Towards Zero-Shot Domain Generalization for ID Cards Presentation Attack Detection

Mario Nieto-Hidalgo; Juan M. Espin; Juan E. Tapia

cs.CVAug 17, 2026

Towards Zero-Shot Domain Generalization for ID Cards Presentation Attack Detection

Authors: Mario Nieto-Hidalgo, Juan M. Espin, Juan E. Tapia

Organizations: Facephi, R&D Department, Spain. · da/sec-Biometrics and Internet Security Research Group. Hochschule Darmstadt, Germany.

Abstract

Presentation-Attack Detection (PAD) for national ID cards is limited by the lack of publicly available genuine samples, making it difficult for systems to generalize across countries. This paper introduces two main innovations: (1) a Prototypical Network head using an EfficientNet-V2-b0 backbone that requires only four genuine samples per class to create reliable prototypes; and (2) an episodic training regime that keeps PAD classes fixed while varying the card domain, allowing the network to learn universal attack cues. Evaluated on a large multi-country dataset and the public DLC-2021 benchmark, this method achieves an average Equal Error Rate of around 9%, outperforming conventional softmax and CLIP zero-shot baselines even with data from a single source country. This approach provides accurate, privacy-preserving PAD while minimizing data collection, facilitating scalable cross-jurisdictional remote onboarding.

Figures & tables

Panel of Figure 1 — Figure 1: Diagrams for baseline method (a), Prototypical Network train stage (b), and Prototypical Network inference stage (c).

Panel of Figure 2 — Figure 2: Example of images from a private dataset.

	PAN	COL	CHL-1	CHL-2	MEX-1	MEX-2	GTM
Bona fide	1,006	80	696	13,000	353	660	1,001
Print	1,006	80	696	13,000	353	660	1,001
Screen	1,006	80	696	13,000	353	660	1,001
PVC	506	80	259	6,500	353	160	501

Table 1: Number of samples per ID card type.

Model/Classes	EER%	BPCER10	BPCER20	BPCER100
CLIP-B16 / 4C	30.53	66.66	81.63	95.24
CLIP-L14 / 4C	30.86	65.31	78.44	94.21
CLIP-B16 / 3C	20.71	41.52	60.14	88.06
CLIP-L14/ 3C	27.07	51.33	65.63	86.33

Table 2: Experiment 0: CLIP test with CHL-2 in private dataset.

	EER%	BPCER10	BPCER20	BPCER100
	Baseline
PAN	12.70	17.50	31.11	56.96
COL	38.54	66.25	75.00	92.5
CHL-1	21.35	36.64	40.80	71.84
MEX-1	56.80	100.00	100.00	100.00
MEX-2	56.80	100.00	100.00	100.00

Table 3: Experiment 1 on the private dataset in (%).

	EER%	BPCER10	BPCER20	BPCER100
	Baseline
PAN	3.06	0.60	1.69	6.96
COL	14.17	20.00	36.25	66.25
CHL-2	11.95	14.91	29.34	63.37
MEX-1	18.74	32.29	45.04	81.87
AVG	11.98	16.95	28.08	54.61

Table 4: Experiment 2 on the private dataset in (%).

	EER%	BPCER10	BPCER20	BPCER100
B16-bf-Prompt	49.37	93.39	97.82	100.00
L14-bf-Prompt	38.05	89.99	95.96	99.42
B16-bf-PVC	41.81	81.33	90.64	96.92
L14-bf-PVC	42.67	89.16	96.47	99.17

Table 5: CLIP tests (%) with ESP ID cards in DLC-2021.

	EER%	BPCER10	BPCER20	BPCER100
	Baseline
ALB	26.91	53.43	70.32	85.92
EST	21.34	35.65	44.32	68.44
FIN	27.12	53.22	64.15	82.57
SVK	35.84	71.78	83.96	94.13
AVG	27.8	53.77	65.69	82.77

Table 6: Experiment 1 on the DLC-2021 dataset in (%).

	EER%	BPCER10	BPCER20	BPCER100
	Baseline
ALB	7.97	6.92	12.67	47.43
ESP	5.29	1.78	5.47	29.09
EST	2.95	0.31	0.67	7.88
FIN	20.10	36.41	49.34	82.26
SVK	15.05	21.16	33.52	59.11

Table 7: Experiment 2 on the DLC-2021 dataset in (%).

Domain Generalization

Domain generalization develops models that perform reliably in new environments without training on target-domain data.

See all 375 papers

From Vision to Text: A Compact Multimodal Approach for Robust, Cross-Domain Presentation Attack Detection on ID Cards
Jun 5, 2026Qingwen Zeng, Juan E. Tapia, Sneha Das +1Multimodal Robustness Domain Generalization
Technical University of Denmark (DTU), Denmark · da/sec-Biometrics and Security Research Group, Hochschule Darmstadt, Germany
Foundation Models for Face Presentation Attack Detection: A Unified Linear-Probing Benchmark
Jul 29, 2026Peter Lorenz, Anjith George, Sébastien MarcelVision Foundation Models Linear Probing
Idiap Research Institute, Martigny, Switzerland · University of Lausanne (UNIL), Lausanne, Switzerland
CPG-PAD: Concept-Informed Prompts Guided Presentation Attack Detection
Jul 1, 2026Haoyuan Zhang, Xiangyu Zhu, Li Gao +3VLM Adaptation Domain Generalization
School of Artificial Intelligence, University of Chinese Academy of Sciences, Beijing 100049, China · State Key Laboratory of Multimodal Artificial Intelligence Systems, Institute of Automation, Chinese Academy of Sciences, Beijing 100190, China · China Mobile Financial Technology Co., Ltd., Beijing 100032, China

Jun 5, 2026J/K move · Enter open · S save

From Vision to Text: A Compact Multimodal Approach for Robust, Cross-Domain Presentation Attack Detection on ID Cards

Qingwen Zeng, Juan E. Tapia, Sneha Das, Christoph Busch

Technical University of Denmark (DTU), Denmark · da/sec-Biometrics and Security Research Group, Hochschule Darmstadt, Germany

Multimodal Robustness Domain Generalization Multimodal Model Evaluation Synthetic Data Evaluation

Open paper AskPDF arXiv

Cross-domain shifts challenge Presentation Attack Detection (PAD) on ID Cards, given the restricted data available due to privacy concerns. This work proposes a compact multimodal model, based on new generative and discriminative blocks, which combines visual and textual data for PAD on genuine and synthetic ID images. While multimodal models exhibit strong generalisation after supervised fine-tuning, they fail in zero-shot settings. Our findings underscore that model capacity and real-world data are essential for reliable PAD, while existing synthetic datasets may not reflect real-world challenges. We argue for a re-evaluation of synthetic data as a benchmark and emphasise the need for more realistic, diverse datasets to advance PAD research.

Abstract

Domain Generalization

Explore similar work

From Vision to Text: A Compact Multimodal Approach for Robust, Cross-Domain Presentation Attack Detection on ID Cards

Foundation Models for Face Presentation Attack Detection: A Unified Linear-Probing Benchmark

CPG-PAD: Concept-Informed Prompts Guided Presentation Attack Detection