Source-linked AI summary
Diff-IrisPAD: Modeling Bona Fide Iris Distributions for Unsupervised Presentation Attack Detection
Geetanjali Sharma, Harsh Yadav, Tanmay Deshpande, Shubham Ashwani, Aditya Nigam, Raghavendra Ramachandra
TL;DR
Iris PAD faces attacks that evolve beyond known categories, while many existing methods rely on labeled attack data. Diff-IrisPAD models bona fide iris images with Brownian Bridge Diffusion and uses reconstruction inconsistency to detect attacks; it reports an ACER of 30.52 and improved generalization to unseen attacks under the ZAK protocol.
Problem
Many iris PAD methods require bona fide and attack samples for training, and can overfit known attacks with performance degradation under unseen attacks and cross-sensor scenarios.
Source: §1 · p. 1Method
Diff-IrisPAD uses Brownian Bridge Diffusion to learn bona fide iris distributions by reconstructing clean textures from degraded inputs, detecting attacks through reconstruction inconsistency.
Source: §1 · pp. 1–2, §3.5 · p. 4Results
ACER of 30.52, outperforming AnoDDPM and f-AnoGAN and improving generalization to unseen presentation attacks under the ZAK protocol.
Source: §6 · p. 8Takeaways & Limitations
The reported results support attack-independent bona fide modeling as a way to improve generalization to unseen presentation attacks under the ZAK protocol.
Source: §6 · p. 8Diff-IrisPAD depends on effective degradation modeling; mismatched synthetic degradations can reduce reconstruction quality, and highly realistic attacks resembling bona fide textures may remain challenging.
Source: §5.1 · p. 8
Abstract
from arXiv · showhide
Iris recognition systems are vulnerable to presentation attacks (PAs), including textured contact lenses, print replays, and synthetic irises. Existing PAD methods rely on supervised learning with attack data, limiting generalization to unseen attacks and new sensors. We propose Diff-IrisPAD, an unsupervised framework based on Brownian Bridge Diffusion that models bona fide iris distributions without using attack samples. The method reconstructs clean iris textures from degraded inputs and detects attacks via reconstruction inconsistency using ViT scoring and pixel-level measures. Experiments on a large-scale multi-sensor dataset (125K+ images, NIR and VIS, 8 attack types) show that Diff-IrisPAD achieves an overall ACER of 30.52, significantly outperforming diffusion-based baselines while demonstrating strong generalization to unseen attacks. These results highlight the effectiveness of diffusion-based bona fide modeling for robust and scalable iris PAD.
1. Introduction
Iris PAD must address attacks that evolve beyond known categories, while many supervised approaches depend on labeled attack samples and can degrade on unseen attacks and sensors. Diff-IrisPAD instead learns bona fide iris distributions with Brownian Bridge Diffusion and identifies attacks through reconstruction inconsistency.
1. Introduction
- Supervised PAD methods require bona fide and attack samples and can overfit known attacks, degrading under cross-sensor and unseen-attack scenarios.The introduction motivates approaches that model bona fide data without attack samples as new attack types emerge.Source: §1 · p. 1
- Diff-IrisPAD learns to reconstruct clean iris textures from synthetically degraded inputs using bona fide-only training, then detects attacks through reconstruction inconsistency.Both bona fide and attack samples use the same inference pipeline; perceptual similarity metrics such as LPIPS quantify the discrepancy.Source: §1 · pp. 1–2
- The framework uses latent-space reconstruction inconsistency scored with ViT metrics and combines a frozen VQGAN with trainable BBDM for fine-grained texture modeling.The stated design aims to enable efficient and stable learning of iris texture representations.Source: §1 · p. 2
- Its attack-agnostic learning paradigm relies solely on bona fide data to improve robustness to unseen presentation attacks.Source: §1 · p. 2
- Evaluation on a multi-sensor iris PAD dataset reports competitive performance and improved generalization compared with diffusion-based baselines.Source: §1 · p. 2
2. Related work
Related work moves from handcrafted and deep-learning PAD methods toward addressing domain shift, unseen attacks, and limited attack data. Recent work also explores foundation models, synthetic data, and broader benchmarks, leaving generalizable PAD an ongoing focus.
2. Related work
- Earlier deep-learning approaches used specialized CNNs, dual-stream raw-and-edge inputs, joint recognition and PAD learning, and generalized contact-lens detection.The cited work spans [35],, [9], and.Source: §2 · p. 2
- Domain shift and cross-spectrum evaluation expose performance gaps across sensors and imaging conditions, while augmentation studies caution that naïve combinations can harm performance.Single-domain dynamic generalization and adversarial augmentation were proposed to address robustness without target-domain data [26] [30].Source: §2 · p. 2
- Open-set PAD motivates anomaly detection and one-class learning, alongside work on attention, multilevel feature fusion, visible-spectrum PAD, synthetic periocular data, and privacy-preserving training.The cited studies include,,,,, and [31].Source: §2 · p. 2
- Foundation and vision-language models, synthetic-iris benchmarks, and expanded unknown-attack evaluations reinforce the continuing need for robust, generalisable PAD.The passage cites pretrained-model work [36], zero-shot analysis [17], and LivDet-Iris developments [37, 27].Source: §2 · pp. 2–3
3. Methodology
Diff-IrisPAD learns bona fide iris distributions by reconstructing clean textures from synthetically degraded inputs, then uses reconstruction inconsistency for attack detection. Its workflow combines latent Brownian Bridge Diffusion, bona-fide-only training, and threshold-based inference.
3.1. Overview of Diff-IrisPAD
- Diff-IrisPAD processes bona fide and attack inputs through the same reconstruction pipeline, using reconstruction differences to distinguish attacks from genuine iris samples.The framework comprises diffusion-based reconstruction, reconstruction and trajectory-based scores, and threshold-based decisions.Source: §3.1 · p. 3, §3 · p. 3
3.2. Brownian Bridge Diffusion Model
- BBDM learns a direct stochastic bridge from degraded to clean iris images, while latent LBBDM-f4 uses a pretrained VQGAN representation to reduce computational cost.The UNet predicts the reverse process; interpolation and variance are controlled by m_t and δ_t.Source: §3.2 · p. 3
3.3. Unsupervised Iris PAD Formulation
- Training uses only bona fide images and structure-preserving noise, blur, and resolution corruptions; attacks are treated as out-of-distribution inputs at inference.Because the model learns genuine iris textures, attack samples can yield higher reconstruction errors without attack data during training.Source: §3.3 · p. 3
3.4. Diff-IrisPAD Architecture
- The architecture uses a compressed VQ-f4 latent representation and a UNet backbone with self-attention to capture local texture variations and global structural cues.Inference uses DDIM-style sampling with a linear skip schedule.Source: §3.4 · p. 3, Figure 1 · p. 4
3.5. Training Strategy(Diff-IrisPAD)
- Paired clean and synthetically degraded bona fide images train the model to reconstruct genuine iris textures without exposure to attack data.The degradation sequence includes Gaussian noise, blur, and resolution degradation; images are encoded with a pretrained VQGAN for latent-space diffusion.Source: §3.5 · p. 4
3.6. Performance metrics
- The evaluation reports APCER, BPCER, and ACER; ACER is the average of APCER and BPCER and is noted as deprecated in ISO/IEC 30107-3:2017.The paper reports ACER for comparison with prior work.Source: §3.6 · pp. 4–5
3.7. Inference and Decision Rule
- At inference, the model reconstructs each input and computes ViT reconstruction scores; the threshold is the 90th percentile of bona-fide validation errors and is applied unchanged across attack types.Threshold estimation uses bona-fide validation samples only, with no attack data.Source: §3.7 · p. 5
4. Experiments
Experiments evaluate Diff-IrisPAD on a large-scale multi-sensor iris PAD benchmark, with tests of detection performance and generalization to unseen attacks. The evaluation uses bona-fide-only training and includes comparisons with diffusion-based methods and supervised models.
4.1. Datasets
- The benchmark spans multiple sensors and diverse attack types, and its ZAK evaluation pool contains 50,612 attacks and 12,926 bona-fide test images.The caption also reports 5,276 bona-fide validation images reserved for threshold calibration.Source: §4 · p. 5, §4.1 · p. 5, Table 1 · p. 6
4.2. Preprocessing
- All 125,854 iris images are resized to 256×256 RGB, with iris localization using Circular Hough Transform and a center-crop fallback when detection fails.Degraded inputs are generated through seeded Gaussian noise, blur, and resolution degradation.Source: §4.2 · p. 6
4.3. Bona Fide Pair Construction
- Training pairs use a clean bona-fide crop and a deterministically degraded counterpart, with the degraded image as input and the clean image as reconstruction target.The degradation pipeline applies Gaussian noise, Gaussian blur, then downsampling and upsampling; spoof samples are excluded from training.Source: §4.3 · p. 6
4.4. Training and Evaluation Dataset Construction
- Evaluation processes both bona-fide and attack samples through the deterministic corruption pipeline and associates each sample with a bona-fide or attack label and attack type.Source: §4.4 · p. 6
4.5. Implementation Details
- The PyTorch implementation uses LBBDM-f4, a pretrained VQGAN to encode 256 × 256 images into a 64 × 64 latent space, and validation-based threshold optimization.Source: §4.5 · p. 6
4.6. Comparison with State-of-the-Art
- 30.52 overall ACER for Diff-IrisPAD versus 49.17 for AnoDDPM; Diff-IrisPAD also has the lowest ACER for Artifact (6.08), Fake with Add-On (7.01), Post-Mortem (7.82), and Print & E-display (25.41).Table 2 compares diffusion-based methods under an unsupervised thresholding protocol.Source: §4.6 · p. 7, Table 2 · p. 7
- Diff-IrisPAD is compared with AnoDDPM and f-AnoGAN under the ZAK protocol, and achieves comparable performance to supervised methods on unseen attacks despite using only bona-fide training samples.Contact Lens and Generated attacks remain difficult because they resemble bona-fide iris textures.Source: §4.6 · p. 7
4.7. Generalization to Unseen Attacks
- In leave-one-attack-out tests, supervised models show substantial variability across unseen conditions, while Diff-IrisPAD is trained solely on bona-fide samples; reconstructions also show low error for bona-fide images and higher error for attacks.Contact Lens and Generated attacks remain challenging, and Figure 3 shows attack-related error regions around iris textures and boundaries.Source: §4.7 · pp. 7–8, Figure 3 · p. 8
5. DET Curve Analysis
DET curves compare models across attack types and reveal APCER–BPCER trade-offs; the denoising-step ablation finds T=100 gives the best overall ACER while balancing reconstruction quality and computational cost.
5. DET Curve Analysis
- DET curves compare APCER–BPCER trade-offs across attack types for CNN, transformer, foundation, diffusion, and Diff-IrisPAD models.They complement the threshold-based metrics in Table 3.Source: §5 · p. 8
5.1. Ablation Study
- T=10 runs at 84.4 ms/img but has higher ACER due to limited reconstruction fidelity.Increasing to T=50 improves stability on challenging E-display and Generated samples.Source: §5.1 · p. 8
- T=200 yields marginal gains for some cases such as Artifact, but costs 671.9 ms/img without improving overall performance.Source: §5.1 · p. 8
- At T=100, overall ACER is 30.52, the lowest reported, with consistent APCER/BPCER across attacks.The ablation reports results averaged across attacks, with lower values better.Source: Table 4 · p. 8, §5.1 · p. 8
- Diff-IrisPAD depends on effective degradation modeling; mismatched synthetic degradations can reduce reconstruction quality, and highly realistic attacks may remain difficult.Source: §5.1 · p. 8
6. Conclusion
Diff-IrisPAD models bona fide iris images without attack samples and achieves ACER 30.52, outperforming AnoDDPM and f-AnoGAN. Under the ZAK protocol, the authors report improved generalization to unseen attacks.
6. Conclusion
- Diff-IrisPAD models the bona fide iris manifold without requiring attack samples.Source: §6 · p. 8
- ACER of 30.52 outperforms AnoDDPM and f-AnoGAN.Source: §6 · p. 8
- Attack-independent bona fide modeling improves generalization to unseen presentation attacks under the ZAK protocol.Source: §6 · p. 8
- Future work will investigate adaptive degradation and cross-domain generalization.Source: §6 · p. 8