Diff-IrisPAD: Modeling Bona Fide Iris Distributions for Unsupervised Presentation Attack Detection

Geetanjali Sharma; Harsh Yadav; Tanmay Deshpande; Shubham Ashwani; Aditya Nigam; Raghavendra Ramachandra

cs.CVOct 21, 2026

Diff-IrisPAD: Modeling Bona Fide Iris Distributions for Unsupervised Presentation Attack Detection

Authors: Geetanjali Sharma, Harsh Yadav, Tanmay Deshpande, Shubham Ashwani, Aditya Nigam, Raghavendra Ramachandra

Organizations: Indian Institute of Technology Mandi, Himachal Pradesh, India · SAFE Center, Norwegian University of Science and Technology (NTNU), Gjøvik, Norway

Abstract

Iris recognition systems are vulnerable to presentation attacks (PAs), including textured contact lenses, print replays, and synthetic irises. Existing PAD methods rely on supervised learning with attack data, limiting generalization to unseen attacks and new sensors. We propose Diff-IrisPAD, an unsupervised framework based on Brownian Bridge Diffusion that models bona fide iris distributions without using attack samples. The method reconstructs clean iris textures from degraded inputs and detects attacks via reconstruction inconsistency using ViT scoring and pixel-level measures. Experiments on a large-scale multi-sensor dataset (125K+ images, NIR and VIS, 8 attack types) show that Diff-IrisPAD achieves an overall ACER of 30.52, significantly outperforming diffusion-based baselines while demonstrating strong generalization to unseen attacks. These results highlight the effectiveness of diffusion-based bona fide modeling for robust and scalable iris PAD.

Figures & tables

Figure 1: Diff-IrisPAD framework. (A) Training: a latent BBDM (LBBDM-f4) learns bona fide iris distributions by reconstructing clean images from degraded inputs using a frozen VQGAN and trainable UNet. (B) Inference: reconstruction inconsistency ViT is used for threshold-based open-set attack detection without using attack data.

Figure 2: Sample images illustrating different iris presentation attacks, including contact lens, display, synthetic and other

Dataset	Train	Val	Test	Total
Bonafide	28056	5276	12926	46258
Artifact	-	704	1643	2347
Contact Lens	-	2840	6304	9144
E-display(ED)	-	2369	5546	7915
Fake with Add-On	-	39	67	106
Generated	-	2986	4978	7964

Table 1: Diff-IrisPAD is trained using only bona-fide images, without attack data for training or thresholding. Evaluation uses a merged ZAK attack pool (50,612 samples) against 12,926 bona-fide test images, while 5,276 validation bona-fide images are reserved solely for threshold calibration.

Model	Attack	APCER	BPCER	ACER	EER
f-AnoGAN ( $p{=}90$ , $\tau{=}0.977$ ) [ 33 ]	Artifact	99.06	9.55	54.31	60.00
	Contact Lens	98.34	9.55	53.95	56.48
	E-display	87.96	9.55	48.76	41.20
	Fake W/AO	99.06	9.55	54.31	68.18
	Generated	98.93	9.55	54.24	60.63
	Post-Mortem	93.39	9.55	51.47	46.87

Table 2: Comparison of diffusion-based iris PAD methods. Threshold (unsupervised):

\tau

= 90th percentile of bona-fide validation scores (

\approx

10% BPCER), with no use of attack data. BPCER consistency: A fixed

\tau

on a shared bona-fide test set (12,926) yields identical BPCER across attacks; only APCER varies. Test pool: 50,612 attacks (val+test) vs 12,926 bona-fide. Diff-IrisPAD uses

T{=}100

; AnoDDPM uses ViT-B/16 scoring. Bold = best ACER per attack.

Model	Attack	$\tau$	APCER	BPCER	ACER
ResNet50 [ 23 ]	Artifact	0.45	0.776	0.021	0.399
	CL	0.275	0.990	0.005	0.497
	E-display	0.45	0.319	0.017	0.168
	Fake W/AO	0.5	0.134	0.015	0.074
	Generated	0.5	0.458	0.014	0.236
	PostMortem	0.575	0.353	0.014	0.183

Table 3: Leave-One-Attack-Out (LOO) evaluation. The model is trained excluding one attack type and tested on the unseen attack.

Figure 3: Reconstruction and error analysis. Attack samples show higher reconstruction error, while bona-fide images exhibit low error, enabling clear separation.

Steps	Attack	APCER	BPCER	ACER	EER	ms/img
10 $\tau{=}0.201$	Artifact	1.87	9.68	5.78	6.23	84.4
	CL	85.71	9.68	47.69	41.58
	E-display	53.24	9.68	31.46	26.73
	Fake W/AO	6.60	9.68	8.14	7.55
	Generated	88.16	9.68	48.92	42.35
	Post-Mortem	11.81	9.68	10.74	10.58

Table 4: Ablation on denoising steps (

T

). LBBDM-f4 with ViT scoring;

\tau

tuned on validation data. Results averaged across attacks (lower is better).

Biometric Identification

Biometric identification matches or verifies people and animals using distinctive physical, physiological, or behavioral signals.

See all 129 papers

VISER: Visually-Informed System for Enhanced Robustness in Iris Presentation Attack Detection
Mar 18, 2026Byron Dowling, Jacob Piland, Eleanor Frederick +2Visual Saliency
†Department of Computer Science and Engineering, University of Notre Dame, Notre Dame, Indiana 46556, USA · ‡Center for Research Computing, University of Notre Dame, Notre Dame, Indiana 46556, USA
Compact Vision Models for Iris Presentation Attack Detection under Presentation Attack Instrument Shift and Environmental Degradation
Sep 17, 2026Athanasios Angelakis, Marta Gomez-BarreroDistribution Shift Robustness
BioML Lab, RI CODE, UniBw, Munich, Germany
A Systematic Failure Analysis of Vision Foundation Models for Open Set Iris Presentation Attack Detection
May 18, 2026Rahul Anand, Siddharth Singh, Dileep A D +2Vision Foundation Models Open-Set Recognition
Indian Institute of Technology, Dharwad, India. · SAFE Center, Norwegian University of Science and Technology (NTNU), Norway. · Indian Institute of Information Technology Dharwad, India.

Mar 18, 2026J/K move · Enter open · S save

VISER: Visually-Informed System for Enhanced Robustness in Iris Presentation Attack Detection

Byron Dowling, Jacob Piland, Eleanor Frederick, Christopher Sweet+1

†Department of Computer Science and Engineering, University of Notre Dame, Notre Dame, Indiana 46556, USA · ‡Center for Research Computing, University of Notre Dame, Notre Dame, Indiana 46556, USA

Visual Saliency

Open paper AskPDF arXiv

Human perceptual priors have shown promise in saliency-guided deep learning training, particularly in the domain of iris presentation attack detection (PAD). Common saliency approaches include hand annotations obtained via mouse clicks and eye gaze heatmaps derived from eye tracking data. However, the most effective form of human saliency for raising generalization to unknown attack classes in iris PAD remains under-explored. In this paper, we conduct a series of experiments comparing hand annotations, eye tracking heatmaps, segmentation masks, and foundation model embeddings to a state-of-the-art deep learning-based baseline on the task of unknown attack type classification for iris PAD. Results in a leave-one-attack-type out paradigm indicate that denoised eye tracking heatmaps show the best generalization improvement over cross entropy in Attack Presentation Classification Error Rate (APCER) at Bona Fide Presentation Classification Error Rate (BPCER) of 1%. Along with this paper, we offer trained models, code, and saliency maps for reproducibility and to facilitate follow-up research efforts.

Abstract

Biometric Identification

Explore similar work

VISER: Visually-Informed System for Enhanced Robustness in Iris Presentation Attack Detection

Compact Vision Models for Iris Presentation Attack Detection under Presentation Attack Instrument Shift and Environmental Degradation

A Systematic Failure Analysis of Vision Foundation Models for Open Set Iris Presentation Attack Detection