cs.CVAug 20, 2026

Tomatoes, Potatoes, and Onions: Questioning the Need for Faces in Face Presentation Attack Detection

Authors: Guray Ozgur, Fadi Boutros, Naser Damer

Organizations: Fraunhofer IGD and Department of Computer Science, TU Darmstadt Darmstadt, Germany

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Face presentation attack detection (PAD) is traditionally formulated as a face-specific problem, although many of the visual artifacts introduced by print, replay, and recapture processes are not inherently tied to facial appearance. In this work, we investigate whether transferable PAD representations can be learned without using faces during downstream PAD training. To this end, we introduce TPO, a controlled face-free presentation attack dataset consisting of bona fide, print, and replay recordings of, almost randomly chosen, tomatoes, potatoes, and onions acquired under protocols that closely mirror conventional face PAD datasets. Using a foundation-model-based PAD architecture, we demonstrate that a detector trained on TPO achieves an average AUC of 92.70% across four standard cross-dataset face PAD benchmarks, outperforming training on synthetic faces and remaining competitive with models trained on real face datasets. Conversely, models trained on face PAD datasets transfer consistently above chance to TPO, suggesting that the learned representations capture characteristics of the presentation process rather than object semantics. Furthermore, incorporating TPO into conventional face PAD training consistently improves cross-dataset performance under fixed optimization budgets, indicating that face-free data provides complementary information rather than simply additional training samples. Finally, representation and frequency analyses provide further evidence that transferable PAD representations cannot be explained by a single spectral artifact but instead encode richer presentation cues shared across object categories. Together, these results provide empirical evidence that transferable presentation attack representations can be learned independently of facial content, opening new opportunities for privacy-preserving and identity-independent PAD development.

Figures & tables

Figure 1. Same presentation process, different objects. TPO examples (top) and Idiap Replay-Attack examples (bottom) contain the same PAD structure: bona fide camera observations and print or display attacks recaptured by a second camera. Replacing faces with tomatoes, potatoes, and onions preserves the acquisition and presentation-instrument cues while removing facial identity, which makes the cross-object transfer test possible. The TPO dataset is released at https://github.com/gurayozgur/TPO . Two horizontal sample grids compare the vegetable TPO dataset above with the face-based Idiap Replay-Attack dataset below. Each grid contains bona fide camera images and recaptured print or display attacks. The objects differ, but both grids show the same visual effects of printing, display replay, and camera recapture.
SubsetVideosImagesTotal
Bona fide1,2481,2482,496
Print attacks4,992-4,992
Replay attacks4,992-4,992
Total11,2321,24812,480
Table 1. TPO composition. TPO contains 12,480 presentations from 78 vegetable identities. Print and replay attacks are exactly balanced at 4,992 videos each; the bona fide subset contains 1,248 videos and 1,248 still images.
Training data / method→\rightarrow M→\rightarrow C→\rightarrow I→\rightarrow OAvg. faces→\rightarrow TPO
HTER ↓\downarrowAUC ↑\uparrowHTER ↓\downarrowAUC ↑\uparrowHTER ↓\downarrowAUC ↑\uparrowHTER ↓\downarrowAUC ↑\uparrowHTER ↓\downarrowAUC ↑\uparrowHTER ↓\downarrowAUC ↑\uparrow
No PAD training (zero-shot)
CLIP ViT-B/16, text-image prompts46.6753.5252.7844.4437.4566.5842.1259.8944.7556.1136.8967.72
Trained on TPO (vegetables, no faces )
ViT-B/16, ImageNet-21k41.9059.9848.5655.7621.3585.2936.0770.2236.9767.81  
ViT-B/16, CLIP+LoRA (FoundPAD)15.0091.0111.1195.9812.2094.0818.3089.7414.1592.70  
Table 2. Cross-object transfer and the role of training source. We compare ViT-B/16 models trained with no PAD data, TPO, SynthASpoof, or real face datasets, then evaluate on M, C, I, O, and TPO. TPO-trained FoundPAD reaches 92.70% AUC at 14.15% HTER on MCIO, compared with 67.81% AUC for the architecture-matched ViT-B/16 initialized from ImageNet-21k and 81.02% when FoundPAD is trained on SynthASpoof. Face-free transfer is therefore substantially stronger with the CLIP prior and exceeds the synthetic-face control. Single-source face-to-TPO transfer is uneven at 58.89-89.88% AUC. HTER is measured at the test-EER threshold; gray cells denote training domains.
Training dataMetricC →\to IC →\to MC →\to OI →\to CI →\to MI →\to OM →\to CM →\to IM →\to OO →\to IO →\to MO →\to CAvg.
face onlyHTER ↓\downarrow21.8524.0524.6635.6728.5716.765.229.509.739.5520.244.6717.54
AUC ↑\uparrow84.2783.7984.2473.0781.8289.7598.9797.0995.0594.9190.1498.8689.33
face + TPOHTER ↓\downarrow15.0016.9021.6225.3325.0018.590.675.555.9513.1017.142.7813.97
AUC ↑\uparrow91.9389.0287.2886.5584.7388.6599.9098.8997.9594.1592.0799.4392.55
Table 3. Can TPO replace part of single-source face exposure? Replacing part of a fixed single-source face-training budget with TPO consistently improves cross-dataset PAD. Under identical optimization budgets, introducing face-free presentation data increases mean AUC from 89.33% to 92.55% while reducing mean HTER from 17.54% to 13.97%, showing that TPO contributes complementary presentation information rather than simply increasing training data..
Training dataMetricdouble-sourcetriple-sourceAvg.
M&I →\to CM&I →\to OO&C&I →\to MO&M&I →\to CO&C&M →\to II&C&M →\to O
face onlyHTER ↓\downarrow16.898.0810.9515.0018.3019.1214.72
AUC ↑\uparrow89.8897.5192.9494.9589.3888.0092.11
face + TPOHTER ↓\downarrow3.448.0616.192.4411.005.887.84
AUC ↑\uparrow99.1196.9592.0799.5095.8298.2996.96
Table 4. Face-free data remains beneficial even in stronger multi-source training regimes. Replacing part of the sampled face observations with TPO improves average AUC from 92.11% to 96.96% and reduces HTER from 14.72% to 7.84%, indicating that the benefit of face-free presentation data extends beyond low-data scenarios.
TPO training subset→\rightarrow M→\rightarrow C→\rightarrow I→\rightarrow OAverage
HTER ↓\downarrowAUC ↑\uparrowHTER ↓\downarrowAUC ↑\uparrowHTER ↓\downarrowAUC ↑\uparrowHTER ↓\downarrowAUC ↑\uparrowHTER ↓\downarrowAUC ↑\uparrow
all vegetables, both PAIs (reference)15.0091.0111.1195.9812.2094.0818.3089.7414.1592.70
print attacks only27.3881.268.6797.2623.1086.0428.8680.0022.0086.14
replay attacks only28.8180.8826.0083.4717.5089.7226.4881.8124.7083.97
tomatoes only24.0582.5414.1192.6027.6080.6229.2876.7923.7683.14
potatoes only25.9580.9427.3382.0225.5584.2624.1384.3925.7482.90
Table 5. What makes face-free training transfer? Attack diversity is more important than dataset size for face-free PAD training. Restricting TPO to a single attack type substantially reduces transfer performance, whereas individual vegetable categories already provide meaningful generalization. Combining multiple vegetable types yields the strongest results, while using only a small fraction of available video frames causes almost no performance degradation, suggesting that presentation diversity rather than redundant frames drives transfer.
Figure 2. Training source changes the embedding geometry. FoundPAD visual embeddings for the same class-balanced samples from M, C, I, O, TPO, and SynthASpoof. Panels (a-b) use the TPO-trained encoder; panels (c-d) use the O-trained encoder. Dataset coloring in (a,c) shows stronger source-domain organization after TPO training, while PAD coloring in (b,d) shows a clearer cross-domain bona fide/attack partition after O training. Each dataset contributes 250 bona fide and 250 attack images. Each encoder is projected separately with fixed-seed PCA-t-SNE; axes are arbitrary. Four scatter plots show identical images embedded by two FoundPAD encoders. In panels a and c, six colors identify M, C, I, O, TPO, and SynthASpoof. In panels b and d, blue circles mark bona fide images and orange triangles mark attacks. The TPO-trained pair forms stronger dataset-specific groups, whereas the O-trained pair shows a clearer separation between bona fide and attack points across datasets.
Figure 3. The transferable cue is not one global frequency signature. Radial log-magnitude spectra for M, C, I, O, TPO, and SynthASpoof. Bona fide curves in (a) differ strongly by dataset and crop. Attack - bona fide residuals in (b) also disagree in direction: TPO gains high-frequency energy, C, I, O, and SynthASpoof lose it, and M remains near zero. Curves average 400 images per class and dataset; shading gives 95% confidence intervals. Colors match Fig. 2 . Images are grayscale, resized to 256×256256{\times}256 , standardized per image, and Hann-windowed before the FFT. Two line plots share six dataset colors. The left plot shows widely separated bona fide frequency spectra. The right plot shows attack minus bona fide residuals around a horizontal zero line: the TPO curve is positive at high frequencies, the C, I, O, and SynthASpoof curves are negative, and the M curve stays near zero. Narrow shaded bands show confidence intervals.
More in this topic

Face Presentation Attack Detection

Face Presentation Attack Detection identifies spoofing attempts, such as printed, replayed, masked, or digitally altered faces, targeting face recognition systems.

See all 21 papers

Explore similar work

CardsList
Jul 29, 2026

Foundation Models for Face Presentation Attack Detection: A Unified Linear-Probing Benchmark

Face presentation attack detection (PAD) remains challenging under cross-dataset evaluation, where domain shift degrades models trained on a single dataset. The scarcity of large-scale labeled data motivates adapting pretrained vision models rather than training task-specific architectures from scratch, raising a fundamental question: do general-purpose vision foundation models encode PAD-relevant information accessible with minimal task-specific training? To investigate, we systematically evaluate 24 frozen encoders, including self-supervised vision transformers, vision-language encoders, and supervised CNNs, using a unified linear-probing protocol on the MCIO benchmark (MSU-MFSD, CASIA-FASD, Replay-Attack, OULU-NPU). The backbone remains fixed, and only a lightweight linear head is trained to isolate the PAD information already present in the pretrained representation. Results show that frozen foundation-model representations can support strong intra-dataset PAD performance with only a linear classifier, but this performance does not reliably transfer across datasets. Model scale is beneficial within several families, although the effect is not monotonic and is strongly mediated by architecture and pretraining. InternViT-6B achieves the lowest mean intra-dataset error, whereas CLIP ViT-B/32 offers the most favorable cross-dataset transfer-compute trade-off among the evaluated probes. These findings suggest that while pretrained representations contain PAD-relevant information, explicit adaptation remains necessary to address domain shift.

Peter Lorenz, Anjith George, Sébastien Marcel

Idiap Research Institute, Martigny, Switzerland · University of Lausanne (UNIL), Lausanne, Switzerland

Vision Foundation ModelsLinear ProbingCross-Domain GeneralizationFace Presentation Attack Detection
AskPDF
Aug 10, 2026

LoRA-based Adaptation Alone Is Not Enough: Understanding the Limits of Foundation Models for Face Presentation Attack Detection

Face presentation attack detection (PAD) aims to reliably detect a wide range of presentation attacks. While PAD methods achieve strong performance within individual datasets, their performance degrades under cross-dataset evaluation. Variations in sensors or lighting conditions can reduce the effectiveness of detectors from near-perfect to nearly random. Foundation models (FMs) have emerged as a promising alternative because typical PAD datasets, such as the MCIO benchmarks (MSU-MFSD, CASIA-FASD, Replay-Attack, and OULU-NPU), are small relative to the scale used for web-based pretraining. However, existing PAD systems primarily focus on CLIP-based foundation models, while overlooking other FMs with different architectures and training procedures. This study addresses this question by systematically evaluating 32 FMs. Zero-shot prompting achieves performance near chance across model families and scales. The vision encoders, when low-rankadapted (LoRA) with fewer than 1% trainable weights, achieve below 2% intra-dataset ACER in most cases, while cross-dataset ACER is substantially higher. LoRA primarily refines the decision boundary within a dataset, suggesting that pretrained representations and the adaptation dataset play a larger role in cross-dataset generalization than the evaluated lightweight adaptation strategy.

Peter Lorenz, Anjith George, Marcel Sébastien

Idiap Research Institute, Martigny, Switzerland · University of Lausanne (UNIL), Lausanne, Switzerland

Vision Foundation ModelsVision Foundation Model AdaptationLow-Rank AdaptationFace Presentation Attack DetectionCross-Dataset Generalization
AskPDF
Jun 16, 2026

Architectural Bias in Face Presentation Attack Detection: A Comparative Study of Vision Transformers and Convolutional Neural Networks

Face Presentation Attack Detection (PAD) systems constitute a critical security layer in biometric authentication; however, existing approaches exhibit systematic performance disparities across demographic groups, disproportionately affecting individuals with darker skin tones. This paper presents a comparative empirical investigation of whether Vision Transformer architectures reduce demographic bias in face PAD systems relative to convolutional baselines. Experiments are conducted on the CASIA-SURF Cross-Ethnicity Face Anti-Spoofing (CeFA) dataset. Three architectures are evaluated: a Multimodal ViT-Tiny trained from scratch, a ResNet18 CNN baseline, and a pretrained DeiT-S fine-tuned on CeFA across African, East Asian, and zero-shot Central Asian demographic groups. DeiT-S achieves the highest overall accuracy of 97.27% and the lowest EER of 0.86%, outperforming ResNet18 at 90.15% accuracy. In terms of fairness, DeiT-S reduces the inter-ethnic ACER gap between African and East Asian subjects to 0.13%, compared to 0.75% reported in an LBP-based work [6], representing an 83% reduction. Most notably, while ResNet18 records a BPCER of 10.44% on zero-shot Central Asian subjects, DeiT-S maintains 2.89% on the same unseen group, demonstrating a 3.6x generalization advantage. These results suggest that pretrained Vision Transformers achieve superior PAD accuracy, produce smaller demographic performance gaps, and generalize more equitably across unseen demographic groups, indicating that cross-demographic fairness in PAD may partly be influenced by architectural design.

Ngela Landon Ntung, Floride Tuyisenge, Jema David Ndibwile

College of Engineering, Carnegie Mellon University Africa, Kigali, Rwanda

Vision TransformerAlgorithmic FairnessFace Presentation Attack Detection
AskPDF