Are Foundation Models All You Need for Zero-shot Face Presentation Attack Detection?

TL;DR

This paper evaluates the potential of foundation models for zero-shot face presentation attack detection, demonstrating their effectiveness in challenging scenarios without extensive training.

Contribution

It assesses foundation models' generalisability for zero-shot PAD and proposes a simple framework that outperforms state-of-the-art methods on challenging datasets.

Findings

Foundation models achieve high performance in difficult scenarios.

Proposed framework requires minimal effort and training.

Outperforms state-of-the-art on SiW-Mv2 database.

Abstract

Although face recognition systems have undergone an impressive evolution in the last decade, these technologies are vulnerable to attack presentations (AP). These attacks are mostly easy to create and, by executing them against the system's capture device, the malicious actor can impersonate an authorised subject and thus gain access to the latter's information (e.g., financial transactions). To protect facial recognition schemes against presentation attacks, state-of-the-art deep learning presentation attack detection (PAD) approaches require a large amount of data to produce reliable detection performances and even then, they decrease their performance for unknown presentation attack instruments (PAI) or database (information not seen during training), i.e. they lack generalisability. To mitigate the above problems, this paper focuses on zero-shot PAD. To do so, we first assess the effectiveness and generalisability of foundation models in established and challenging experimental scenarios and then propose a simple but effective framework for zero-shot PAD. Experimental results show that these models are able to achieve performance in difficult scenarios with minimal effort of the more advanced PAD mechanisms, whose weights were optimised mainly with training sets that included APs and bona fide presentations. The top-performing foundation model outperforms by a margin the best from the state of the art observed with the leaving-one-out protocol on the SiW-Mv2 database, which contains challenging unknown 2D and 3D attacks