Source-linked AI summary
Tomatoes, Potatoes, and Onions: Questioning the Need for Faces in Face Presentation Attack Detection
Guray Ozgur, Fadi Boutros, Naser Damer
TL;DR
The paper asks whether transferable PAD representations require faces, given that many attack cues arise from presentation and recapture processes. It introduces the face-free TPO dataset and finds that vegetable-trained detectors transfer to face PAD while TPO also improves mixed face-data training under fixed budgets.
Problem
PAD is usually trained on face datasets, leaving limited evidence about whether transferable attack representations require facial content rather than presentation-process cues.
Method
The paper introduces TPO, a controlled face-free dataset of bona fide, print, and replay recordings of tomatoes, potatoes, and onions, and evaluates foundation-model PAD transfer across object domains.
Results
TPO-only training achieves 92.70% average AUC across four cross-dataset face PAD benchmarks and improves mixed face/TPO training, whose average AUC rises from 92.11% to 96.96%.
Takeaways & Limitations
The findings provide empirical evidence that a substantial portion of transferable PAD knowledge can be learned without facial data and reflects richer presentation cues shared across object categories.
Takeaways & Limitations
Threshold calibration does not transfer across domains, so the evaluation relies on target-domain threshold estimation while using AUC for ranking and discrimination.
Abstract
from arXiv · showhide
Face presentation attack detection (PAD) is traditionally formulated as a face-specific problem, although many of the visual artifacts introduced by print, replay, and recapture processes are not inherently tied to facial appearance. In this work, we investigate whether transferable PAD representations can be learned without using faces during downstream PAD training. To this end, we introduce TPO, a controlled face-free presentation attack dataset consisting of bona fide, print, and replay recordings of, almost randomly chosen, tomatoes, potatoes, and onions acquired under protocols that closely mirror conventional face PAD datasets. Using a foundation-model-based PAD architecture, we demonstrate that a detector trained on TPO achieves an average AUC of 92.70% across four standard cross-dataset face PAD benchmarks, outperforming training on synthetic faces and remaining competitive with models trained on real face datasets. Conversely, models trained on face PAD datasets transfer consistently above chance to TPO, suggesting that the learned representations capture characteristics of the presentation process rather than object semantics. Furthermore, incorporating TPO into conventional face PAD training consistently improves cross-dataset performance under fixed optimization budgets, indicating that face-free data provides complementary information rather than simply additional training samples. Finally, representation and frequency analyses provide further evidence that transferable PAD representations cannot be explained by a single spectral artifact but instead encode richer presentation cues shared across object categories. Together, these results provide empirical evidence that transferable presentation attack representations can be learned independently of facial content, opening new opportunities for privacy-preserving and identity-independent PAD development.
1 Introduction
The paper challenges the assumption that PAD must learn facial content, proposing that transferable detectors may instead learn artifacts introduced by presentation and recapture processes. It introduces a face-free vegetable dataset to test whether such representations transfer to human-face PAD.
- PAD research typically treats presentation attack detection as a face-specific problem and explains cross-dataset degradation through shifts in subjects, demographics, illumination, and backgrounds.
- Presentation attacks introduce moiré, halftoning, paper texture, display distortion, specular highlights, and recapture noise associated with the presentation pipeline rather than the recaptured object.
- The study tests this claim using bona fide, print, and replay recordings of tomatoes, potatoes, and onions acquired under a face-PAD-style protocol.
- TPO is a controlled face-free dataset containing 12,480 samples, accompanied by cross-object experiments and released training, evaluation, and cross-dataset protocols.
2 Background
The background reframes part of the cross-dataset PAD problem as variation in presentation and capture pipelines rather than facial content. This motivates testing whether non-face objects can provide a controlled way to study transferable recapture cues.
- Face PAD models often degrade across datasets, a problem commonly attributed to face-domain shifts and addressed with domain generalization, adaptation, alignment, meta-learning, and disentanglement.
- Synthetic face data and foundation models are two approaches for reducing dependence on large, sensitive real-face PAD corpora.
- Prior PAD analyses identify moiré, image-quality, color, texture, reflection, and recapture-noise cues that arise from the recapture process.
- TPO turns this observation into a testable position by treating the presented object as interchangeable when the presentation-attack trace is the relevant cue.
3 The TPO Dataset
TPO preserves key acquisition and attack factors from face PAD while replacing human subjects with vegetables. Its controlled design varies object identity and reflectiveness without changing the presentation process.
- TPO contains tomatoes, potatoes, and onions, with 26 physically distinct specimens per species and 78 vegetable identities overall.
- The dataset applies the same bona fide, print, and replay construction to every species, allowing the presented object to vary while the presentation process remains fixed.
- Bona fide captures use four approximately orthogonal viewpoints, close and far scales, two devices, controlled illumination, videos, and still images for each acquisition combination.
- Print attacks are made by printing bona fide still images on A4 paper and recapturing them, whereas replay attacks display bona fide videos and record the display.
4 Experimental Settings
Experiments use full-source cross-dataset evaluation with a foundation-model PAD architecture and matched training controls. The setup evaluates transfer across face datasets, TPO, and representation spaces without same-dataset train-test results.
- Each dataset is used entirely as a training source or held-out target, with single-source models evaluated across the other face datasets and TPO.
- TPO videos contribute uniformly sampled frames from their middle 80%, while all inputs are converted to RGB and resized to 224×224 without face detection or landmarks.
- FoundPAD uses a frozen CLIP ViT-B/16 encoder, LoRA adaptation in attention projections, and a linear two-class head on normalized image embeddings.
- The ImageNet-pretrained ViT comparison matches resizing, augmentation, classification head, optimizer family, training data, and epoch budget, but differs in normalization and adaptation strategy.
- All experiments use approximately 11,000 optimizer updates to compare datasets under a common computational budget.
- Model analyses compare embeddings from TPO-trained and O-trained encoders on bona fide and attack frames from face, TPO, and synthetic-face datasets.
- Performance is reported with video-level AUC and HTER after averaging frame scores within each source video.
5 Position and Empirical Evidence
The paper tests whether PAD can learn transferable presentation-process cues without facial content and finds strong cross-object transfer, complementary benefits from TPO, and dependence on diverse attack conditions and general visual representations.
- The central hypothesis is that PAD can learn presentation attack and recapture artifacts rather than semantic facial characteristics.The proposed test is whether non-face training transfers to face PAD and face training transfers to non-face objects.
- 92.70% average AUC and 14.15% HTER are achieved by TPO-trained FoundPAD across four cross-dataset face PAD benchmarks.TPO training remains competitive with conventional face training despite using no facial information.
- 67.81% average AUC for ImageNet-21k ViT-B/16 versus 92.70% for FoundPAD shows that the foundation-model representation prior is important for face-free transfer.The comparison uses architecture-matched models under identical downstream training data.
- 92.55% average AUC versus 89.33% and 13.97% HTER versus 17.54% show that adding TPO improves single-source face training under fixed budgets.The improvement indicates complementary presentation information rather than merely more optimization or sampled examples.
- 96.96% average AUC versus 92.11% and 7.84% HTER versus 14.72% show that TPO remains beneficial in multi-source face training.Replacing part of sampled face observations with TPO continues to help even when substantial face PAD supervision is available.
- Attack diversity matters more than redundant frames: print-only or replay-only training lowers AUC, while using 10% of frames retains 92.97% AUC.Combining vegetable categories is strongest, and consecutive frames provide little additional supervision because they are highly redundant.
- TPO-adapted representations preserve dataset-specific appearance while separating bona fide from attacks across object categories.Frequency analysis further indicates that transfer is not explained by a universal spectral signature alone.
6 Counterarguments
The paper answers key objections by showing that its claim concerns downstream PAD training, not face recognition itself, and by distinguishing transferable discrimination from calibration. It also uses embedding and frequency analyses to clarify what transfers and what does not.
- Figure 2 shows dataset organization after TPO training but cross-domain bona fide/attack separation after O training, indicating distinct embedding geometries.Both encoders receive the same class-balanced samples, with 250 bona fide and 250 attack images per dataset.
- Figure 3 shows attack-minus-bona-fide spectral residuals changing direction across datasets, arguing against one universal frequency signature.TPO gains high-frequency energy, several datasets lose it, and M remains near zero.
- 92.7% AUC on faces is achieved by a detector adapted without face images, converting the recapture-artifact intuition into a quantified claim.The comparison is presented as evidence that the face need not be central to downstream PAD learning.
- Face-free PAD training does not remove faces from deployment: PAD remains a pre-filter that can operate before a face recognizer.The claimed change concerns the PAD module's training data, not the overall biometric pipeline.
- AUC remains relevant despite cross-domain threshold miscalibration because it measures ranking and discrimination rather than operating-point calibration.The paper states that target-domain threshold estimation handles calibration differences.
7 Implications
The paper argues that face-free PAD data could reduce privacy burdens, redirect generalization analysis toward capture conditions, and support broader artifact-focused evaluation. It also identifies fairness and broader attack coverage as important but incompletely established boundaries.
- Face-free PAD corpora can replace identifiable human images for training, reducing consent, retention, and GDPR-related privacy burdens.The paper presents vegetables as one example and states that any textured object could serve this role.
- Face-free training may offer demographic fairness by construction, but this remains theoretical because the study did not analyze it.The proposed coverage concern shifts from subject attributes to PAI and sensor coverage.
- Cross-dataset degradation should be analyzed as possible PAI and capture-pipeline shift, not only face-domain shift.The paper recommends reporting printer, sensor, and attack-instrument provenance alongside subject information.
- Method design should prioritize general visual representations and broad recapture-condition coverage over face-specific inductive biases.TPO is proposed as a testbed for stress-testing generalization and auditing detector behavior.
- A future research program should diversify face-free artifact corpora across objects, printers, displays, cameras, modalities, and attack types.The paper specifically flags depth, infrared, and 3D-mask scenarios as settings where object structure may matter.
8 Conclusion
The study tests whether transferable PAD representations require faces by training on the controlled face-free TPO dataset. Its results support presentation-artifact-based transfer across objects, while limiting the conclusion to the studied attack settings and supported scope.
- TPO preserves conventional PAD acquisition and recapture processes while removing facial content, enabling a direct test of face-free representation learning.The dataset contains bona fide, print, and replay presentations of non-human objects.
- TPO-adapted detectors achieve competitive cross-dataset face PAD performance, while face-trained models also transfer consistently to TPO.The reported pattern supports transfer across fundamentally different object categories.
- Replacing part of real-face training with TPO consistently improves performance under identical optimization budgets, indicating complementary face-free information.The improvement appears in both single-source and multi-source training settings.
- Embedding and frequency analyses indicate that transferable PAD representations encode richer presentation cues rather than one universal spectral artifact.The representations organize samples by presentation status across domains, but the frequency evidence is not explained by a single signature.
- The conclusions are restricted to print and replay attacks and do not claim that faces are irrelevant to every biometric system or attack scenario.The paper frames its evidence as applying to a substantial portion of transferable PAD knowledge.
Ethics and Privacy Statement
The ethics statement emphasizes that TPO avoids human subjects and sensitive biometric data, while qualifying the privacy claim and operational scope of the experiments.
- TPO contains no human subjects, biometric data, or personally identifiable information.The comparison face datasets were obtained from their owners under appropriate licenses.
- The findings support reduced collection of sensitive data, not a fully face-free system, because CLIP pretraining may include faces.The paper distinguishes face-free downstream training from the broader pretraining history of the model.
- The experiments investigate transferability rather than demonstrating operational readiness.The statement limits the deployment claim beyond the reported research evaluation.