Pith. sign in

REVIEW 2 major objections 4 minor 82 references

LoRA-based Adaptation Alone Is Not Enough: Understanding the Limits of Foundation Models for Face Presentation Attack Detection

T0 review · 2 major / 4 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Low-rank adaptation alone leaves cross-dataset face spoof detection errors between 20% and 43% across all 32 tested foundation models.

desk verdict A genuinely broad and useful benchmark for face PAD, but the headline conclusion about LoRA generalizes further than the single fixed recipe actually supports. read the letter →

arxiv 2608.09633 v2 pith:SQ44XG54 submitted 2026-08-10 cs.CV cs.LG

Peter Lorenz , Anjith George , Marcel Sébastien This is my paper · ORCID
classification cs.CVcs.LG
keywords facepresentationattackdetectionlow-rankadaptationLoRAfoundationmodelscross-datasetgeneralizationzero-shotpromptingvisionencodersaverageclassificationerrorrate
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Face presentation attack detection (PAD) works well when the test camera matches the training data, but error rises sharply when the sensor or lighting changes. This paper asks whether low-rank adaptation (LoRA) of large pretrained vision encoders, updating fewer than 1% of the weights, is enough to close that cross-dataset gap. The authors evaluate 32 vision backbones and nine vision-language models on four standard PAD datasets under one identical protocol. LoRA brings most backbones below 2% intra-dataset average classification error, yet every model lands between roughly 20% and 43% cross-dataset error, and embeddings remain organized by source dataset rather than by spoof label. The paper concludes that lightweight adaptation alone does not overcome dataset bias; the backbone and the training dataset dominate cross-dataset transfer.

What carries the argument

The load-bearing mechanism is a fixed low-rank adaptation recipe applied across a deliberately diverse set of pretrained encoders. LoRA reparameterizes each frozen projection as $W' = W_0 + (\alpha/r)BA$ with rank $r=8$, scaling $\alpha=16$, dropout $0.05$, and $B$ initialized to zero, attached only to the query and value projections of every attention block. This same recipe is applied to 32 backbones spanning contrastive image-text, self-distillation, masked-image modeling, and multimodal-language pretraining, and each is scored by ACER on the same four datasets under a single-source protocol. The proposed generalization score $G = \sqrt{(C-\mathrm{ACER}_{\mathrm{ID}})^+(C-\mathrm{ACER}_{\mathrm{CD}})^+}/C$ with $C=50$ summarizes joint intra- and cross-dataset skill, but the empirical core is the $4\times4$ transfer matrix and its means over intra-dataset, cross-dataset, and all sixteen pairs.

What would settle it

Repeat the same four-dataset, single-source protocol with LoRA variants of higher rank (e.g., 32), adapters on MLP or convolutional layers, per-backbone learning rates, and an early-stopping criterion, and record mean cross-dataset ACER and the source-dataset separability of the adapted embeddings. A configuration that clearly beats the 20-43% range, or that makes adapted features no longer separable by acquisition domain, would falsify the paper's general conclusion that LoRA alone cannot resolve cross-dataset transfer.

Watch

Extended reading notes

Core claim

Under the single-source protocol on MSU-MFSD, CASIA-FASD, Replay-Attack, and OULU-NPU, the paper adapts 32 frozen vision encoders with the same LoRA recipe (rank 8, alpha 16, dropout 0.05, adapters on query and value projections, fewer than 1% trainable weights) plus a linear head. Most adapted backbones fall below 2% intra-dataset ACER, while cross-dataset ACER across the twelve transfer pairs lies between 19.8% and 42.6%; the best models are LLaVA-NeXT-7B-ViT at 19.8%, DINOv2-R-giant at 20.4%, and CLIP ViT-B/32 at 21.8%. The central discovery is that LoRA's gain is dataset-conditional: it sharpens the decision boundary within the training acquisition pipeline but leaves the feature geometry structured by acquisition domain rather than by attack class, so thresholds calibrated in one domain do not transfer. The paper states the primary limitation shifts from representation quality to the choice of backbone and the training dataset for the deployment domain.

Load-bearing premise

The load-bearing premise is that the single fixed LoRA configuration used for all 32 backbones, rank 8, alpha 16, dropout 0.05, adapters only on query/value projections, and learning rate 1e-4, represents low-rank adaptation generally; if another low-rank recipe, adapter placement, or per-backbone tuning substantially closes the 20-43% cross-dataset gap, the paper's conclusion would be overstated.

Editorial extensions

If this is right

  • A practitioner can expect cross-dataset ACER between about 20% and 43% for any of these backbones under this LoRA recipe, so a deployment on a new sensor should not rely on lightweight adaptation alone.
  • Intra-dataset accuracy below 2% should be read as an upper bound under matched conditions, not as expected operational accuracy under domain shift.
  • Pretraining objective and curation outweigh scale: ImageNet-only backbones sit in the bottom third on the all-pairs aggregate, while web-scale contrastive and self-distillation encoders lead.
  • The training dataset choice is a dominant factor: CLIP ViT-B/32 adapted on Replay-Attack averages about 10% cross-dataset ACER, whereas the same backbone adapted on MSU-MFSD averages about 33%.
  • Zero-shot prompting of nine VLMs stays near chance (average ACER 35-50%), so semantic language alignment does not substitute for task-aligned adaptation of the vision tower.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper, a direct test of its scope is to vary the LoRA recipe itself: higher rank, adapters on MLP or convolutional layers, or per-backbone learning rates could push cross-dataset ACER clearly below the 20-43% band, which would narrow the conclusion to 'this LoRA recipe is not enough.'
  • The embedding analysis suggests a quantitative diagnostic the authors do not run: train a classifier to predict the source dataset from adapted features; a configuration that lowers domain-separability accuracy while keeping intra-dataset ACER low would be a promising next candidate for cross-dataset PAD.
  • The pattern that transfer tracks proximity to the original contrastive initialization in VLM towers implies that later multimodal co-training may erode transferable spatial structure, which could motivate freezing earlier contrastive layers during multimodal instruction tuning.
  • If the result generalizes beyond the MCIO benchmark, the bottleneck may be the single-source training protocol itself, making multi-source or synthetic-data training necessary for robust PAD rather than optional.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 4 minor

Summary. This paper asks whether parameter-efficient low-rank adaptation of foundation-model vision encoders is sufficient for cross-dataset face presentation attack detection. On the four MCIO datasets, the authors train a single linear head and LoRA adapters (r=8, alpha=16, dropout 0.05, query/value projections only) on 32 vision encoders and also prompt nine VLMs zero-shot. Under a single-source protocol they report intra-dataset ACER mostly below 2%, cross-dataset mean ACER between 19.8% and 42.6%, and a new G score that geometrically combines intra- and cross-dataset skill. They find that zero-shot prompting is near chance, that pretraining objective and training-dataset choice matter more than scale, and that adapted embeddings remain organized by acquisition domain, leading to the conclusion that LoRA adaptation alone does not close the cross-dataset gap.

Significance. The main negative result—that none of the 32 LoRA-adapted encoders escapes the 20–43% mean cross-dataset ACER band under a fixed protocol—is directly supported by Table 4 and is a useful contribution to the PAD literature, which has mostly focused on CLIP-based models. The breadth of backbones (contrastive, self-distillation, masked image modeling, VLM towers), the unified protocol, the public project page, and the geometric G score are strengths. The paper also supports a practically relevant observation that contrastive and DINO-family encoders transfer better than masked-image-modeling encoders. The primary significance is limited, however, by the fact that the negative conclusion is tied to a single LoRA configuration and a single zero-shot prompt; until robustness to these choices is demonstrated, the headline claim is a statement about this benchmark protocol rather than about low-rank adaptation in general.

major comments (2)
  1. [Sec. 3.1 and Sec. 4.6] Section 3.1 fixes rank r=8, scaling alpha=16, dropout 0.05, adapters on W_Q and W_V only, learning rate 1e-4, batch size 32, and early stopping, and Section 4.6 then generalizes from this single configuration to “lightweight adaptation does not resolve cross-dataset transfer” and the title claim. A rank/placement/learning-rate ablation on at least a few representative backbones (e.g., CLIP ViT-B/32, DINOv2-R-giant, and LLaVA-NeXT-7B-ViT) is needed to distinguish an inherent limit of low-rank adaptation from a property of this particular recipe; without it, the conclusion should be explicitly restricted to the tested configuration. The Sec. 5 limitation narrows the claim to LoRA among PEFT methods, but it does not address within-LoRA variation, so the present wording overstates the evidence.
  2. [Sec. 4.3 and Table 2] Table 2 and Sec. 4.3 report near-chance zero-shot performance using a single hand-written prompt and NF4-quantized weights with bf16/fp16 matmuls. Because the abstract and Sec. 4.3 state the result as a model-family-level negative finding, the protocol should include at least one alternative prompt and a full-precision or less aggressive quantization check; otherwise the near-chance outcome could reflect prompt sensitivity or quantization rather than the visual representations themselves. The Sec. 5 limitation mentions prompt sensitivity, but only after the broader claim has already been made.
minor comments (4)
  1. [Sec. 4.6 and Table 4] The sentence “cross-dataset ACER remains between 20% and 43%” refers to mean CD ACER averaged over twelve transfer pairs; the paper should state this explicitly and ideally include the per-pair 4x4 transfer matrices, since individual transfer directions can be much worse than the mean and are the quantities most relevant to deployment.
  2. [Sec. 4.7 and Fig. 3] The claim that web-scale pretraining coverage is “necessary” for cross-dataset transfer is a correlational observation across models whose pretraining scale is confounded with architecture family and pretraining objective; it should be phrased as a hypothesis supported by the benchmark rather than as a causal necessity.
  3. [Eq. (3)] The generalization score G is called “bias free,” but no statistical bias is defined or demonstrated; I suggest either providing a formal justification for the name or renaming it to “generalization score” to avoid overclaiming.
  4. [Sec. 3.3 and Table 4] The specialist baselines (DeepPixBiS, FSFM-FAS, FLIP) are fully fine-tuned on the same datasets but not on the same backbones; a sentence acknowledging that these are reference points rather than controlled LoRA-versus-full-fine-tuning comparisons would clarify the interpretation.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: all central claims are measured ACER values under a fixed protocol; the G score is an explicit definition, not a fitted quantity, and no load-bearing step reduces to its inputs.

full rationale

This is an empirical benchmark paper. The central claims — zero-shot prompting is near chance, LoRA adaptation gives low intra-dataset ACER and 20–43% cross-dataset ACER across 32 encoders — are direct measurements reported in Tables 2, 3, and 4 under a fixed protocol. The proposed generalization score G (Eq. 3) is a definition that re-expresses the already reported ID and CD ACER values as a geometric mean relative to the 50% chance level; it is not fitted to any outcome and is not used to derive any of the measured results. No load-bearing equation reduces to a fitted parameter: the LoRA rank, alpha, dropout, adapter placement, learning rate, and batch size are fixed a priori in Sec. 3.1 and are not selected to force the cross-dataset band. The paper's own Limitation section explicitly acknowledges that lightweight adaptation is restricted to LoRA and that zero-shot uses a single prompt; this is a scope limitation, not a circular move. The few self-citations (DeepPixBiS as a baseline, the Bob toolkit for metrics) are not load-bearing for the central conclusion: DeepPixBiS is an external reference point, not evidence that LoRA fails, and no uniqueness claim or prior-work-derived ansatz is used to justify the LoRA configuration. The cross-dataset conclusion is therefore an honest empirical finding rather than a result equivalent to its inputs by construction.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

No new physical or conceptual entities are postulated. The proposed G score is a summary statistic, not an invented entity, and it provides no falsifiable handle beyond its definition. The main free parameters are the hand-chosen LoRA recipe and the zero-shot prompt, both of which condition the conclusions. The axiomatic burden is the standard domain assumption that the MCIO single-source protocol and EER thresholding capture the relevant PAD generalization problem.

free parameters (2)
  • LoRA hyperparameter configuration = r=8, alpha=16, dropout=0.05, lr=1e-4, batch size 32, Q and V projections only
    These values are fixed by hand for all 32 backbones. The central conclusion that LoRA adaptation alone is insufficient is conditioned on this particular recipe; alternate ranks, adapter placements, or per-backbone tuning are not explored and could change the result.
  • Zero-shot VLM prompt and precision = Single fixed authenticity-score prompt with NF4 quantization
    The zero-shot evaluation uses one hand-written prompt and 4-bit NF4 weights for all nine VLMs. The near-chance zero-shot result is therefore conditioned on these choices; no full-precision or prompt-variation baseline is reported.
assumptions (4)
  • domain assumption Cross-dataset ACER on the MCIO single-source protocol measures the robustness of interest for face PAD.
    The paper's conclusion about LoRA insufficiency is drawn from four MCIO datasets covering print and replay attacks only; deepfakes and multi-source protocols are excluded (Sec. 4.1 and the Limitation section).
  • domain assumption The EER criterion on the development split is an appropriate threshold rule for computing ACER.
    This is the standard in ISO/IEC 30107-3 evaluations, cited in Sec. 4.2. If a different thresholding rule were used, the reported ACER values and rankings could shift.
  • domain assumption t-SNE projections of the adapted embeddings faithfully reveal whether representations are organized by dataset or by spoof label.
    Used in Sec. 4.8 and Fig. 4 to support the claim that LoRA only refines intra-dataset boundaries. t-SNE is a non-linear stochastic embedding, and the conclusion drawn from it is qualitative.
  • domain assumption Pretraining corpus sizes as reported by each model's publication are comparable across families.
    The data-scale analysis in Sec. 4.7 and Fig. 3 relies on reported corpus sizes such as WIT-400M, LAION-2B, and WebLI being measured on a comparable basis, despite different curation and filtering pipelines.

how reviews work

0 comments
Cite this review

Pith. "Pith review of LoRA-based Adaptation Alone Is Not Enough: Understanding the Limits of Foundation Models for Face Presentation Attack Detection." pith.science (2026). https://pith.science/paper/SQ44XG54

@misc{pith2026260809633,
  author       = {Pith},
  title        = {Pith review of: LoRA-based Adaptation Alone Is Not Enough: Understanding the Limits of Foundation Models for Face Presentation Attack Detection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/SQ44XG54}},
  note         = {Machine review of arXiv:2608.09633}
}
read the original abstract

Face presentation attack detection (PAD) aims to reliably detect a wide range of presentation attacks. While PAD methods achieve strong performance within individual datasets, their performance degrades under cross-dataset evaluation. Variations in sensors or lighting conditions can reduce the effectiveness of detectors from near-perfect to nearly random. Foundation models (FMs) have emerged as a promising alternative because typical PAD datasets, such as the MCIO benchmarks (MSU-MFSD, CASIA-FASD, Replay-Attack, and OULU-NPU), are small relative to the scale used for web-based pretraining. However, existing PAD systems primarily focus on CLIP-based foundation models, while overlooking other FMs with different architectures and training procedures. This study addresses this question by systematically evaluating 32 FMs. Zero-shot prompting achieves performance near chance across model families and scales. The vision encoders, when low-rankadapted (LoRA) with fewer than 1% trainable weights, achieve below 2% intra-dataset ACER in most cases, while cross-dataset ACER is substantially higher. LoRA primarily refines the decision boundary within a dataset, suggesting that pretrained representations and the adaptation dataset play a larger role in cross-dataset generalization than the evaluated lightweight adaptation strategy.

Figures

Figures reproduced from arXiv: 2608.09633 by the authors.

Figure 1
Figure 1. Mean ACER range across models (dots: models; bars: min–max). Zero-shot VLMs perform near chance (Q1, [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. ACERALL ↓ (%) vs. compute↓ (GFLOPs). Left: frozen vision backbone param￾eters (billions). Right: forward-pass GFLOPs at batch size 1, where CLIP VIT-B/32 yields the best trade-off between accuracy and compute. Note that some jitter was added to the x-axis of the datapoints such that they do not overlap. Legend explained in Sec. 3.2. 4.4 Intra-dataset Performance under LoRA [PITH_FULL_IMAGE:figures/full_fig_p009_2.png] view at source ↗
Figure 3
Figure 3. Relationship between dataset size and ACER. The mean intra-dataset er￾ror (ACERID, left) and cross-dataset error (ACERALL, right) are presented. Colors and markers indicate pretraining families (see Sec. 3.2). The shaded band denotes ImageNet-scale datasets (≤ 108 images). Intra-dataset performance is insensitive to dataset size, while cross-dataset performance plateaus beyond 108 images. Legend ex￾plained in Sec. 3… view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: t-SNE of CLS features on the test sets. (a) Off-the-shelf frozen backbones (before adaptation); (b) the same encoders after LoRA fine-tuning. Bonafide samples are shown in red across all datasets, while presentation attacks are colored: MSU￾MFSD, CASIA-FASD, Replay-Att…

Review history (2 revisions) →

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

82 extracted references · 11 linked inside Pith

  1. [1]

    In: 20th ACM Conference on Multimedia Systems (ACMMM) (Oct 2012),https: //publications.idiap.ch/downloads/papers/2012/Anjos_Bob_ACMMM12.pdf

    Anjos, A., El Shafey, L., Wallace, R., Günther, M., McCool, C., Marcel, S.: Bob: a free signal processing and machine learning toolbox for researchers. In: 20th ACM Conference on Multimedia Systems (ACMMM) (Oct 2012),https: //publications.idiap.ch/downloads/papers/2012/Anjos_Bob_ACMMM12.pdf

    2012

  2. [2]

    In: International Conference on Machine Learning (ICML) (Aug 2017),http://publications.idiap.ch/downloads/papers/2017/ Anjos_ICML2017-2_2017.pdf

    Anjos, A., Günther, M., de Freitas Pereira, T., Korshunov, P., Mohammadi, A., Marcel, S.: Continuously reproducing toolchains in pattern recognition and ma- chine learning experiments. In: International Conference on Machine Learning (ICML) (Aug 2017),http://publications.idiap.ch/downloads/papers/2017/ Anjos_ICML2017-2_2017.pdf

    2017

  3. [3]

    In: European conference on computer vision

    Assran, M., Caron, M., Misra, I., Bojanowski, P., Bordes, F., Vincent, P., Joulin, A., Rabbat, M., Ballas, N.: Masked siamese networks for label-efficient learning. In: European conference on computer vision. pp. 456–473. Springer (2022)

    2022

  4. [4]

    CoRRabs/2502.13923(2025).https: //doi.org/10.48550/ARXIV.2502.13923,https://doi.org/10.48550/arXiv

    Bai, S., Chen, K., Liu, X., Wang, J., Ge, W., Song, S., Dang, K., Wang, P., Wang, S., Tang, J., Zhong, H., Zhu, Y., Yang, M., Li, Z., Wan, J., Wang, P., Ding, W., Fu, Z., Xu, Y., Ye, J., Zhang, X., Xie, T., Cheng, Z., Zhang, H., Yang, Z., Xu, H., Lin, J.: Qwen2.5-vl technical report. CoRRabs/2502.13923(2025).https: //doi.org/10.48550/ARXIV.2502.13923,http...

    arXiv doi:10.48550/arxiv.2502.13923 2025

  5. [5]

    arXiv preprint arXiv:2106.08254 (2021)

    Bao, H., Dong, L., Piao, S., Wei, F.: Beit: Bert pre-training of image transformers. arXiv preprint arXiv:2106.08254 (2021)

    arXiv 2021

  6. [6]

    In: 2017 12th IEEE international conference on automatic face & gesture recognition (FG 2017)

    Boulkenafet, Z., Komulainen, J., Li, L., Feng, X., Hadid, A.: Oulu-npu: A mobile face presentation attack database with real-world variations. In: 2017 12th IEEE international conference on automatic face & gesture recognition (FG 2017). pp. 612–618. IEEE (2017)

    2017

  7. [7]

    In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition

    Boutros, F., Damer, N., Kirchbuchner, F., Kuijper, A.: Elasticface: Elastic margin loss for deep face recognition. In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. pp. 1578–1587 (2022)

    2022

  8. [8]

    Byeon, M., Park, B., Kim, H., Lee, S., Baek, W., Kim, S.: COYO-700M: Image-text pair dataset.https://github.com/kakaobrain/coyo-dataset(2022)

    2022

Show all 82 references
  1. [9]

    International Journal of Computer Vision pp

    Cai, R., Soh, C.Y., Yu, Z., Li, H., Yang, W., Kot, A.C.: Towards data-centric face anti-spoofing: Improving cross-domain generalization via physics-based data synthesis. International Journal of Computer Vision pp. 1–22 (2024)

    2024

  2. [10]

    In: 2025 IEEE/CVF Winter Conference on Applications of Computer Vision (WACV)

    Cao, J., Ma, C.: Towards generalized face anti-spoofing from a frequency shortcut view. In: 2025 IEEE/CVF Winter Conference on Applications of Computer Vision (WACV). pp. 1005–1015. IEEE (2025)

    2025

  3. [11]

    In: 2018 13th IEEE international conference on automatic face & gesture recognition (FG 2018)

    Cao, Q., Shen, L., Xie, W., Parkhi, O.M., Zisserman, A.: Vggface2: A dataset for recognising faces across pose and age. In: 2018 13th IEEE international conference on automatic face & gesture recognition (FG 2018). pp. 67–74. IEEE (2018)

    2018

  4. [12]

    In: The Eleventh International Conference on Learning Representations, ICLR 2023, Ki- gali, Rwanda, May 1-5, 2023

    Chen, X., Wang, X., Changpinyo, S., Piergiovanni, A.J., Padlewski, P., Salz, D., Goodman, S., Grycner, A., Mustafa, B., Beyer, L., Kolesnikov, A., Puigcerver, J., Ding, N., Rong, K., Akbari, H., Mishra, G., Xue, L., Thapliyal, A.V., Bradbury, J., Kuo, W.: Pali: A jointly-scale...

    2023

  5. [13]

    arXiv preprint arXiv:2412.05271 (2024) LoRA Adaptation Alone Is Not Enough for Face PAD 17

    Chen, Z., Wang, W., Cao, Y., Liu, Y., Gao, Z., Cui, E., Zhu, J., Ye, S., Tian, H., Liu, Z., et al.: Expanding performance boundaries of open-source multimodal models with model, data, and test-time scaling. arXiv preprint arXiv:2412.05271 (2024) LoRA Adaptation Alone Is Not En...

    2024 arXiv

  6. [14]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

    Chen, Z., Wu, J., Wang, W., Su, W., Chen, G., Xing, S., Zhong, M., Zhang, Q., Zhu, X., Lu, L., et al.: InternVL: Scaling up vision foundation models and aligning for generic visual-linguistic tasks. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Reco...

    2024

  7. [15]

    In: AAAI

    Chen, Z., Yao, T., Sheng, K., Ding, S., Tai, Y., Li, J., Huang, F., Jin, X.: Gener- alizable representation learning for mixture domain face anti-spoofing. In: AAAI. pp. 1132–1139. AAAI Press (2021)

    2021

  8. [16]

    In: 2016 international conference of the Biometrics Special Interest Group (BIOSIG)

    Costa-Pazo, A., Bhattacharjee, S., Vazquez-Fernandez, E., Marcel, S.: The replay- mobile face presentation-attack database. In: 2016 international conference of the Biometrics Special Interest Group (BIOSIG). pp. 1–7. IEEE (2016)

    2016

  9. [17]

    In: International Conference on Learning Representations (2024)

    Darcet, T., Oquab, M., Mairal, J., Bojanowski, P.: Vision transformer needs reg- isters. In: International Conference on Learning Representations (2024)

    2024

  10. [18]

    In: 2009 IEEE conference on computer vision and pattern recognition

    Deng, J., Dong, W., Socher, R., Li, L.J., Li, K., Fei-Fei, L.: Imagenet: A large- scale hierarchical image database. In: 2009 IEEE conference on computer vision and pattern recognition. pp. 248–255. Ieee (2009)

    2009

  11. [19]

    In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition

    Deng, J., Guo, J., Xue, N., Zafeiriou, S.: Arcface: Additive angular margin loss for deep face recognition. In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. pp. 4690–4699 (2019)

    2019

  12. [20]

    In: The Twelfth International Conference on Learning Repre- sentations, ICLR 2024, Vienna, Austria, May 7-11, 2024

    Fang, A., Jose, A.M., Jain, A., Schmidt, L., Toshev, A.T., Shankar, V.: Data filtering networks. In: The Twelfth International Conference on Learning Repre- sentations, ICLR 2024, Vienna, Austria, May 7-11, 2024. OpenReview.net (2024), https://openreview.net/forum?id=KAk6ngZ09F

    2024

  13. [21]

    In: Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision

    Fang, M., Damer, N.: Face presentation attack detection by excavating causal clues and adapting embedding statistics. In: Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision. pp. 6269–6279 (2024)

    2024

  14. [22]

    In: IEEE/CVF WACV, Waikoloa, HI, USA, January 3-8, 2022

    Fang, M., Damer, N., Kirchbuchner, F., Kuijper, A.: Learnable multi-level fre- quency decomposition and hierarchical attention mechanism for generalized face presentation attack detection. In: IEEE/CVF WACV, Waikoloa, HI, USA, January 3-8, 2022. pp. 1131–1140. IEEE (2022).http...

    2022

  15. [23]

    Pattern Recognit.123, 108398 (2022)

    Fang, M., Damer, N., Kirchbuchner, F., Kuijper, A.: Real masks and spoof faces: On the masked face presentation attack detection. Pattern Recognit.123, 108398 (2022)

    2022

  16. [24]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

    Fang, M., Huber, M., Damer, N.: Synthaspoof: Developing face presentation at- tack detection based on privacy-friendly synthetic data. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp. 1061– 1070 (2023)

    2023

  17. [25]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

    Feng, M., Gallin-Martel, P., Ito, K., Aoki, T.: Benchmarking vision founda- tion models for domain-generalizable face anti-spoofing. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp. 1567– 1576 (2026)

    2026

  18. [26]

    de Freitas Pereira, T., Anjos, A., Martino, J.M.D., Marcel, S.: Can face anti- spoofing countermeasures work in a real world scenario? In: ICB. pp. 1–8. IEEE (2013)

    2013

  19. [27]

    Lorenz et al

    Gadre, S.Y., Ilharco, G., Fang, A., Hayase, J., Smyrnis, G., Nguyen, T., Marten, R., Wortsman, M., Ghosh, D., Zhang, J., Orgad, E., Entezari, R., Daras, G., Pratt, S.M., Ramanujan, V., Bitton, Y., Marathe, K., Mussmann, S., Vencu, R., Cherti, M., Krishna, R., Koh, P.W., Saukh,...

    2023

  20. [28]

    In: 2019 international conference on biometrics (ICB)

    George, A., Marcel, S.: Deep pixel-wise binary supervision for face presentation attack detection. In: 2019 international conference on biometrics (ICB). pp. 1–8. IEEE (2019)

    2019

  21. [29]

    Gonzalez-Soler, L.J., Tapia, J.E., Busch, C.: Are foundation models all you need for zero-shot face presentation attack detection? In: 2025 IEEE 19th International Conference on Automatic Face and Gesture Recognition (FG). pp. 1–10. IEEE (2025)

    2025

  22. [30]

    Gu,J.,Meng,X.,Lu,G.,Hou,L.,Minzhe,N.,Liang,X.,Yao,L.,Huang,R.,Zhang, W., Jiang, X., Xu, C., Xu, H.: Wukong: A 100 million large-scale chinese cross- modalpre-trainingbenchmark.In:Koyejo,S.,Mohamed,S.,Agarwal,A.,Belgrave, D., Cho, K., Oh, A. (eds.) Advances in Neural Informatio...

    2022

  23. [31]

    In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition

    He, K., Chen, X., Xie, S., Li, Y., Dollár, P., Girshick, R.: Masked autoencoders are scalable vision learners. In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. pp. 16000–16009 (2022)

    2022

  24. [32]

    Iclr1(2), 3 (2022)

    Hu, E.J., Shen, Y., Wallis, P., Allen-Zhu, Z., Li, Y., Wang, S., Wang, L., Chen, W., et al.: Lora: Low-rank adaptation of large language models. Iclr1(2), 3 (2022)

    2022

  25. [33]

    In: European conference on computer vision

    Huang, H.P., Sun, D., Liu, Y., Chu, W.S., Xiao, T., Yuan, J., Adam, H., Yang, M.H.: Adaptive transformers for robust few-shot cross-domain face anti-spoofing. In: European conference on computer vision. pp. 37–54. Springer (2022)

    2022

  26. [34]

    3: Testing and reporting (2017)

    International Organization for Standardization: ISO/IEC DIS 30107-3:2016: Infor- mation Technology – Biometric presentation attack detection – P. 3: Testing and reporting (2017)

    2017

  27. [35]

    In: CVPR

    Jia, Y., Zhang, J., Shan, S., Chen, X.: Single-side domain generalization for face anti-spoofing. In: CVPR. pp. 8481–8490. Computer Vision Foundation / IEEE (2020)

    2020

  28. [36]

    In: IEEE/CVF International Conference on Computer Vision, ICCV 2023, Paris, France, October 1-6, 2023

    Kirillov, A., Mintun, E., Ravi, N., Mao, H., Rolland, C., Gustafson, L., Xiao, T., Whitehead, S., Berg, A.C., Lo, W., Dollár, P., Girshick, R.B.: Segment any- thing. In: IEEE/CVF International Conference on Computer Vision, ICCV 2023, Paris, France, October 1-6, 2023. pp. 3992...

    2023

  29. [37]

    In: Proceedings of the IEEE/CVF International Conference on Computer Vision

    Kirillov, A., Mintun, E., Ravi, N., Mao, H., Rolland, C., Gustafson, L., Xiao, T., Whitehead, S., Berg, A.C., Lo, W.Y., et al.: Segment anything. In: Proceedings of the IEEE/CVF International Conference on Computer Vision. pp. 4015–4026 (2023)

    2023

  30. [38]

    In: IEEE/CVF Winter Conference on Applications of Computer Vision, WACV 2025 - Workshops, Tucson, AZ, USA, February 28 - March 4, 2025

    Komaty, A., Otroshi-Shahreza, H., George, A., Marcel, S.: Exploring chatgpt for face presentation attack detection in zero and few-shot in-context learning. In: IEEE/CVF Winter Conference on Applications of Computer Vision, WACV 2025 - Workshops, Tucson, AZ, USA, February 28 -...

    2025

  31. [39]

    CoRRabs/1810.09305(2018),http://arxiv.org/abs/1810.09305

    Koupaee, M., Wang, W.Y.: Wikihow: A large scale text summarization dataset. CoRRabs/1810.09305(2018),http://arxiv.org/abs/1810.09305

    2018 arXiv

  32. [40]

    In: Oh, A., Naumann, T., Globerson, A., Saenko, K., Hardt, M., Levine, S

    Laurençon, H., Saulnier, L., Tronchon, L., Bekman, S., Singh, A., Lozhkov, A., Wang, T., Karamcheti, S., Rush, A.M., Kiela, D., Cord, M., Sanh, V.: OBELICS: an open web-scale filtered dataset of interleaved image-text documents. In: Oh, A., Naumann, T., Globerson, A., Saenko, ...

    2023

  33. [41]

    arXiv preprint arXiv:2408.03326 (2024)

    Li, B., Zhang, Y., Guo, D., Zhang, R., Li, F., Zhang, H., Zhang, K., Zhang, P., Li, Y., Liu, Z., Li, C.: Llava-onevision: Easy visual task transfer. arXiv preprint arXiv:2408.03326 (2024)

    2024 arXiv

  34. [42]

    IEEE Trans

    Li, H., Li, W., Cao, H., Wang, S., Huang, F., Kot, A.C.: Unsupervised domain adaptation for face anti-spoofing. IEEE Trans. Inf. Forensics Secur.13(7), 1794– 1809 (2018)

    2018

  35. [43]

    In: Proceedings of the Computer Vision and Pattern Recognition Conference

    Li, Z., Zhao, T., Xu, X., Zhang, Z., Li, Z., Chen, X., Zhang, Q., Bergamo, A., Jain, A.K., Xing, Y.: Optimal transport-guided source-free adaptation for face anti-spoofing. In: Proceedings of the Computer Vision and Pattern Recognition Conference. pp. 24351–24363 (2025)

    2025

  36. [44]

    In: Proceedings of the 33rd ACM International Conference on Multimedia

    Lin, K.H., Tseng, Y.W., Huang, K.Y., Wu, J.C., Cheng, W.H.: Instructflip: Ex- ploring unified vision-language model for face anti-spoofing. In: Proceedings of the 33rd ACM International Conference on Multimedia. pp. 2987–2996 (2025)

    2025

  37. [45]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

    Liu, A., Xue, S., Gan, J., Wan, J., Liang, Y., Deng, J., Escalera, S., Lei, Z.: Cfpl- fas: Class free prompt learning for generalizable face anti-spoofing. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp. 222–232 (2024)

    2024

  38. [46]

    Liu, H., Li, C., Li, Y., Li, B., Zhang, Y., Shen, S., Lee, Y.J.: Llava-next: Improved reasoning, ocr, and world knowledge.https://llava-vl.github.io/blog/2024- 01-30-llava-next/(2024)

    2024

  39. [47]

    In: CVPR

    Liu, Y., Jourabloo, A., Liu, X.: Learning deep models for face anti-spoofing: Binary or auxiliary supervision. In: CVPR. pp. 389–398. IEEE Computer Society (2018)

    2018

  40. [48]

    In: ICME

    Liu, Y., Chen, Y., Dai, W., Li, C., Zou, J., Xiong, H.: Causal intervention for generalizable face anti-spoofing. In: ICME. pp. 1–6. IEEE (2022)

    2022

  41. [49]

    In: Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing

    Miao, D., Liu, Y., Wang, J., Sun, C., Zhang, Y., Yan, D., Dong, S., Zhang, Q., Wu, Y.: Taso: Task-aligned sparse optimization for parameter-efficient model adapta- tion. In: Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing. pp. 22746–22758 (2025)

    2025

  42. [50]

    arXiv preprint arXiv:2304.07193 (2023)

    Oquab, M., Darcet, T., Moutakanni, T., Vo, H., Szafraniec, M., Khalidov, V., Fernandez, P., Haziza, D., Massa, F., El-Nouby, A., et al.: Dinov2: Learning robust visual features without supervision. arXiv preprint arXiv:2304.07193 (2023)

    2023 arXiv

  43. [51]

    IEEE Transactions on Information Forensics and Security (2025)

    Otroshi Shahreza, H., Marcel, S.: Foundation models and biometrics: A survey and outlook. IEEE Transactions on Information Forensics and Security (2025). https://doi.org/10.1109/TIFS.2025.3602233,https://ieeexplore.ieee. org/document/11137396

    2025

  44. [52]

    In: Proceedings of the Winter Conference on Applications of Computer Vision

    Ozgur, G., Caldeira, E., Chettaoui, T., Boutros, F., Ramachandra, R., Damer, N.: Foundpad: Foundation models reloaded for face presentation attack detection. In: Proceedings of the Winter Conference on Applications of Computer Vision. pp. 745–755 (2025) 20 P. Lorenz et al

    2025

  45. [53]

    In: 2023 11th International Workshop on Biometrics and Forensics (IWBF)

    Pasmino, D., Aravena, C., Tapia, J.E., Busch, C.: Flickr-pad: New face high- resolution presentation attack detection database. In: 2023 11th International Workshop on Biometrics and Forensics (IWBF). pp. 1–6. IEEE (2023)

    2023

  46. [54]

    IEEE transactions on information forensics and security11(10), 2268–2283 (2016)

    Patel, K., Han, H., Jain, A.K.: Secure face unlock: Spoof detection on smartphones. IEEE transactions on information forensics and security11(10), 2268–2283 (2016)

    2016

  47. [55]

    In: International conference on machine learning

    Radford, A., Kim, J.W., Hallacy, C., Ramesh, A., Goh, G., Agarwal, S., Sastry, G., Askell, A., Mishkin, P., Clark, J., et al.: Learning transferable visual models from natural language supervision. In: International conference on machine learning. pp. 8748–8763. PmLR (2021)

    2021

  48. [56]

    In: Koyejo, S., Mohamed, S., Agarwal, A., Belgrave, D., Cho, K., Oh, A

    Schuhmann, C., Beaumont, R., Vencu, R., Gordon, C., Wightman, R., Cherti, M., Coombes, T., Katta, A., Mullis, C., Wortsman, M., Schramowski, P., Kun- durthy, S., Crowson, K., Schmidt, L., Kaczmarczyk, R., Jitsev, J.: LAION- 5B: an open large-scale dataset for training next gen...

    2022

  49. [57]

    In: CVPR

    Shao, R., Lan, X., Li, J., Yuen, P.C.: Multi-adversarial discriminative deep domain generalization for face presentation attack detection. In: CVPR. pp. 10023–10031. Computer Vision Foundation / IEEE (2019)

    2019

  50. [58]

    In: AAAI

    Shao, R., Lan, X., Yuen, P.C.: Regularized fine-grained meta face anti-spoofing. In: AAAI. pp. 11974–11981. AAAI Press (2020)

    2020

  51. [59]

    arXiv preprint arXiv:2508.10104 (2025)

    Siméoni, O., Vo, H.V., Seitzer, M., Baldassarre, F., Oquab, M., Jose, C., Khali- dov, V., Szafraniec, M., Yi, S., Ramamonjisoa, M., et al.: Dinov3. arXiv preprint arXiv:2508.10104 (2025)

    2025 arXiv

  52. [60]

    In: Diaz, F., Shah, C., Suel, T., Castells, P., Jones, R., Sakai, T

    Srinivasan, K., Raman, K., Chen, J., Bendersky, M., Najork, M.: WIT: wikipedia- based image text dataset for multimodal multilingual machine learning. In: Diaz, F., Shah, C., Suel, T., Castells, P., Jones, R., Sakai, T. (eds.) SIGIR ’21: The 44th International ACM SIGIR Confer...

    2021

  53. [61]

    Srivatsan, K., Naseer, M., Nandakumar, K.: Flip: Cross-domain face anti-spoofing withlanguageguidance.In:ProceedingsoftheIEEE/CVFinternationalconference on computer vision. pp. 19685–19696 (2023)

    2023

  54. [62]

    arXiv preprint arXiv:2303.15389 (2023)

    Sun, Q., Fang, Y., Wu, L., Wang, X., Cao, Y.: Eva-clip: Improved training tech- niques for clip at scale. arXiv preprint arXiv:2303.15389 (2023)

    2023 arXiv

  55. [63]

    CoRRabs/2402.04252(2024)

    Sun, Q., Wang, J., Yu, Q., Cui, Y., Zhang, F., Zhang, X., Wang, X.: EVA- CLIP-18B: scaling CLIP to 18 billion parameters. CoRRabs/2402.04252(2024). https://doi.org/10.48550/ARXIV.2402.04252,https://doi.org/10.48550/ arXiv.2402.04252

    2024 doi arXiv

  56. [64]

    In: CVPR

    Wang, C., Lu, Y., Yang, S., Lai, S.: Patchnet: A simple face anti-spoofing frame- work via fine-grained patch recognition. In: CVPR. pp. 20249–20258. IEEE (2022)

    2022

  57. [65]

    In: Proceedings of the Computer Vision and Pattern Recognition Conference

    Wang, G., Lin, F., Wu, T., Liu, Z., Ba, Z., Ren, K.: Fsfm: A generalizable face security foundation model via self-supervised facial representation learning. In: Proceedings of the Computer Vision and Pattern Recognition Conference. pp. 24364–24376 (2025)

    2025

  58. [66]

    Wang, G., Han, H., Shan, S., Chen, X.: Improving cross-database face presentation attack detection via adversarial domain adaptation. In: ICB. pp. 1–8. IEEE (2019) LoRA Adaptation Alone Is Not Enough for Face PAD 21

    2019

  59. [67]

    CoRRabs/2409.12191(2024).https://doi.org/10.48550/ ARXIV.2409.12191,https://doi.org/10.48550/arXiv.2409.12191

    Wang, P., Bai, S., Tan, S., Wang, S., Fan, Z., Bai, J., Chen, K., Liu, X., Wang, J., Ge, W., Fan, Y., Dang, K., Du, M., Ren, X., Men, R., Liu, D., Zhou, C., Zhou, J., Lin, J.: Qwen2-vl: Enhancing vision-language model’s perception of the world at any resolution. CoRRabs/2409.1...

    2024 doi arXiv

  60. [68]

    IEEE Trans

    Wang,Z.,Wang,Q.,Deng,W.,Guo,G.:Faceanti-spoofingusingtransformerswith relation-aware mechanism. IEEE Trans. Biom. Behav. Identity Sci.4(3), 439–450 (2022)

    2022

  61. [69]

    In: Asia-Pacific Signal and Information Processing Association Annual Summit and Conference

    Watanabe, K., Ito, K., Aoki, T.: Spoofing attack detection in face recognition sys- tem using vision transformer with patch-wise data augmentation. In: Asia-Pacific Signal and Information Processing Association Annual Summit and Conference. pp. 1561–1565 (2022)

    2022

  62. [70]

    IEEE Transactions on Information Forensics and Security10(4), 746–761 (2015)

    Wen, D., Han, H., Jain, A.K.: Face spoof detection with image distortion analysis. IEEE Transactions on Information Forensics and Security10(4), 746–761 (2015)

    2015

  63. [71]

    In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition

    Woo, S., Debnath, S., Hu, R., Chen, X., Liu, Z., Kweon, I.S., Xie, S.: Convnext v2: Co-designing and scaling convnets with masked autoencoders. In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. pp. 16133– 16142 (2023)

    2023

  64. [72]

    arXiv preprint arXiv:2412.10302 (2024)

    Wu,Z.,Chen,X.,Pan,Z.,Liu,X.,Liu,W.,Dai,D.,Gao,H.,Ma,Y.,Wu,C.,Wang, B., et al.: Deepseek-vl2: Mixture-of-experts vision-language models for advanced multimodal understanding. arXiv preprint arXiv:2412.10302 (2024)

    2024 arXiv

  65. [73]

    IEEE Trans

    Yan, W., Zeng, Y., Hu, H.: Domain adversarial disentanglement network with cross-domain synthesis for generalized face anti-spoofing. IEEE Trans. Circuits Syst. Video Technol.32(10), 7033–7046 (2022)

    2022

  66. [74]

    In: Proceedings of the IEEE/CVF International Conference on Computer Vision

    Yang, J., Lin, X., Yu, Z., Zhang, L., Liu, X., Li, H., Yuan, X., Cao, X.: Dadm: Dual alignment of domain and modality for face anti-spoofing. In: Proceedings of the IEEE/CVF International Conference on Computer Vision. pp. 12045–12056 (2025)

    2025

  67. [75]

    IEEE Trans

    Yu, Z., Li, X., Shi, J., Xia, Z., Zhao, G.: Revisiting pixel-wise supervision for face anti-spoofing. IEEE Trans. Biom. Behav. Identity Sci.3(3), 285–295 (2021)

    2021

  68. [76]

    IEEE Trans

    Yu,Z.,Wan,J.,Qin,Y.,Li,X.,Li,S.Z.,Zhao,G.:NAS-FAS:static-dynamiccentral difference network search for face anti-spoofing. IEEE Trans. Pattern Anal. Mach. Intell.43(9), 3005–3023 (2021)

    2021

  69. [77]

    In: CVPR

    Yu, Z., Zhao, C., Wang, Z., Qin, Y., Su, Z., Li, X., Zhou, F., Zhao, G.: Searching central difference convolutional networks for face anti-spoofing. In: CVPR. pp. 5294–5304. IEEE (2020)

    2020

  70. [78]

    In: Proceedings of the IEEE/CVF international conference on computer vision

    Zhai, X., Mustafa, B., Kolesnikov, A., Beyer, L.: Sigmoid loss for language im- age pre-training. In: Proceedings of the IEEE/CVF international conference on computer vision. pp. 11975–11986 (2023)

    2023

  71. [79]

    In: Proceedings of the AAAI Conference on Artificial Intelligence (2025)

    Zhang, G., Wang, K., Yue, H., Liu, A., Zhang, G., Yao, K., Ding, E., Wang, J.: Interpretable face anti-spoofing: Enhancing generalization with multimodal large language models. In: Proceedings of the AAAI Conference on Artificial Intelligence (2025)

    2025

  72. [80]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)

    Zhang, H., Fang, Z., Zhao, N., Hou, S., Ma, L., Pei, R., He, Z.: Harnessing chain- of-thought reasoning in multimodal large language models for face anti-spoofing. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). pp. 33566–33576 (June 2026)

    2026

  73. [81]

    Lorenz et al

    Zhang, K., Zhang, Z., Li, Z., Qiao, Y.: Joint face detection and alignment using multitaskcascadedconvolutionalnetworks.IEEESignalProcessingLetters23(10), 1499–1503 (2016) 22 P. Lorenz et al

    2016

  74. [82]

    In: European conference on computer vision

    Zhang, Y., Yin, Z., Li, Y., Yin, G., Yan, J., Shao, J., Liu, Z.: Celeba-spoof: Large- scale face anti-spoofing dataset with rich annotations. In: European conference on computer vision. pp. 70–85. Springer (2020)

    2020

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.