A Systematic Failure Analysis of Vision Foundation Models for Open Set Iris Presentation Attack Detection

TL;DR

This paper systematically analyzes the limitations of vision foundation models in open-set iris presentation attack detection, revealing their struggles with unseen attack instruments and spectral shifts, and emphasizing the need for more robust PAD representations.

Contribution

It provides a comprehensive failure analysis of general-purpose vision foundation models for open-set iris PAD, highlighting their vulnerabilities and the impact of different adaptation strategies.

Findings

Foundation models transfer well across similar datasets but fail on unseen attack instruments.

LoRA improves some cross-dataset performance but often worsens failure under spectral shifts.

Failures are consistent across different input types and training strategies, indicating fundamental limitations.

Abstract

Vision foundation models have demonstrated strong transferability across diverse visual recognition tasks and are increasingly considered for biometric applications. Their suitability for iris Presentation Attack Detection (PAD), particularly under realistic open-set operating conditions, remains insufficiently examined. This work presents a systematic failure analysis of general-purpose vision foundation models for open-set iris PAD using periocular imagery. Five representative foundation models are evaluated under three open-set protocols that explicitly separate different sources of distribution shift: unseen Presentation Attack Instruments (PAIs), unseen datasets captured with different sensors and cross-spectral transfer from near-infrared (NIR) to visible spectrum (VIS) imagery. Both frozen feature representations and parameter-efficient task adaptation using Low-Rank Adaptation (LoRA) are assessed within a unified experimental framework. The results indicate that foundation models can transfer across datasets with similar sensing characteristics, but fail to generalise reliably to unseen attack instruments and degrade sharply under cross-spectral evaluation. While LoRA improves performance in certain cross-dataset settings, it frequently amplifies failure under attack-level and spectral shifts. Additional validation experiments using segmented iris inputs, full backbone fine-tuning, joint cross-dataset and cross-PAI shifts, and reverse VIS to NIR transfer further confirm that these failures are not simply artefacts of periocular input, weak adaptation, or one-directional spectral evaluation. These findings show that strong closed-set or cross-dataset performance should not be treated as evidence of robust open-set security, and highlight the need for PAD representations that maintain sensitivity to presentation artefacts while remaining stable under realistic deployment variation.