Domain-generalizable Face Anti-Spoofing with Patch-based Multi-tasking and Artifact Pattern Conversion

Seungjin Jung; Yonghyun Jeong; Minha Kim; Jimin Min; Youngjoon Yoo; Jongwon Choi

cs.CVApr 10, 2026

Domain-generalizable Face Anti-Spoofing with Patch-based Multi-tasking and Artifact Pattern Conversion

Authors: Seungjin Jung, Yonghyun Jeong, Minha Kim, Jimin Min, Youngjoon Yoo, Jongwon Choi

Organizations: Department of Artificial Intelligence, Chung-Ang University, Seoul, 06974, Korea · Team of Image Vision, Naver Cloud, Seongnam, 13561, Korea · Department of Human-centric AI, Nota AI, Seoul, 06164, Korea · Department of Computer Engineering, Hanbat National University, Daejeon, 34158, Korea ·

Abstract

Face Anti-Spoofing (FAS) algorithms, designed to secure face recognition systems against spoofing, struggle with limited dataset diversity, impairing their ability to handle unseen visual domains and spoofing methods. We introduce the Pattern Conversion Generative Adversarial Network (PCGAN) to enhance domain generalization in FAS. PCGAN effectively disentangles latent vectors for spoof artifacts and facial features, allowing to generate images with diverse artifacts. We further incorporate patch-based and multi-task learning to tackle partial attacks and overfitting issues to facial features. Our extensive experiments validate PCGAN's effectiveness in domain generalization and detecting partial attacks, giving a substantial improvement in facial recognition security.

Figures & tables

Figure 1: Overall framework. (a) shows the disentanglement and conversion of artifact patterns by combining spatial content features and artifact representations from different images. (b) PCGAN-based data augmentation and construction of patched datasets for training. (c) Patch-based Multi-tasking Network (PMN), which jointly learns from patched and full face-cropped images.

Prompt No.	Liveness Face Prompts	Attack Face Prompts
No.1	This is an example of a real face	This is an example of a spoof face
No.2	This is a bonafide face	This is an example of an attack face
No.3	This is a real face	This is not a real face
No.4	This is how a real face looks like	This is how a spoof face looks like
No.5	a photo of a real face	a photo of a spoof face
No.6	This is not a spoof face	a printout shown to be a spoof face

Table 1: Text Prompt Templates for Live and Attack Faces.

Method	OCI $\rightarrow$ M		OMI $\rightarrow$ C		OCM $\rightarrow$ I		ICM $\rightarrow$ O		Average
Method	ACER (%)	AUC (%)	ACER (%)	AUC (%)	ACER (%)	AUC (%)	ACER (%)	AUC (%)	ACER (%)	AUC (%)
MA-Net [ 42 ]	20.80	-	25.60	-	24.70	-	26.30	-	24.35	-
SSAN-R [ 18 ]	6.67	98.75	10.00	96.67	8.88	96.79	13.72	93.63	9.82	96.46
AFD [ 12 ]	12.92	93.29	17.78	88.10	18.75	91.92	15.90	90.54	16.34	90.96
PatchNet [ 27 ]	7.10	98.46	11.33	94.58	13.40	95.67	11.82	95.07	10.90	95.95
DFDN [ 11 ]	5.20	98.39	8.00	97.45	7.71	95.56	11.01	95.22	7.98	96.66

Table 2: Best-epoch comparison on the DG-FAS benchmark . ACER and AUC are reported under four DG protocols (O, M, I, C denote OULU, MSU-MFSD, Replay-Attack, and CASIA-FASD). Bold and underlined values indicate the best and second-best performance, respectively. * denotes the use of CelebA-Spoof.

Method	OCI $\rightarrow$ M		OMI $\rightarrow$ C		OCM $\rightarrow$ I		ICM $\rightarrow$ O		Average
Method	ACER (%)	AUC (%)	ACER (%)	AUC (%)	ACER (%)	AUC (%)	ACER (%)	AUC (%)	ACER (%)	AUC (%)
SSAN-R [ 18 ]	21.79(15.12)	84.06	26.44(16.44)	78.44	35.39(26.51)	70.13	25.72(12.00)	79.37	27.34(17.52)	78.00
PatchNet [ 27 ]	25.92(18.82)	83.43	36.26(24.93)	71.38	29.75(16.35)	80.53	23.49(11.67)	84.62	28.86(17.96)	79.99
SAFAS [ 9 ]	14.36(8.41)	92.06	19.40(10.62)	88.69	11.48(4.90)	95.74	11.29(1.29)	95.23	14.13(6.26)	92.93
FLIP-MCL [ 10 ]	15.00(10.00)	93.37	3.22 (2.68)	99.44	10.25(6.00)	96.56	5.75(2.05)	98.48	8.56(5.19)	96.96
Ours	8.21 (5.71)	96.95	5.41(3.37)	98.76	9.55 (6.22)	96.72	5.51 (2.22)	98.23	7.17 (4.38)	97.67

Table 3: Domain generalization results on the FAS benchmark . ACER and AUC are averaged over the last 10 epochs. Parentheses indicate ACER differences from Tab. 2 as a measure of learning stability. The same four protocols as Tab. 2 are used.

Method	CS $\rightarrow$ W		SW $\rightarrow$ C		CW $\rightarrow$ S		Average
Method	ACER (%)	AUC (%)	ACER (%)	AUC (%)	ACER (%)	AUC (%)	ACER (%)	AUC (%)
ViT	21.04	89.12	17.12	89.05	17.16	90.25	18.44	89.47
CLIP-V [ 30 ]	20.00	87.72	17.67	89.67	8.32	97.23	15.33	91.54
CLIP [ 30 ]	17.05	89.37	15.22	91.99	9.34	96.62	13.87	92.66
CA-MoEiT [ 44 ]	16.67	91.02	16.42	93.17	12.57	93.76	15.22	92.59
CoOp [ 47 ]	9.52	90.49	18.30	87.47	11.37	95.46	13.06	91.14

Table 4: Results on CSW benchmarks . Evaluation metrics are ACER and AUC under cross-domain settings on CASIA-Surf-CeFA (C), CASIA-Surf (S), and WMCA (W), where bold and underlined values indicate the best and second-best performance, respectively.

(a) Protocol 1: Best epochs
PMN		PCGAN	OCI $\rightarrow$ M	OMI $\rightarrow$ C	OCM $\rightarrow$ I	ICM $\rightarrow$ O	Avg.
CL	PL	Syn	OCI $\rightarrow$ M	OMI $\rightarrow$ C	OCM $\rightarrow$ I	ICM $\rightarrow$ O	Avg.
			10.42	4.44	7.75	6.11	7.18
	✓		10.00	2.04	6.67	3.38	5.52
✓			7.50	2.22	5.25	5.14	5.03
✓	✓		5.00	3.33	6.67	4.81	4.95

Table 5: For the ablation study, we report results on a domain-generalization FAS benchmark using ACER. A checkmark indicates the inclusion of each component in PMN and PCGAN, where CL, PL, and Syn denote Center Loss, Patch Loss, and synthesized images, respectively.

Spoof $\rightarrow$ Live	Live $\rightarrow$ Spoof	OCI $\rightarrow$ M	OMI $\rightarrow$ C	OCM $\rightarrow$ I	ICM $\rightarrow$ O	Average
		5.00	3.33	6.67	4.81	4.95
✓		5.42	4.44	8.75	4.17	5.70
	✓	7.50	6.67	10.00	3.82	7.00
✓	✓	7.50	3.33	11.25	3.02	6.28

Table 6: Ablation study on synthetic-live and synthetic-spoof samples generated by PCGAN. Spoof→Live replaces real live data with artifact-removed spoof images, while Live→Spoof replaces real spoof data with artifact-injected live images. ACER (%) is reported under four cross-domain protocols.

(a)Protocol 1: Best epochs
Origin	Syn	OULU	MSU	Idiap	CASIA	Average
✓		0.00	5.00	7.83	4.63	4.37
	✓	8.33	25.00	16.33	7.96	14.41
✓	✓	0.00	7.50	5.17	4.44	4.28

Table 7: ACER (%) performance on different datasets. We train the model using either the original images (Original OULU) or synthesized images (Syn OULU).

Range	OCI $\rightarrow$ M	OMI $\rightarrow$ C	OCM $\rightarrow$ I	ICM $\rightarrow$ O	Avg.
0.2-1.0	2.50	2.04	3.33	3.29	2.79
0.2-0.2	5.00	1.11	8.50	3.38	4.50
0.4-0.4	5.42	2.22	11.67	2.22	5.38
0.6-0.6	7.08	2.22	10.00	3.38	5.67
0.8-0.8	5.00	1.11	10.00	3.33	4.86

Table 8: Experimental results show the impact of changing the random cropping size. The metrics used in this experiment are the ACER.

Figure 2: Examples displayed each cropping approach.

(a) Protocol 1: Best epochs
Method	OCI $\rightarrow$ M	OMI $\rightarrow$ C	OCM $\rightarrow$ I	ICM $\rightarrow$ O	Avg.
RC	2.50	2.04	3.33	3.29	2.79
CC	7.50	1.11	8.33	4.77	5.43
LC	4.17	2.22	10.00	2.59	4.74

Table 9: Experimental results on the domain-generalization for FAS benchmark. The metrics used in this experiment are the ACER. RC, CC, and LC mean Random Cropping, Center Cropping, and Left Up Cropping, respectively.

Figure 3: Grad-CAM visualizations under the MOI→C protocol. Activation maps for the attack class on the ROSE-Youtu dataset are shown to evaluate robustness to unseen partial attacks. (a) Attack image. (b) ResNet50 without PMN and PCGAN. (c) Our model with PMN. (d) Our model with both PMN and PCGAN.

Figure 4: Cross class results with Pattern Conversion GANs. The images show the artifact pattern detection results by Canny detection and Hough Transform. (c) shows the artifact-pattern removal results from (b). (d) inserts artifact patterns from (a) into (b).

Figure 5: Distinct visual artifacts extracted via Sobel filtering. (a)–(c) are taken from Fig. 1 .

Method	Generator			Detector				Inference
	Generator			Image Encoder		Text Encoder		Inference
	Type	Parameters	Flops	Parameters	Flops	Parameters	Flops	Parameters	Flops	Inference Time
ViT [ 48 ]	None	-	-	86.19M	17.58G	-	-	86.19M	17.58G	0.007
FLIP-IT [ 10 ]	None	-	-	86.19M	17.58G	63.11M	35.81M	86.19M	17.58G	0.0010
FLIP-MCL [ 10 ]	None	-	-	86.19M	52.74G	83.05M	35.86M	86.19M	17.58G	0.0010
Ca-MoEiT [ 44 ]	None	-	-	86.19M	17.58G	-	-	86.19M	17.58G	-

Table 10: Computational cost comparison in terms of parameters and FLOPs . The generator is used only during training, so inference cost reflects the detector alone.

Face Anti-Spoofing

Face anti-spoofing detects presentation and digital attacks that try to fool facial recognition systems.

See all 13 papers

Purify then Guide: Rethinking Domain Generalization for Multimodal Face Anti-Spoofing
May 14, 2025Yingjie Ma, Xun Lin, Zitong Yu +7Cross-Modal Alignment Domain Generalization
College of Computer Science and Software Engineering, Shenzhen University · School of Computing and Information Technology, Great Bay University · The Chinese University of Hong Kong +5
Benchmarking Vision Foundation Models for Domain-Generalizable Face Anti-Spoofing
Apr 21, 2026Mika Feng, Pierre Gallin-Martel, Koichi Ito +1Vision Foundation Models Domain Generalization
Graduate School of Information Sciences, Tohoku University, Japan
FAS-R1: A Unified Multi-Task MLLM for Reasoning Face Anti-Spoofing
Jul 29, 2026Hongyang Wang, Yichen Shi, Hongrui Li +3CoT Reasoning Group Relative Policy Optimization
Shijiazhuang Tiedao University · Fudan University · Shanghai Jiao Tong University +2

May 14, 2025J/K move · Enter open · S save

Purify then Guide: Rethinking Domain Generalization for Multimodal Face Anti-Spoofing

Yingjie Ma, Xun Lin, Zitong Yu, Haonan Wang+6

College of Computer Science and Software Engineering, Shenzhen University · School of Computing and Information Technology, Great Bay University · The Chinese University of Hong Kong+5

Cross-Modal Alignment Domain Generalization Face Anti-Spoofing

Open paper AskPDF arXiv

Face Anti-Spoofing (FAS) is essential for the security of facial recognition systems in diverse scenarios such as payment processing and surveillance. Current multimodal FAS methods often struggle with effective generalization, mainly due to modality-specific biases and domain shifts. To address these challenges, we introduce the Multimodal Denoising and Alignment (MMDA) framework. By leveraging the zero-shot generalization capability of CLIP, the MMDA framework effectively suppresses noise in multimodal data through denoising and alignment mechanisms, thereby significantly enhancing the generalization performance of cross-modal alignment. The Modality-Domain Joint Differential Attention (MD2A) module in MMDA concurrently mitigates the impacts of domain and modality noise by refining the attention mechanism based on extracted common noise features. Furthermore, the Representation Space Soft (RS2) Alignment strategy utilizes the pre-trained CLIP model to align multi-domain multimodal data into a generalized representation space in a flexible manner, preserving intricate representations and enhancing the model's adaptability to various unseen conditions. We also design a U-shaped Dual Space Adaptation (U-DSA) module to enhance the adaptability of representations while maintaining generalization performance. These improvements not only enhance the framework's generalization capabilities but also boost its ability to represent complex representations. Our experimental results on four benchmark datasets under different evaluation protocols demonstrate that the MMDA framework outperforms existing state-of-the-art methods in terms of cross-domain generalization and multimodal detection accuracy. The code will be released soon.

Abstract

Face Anti-Spoofing

Explore similar work

Purify then Guide: Rethinking Domain Generalization for Multimodal Face Anti-Spoofing

Benchmarking Vision Foundation Models for Domain-Generalizable Face Anti-Spoofing

FAS-R1: A Unified Multi-Task MLLM for Reasoning Face Anti-Spoofing