Source-linked AI summary
Single-Side Domain Generalization for Face Anti-Spoofing
Yunpei Jia, Jie Zhang, Shiguang Shan, Xilin Chen
TL;DR
Cross-database face anti-spoofing remains difficult because fake faces from different domains have large distribution discrepancies. SSDG addresses this with asymmetric domain generalization that compacts real features and separates fake features, achieving state-of-the-art results on four public databases.
Problem
Existing domain generalization methods struggle to learn a compact generalized feature space for fake faces because their cross-domain distributions differ substantially.
Method
SSDG combines single-side adversarial learning, asymmetric triplet mining, and feature and weight normalization in an end-to-end framework.
Results
SSDG achieves state-of-the-art results on four public databases and outperforms existing methods across the reported testing tasks.
Takeaways & Limitations
Asymmetric optimization makes real-face features compact while allowing fake-face features to remain dispersed across domains, producing a more generalized class boundary.
Takeaways & Limitations
The single-side adversarial-learning design assumes real-face distributions differ less across domains than fake-face distributions.
Abstract
from arXiv · showhide
Existing domain generalization methods for face anti-spoofing endeavor to extract common differentiation features to improve the generalization. However, due to large distribution discrepancies among fake faces of different domains, it is difficult to seek a compact and generalized feature space for the fake faces. In this work, we propose an end-to-end single-side domain generalization framework (SSDG) to improve the generalization ability of face anti-spoofing. The main idea is to learn a generalized feature space, where the feature distribution of the real faces is compact while that of the fake ones is dispersed among domains but compact within each domain. Specifically, a feature generator is trained to make only the real faces from different domains undistinguishable, but not for the fake ones, thus forming a single-side adversarial learning. Moreover, an asymmetric triplet loss is designed to constrain the fake faces of different domains separated while the real ones aggregated. The above two points are integrated into a unified framework in an end-to-end training manner, resulting in a more generalized class boundary, especially good for samples from novel domains. Feature and weight normalization is incorporated to further improve the generalization ability. Extensive experiments show that our proposed approach is effective and outperforms the state-of-the-art methods on four public databases.
1. Introduction
Face anti-spoofing models often fail across databases because database-biased features do not generalize to unseen domains. SSDG instead aggregates real faces while separating fake faces across domains, using asymmetric objectives to improve the class boundary.
- Cross-database testing exposes poor generalization despite promising intra-database results.
- Domain adaptation reduces source-target discrepancy but requires unlabeled target data, which can be difficult and expensive to collect.
- Real-face distributions are relatively similar across domains, whereas diverse attack types make fake-face distributions substantially more variable.
- SSDG makes real-face features from different domains indistinguishable while treating fake faces from different domains separately.
- The framework combines single-side adversarial learning, asymmetric triplet loss, and feature and weight normalization in an end-to-end model.
- SSDG achieves state-of-the-art performance on four public databases.
2. Related Work
Face anti-spoofing research includes texture-based and temporal-based methods, but these approaches can learn database-biased features that generalize poorly. Domain generalization addresses this by using multiple source domains without target data, while SSDG uses asymmetric treatment of real and fake faces.
- Texture-based methods: Texture-based methods use handcrafted descriptors or CNNs to distinguish real and fake faces through texture cues.
- Temporal-based methods: Temporal-based methods detect spoofing from cues in consecutive face frames, including mouth motion, eye blinking, and learned temporal features.
- SSDG: SSDG makes domain distributions indistinguishable for real faces but preserves separation among fake faces through single-side adversarial learning and asymmetric triplet mining.
- Existing methods can extract database-biased features because they do not mine distribution relationships across domains, harming generalization to unseen domains.
- Domain generalization: Domain generalization mines relationships among multiple source domains without accessing target data to improve generalization to unseen domains.
- Domain generalization: Because attack types and collection methods vary widely, seeking one generalized feature space for fake faces can produce a sub-optimal solution.
3. Proposed Method
SSDG optimizes real and fake faces asymmetrically: real features are made compact across domains, while fake features are separated to accommodate their larger distribution discrepancies. The framework combines adversarial learning, asymmetric triplet mining, normalization, and end-to-end optimization.
- Overview: SSDG targets a more generalized class boundary by forcing fake features to be dispersed and real features to be compact.
- Single-Side Adversarial Learning: Single-side adversarial learning aligns only real-face features because their cross-domain discrepancies are assumed smaller than those of fake faces.
- Single-Side Adversarial Learning: The feature generators transform real and fake inputs into latent features, while shared parameters connect the two processing paths.
- Single-Side Adversarial Learning: The feature generator maximizes domain-discriminator loss while the discriminator optimizes the opposite objective; a gradient reversal layer enables simultaneous training.
- Asymmetric Triplet Mining: Asymmetric triplet mining separates fake faces from different domains, aggregates all real faces, and distinguishes real from fake features.
- Feature and Weight Normalization: Feature normalization addresses differing feature norms, while weight normalization constrains the final-layer weights and biases to promote discriminative cues.
- Loss Function: The classifier and feature generator use cross-entropy, and all components are trained end-to-end with balanced adversarial and triplet-loss terms.
4.1. Experimental Settings
The experiments use four public face anti-spoofing databases in four cross-database testing tasks, with one target database held out while the others train the model. Evaluation uses HTER, AUC, ROC, t-SNE, and CAM, and compares two feature-generator architectures.
- Datasets and protocols: Four databases are evaluated by selecting one target domain and using the remaining three source domains, yielding four testing tasks.The databases are OULU-NPU, CASIA-FASD, Idiap Replay-Attack, and MSU-MFSD.
- Implementation details: The implementation detects and aligns faces with MTCNN, resizes them to 256×256×3, uses RGB inputs, and trains on one randomly selected frame per video.
- Network architectures: Two feature-generator architectures are compared: an MADDG-based design and a ResNet-18-based design, denoted SSDG-M and SSDG-R.Both use a 512-unit bottleneck, while the classifier and domain discriminator are fully connected networks.
- Evaluation metrics: The study reports HTER and AUC, along with ROC curves and t-SNE and CAM visualizations, to evaluate performance and learned features.
4.2. Discussion
Ablations, baseline comparisons, architecture tests, limited-source experiments, and visualizations support SSDG’s asymmetric treatment of real and fake faces. The method is reported to improve cross-domain generalization while focusing on internal facial regions rather than domain-specific backgrounds.
- 4.2.1 Influences of Each Network Component: Removing any SSDG component degrades performance across both architectures, while combining single-side adversarial learning, asymmetric triplet loss, and normalization performs best.The ablation evaluates ssad, triplet, and norm components.
- 4.2.2 Comparisons with the Baseline Method: SSDG outperforms the BDG and MADDG methods on all testing tasks, whereas BDG-M and MADDG achieve average HTER values of 23.09% and 23.05%, respectively.The comparison is conducted with different network architectures.
- 4.2.2 Comparisons with the Baseline Method: Asymmetric optimization separates fake faces from different domains while aggregating real faces, producing a class boundary reported to generalize better to unseen domains.
- 4.2.3 Visualizations of the Proposed Method: Grad-CAM visualizations show SSDG focusing on internal face regions instead of domain-specific backgrounds and illuminations, with attack-specific attention such as the eyes for cut attacks.
- 4.2.3 Visualizations of the Proposed Method: t-SNE visualizations show more dispersed fake-face features and more compact real-face features for SSDG than for BDG, supporting a better class boundary.
- 4.2.4 Limited Source Domains: With only two source databases, SSDG achieves the best performance and disperses fake-face features to promote a more generalized class boundary for unseen domains.
- 4.2.5 Comparisons of Different Architectures: The ResNet18-based architecture is more accurate and faster than the MADDG-based architecture, based on average HTER, AUC, and inference-speed comparisons.Inference speed is measured on the OULU database using a single NVIDIA TITAN 1080 GPU at 256×256 resolution.
4.3. Comparison with State-of-the-art Methods
SSDG outperforms all state-of-the-art methods across four testing tasks. The comparison attributes this advantage to asymmetric optimization that accounts for the differing distributions of real and fake faces across domains.
- SSDG outperforms all state-of-the-art methods under four testing tasks.
- Fake-face diversity across attack types and database collection methods makes jointly aggregating fake features from different domains difficult.
- SSDG applies asymmetric optimization by aggregating real faces while separating fake faces from different domains.
4.4. Conclusion
The paper proposes SSDG to learn compact real-face features while dispersing fake-face features across domains. Its experiments show state-of-the-art results on four public databases, supporting asymmetric treatment for generalization to unseen domains.
- SSDG learns a feature space that compacts real-face distributions while dispersing fake-face distributions across domains.
- Single-side adversarial learning aggregates real faces, while asymmetric triplet loss separates fake faces from different domains.
- SSDG achieves state-of-the-art results on four public databases.
- The conclusion suggests that asymmetric treatment can improve generalization to unseen domains because real and fake face distributions differ.
- Future asymmetric designs could divide fake faces according to attack types rather than databases.