CPG-PAD: Concept-Informed Prompts Guided Presentation Attack Detection

Technical Summary: CPG-PAD: Concept-Informed Prompts Guided Presentation Attack Detection

Problem Statement
Presentation Attack Detection (PAD) is critical for securing face recognition systems against spoofing attempts such as printed photos, replayed videos, and 3D masks. While deep learning-based methods have shown promise, they struggle to generalize across unseen domains due to significant shifts in sensors, lighting conditions, and attack materials. Recent approaches leveraging Vision-Language Models (VLMs), particularly CLIP-based frameworks, have improved generalization by utilizing multi-modal knowledge. However, existing CLIP-like PAD methods typically rely on human-designed textual prompts (e.g., "a photo of a real face") optimized under class-label supervision. The authors argue that these human-level prompts fail to explicitly align with fine-grained, attack-relevant visual semantics (such as subtle geometric distortions or illumination-reflection discrepancies) and often overfit to domain-specific artifacts rather than capturing transferable attack cues.

Methodology
The paper proposes CPG-PAD (Concept-Informed Prompts Guided Presentation Attack Detection), a framework that integrates model-level concept guidance into the prompt learning process. The method consists of two primary stages:

1. Visual Concept-driven Enhancement (VCE):

   • This module operates on a pretrained CLIP model without requiring parameter updates.
   • Concept Discovery: Using Semi-Negative Matrix Factorization (Semi-NMF) on activation maps from a subset of domain data, the system automatically discovers PAD-relevant visual concepts (e.g., "paper crease," "cut holes," "ambiguous eyes") directly from the feature space.
   • Heatmap Generation: These discovered concepts are used to generate fine-grained feature heatmaps ($H_{gt}$) for the entire dataset. These heatmaps serve as localized, concept-associated guidance signals that highlight specific visual cues relevant to attack detection, extending beyond human-level understanding.

2. Prompt-based Concept Injection (PCI):

   • This stage learns multiple concept-informed prompts by aligning textual prompts with the visual concepts discovered by VCE.
   • Learnable Prompts: The framework utilizes learnable prompt embeddings concatenated with fixed class-wise text descriptions (e.g., "A photo of a fake face").
   • Visual-Prompt Decoder (VPD): A novel decoder module, incorporating Multi-head Self-Attention (MSA) and a proposed Multi-head Dual-Attention (MDA) mechanism, facilitates interaction between the prompt features and image tokens.
   • Concept Mapping Loss: The VPD decodes the prompts into predicted heatmaps ($H_{dec}$). A concept mapping loss ($L_M$) is applied to minimize the error between $H_{dec}$ and the ground-truth concept heatmaps ($H_{gt}$) using Hungarian matching. This forces the learnable prompts to align with the model's internal concept space, effectively injecting visual concept information into the text prompts.
   • Classification: The final classification is performed by calculating similarity scores between the learned prompt features and the CLS token of the input image, supervised by both the classification cross-entropy loss and the concept mapping loss.

Key Contributions

• Novel Framework: The introduction of CPG-PAD, which enhances domain generalization by incorporating visual concepts discovered via XAI techniques on pretrained VLMs into the prompt learning process.
• VCE and PCI Mechanisms: The design of the Visual Concept-driven Enhancement (VCE) to automatically discover attack-relevant concepts and generate feature heatmaps, and the Prompt-based Concept Injection (PCI) to learn concept-informed prompts via the Visual-Prompt Decoder (VPD).
• State-of-the-Art Performance: The demonstration of superior cross-domain performance across nine benchmark datasets under multi-source, limited-source, and single-source evaluation protocols.

Experimental Results
The authors evaluated CPG-PAD on nine datasets (including MSU-MFSD, CASIA-FASD, OULU-NPU, CelebA-Spoof, and SiW-Mv2) across five evaluation protocols (P1–P5).

• Multi-source (P1): On the ICMO benchmark, CPG-PAD achieved an average Half Total Error Rate (HTER) of 2.08%, outperforming the previous state-of-the-art CLIP-based method S-CPTL (3.33%) and even S-CPTL trained with additional data (2.89%).
• Limited-source (P2/P3): In scenarios with fewer source domains, CPG-PAD consistently achieved top-two performance, reducing average HTER to 9.91% (without extra data) and 6.59% (with CelebA-Spoof augmentation) on CSW datasets.
• Single-source (P4): The method achieved an average HTER of 5.33% (3.36% with augmentation), significantly outperforming other single-source baselines.
• Unknown PAI (P5): On the SiW-Mv2 dataset with unknown Presentation Attack Instruments (PAIs), CPG-PAD reduced the average HTER from 3.03% (CLIP baseline) to 1.02%, showing particular robustness against obfuscation, makeup, and 3D masks.
• Ablation Studies: Experiments confirmed the necessity of each component (Learnable Prompts, Concept Mapping Loss, and VPD), the optimal number of prompts (matching the number of discovered concepts, $J=K=15$), and the optimal VPD depth (4 layers).

Significance
The paper claims that CPG-PAD addresses the limitation of human-designed prompts in CLIP-based PAD methods by leveraging model-level signals. By using XAI to discover visual concepts and heatmaps, the framework enables the model to learn prompts that align with fine-grained, transferable attack cues rather than domain-specific artifacts. This approach allows the model to capture generalizable features and suppress dataset-specific biases, leading to robust performance in unseen target domains without relying on additional sensors or complex multi-modal reasoning architectures (such as Large Language Models). The results suggest that distilling visual concepts from pretrained VLMs is an effective strategy for enhancing the domain generalization of face anti-spoofing systems.