.

Figures

Figures reproduced from arXiv: 2507.15285 by the authors.

Figure 1
Figure 1. Conceptual in-context learning framework for physical (i.e., PAD) and digital (i.e., S-MAD) attack detection. [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Example of BP and PAIs in each database used in the experimental evaluation. [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Questions on the concepts of presentation (in red) and morphing (in blue) attacks, together with the respective answer [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Performance trends worsen with the number of shots. [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: Cross-database performance of Qwen2 plotted as DET curves for different shots. [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 6
Figure 6. Figure 6: Qwen2 response to a morphed image with one un [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

91 extracted references · 61 canonical work pages

  1. [1]

    Information Tech- nology - Biometric presentation attack detection - Part 3: Testing and Reporting, International Organization for Standardization, 2023

    ISO/IEC JTC1 SC37 Biometrics, ISO/IEC 30107-3. Information Tech- nology - Biometric presentation attack detection - Part 3: Testing and Reporting, International Organization for Standardization, 2023

    2023

  2. [2]

    On the generalisation capabilities of fisher vector-based face presentation attack detection,

    L. J. Gonz ´alez-Soler, M. Gomez-Barrero, and C. Busch, “On the generalisation capabilities of fisher vector-based face presentation attack detection,” IET Biometrics, vol. 10, no. 5, pp. 480–496, 2021

    2021

  3. [3]

    Madation: Face morphing attack detection with foundation models,

    E. Caldeira, G. Guray, T. Chettaoui, M. Ivanovska, P. Peer, F. Boutros, V . Struc, and N. Damer, “Madation: Face morphing attack detection with foundation models,” 2025. [Online]. Available: https://arxiv.org/abs/2501.03800

    arXiv 2025

  4. [4]

    FoundPAD: Foundation models reloaded for face presenta- tion attack detection,

    G. Ozgur, E. Caldeira, T. Chettaoui, F. Boutros, R. Raghavendra, and N. Damer, “FoundPAD: Foundation models reloaded for face presenta- tion attack detection,” arXiv preprint arXiv:2501.02892 , 2025

    arXiv 2025

  5. [5]

    Vision-language models for vision tasks: A survey,

    J. Zhang, J. Huang, S. Jin, and S. Lu, “Vision-language models for vision tasks: A survey,” 2024. [Online]. Available: https: //arxiv.org/abs/2304.00685

    arXiv 2024

  6. [6]

    Shield: An evaluation benchmark for face spoofing and forgery detection with multimodal large language models,

    Y . Shi, Y . Gao, Y . Lai, H. Wang, J. Feng, L. He, J. Wan, C. Chen, Z. Yu, and X. Cao, “Shield: An evaluation benchmark for face spoofing and forgery detection with multimodal large language models,” arXiv preprint, 2023

    2023

  7. [7]

    Exploring ChatGPT for Face Presentation Attack Detection in Zero and Few-Shot in-Context Learning

    A. Komaty, H. Otroshi, A. George, and S. Marcel, “Exploring ChatGPT for face presentation attack detection in zero and few-shot in-context learning,” 2025. [Online]. Available: https://arxiv.org/abs/2501.08799

    work page Pith review arXiv 2025

  8. [8]

    ChatGPT Encounters Morphing Attack Detection: Zero-Shot MAD with Multi-Modal Large Language Models and General Vision Models

    H. Zhang, R. Raghavendra, K. Raja, and C. Busch, “Chatgpt en- counters morphing attack detection: Zero-shot mad with multi-modal large language models and general vision models,” arXiv preprint arXiv:2503.10937, 2025

    work page Pith review arXiv 2025

Show all 91 references
  1. [9]

    Information Technology – Methodologies to evaluate the resistance of biometric recognition systems to morphing attacks , International Organization for Standardization, 2025

    ISO/IEC JTC1 SC37 Biometrics, ISO/IEC FDIS 20059. Information Technology – Methodologies to evaluate the resistance of biometric recognition systems to morphing attacks , International Organization for Standardization, 2025

    2025

  2. [10]

    Face spoofing detection based on multiple descriptor fusion using multiscale dynamic binarized statistical image features,

    S. R. Arashloo, J. Kittler, and W. Christmas, “Face spoofing detection based on multiple descriptor fusion using multiscale dynamic binarized statistical image features,” IEEE Trans. on Information Forensics and Security, vol. 10, no. 11, pp. 2396–2407, 2015

    2015

  3. [11]

    Fisher vector encoding of dense-bsif features for unknown face presentation attack detection,

    L. J. Gonz ´alez-Soler, M. Gomez-Barrero, and C. Busch, “Fisher vector encoding of dense-bsif features for unknown face presentation attack detection,” in Proc. Intl. Conf. of the Biometrics Special Interest Group (BIOSIG). IEEE, 2020, pp. 1–6

    2020

  4. [12]

    On the generalisation capabilities of fisher vector based face presentation attack detection,

    L. J. Gonzalez-Soler, M. Gomez-Barrero, and C. Busch, “On the generalisation capabilities of fisher vector based face presentation attack detection,” IET Biometrics, vol. 10, no. 5, pp. 480–496, September 2021

    2021

  5. [13]

    Fusion of multi-scale local phase quantization features for face presentation attack detection,

    R. Raghavendra, S. Venkatesh, K. Raja, P. Wasnik, M. Stokkenes, and C. Busch, “Fusion of multi-scale local phase quantization features for face presentation attack detection,” in Proc. Intl. Conf. on Information Fusion (FUSION), 2018, pp. 2107–2112

    2018

  6. [14]

    Patchswap: Boosting the generalizability of face presentation attack detection by identity-aware patch swapping,

    M. Fang, H. Ali, A. Kuijper, and N. Damer, “Patchswap: Boosting the generalizability of face presentation attack detection by identity-aware patch swapping,” in Proc. Intl. Joint Conference on Biometrics (IJCB) , 2022, pp. 1–10

    2022

  7. [15]

    Face presentation attack detection by exca- vating causal clues and adapting embedding statistics,

    M. Fang and N. Damer, “Face presentation attack detection by exca- vating causal clues and adapting embedding statistics,” in Proc. Winter Conf. on Applications of Computer Vision (WCACV) , 2024, pp. 6269– 6279

    2024

  8. [16]

    Deep pixel-wise binary supervision for face presentation attack detection,

    A. George and S. Marcel, “Deep pixel-wise binary supervision for face presentation attack detection,” in Proc. Intl. Conf. on Biometrics (ICB) . IEEE, 2019, pp. 1–8

    2019

  9. [17]

    On the effectiveness of vision transformers for zero-shot face anti-spoofing,

    ——, “On the effectiveness of vision transformers for zero-shot face anti-spoofing,” in Proc. Intl. Joint Conf. on Biometrics (IJCB) , 2021, pp. 1–8

    2021

  10. [18]

    Are foundation models all you need for zero-shot face presentation attack detection?

    C. B. L. J. Gonzalez-Soler, J. E. Tapia, “Are foundation models all you need for zero-shot face presentation attack detection?” in Proc. Intl. Conf. on Automatic Face and Gesture Recognition (FG) , May 2025

    2025

  11. [19]

    Learn convolutional neural network for face anti-spoofing,

    J. Yang, Z. Lei, and S. Li, “Learn convolutional neural network for face anti-spoofing,” arXiv preprint arXiv:1408.5601 , 2014

    2014 arXiv

  12. [20]

    Caffe: Convolutional architecture for fast feature embedding,

    Y . Jia, E. Shelhamer, J. Donahue, S. Karayev, J. Long, R. Girshick, S. Guadarrama, and T. Darrell, “Caffe: Convolutional architecture for fast feature embedding,” in Proc. Intl. Conf. on Multimedia , 2014, pp. 675–678

    2014

  13. [21]

    Deep face recognition,

    O. Parkhi, A. Vedaldi, and A. Zisserman, “Deep face recognition,” in Proc. British Machine Vision Conf. (BMVC) . British Machine Vision Association, 2015

    2015

  14. [22]

    Learning temporal features using LSTM- CNN architecture for face anti-spoofing,

    Z. Xu, S. Li, and W. Deng, “Learning temporal features using LSTM- CNN architecture for face anti-spoofing,” inProc. Asian Conf. on Pattern Recognition (ACPR), 2015, pp. 141–145

    2015

  15. [23]

    Mixnet for generalized face presentation attack detection,

    N. Sanghvi, S. Singh, A. Agarwal, M. Vatsa, and R. Singh, “Mixnet for generalized face presentation attack detection,” in Proc. Intl. Conf. on Pattern Recognition (ICPR), 2021, pp. 5511–5518

    2021

  16. [24]

    Learnable multi- level frequency decomposition and hierarchical attention mechanism for generalized face presentation attack detection,

    M. Fang, N. Damer, F. Kirchbuchner, and A. Kuijper, “Learnable multi- level frequency decomposition and hierarchical attention mechanism for generalized face presentation attack detection,” in Proc. Winter Conf. on Applications of Computer Vision (WCACV) , 2022, pp. 3722–3731

    2022

  17. [25]

    A dual-stream framework for 3d mask face presentation attack detection,

    S. Chen, T. Yao, K. Zhang, Y . Chen, K. Sun, S. Ding, J. Li, F. Huang, and R. Ji, “A dual-stream framework for 3d mask face presentation attack detection,” in Proc. Intl. Conference on Computer Vision , 2021, pp. 834–841

    2021

  18. [26]

    Contrastive context-aware learning for 3d high-fidelity mask face presentation attack detection,

    A. Liu, C. Zhao, Z. Yu, J. Wan, A. Su, X. Liu, Z. Tan, S. Escalera, J. Xing, Y . Liang et al. , “Contrastive context-aware learning for 3d high-fidelity mask face presentation attack detection,” IEEE Trans. on Information Forensics and Security (TIFS) , 2022

    2022

  19. [27]

    One-class knowledge distillation for face presentation attack detection,

    Z. Li, R. Cai, H. Li, K. Lam, Y . Hu, and A. Kot, “One-class knowledge distillation for face presentation attack detection,” IEEE Trans. on Information Forensics and Security (TIFS) , 2022

    2022

  20. [28]

    Learning how to recognize faces in heterogeneous environments,

    T. D. F. Pereira, “Learning how to recognize faces in heterogeneous environments,” EPFL, Tech. Rep., 2019

    2019

  21. [29]

    Unsupervised adversarial domain adaptation for cross-domain face presentation attack detection,

    G. Wang, H. Han, S. Shan, and X. Chen, “Unsupervised adversarial domain adaptation for cross-domain face presentation attack detection,” IEEE Trans. on Information Forensics and Security , vol. 16, pp. 56–69, 2020

    2020

  22. [30]

    Multi-domain incremental learning for face presentation attack detection,

    K. Wang, G. Zhang, H. Yue, A. Liu, G. Zhang, H. Feng, J. Han, E. Ding, and J. Wang, “Multi-domain incremental learning for face presentation attack detection,” in Proc. of the AAAI Conf. on Artificial Intelligence , vol. 38, no. 6, 2024, pp. 5499–5507

    2024

  23. [31]

    Person-specific face antispoofing with subject domain adaptation,

    J. Yang, Z. Lei, D. Yi, and S. Z. Li, “Person-specific face antispoofing with subject domain adaptation,” IEEE Trans. on Information Forensics and Security, vol. 10, no. 4, pp. 797–809, 2015

    2015

  24. [32]

    A face antispoofing database with diverse attacks,

    Z. Zhang, J. Yan, S. Liu, Z. Lei, D. Yi, and S. Li, “A face antispoofing database with diverse attacks,” in Proc. Intl. Conf. on Biometrics (ICB) , 2012, pp. 26–31

    2012

  25. [33]

    On the effectiveness of local binary patterns in face anti-spoofing,

    I. Chingovska, A. Anjos, and S. Marcel, “On the effectiveness of local binary patterns in face anti-spoofing,” in Proc. Intl. Conf. of Biometrics Special Interest Group (BIOSIG) , 2012, pp. 1–7

    2012

  26. [34]

    Oulu-npu: A mobile face presentation attack database with real-world variations,

    Z. Boulkenafet, J. Komulainen, L. Li, X. Feng, and A. Hadid, “Oulu-npu: A mobile face presentation attack database with real-world variations,” in Proc. Intl. Conf. on Automatic Face & Gesture Recognition (FG) , 2017, pp. 612–618

    2017

  27. [35]

    Face spoof detection with image distortion analysis,

    D. Wen, H. Han, and A. K. Jain, “Face spoof detection with image distortion analysis,” IEEE Trans. on Information Forensics and Security (TIFS), vol. 10, no. 4, pp. 746–761, 2015

    2015

  28. [36]

    The FERET database and evaluation procedure for face-recognition algorithms,

    P. J. Phillips, H. Wechsler, J. Huang, and P. J. Rauss, “The FERET database and evaluation procedure for face-recognition algorithms,” Image and Vision Computing , vol. 16, no. 5, pp. 295–306, 1998

    1998

  29. [37]

    Overview of the face recognition grand challenge,

    P. J. Phillips, P. J. Flynn, T. Scruggs, K. Bowyer et al. , “Overview of the face recognition grand challenge,” in IEEE Computer Society Conf. on Computer Vision and Pattern Recognition (CVPR) , vol. 1. IEEE, 2005, pp. 947–954

    2005

  30. [38]

    Face analysis technology evaluation (fate) part 4: Morph - performance of automated face morph detection,

    M. Ngan, P. Grother, K. Hanaoka, and J. Kuo, “Face analysis technology evaluation (fate) part 4: Morph - performance of automated face morph detection,” 2025

    2025

  31. [39]

    67-78, 2019, accessed: 2025-01-21

    European Union, “Regulation (eu) 2019/1157 of the european parliament and of the council of 20 june 2019 on strengthening the security of identity cards of union citizens and of residence documents issued to union citizens and their family members exercising their right of fre...

    2019

  32. [40]

    Morph deterction from single face image: A multi-algorithm fusion approach,

    U. Scherhag, C. Rathgeb, and C. Busch, “Morph deterction from single face image: A multi-algorithm fusion approach,” in Proc. Intl. Conf. on Biometric Engineering and Applications (ICBEA) , 2018, pp. 6–12. 12

    2018

  33. [41]

    Morphing attack detection-database, evaluation platform, and bench- marking,

    K. Raja, M. Ferrara, A. Franco, L. Spreeuwers, I. Batskos, F. D. Wit, M. Gomez-Barrero, U. Scherhag, D. Fischer, S. Venkatesh et al. , “Morphing attack detection-database, evaluation platform, and bench- marking,” IEEE Trans. on Information Forensics and Security (TIFS) , vol....

    2020

  34. [42]

    A principal component analysis-based approach for single morphing attack detection,

    L. Dargaud, M. Ibsen, J. Tapia, and C. Busch, “A principal component analysis-based approach for single morphing attack detection,” in Proc. Winter Conf. on Applications of Computer Vision (WCACV) , 2023, pp. 683–692

    2023

  35. [43]

    PRNU variance analysis for morphed face image detection,

    L. Debiasi, U. Scherhag, C. Rathgeb, A. Uhl, and C. Busch, “PRNU variance analysis for morphed face image detection,” in Proc. of 9th Intl. Conf. on Biometrics: Theory, Applications and Systems (BTAS 2018) , 2018

    2018

  36. [44]

    Detection of face morphing attacks based on PRNU analysis,

    U. Scherhag, L. Debiasi, C. Rathgeb, C. Busch, and A. Uhl, “Detection of face morphing attacks based on PRNU analysis,” Trans. on Biomet- rics, Behavior, and Identity Science (TBIOM) , 2019

    2019

  37. [45]

    Morphed face detection based on deep color residual noise,

    S. Venkatesh, R. Raghavendra, K. Raja, L. Spreeuwers, R. Veldhuis, and C. Busch, “Morphed face detection based on deep color residual noise,” in Proc. Intl. Conf. on Image Processing Theory, Tools and Applications (IPTA), 2019, pp. 1–6

    2019

  38. [46]

    Detecting morphed face attacks using residual noise from deep multi-scale context aggregation network,

    ——, “Detecting morphed face attacks using residual noise from deep multi-scale context aggregation network,” in Proc. Winter Conf. on Applications of Computer Vision (WCACV) , 2020, pp. 280–289

    2020

  39. [47]

    Generalized single- image-based morphing attack detection using deep representations from vision transformer,

    H. Zhang, R. Raghavendra, K. Raja, and C. Busch, “Generalized single- image-based morphing attack detection using deep representations from vision transformer,” in Proc. Intl. Conf. on Computer Vision and Pattern Recognition (CVPR), 2024, pp. 1510–1518

    2024

  40. [48]

    Single-morphing attack detection using few-shot learning and triplet-loss,

    J. Tapia, D. Schulz, and C. Busch, “Single-morphing attack detection using few-shot learning and triplet-loss,” Neurocomputing, p. 130033, 2025

    2025

  41. [49]

    Detection of face morphing attacks by deep learning,

    C. Seibold, W. Samek, A. Hilsmann, and P. Eisert, “Detection of face morphing attacks by deep learning,” in Proc. Intl. Workshop on Digital Forensics and Watermarking, 2017, pp. 107–120

    2017

  42. [50]

    Face morphing attack generation and detection: A comprehensive survey,

    S. Venkatesh, R. Raghavendra, K. Raja, and C. Busch, “Face morphing attack generation and detection: A comprehensive survey,” IEEE Trans. on Technology and Society (TTS) , vol. 2, no. 3, pp. 128–145, 2021

    2021

  43. [51]

    Towards making morphing attack detection robust using hybrid scale-space colour texture features,

    R. Raghavendra, S. Venkatesh, K. Raja, and C. Busch, “Towards making morphing attack detection robust using hybrid scale-space colour texture features,” in Proc. Intl. Conf. on Identity, Security, and Behavior Analysis (ISBA), 2019, pp. 1–8

    2019

  44. [52]

    Robust morph- detection at automated border control gate using deep decomposed 3D shape & diffuse reflectance,

    J. Singh, K. Raja, R. Raghavendra, and C. Busch, “Robust morph- detection at automated border control gate using deep decomposed 3D shape & diffuse reflectance,” in Proc. of the 15th Intl. Conf. on Signal Image Technology & Internet Based Systems (SITIS) , November 2019

    2019

  45. [53]

    Detecting morphed face images using facial landmarks,

    U. Scherhag, D. Budhrani, M. Gomez-Barrero, and C. Busch, “Detecting morphed face images using facial landmarks,” in Intl. Conf. on Image and Signal Processing (ICISP) , 2018

    2018

  46. [54]

    Detecting face morphing attacks by analyzing the directed distances of facial landmarks shifts,

    N. Damer, V . Boller, Y . Wainakh, F. Boutros, P. Terh¨orst, A. Braun, and A. Kuijper, “Detecting face morphing attacks by analyzing the directed distances of facial landmarks shifts,” in Pattern Recognition, T. Brox, A. Bruhn, and M. Fritz, Eds., Cham, Switzerland, 2019, pp. 518–534

    2019

  47. [55]

    Multispectral imaging for differential face morphing attack detection: A preliminary study,

    R. Raghavendra, S. Venkatesh, N. Damer, N. Vetrekar, and R. Gad, “Multispectral imaging for differential face morphing attack detection: A preliminary study,” inProc. Winter Conf. on Applications of Computer Vision (WCACV), 2024, pp. 6185–6193

    2024

  48. [56]

    A multi-detector solution towards an accurate and generalized detection of face morphing attacks,

    N. Damer, S. Zienert, Y . Wainakh, A. Mosegu´ı-Saladi´e, F. Kirchbuchner, and A. Kuijper, “A multi-detector solution towards an accurate and generalized detection of face morphing attacks,” in Proc. Intl. Conf. Information Fusion (FUSION) , 2019, pp. 1–8

    2019

  49. [57]

    Deep face repre- sentations for differential morphing attack detection,

    U. Scherhag, C. Rathgeb, J. Merkle, and C. Busch, “Deep face repre- sentations for differential morphing attack detection,” IEEE Trans. on Information Forensics and Security , 2020

    2020

  50. [58]

    Differential anomaly detection for facial im- ages,

    M. Ibsen, L. J. Gonzalez-Soler, C. Rathgeb, P. Drozdowski, M. Gomez- Barrero, and C. Busch, “Differential anomaly detection for facial im- ages,” in IEEE Intl. Workshop on Information Forensics and Security (WIFS), 2021, pp. 1–6

    2021

  51. [59]

    Face analysis technology evaluation (fate) part 4: Morph - performance of automated face morph detection,

    M. Ngan, P. Grother, K. Hanaoka, and J. Kuo, “Face analysis technology evaluation (fate) part 4: Morph - performance of automated face morph detection,” National Institute of Standards and Technology (NIST), Gaithersburg, MD, USA, Tech. Rep., 2025

    2025

  52. [60]

    Generating automatically print/scan textures for morphing attack detection applications,

    J. Tapia, M. Russo, and C. Busch, “Generating automatically print/scan textures for morphing attack detection applications,” IEEE Access, 2025

    2025

  53. [61]

    Face demorphing,

    M. Ferrara, A. Franco, and D. Maltoni, “Face demorphing,” IEEE Trans. on Information Forensics and Security (TIFS) , vol. 13, no. 4, pp. 1008– 1017, 2018

    2018

  54. [62]

    Fd-gan: Face de-morphing generative adversarial network for restoring accomplice’s facial image,

    F. Peng, L. Zhang, and M. Long, “Fd-gan: Face de-morphing generative adversarial network for restoring accomplice’s facial image,” IEEE Access, vol. 7, pp. 75 122–75 131, 2019

    2019

  55. [63]

    Border control morphing attack detection with a convolutional neural network de-morphing approach,

    D. Ortega-Delcampo, C. Conde, D. Palacios-Alonso, and E. Cabello, “Border control morphing attack detection with a convolutional neural network de-morphing approach,” IEEE Access , vol. 8, pp. 92 301– 92 313, 2020

    2020

  56. [64]

    Foundation models and biometrics: A survey and outlook,

    H. Otroshi-Shahreza and S. Marcel, “Foundation models and biometrics: A survey and outlook,” Authorea Preprints, 2025

    2025

  57. [65]

    ChatGPT and biometrics: an assessment of face recognition, gender detection, and age estimation capabilities,

    A. Hassanpour, Y . Kowsari, H. O. Shahreza, B. Yang, and S. Marcel, “ChatGPT and biometrics: an assessment of face recognition, gender detection, and age estimation capabilities,” in Proc. Intl. Conf. on Image Processing (ICIP), 2024, pp. 3224–3229

    2024

  58. [66]

    How good is ChatGPT at face biometrics? a first look into recognition, soft biometrics, and explainability,

    I. Deandres-Tame, R. Tolosana, R. Vera-Rodriguez, A. Morales, J. Fier- rez, and J. Ortega-Garcia, “How good is ChatGPT at face biometrics? a first look into recognition, soft biometrics, and explainability,” IEEE Access, 2024

    2024

  59. [67]

    ChatGPT meets iris biometrics,

    P. Farmanifard and A. Ross, “ChatGPT meets iris biometrics,” in Proc. Intl. Joint Conf. on Biometrics (IJCB) , 2024, pp. 1–10

    2024

  60. [68]

    Aligning actions and walking to llm-generated textual descriptions,

    R. Chivereanu, A. Cosma, A. Catruna, R. Rughinis, and E. Radoi, “Aligning actions and walking to llm-generated textual descriptions,” in Proc. Intl. Conf. on Automatic Face and Gesture Recognition (FG) , 2024, pp. 1–7

    2024

  61. [69]

    Language models are few-shot learners,

    B. Mann, N. Ryder, M. Subbiah, J. Kaplan, P. Dhariwal, A. Neelakantan, P. Shyam, G. Sastry, A. Askell, S. Agarwal et al. , “Language models are few-shot learners,” arXiv preprint arXiv:2005.14165 , vol. 1, p. 3, 2020

    2005 arXiv

  62. [70]

    Facexbench: Evaluating multimodal llms on face understanding,

    K. Narayan, V . VS, and V . Patel, “Facexbench: Evaluating multimodal llms on face understanding,” arXiv preprint arXiv:2501.10360 , 2025

    2025

  63. [71]

    Llama: Open and efficient foundation language models,

    H. Touvron, T. Lavril, G. Izacard, X. Martinet, M. Lachaux, T. Lacroix, B. Rozi `ere, N. Goyal, E. Hambro, F. Azhar et al. , “Llama: Open and efficient foundation language models,” arXiv preprint arXiv:2302.13971, 2023

    2023 arXiv

  64. [72]

    Palm: Scaling language modeling with pathways,

    A. Chowdhery, S. Narang, J. Devlin, M. Bosma, G. Mishra, A. Roberts, P. Barham, H. Chung, C. Sutton, S. Gehrmann et al. , “Palm: Scaling language modeling with pathways,” Journal of Machine Learning Re- search, vol. 24, no. 240, pp. 1–113, 2023

    2023

  65. [73]

    Chain-of-thought prompting elicits reasoning in large language models,

    J. Wei, X. Wang, D. Schuurmans, M. Bosma, F. Xia, E. Chi, Q. Le, D. Zhou et al. , “Chain-of-thought prompting elicits reasoning in large language models,” Advances in neural information processing systems (NeurIPS), vol. 35, pp. 24 824–24 837, 2022

    2022

  66. [74]

    A survey on in-context learning,

    Q. Dong, L. Li, D. Dai, C. Zheng, J. Ma, R. Li, H. Xia, J. Xu, Z. Wu, T. Liu et al., “A survey on in-context learning,” arXiv preprint arXiv:2301.00234, 2022

    2022 arXiv

  67. [75]

    Joint face detection and alignment using multitask cascaded convolutional networks,

    K. Zhang, Z. Zhang, Z. Li, and Y . Qiao, “Joint face detection and alignment using multitask cascaded convolutional networks,” IEEE signal processing letters , vol. 23, no. 10, pp. 1499–1503, 2016

    2016

  68. [76]

    Privacy-friendly synthetic data for the development of face morphing attack detectors,

    N. Damer, C. L ´opez, M. Fang, N. Spiller, M. Pham, and F. Boutros, “Privacy-friendly synthetic data for the development of face morphing attack detectors,” in Proc. Intl. Conf. on Computer Vision and Pattern Recognition (CVPR), 2022, pp. 1606–1617

    2022

  69. [77]

    Hugging face,

    S. Jain, “Hugging face,” in Introduction to transformers for NLP: With the hugging face library and models to solve problems . Springer, 2022, pp. 51–67

    2022

  70. [78]

    PyTorch: An Imperative Style, High- Performance Deep Learning Library,

    A. Paszke, S. Gross, F. Massa, A. Lerer, J. Bradbury, G. Chanan, T. Killeen, Z. Lin, N. Gimelshein, L. Antiga, A. Desmaison, A. Kopf, E. Yang, Z. DeVito, M. Raison, A. Tejani, S. Chilamkurthy, B. Steiner, L. Fang, J. Bai, and S. Chintala, “PyTorch: An Imperative Style, High- P...

    2019

  71. [79]

    Vlmevalkit: An open-source toolkit for evaluating large multi-modality models, 2024,

    H. Duan, J. Yang, Y . Qiao, X. Fang, L. Chen, Y . Liu, X. Dong, Y . Zang, P. Zhang, J. Wang et al., “Vlmevalkit: An open-source toolkit for evaluating large multi-modality models, 2024,” URL https://arxiv. org/abs/2407.11691

    2024 arXiv

  72. [80]

    Ovis: Structural embedding alignment for multimodal large language model,

    S. Lu, Y . Li, Q. Chen, Z. Xu, W. Luo, K. Zhang, and H. Ye, “Ovis: Structural embedding alignment for multimodal large language model,” arXiv:2405.20797, 2024

    2024 arXiv

  73. [81]

    Mini-internvl: A flexible-transfer pocket multimodal model with 5% parameters and 90% performance,

    Z. Gao, Z. Chen, E. Cui, Y . Ren, W. Wang, J. Zhu, H. Tian, S. Ye, J. He, X. Zhu et al. , “Mini-internvl: A flexible-transfer pocket multimodal model with 5% parameters and 90% performance,” arXiv preprint arXiv:2410.16261, 2024

    arXiv

  74. [82]

    Qwen2-vl: Enhancing vision-language model’s perception of the world at any resolution,

    P. Wang, S. Bai, S. Tan, S. Wang, Z. Fan, J. Bai, K. Chen, X. Liu, J. Wang, W. Ge, Y . Fan, K. Dang, M. Du, X. Ren, R. Men, D. Liu, C. Zhou, J. Zhou, and J. Lin, “Qwen2-vl: Enhancing vision-language model’s perception of the world at any resolution,” arXiv preprint arXiv:2409....

    2024 arXiv

  75. [83]

    Qwen-vl: A versatile vision-language model for un- derstanding, localization, text reading, and beyond,

    J. Bai, S. Bai, S. Yang, S. Wang, S. Tan, P. Wang, J. Lin, C. Zhou, and J. Zhou, “Qwen-vl: A versatile vision-language model for un- derstanding, localization, text reading, and beyond,” arXiv preprint arXiv:2308.12966, 2023

    2023 arXiv

  76. [84]

    Mme: A comprehensive evaluation benchmark for multimodal large language models,

    C. Fu, P. Chen, Y . Shen, Y . Qin, M. Zhang, X. Lin, J. Yang, X. Zheng, K. Li, X. Sun, Y . Wu, and R. Ji, “Mme: A comprehensive evaluation benchmark for multimodal large language models,” 2024. [Online]. Available: https://arxiv.org/abs/2306.13394

    2024 arXiv

  77. [85]

    Ocrbench: on the hidden mystery of ocr in large multimodal models,

    Y . Liu, Z. Li, M. Huang, B. Yang, W. Yu, C. Li, X. Yin, C. Liu, L. Jin, and X. Bai, “Ocrbench: on the hidden mystery of ocr in large multimodal models,” Science China Information Sciences , vol. 67, no. 12, 2024. [Online]. Available: http://dx.doi.org/10.1007/s11432-024-4235-6

    2024 doi

  78. [86]

    Are we on the right way for evaluating large vision-language models?

    L. Chen, J. Li, X. Dong, P. Zhang, Y . Zang, Z. Chen, H. Duan, J. Wang, Y . Qiao, D. Lin, and F. Zhao, “Are we on the right way for evaluating large vision-language models?” 2024. [Online]. Available: https://arxiv.org/abs/2403.20330

    2024 arXiv

  79. [87]

    Qwen2-vl-7b-instruct: Vision-language model,

    Q. Team, “Qwen2-vl-7b-instruct: Vision-language model,” https:// huggingface.co/Qwen/Qwen2-VL-7B-Instruct, accessed: February 16, 2025

    2025

  80. [88]

    Minicpm-v: A gpt-4v level mllm on your phone,

    Y . Yao, T. Yu, A. Zhang, C. Wang, J. Cui, H. Zhu, T. Cai, H. Li, W. Zhao, Z. He et al., “Minicpm-v: A gpt-4v level mllm on your phone,” arXiv preprint arXiv:2408.01800, 2024

    2024 arXiv

  81. [89]

    MiniCPM-v 2.6: A gpt-4v level multimodal large language model,

    OpenBMB, “MiniCPM-v 2.6: A gpt-4v level multimodal large language model,” 2024, hugging Face model repository. [Online]. Available: https://huggingface.co/openbmb/MiniCPM-V-2 6

    2024

  82. [90]

    Mimicking or reasoning: Rethinking multi-modal in-context learning in vision-language models,

    C. Huang, Y . Zhu, S. Zhu, J. Xiao, M. Andrade, S. Chopra, and Z. Kira, “Mimicking or reasoning: Rethinking multi-modal in-context learning in vision-language models,” arXiv preprint arXiv:2506.07936 , 2025

    2025 arXiv

  83. [91]

    Learning transferable visual models from natural language supervision,

    A. Radford, J. Kim, C. Hallacy, A. Ramesh, G. Goh, S. Agarwal, G. Sastry, A. Askell, P. Mishkin, J. Clark et al., “Learning transferable visual models from natural language supervision,” in Proc. Intl. Conf. on Machine Learning (ICML) , 2021, pp. 8748–8763

    2021

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.