MS-MFAD : Multimodal large language models for Face Anti-spoofing Detection
Organizations: Mashang Consumer Finance Co., Ltd., 4th to 8th Floors, Building B2, Yuxing Plaza, No. 52 Huangshan Avenue Middle Section, Chongqing, 401121, Chongqing, China · Huazhong University of Science and Technology, 1037 Luoyu Road, Hongshan District, Wuhan, 430074, Hubei, China
Abstract
Facial biometric recognition systems currently face compound threats intertwining generative AI and high-fidelity physical spoofing. Existing defenses suffer from systemic bottlenecks, including poor generalization, non-auditable reasoning, and reliance on massive, low-quality datasets. To address these challenges, we propose Multimodal Large Language Models (MFAD) for face anti-spoofing detection, an explainable reasoning system for Unified Face Anti-Spoofing Detection (UFAD), accompanied by a semantic-level annotation benchmark. Unlike methods relying on external tools or coarse alignment, MFAD activates the intrinsic reasoning capabilities of Multimodal Large Language Models (MLLMs) via a fine-grained pixel-semantic anchoring mechanism. This eliminates localization hallucinations and ensures auditable reasoning paths. We introduce a cross-attack semantic-level unified annotation paradigm: by annotating only 1,000 precise masks per attack category, we generate reasoning evidence chains strictly corresponding to spoofed regions. Supervised fine-tuning on the Qwen-VL foundation model demonstrates that, using limited high-quality samples, the system achieves a 40-50% relative reduction in in-domain ACER and restricts cross-domain performance degradation to within 11.62%/5.23%, significantly outperforming existing frameworks. Furthermore, under white-box adversarial attacks, detection accuracy drops by only 3.2%, validating the robustness of semantic anchoring compared to models trained on massive short-text data. Domain practitioners rated the evidence reliability of reasoning paths at 4.57/5, with inference latency satisfying real-time deployment requirements. These results confirm that a few-shot, high-quality semantic annotation paradigm is effective for building trustworthy, explainable, and cost-efficient UFAD systems.
Figures & tables
| Evaluator | D1 Avg. | D2 Avg. | D3 Avg. | Weighted Score |
| Human Expert | 4.8024 | 4.7917 | 4.6476 | 4.7619 |
| GPT-4.1 | 4.5607 | 4.9043 | 4.7186 | 4.7046 |
| Qwen-3.6 | 4.0822 | 4.3987 | 4.3621 | 4.2536 |
| CelebA-Spoof | MS-UFAD-Deepfake | MFFI | |||||||
| Model | APCER | BPCER | ACER | APCER | BPCER | ACER | APCER | BPCER | ACER |
| ResNet-50 | 0.1885 | 0.1475 | 0.1680 | 0.0040 | 0.1475 | 0.0756 | 0.2382 | 0.6293 | 0.4338 |
| ResNet-101 | 0.1505 | 0.1975 | 0.1740 | 0.0000 | 0.1975 | 0.0988 | 0.1735 | 0.7375 | 0.4555 |
| CLIP-ViT-base-patch16 | 0.1191 | 0.1501 | 0.1346 | 0.0247 | 0.0081 | 0.0177 | 0.4764 | 0.5139 | 0.4951 |
| CLIP-ViT-base-patch32 | 0.1001 | 0.3055 | 0.2028 | 0.0107 | 0.0061 | 0.0084 | 0.633 | 0.3242 | 0.4786 |
| Qwen3-VL-8B-Thinking | 0.8032 | 0.0175 | 0.4104 | 0.7206 | 0.0175 | 0.3690 | 0.7147 | 0.0309 | 0.3728 |
| Dataset | Metric | Base | SFT | 200 | 500 | 1k | 10k | 20k | 40k |
| CelebA-Spoof | APCER | 0.4029 | 0.1541 | 0.6208 | 0.6234 | 0.6259 | 0.6229 | 0.6248 | 0.623 |
| BPCER | 0.4369 | 0.0000 | 0.2179 | 0.2189 | 0.2271 | 0.2170 | 0.2184 | 0.217 | |
| ACER | 0.4199 | 0.0770 | 0.4194 | 0.4211 | 0.4265 | 0.4199 | 0.4216 | 0.420 | |
| MS-UFAD-Spoof | APCER | 0.5427 | 0.0340 | 0.7453 | 0.7434 | 0.7422 | 0.7467 | 0.7443 | 0.743 |
| BPCER | 0.4375 | 0.0031 | 0.2224 | 0.2212 | 0.2191 | 0.2206 | 0.2228 | 0.222 | |
| ACER | 0.4901 | 0.0186 | 0.4839 | 0.4823 | 0.4806 | 0.4836 | 0.4836 | 0.482 |
Face Anti-Spoofing
Face anti-spoofing detects presentation and digital attacks that try to fool facial recognition systems.
See all 13 papers