Tomatoes, Potatoes, and Onions: Questioning the Need for Faces in Face Presentation Attack Detection

Guray Ozgur; Fadi Boutros; Naser Damer

cs.CVAug 20, 2026

Tomatoes, Potatoes, and Onions: Questioning the Need for Faces in Face Presentation Attack Detection

Authors: Guray Ozgur, Fadi Boutros, Naser Damer

Organizations: Fraunhofer IGD and Department of Computer Science, TU Darmstadt Darmstadt, Germany

Abstract

Face presentation attack detection (PAD) is traditionally formulated as a face-specific problem, although many of the visual artifacts introduced by print, replay, and recapture processes are not inherently tied to facial appearance. In this work, we investigate whether transferable PAD representations can be learned without using faces during downstream PAD training. To this end, we introduce TPO, a controlled face-free presentation attack dataset consisting of bona fide, print, and replay recordings of, almost randomly chosen, tomatoes, potatoes, and onions acquired under protocols that closely mirror conventional face PAD datasets. Using a foundation-model-based PAD architecture, we demonstrate that a detector trained on TPO achieves an average AUC of 92.70% across four standard cross-dataset face PAD benchmarks, outperforming training on synthetic faces and remaining competitive with models trained on real face datasets. Conversely, models trained on face PAD datasets transfer consistently above chance to TPO, suggesting that the learned representations capture characteristics of the presentation process rather than object semantics. Furthermore, incorporating TPO into conventional face PAD training consistently improves cross-dataset performance under fixed optimization budgets, indicating that face-free data provides complementary information rather than simply additional training samples. Finally, representation and frequency analyses provide further evidence that transferable PAD representations cannot be explained by a single spectral artifact but instead encode richer presentation cues shared across object categories. Together, these results provide empirical evidence that transferable presentation attack representations can be learned independently of facial content, opening new opportunities for privacy-preserving and identity-independent PAD development.

Figures & tables

Panel of Figure 1 — Figure 1. Same presentation process, different objects. TPO examples (top) and Idiap Replay-Attack examples (bottom) contain the same PAD structure: bona fide camera observations and print or display attacks recaptured by a second camera. Replacing faces with tomatoes, potatoes, and onions preserves the acquisition and presentation-instrument cues while removing facial identity, which makes the cross-object transfer test possible. The TPO dataset is released at https://github.com/gurayozgur/TPO . Two horizontal sample grids compare the vegetable TPO dataset above with the face-based Idiap Replay-Attack dataset below. Each grid contains bona fide camera images and recaptured print or display attacks. The objects differ, but both grids show the same visual effects of printing, display replay, and camera recapture.

Subset	Videos	Images	Total
Bona fide	1,248	1,248	2,496
Print attacks	4,992	-	4,992
Replay attacks	4,992	-	4,992
Total	11,232	1,248	12,480

Table 1. TPO composition. TPO contains 12,480 presentations from 78 vegetable identities. Print and replay attacks are exactly balanced at 4,992 videos each; the bona fide subset contains 1,248 videos and 1,248 still images.

No PAD training (zero-shot)
Training data / method	$\rightarrow$ M		$\rightarrow$ C		$\rightarrow$ I		$\rightarrow$ O		Avg. faces		$\rightarrow$ TPO
Training data / method	HTER $\downarrow$	AUC $\uparrow$	HTER $\downarrow$	AUC $\uparrow$	HTER $\downarrow$	AUC $\uparrow$	HTER $\downarrow$	AUC $\uparrow$	HTER $\downarrow$	AUC $\uparrow$	HTER $\downarrow$	AUC $\uparrow$
CLIP ViT-B/16, text-image prompts	46.67	53.52	52.78	44.44	37.45	66.58	42.12	59.89	44.75	56.11	36.89	67.72
Trained on TPO (vegetables, no faces )
ViT-B/16, ImageNet-21k	41.90	59.98	48.56	55.76	21.35	85.29	36.07	70.22	36.97	67.81
ViT-B/16, CLIP+LoRA (FoundPAD)	15.00	91.01	11.11	95.98	12.20	94.08	18.30	89.74	14.15	92.70

Table 2. Cross-object transfer and the role of training source. We compare ViT-B/16 models trained with no PAD data, TPO, SynthASpoof, or real face datasets, then evaluate on M, C, I, O, and TPO. TPO-trained FoundPAD reaches 92.70% AUC at 14.15% HTER on MCIO, compared with 67.81% AUC for the architecture-matched ViT-B/16 initialized from ImageNet-21k and 81.02% when FoundPAD is trained on SynthASpoof. Face-free transfer is therefore substantially stronger with the CLIP prior and exceeds the synthetic-face control. Single-source face-to-TPO transfer is uneven at 58.89-89.88% AUC. HTER is measured at the test-EER threshold; gray cells denote training domains.

Training data	Metric	C $\to$ I	C $\to$ M	C $\to$ O	I $\to$ C	I $\to$ M	I $\to$ O	M $\to$ C	M $\to$ I	M $\to$ O	O $\to$ I	O $\to$ M	O $\to$ C	Avg.
face only	HTER $\downarrow$	21.85	24.05	24.66	35.67	28.57	16.76	5.22	9.50	9.73	9.55	20.24	4.67	17.54
face only	AUC $\uparrow$	84.27	83.79	84.24	73.07	81.82	89.75	98.97	97.09	95.05	94.91	90.14	98.86	89.33
face + TPO	HTER $\downarrow$	15.00	16.90	21.62	25.33	25.00	18.59	0.67	5.55	5.95	13.10	17.14	2.78	13.97
face + TPO	AUC $\uparrow$	91.93	89.02	87.28	86.55	84.73	88.65	99.90	98.89	97.95	94.15	92.07	99.43	92.55

Table 3. Can TPO replace part of single-source face exposure? Replacing part of a fixed single-source face-training budget with TPO consistently improves cross-dataset PAD. Under identical optimization budgets, introducing face-free presentation data increases mean AUC from 89.33% to 92.55% while reducing mean HTER from 17.54% to 13.97%, showing that TPO contributes complementary presentation information rather than simply increasing training data..

Training data	Metric	double-source		triple-source				Avg.
Training data	Metric	M&I $\to$ C	M&I $\to$ O	O&C&I $\to$ M	O&M&I $\to$ C	O&C&M $\to$ I	I&C&M $\to$ O	Avg.
face only	HTER $\downarrow$	16.89	8.08	10.95	15.00	18.30	19.12	14.72
face only	AUC $\uparrow$	89.88	97.51	92.94	94.95	89.38	88.00	92.11
face + TPO	HTER $\downarrow$	3.44	8.06	16.19	2.44	11.00	5.88	7.84
face + TPO	AUC $\uparrow$	99.11	96.95	92.07	99.50	95.82	98.29	96.96

Table 4. Face-free data remains beneficial even in stronger multi-source training regimes. Replacing part of the sampled face observations with TPO improves average AUC from 92.11% to 96.96% and reduces HTER from 14.72% to 7.84%, indicating that the benefit of face-free presentation data extends beyond low-data scenarios.

TPO training subset	$\rightarrow$ M		$\rightarrow$ C		$\rightarrow$ I		$\rightarrow$ O		Average
TPO training subset	HTER $\downarrow$	AUC $\uparrow$	HTER $\downarrow$	AUC $\uparrow$	HTER $\downarrow$	AUC $\uparrow$	HTER $\downarrow$	AUC $\uparrow$	HTER $\downarrow$	AUC $\uparrow$
all vegetables, both PAIs (reference)	15.00	91.01	11.11	95.98	12.20	94.08	18.30	89.74	14.15	92.70
print attacks only	27.38	81.26	8.67	97.26	23.10	86.04	28.86	80.00	22.00	86.14
replay attacks only	28.81	80.88	26.00	83.47	17.50	89.72	26.48	81.81	24.70	83.97
tomatoes only	24.05	82.54	14.11	92.60	27.60	80.62	29.28	76.79	23.76	83.14
potatoes only	25.95	80.94	27.33	82.02	25.55	84.26	24.13	84.39	25.74	82.90

Table 5. What makes face-free training transfer? Attack diversity is more important than dataset size for face-free PAD training. Restricting TPO to a single attack type substantially reduces transfer performance, whereas individual vegetable categories already provide meaningful generalization. Combining multiple vegetable types yields the strongest results, while using only a small fraction of available video frames causes almost no performance degradation, suggesting that presentation diversity rather than redundant frames drives transfer.

Figure 2. Training source changes the embedding geometry. FoundPAD visual embeddings for the same class-balanced samples from M, C, I, O, TPO, and SynthASpoof. Panels (a-b) use the TPO-trained encoder; panels (c-d) use the O-trained encoder. Dataset coloring in (a,c) shows stronger source-domain organization after TPO training, while PAD coloring in (b,d) shows a clearer cross-domain bona fide/attack partition after O training. Each dataset contributes 250 bona fide and 250 attack images. Each encoder is projected separately with fixed-seed PCA-t-SNE; axes are arbitrary. Four scatter plots show identical images embedded by two FoundPAD encoders. In panels a and c, six colors identify M, C, I, O, TPO, and SynthASpoof. In panels b and d, blue circles mark bona fide images and orange triangles mark attacks. The TPO-trained pair forms stronger dataset-specific groups, whereas the O-trained pair shows a clearer separation between bona fide and attack points across datasets.

Figure 3. The transferable cue is not one global frequency signature. Radial log-magnitude spectra for M, C, I, O, TPO, and SynthASpoof. Bona fide curves in (a) differ strongly by dataset and crop. Attack - bona fide residuals in (b) also disagree in direction: TPO gains high-frequency energy, C, I, O, and SynthASpoof lose it, and M remains near zero. Curves average 400 images per class and dataset; shading gives 95% confidence intervals. Colors match Fig. 2 . Images are grayscale, resized to

256{\times}256

, standardized per image, and Hann-windowed before the FFT. Two line plots share six dataset colors. The left plot shows widely separated bona fide frequency spectra. The right plot shows attack minus bona fide residuals around a horizontal zero line: the TPO curve is positive at high frequencies, the C, I, O, and SynthASpoof curves are negative, and the M curve stays near zero. Narrow shaded bands show confidence intervals.

Face Presentation Attack Detection

Face Presentation Attack Detection identifies spoofing attempts, such as printed, replayed, masked, or digitally altered faces, targeting face recognition systems.

See all 21 papers

Foundation Models for Face Presentation Attack Detection: A Unified Linear-Probing Benchmark
Jul 29, 2026Peter Lorenz, Anjith George, Sébastien MarcelVision Foundation Models Linear Probing
Idiap Research Institute, Martigny, Switzerland · University of Lausanne (UNIL), Lausanne, Switzerland
LoRA-based Adaptation Alone Is Not Enough: Understanding the Limits of Foundation Models for Face Presentation Attack Detection
Aug 10, 2026Peter Lorenz, Anjith George, Marcel SébastienVision Foundation Models Vision Foundation Model Adaptation
Idiap Research Institute, Martigny, Switzerland · University of Lausanne (UNIL), Lausanne, Switzerland
Architectural Bias in Face Presentation Attack Detection: A Comparative Study of Vision Transformers and Convolutional Neural Networks
Jun 16, 2026Ngela Landon Ntung, Floride Tuyisenge, Jema David NdibwileVision Transformer Algorithmic Fairness
College of Engineering, Carnegie Mellon University Africa, Kigali, Rwanda

Jul 29, 2026J/K move · Enter open · S save

Foundation Models for Face Presentation Attack Detection: A Unified Linear-Probing Benchmark

Peter Lorenz, Anjith George, Sébastien Marcel

Idiap Research Institute, Martigny, Switzerland · University of Lausanne (UNIL), Lausanne, Switzerland

Vision Foundation Models Linear Probing Cross-Domain Generalization Face Presentation Attack Detection

Open paper AskPDF arXiv

Face presentation attack detection (PAD) remains challenging under cross-dataset evaluation, where domain shift degrades models trained on a single dataset. The scarcity of large-scale labeled data motivates adapting pretrained vision models rather than training task-specific architectures from scratch, raising a fundamental question: do general-purpose vision foundation models encode PAD-relevant information accessible with minimal task-specific training? To investigate, we systematically evaluate 24 frozen encoders, including self-supervised vision transformers, vision-language encoders, and supervised CNNs, using a unified linear-probing protocol on the MCIO benchmark (MSU-MFSD, CASIA-FASD, Replay-Attack, OULU-NPU). The backbone remains fixed, and only a lightweight linear head is trained to isolate the PAD information already present in the pretrained representation. Results show that frozen foundation-model representations can support strong intra-dataset PAD performance with only a linear classifier, but this performance does not reliably transfer across datasets. Model scale is beneficial within several families, although the effect is not monotonic and is strongly mediated by architecture and pretraining. InternViT-6B achieves the lowest mean intra-dataset error, whereas CLIP ViT-B/32 offers the most favorable cross-dataset transfer-compute trade-off among the evaluated probes. These findings suggest that while pretrained representations contain PAD-relevant information, explicit adaptation remains necessary to address domain shift.

Abstract

Face Presentation Attack Detection

Explore similar work

Foundation Models for Face Presentation Attack Detection: A Unified Linear-Probing Benchmark

LoRA-based Adaptation Alone Is Not Enough: Understanding the Limits of Foundation Models for Face Presentation Attack Detection

Architectural Bias in Face Presentation Attack Detection: A Comparative Study of Vision Transformers and Convolutional Neural Networks