cs.CVAug 18, 2026
SavePrimitive-Driven Compositional Forensic Visual Prompting for Open-World Face Anti-Spoofing
Organizations: The First Affiliated Hospital, the School of Computer Science, University of South China, Hengyang, 421001, China · New Laboratory of Pattern Recognition, MAIS, CASIA, Beijing, 100190, China · Department of Computer Science and Engineering, University of California, Merced, CA, 95340, USA
Abstract
Open-world face anti-spoofing must address both covariate and semantic shifts: source and target domains differ in imaging conditions, while target domains contain diverse attack types absent from training. Existing prompt-based approaches often express spoofing through category semantics or language guidance, which is effective for modeling high-level concepts but is less suited to explicitly capturing the evolving fine-grained and spatially heterogeneous forensic evidence of unseen attacks. Motivated by the hypothesis that many unseen attacks can be characterized by new combinations of recurring visual cues, we propose a compositional forensic visual prompt learning framework that operates entirely in the visual feature space. Built on a frozen ViT-based vision foundation model, the framework employs patch-aware attention to refine a shared set of learnable micro-forensic primitives into localized forensic evidence units derived from image patches. Class-specific global contextual prompts then provide input-dependent routing weights that adaptively select and compose these primitives into compositional forensic visual prompts for real/spoof discrimination. The primitives are not assigned predefined semantic meanings; instead, their specialization and reuse emerge from shared parameterization and joint optimization across categories. Extensive experiments on nine open-world protocols demonstrate state-of-the-art performance, strong cross-domain generalization, and robust adaptation to unseen attacks.
Figures & tables
Fig. 1: (a) Open-world face anti-spoofing exhibits severe covariate and semantic shifts, resulting in continuously evolving heterogeneous spoof cues in both pattern and spatial distribution. (b) Our framework learns reusable micro-forensic primitives and dynamically composes them using image-level physical priors for unified detection of heterogeneous attacks. (c) Motivating hypothesis: heterogeneous unseen attacks may be represented by new combinations of recurring visual forensic cues.
Fig. 2: Overview of the proposed compositional forensic diagnosis framework for open-world face anti-spoofing. Built on a frozen ViT-based vision foundation model, the framework learns hierarchical purely visual prompts without language encoding. At each stage, micro-forensic primitives are first refined through patch-aware interactions to summarize reusable and composable fine-grained forensic units. These forensic units are then dynamically composed into class-specific primitive evidence prompts according to global priors and augmented with global contextual prompts to generate stage-wise compositional forensic visual prompts. Multi-stage prompts are finally aggregated for real/spoof discrimination. By representing heterogeneous attacks as dynamic compositions of reusable forensic evidence, the framework enables unified reasoning over diverse unseen attack types.
Fig. 3: Fourier analysis results of the text-prompt baseline and the proposed visual prompts under the protocol. The 2D spectrum show that both prompt types produce strong low-frequency responses, whereas the proposed visual prompts exhibit more pronounced energy expansion in the high-frequency regions. The 1D radial energy curves further demonstrate that visual prompts maintain stronger and more stable responses in the mid- and high-frequency ranges, indicating their superior ability to capture fine-grained forensic cues and thereby enhance cross-domain unseen-attack detection.
Fig. 4: Visualization of attention regions activated by the compositional forensic visual prompts under the protocol. Real faces mainly activate structurally informative regions, such as the eyes, nose, and mouth, while spoof samples activate attack-specific forensic regions, including makeup artifacts, full-face mask areas, and localized eye- or mouth-level spoof traces. These results show that the learned prompts can effectively localize discriminative evidence across heterogeneous attacks.
Fig. 5: Visualization of attention regions across visual prompt layers, using partial eye and partial mouth attacks under the protocol. The results show a progressive shift from global facial context to localized spoofed regions, indicating that the learned prompts guide the frozen vision foundation model toward forensic-level evidence localization.
Fig. 6: t-SNE visualization analysis of different prompt components.
Fig. 7: Category activation visualization of micro-forensic primitives under the protocol. Different primitives exhibit clear category selectivity and produce distinct responses to both real and spoof evidence. Meanwhile, different attack types share a subset of primitives, whereas a single primitive cannot cover all spoofing patterns, indicating that heterogeneous attacks should be jointly represented by multiple reusable primitives. These results demonstrate that micro-forensic primitives provide an effective foundation for dynamic compositional modeling of unseen attacks in open-world scenarios.
Fig. 8: Evolution of category activations of primitive P5 across different layers under the protocol. Taking real faces, replay attacks, and silicone mask attacks as examples, the responses of P5 gradually evolve from cross-category similarity in shallow layers to clear category separation in deeper layers, indicating that micro-forensic primitives progressively develop stronger category selectivity and forensic discriminative capability as the network depth increases.
Fig. 9: Visualization of the top-10 similar patches for micro-forensic primitives under the protocol. Red boxes mark the matched patch regions, and surrounding crops provide local context. The retrieved examples show recurring local patterns for individual primitives and different preferences across primitives, providing qualitative evidence of specialization and reuse.
| Method | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| HTER (%) | AUC (%) | HTER (%) | AUC (%) | HTER (%) | AUC (%) | HTER (%) | AUC (%) | HTER (%) | AUC (%) | |
| MS-LBP [ 45 ] | 43.84 | 52.71 | 54.12 | 44.42 | 54.19 | 46.15 | 42.53 | 54.86 | 48.67 | 49.54 |
| Color texture [ 1 ] | 45.10 | 54.80 | 57.47 | 41.80 | 46.84 | 53.97 | 47.17 | 53.55 | 49.15 | 51.03 |
| CNN [ 56 ] | 41.92 | 59.64 | 43.29 | 53.84 | 43.56 | 57.22 | 42.06 | 57.88 | 42.71 | 57.15 |
| DTN [ 38 ] | 45.39 | 55.13 | 47.61 | 52.90 | 38.62 | 65.61 | 42.78 | 61.49 | 43.60 | 58.78 |
| SDTN [ 39 ] | 40.73 | 61.89 | 42.91 | 58.21 | 38.14 | 63.97 | 46.39 | 54.33 | 42.04 | 59.60 |
TABLE I: Comparison with state-of-the-art methods using SiW-Mv2 (W for short) dataset as the target domain, and one of CASIA-MFSD (C), Replay-Attack (I), MSU-MFSD (M), and OULU-NPU (O) dataset as the source domain. AVG represents the average value across the four protocols. A lower HTER indicates better performance, while a higher AUC signifies better performance.
| Method | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| HTER (%) | AUC (%) | HTER (%) | AUC (%) | HTER (%) | AUC (%) | HTER (%) | AUC (%) | HTER (%) | AUC (%) | |
| MS-LBP [ 45 ] | 46.78 | 56.63 | 53.85 | 44.26 | 50.52 | 51.45 | 43.24 | 59.42 | 48.60 | 52.94 |
| Color texture [ 1 ] | 43.66 | 61.70 | 49.63 | 50.00 | 50.00 | 50.00 | 42.20 | 60.07 | 46.37 | 55.44 |
| CNN [ 56 ] | 40.95 | 64.67 | 40.33 | 66.27 | 42.31 | 63.87 | 39.04 | 65.36 | 40.66 | 65.04 |
| DTN [ 38 ] | 39.04 | 62.86 | 36.59 | 67.33 | 40.54 | 65.22 | 45.64 | 53.70 | 40.45 | 62.28 |
| SDTN [ 39 ] | 51.16 | 48.33 | 45.27 | 56.35 | 50.76 | 47.22 | 41.92 | 62.07 | 47.28 | 53.49 |
TABLE II: Comparison with state-of-the-art methods using HQ-WMCA (H for short) dataset as the target domain, and one of CASIA-MFSD (C), Replay-Attack (I), MSU-MFSD (M), and OULU-NPU (O) dataset as the source domain. AVG represents the average value across the four protocols. A lower HTER indicates better performance, while a higher AUC signifies better performance.
Fig. 10: Pairwise cosine similarity matrix of the learned micro-forensic primitives under the protocol. Most primitive pairs exhibit low similarity, indicating that the learned primitives capture diverse aspects of localized forensic evidence.
Fig. 11: Utilization of the micro-forensic primitives under the protocol. All primitives remain actively utilized, while their different average routing weights reflect differentiated contributions to compositional forensic representation.
| Method | ||
|---|---|---|
| HTER (%) | AUC (%) | |
| MS-LBP [ 45 ] | 53.80 | 46.52 |
| Color texture [ 1 ] | 55.85 | 45.55 |
| CNN [ 56 ] | 43.74 | 61.07 |
| DTN [ 38 ] | 41.37 | 64.45 |
| SDTN [ 39 ] | 36.03 | 66.47 |
TABLE III: Comparison with state-of-the-art methods using CASIA-SURF (S) dataset as the source domain and CeFA (F) dataset as the target domain. A lower HTER indicates better performance, while a higher AUC signifies better performance.
| Component | HTER (%) | AUC (%) |
| w/o primitive evidence prompts | 26.72 | 80.72 |
| w/o global augmentation | 10.89 | 95.08 |
| w/o global guild | 17.84 | 90.29 |
| w/o all global contextual prompts | 50.00 | 50.00 |
| Ours | 10.14 | 95.26 |
TABLE IV: Component contribution analysis results under the protocol.
| Number of Primitives | HTER (%) | AUC (%) |
| 4 | 16.78 | 90.16 |
| 6 | 12.51 | 93.86 |
| 8 | 10.14 | 95.26 |
| 10 | 12.57 | 92.74 |
| 12 | 15.56 | 91.02 |
TABLE V: Comparison of the number of primitives under the protocol.
| Component | HTER (%) | AUC (%) |
| w/o layer6 | 15.45 | 92.32 |
| w/o layer12 | 11.89 | 92.93 |
| w/o layer18 | 15.00 | 91.97 |
| w/o layer24 | 11.13 | 94.37 |
| Ours | 10.14 | 95.26 |
TABLE VI: Ablation analysis of visual prompts at different layers under the protocol.
| Backbone | HTER (%) | AUC (%) |
| ViT-B/16 | 23.40 | 83.09 |
| ViT-B/32 | 24.69 | 82.59 |
| ViT-L/14 | 13.61 | 92.91 |
| ViT-L/14@336px | 10.14 | 95.26 |
TABLE VII: Comparison of vision foundation model backbones under the protocol.
Fig. 12: Category-wise error rates under the protocol. Errors are mainly concentrated in makeup and partial attacks with subtle or spatially localized spoofing cues, while most other attack types achieve error rates below 3%.
More in this topic
Face Anti-Spoofing
Face anti-spoofing detects presentation and digital attacks that try to fool facial recognition systems.
See all 13 papers