Leveraging Intermediate Features of Vision Transformer for Face Anti-Spoofing

Koichi Ito; Masakatsu Nishigaki; Mika Feng; Takafumi Aoki; Tetsushi Ohki

REVIEW 3 major objections 4 minor 20 references

Leveraging Intermediate Features of Vision Transformer for Face Anti-Spoofing

T0 review · 3 major / 4 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that the class token of encoder block 8 is the most reliable place to read a face-liveness score, and reports the lowest ACER on OULU-NPU Protocol 4 and SiW Protocol 3 among the compared methods.

desk verdict Useful incremental ViT feature selection for face anti-spoofing, but the reported numbers are optimistic because the configuration and threshold are chosen on the test protocols. read the letter →

arxiv 2505.24402 v2 pith:5ILUJTD5 submitted 2025-05-30 cs.CV

Mika Feng , Koichi Ito , Takafumi Aoki , Tetsushi Ohki , Masakatsu Nishigaki This is my paper

classification cs.CV

keywords faceanti-spoofingVisionTransformerintermediatefeaturesclasstokenlivenessscoredataaugmentationOULU-NPUSiW

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that the features a Vision Transformer (ViT) builds in its middle encoder blocks, rather than its final layer, are the right place to read a face-liveness score, because they balance local and global image cues. It proposes a face anti-spoofing detector that scores an input by the cosine similarity of the class-token vector from encoder block 8 against live reference vectors, adds a second classification loss at encoder block 11, and augments training with two attack-specific data augmentations, FAS-Aug and Patch-wise Data Augmentation (PDA). On the OULU-NPU and SiW benchmarks the paper reports lower average classification error than the listed prior methods on the generalization-focused protocols, with ACER of 2.54% on OULU-NPU Protocol 4 and 0.83% on SiW Protocol 3 when PDA is included. The value claimed is that a generic ViT can be turned into a strong detector of unknown presentation attacks simply by choosing where in the network to look.

What carries the argument

The load-bearing object is the class token extracted from encoder block 8 of ViT-Base, used as a live-versus-spoof embedding. The paper treats the class token's cosine similarity to reference vectors of live training images as the liveness score, and couples it with a gradient path from the class token of encoder block 11 via an additional classification loss. The other components, FAS-Aug and PDA's Live Patch Mask, serve to widen the training distribution toward unknown attacks.

What would settle it

Retrain the exact method but select the encoder block for scoring, the block for the auxiliary loss, and the decision threshold on a separate validation split of OULU-NPU Protocol 4 and SiW Protocol 3, then freeze and evaluate on the official test protocols; if the frozen-method ACER rises to or above the best prior method's level, the paper's central claim of superior generalization is falsified.

Watch

Extended reading notes

Core claim

The central claim is that for face anti-spoofing, the class token from the 8th of 12 ViT encoder blocks is a better basis for liveness scoring than the class token from the final layer or normalization layer, because this intermediate representation does not overfit the training data and retains both local and global features. Training uses three $L_2$-constrained softmax losses: the usual final-layer class loss, the Attention-Weighted Patch Loss on the final block's attention map, and an additional class loss at encoder block 11 that refines the features used for scoring. Inference computes a score as the maximum cosine similarity between the block-8 class token of the input and stored block-8 class tokens of live training images, with the threshold set at the FAR/FRR intersection. The paper claims this configuration, combined with FAS-Aug and PDA data augmentation, achieves the best ACER among the listed methods on OULU-NPU Protocol 4 and SiW Protocol 3, and that the two augmentations help with or without the intermediate features.

Load-bearing premise

The load-bearing premise is that choosing the scoring layer, the auxiliary loss layer, and the decision threshold on the same evaluation data still measures how the method will perform on unseen spoofing attacks; if a separate validation set were used, the reported ACERs could be higher.

Editorial extensions

If this is right

If block 8 is indeed the right readout layer, other ViT-based anti-spoofing methods could improve by switching their score source from the final layer to an ablation-selected intermediate block.
The block-11 classification loss acts as a feature-refinement regularizer, suggesting that intermediate supervision near the scoring layer can substitute for deeper supervision.
Combining two attack-specific augmentations gives a larger gain than either alone, so the gains are at least partly additive.
Because the method uses only a single image, it can be applied frame-by-frame in video authentication without temporal modeling.
Reported ACERs on OULU-NPU Protocols 2 and 3 drop below 0.6% with PDA, which would make the method competitive as a pre-filter before face recognition.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The paper does not use a separate validation split for choosing block 8, block 11, or the threshold; a natural extension is to test how much of the reported margin survives when those choices are made on held-out data.
The same readout-layer selection procedure could be applied to other transformer backbones to test whether an intermediate balancing layer generalizes beyond ViT-Base.
The method's claim implies that block-8 features encode attack-relevant cues such as texture and reflection; one could probe this directly by visualizing attention or measuring patch-level sensitivity at that block.
Since the threshold is set at FAR/FRR intersection on the evaluation data, deployment would require re-estimating the threshold from a separate calibration set; the paper's operational error rates may not transfer directly.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Quick take: this is a reasonable empirical extension of Watanabe et al.'s ViT-based FAS work, with an honest ablation study, but the headline ACERs are not trustworthy as published because the scoring layer, loss layer, and decision threshold are all selected using the evaluation protocols themselves. It needs revision, not rejection.

What's new: the paper systematically compares encoder blocks 6-12 for score computation and shows block 8 works best on two protocols; it adds an auxiliary loss at block 11; and it combines FAS-Aug with PDA in one pipeline. No single component is new, but the combination and the layer-choice study is a legitimate contribution. The ablations are clearly presented, and the authors are explicit that they chose layers empirically. That's credit where due.

Soft spots, in order of severity:

1. Evaluation leakage. Section 4.5 selects the scoring block by ACER on OULU-NPU Protocol 4 and SiW Protocol 3; Section 4.6 selects the loss block the same way; Section 4.3 sets the threshold at the FAR/FRR intersection on the evaluation data. So the configuration and threshold are fit to the test labels. The reported 2.54% and 0.83% are therefore optimistic bounds, not the accuracy of a frozen method. A validation split for model selection and thresholding would be needed to defend the SOTA claim. This is the load-bearing issue.

2. Internal inconsistency about PDA. The text says Protocol 4 is best without PDA, and indeed Table 4 shows FAS-Aug alone gives 5.5% vs 2.54% with FAS-Aug+PDA, but the text in Section 4.9 says "ACER of OULU-NPU Protocol 4 is lower when PDA is not introduced as shown in Table 4" -- Table 4 actually shows the opposite. Then Section 4.8 says PDA hurts Protocol 4, which isn't what Table 4 shows. This is confusing and needs fixing. It might just be sloppy writing, but it matters because the paper reports both w/ and w/o PDA and claims superiority for one or the other depending on protocol.

3. Minor: the claim that the 8th block has a "good balance of local and global features" is post-hoc rationalization; no measure of locality/globality is given. That's fine for a workshop paper, but don't oversell.

Bottom line: this is a serious incremental paper from a group that knows FAS, with a useful layer-choice study. But the evaluation protocol needs to be redone with a proper validation split before the numbers can be compared against prior work. I'd send it to peer review, but with the expectation of heavy revision on the evaluation methodology. If the authors can re-estimate with a validation split and fix the PDA inconsistency, it becomes a solid contribution.

Referee Report

3 major / 4 minor

Summary. The paper proposes a ViT-based face anti-spoofing method that computes the liveness score from the class token of the 8th encoder block, adds an auxiliary classification loss on the class token of the 11th encoder block, and combines FAS-Aug and PDA during training. Experiments on OULU-NPU and SiW report ACERs of 0.54%–2.54% on OULU-NPU protocols 2–4 and 0.83% on SiW Protocol 3, which the authors claim are lower than existing CNN/ViT-based methods. The paper also presents ablations on the scoring layer, auxiliary-loss layer, loss functions, and data augmentation.

Significance. If the reported results survive a properly held-out evaluation, the intermediate-feature design is a plausible and potentially useful contribution: it is consistent with anomaly-detection literature showing that mid-level ViT features balance local and global cues, and the ablation structure is clear and systematic. The claimed improvements are substantial on the two protocols most relevant to generalization to unknown attacks. However, the current manuscript does not yet establish the central claim, because the configuration and threshold are selected using the evaluation protocols whose ACERs are then reported, and several table/prose inconsistencies need to be corrected.

major comments (3)

[Sections 4.3, 4.5, 4.6, 4.8] The scoring layer, auxiliary-loss layer, augmentation usage, and decision threshold are all selected on the same evaluation protocols used for the headline results. Table 1 chooses the scoring encoder block by ACER on OULU-NPU Protocol 4 and SiW Protocol 3; Table 2 chooses the auxiliary-loss block in the same way; Section 4.3 sets the live/spoof threshold at the FAR/FRR intersection computed on the evaluation data; and Section 4.8 selects FAS-Aug/PDA usage from the same two protocols. The reported ACERs in Tables 5 and 6 are therefore in-sample estimates of a configuration chosen with access to the test labels, not the performance of a pre-specified frozen method. The SOTA comparison is not valid until all configuration choices and the threshold are fixed on a separate validation split and the test ACERs are recomputed.
[Section 4.8 and Table 4] The text and Table 4 are internally inconsistent about the best augmentation setting on OULU-NPU Protocol 4. Section 4.8 states that with intermediate features, Protocol 4 exhibits the lowest ACER when FAS-Aug is introduced, while Section 4.9 states that Protocol 4 ACER is lower when PDA is not introduced 'as shown in Table 4.' Table 4 as typeset shows the lowest Protocol 4 value (2.21%) in a row with two check marks; whether that row denotes ViT+PDA or ViT+FAS-Aug is not unambiguous in the plain-text rendering, but under either reading one of the two prose statements is wrong. Please correct the table or the text, make the row labels unambiguous, and define explicitly what 'Proposed w/o PDA' and 'Proposed w/ PDA' denote in Tables 5 and 6.
[Section 4.7 and Table 3] The prose in Section 4.7 is difficult to reconcile with Table 3 as printed. The text says SiW Protocol 3 has the lowest ACER when LClass11 is introduced, but the lowest SiW ACER in the table (1.63%) appears in a row that contains LAPL and, under the natural column alignment, does not contain LClass11. Please verify the table alignment and correct either the table or the sentence so that the ablation conclusions are reproducible.

minor comments (4)

[Section 4.3] Several hyperparameters are introduced without specifying how they were chosen or whether they were varied: the L2-softmax scaling parameter α, the FAS-Aug probability (0.2), the PDA probability (0.2), the patch replacement probability (0.5), and the augmentation stopping threshold (loss below 0.001). Please state whether these were fixed a priori or selected on a validation split.
[Tables 5 and 6] The terms 'Proposed w/o PDA' and 'Proposed w/ PDA' are not defined in the table captions or in Section 4.9. In particular, it is unclear whether both variants include FAS-Aug and all three loss terms; please add an explicit configuration list.
[Section 4.3] The evaluation uses 10 randomly sampled frames per video, but the paper does not state the number of random seeds or whether the reported standard deviations include frame-sampling variance; this matters because the reported standard deviations otherwise reflect only the protocol folds.
[Throughout] There are minor typographical artifacts in the plain text, such as ligature characters in 'spooﬁng' and inconsistent spacing around citations; these do not affect the technical content.

Circularity Check

3 steps flagged · score 6.0 of 10

Evaluation leakage: scoring block, loss block, and decision threshold are selected on the official test protocols, so the headline ACERs are in-sample selection results rather than frozen-method predictions.

fitted input called prediction [Section 4.5, Exp. (i); final architecture in Section 3.1; results in Tables 5-6]
"When the class token output from the 8th encoder block is used to calculate the score, the lowest ACER is obtained for both datasets."

Table 1 compares blocks 6 to 12 and the normalization layer on OULU-NPU Protocol 4 and SiW Protocol 3, and block 8 is chosen as the minimum of that search. The final ACERs in Tables 5-6 are then reported on the same two protocols. Thus the score-layer selection and the performance claim are fit to the same test labels; the reported result is a selected minimum, not the accuracy of a pre-specified architecture on unseen data.
fitted input called prediction [Section 4.6, Exp. (ii); final loss design in Section 3.3; results in Tables 5-6]
"The lowest ACER is obtained when a 2-class classification loss is introduced in the class token output from the 11th encoder block."

The loss-layer position is selected by minimizing ACER on OULU-NPU Protocol 4 and SiW Protocol 3, the exact protocols used in the final comparison tables. The reported improvement from LClass11 is therefore the value of the selection objective on the evaluation data, not an independent out-of-sample validation of a fixed loss design.

1 more flagged steps

fitted input called prediction [Section 4.3, Experimental Condition; metrics in Section 4.4; results in Tables 5-6]
"The threshold is set at the score where the False Acceptance Rate (FAR) and False Rejection Rate (FRR) intersect, following [16]."

FAR and FRR are computed on the evaluation videos, so the decision threshold is fit to those same labels. APCER, BPCER, and ACER in the final tables are then evaluated at this in-sample threshold. This makes the headline ACERs an in-sample operating point, and combined with the block selections the numbers are optimistically biased by construction.

full rationale

The method's architecture and loss design are not definitionally circular: the intermediate-feature hypothesis is tested by ablations rather than assumed, and PDA/APL from the authors' prior work [16] are re-tested in Tables 3-4 rather than imported as unverified support. The circularity is confined to the empirical headline. The evaluation protocols serve double duty as configuration search and test set: block 8 (score), block 11 (loss), and the threshold are all chosen using ACER/FAR/FRR computed on OULU-NPU Protocol 4 and SiW Protocol 3, and the same protocols are used to report the final ACERs. This is evaluation leakage and in-sample model selection, so the reported 2.54% (OULU-NPU P4) and 0.83% (SiW P3) are not the expected accuracy of a frozen, pre-specified method on unseen attacks. A separate validation split or nested protocol is required. Separately, the text is internally inconsistent: Section 4.8 states OULU-NPU Protocol 4 is best when FAS-Aug is introduced, but Table 4 shows PDA-only (2.21%) is better than FAS-Aug-only (5.5%) for the intermediate-feature model; this does not change the circularity verdict but further weakens confidence in the empirical selection.

Assumptions & free parameters 8 free parameters · 7 assumptions · 0 invented entities

No new entities are postulated. The method's burden is mostly empirical assumptions: layer choices and thresholds are tuned on the evaluation protocols, and the augmentation realism is inherited from prior work.

free parameters (8)

Encoder block for score computation = 8th block
Selected from ablation on OULU-NPU Protocol 4 and SiW Protocol 3 (Table 1), not from an independent validation split.
Encoder block for auxiliary loss = 11th block
Selected from ablation in Table 2 on the same two evaluation protocols.
FAS-Aug application probability = 0.2
Empirically determined, stated in Section 4.3; affects augmentation strength and results.
PDA application probability = 0.2
Empirically determined, Section 4.3.
Patch replacement probability in PDA = 0.5
Stated in Section 3.2, chosen without a reported sensitivity analysis.
Augmentation stopping threshold = 0.001
Augmentations are stopped after the loss drops below 0.001, Section 4.3; an ad hoc rule.
Decision threshold for liveness = FAR/FRR intersection
Computed on evaluation data during inference, Section 4.3; uses test labels, so it is a fitted parameter.
L2-softmax alpha = not specified
Alpha in Eq. (1) is required but its value is not reported.

assumptions (7)

domain assumption Pre-trained ViT-Base on a large non-public Google dataset transfers well to face anti-spoofing after fine-tuning.
Used as initialization in Section 3.1; no analysis of sensitivity to pretraining data.
domain assumption Features from the 8th encoder block achieve a good balance of local and global information for spoof detection.
Stated in Sections 3.1 and 4.5; only supported by the same-protocol ablation, not by an independent causal analysis.
domain assumption FAS-Aug's eight synthetic artifacts and PDA's live-patch masking simulate real print and display attacks closely enough to improve generalization.
Taken from references [2,16]; the paper does not validate the realism of the augmented images outside benchmark results.
domain assumption The benchmark protocols (OULU-NPU and SiW) are representative of real-world spoofing scenarios.
The paper uses these two datasets as sole evidence; no deployment data or cross-dataset test is provided.
domain assumption Cosine similarity between a test image's 8th-block class token and stored live reference tokens is a valid liveness score.
Core inference rule in Section 3.4; no comparison against alternative scoring rules.
domain assumption Randomly sampling 10 frames from each video preserves the video-level attack information.
Section 4.3 follows [1], but no frame-count ablation is reported.
domain assumption L2-constrained softmax loss trains features without bias toward either class.
From [12], adopted without comparison to plain softmax in this setting.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Leveraging Intermediate Features of Vision Transformer for Face Anti-Spoofing." pith.science (2026). https://pith.science/paper/5ILUJTD5

@misc{pith2026250524402,
  author       = {Pith},
  title        = {Pith review of: Leveraging Intermediate Features of Vision Transformer for Face Anti-Spoofing},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/5ILUJTD5}},
  note         = {Machine review of arXiv:2505.24402}
}

read the original abstract

Face recognition systems are designed to be robust against changes in head pose, illumination, and blurring during image capture. If a malicious person presents a face photo of the registered user, they may bypass the authentication process illegally. Such spoofing attacks need to be detected before face recognition. In this paper, we propose a spoofing attack detection method based on Vision Transformer (ViT) to detect minute differences between live and spoofed face images. The proposed method utilizes the intermediate features of ViT, which have a good balance between local and global features that are important for spoofing attack detection, for calculating loss in training and score in inference. The proposed method also introduces two data augmentation methods: face anti-spoofing data augmentation and patch-wise data augmentation, to improve the accuracy of spoofing attack detection. We demonstrate the effectiveness of the proposed method through experiments using the OULU-NPU and SiW datasets. The project page is available at: https://gsisaoki.github.io/FAS-ViT-CVPRW/ .

Figures

Figures reproduced from arXiv: 2505.24402 by the authors.

**Figure 2.** Example of face images after applying FAS-Aug. [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗

**Figure 3.** Overview of the procedure of Live Patch Mask in PDA. [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

20 extracted references · 17 canonical work pages

[1]

Boulkenafet, J

Z. Boulkenafet, J. Komulainen, L. Li, X. Feng, and A. Hadi d. OULU-NPU: A mobile face presentation attack database with real-world variations. Proc. IEEE Int’l Conf. Automatic Face Gesture Recog., pages 612–618, 2017. 2, 5

work page 2017
[2]

R. Cai, C. Soh, Z. Y u, H. Li, W. Yang, and A. Kot. Towards data-centric face anti-spooﬁng: Improving cross- domain generalization via physics-based data synthesis. Int’l J. Comput. Vis., pages 1–22, 2024. 2, 3, 5, 7

work page 2024
[3]

X. Chen, Y . Jia, and Y . Wu. Fine-grained annotation for fa ce anti-spooﬁng. CoRR, abs/2310.08142, 2023. 1, 2, 7, 8

arXiv 2023
[4]

Defard, A

T. Defard, A. Setkov, A. Loesch, and R. Audigier. PaDiM: A patch distribution modeling framework for anomaly de- tection and localization. Proc. ICPR Int’l W orkshops and Challenges, pages 475–489, 2021. 2, 3

work page 2021
[5]

Dosovitskiy, L

A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenborn, X. Zhai, T. Unterthiner, M. Dehghani, M. Minderer, G. Heigold, S. Gelly, J. Uszkoreit, and N. Houlsby. An image is worth 16x16 words: Transformers for image recognition at scale. Proc. Int’l Conf. Learn. Represent. , 2021. 1, 2, 3, 5

work page 2021
[6]

Kirillov, E

A. Kirillov, E. Mintun, N. Ravi, H. Mao, C. Rolland, L. Gustafson, T. Xiao, S. Whitehead, A. C. Berg, W.-Y . Lo, and R. Girshick. Segment anything. Proc. IEEE/CVF Int’l Conf. Comput. Vis., pages 4015–4026, 2023. 2

work page 2023
[7]

D. Li, G. Chen, X. Wu, Z. Y u, and M. Tan. Face anti- spooﬁng with cross-stage relation enhancement and spoof material perception. Neural Networks , 175:106275, 2024. 1, 7, 8

work page 2024
[8]

Li and A

S. Li and A. Jain. Handbook of Face Recognition. Springer,

Show all 20 references

[9]

Y . Liu, A. Jourabloo, and X. Liu. Learning deep models for face anti-spooﬁng: Binary or auxiliary supervision. Proc. IEEE/CVF Conf. Comput. Vis. Pattern Recog. , pages 389– 398, 2018. 2, 5

2018
[10]

Marcel, J

S. Marcel, J. Fierrez, and N. Evans. Handbook of Biometric Anti-Spooﬁng. Springer, 2023. 1

2023
[11]

Nesterov

Y . Nesterov. A method of solving a convex program- ming problem with convergence rate O(1/k2). Proc. USSR Academy of Sciences, 269:543–547, 1983. 5

1983
[12]

Ranjan, C

R. Ranjan, C. D Castillo, and R. Chellappa. L2-constrai ned softmax loss for discriminative face veriﬁcation. CoRR, abs/1703.09507, 2017. 4

2017 arXiv
[13]

K. Roth, L. Pemula, J. Zepeda, B. Sch¨ olkopf, T. Brox, and P . Gehler. Towards total recall in industrial anomaly detecti on. Proc. IEEE/CVF Conf. Comput. Vis. Pattern Recog. , pages 14318–14328, 2022. 2, 3

2022
[14]

C. Wang, Y . Lu, S. Yang, and S. Lai. PatchNet: A simple face anti-spooﬁng framework via ﬁne-grained patch recognition . Proc. IEEE/CVF Conf. Comput. Vis. Pattern Recog. , pages 20281–20290, 2022. 1, 2, 7, 8

2022
[15]

Z. Wang, Q. Wang, W. Deng, and G. Guo. Face anti-spooﬁng using transformers with relation-aware mechanism. IEEE Trans. Biometrics, Behavior , and Identity Science, 4(3):439– 450, 2022. 1, 2, 7, 8

2022
[16]

Watanabe, K

K. Watanabe, K. Ito, and T. Aoki. Spooﬁng attack de- tection in face recognition system using vision transforme r with patch-wise data augmentation. Proc. Asia-Paciﬁc Sig- nal and Information Processing Association Annual Summit and Conf., pages 1561–1565, 2022. 1, 2, 3, 4, 5, 6, 7, 8

2022
[17]

Xiang and G

J. Xiang and G. Zhu. Joint face detection and facial expr es- sion recognition with MTCNN. Proc. Int’l Conf. Information Science and Control Engineering, pages 424–427, 2017. 5

2017
[18]

Z. Y u, J. Wan, Y . Qin, X. Li, S. Z. Li, and G. Zhao. NAS- FAS: Static-dynamic central difference network search for face anti-spooﬁng. IEEE Trans. Pattern Anal. Mach. Intell. , 43(9):3005–3023, 2020. 1, 2, 7, 8

2020
[19]

Z. Y u, C. Zhao, Z. Wang, Y . Qin, Z. Su, X. Li, F. Zhou, and G. Zhao. Searching central difference convolutional ne t- works for face anti-spooﬁng. Proc. IEEE/CVF Conf. Com- put. Vis. Pattern Recog., pages 5295–5305, 2020. 2, 7, 8

2020
[20]

Zheng, B

T. Zheng, B. Li, S. Wu, B. Wan, G. Mu, S. Liu, S. Ding, and J. Wang. MFAE: Masked frequency autoencoders for domain generalization face anti-spooﬁng. IEEE Trans. Inf. F orensics Secur ., pages 4058–4069, 2024. 1, 7, 8 9

2024

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.

[1] [1]

Boulkenafet, J

Z. Boulkenafet, J. Komulainen, L. Li, X. Feng, and A. Hadi d. OULU-NPU: A mobile face presentation attack database with real-world variations. Proc. IEEE Int’l Conf. Automatic Face Gesture Recog., pages 612–618, 2017. 2, 5

work page 2017

[2] [2]

R. Cai, C. Soh, Z. Y u, H. Li, W. Yang, and A. Kot. Towards data-centric face anti-spooﬁng: Improving cross- domain generalization via physics-based data synthesis. Int’l J. Comput. Vis., pages 1–22, 2024. 2, 3, 5, 7

work page 2024

[3] [3]

X. Chen, Y . Jia, and Y . Wu. Fine-grained annotation for fa ce anti-spooﬁng. CoRR, abs/2310.08142, 2023. 1, 2, 7, 8

arXiv 2023

[4] [4]

Defard, A

T. Defard, A. Setkov, A. Loesch, and R. Audigier. PaDiM: A patch distribution modeling framework for anomaly de- tection and localization. Proc. ICPR Int’l W orkshops and Challenges, pages 475–489, 2021. 2, 3

work page 2021

[5] [5]

Dosovitskiy, L

A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenborn, X. Zhai, T. Unterthiner, M. Dehghani, M. Minderer, G. Heigold, S. Gelly, J. Uszkoreit, and N. Houlsby. An image is worth 16x16 words: Transformers for image recognition at scale. Proc. Int’l Conf. Learn. Represent. , 2021. 1, 2, 3, 5

work page 2021

[6] [6]

Kirillov, E

A. Kirillov, E. Mintun, N. Ravi, H. Mao, C. Rolland, L. Gustafson, T. Xiao, S. Whitehead, A. C. Berg, W.-Y . Lo, and R. Girshick. Segment anything. Proc. IEEE/CVF Int’l Conf. Comput. Vis., pages 4015–4026, 2023. 2

work page 2023

[7] [7]

D. Li, G. Chen, X. Wu, Z. Y u, and M. Tan. Face anti- spooﬁng with cross-stage relation enhancement and spoof material perception. Neural Networks , 175:106275, 2024. 1, 7, 8

work page 2024

[8] [8]

Li and A

S. Li and A. Jain. Handbook of Face Recognition. Springer,