Are Foundation Models All You Need for Zero-shot Face Presentation Attack Detection?

2025-07-22

AI Summary

To address the weak generalization capability and heavy reliance on labeled data in zero-shot face presentation attack detection (PAD), this paper proposes a foundation-model-based zero-shot PAD framework. The method leverages pre-trained foundation models to extract robust facial features and enables label-free recognition of unseen attack types—such as novel 2D or 3D attacks—via zero-shot similarity matching, without fine-tuning. Its core innovation lies in constructing a prompt-guided feature space with cross-domain semantic alignment, substantially enhancing generalization across unknown attacks and heterogeneous benchmark databases. Under the “leave-one-attack-out” protocol on SiW-Mv2, the proposed approach achieves significant performance gains over existing state-of-the-art methods. This work establishes a new paradigm for biometric security systems operating under low-resource constraints while demanding high generalization capability.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Cognitive Modeling & Cognitive Systems: Other Foundations of Cognitive Modeling & Systems

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs
• Security and Privacy: Large-scale security measurements

Abstract

Although face recognition systems have undergone an impressive evolution in the last decade, these technologies are vulnerable to attack presentations (AP). These attacks are mostly easy to create and, by executing them against the system's capture device, the malicious actor can impersonate an authorised subject and thus gain access to the latter's information (e.g., financial transactions). To protect facial recognition schemes against presentation attacks, state-of-the-art deep learning presentation attack detection (PAD) approaches require a large amount of data to produce reliable detection performances and even then, they decrease their performance for unknown presentation attack instruments (PAI) or database (information not seen during training), i.e. they lack generalisability. To mitigate the above problems, this paper focuses on zero-shot PAD. To do so, we first assess the effectiveness and generalisability of foundation models in established and challenging experimental scenarios and then propose a simple but effective framework for zero-shot PAD. Experimental results show that these models are able to achieve performance in difficult scenarios with minimal effort of the more advanced PAD mechanisms, whose weights were optimised mainly with training sets that included APs and bona fide presentations. The top-performing foundation model outperforms by a margin the best from the state of the art observed with the leaving-one-out protocol on the SiW-Mv2 database, which contains challenging unknown 2D and 3D attacks

Problem

• Detecting zero-shot face presentation attacks effectively
• Assessing generalizability of foundation models in PAD
• Improving PAD performance for unknown attack types

Innovation

• Utilizes foundation models for zero-shot PAD
• Assesses generalizability in challenging scenarios
• Outperforms state-of-the-art with minimal effort