Face Presentation Attack Detection via Content-Adaptive Spatial Operators

Shujaat Khan

cs.CVFeb 21, 2026

Face Presentation Attack Detection via Content-Adaptive Spatial Operators

Authors: Shujaat Khan

Organizations: Department of Computer Engineering, College of Computing and Mathematics, King Fahd University of Petroleum & Minerals, Dhahran, 31261, Saudi Arabia · SDAIA–KFUPM Joint Research Center for Artificial Intelligence, King Fahd University of Petroleum & Minerals, Dhahran, 31261, Saudi Arabia

Abstract

Face presentation attack detection (FacePAD) is critical for securing facial authentication against print, replay, and mask-based spoofing. This paper proposes CASO-PAD, an RGB-only, single-frame model that enhances MobileNetV3 with content-adaptive spatial operators (involution) to better capture localized spoof cues. Unlike spatially shared convolution kernels, the proposed operator generates location-specific, channel-shared kernels conditioned on the input, improving spatial selectivity with minimal overhead. CASO-PAD remains lightweight (3.6M parameters; 0.64 GFLOPs at $256\times256$ ) and is trained end-to-end using a standard binary cross-entropy objective. Extensive experiments on Replay-Attack, Replay-Mobile, ROSE-Youtu, and OULU-NPU demonstrate strong performance, achieving 100/100/98.9/99.7% test accuracy, AUC of 1.00/1.00/0.9995/0.9999, and HTER of 0.00/0.00/0.82/0.44%, respectively. On the large-scale SiW-Mv2 Protocol-1 benchmark, CASO-PAD further attains 95.45% accuracy with 3.11% HTER and 3.13% EER, indicating improved robustness under diverse real-world attacks. Ablation studies show that placing the adaptive operator near the network head and using moderate group sharing yields the best accuracy--efficiency balance. Overall, CASO-PAD provides a practical pathway for robust, on-device FacePAD with mobile-class compute and without auxiliary sensors or temporal stacks.

Figures & tables

Dataset	Release Year	Participants	Authentic / Attack Samples
Replay-Attack [ 24 ]	2012	50	300 / 1000
Replay-Mobile [ 25 ]	2016	40	550 / 640
OULU-NPU [ 26 ]	2017	55	990 / 3,960
ROSE-Youtu [ 27 ]	2018	20	1000 / 2350
SiW-Mv2 [ 28 ]	2022	600	785 / 915

Table 1: Overview of the benchmark datasets used for evaluation.

Figure 1: Sample frames from authentic and spoofed videos in (a) RA, (b) RM, (c) OULU-NPU, (d) RY, and (e) SiW-Mv2 datasets. Genuine samples appear in the top row, while the bottom row shows different attack types.

Figure 2: Illustration of the adaptive center-cropping process used in the pre-processing pipeline. This operation ensures consistent framing and preserves the original aspect ratio across all samples.

Figure 3: Schematic diagram of the proposed content adaptive spatial operator-based deep learning network.

Panel of Table 2 — Table 2: Performance of the proposed method on Replay-Attack (RA), Replay-Mobile (RM), OULU-NPU, ROSE-Youtu (RY), and SiW-Mv2 (Protocol-1) datasets. Results are reported as mean $\pm$ std over 3 runs where applicable.

Method	Year	HTER (%)
EfficientNet-B0 [ 54 ]	2024	36.88
InceptionV4 [ 55 ]	2020	13.54
3D ConvNet [ 56 ]	2023	11.70
SCNN [ 55 ]	2020	7.53
Multi-Block LBP [ 57 ]	2023	6.98
MIQF+SVM [ 58 ]	2022	5.38

Table 3: Replay-Attack (RA): comparison of test HTER (%) sorted from highest (worst) to lowest (best).

Method	Year	HTER (%)
VGG16+GMM [ 37 ]	2021	17.21
GoogLeNet+GMM [ 37 ]	2021	13.56
SMKFNS [ 67 ]	2020	11.88
3D ConvNet [ 56 ]	2023	8.70
MK-SVDD-Slim [ 68 ]	2021	7.60
MKL [ 68 ]	2021	6.70

Table 4: Replay-Mobile (RM): comparison of test HTER (%) sorted from highest (worst) to lowest (best).

Method	Year	APCER / BPCER / ACER (%)
Texture (VAR) [ 71 ]	2021	14.5 / 15.0 / 14.8
ED-LBP (VAR) [ 72 ]	2021	11.3 / 8.4 / 9.9
Fake-Net (VAR) [ 73 ]	2021	5.4 / 6.9 / 6.2
OFT (VAR) [ 74 ]	2022	5.7 / 2.7 / 4.2
UCDCN [ 75 ]	2024	2.6 / 1.01 / 1.82
3DLCN [ 76 ]	2024	1.5 / 0.5 / 1.0

Table 5: OULU-NPU (complete protocol): comparison of test performance sorted by ACER from highest (worst) to lowest (best).

Method	Year	HTER/EER (%)
3D ConvNet [ 56 ]	2023	21.30/-
ResNet50+GMM [ 37 ]	2021	14.69/-
ViViT [ 77 ]	2023	13.28/2.46
EfficientNet-B0 [ 54 ]	2024	9.54/-
FASNet [ 36 ]	2021	8.57/-
Fatemifar et al. [ 78 ]	2022	6.34/-

Table 6: ROSE-Youtu (RY): comparison of test HTER/EER (%) sorted by HTER from highest (worst) to lowest (best). Entries without reported HTER are listed last.

Method	Year	HTER/EER (%)
VGG16 [ 80 ]	2014	10.54/10.45
Spatio-Temporal ( $\tau{=}1$ ) [ 65 ]	2025	6.11/6.63
MobileNetV3 large [ 22 ]	2019	5.93/5.87
Inceptionv3 [ 81 ]	2016	5.77/5.78
Depth-aug. Teacher [ 66 ]	2025	5.82/6.08
ResNet50V2 [ 60 ]	2023	5.18/6.08

Table 7: SiW-Mv2 (Protocol-1): comparison of test HTER/EER (%) sorted by HTER from highest (worst) to lowest (best).

Figure 4: Kernel audit visualization (normalized to $[0,1]$ ). Left: Mean kernel showing directional polarity contrast, resembling an edge-detecting filter. Right: Mean energy distribution, radially compact and indicative of high-pass/edge-emphasizing behavior.

Panel of Figure 5 — Figure 5: Kernel audit overlays on the test set. ( a ) Real faces show higher directional consistency (anisotropy), while ( b ) attack samples exhibit excessive sharpness (higher HF/LF) but weaker organization.

Model	Params (M)	GFLOPs	Youden max $\uparrow$	HTER (%) $\downarrow$
MobileNetV3+GI	3.635	0.643	$0.984\pm 0.004$	$0.82\pm 0.21$
MobileNetV2+GI	3.399	0.932	$0.971\pm 0.006$	$1.43\pm 0.34$

Table 8: Comparison of different MobileNet backbones with proposed GI head on the ROSE-Youtu dataset (reduction ratio

=

4, groups

=

120). Results are reported as mean

\pm

std over 3 runs.

Groups	Params (M)	GFLOPs	Youden $\uparrow$	HTER (%) $\downarrow$
16	3.476	0.623	0.977 $\pm$ 0.004	1.16 $\pm$ 0.19
30	3.497	0.626	0.977 $\pm$ 0.010	1.14 $\pm$ 0.50
60	3.543	0.631	0.972 $\pm$ 0.020	1.41 $\pm$ 1.01
120	3.635	0.643	0.984 $\pm$ 0.004	0.82 $\pm$ 0.21
240	3.818	0.666	0.965 $\pm$ 0.020	1.77 $\pm$ 0.98

Table 9: Ablation over group count (

G

) in the GI head (input size

256\times 256

). Results are mean

\pm

std over 3 runs.

Placement	Params (M)	GFLOPs	Youden max $\uparrow$	HTER (%) $\downarrow$
Beginning	2.975	0.645	$0.968\pm 0.014$	$1.59\pm 0.70$
End	3.635	0.643	$0.984\pm 0.004$	$0.82\pm 0.21$

Table 10: Effect of GI block placement in MobileNetV3 (groups

=120

). Values are mean

\pm

std over 3 runs. GFLOPs measured on

256\times 256

input.

Panel of Table 11 — Table 11: Performance for different input image sizes on the ROSE-Youtu dataset. Mean $\pm$ std over 3 runs.

Reduce	Params (M)	GFLOPs	Youden max $\uparrow$	HTER (%) $\downarrow$
1	5.775	0.919	$0.965\pm 0.028$	$1.75\pm 1.40$
4	3.635	0.643	$0.984\pm 0.004$	$0.82\pm 0.21$
8	3.303	0.600	$0.967\pm 0.016$	$1.65\pm 0.78$

Table 12: Effect of reduction ratio ( reduce

\in\{1,4,8\}

) in the END-placed involution [ 23 ] head (

G{=}120

). Mean

\pm

std over 3 runs.

Figure 7: Trade-off comparison between model complexity and performance. (Left) HTER vs. number of parameters. (Right) HTER vs. GFLOPs.

Method	Jetson Orin Nano Latency (ms)
ShuffleNetV2 [ 82 ]	22.6 $\pm$ 0.6
Once-for-All [ 83 ]	49.36 $\pm$ 0.4
MobileViTV2 [ 85 ]	28.87 $\pm$ 0.8
MobileNetV2 [ 84 ]	19.0 $\pm$ 0.4
MobileNetV3 (large) [ 22 ]	23.17 $\pm$ 0.7
GhostNet [ 86 ]	37.8 $\pm$ 0.2

Table 13: Inference latency comparison on NVIDIA Jetson Orin Nano for input resolution

224\times 224

(CUDA execution).

Figure 8: Grad-CAM [ 87 ] visualizations on genuine and spoof frames from the ROSE-Youtu dataset. The model focuses on discriminative cues such as eyes, lips, and mask edges (best viewed in color).

Lightweight Neural Networks

See all 18 papers

Flow Augmentation and Knowledge Distillation for Lightweight Face Presentation Attack Detection
May 13, 2026Muhammad Shahid Jabbar, Muhammad Sohail Ibrahim, Taha Hasan Masood Siddique +2Face Presentation Attack Detection
SDAIA-KFUPM Joint Research Center for Artificial Intelligence, King Fahd University of Petroleum & Minerals, Dhahran, Saudi Arabia · Interdisciplinary Research Center for Intelligent Secure Systems (IRC-ISS), King Fahd University of Petroleum & Minerals, Dhahran, Saudi Arabia · College of Information Science & Electronic Engineering, Zhejiang University, Hangzhou, China +1
LoRA-based Adaptation Alone Is Not Enough: Understanding the Limits of Foundation Models for Face Presentation Attack Detection
Aug 10, 2026Peter Lorenz, Anjith George, Marcel SébastienVision Foundation Models Vision Foundation Model Adaptation
Idiap Research Institute, Martigny, Switzerland · University of Lausanne (UNIL), Lausanne, Switzerland
Tomatoes, Potatoes, and Onions: Questioning the Need for Faces in Face Presentation Attack Detection
Aug 20, 2026Guray Ozgur, Fadi Boutros, Naser DamerFace Presentation Attack Detection Domain Generalization
Fraunhofer IGD and Department of Computer Science, TU Darmstadt Darmstadt, Germany

May 13, 2026J/K move · Enter open · S save

Flow Augmentation and Knowledge Distillation for Lightweight Face Presentation Attack Detection

Muhammad Shahid Jabbar, Muhammad Sohail Ibrahim, Taha Hasan Masood Siddique, Kejie Huang+1

SDAIA-KFUPM Joint Research Center for Artificial Intelligence, King Fahd University of Petroleum & Minerals, Dhahran, Saudi Arabia · Interdisciplinary Research Center for Intelligent Secure Systems (IRC-ISS), King Fahd University of Petroleum & Minerals, Dhahran, Saudi Arabia · College of Information Science & Electronic Engineering, Zhejiang University, Hangzhou, China+1

Face Presentation Attack Detection

Open paper AskPDF arXiv

Face presentation attack detection (FacePAD) remains challenging under diverse spoofing representation, including 2D print and replay, 3D mask-based spoofing, makeup-induced appearance manipulation, and physical occlusions, as well as under varying capture conditions. Motion cues are highly discriminative for FacePAD but typically require explicit optical flow estimation, which introduces substantial computational overhead and limits real-time deployment. In this work, we leverage optical flow to enhance motion representation during training while eliminating the need for flow computation at inference. We propose a dual-branch teacher model that fuses appearance cues from RGB frames with motion cues derived from colorwheel-encoded optical flow, enabling effective modeling of micro-motions and temporal consistency. To enable efficient deployment, we introduce a knowledge distillation framework that transfers motion-aware knowledge from the flow-augmented teacher to a lightweight RGB-only student via logit distillation. As a result, the student implicitly learns motion-sensitive representations without requiring explicit flow estimation or additional feature extraction blocks at inference. Extensive experiments demonstrate strong performance across multiple benchmarks, achieving 0.0% HTER on Replay-Attack and Replay-Mobile, 0.94% HTER on ROSE-Youtu, 5.65% HTER on SiW-Mv2, and 0.42% ACER on OULU-NPU. The distilled student achieves performance comparable to or better than the teacher while significantly reducing parameters and FLOPs, achieving 52 FPS on an NVIDIA Jetson Orin Nano, indicating its suitability for real-time and resource-constrained FacePAD deployment.

Abstract

Lightweight Neural Networks

Explore similar work

Flow Augmentation and Knowledge Distillation for Lightweight Face Presentation Attack Detection

LoRA-based Adaptation Alone Is Not Enough: Understanding the Limits of Foundation Models for Face Presentation Attack Detection

Tomatoes, Potatoes, and Onions: Questioning the Need for Faces in Face Presentation Attack Detection