Foundation Models for Face Presentation Attack Detection: A Unified Linear-Probing Benchmark
This paper establishes a unified linear-probing benchmark evaluating 24 frozen foundation models for face presentation attack detection, revealing that while pretrained representations contain task-relevant information for intra-dataset performance, they fail to generalize across datasets without explicit adaptation to overcome domain shift.
Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
Imagine you are trying to teach a robot to spot a fake. You show it a photo of a real person, and then you show it a photo of a person holding up a printed picture of that same face. The robot needs to shout "Real!" for the first and "Fake!" for the second. This is the job of Face Presentation Attack Detection (PAD). It's the digital bouncer at the club of your phone or bank app, ensuring that the person trying to get in is actually a living human and not a clever trickster with a photo, a video, or a mask.
The tricky part is that these robots are often too good at memorizing the specific lighting or camera of the training room but terrible at recognizing fakes in a new room with different lights. This is called the "domain shift" problem. To fix this, scientists have started using Foundation Models. Think of these as giant, super-smart brains that have already read almost the entire internet and looked at billions of pictures. They aren't specialized in spotting fakes yet, but they know a lot about what faces look like. The big question researchers have been asking is: "Do these giant brains already know enough about fakes that we just need to add a tiny, simple switch to their output to make them work, or do we have to retrain the whole thing?"
This paper, titled "Foundation Models for Face Presentation Attack Detection: A Unified Linear-Probing Benchmark," goes into the lab to answer that question. The researchers took 24 different giant, pre-trained brains—some that only look at pictures, some that read text and look at pictures, and some that learned by guessing missing parts of images—and froze them. They didn't let the brains learn anything new; they just attached a very simple, lightweight "linear head" (a single layer of math) to the end of each brain to see if it could learn to spot the fakes.
The results were a mix of "Wow" and "Whoa." When the researchers tested these frozen brains on the same type of data they were trained on (intra-dataset), the big brains were incredible. The largest model, called InternViT-6B, made almost no mistakes, with an error rate of just 1.6%. However, it is important to note that specialized robots built specifically for this job, like DeepPixBiS, actually outperformed most of the frozen probes (though InternViT-6B still beat DeepPixBiS), even though DeepPixBiS had far fewer trainable parameters. This suggests that while these giant models do contain the secret clues needed to spot a fake face, the information is just sitting there, waiting to be unlocked, but specialized training still holds an edge in the same environment for many models.
However, the story changes when you move the robot to a new environment (cross-dataset). When the researchers tested these same frozen brains on data from different cameras or lighting conditions, the performance dropped hard. Even the best model, InternViT-6B, saw its error rate jump significantly, with a gap of 30.3% between its performance on familiar data and new data, resulting in a total error rate of roughly 32% when moving between datasets. The paper explicitly rules out the idea that simply having a bigger model or a more specialized pre-training (like one trained specifically on face fakes) guarantees success in new situations. In fact, a mid-sized model called CLIP ViT-B/32, which was trained on general image-text pairs from the internet, turned out to be the most balanced choice. It offered the best trade-off between how much computer power it needed and how well it could handle new, unseen data, with a cross-dataset error rate of 31.6%.
The authors suggest that while these foundation models have the raw ingredients for spotting fakes, they still need some extra help—like a little fine-tuning or adaptation—to handle the messy reality of different cameras and lighting. The paper concludes that while we don't need to build a new brain from scratch for every new security camera, we also can't just plug in a frozen giant brain and expect it to work perfectly everywhere. The "linear probing" method used here acts as a stress test, showing us exactly how much of the "fake-spotting" knowledge is already there, and how much we still need to teach.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.