Source-linked AI summary
Deep Learning for Face Anti-Spoofing: A Survey
Zitong Yu, Yunxiao Qin, Xiaobai Li, Chenxu Zhao, Zhen Lei, Guoying Zhao
TL;DR
Face anti-spoofing must distinguish subtle, content-irrelevant spoof cues while confronting changing attacks and gaps between training and testing domains. This survey synthesizes deep learning methods, datasets, protocols, sensors, and open research issues, reporting strong recent benchmark performance alongside unresolved representation, generalization, interpretability, and privacy challenges.
Problem
Face recognition systems remain vulnerable to diverse presentation attacks, while FAS must detect subtle, fine-grained material and geometric cues and handle unseen domains and unknown attacks.
Method
The survey compares 35 public datasets, reviews deep FAS methods and evaluation metrics and protocols, and covers domain generalization, open-set evaluation, and varied sensing modalities.
Results
Recent deep FAS methods achieve reported performance below 5% ACER, 15% HTER, and 10% EER on four evaluation protocols, with pixel-wise supervision and generalization methods supporting detection and intrinsic clue mining.
Takeaways & Limitations
The survey provides a taxonomy of methods, datasets, protocols, and sensors while identifying potential directions for improving representation, generalization, interpretability, and privacy.
Takeaways & Limitations
FAS remains unsolved because subtle spoof patterns, complex real-world domain gaps, and rapidly evolving novel attacks challenge current architectures, supervision, and learning strategies.
Abstract
from arXiv · showhide
Face anti-spoofing (FAS) has lately attracted increasing attention due to its vital role in securing face recognition systems from presentation attacks (PAs). As more and more realistic PAs with novel types spring up, traditional FAS methods based on handcrafted features become unreliable due to their limited representation capacity. With the emergence of large-scale academic datasets in the recent decade, deep learning based FAS achieves remarkable performance and dominates this area. However, existing reviews in this field mainly focus on the handcrafted features, which are outdated and uninspiring for the progress of FAS community. In this paper, to stimulate future research, we present the first comprehensive review of recent advances in deep learning based FAS. It covers several novel and insightful components: 1) besides supervision with binary label (e.g., '0' for bonafide vs. '1' for PAs), we also investigate recent methods with pixel-wise supervision (e.g., pseudo depth map); 2) in addition to traditional intra-dataset evaluation, we collect and analyze the latest methods specially designed for domain generalization and open-set FAS; and 3) besides commercial RGB camera, we summarize the deep learning applications under multi-modal (e.g., depth and infrared) or specialized (e.g., light field and flash) sensors. We conclude this survey by emphasizing current open issues and highlighting potential prospects.
1 INTRODUCTION
Face anti-spoofing protects face recognition from increasingly varied presentation attacks, but handcrafted methods and conventional evaluations struggle with subtle spoof cues and changing domains. This survey organizes deep learning methods, datasets, sensors, supervision strategies, and four practical evaluation protocols, including unseen domains and attack types.
- Face recognition systems are vulnerable to presentation attacks including print, replay, makeup, and 3D-mask attacks, motivating face anti-spoofing research.
- Handcrafted liveness cues and descriptors require task-aware knowledge, can be mimicked by video attacks, and offer limited reliability for practical deployment.Long-term interactive videos make physiological cues inconvenient, while classical descriptors extract spoofing patterns from several color spaces.
- Binary-loss deep models face a difficult self-evolving task because FAS relies on subtle, content-irrelevant material and geometry cues rather than obvious semantic appearance.Single binary supervision may discover arbitrary and unfaithful features for these fine-grained distinctions.
- Existing reviews covered fewer than 15 small-scale datasets, whereas this survey compares 35 public datasets spanning diverse attacks, modalities, sensors, and recording conditions.The survey also covers more than 100 deep learning methods for single- and multi-modal FAS.
- The survey covers binary and pixel-wise supervision, RGB and advanced sensors, and four protocols for intra- or cross-domain and intra- or cross-attack evaluation.These protocols address unseen-domain generalization and unknown-attack detection alongside conventional testing.
3 DEEP FAS WITH COMMERCIAL RGB CAMERA
Deep FAS with commercial RGB cameras spans hybrid feature frameworks, end-to-end learning, pixel-wise supervision, and efforts toward domain and attack generalization. The survey organizes these methods while noting persistent limitations from data scarcity, feature incompatibility, noisy supervision, domain shifts, and unknown attacks.
- 3.1 Hybrid (Handcraft + Deep Learning) Method: Hybrid FAS frameworks derive deep features from handcrafted features, handcrafted descriptors from deep features, or fused handcrafted and deep representations.These three topologies are illustrated in Fig. 7.
- 3.1 Hybrid (Handcraft + Deep Learning) Method: Hybrid methods capture non-texture cues such as temporal rPPG and motion blur, but handcrafted features require expert knowledge and may be incompatible with deep features.The survey identifies these issues as sources of inefficiency and performance saturation.
- 3.2 End-to-End Deep Learning Method: End-to-end deep FAS methods learn mappings directly from face inputs and increasingly dominate the field alongside advanced CNNs, regularization, and large-scale datasets.Traditional end-to-end methods commonly use binary cross-entropy or extended losses, while other approaches use more discriminative supervision.
- 3.2.2 Pixel-wise Supervision: Pixel-wise supervision uses signals such as reflection, depth, or generated spoof patterns to learn physically meaningful and explainable material and geometry cues.Meta-teacher frameworks can automatically generate pixel-wise labels for student FAS models.
- 3.3 Generalization: Domain-generalization and open-set methods address unseen environments and unknown attack types beyond conventional predefined-scenario evaluation.Cross-dataset protocols expose domain shifts, while anomaly-based methods model bonafide representations for unknown attacks.
4 DEEP FAS WITH ADVANCED SENSORS
Advanced-sensor FAS supplements commercial RGB cameras with depth, infrared, thermal, light-field, polarization, and flash-based sensing. These modalities provide complementary geometry, reflection, material, temperature, or surface-normal cues, but introduce cost, imaging, and deployment trade-offs.
- Sensor and Hardware Overview: Advanced sensors target high-security FAS settings where very low false-acceptance errors are required despite higher hardware complexity.The survey contrasts these settings with the security-cost trade-off of commercial RGB cameras.
- Depth and NIR Sensors: Depth sensors reconstruct facial 3D geometry, while NIR exploits reflection differences; TOF is more robust than structured light to lighting and distance changes.NIR has poor imaging quality at long distance, whereas VIS-NIR integration offers a high performance-price ratio for access control.
- Specialized Sensors: SWIR distinguishes skin material through water absorption, thermal cameras estimate face temperature, and light-field or polarization sensors represent depth or reflection-related cues.Thermal sensing performs poorly when subjects wear transparent masks.
- Flash-Based Methods: Dynamic flash enables photometric-stereo recovery of face surface normals, which can support facial-depth and light-CAPTCHA prediction for presentation-attack detection.The approach uses smartphone-screen illumination from multiple directions.
- Multimodal Learning: Multimodal FAS uses feature-, input-, and decision-level fusion or cross-modal translation to handle complementary modalities and missing inputs.Feature re-weighting can discard redundant channels, while cross-modal translation generates unavailable modalities such as NIR from RGB.
- Multimodal Learning: Sensor-based multimodal FAS has grown since 2019 but remains slower than RGB-based unimodal FAS, while early fusion can lose multimodal clues and direct concatenation can overfit.These limitations motivate selective fusion and decision-level strategies.
5 DISCUSSION AND FUTURE DIRECTIONS
Deep learning FAS has improved, but reliable deployment remains constrained by representation, evaluation, efficiency, interpretability, privacy, and multimodal generalization challenges. The survey identifies directions including automated multimodal temporal design, richer supervision, broader data use, practical open-set protocols, and unified attack detection.
- Recent deep FAS methods achieve strong results across four protocols, while pixel-wise supervision and generalized learning address fine-grained materials and unseen attacks.Reported performance includes <5% ACER, <15% HTER, <10% EER, and <20% HTER on the four protocols, respectively.
- 5.1 Architecture, Supervision and Interpretability: Current architectures and supervision strategies remain sub-optimal across benchmarks, motivating automated searches for temporal architectures, multimodal fusion, and dynamic supervision.Existing AutoML efforts mainly target unimodal, single-frame settings.
- 5.2 Representation Learning: Representation learning should exploit labeled and unlabeled data through self-supervised, semi-supervised, augmentation, transfer, disentangled, and metric-learning strategies.A central challenge is using continuously collected, imbalanced unlabeled data without performance degradation.
- 5.3 Real-World Open-Set FAS: Practical evaluation requires larger domain- and type-aware open-set protocols because existing benchmarks are small, single-factor, and insufficiently representative of real-world conditions.GrandTest and open-set testing extend evaluation, but simultaneous domain and attack-type shifts remain neglected.
- Multimodal deployment needs dynamic knowledge propagation across modality combinations because training separate models is costly and translated modalities are less faithful than real sensor data.Relevant combinations include RGB-NIR, RGB-D, NIR-D, and RGB-D-NIR.
- Generic PAD and related tasks may support explainable FAS by learning shared intrinsic spoof patterns, while physical adversarial faces and imbalanced digital attacks remain concerns.The survey also highlights spoof-region localization, spoof-map estimation, natural-language explanations, and privacy-sensitive source-free adaptation.
6 CONCLUSION
The paper presents a contemporary survey of deep learning methods, datasets, and protocols for face anti-spoofing. It organizes the field through a comprehensive taxonomy, evaluates merits and demerits of methods and sensors, and identifies future research directions.
- The survey covers deep learning based FAS methods, datasets, and evaluation protocols.
- It provides a comprehensive taxonomy and discusses the merits and demerits of FAS methods and sensors.
- Potential research directions are listed to guide future development of face anti-spoofing.