Facial biometric recognition systems currently face compound threats intertwining generative AI and high-fidelity physical spoofing. Existing defenses suffer from systemic bottlenecks, including poor generalization, non-auditable reasoning, and reliance on massive, low-quality datasets. To address these challenges, we propose Multimodal Large Language Models (MFAD) for face anti-spoofing detection, an explainable reasoning system for Unified Face Anti-Spoofing Detection (UFAD), accompanied by a semantic-level annotation benchmark. Unlike methods relying on external tools or coarse alignment, MFAD activates the intrinsic reasoning capabilities of Multimodal Large Language Models (MLLMs) via a fine-grained pixel-semantic anchoring mechanism. This eliminates localization hallucinations and ensures auditable reasoning paths. We introduce a cross-attack semantic-level unified annotation paradigm: by annotating only 1,000 precise masks per attack category, we generate reasoning evidence chains strictly corresponding to spoofed regions. Supervised fine-tuning on the Qwen-VL foundation model demonstrates that, using limited high-quality samples, the system achieves a 40-50% relative reduction in in-domain ACER and restricts cross-domain performance degradation to within 11.62%/5.23%, significantly outperforming existing frameworks. Furthermore, under white-box adversarial attacks, detection accuracy drops by only 3.2%, validating the robustness of semantic anchoring compared to models trained on massive short-text data. Domain practitioners rated the evidence reliability of reasoning paths at 4.57/5, with inference latency satisfying real-time deployment requirements. These results confirm that a few-shot, high-quality semantic annotation paradigm is effective for building trustworthy, explainable, and cost-efficient UFAD systems.
Figures & tables
Figure 1: VLFFD proposes a CoT construction method; however, it is applicable only to Deepfake attacks with precise forgery masks, and the method itself inherently follows the CPT paradigm, making it difficult to eliminate the reliance on large-scale image-text paired data. In contrast, our proposed data and framework are applicable to all attack types. As a post-training approach, it elicits the reasoning capabilities of MLLMs with only a small amount of data.
Figure 2: Schematic diagram of the mask generation process.
Figure 3: CoT Data Construction Pipeline.
Figure 4: Comparative experiments on model performance as a function of training data scale for CoT and short-text datasets.
Figure 5: Comparison of the base model, the model fine-tuned on a large corpus of short-text samples, and the model fine-tuned on a small amount of CoT data under white-box attacks.
Evaluator
D1 Avg.
D2 Avg.
D3 Avg.
Weighted Score
Human Expert
4.8024
4.7917
4.6476
4.7619
GPT-4.1
4.5607
4.9043
4.7186
4.7046
Qwen-3.6
4.0822
4.3987
4.3621
4.2536
Table 1: Comparison of Evaluation Scores across Different Models and Human Experts
Figure 6: Performance analysis of LoRA configurations across physical, digital, and cross-domain anti-spoofing tasks.
Figure 7: Performance analysis of LoRA configurations across physical, digital, and cross-domain anti-spoofing tasks.
CelebA-Spoof
MS-UFAD-Deepfake
MFFI
Model
APCER
BPCER
ACER
APCER
BPCER
ACER
APCER
BPCER
ACER
ResNet-50
0.1885
0.1475
0.1680
0.0040
0.1475
0.0756
0.2382
0.6293
0.4338
ResNet-101
0.1505
0.1975
0.1740
0.0000
0.1975
0.0988
0.1735
0.7375
0.4555
CLIP-ViT-base-patch16
0.1191
0.1501
0.1346
0.0247
0.0081
0.0177
0.4764
0.5139
0.4951
CLIP-ViT-base-patch32
0.1001
0.3055
0.2028
0.0107
0.0061
0.0084
0.633
0.3242
0.4786
Qwen3-VL-8B-Thinking
0.8032
0.0175
0.4104
0.7206
0.0175
0.3690
0.7147
0.0309
0.3728
Table 2: Performance comparison of different models across CelebA-Spoof, MS-UFAD-Deepfake, and MFFI datasets.
Dataset
Metric
Base
SFT
200
500
1k
10k
20k
40k
CelebA-Spoof
APCER
0.4029
0.1541
0.6208
0.6234
0.6259
0.6229
0.6248
0.623
BPCER
0.4369
0.0000
0.2179
0.2189
0.2271
0.2170
0.2184
0.217
ACER
0.4199
0.0770
0.4194
0.4211
0.4265
0.4199
0.4216
0.420
MS-UFAD-Spoof
APCER
0.5427
0.0340
0.7453
0.7434
0.7422
0.7467
0.7443
0.743
BPCER
0.4375
0.0031
0.2224
0.2212
0.2191
0.2206
0.2228
0.222
ACER
0.4901
0.0186
0.4839
0.4823
0.4806
0.4836
0.4836
0.482
Table 3: Reinforcement Learning Experiments on MFAD-3B Fine-tuned from Qwen3-VL-3B-Instruct via SFT
Face anti-spoofing (FAS) is increasingly expected to provide not only bona fide/spoof decisions, but also attack semantics and image-grounded evidence for human inspection. Existing discriminative FAS models remain largely label-centric, while recent MLLM-based methods offer structured outputs but still rely mainly on supervised fine-tuning, often producing template-like rationales and weak optimization for difficult attacks. We propose FAS-R1, a two-stage reasoning-oriented MLLM framework for unified FAS prediction, covering authenticity classification, attack-type recognition and spoof-region localization. FAS-R1 first uses FAS-R1-23K, a high-quality long-CoT dataset, for cold-start supervised fine-tuning, and then performs FAS-specific GRPO post-training. Degradation-Simulated Augmentation (DSA) encourages stable spoof-cue reasoning across visual-quality shifts, while Difficulty-Aware GRPO (DA-GRPO) mitigates easy-sample dominance that may leave difficult task--attack groups under-optimized, especially for subtle or ambiguous attacks such as makeup and mask attacks. The main 3B FAS-R1 model achieves 98.75% authenticity accuracy, 93.33% attack-type accuracy, and 96.30/94.73% AP@40/AP@50 in-domain. It also outperforms the compared systems in cross-domain authenticity generalization and answer-and-rationale quality. Experiments with different base models further show favorable scaling behavior. The code will be released soon.
Hongyang Wang, Yichen Shi, Hongrui Li +3
Shijiazhuang Tiedao University · Fudan University · Shanghai Jiao Tong University +2
Face recognition remains vulnerable to presentation attacks, calling for robust Face Anti-Spoofing (FAS) solutions. Recent MLLM-based FAS methods reformulate the binary classification task as the generation of brief textual descriptions to improve cross-domain generalization. However, their generalizability is still limited, as such descriptions mainly capture intuitive semantic cues (e.g., mask contours) while struggling to perceive fine-grained visual patterns. To address this limitation, we incorporate external visual tools into MLLMs to encourage deeper investigation of subtle spoof clues. Specifically, we propose the Tool-Augmented Reasoning FAS (TAR-FAS) framework, which reformulates the FAS task as a Chain-of-Thought with Visual Tools (CoT-VT) paradigm, allowing MLLMs to begin with intuitive observations and adaptively invoke external visual tools for fine-grained investigation. To this end, we design a tool-augmented data annotation pipeline and construct the ToolFAS-16K dataset, which contains multi-turn tool-use reasoning trajectories. Furthermore, we introduce a tool-aware FAS training pipeline, where Diverse-Tool Group Relative Policy Optimization (DT-GRPO) enables the model to autonomously learn efficient tool use. Extensive experiments under a challenging one-to-eleven cross-domain protocol demonstrate that TAR-FAS achieves SOTA performance while providing fine-grained visual investigation for trustworthy spoof detection.
Face Anti-Spoofing (FAS) remains challenging due to the requirement for robust domain generalization across unseen environments. While recent trends leverage Vision-Language Models (VLMs) for semantic supervision, these multimodal approaches often demand prohibitive computational resources and exhibit high inference latency. Furthermore, their efficacy is inherently limited by the quality of the underlying visual features. This paper revisits the potential of vision-only foundation models to establish a highly efficient and robust baseline for FAS. We conduct a systematic benchmarking of 15 pre-trained models, such as supervised CNNs, supervised ViTs, and self-supervised ViTs, under severe cross-domain scenarios including the MICO and Limited Source Domains (LSD) protocols. Our comprehensive analysis reveals that self-supervised vision models, particularly DINOv2 with Registers, significantly suppress attention artifacts and capture critical, fine-grained spoofing cues. Combined with Face Anti-Spoofing Data Augmentation (FAS-Aug), Patch-wise Data Augmentation (PDA) and Attention-weighted Patch Loss (APL), our proposed vision-only baseline achieves state-of-the-art performance in the MICO protocol. This baseline outperforms existing methods under the data-constrained LSD protocol while maintaining superior computational efficiency. This work provides a definitive vision-only baseline for FAS, demonstrating that optimized self-supervised vision transformers can serve as a backbone for both vision-only and future multimodal FAS systems. The project page is available at: https://gsisaoki.github.io/FAS-VFMbenchmark-CVPRW2026/ .
Mika Feng, Pierre Gallin-Martel, Koichi Ito +1
Graduate School of Information Sciences, Tohoku University, Japan