From Intuition to Investigation: A Tool-Augmented Reasoning MLLM Framework for Generalizable Face Anti-Spoofing

Haoyuan Zhang; Keyao Wang; Guosheng Zhang; Haixiao Yue; Zhiwen Tan; Siran Peng; Tianshuo Zhang; Xiao Tan

cs.CVMar 1, 2026

From Intuition to Investigation: A Tool-Augmented Reasoning MLLM Framework for Generalizable Face Anti-Spoofing

Authors: Haoyuan Zhang, Keyao Wang, Guosheng Zhang, Haixiao Yue, Zhiwen Tan, Siran Peng, Tianshuo Zhang, Xiao Tan,

Organizations: SAI, UCAS · MAIS, CASIA · Baidu Inc · CAIR, HKISI, CAS ·

Abstract

Face recognition remains vulnerable to presentation attacks, calling for robust Face Anti-Spoofing (FAS) solutions. Recent MLLM-based FAS methods reformulate the binary classification task as the generation of brief textual descriptions to improve cross-domain generalization. However, their generalizability is still limited, as such descriptions mainly capture intuitive semantic cues (e.g., mask contours) while struggling to perceive fine-grained visual patterns. To address this limitation, we incorporate external visual tools into MLLMs to encourage deeper investigation of subtle spoof clues. Specifically, we propose the Tool-Augmented Reasoning FAS (TAR-FAS) framework, which reformulates the FAS task as a Chain-of-Thought with Visual Tools (CoT-VT) paradigm, allowing MLLMs to begin with intuitive observations and adaptively invoke external visual tools for fine-grained investigation. To this end, we design a tool-augmented data annotation pipeline and construct the ToolFAS-16K dataset, which contains multi-turn tool-use reasoning trajectories. Furthermore, we introduce a tool-aware FAS training pipeline, where Diverse-Tool Group Relative Policy Optimization (DT-GRPO) enables the model to autonomously learn efficient tool use. Extensive experiments under a challenging one-to-eleven cross-domain protocol demonstrate that TAR-FAS achieves SOTA performance while providing fine-grained visual investigation for trustworthy spoof detection.

Figures & tables

Figure 1: Previous methods struggle to distinguish high-quality spoof samples with subtle visual cues, while TAR-FAS enhances fine-grained investigation by coupling MLLM with visual tools.

Figure 2: Detailed construction and samples of ToolFAS-16K.

Figure 3: Illustration of the data annotation pipeline. (a) Each annotation can be divided into multiple sub-annotations $Ann^{(l)}$ generated by the MLLM with historical context, and the multi-turn process ends when the MLLM outputs the final answer. (b) The data verification process ensuring annotation reliability.

Figure 4: The total framework and training pipeline of TAR-FAS. (a) introduce the framework of TAR-FAS which can give a quick intuitive answer and investigate with visual tools to give a more accurate final decision. (b) illustrate the whole tool-aware FAS training pipeline including FAS knowledge transfer, tool-call format injection and DT-GRPO.

Table 1: Comparison in Protocol 2, illustrating the challenge of training solely on the CelebA-Spoof dataset followed by testing across 11 distinct datasets. We run each experiment 3 times under different seeds and report the average HTER and AUC.

Tools	Results
Tools	HTER(%)	AUC
ZoomIn Tool	10.63	93.90
ZoomIn + Frequency Tools	9.55	95.40
ZoomIn + Texture Tools	9.90	95.75
ZoomIn + Structure Tools	8.71	96.32
All Tools	7.54	96.67

Table 2: Ablation study of different visual tools. Frequency tools denotes FFT and Wavelet, texture tools denotes LBP, structure tools denotes HOG and Edge Detection.

Training Stage			Results
KT	FI	RL	HTER(%)	AUC
		✓	20.79	86.43
	✓		16.80	89.65
✓	✓		13.29	91.46
	✓	✓	9.23	95.11
✓	✓	✓	7.54	96.67

Table 3: Ablation study of different training strategy. ‘KT’ denotes FAS Knowledge Transfer, ‘FI’ denotes tool-call Format Injection, and ’RL’ denotes DT-GRPO.

Figure 5: The visualization of TAR-FAS results. We select one sample for each type: real, print, replay, and mask attacks. The zoom in operation in red boxes is for better understandings.

Backbone	Resize	Results
Backbone		HTER(%)	AUC
Qwen2.5-VL-7B		9.45	95.32
Qwen2.5-VL-7B	✓	8.60	96.08
InternVL3-8B	✓	7.54	96.67

Table 4: Ablation study of different resolution and backbone.

Appendix figures & tables20 assets

Supplementary material from the paper’s appendix.

Appendix

Figure S6 : The detailed spoof types in ToolFAS-16K.

Figure S7 : The detailed accuracy of expert model for each tool.

Panel of Figure 12 — Figure S8 : Complete System prompt.

Figure S9 : The detailed architecture of expert model for each tool. The input of expert model is only tool result (without RGB image). The ‘MaxPool’ perform double downsampling. The ‘MLP’ denotes two linear layer with a ReLU achitation function.

Methods	O&C&I to M		O&M&I to C		O&C&M to I		I&C&M to O		Avg.
	HTER(%)	AUC	HTER(%)	AUC	HTER(%)	AUC	HTER(%)	AUC	HTER(%)
FGHV [ 32 ]	9.17	96.92	12.47	93.47	16.29	90.11	13.58	93.55	12.88
GDA [ 64 ]	9.20	98.00	12.20	93.00	10.00	96.00	14.40	92.60	11.45
PatchNet [ 45 ]	7.10	98.46	11.33	94.58	13.40	95.67	11.82	95.07	10.91
SSAN [ 49 ]	6.67	98.75	10.00	96.67	8.88	96.79	13.72	93.63	9.82
IADG [ 63 ]	5.41	98.19	8.70	96.40	10.62	94.50	8.86	97.14	8.40

Appendix

Table S5: Comparison with the closest and SOTA FAS methods in leave-one-out protocol on MSU-MFSD (M), CASIA-FASD (C), ReplayAttack (I), and OULU-NPU (O) datasets. Avg. indicates the average performance across four experimental scenarios. The scores presented in bold represent the best performance.

	Results
	HTER(%)	AUC
Fast Answer	10.54	95.06
Reasoning Answer	7.54	96.67

Appendix

Table S6: Performance comparison of fast and reasoning answer.

Figure S10 : The reasoning accuracy comparison between our tool-aware training and RL only training during training process.

RL	Results
	HTER(%)	AUC
ST-GRPO [ 61 ]	9.98	94.41
DT-GRPO (Ours)	7.54	96.67

Appendix

Table S7: Performance comparison of DT-GRPO and ST-GRPO (Single-Tool GRPO) in DeepEyes [ 61 ] .

Figure S11 : Impact of maximum tool-call time. Increasing the maximum tool-call time from 1 to 3 improves performance, while setting it to 4 leads to a slight drop due to longer rollouts and higher sample uncertainty.

Figure S13 : Sample of CASIA-SURF-3DMask.

Face Presentation Attack Detection

Face Presentation Attack Detection identifies spoofing attempts, such as printed, replayed, masked, or digitally altered faces, targeting face recognition systems.

See all 22 papers

FAS-R1: A Unified Multi-Task MLLM for Reasoning Face Anti-Spoofing
Jul 29, 2026Hongyang Wang, Yichen Shi, Hongrui Li +3CoT Reasoning Group Relative Policy Optimization
Shijiazhuang Tiedao University · Fudan University · Shanghai Jiao Tong University +2
MS-MFAD : Multimodal large language models for Face Anti-spoofing Detection
Aug 18, 2026Xiaoyong Yu, Rongzhen Li, Shuming Shi +1Face Anti-Spoofing Multimodal Large Language Models
Mashang Consumer Finance Co., Ltd., 4th to 8th Floors, Building B2, Yuxing Plaza, No. 52 Huangshan Avenue Middle Section, Chongqing, 401121, Chongqing, China · Huazhong University of Science and Technology, 1037 Luoyu Road, Hongshan District, Wuhan, 430074, Hubei, China
Benchmarking Vision Foundation Models for Domain-Generalizable Face Anti-Spoofing
Apr 21, 2026Mika Feng, Pierre Gallin-Martel, Koichi Ito +1Vision Foundation Models Domain Generalization
Graduate School of Information Sciences, Tohoku University, Japan

Jul 29, 2026J/K move · Enter open · S save

FAS-R1: A Unified Multi-Task MLLM for Reasoning Face Anti-Spoofing

Hongyang Wang, Yichen Shi, Hongrui Li, Yiru Huo+2

Shijiazhuang Tiedao University · Fudan University · Shanghai Jiao Tong University+2

CoT Reasoning Group Relative Policy Optimization Image Forgery Localization Face Presentation Attack Detection Face Anti-Spoofing

Open paper AskPDF arXiv

Face anti-spoofing (FAS) is increasingly expected to provide not only bona fide/spoof decisions, but also attack semantics and image-grounded evidence for human inspection. Existing discriminative FAS models remain largely label-centric, while recent MLLM-based methods offer structured outputs but still rely mainly on supervised fine-tuning, often producing template-like rationales and weak optimization for difficult attacks. We propose FAS-R1, a two-stage reasoning-oriented MLLM framework for unified FAS prediction, covering authenticity classification, attack-type recognition and spoof-region localization. FAS-R1 first uses FAS-R1-23K, a high-quality long-CoT dataset, for cold-start supervised fine-tuning, and then performs FAS-specific GRPO post-training. Degradation-Simulated Augmentation (DSA) encourages stable spoof-cue reasoning across visual-quality shifts, while Difficulty-Aware GRPO (DA-GRPO) mitigates easy-sample dominance that may leave difficult task--attack groups under-optimized, especially for subtle or ambiguous attacks such as makeup and mask attacks. The main 3B FAS-R1 model achieves 98.75% authenticity accuracy, 93.33% attack-type accuracy, and 96.30/94.73% AP@40/AP@50 in-domain. It also outperforms the compared systems in cross-domain authenticity generalization and answer-and-rationale quality. Experiments with different base models further show favorable scaling behavior. The code will be released soon.

Abstract

Face Presentation Attack Detection

Explore similar work

FAS-R1: A Unified Multi-Task MLLM for Reasoning Face Anti-Spoofing

MS-MFAD : Multimodal large language models for Face Anti-spoofing Detection

Benchmarking Vision Foundation Models for Domain-Generalizable Face Anti-Spoofing