PaperlayerView exact revision on arXiv

Source-linked AI summary

Federated Generalized Face Presentation Attack Detection

Rui Shao, Pramuditha Perera, Pong C. Yuen, Vishal M. Patel

arXiv:2104.06595v2cs.CV

TL;DR

Data centers’ limited, distinct fPAD datasets leave models vulnerable to unseen attacks, while privacy rules prevent sharing training data. FedPAD aggregates local model updates without accessing those data, and FedGPAD adds federated domain disentanglement. The reported experiments show FedGPAD outperforms the baselines and FedPAD, including about 9% improvement in HTER and AUC over the pooled-data baseline.

Abstract

from arXiv · show

Face presentation attack detection plays a critical role in the modern face recognition pipeline. A face presentation attack detection model with good generalization can be obtained when it is trained with face images from different input distributions and different types of spoof attacks. In reality, training data (both real face images and spoof images) are not directly shared between data owners due to legal and privacy issues. In this paper, with the motivation of circumventing this challenge, we propose a Federated Face Presentation Attack Detection (FedPAD) framework that simultaneously takes advantage of rich fPAD information available at different data owners while preserving data privacy. In the proposed framework, each data center locally trains its own fPAD model. A server learns a global fPAD model by iteratively aggregating model updates from all data centers without accessing private data in each of them. To equip the aggregated fPAD model in the server with better generalization ability to unseen attacks from users, following the basic idea of FedPAD, we further propose a Federated Generalized Face Presentation Attack Detection (FedGPAD) framework. A federated domain disentanglement strategy is introduced in FedGPAD, which treats each data center as one domain and decomposes the fPAD model into domain-invariant and domain-specific parts in each data center. Two parts disentangle the domain-invariant and domain-specific features from images in each local data center, respectively. A server learns a global fPAD model by only aggregating domain-invariant parts of the fPAD models from data centers and thus a more generalized fPAD model can be aggregated in server. We introduce the experimental setting to evaluate the proposed FedPAD and FedGPAD frameworks and carry out extensive experiments to provide various insights about federated learning for fPAD.

I. INTRODUCTION

Data centers have limited, non-overlapping fPAD data, while privacy rules prevent pooling it; this leaves models vulnerable to attacks users encounter that were unseen during training. The paper proposes federated approaches that aggregate model information without sharing training images, with FedGPAD additionally learning domain-invariant features for generalization.

I. INTRODUCTION

  • Limited data at each center covers few identities and known attack types, weakening generalization to unseen presentation attacks.Users may encounter those unseen attacks, but have only real local data and cannot train fPAD models themselves.Source: §I · p. 2
  • Although training across diverse input distributions and spoof attacks can improve fPAD generalization, privacy policies prevent centers from sharing their collected data.The paper notes that collaborative use of data across centers could improve performance, but direct pooling is impractical.Source: §I · p. 2
  • FedPAD lets data centers share and aggregate model updates while keeping their training images private.The paper frames this as its first study of federated learning for fPAD and focuses on generalization rather than personalization to seen clients.Source: §I · p. 2
  • Unlike conventional federated learning clients, data centers train and exchange models while users download the global model only for inference, exposing it to unseen attacks.This training-versus-testing distinction motivates the paper’s focus on generalization to attacks users encounter.Source: §I · p. 2
  • FedGPAD treats each data center as a source domain and separates domain-invariant from domain-specific model parts, aggregating the invariant parts to form a privacy-preserving global model.The paper also defines an experimental setting and reports extensive experiments and insights about federated learning for fPAD.Source: §I · p. 2

II. RELATED WORK

Prior fPAD work uses single- or multi-domain signals, while federated learning typically targets global or personalized models. This paper addresses privacy-preserving generalization across data centers and distinguishes its domain disentanglement approach from earlier fPAD disentanglement work.

A. Face Presentation Attack Detection

  • Multi-domain fPAD methods use data from multiple datasets or spoof subgroups to improve generalization, while this paper assumes each privacy-constrained center holds one domain.Prior approaches include domain generalization, zero-shot attack grouping, meta-learning, and cross-domain disentanglement.Source: A. Face Presentation Attack Detection · p. 3

B. Federated Learning

  • Federated learning collaboratively trains a server-assisted global model while preserving local data; personalization methods adapt it to clients seen during training.The paper instead targets generalization to unseen presentation attacks at test time.Source: B. Federated Learning · p. 3

C. Disentanglement Learning

  • Earlier fPAD disentanglement separates spoof traces or liveness from content within a domain, whereas FedGPAD separates domain-invariant and domain-specific features across centers under privacy-preserving federated learning.The paper identifies this as the first privacy-preserving domain-invariant feature learning under an FL framework.Source: C. Disentanglement Learning · p. 3

8 Download Wt to Data Centers

FedPAD trains local fPAD models on each center’s data and iteratively averages their updates at a server without accessing private data. After training, users can download the global model for local detection.

10 Users Download Wt

  • After training converges, users download the global model to their devices to perform fPAD locally.The framework obtains the collaboratively trained model through repeated communication between centers and the server while preserving data privacy.Source: Figure 2 · p. 4

A. Federated Face Presentation Attack Detection

  • Centers train fPAD models on image-label pairs, with labels distinguishing spoof from real samples, and update parameters through local optimization.Each center’s model is parameterized by its own weights.Source: A. Federated Face Presentation Attack… · p. 4
  • Each center’s dataset reflects a specific input distribution and contains only a finite set of known spoof attacks, so its model may not generalize to unseen attacks.Combining all centers’ data could help, but privacy restrictions make direct pooling impractical.Source: A. Federated Face Presentation Attack… · p. 4
  • The server aggregates center model updates to produce a global fPAD model without accessing private training data, then distributes it for the next round of local updates.Aggregation is based on averaging updated parameters and can be repeated across communication rounds.Source: A. Federated Face Presentation Attack… · p. 4

6 DataCenterUpdate(k, W(EI)

The described workflow moves model parameters between data centers and the server over repeated rounds, producing a global model that users can use for local detection.

6 DataCenterUpdate(k, W(EI)

  • The cited algorithm names a DataCenterUpdate procedure with inputs k, W(EI), W(C), and W(Dep); it does not establish how those values are used or initialized.Source: §6 · p. 5
  • Data centers upload their updated model parameters to the server for aggregation..Source: §6 · p. 5
  • After repeated center-server communication, the trained global model is available for users to download and run fPAD locally.The training process does not compromise individual centers’ private data.Source: §6 · p. 5

B. Federated Generalized Face Presentation Attack Detection

FedGPAD addresses the limited generalization of FedPAD by separating domain-invariant from domain-specific features locally, then iteratively aggregating only domain-invariant model parts across data centers. This lets the server learn a global model without accessing private data.

B. Federated Generalized Face Presentation Attack Detection

  • Directly aggregating FedPAD parameters can carry domain-specific cues, such as display materials, backgrounds, and environmental noise, and degrade generalization to unseen attacks.These cues change across presentation materials and recording environments.Source: B. Federated Generalized Face… · p. 5
  • Each data center splits its fPAD model into domain-invariant extractors, classifiers, and depth estimators, plus domain-specific extractors and decoders.The two feature extractors encode domain-invariant and domain-specific features from local images, respectively.Source: B. Federated Generalized Face… · p. 5
  • After communication rounds, users can download the global feature extractor and classifier for local attack detection without compromising data-center private data.The overview also identifies the global model's depth estimator as part of its parameterization.Source: Figure 3 · p. 6, B. Federated Generalized Face… · p. 7
  • Local training combines classification and depth-estimation losses with reconstruction and difference losses to train and disentangle the two feature types.The difference loss encourages orthogonality, while reconstruction uses the combined features to reconstruct the input.Source: B. Federated Generalized Face… · p. 6
  • Data centers upload only domain-invariant model parameters for server aggregation, then download the aggregated parameters to continue local disentanglement learning.The server averages uploaded parameters; repeated communication incorporates domain-invariant information from all centers.Source: B. Federated Generalized Face… · pp. 6–7

IV. EXPERIMENTS

The experiments evaluate the proposed federated frameworks on 2D face presentation attacks using five datasets. The section describes the evaluation setup and reports results with accompanying discussion.

IV. EXPERIMENTS

  • The experiments focus on 2D face presentation attacks and evaluate the proposed federated frameworks on five datasets.The section says it reports results and discusses their implications for federated learning for fPAD.Source: §IV · p. 7
  • The evaluation section covers datasets, testing protocols, evaluation metrics, and implementation details.Source: §IV · p. 7
  • The authors report experimental results across multiple fPAD datasets and provide discussion and analysis.Source: §IV · p. 7

A. Experimental Settings

The experimental settings section includes a comparison of five experimental datasets.

A. Experimental Settings

1) Datasets:

The evaluation uses five public 2D fPAD datasets containing print and video-replay attacks, with variation in attack and recording conditions. The authors identify substantial domain shifts among the datasets.

1) Datasets:

  • The evaluation uses Oulu-NPU, CASIA-MFSD, Idiap Replay-Attack, MSU-MFSD, and SiW, which contain print and video-replay attacks.Source: 1) Datasets · p. 7
  • The datasets differ in attack types, display materials and resolution, illumination, backgrounds, and other presentation characteristics.Source: 1) Datasets · p. 7
  • The authors report that significant domain shifts exist among the five datasets.Source: 1) Datasets · p. 7

2) Protocol:

Evaluation tests each trained model on a dataset withheld from training, treating it as users’ data. The section also specifies the metrics and implementation used for FedPAD and FedGPAD.

2) Protocol:

  • Each protocol withholds one dataset for users and trains on the remaining datasets as data centers, then tests real-versus-spoof discrimination on the held-out set.The evaluation is designed to measure generalization to a dataset not observed during training.Source: 2) Protocol · p. 7

3) Evaluation Metrics:

  • HTER, EER, and AUC measure performance; without a development set, thresholds are determined using data from all data centers.HTER is half the sum of false acceptance and false rejection rates.Source: 3) Evaluation Metrics · p. 7

4) Implementation Details:

  • FedPAD uses ResNet-18, while FedGPAD uses the network components detailed in Table II; both use Adam at a learning rate of 1e-2.Input images are 256×256×6; batch sizes are 64 per center for FedPAD and 16 for FedGPAD.Source: 4) Implementation Details · pp. 7–8, Table II · p. 8

B. Experimental Results

FedGPAD outperforms the other baselines and improves on FedPAD in the reported experiments. The paper also compares the frameworks with privacy-violating pooled-data training and state-of-the-art methods.

B. Experimental Results

  • Score fusion improves fPAD performance on average but requires higher inference time and computation complexity, of order three in this experiment.The authors note that feature-level fusion is impractical because no classifier can be trained on fused features during inference without access to real or spoof data.Source: B. Experimental Results · p. 8
  • FedPAD’s average values across all evaluation metrics outperform the single-center and score-fusion baselines.The single-center baseline trains independently on the remaining datasets for each user-dataset choice; score fusion averages predictions from multiple center-trained models.Source: B. Experimental Results · p. 8, Table III · p. 9
  • FedGPAD outperforms the other baselines and significantly improves performance over FedPAD in the reported settings.Table III and Fig. 5 present the comparisons.Source: B. Experimental Results · p. 9, Table III · p. 9, Figure 5 · p. 9
  • FedGPAD improves HTER and AUC by about 9% over the All baseline, which trains on all available data and violates the privacy assumption.FedPAD is 3.9% worse than All in AUC; All is described as an upper bound, not a valid privacy-preserving comparison.Source: B. Experimental Results · p. 9, Table III · p. 9

C. Comparison with state-of-the-art face presentation attack detection methods

D. Comparison with state-of-the-art federated learning methods

FedGPAD outperforms the compared federated-learning methods. Ablations support the loss components and domain-disentanglement strategy, while experiments report improved evaluation results with more data centers.

D. Comparison with state-of-the-art federated learning methods

  • FedGPAD outperforms FedAvg [22] and FedMA [41] in the reported fPAD comparisons.The authors attribute the advantage to better disentanglement of domain-invariant information and a more generalized global model for unseen attacks.Source: D. Comparison with state-of-the-art… · p. 10

E. Ablation Study

  • Removing any tested loss component significantly degrades performance in O&M&I to C, supporting the complementary contribution of the components.The ablation varies L Diff, L Rec, and L Dep; L Cls is retained as necessary for classification.Source: E. Ablation Study · p. 10, Table VI · p. 10
  • Federated domain disentanglement significantly improves average performance across all three metrics in the four tested settings.The comparison is reported in Table VII.Source: E. Ablation Study · p. 11, Table VII · p. 11

F. Comparison of different number of data centers

G. Generalization ability to various 2D spoof attacks

FedPAD improves generalization to varied 2D spoof attacks over score fusion, while FedGPAD’s domain-invariant features are reported to align data-center and user distributions and separate real from spoof faces. The conclusion presents both frameworks as privacy-preserving approaches to generalized fPAD.

G. Generalization ability to various 2D spoof attacks

H. Visualization of latent features

V. CONCLUSION

  • FedPAD aggregates model updates without accessing local private data; FedGPAD aggregates domain-invariant model parts to target better generalization to unseen user attacks.The conclusion reports extensive experiments demonstrating the frameworks’ effectiveness.Source: §V · pp. 12–13

Related papers

Loading 2104.06595v2…