Pith. sign in

REVIEW 3 major objections 4 minor 67 references

Foundation Models for Face Presentation Attack Detection: A Unified Linear-Probing Benchmark

T0 review · 3 major / 4 minor · reviewed 2026-08-01 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper establishes that frozen foundation-model encoders carry linearly readable face-spoof information that does not transfer across datasets, and that the best transfer per compute is a small vision-language encoder, not the largest mo

desk verdict Frozen features work intra-dataset but not cross-dataset — that robust finding stands; the specific rankings and trade-off winner rest on single runs with no uncertainty, so they're provisional. read the letter →

arxiv 2607.26993 v2 pith:XOADSQDS submitted 2026-07-29 cs.LG

Peter Lorenz , Anjith George , Sébastien Marcel This is my paper
classification cs.LG
keywords facepresentationattackdetectionfoundationmodelslinearprobingcross-datasetgeneralizationvisiontransformersCLIPMCIObenchmarkdomainshift
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper asks whether general-purpose vision foundation models, frozen and probed with only a single trainable linear layer, already encode enough information to detect face presentation attacks, and whether that knowledge survives a change of dataset. Across 24 encoders and the four MCIO corpora, it finds the first point holds: several frozen backbones reach single-digit average in-dataset error, with the 6B InternViT-6B at 1.6% mean ACER. The second point fails: cross-dataset error remains high for nearly every model, and the best transfer-per-compute model is a much smaller vision-language encoder, CLIP ViT-B/32, at 31.6% mean off-diagonal ACER. The paper concludes that pretrained representations contain PAD-relevant cues but explicit adaptation is still needed to handle domain shift.

What carries the argument

The mechanism is a frozen-backbone linear probe: each encoder's global embedding (CLS token, post-layer-norm CLS, average pooling, contrastive embedding, or mean-pooled patches) is fed to one trainable fully-connected layer trained with binary cross-entropy, and performance is measured as ACER with a development-split threshold. The same protocol is applied to every backbone so that family, scale, and pretraining objective are the only variables. The diagonal (same-corpus) versus off-diagonal (cross-corpus) split of the sixteen source-target MCIO pairs is the measuring device that separates in-domain separability from transfer.

What would settle it

Take the paper's own off-diagonal ACER matrices (Appendix D, Tables 7–10) and recompute the rankings with a paired bootstrap across the twelve source-target pairs: if CLIP ViT-B/32's 31.6% mean is not separated from CLIP ViT-L/14's 34.0% or InternViT-6B's 32.0% at a reasonable bootstrap interval, the headline transfer-compute ordering is unsupported. A stronger check is to rerun the full protocol with multiple seeds per backbone: if InternViT-6B's diagonal-to-off-diagonal gap of 30.3 points overlaps zero, the claim that frozen representations are corpus-specific rather than globally spoof-inva

Watch

Extended reading notes

Core claim

The central discovery is that spoof-related cues are linearly decodable from frozen pretrained representations, yet that linear separability is largely tied to the training corpus. The paper establishes this with a homogeneous linear-probing protocol: 24 encoders, one trainable fully-connected layer, the same threshold rule, and the same four MCIO datasets. InternViT-6B reaches a 1.6% mean intra-dataset ACER with roughly three thousand trainable weights, while CLIP ViT-B/32—about sixty times smaller—offers the strongest transfer per compute at 31.6% mean off-diagonal ACER. The diagonal-versus-off-diagonal contrast, a 30.3-point gap for InternViT-6B, is the paper's key evidence that frozen re

Load-bearing premise

The load-bearing premise is that each reported ACER is a stable estimate of that model's ability; the paper gives single runs with no seeds or confidence intervals, so the small gaps that decide the ranking—such as CLIP ViT-B/32 at 31.6% versus CLIP ViT-L/14 at 34.0% mean off-diagonal ACER, and the non-monotonic scale effects in Table 5—could be noise; this enters at Section 4.4 where the transfer-compute trade-off is decided.

Editorial extensions

If this is right

  • Several frozen foundation encoders can serve as PAD feature extractors with only a linear head, so competitive single-dataset PAD does not require task-specific end-to-end training.
  • A strong in-domain PAD score should not be read as evidence of robustness; the large diagonal-versus-off-diagonal gap shows deployment must budget for domain shift.
  • At a similar inference budget, a web-scale contrastive encoder (CLIP ViT-B/32) transfers better than a task-trained specialist (DeepPixBiS) at comparable GFLOPs, suggesting pretraining data matters more than task-specific training for cross-dataset robustness.
  • Pretraining objective matters at least as much as scale: self-distillation and vision-language objectives (DINO, BEiT, CLIP, SigLIP) dominate reconstruction- and prototype-based objectives (ViT-MAE, ViT-MSN) at comparable sizes.
  • Explicit adaptation, such as fine-tuning or more capable readouts, remains necessary to close cross-dataset gaps, since frozen linear readouts cap transfer.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial: the coarse-patch advantage of CLIP ViT-B/32 over CLIP ViT-L/14 and ViT-H/14 suggests a testable mechanism: larger patches act as an implicit low-pass filter that discards acquisition-specific texture, acting as built-in domain randomization; this could be verified by probing patch-size variants matched in pretraining data.
  • Editorial: because the paper only uses single-source training, the rankings may not survive multi-source protocols such as leave-one-out; adding source diversity could change which backbones win, which a reader can test by rerunning the same probes under LOO or limited-source-domain protocols.
  • Editorial: since frozen linear probes are a lower bound, the gap table provides per-backbone headroom estimates; for instance, InternViT-6B's 30-point gap predicts that task-specific adaptation methods should yield large gains, and fine-tuning experiments can test that prediction directly.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. This paper benchmarks 24 frozen vision encoders (CLIP, DINOv2/v3, BEiT, SigLIP, MAE, MSN, ConvNeXt-V2, Qwen2.5-VL, InternViT, EVA-CLIP) under a unified linear-probing protocol on the MCIO face PAD datasets. It reports intra-dataset and cross-dataset ACER, aggregate ACER_all/ACER_cross, and FLOP-accuracy trade-offs against fully trained specialist baselines (DeepPixBiS, FSFM-FAS). The central claims are that frozen representations contain PAD-relevant information accessible by a linear head (InternViT-6B reaches 1.6% mean intra-dataset ACER), that cross-dataset transfer is markedly worse for all models, and that CLIP ViT-B/32 offers the best cross-dataset transfer-compute trade-off.

Significance. If the quantitative claims hold, this is a useful reference benchmark: it standardizes the probe, uses a wide model zoo, and cleanly separates representation quality from adaptation. The robust qualitative finding—that single-source linear probes transfer poorly across MCIO domains—is well supported by the full matrices in Appendix D. The effort to compare frozen features across many families is valuable for the PAD community. However, the headline ordering and trade-off claims need additional statistical support before being accepted.

major comments (3)
  1. [§4.4, Table 5, Fig. 3] All headline rankings are single-run point estimates. The transfer-compute conclusion hinges on off-diagonal ACER differences of 0.4 pp (CLIP ViT-B/32 31.6 vs InternViT-6B 32.0) and ACER_all differences of 1.4 pp (26.8 vs 28.2). Within-family scale comparisons are even closer (CLIP L/14 10.6 vs H/14 10.5; DINOv2-giant 8.4 vs registers-giant 8.6). The training protocol (Adam, WeightedRandomSampler, early stopping with patience 8) is stochastic, so these margins are within plausible run-to-run variation. I recommend reporting at least 3–5 seeds with mean±std and, if feasible, paired significance tests, or restricting the abstract and conclusions to qualitative claims. This is load-bearing because the abstract's 'most favorable trade-off' and the non-monotonic scale claim depend on these numbers.
  2. [§4.4, Conclusion] The explanation that coarser 32x32 patch tokenisation trades intra-dataset separability for cross-dataset robustness is presented as a plausible conclusion, but CLIP B/32 vs L/14 vs H/14 differ in capacity, depth, and pretraining details as well as patch size. This is not a controlled comparison. Please label this explicitly as a hypothesis, or add a controlled study that varies patch size while holding the pretraining recipe fixed. As written, the claim over-interprets the single-run ordering.
  3. [§4.1, Eq. (1)] The cross-dataset protocol should state explicitly which development split is used to select the operating threshold. If the target dataset's dev split is used for each train/test pair, that introduces target-label information into a transfer claim; if the source dev split is used, say so. Also clarify whether ACER is computed per frame or after video-level fusion, since up to 20 frames per video are sampled. These choices affect the comparability of every reported number.
minor comments (4)
  1. [§4.3 vs Table 3] The text states that the InternVL-14B zero-shot model averages 28.8% ACER, but Table 3 reports 35.3% (mean of 38.4, 14.4, 48.8, 39.6). Please reconcile.
  2. [Table 3] Baseline parameter units are inconsistent: DeepPixBiS is said in §4.3 to have ~3M trainable weights, but the table entry reads '3×10^3'; FSFM-FAS ViT-B/16 reads '86×10^3', which would be 86k, not ~86M. Rewrite the parameter column for fully trainable baselines or explain the unit convention clearly.
  3. [Availability] The abstract says code and evaluation protocols will be publicly released, but no link or anonymous repository is included in the submission. For a benchmark paper, include a reproducibility artifact or a detailed evaluation checklist at submission time.
  4. [§4.1] Minor wording: 'offering and the strongest sensor diversity' should read 'offering the strongest sensor diversity'.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the paper is an empirical benchmark whose aggregations are defined from measured ACER values, and its conclusions do not rest on author self-citations.

full rationale

This paper makes no mathematical derivation that could reduce to its own inputs. The central procedure is fixed-backbone linear probing on four external MCIO datasets, with ACER computed from held-out test samples using a dev-set threshold. Claims such as 'InternViT-6B achieves the lowest mean intra-dataset error' and 'CLIP ViT-B/32 offers the most favorable cross-dataset transfer-compute trade-off' are direct summaries of measured values in Tables 3-5; Eqs. (2)-(3) and Gap=CD-ID are definitions of aggregates, not fitted predictions. No parameter is fit to a subset and then called a prediction of the same subset: the linear head is trained on the train split, evaluated on the test split, and the threshold is tuned on the dev split and applied to the test split. The only self-citations (DeepPixBiS baseline and Bob metric library, both by the authors) are used as contextual baselines/tooling, not to justify the load-bearing claim that frozen representations contain PAD information; removing them would not affect that claim. The single-run/no-confidence-interval issue highlighted by the skeptical reader concerns statistical uncertainty in rankings, which is a correctness or robustness concern, not circularity. Therefore no circular step is present; the modest score reflects only minor non-load-bearing self-citations rather than any circular reduction.

Assumptions & free parameters 2 free parameters · 3 assumptions · 0 invented entities

No new physical or mathematical entities are introduced; the central claims rest on standard dataset assumptions, hand-chosen probe hyperparameters, and dev-set threshold tuning.

free parameters (2)
  • operating threshold tau = varies per model/source pair
    All reported ACER values are evaluated at a threshold tuned on the development split by minimizing the EER criterion; a standard protocol, but a fitted quantity that affects every number.
  • probe training hyperparameters = lr=1e-4, wd=1e-6, batch=64, patience=8, min 5 epochs
    Chosen by hand rather than swept; they could affect the relative ranking of models, especially when ACER differences are small.
assumptions (3)
  • domain assumption Frame-level i.i.d. evaluation is a valid proxy for PAD performance.
    Up to 20 frames are sampled per video and treated independently; no video-level aggregation or temporal modeling is used. Section 4.1.
  • domain assumption MCIO train/dev/test splits contain no identity or device leakage.
    The paper relies on standard MCIO protocols and does not audit frame-level splits for overlap; leakage would inflate intra-dataset results.
  • domain assumption Pretraining data of foundation models does not contain the MCIO test images.
    No leakage audit is reported for CLIP, DINOv2, InternViT, or other web-scale pretraining corpora; unrecognized leakage would affect the claim that PAD-relevant information is genuinely encoded.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Foundation Models for Face Presentation Attack Detection: A Unified Linear-Probing Benchmark." pith.science (2026). https://pith.science/paper/XOADSQDS

@misc{pith2026260726993,
  author       = {Pith},
  title        = {Pith review of: Foundation Models for Face Presentation Attack Detection: A Unified Linear-Probing Benchmark},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/XOADSQDS}},
  note         = {Machine review of arXiv:2607.26993}
}
read the original abstract

Face presentation attack detection (PAD) remains challenging under cross-dataset evaluation, where domain shift degrades models trained on a single dataset. The scarcity of large-scale labeled data motivates adapting pretrained vision models rather than training task-specific architectures from scratch, raising a fundamental question: do general-purpose vision foundation models encode PAD-relevant information accessible with minimal task-specific training? To investigate, we systematically evaluate 24 frozen encoders, including self-supervised vision transformers, vision-language encoders, and supervised CNNs, using a unified linear-probing protocol on the MCIO benchmark (MSU-MFSD, CASIA-FASD, Replay-Attack, OULU-NPU). The backbone remains fixed, and only a lightweight linear head is trained to isolate the PAD information already present in the pretrained representation. Results show that frozen foundation-model representations can support strong intra-dataset PAD performance with only a linear classifier, but this performance does not reliably transfer across datasets. Model scale is beneficial within several families, although the effect is not monotonic and is strongly mediated by architecture and pretraining. InternViT-6B achieves the lowest mean intra-dataset error, whereas CLIP ViT-B/32 offers the most favorable cross-dataset transfer-compute trade-off among the evaluated probes. These findings suggest that while pretrained representations contain PAD-relevant information, explicit adaptation remains necessary to address domain shift.

Figures

Figures reproduced from arXiv: 2607.26993 by the authors.

Figure 1
Figure 1. Overview of the linear probing for binary detection: A [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Examples face crops with the MTCNN detector [ [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Comparison of the overall classification performance (intra-dataset and cross-dataset transfer measured in [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: t-distributed stochastic neighbor embedding (t-SNE) of [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: Combined summary [PITH_FULL_IMAGE:figures/full_fig_p013_5.png]
Figure 7
Figure 7. Figure 7: t-SNE are in fig. 4. UMAP of frozen CLS embeddings (MCIO test samples, all corpora pooled; colored by dataset). (a) CLIP ViT-B/32 (b) CLIP ViT-L/14 (c) CLIP ViT-B/32 (d) CLIP ViT-L/14 [PITH_FULL_IMAGE:figures/full_fig_p017_7.png]
Figure 8
Figure 8. Figure 8: Top: t-SNE of frozen CLS embeddings (MCIO test samples, all corpora pooled; colored by dataset). Bottom: corresponding [PITH_FULL_IMAGE:figures/full_fig_p017_8.png]

Review history (2 revisions) →

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

67 extracted references · 8 linked inside Pith

  1. [1]

    Andre, E

    A. Andre, E. S. Laurant, W. Roy, G. Manuel, M. Chris, and S. Marcel. Bob: a free signal processing and machine learning toolbox for researchers. In20th ACM Conference on Multimedia Systems (ACMMM), Oct. 2012

    2012

  2. [2]

    Continuouslyreproducingtoolchains in pattern recognition and machine learning experi- ments

    A.Andre,G.Manuel,d.F.P.Tiago,K.Pavel,M.Amir, andM.Sebastian. Continuouslyreproducingtoolchains in pattern recognition and machine learning experi- ments. InInternational Conference on Machine Learn- ing (ICML), Aug. 2017

    2017

  3. [3]

    Assran, M

    M. Assran, M. Caron, I. Misra, P. Bojanowski, F. Bor- des, P. Vincent, A. Joulin, M. Rabbat, and N. Ballas. Masked siamese networks for label-efficient learning. InEuropean conference on computer vision, pages 456–473. Springer, 2022

    2022

  4. [4]

    J.Bai,S.Bai,Y.Chu,Z.Cui,K.Dang,X.Deng,Y.Fan, W. Ge, Y. Han, F. Huang, et al. Qwen technical report. arXiv preprint arXiv:2309.16609, 2023

    arXiv 2023

  5. [5]

    H. Bao, L. Dong, S. Piao, and F. Wei. Beit: Bert pre-training of image transformers.arXiv preprint arXiv:2106.08254, 2021

    arXiv 2021

  6. [6]

    Boulkenafet, J

    Z. Boulkenafet, J. Komulainen, L. Li, X. Feng, and A. Hadid. Oulu-npu: A mobile face presentation attack databasewithreal-worldvariations. In201712thIEEE international conference on automatic face & gesture recognition (FG 2017), pages 612–618. IEEE, 2017

    2017

  7. [7]

    Boutros, N

    F. Boutros, N. Damer, F. Kirchbuchner, and A. Kui- jper. Elasticface: Elastic margin loss for deep face recognition. InProceedings of the IEEE/CVF confer- enceoncomputervisionandpatternrecognition,pages 1578–1587, 2022

    2022

  8. [8]

    Towards data-centric face anti-spoofing: Improving cross-domain generalization via physics-based data synthesis.International Journal of Computer Vision, pages 1–22, 2024

    R.Cai,C.-Y.Soh,Z.Yu,H.Li,W.Yang,andA.C.Kot. Towards data-centric face anti-spoofing: Improving cross-domain generalization via physics-based data synthesis.International Journal of Computer Vision, pages 1–22, 2024

    2024

Show all 67 references
  1. [9]

    Cao and C

    J. Cao and C. Ma. Towards generalized face anti- spoofing from a frequency shortcut view. In2025 IEEE/CVF Winter Conference on Applications of Com- puter Vision (WACV), pages 1005–1015. IEEE, 2025

    2025

  2. [10]

    Q. Cao, L. Shen, W. Xie, O. M. Parkhi, and A. Zis- serman. Vggface2: A dataset for recognising faces across pose and age. In2018 13th IEEE international conference on automatic face & gesture recognition (FG 2018), pages 67–74. IEEE, 2018

    2018

  3. [11]

    Z. Chen, W. Wang, Y. Cao, Y. Liu, Z. Gao, E. Cui, J. Zhu, S. Ye, H. Tian, Z. Liu, et al. Expanding performance boundaries of open-source multimodal models with model, data, and test-time scaling.arXiv preprint arXiv:2412.05271, 2024

    2024 arXiv

  4. [12]

    Z. Chen, J. Wu, W. Wang, W. Su, G. Chen, S. Xing, M. Zhong, Q. Zhang, X. Zhu, L. Lu, et al. InternVL: Scaling up vision foundation models and aligning for generic visual-linguistic tasks. InProceedings of the IEEE/CVFConferenceonComputerVisionandPattern Recognition, pages 2418...

    2024

  5. [13]

    Z. Chen, T. Yao, K. Sheng, S. Ding, Y. Tai, J. Li, F. Huang, and X. Jin. Generalizable representation learning for mixture domain face anti-spoofing. In AAAI, pages 1132–1139. AAAI Press, 2021

    2021

  6. [14]

    A.Costa-Pazo,S.Bhattacharjee,E.Vazquez-Fernandez, and S. Marcel. The replay-mobile face presentation- attack database. In2016 international conference of the Biometrics Special Interest Group (BIOSIG), pages 1–7. IEEE, 2016

    2016

  7. [15]

    Darcet, M

    T. Darcet, M. Oquab, J. Mairal, and P. Bojanowski. Vision transformer needs registers. InInternational Conference on Learning Representations, 2024

    2024

  8. [16]

    J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei. Imagenet: A large-scale hierarchical image database. In2009 IEEE conference on computer vision and pattern recognition, pages 248–255. Ieee, 2009

    2009

  9. [17]

    J. Deng, J. Guo, N. Xue, and S. Zafeiriou. Arcface: Additive angular margin loss for deep face recognition. InProceedings of the IEEE/CVF conference on com- putervisionandpatternrecognition, pages4690–4699, 2019

    2019

  10. [18]

    Fang and N

    M. Fang and N. Damer. Face presentation attack detec- tionbyexcavatingcausalcluesandadaptingembedding statistics. InProceedingsoftheIEEE/CVFWinterCon- ference on Applications of Computer Vision, pages 6269–6279, 2024

    2024

  11. [19]

    M. Fang, N. Damer, F. Kirchbuchner, and A. Kuijper. Learnable multi-level frequency decomposition and hierarchical attention mechanism for generalized face presentation attack detection. InIEEE/CVF WACV, Waikoloa, HI, USA, January 3-8, 2022, pages 1131–

    2022

  12. [20]

    M. Fang, N. Damer, F. Kirchbuchner, and A. Kuijper. Realmasksandspooffaces: Onthemaskedfacepresen- tation attack detection.Pattern Recognit., 123:108398, 2022

    2022

  13. [21]

    M. Fang, M. Huber, and N. Damer. Synthaspoof: Developing face presentation attack detection based on privacy-friendly synthetic data. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 1061–1070, 2023

    2023

  14. [22]

    M. Feng, P. Gallin-Martel, K. Ito, and T. Aoki. Benchmarking vision foundation models for domain- generalizable face anti-spoofing. InProceedings of the IEEE/CVFConferenceonComputerVisionandPattern Recognition, pages 1567–1576, 2026

    2026

  15. [23]

    George and S

    A. George and S. Marcel. Deep pixel-wise binary supervision for face presentation attack detection. In 2019 international conference on biometrics (ICB), pages 1–8. IEEE, 2019

    2019

  16. [24]

    L. J. Gonzalez-Soler, J. E. Tapia, and C. Busch. Are foundation models all you need for zero-shot face pre- sentation attack detection? In2025 IEEE 19th Inter- national Conference on Automatic Face and Gesture Recognition (FG), pages 1–10. IEEE, 2025

    2025

  17. [25]

    X. Guo, Y. Liu, A. Jain, and X. Liu. Multi-domain learning for updating face anti-spoofing models. In ECCV, 2022

    2022

  18. [26]

    Masked autoencoders are scalable vision learners

    K.He,X.Chen,S.Xie,Y.Li,P.Dollár,andR.Girshick. Masked autoencoders are scalable vision learners. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 16000–16009, 2022

    2022

  19. [27]

    E. J. Hu, Y. Shen, P. Wallis, Z. Allen-Zhu, Y. Li, S. Wang, L. Wang, W. Chen, et al. Lora: Low-rank adaptation of large language models.Iclr, 1(2):3, 2022

    2022

  20. [28]

    Adam, and M.-H

    H.-P.Huang,D.Sun,Y.Liu,W.-S.Chu,T.Xiao,J.Yuan, H. Adam, and M.-H. Yang. Adaptive transformers for robust few-shot cross-domain face anti-spoofing. In European conference on computer vision, pages 37–54. Springer, 2022

    2022

  21. [29]

    ISO/IECDIS30107-3:2016: InformationTechnology– Biometric presentation attack detection – P

    International Organization for Standardization. ISO/IECDIS30107-3:2016: InformationTechnology– Biometric presentation attack detection – P. 3: Testing and reporting, 2017

    2016

  22. [30]

    Y. Jia, J. Zhang, S. Shan, and X. Chen. Single-side domain generalization for face anti-spoofing. InCVPR, pages8481–8490.ComputerVisionFoundation/IEEE, 2020

    2020

  23. [31]

    Kirillov, E

    A. Kirillov, E. Mintun, N. Ravi, H. Mao, C. Rolland, L. Gustafson, T. Xiao, S. Whitehead, A. C. Berg, W.- Y. Lo, et al. Segment anything. InProceedings of the IEEE/CVF International Conference on Computer Vision, pages 4015–4026, 2023

    2023

  24. [32]

    Unsupervised domain adaptation for face anti-spoofing

    H.Li,W.Li,H.Cao,S.Wang,F.Huang,andA.C.Kot. Unsupervised domain adaptation for face anti-spoofing. IEEE Trans. Inf. Forensics Secur., 13(7):1794–1809, 2018

    2018

  25. [33]

    Z. Li, T. Zhao, X. Xu, Z. Zhang, Z. Li, X. Chen, Q.Zhang,A.Bergamo,A.K.Jain,andY.Xing.Optimal transport-guided source-free adaptation for face anti- spoofing. InProceedings of the Computer Vision and Pattern Recognition Conference, pages 24351–24363, 2025

    2025

  26. [34]

    Lin, Y.-W

    K.-H. Lin, Y.-W. Tseng, K.-Y. Huang, J.-C. Wu, and W.-H. Cheng. Instructflip: Exploring unified vision- language model for face anti-spoofing. InProceedings of the 33rd ACM International Conference on Multime- dia, pages 2987–2996, 2025

    2025

  27. [35]

    Cfpl-fas: Classfreepromptlearning for generalizable face anti-spoofing

    A.Liu,S.Xue,J.Gan,J.Wan,Y.Liang,J.Deng,S.Es- calera,andZ.Lei. Cfpl-fas: Classfreepromptlearning for generalizable face anti-spoofing. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 222–232, 2024

    2024

  28. [36]

    Y. Liu, Y. Chen, W. Dai, C. Li, J. Zou, and H. Xiong. Causalinterventionforgeneralizablefaceanti-spoofing. InICME, pages 1–6. IEEE, 2022

    2022

  29. [37]

    Learningdeepmodels for face anti-spoofing: Binary or auxiliary supervision

    Y.Liu,A.Jourabloo,andX.Liu. Learningdeepmodels for face anti-spoofing: Binary or auxiliary supervision. InCVPR, pages 389–398. IEEE Computer Society, 2018

    2018

  30. [38]

    Oquab, T

    M. Oquab, T. Darcet, T. Moutakanni, H. Vo, M. Szafraniec, V. Khalidov, P. Fernandez, D. Haziza, F. Massa, A. El-Nouby, et al. Dinov2: Learning robust visual features without supervision.arXiv preprint arXiv:2304.07193, 2023

    2023 arXiv

  31. [39]

    Foundationmodels and biometrics: A survey and outlook.IEEE Transac- tions on Information Forensics and Security, 2025

    H.OtroshiShahrezaandS.Marcel. Foundationmodels and biometrics: A survey and outlook.IEEE Transac- tions on Information Forensics and Security, 2025

    2025

  32. [40]

    Ozgur, E

    G. Ozgur, E. Caldeira, T. Chettaoui, F. Boutros, R. Ra- machandra, and N. Damer. Foundpad: Foundation models reloaded for face presentation attack detection. InProceedings of the Winter Conference on Applica- tions of Computer Vision, pages 745–755, 2025

    2025

  33. [41]

    Pasmino, C

    D. Pasmino, C. Aravena, J. E. Tapia, and C. Busch. Flickr-pad: New face high-resolution presentation at- tack detection database. In2023 11th International Workshop on Biometrics and Forensics (IWBF), pages 1–6. IEEE, 2023

    2023

  34. [42]

    Patel, H

    K. Patel, H. Han, and A. K. Jain. Secure face unlock: Spoofdetectiononsmartphones.IEEEtransactionson information forensics and security, 11(10):2268–2283, 2016

    2016

  35. [43]

    Agarwal, G

    A.Radford,J.W.Kim,C.Hallacy,A.Ramesh,G.Goh, S. Agarwal, G. Sastry, A. Askell, P. Mishkin, J. Clark, et al. Learning transferable visual models from natural language supervision. InInternational conference on machine learning, pages 8748–8763. PmLR, 2021

    2021

  36. [44]

    Multi-adversarial discriminative deep domain generalization for face presentation attack detection

    R.Shao,X.Lan,J.Li,andP.C.Yuen. Multi-adversarial discriminative deep domain generalization for face presentation attack detection. InCVPR, pages 10023– 10031. Computer Vision Foundation / IEEE, 2019

    2019

  37. [45]

    R. Shao, X. Lan, and P. C. Yuen. Regularized fine- grainedmetafaceanti-spoofing. InAAAI,pages11974– 11981. AAAI Press, 2020

    2020

  38. [46]

    Siméoni, H

    O. Siméoni, H. V. Vo, M. Seitzer, F. Baldassarre, M. Oquab, C. Jose, V. Khalidov, M. Szafraniec, S. Yi, M. Ramamonjisoa, et al. Dinov3.arXiv preprint arXiv:2508.10104, 2025

    2025 arXiv

  39. [47]

    Srivatsan, M

    K. Srivatsan, M. Naseer, and K. Nandakumar. Flip: Cross-domain face anti-spoofing with language guid- ance. InProceedings of the IEEE/CVF international conference on computer vision, pages 19685–19696, 2023

    2023

  40. [48]

    Eva-clip: Improved training techniques for clip at scale.arXiv preprint arXiv:2303.15389, 2023

    Q.Sun,Y.Fang,L.Wu,X.Wang,andY.Cao. Eva-clip: Improved training techniques for clip at scale.arXiv preprint arXiv:2303.15389, 2023

    2023 arXiv

  41. [49]

    C. Wang, Y. Lu, S. Yang, and S. Lai. Patchnet: A simple face anti-spoofing framework via fine-grained patchrecognition. InCVPR,pages20249–20258.IEEE, 2022

    2022

  42. [50]

    G. Wang, H. Han, S. Shan, and X. Chen. Improving cross-database face presentation attack detection via adversarial domain adaptation. InICB, pages 1–8. IEEE, 2019

    2019

  43. [51]

    G. Wang, F. Lin, T. Wu, Z. Liu, Z. Ba, and K. Ren. Fsfm: A generalizable face security foundation model via self-supervised facial representation learning. In ProceedingsoftheComputerVisionandPatternRecog- nition Conference, pages 24364–24376, 2025

    2025

  44. [52]

    Z. Wang, Q. Wang, W. Deng, and G. Guo. Face anti-spoofing using transformers with relation-aware mechanism.IEEE Trans. Biom. Behav. Identity Sci., 4(3):439–450, 2022

    2022

  45. [53]

    Spoofingattackdetec- tioninfacerecognitionsystemusingvisiontransformer with patch-wise data augmentation

    K.Watanabe,K.Ito,andT.Aoki. Spoofingattackdetec- tioninfacerecognitionsystemusingvisiontransformer with patch-wise data augmentation. InAsia-Pacific Signal and Information Processing Association Annual Summit and Conference, pages 1561–1565, 2022

    2022

  46. [54]

    D. Wen, H. Han, and A. K. Jain. Face spoof detection with image distortion analysis.IEEE Transactions on Information Forensics and Security, 10(4):746–761, 2015

    2015

  47. [55]

    Googleland- marks dataset v2-a large-scale benchmark for instance- level recognition and retrieval

    T.Weyand,A.Araujo,B.Cao,andJ.Sim. Googleland- marks dataset v2-a large-scale benchmark for instance- level recognition and retrieval. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 2575–2584, 2020

    2020

  48. [56]

    S.Woo,S.Debnath,R.Hu,X.Chen,Z.Liu,I.S.Kweon, and S. Xie. Convnext v2: Co-designing and scaling convnets with masked autoencoders. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 16133–16142, 2023

    2023

  49. [57]

    W. Yan, Y. Zeng, and H. Hu. Domain adversarial disentanglement network with cross-domain synthesis forgeneralizedfaceanti-spoofing.IEEETrans.Circuits Syst. Video Technol., 32(10):7033–7046, 2022

    2022

  50. [58]

    A. Yang, A. Li, B. Yang, B. Zhang, B. Hui, B. Zheng, B.Yu,C.Gao,C.Huang,C.Lv,etal. Qwen3technical report.arXiv preprint arXiv:2505.09388, 2025

    2025 arXiv

  51. [59]

    J.Yang,X.Lin,Z.Yu,L.Zhang,X.Liu,H.Li,X.Yuan, and X. Cao. Dadm: Dual alignment of domain and modality for face anti-spoofing. InProceedings of the IEEE/CVF International Conference on Computer Vision, pages 12045–12056, 2025

    2025

  52. [60]

    Z. Yu, X. Li, J. Shi, Z. Xia, and G. Zhao. Revisiting pixel-wise supervision for face anti-spoofing.IEEE Trans. Biom. Behav. Identity Sci., 3(3):285–295, 2021

    2021

  53. [61]

    Z. Yu, J. Wan, Y. Qin, X. Li, S. Z. Li, and G. Zhao. NAS-FAS: static-dynamic central difference network searchforfaceanti-spoofing.IEEETrans.PatternAnal. Mach. Intell., 43(9):3005–3023, 2021

    2021

  54. [62]

    X. Zhai, A. Kolesnikov, N. Houlsby, and L. Beyer. Scaling vision transformers. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 12104–12113, 2022

    2022

  55. [63]

    X. Zhai, B. Mustafa, A. Kolesnikov, and L. Beyer. Sigmoid loss for language image pre-training. InPro- ceedings of the IEEE/CVF international conference on computer vision, pages 11975–11986, 2023

    2023

  56. [64]

    Zhang, K

    G. Zhang, K. Wang, H. Yue, A. Liu, G. Zhang, K. Yao, E. Ding, and J. Wang. Interpretable face anti-spoofing: Enhancing generalization with multimodal large lan- guage models. InProceedings of the AAAI Conference on Artificial Intelligence, 2025

    2025

  57. [65]

    Zhang, Z

    K. Zhang, Z. Zhang, Z. Li, and Y. Qiao. Joint face detection and alignment using multitask cascaded con- volutional networks.IEEE Signal Processing Letters, 23(10):1499–1503, 2016

    2016

  58. [66]

    Zhang, Z

    Y. Zhang, Z. Yin, Y. Li, G. Yin, J. Yan, J. Shao, and Z. Liu. Celeba-spoof: Large-scale face anti-spoofing dataset with rich annotations. InEuropean conference on computer vision, pages 70–85. Springer, 2020

    2020

  59. [67]

    J. Zhou, C. Wei, H. Wang, W. Shen, C. Xie, A. Yuille, and T. Kong. ibot: Image BERT pre-training with online tokenizer.arXiv preprint arXiv:2111.07832, 2021. A. ACER metric definitions We follow ISO/IEC 30107-3 [29] and standard PAD prac- tice[36,19,18]. Labelsarebonafide( 𝑦=1...

    2021 arXiv

Pith tools

Reviewed August 1, 2026 · model on record in the stance chip above.