Foundation Models for Face Presentation Attack Detection

Foundation Models for Face Presentation Attack Detection: A Unified Linear-Probing Benchmark

Peter Lorenz¹, Anjith George¹, Sébastien Marcel^1,2

¹Idiap Research Institute, ²University of Lausanne (UNIL), Lausanne, Switzerland Accepted at IJCB 2026

Model	Train	Test
InternViT-6B	M	4.42	16.64	45.29	14.65	20.25	15.18
	C	28.07	1.81	21.26	25.86	19.25	10.36
	I	28.54	25.26	0.06	50.33	26.05	17.83
	O	48.50	38.89	40.37	0.27	32.01	18.68
DeepPixBiS	M	7.89	47.05	49.65	36.46	35.26	16.56
	C	33.74	2.01	30.74	30.20	24.17	12.87
	I	47.36	61.34	0.00	50.94	39.91	23.61
	O	46.55	38.36	45.10	3.84	33.46	17.38

Model

Train

Test

Avg.

Std.

InternViT-6B

4.42

16.64

45.29

14.65

20.25

15.18

28.07

1.81

21.26

25.86

19.25

10.36

28.54

25.26

0.06

50.33

26.05

17.83

48.50

38.89

40.37

0.27

32.01

18.68

DeepPixBiS

7.89

47.05

49.65

36.46

35.26

16.56

33.74

2.01

30.74

30.20

24.17

12.87

47.36

61.34

0.00

50.94

39.91

23.61

46.55

38.36

45.10

3.84

33.46

17.38

Abstract

Face presentation attack detection (PAD) remains challenging under cross-dataset evaluation, where domain shift degrades models trained on a single dataset. The scarcity of large-scale labeled data motivates adapting pretrained vision models rather than training task-specific architectures from scratch, raising a fundamental question: do general-purpose vision foundation models encode PAD-relevant information accessible with minimal task-specific training? To investigate, we systematically evaluate 24 frozen encoders, including self-supervised Vision Transformers, vision–language encoders, and supervised CNNs, using a unified linear-probing protocol on the MCIO benchmark (MSU-MFSD, CASIA-FASD, Replay-Attack, OULU-NPU). The backbone remains fixed, and only a lightweight linear head is trained, isolating the PAD information already present in the pretrained representation. We report intra- and cross-dataset performance alongside accuracy–compute trade-offs relative to two specialist PAD baselines. Results show that frozen foundation-model representations can support strong intra-dataset PAD performance with only a linear classifier, but this performance does not reliably transfer across datasets. Model scale is beneficial within several families, although the effect is not monotonic and is strongly mediated by architecture and pretraining. InternViT-6B achieves the lowest mean intra-dataset error, whereas CLIP ViT-B/32 offers the most favorable cross-dataset transfer–compute trade-off among the evaluated probes. These findings suggest that while pretrained representations contain PAD-relevant information, explicit adaptation remains necessary to address domain shift. Code and evaluation protocols will be publicly released.

Method

Every backbone stays frozen. A face crop is encoded into a global embedding \( h \in \mathbb{R}^{d} \) (CLS token, mean-pooled patch tokens, or global average pooling, depending on the encoder family), and only a single fully connected layer \( z = w^{\top} h + b \) is trained with binary cross-entropy, with bonafide labelled 1 and attack labelled 0. At inference the bonafide probability is \( p = \sigma(z) \). Freezing the backbone isolates pretraining strategy and model scale from adaptation recipes such as LoRA or full fine-tuning, and equalizes trainable capacity across all encoders.

Models are trained on one MCIO corpus and tested on all four. We report the Average Classification Error Rate (ACER, ISO/IEC 30107-3) in percent, at a threshold \( \tau \) tuned on the development split by the equal-error-rate criterion and applied unchanged to the test split: \[ \mathrm{ACER}(\tau) = \tfrac{1}{2}\bigl(\mathrm{APCER}(\tau) + \mathrm{BPCER}(\tau)\bigr) \]

Experiments

We evaluate only the single-source cross-dataset protocol, where a model is trained on one source dataset and evaluated on a different target dataset. Multi-source protocols such as leave-one-out (LOO) and limited-source-domain (LSD) evaluation are not considered. We evaluate on four widely used MCIO datasets for intra-dataset (M→M, C→C, I→I, O→O) and cross-dataset (M→C, M→I, M→O, …, O→…) transfer.

MSU-MFSD (M) includes videos of printed attacks, as well as replay attacks generated with a mobile phone and a tablet. Protocol protocol (all folds), bob.db.msu_mfsd_mod-2.2.9.
CASIA-FASD (C) includes warped-photo, cut-photo, and replay attacks under varying illumination. Protocol grandtest, pad-face-casia-fasd-0b07ea45.
Replay-Attack (I) provides high-resolution print-and-replay spoofs on a fixed display setup. Protocol grandtest, pad-face-replay-attack-aca6b46f.
OULU-NPU (O) comprises six mobile phone sensors and multiple print-and-replay attack types, offering the strongest sensor diversity. Protocol Protocol_1, pad-face-oulunpu-7bfb90c9.

The four corpora differ by an order of magnitude in size and are attack-heavy throughout: the test splits range from 2,398 frames (MSU-MFSD) to 12,000 (OULU-NPU), with roughly one bonafide frame per three attack frames.

Bonafide and attack frame counts of the MCIO test splits.

Bonafide and attack frame counts of the four MCIO test splits.

No single encoder dominates every compute budget. InternViT-6B is the most accurate overall and the most expensive, while CLIP ViT-B/32 needs about the same forward-pass cost as the compact specialist DeepPixBiS (~8.7 vs. ~9.2 GFLOPs at 224×224) at markedly lower cross-dataset error (mean off-diagonal ACER 31.6% vs. 43.1%). Similar inference budgets do not guarantee similar transfer.

Overall ACER versus parameters and GFLOPs for the 24 frozen encoders and the two specialist baselines, colored by model family.

Mean ACER over the intra-dataset and cross-dataset pairs versus model size and GFLOPs. Points are colored by model family; lower ACER is better.

Summary in ACER (%). All: mean over the sixteen train/test pairs. ID: mean of the four intra-dataset evaluations. CD: mean of the twelve cross-dataset pairs. Gap = CD − ID. Bold: lowest value per column.

Model	All	ID	CD	Gap
InternViT-6B	24.4	1.6	32.0	30.3
CLIP ViT-B/32	26.8	12.6	31.6	18.9
CLIP ViT-L/14	28.2	10.6	34.0	23.4
BEiT-large	29.3	9.1	36.0	26.9
EVA-CLIP-8B	30.4	10.2	37.1	26.9
CLIP ViT-H/14	31.6	10.5	38.7	28.2
DINOv2-giant	31.9	8.4	39.7	31.3
DINOv2-registers-giant	31.9	8.6	39.7	31.1
DINOv3-huge+	32.7	5.7	41.8	36.1
DINOv3-base	33.2	9.4	41.1	31.7
DINOv2-registers-base	34.4	14.6	40.9	26.4
Qwen2.5-VL-7B-ViT	34.8	17.2	40.7	23.4
BEiT-base	35.0	9.2	43.7	34.5
DINOv2-base	35.5	13.2	42.9	29.7
ViT-MAE-huge	36.2	16.7	42.7	26.1
SigLIP-large	36.3	19.3	42.0	22.8
Qwen2.5-VL-3B-ViT	36.5	16.1	43.2	27.1
SigLIP-base	39.5	22.5	45.1	22.6
ConvNeXt-V2-huge	40.5	18.2	48.0	29.7
ConvNeXt-V2-base	41.3	21.4	47.9	26.5
ViT-MAE-base	41.7	18.5	49.4	31.0
InternViT-300M	41.8	23.9	47.7	23.9
ViT-MSN-large	46.8	45.2	47.3	2.0
ViT-MSN-base	53.6	46.5	56.0	9.4
Specialized FAS models
FSFM-FAS	29.0	4.2	37.3	33.1
DeepPixBiS	33.2	3.4	43.1	39.7

Intra-dataset

Backbone scale and pretraining objective drive intra-dataset accuracy. InternViT-6B reaches the lowest mean error (1.6% ACER) with a single trainable layer, and DINOv3-huge+ follows at 5.7%. Self-supervised and vision–language encoders consistently outperform similarly sized ViT-MAE, ViT-MSN and ConvNeXt-V2 variants. The specialist baselines remain strong (DeepPixBiS 3.4%, FSFM-FAS 4.2%), while zero-shot InternVL-14B averages 28.8% — generic multimodal inference without a task-aligned readout is not enough.

Cross-dataset

Transfer stays hard for nearly every model. InternViT-6B pairs the best intra-dataset error with a 30.3-point gap (32.0% mean cross-dataset ACER), and DeepPixBiS reaches 0.0% on Replay-Attack yet 47.4–61.3% on the other corpora. Scale alone does not buy transferability: CLIP ViT-B/32 attains the lowest mean off-diagonal error among the probes (31.6%) with only ~90M frozen parameters, ahead of the much larger CLIP ViT-L/14 and ViT-H/14.

BibTeX

@inproceedings{lorenz2026foundationpad, title={Foundation Models for Face Presentation Attack Detection: A Unified Linear-Probing Benchmark}, author={Lorenz, Peter and George, Anjith and Marcel, S{\'e}bastien}, booktitle={IEEE International Joint Conference on Biometrics (IJCB)}, year={2026}, }