[Paper Review] Deep Anomaly Detection for Generalized Face Anti-Spoofing

Daniel Pérez‐Cabo, David Jiménez‐Cabello+2 more|arXiv (Cornell University)|Apr 17, 2019

Biometric Identification and Security2 citations

TL;DR

This paper proposes a deep metric learning framework for generalized face anti-spoofing by reformulating presentation attack detection as an anomaly detection problem. It introduces a novel 'metric-softmax' loss regularized by a triplet focal loss to learn discriminative feature representations, achieving state-of-the-art performance on the GRAD-GPAD benchmark with a 16.8% ACER on CASIA-FASD and 45.62% ACER on Replay-Attack, while enabling classifier-free inference via few-shot a posteriori probability estimation.

ABSTRACT

Face recognition has achieved unprecedented results, surpassing human capabilities in certain scenarios. However, these automatic solutions are not ready for production because they can be easily fooled by simple identity impersonation attacks. And although much effort has been devoted to develop face anti-spoofing models, their generalization capacity still remains a challenge in real scenarios. In this paper, we introduce a novel approach that reformulates the Generalized Presentation Attack Detection (GPAD) problem from an anomaly detection perspective. Technically, a deep metric learning model is proposed, where a triplet focal loss is used as a regularization for a novel loss coined "metric-softmax", which is in charge of guiding the learning process towards more discriminative feature representations in an embedding space. Finally, we demonstrate the benefits of our deep anomaly detection architecture, by introducing a few-shot a posteriori probability estimation that does not need any classifier to be trained on the learned features. We conduct extensive experiments using the GRAD-GPAD framework that provides the largest aggregated dataset for face GPAD. Results confirm that our approach is able to outperform all the state-of-the-art methods by a considerable margin.

Motivation & Objective

• Address the generalization gap in face anti-spoofing models, which often overfit to training data and fail in real-world scenarios with unseen attacks.
• Reframe generalized presentation attack detection (GPAD) as an anomaly detection problem to improve robustness against out-of-distribution spoofing samples.
• Develop a deep metric learning architecture that learns discriminative feature representations for genuine and spoofed faces in a shared embedding space.
• Enable decision-making without training a separate classifier by introducing a few-shot a posteriori probability estimation method.

Proposed method

• Use a Siamese CNN architecture with shared weights to extract features from anchor, positive, and negative samples in a triplet-based learning setup.
• Introduce a novel 'metric-softmax' loss that models the probability distribution of each triplet pair, enhancing feature separability between real and spoofed samples.
• Apply a triplet focal loss as a regularizer to the metric-softmax loss, focusing training on hard negative samples and improving margin learning.
• Train the model end-to-end to learn a compact, discriminative embedding space where genuine samples are tightly clustered and spoof samples are pushed to the periphery.
• Implement a few-shot a posteriori probability estimation using only M=3 support samples per class, eliminating the need for a separate classifier during inference.
• Leverage the intrinsic distance distribution in the embedding space to detect spoof samples as anomalies, treating them as out-of-distribution points.

Experimental results

Research questions

• RQ1 Can deep metric learning with a novel loss formulation improve generalization in generalized face anti-spoofing beyond domain-shifted test sets?
• RQ2 How effective is the proposed 'metric-softmax' loss combined with triplet focal loss in learning discriminative feature representations for spoof detection?
• RQ3 Can a few-shot a posteriori probability estimation replace traditional classifiers in spoof detection while maintaining high accuracy?
• RQ4 How does the model perform under extreme domain shifts, such as testing on previously unseen datasets like CASIA-FASD and Replay-Attack?
• RQ5 To what extent does the anomaly detection perspective improve robustness compared to conventional classification-based anti-spoofing models?

Key findings

• The proposed method achieves an ACER of 16.8% on the CASIA-FASD dataset under the cross-dataset test protocol, significantly outperforming prior state-of-the-art methods.
• On the Replay-Attack dataset, the method achieves an ACER of 45.62%, which is the best among all compared methods despite the severe performance drop due to domain shift and unseen attack types.
• The few-shot a posteriori probability estimation (Ours†) achieves comparable performance to the SVM-based version (Ours), validating the effectiveness of the classifier-free inference pipeline.
• The model maintains a low HTER of 25.00% on Replay-Attack, outperforming all baselines in terms of HTER and BPCER, indicating strong generalization and robustness.
• The combination of metric-softmax and triplet focal loss leads to more discriminative feature representations, as evidenced by consistent performance gains across multiple inter-dataset evaluations.
• The approach generalizes well to unseen attack types and domains, demonstrating that treating spoofing as anomaly detection improves real-world applicability.