LoRA-based Adaptation Alone Is Not Enough: Understanding the Limits of Foundation Models for Face Presentation Attack Detection

2026-08-10

AI Summary

This study addresses the limited cross-dataset generalization of existing face presentation attack detection (PAD) methods. It presents the first systematic evaluation of 32 foundational models—including both CLIP and non-CLIP architectures—on PAD tasks under domain shift, employing lightweight adaptation via zero-shot prompting and Low-Rank Adaptation (LoRA). Experimental results demonstrate that LoRA fine-tuning reduces the Attack Presentation Classification Error Rate (ACER) to below 2% in-domain, yet performance degrades substantially in cross-dataset settings; zero-shot prompting yields near-random accuracy. These findings reveal that current lightweight adaptation strategies struggle to enhance cross-domain robustness, underscoring the critical influence of pretrained representation quality and the alignment between adaptation data distribution and target domains.

Abstract

Face presentation attack detection (PAD) aims to reliably detect a wide range of presentation attacks. While PAD methods achieve strong performance within individual datasets, their performance degrades under cross-dataset evaluation. Variations in sensors or lighting conditions can reduce the effectiveness of detectors from near-perfect to nearly random. Foundation models (FMs) have emerged as a promising alternative because typical PAD datasets, such as the MCIO benchmarks (MSU-MFSD, CASIA-FASD, Replay-Attack, and OULU-NPU), are small relative to the scale used for web-based pretraining. However, existing PAD systems primarily focus on CLIP-based foundation models, while overlooking other FMs with different architectures and training procedures. This study addresses this question by systematically evaluating 32 FMs. Zero-shot prompting achieves performance near chance across model families and scales. The vision encoders, when low-rankadapted (LoRA) with fewer than 1% trainable weights, achieve below 2% intra-dataset ACER in most cases, while cross-dataset ACER is substantially higher. LoRA primarily refines the decision boundary within a dataset, suggesting that pretrained representations and the adaptation dataset play a larger role in cross-dataset generalization than the evaluated lightweight adaptation strategy.

Problem

• Face Presentation Attack Detection
• Cross-dataset Generalization
• Foundation Models
• Domain Shift
• Zero-shot Transfer

Innovation

• Foundation Models
• LoRA
• Face Presentation Attack Detection
• Cross-dataset Generalization
• Low-rank Adaptation