[Paper Review] Can Your Face Detector Do Anti-spoofing? Face Presentation Attack Detection with a Multi-Channel Face Detector

Anjith George, Sébastien Marcel|arXiv (Cornell University)|Jun 30, 2020

Biometric Identification and Security28 references4 citations

TL;DR

This paper proposes a multi-channel face detector that simultaneously localizes faces and detects presentation attacks (spoofing) using RGB, depth, and infrared data from a single consumer-grade camera. By retraining a single-stage object detector (RetinaNet) to classify bonafide faces versus attacks, the method eliminates the need for a separate PAD module, achieving state-of-the-art performance on the WMCA dataset with lower BPCER in critical low-error regions.

ABSTRACT

In a typical face recognition pipeline, the task of the face detector is to localize the face region. However, the face detector localizes regions that look like a face, irrespective of the liveliness of the face, which makes the entire system susceptible to presentation attacks. In this work, we try to reformulate the task of the face detector to detect real faces, thus eliminating the threat of presentation attacks. While this task could be challenging with visible spectrum images alone, we leverage the multi-channel information available from off the shelf devices (such as color, depth, and infrared channels) to design a multi-channel face detector. The proposed system can be used as a live-face detector obviating the need for a separate presentation attack detection module, making the system reliable in practice without any additional computational overhead. The main idea is to leverage a single-stage object detection framework, with a joint representation obtained from different channels for the PAD task. We have evaluated our approach in the multi-channel WMCA dataset containing a wide variety of attacks to show the effectiveness of the proposed framework.

Motivation & Objective

• To address the vulnerability of face recognition systems to presentation attacks (e.g., photos, videos) by integrating anti-spoofing directly into the face detection stage.
• To eliminate the need for a separate presentation attack detection (PAD) module by leveraging multi-channel data (RGB, depth, infrared) in a unified face detection framework.
• To reduce computational redundancy in face recognition pipelines by replacing standard face detectors with a multi-channel detector that natively performs PAD.
• To improve robustness against diverse attacks—including 2D, 3D, and partial attacks—by utilizing background context and hard negative mining via focal loss.

Proposed method

• Uses a single-stage RetinaNet-based object detector trained on a composite multi-channel input (color, depth, infrared) from a consumer camera (Intel RealSense SR300).
• Reframes the face detection task to classify regions as either 'bonafide face' or 'presentation attack' (non-face), enabling joint localization and anti-spoofing.
• Employs focal loss to focus on hard negative samples (e.g., attack images), improving generalization when training with limited attack data.
• Supports flexible training modes: one-class (only bonafide), two-class (bonafide vs. attack), or multi-class (with labeled attack types), adapting to data availability.
• Utilizes the entire image background as negative samples, enhancing robustness by leveraging contextual information beyond the face region.
• Can be adapted to RGB-D setups using OpenCV AI Kit (OAK-D) or Kinect by stacking RGB and depth channels at input.

Experimental results

Research questions

• RQ1 Can a multi-channel face detector be effectively retrained to detect presentation attacks while maintaining accurate face localization?
• RQ2 Does integrating PAD into the face detection stage reduce pipeline redundancy and computational overhead compared to standalone PAD modules?
• RQ3 How does the proposed method perform against diverse attack types (2D, 3D, partial) in real-world conditions using low-cost sensors?
• RQ4 Can the use of background patches as negative samples improve detection robustness without requiring extensive attack data?
• RQ5 Does focal loss training improve performance on hard examples (e.g., realistic spoof attacks) when only limited attack samples are available?

Key findings

• The proposed method outperforms state-of-the-art CNN-based and feature-based PAD methods on the WMCA dataset, particularly in the low BPCER range (α ≤ 0.5).
• The EPC curve shows superior performance in the critical low-error region, indicating strong robustness and reliability for practical deployment.
• The method achieves high detection accuracy without adding computational cost, as it replaces the standard face detector in the pipeline.
• Training with only bonafide samples and using background as negative samples yields strong performance, demonstrating feasibility in low-data regimes.
• The use of multi-channel data (RGB, depth, infrared) significantly improves discrimination between real faces and spoof attacks compared to single-spectrum methods.
• The framework is deployable on affordable consumer hardware (e.g., Intel RealSense SR300, OAK-D), enabling real-world applicability.