Organizations: The First Affiliated Hospital, the School of Computer Science, University of South China, Hengyang, 421001, China · New Laboratory of Pattern Recognition, MAIS, CASIA, Beijing, 100190, China · Department of Computer Science and Engineering, University of California, Merced, CA, 95340, USA
Open-world face anti-spoofing must address both covariate and semantic shifts: source and target domains differ in imaging conditions, while target domains contain diverse attack types absent from training. Existing prompt-based approaches often express spoofing through category semantics or language guidance, which is effective for modeling high-level concepts but is less suited to explicitly capturing the evolving fine-grained and spatially heterogeneous forensic evidence of unseen attacks. Motivated by the hypothesis that many unseen attacks can be characterized by new combinations of recurring visual cues, we propose a compositional forensic visual prompt learning framework that operates entirely in the visual feature space. Built on a frozen ViT-based vision foundation model, the framework employs patch-aware attention to refine a shared set of learnable micro-forensic primitives into localized forensic evidence units derived from image patches. Class-specific global contextual prompts then provide input-dependent routing weights that adaptively select and compose these primitives into compositional forensic visual prompts for real/spoof discrimination. The primitives are not assigned predefined semantic meanings; instead, their specialization and reuse emerge from shared parameterization and joint optimization across categories. Extensive experiments on nine open-world protocols demonstrate state-of-the-art performance, strong cross-domain generalization, and robust adaptation to unseen attacks.
Figures & tables
Fig. 1: (a) Open-world face anti-spoofing exhibits severe covariate and semantic shifts, resulting in continuously evolving heterogeneous spoof cues in both pattern and spatial distribution. (b) Our framework learns reusable micro-forensic primitives and dynamically composes them using image-level physical priors for unified detection of heterogeneous attacks. (c) Motivating hypothesis: heterogeneous unseen attacks may be represented by new combinations of recurring visual forensic cues.
Fig. 2: Overview of the proposed compositional forensic diagnosis framework for open-world face anti-spoofing. Built on a frozen ViT-based vision foundation model, the framework learns hierarchical purely visual prompts without language encoding. At each stage, micro-forensic primitives are first refined through patch-aware interactions to summarize reusable and composable fine-grained forensic units. These forensic units are then dynamically composed into class-specific primitive evidence prompts according to global priors and augmented with global contextual prompts to generate stage-wise compositional forensic visual prompts. Multi-stage prompts are finally aggregated for real/spoof discrimination. By representing heterogeneous attacks as dynamic compositions of reusable forensic evidence, the framework enables unified reasoning over diverse unseen attack types.
Fig. 3: Fourier analysis results of the text-prompt baseline and the proposed visual prompts under the CtoW protocol. The 2D spectrum show that both prompt types produce strong low-frequency responses, whereas the proposed visual prompts exhibit more pronounced energy expansion in the high-frequency regions. The 1D radial energy curves further demonstrate that visual prompts maintain stronger and more stable responses in the mid- and high-frequency ranges, indicating their superior ability to capture fine-grained forensic cues and thereby enhance cross-domain unseen-attack detection.
Fig. 4: Visualization of attention regions activated by the compositional forensic visual prompts under the CtoW protocol. Real faces mainly activate structurally informative regions, such as the eyes, nose, and mouth, while spoof samples activate attack-specific forensic regions, including makeup artifacts, full-face mask areas, and localized eye- or mouth-level spoof traces. These results show that the learned prompts can effectively localize discriminative evidence across heterogeneous attacks.
Fig. 5: Visualization of attention regions across visual prompt layers, using partial eye and partial mouth attacks under the CtoW protocol. The results show a progressive shift from global facial context to localized spoofed regions, indicating that the learned prompts guide the frozen vision foundation model toward forensic-level evidence localization.
Fig. 6: t-SNE visualization analysis of different prompt components.
Fig. 7: Category activation visualization of micro-forensic primitives under the CtoW protocol. Different primitives exhibit clear category selectivity and produce distinct responses to both real and spoof evidence. Meanwhile, different attack types share a subset of primitives, whereas a single primitive cannot cover all spoofing patterns, indicating that heterogeneous attacks should be jointly represented by multiple reusable primitives. These results demonstrate that micro-forensic primitives provide an effective foundation for dynamic compositional modeling of unseen attacks in open-world scenarios.
Fig. 8: Evolution of category activations of primitive P5 across different layers under the CtoW protocol. Taking real faces, replay attacks, and silicone mask attacks as examples, the responses of P5 gradually evolve from cross-category similarity in shallow layers to clear category separation in deeper layers, indicating that micro-forensic primitives progressively develop stronger category selectivity and forensic discriminative capability as the network depth increases.
Fig. 9: Visualization of the top-10 similar patches for micro-forensic primitives under the CtoW protocol. Red boxes mark the matched patch regions, and surrounding crops provide local context. The retrieved examples show recurring local patterns for individual primitives and different preferences across primitives, providing qualitative evidence of specialization and reuse.
Method
CtoW
ItoW
MtoW
OtoW
AVG
HTER (%)
AUC (%)
HTER (%)
AUC (%)
HTER (%)
AUC (%)
HTER (%)
AUC (%)
HTER (%)
AUC (%)
MS-LBP [ 45 ]
43.84
52.71
54.12
44.42
54.19
46.15
42.53
54.86
48.67
49.54
Color texture [ 1 ]
45.10
54.80
57.47
41.80
46.84
53.97
47.17
53.55
49.15
51.03
CNN [ 56 ]
41.92
59.64
43.29
53.84
43.56
57.22
42.06
57.88
42.71
57.15
DTN [ 38 ]
45.39
55.13
47.61
52.90
38.62
65.61
42.78
61.49
43.60
58.78
SDTN [ 39 ]
40.73
61.89
42.91
58.21
38.14
63.97
46.39
54.33
42.04
59.60
TABLE I: Comparison with state-of-the-art methods using SiW-Mv2 (W for short) dataset as the target domain, and one of CASIA-MFSD (C), Replay-Attack (I), MSU-MFSD (M), and OULU-NPU (O) dataset as the source domain. AVG represents the average value across the four protocols. A lower HTER indicates better performance, while a higher AUC signifies better performance.
Method
CtoH
ItoH
MtoH
OtoH
AVG
HTER (%)
AUC (%)
HTER (%)
AUC (%)
HTER (%)
AUC (%)
HTER (%)
AUC (%)
HTER (%)
AUC (%)
MS-LBP [ 45 ]
46.78
56.63
53.85
44.26
50.52
51.45
43.24
59.42
48.60
52.94
Color texture [ 1 ]
43.66
61.70
49.63
50.00
50.00
50.00
42.20
60.07
46.37
55.44
CNN [ 56 ]
40.95
64.67
40.33
66.27
42.31
63.87
39.04
65.36
40.66
65.04
DTN [ 38 ]
39.04
62.86
36.59
67.33
40.54
65.22
45.64
53.70
40.45
62.28
SDTN [ 39 ]
51.16
48.33
45.27
56.35
50.76
47.22
41.92
62.07
47.28
53.49
TABLE II: Comparison with state-of-the-art methods using HQ-WMCA (H for short) dataset as the target domain, and one of CASIA-MFSD (C), Replay-Attack (I), MSU-MFSD (M), and OULU-NPU (O) dataset as the source domain. AVG represents the average value across the four protocols. A lower HTER indicates better performance, while a higher AUC signifies better performance.
Fig. 10: Pairwise cosine similarity matrix of the learned micro-forensic primitives under the CtoW protocol. Most primitive pairs exhibit low similarity, indicating that the learned primitives capture diverse aspects of localized forensic evidence.
Fig. 11: Utilization of the micro-forensic primitives under the CtoW protocol. All primitives remain actively utilized, while their different average routing weights reflect differentiated contributions to compositional forensic representation.
Method
StoF
HTER (%)
AUC (%)
MS-LBP [ 45 ]
53.80
46.52
Color texture [ 1 ]
55.85
45.55
CNN [ 56 ]
43.74
61.07
DTN [ 38 ]
41.37
64.45
SDTN [ 39 ]
36.03
66.47
TABLE III: Comparison with state-of-the-art methods using CASIA-SURF (S) dataset as the source domain and CeFA (F) dataset as the target domain. A lower HTER indicates better performance, while a higher AUC signifies better performance.
Component
HTER (%)
AUC (%)
w/o primitive evidence prompts
26.72
80.72
w/o global augmentation
10.89
95.08
w/o global guild
17.84
90.29
w/o all global contextual prompts
50.00
50.00
Ours
10.14
95.26
TABLE IV: Component contribution analysis results under the CtoW protocol.
Number of Primitives
HTER (%)
AUC (%)
4
16.78
90.16
6
12.51
93.86
8
10.14
95.26
10
12.57
92.74
12
15.56
91.02
TABLE V: Comparison of the number of primitives under the CtoW protocol.
Component
HTER (%)
AUC (%)
w/o layer6
15.45
92.32
w/o layer12
11.89
92.93
w/o layer18
15.00
91.97
w/o layer24
11.13
94.37
Ours
10.14
95.26
TABLE VI: Ablation analysis of visual prompts at different layers under the CtoW protocol.
Backbone
HTER (%)
AUC (%)
ViT-B/16
23.40
83.09
ViT-B/32
24.69
82.59
ViT-L/14
13.61
92.91
ViT-L/14@336px
10.14
95.26
TABLE VII: Comparison of vision foundation model backbones under the CtoW protocol.
Fig. 12: Category-wise error rates under the CtoW protocol. Errors are mainly concentrated in makeup and partial attacks with subtle or spatially localized spoofing cues, while most other attack types achieve error rates below 3%.
With the increasing diversity of spoofing attacks, there is a growing demand for unified Face Anti-Spoofing (FAS) models capable of detecting both physical and digital threats. While existing Vision-Language Models (VLMs) demonstrate high generalization in this context, they heavily rely on complex multimodal fusion and external text encoders. In this paper, we propose DINO-VPT, a lightweight, vision-only framework leveraging hierarchical visual prompt tuning. By dynamically injecting prompts conditioned on input features via a Prompt Routing Network (PRN), our method effectively disentangles diverse spoofing artifacts without requiring multimodal fusion. Evaluations on the UniAttackData benchmark demonstrate that DINO-VPT achieves higher accuracy than state-of-the-art VLM-based methods. Our results indicate that a properly structured vision-only architecture can achieve state-of-the-art performance in unified FAS without the need for multimodal supervision.
Pierre Gallin-Martel, Mika Feng, Koichi Ito +1
Graduate School of Information Sciences, Tohoku University, Japan
Face Anti-Spoofing (FAS) remains challenging due to the requirement for robust domain generalization across unseen environments. While recent trends leverage Vision-Language Models (VLMs) for semantic supervision, these multimodal approaches often demand prohibitive computational resources and exhibit high inference latency. Furthermore, their efficacy is inherently limited by the quality of the underlying visual features. This paper revisits the potential of vision-only foundation models to establish a highly efficient and robust baseline for FAS. We conduct a systematic benchmarking of 15 pre-trained models, such as supervised CNNs, supervised ViTs, and self-supervised ViTs, under severe cross-domain scenarios including the MICO and Limited Source Domains (LSD) protocols. Our comprehensive analysis reveals that self-supervised vision models, particularly DINOv2 with Registers, significantly suppress attention artifacts and capture critical, fine-grained spoofing cues. Combined with Face Anti-Spoofing Data Augmentation (FAS-Aug), Patch-wise Data Augmentation (PDA) and Attention-weighted Patch Loss (APL), our proposed vision-only baseline achieves state-of-the-art performance in the MICO protocol. This baseline outperforms existing methods under the data-constrained LSD protocol while maintaining superior computational efficiency. This work provides a definitive vision-only baseline for FAS, demonstrating that optimized self-supervised vision transformers can serve as a backbone for both vision-only and future multimodal FAS systems. The project page is available at: https://gsisaoki.github.io/FAS-VFMbenchmark-CVPRW2026/ .
Mika Feng, Pierre Gallin-Martel, Koichi Ito +1
Graduate School of Information Sciences, Tohoku University, Japan
Face recognition remains vulnerable to presentation attacks, calling for robust Face Anti-Spoofing (FAS) solutions. Recent MLLM-based FAS methods reformulate the binary classification task as the generation of brief textual descriptions to improve cross-domain generalization. However, their generalizability is still limited, as such descriptions mainly capture intuitive semantic cues (e.g., mask contours) while struggling to perceive fine-grained visual patterns. To address this limitation, we incorporate external visual tools into MLLMs to encourage deeper investigation of subtle spoof clues. Specifically, we propose the Tool-Augmented Reasoning FAS (TAR-FAS) framework, which reformulates the FAS task as a Chain-of-Thought with Visual Tools (CoT-VT) paradigm, allowing MLLMs to begin with intuitive observations and adaptively invoke external visual tools for fine-grained investigation. To this end, we design a tool-augmented data annotation pipeline and construct the ToolFAS-16K dataset, which contains multi-turn tool-use reasoning trajectories. Furthermore, we introduce a tool-aware FAS training pipeline, where Diverse-Tool Group Relative Policy Optimization (DT-GRPO) enables the model to autonomously learn efficient tool use. Extensive experiments under a challenging one-to-eleven cross-domain protocol demonstrate that TAR-FAS achieves SOTA performance while providing fine-grained visual investigation for trustworthy spoof detection.