← Back to Blog
Research RadarFace DetectionPresentation Attack DetectionarXivAugust 2026

Monthly arXiv Radar

August 2026 Face Detection Papers: Dynamic Landmarks, Face-Free Anti-Spoofing, and Foundation Models

The face detection stack is widening from a fixed bounding box into configurable geometry and trustworthy capture. This month's papers unify incompatible landmark templates, ask whether print/replay artifacts can be learned entirely from non-face objects, and test thirty vision encoders plus sixteen multimodal models across presentation and morph attack datasets.

What This Month Signals

Unified Dynamic FLD replaces template-specific landmark heads with semantic contour queries and can return a requested layout at runtime. TPO challenges an even deeper assumption by showing that print and replay evidence learned from vegetables transfers strongly to face anti-spoofing, making privacy-conscious supplemental data plausible. The foundation-model study provides the boundary condition: general pretraining helps, but zero-shot MLLM prompting remains weak and PAD usually needs visual-encoder adaptation. The practical direction is a consolidated geometry service backed by explicit, cross-domain capture security rather than a collection of dataset-specific models.

Paper 012026-08-11cs.CV

Towards Unified Dynamic Face Landmark Detection

arXivPDF

Authors & Institutions

Sebastian Regalado

University of Toronto, Canada

ModiFace, Canada

Varshanth R. Rao

ModiFace, Canada

Ruowei Jiang

ModiFace, Canada

Parham Aarabi

University of Toronto, Canada

Igor Gilitschenski

University of Toronto, Canada

What Problem It Solves

The paper defines a common semantic coordinate system for heterogeneous landmark layouts and uses it to train one detector across multiple datasets. At inference time, the same network can answer an arbitrary collection of landmark queries, including points not explicitly requested during its source-dataset training.

Key Result

The unified ViT-B model with adapters records 4.02 NME and a 2.19% failure rate on WFLW, 2.43/4.19 NME on the common/challenge 300W splits, and 2.76 NME on AFLW-19 while supporting fused training and dynamic output. When trained only on 300W, it reaches 6.08 NME on the challenging WFLW68 transfer test, versus 7.23 for DTLD and 8.09 for PIPNet. On held-out native landmarks, learned queries improve over spline interpolation by 19.0% on 300W and by 15.7-16.3% on WFLW splits, indicating that the model learns reusable contour semantics rather than only memorizing fixed indices.

Abstract

Although advancements in face landmark detection (FLD) methods continue to push performance boundaries, they overlook two major functional limitations: (1) different network parameters need to be trained independently for each ``$N$-point'' benchmark dataset, and (2) a model trained on an ``$N$-point'' dataset reliably outputs only the $N$ landmarks. In our work, we first conceptualize Face Part-Anchored Landmark Positions (FPALPs), wherein each landmark is treated as a progression value between zero (start) and one (end) along a face part's contour. Every landmark can be expressed in the FPALP format, irrespective of its source dataset, hence unlocking the ability to unify all ``$N$-point'' datasets into a single dataset. Secondly, we represent each landmark with an FPALP-based query, refine it progressively with a cross-modality decoder, and predict its coordinates based on the final representation. Our approach, called Unified Dynamic FLD, embodies these two design choices and streamlines the landmark detection pipeline by enabling (1) a single model to learn on any number of ``$N$-point'' datasets, and (2) yield any number of specific landmark predictions by loading the designated landmark queries at runtime. Extensive experiments on multiple benchmark datasets show that our method delivers these benefits while remaining competitive with, and in several cases outperforming existing state-of-the-art methods.

Research Starting Point

Face landmark datasets disagree on whether a face has 19, 68, 98, or another number of annotated points. Conventional models bind their regression head to one template, forcing teams to train and maintain separate parameters for each dataset and preventing a deployed model from returning a new subset or denser layout on demand. That fragmentation is costly for alignment, reconstruction, makeup, and expression pipelines that consume different landmark conventions.

Method

Each landmark becomes a Face Part-Anchored Landmark Position: a normalized progression from zero to one along a semantic contour such as an eyebrow, eye, nose, mouth, or face boundary. Dataset templates are aligned in this contour space, and every requested point is encoded as an FPALP query. A cross-modality decoder progressively combines image tokens and queries before regressing coordinates. The ViT-B model is jointly trained on AFLW-19, 300W, and WFLW; optional lightweight dataset adapters recover systematic annotation offsets without giving up the unified backbone or runtime-configurable output layout.

Paper Summary

A single query-driven landmark service can replace several template-specific models while preserving competitive accuracy. The approach is especially attractive when products need multiple alignment formats or anticipate adding new landmark definitions, though teams should still test annotation-offset adapters for each production dataset.

Paper 022026-08-20cs.CV

Tomatoes, Potatoes, and Onions: Questioning the Need for Faces in Face Presentation Attack Detection

arXivPDF

Authors & Institutions

Guray Ozgur

Fraunhofer Institute for Computer Graphics Research IGD, Germany

Department of Computer Science, Technical University of Darmstadt, Germany

Fadi Boutros

Fraunhofer Institute for Computer Graphics Research IGD, Germany

Naser Damer

Fraunhofer Institute for Computer Graphics Research IGD, Germany

Department of Computer Science, Technical University of Darmstadt, Germany

What Problem It Solves

The work isolates presentation-process cues from facial semantics through a controlled face-free dataset and asks whether those cues transfer back to standard face PAD benchmarks. It also tests whether replacing some face samples with face-free attacks adds information under a fixed training budget rather than merely increasing dataset size.

Key Result

Training on vegetables alone reaches 92.70% mean AUC and 14.15% HTER across the four face benchmarks, compared with 81.02% AUC for synthetic-face training and 67.81% for the ImageNet-initialized control. Replacing part of a fixed single-source face budget with TPO raises mean cross-dataset AUC from 89.33% to 92.55% and lowers HTER from 17.54% to 13.97%; in multi-source training, AUC rises from 92.11% to 96.96% and HTER falls from 14.72% to 7.84%. Attack diversity matters more than redundant frames: using only 10% of TPO frames still gives 92.97% AUC, while print-only or replay-only training drops to 86.14% and 83.97%.

Abstract

Face presentation attack detection (PAD) is traditionally formulated as a face-specific problem, although many of the visual artifacts introduced by print, replay, and recapture processes are not inherently tied to facial appearance. In this work, we investigate whether transferable PAD representations can be learned without using faces during downstream PAD training. To this end, we introduce TPO, a controlled face-free presentation attack dataset consisting of bona fide, print, and replay recordings of, almost randomly chosen, tomatoes, potatoes, and onions acquired under protocols that closely mirror conventional face PAD datasets. Using a foundation-model-based PAD architecture, we demonstrate that a detector trained on TPO achieves an average AUC of 92.70% across four standard cross-dataset face PAD benchmarks, outperforming training on synthetic faces and remaining competitive with models trained on real face datasets. Conversely, models trained on face PAD datasets transfer consistently above chance to TPO, suggesting that the learned representations capture characteristics of the presentation process rather than object semantics. Furthermore, incorporating TPO into conventional face PAD training consistently improves cross-dataset performance under fixed optimization budgets, indicating that face-free data provides complementary information rather than simply additional training samples. Finally, representation and frequency analyses provide further evidence that transferable PAD representations cannot be explained by a single spectral artifact but instead encode richer presentation cues shared across object categories. Together, these results provide empirical evidence that transferable presentation attack representations can be learned independently of facial content, opening new opportunities for privacy-preserving and identity-independent PAD development.

Research Starting Point

Print and replay attacks introduce moire patterns, display subpixels, paper texture, gamma shifts, reflections, and recapture noise that are properties of the presentation instrument rather than the depicted identity. Yet anti-spoofing research almost always collects more human faces, increasing consent and demographic concerns while encouraging detectors to absorb face or dataset shortcuts. The authors test the deliberately strong hypothesis that transferable attack evidence can be learned without faces at all.

Method

TPO contains 12,480 bona fide, print, and replay presentations of tomatoes, potatoes, and onions captured with protocols modeled on face PAD datasets. A CLIP ViT-B/16 FoundPAD model is adapted with LoRA using only TPO, then evaluated across MSU-MFSD, CASIA-FASD, Replay-Attack, and OULU-NPU. Controls include zero-shot CLIP, an ImageNet-initialized architecture match, SynthASpoof, single- and multi-source real-face training, reverse transfer from face datasets to TPO, fixed-budget replacement experiments, frequency analysis, and ablations over object class, attack type, and frame count.

Paper Summary

For print/replay anti-spoofing, realistic recapture diversity can matter more than collecting another set of identities. Face-free supplemental data offers a privacy-conscious way to improve cross-sensor transfer, but the evidence applies to the tested print and display processes and should not be generalized automatically to masks or novel physical attacks.

Paper 032026-08-30cs.CV

Foundation and Multimodal Large Language Models for Face Presentation and Morph Attack Detection

arXivPDF

Authors & Institutions

Hatef Otroshi Shahreza

Idiap Research Institute, Switzerland

Asif Hussain Khan

Idiap Research Institute, Switzerland

Peter Lorenz

Idiap Research Institute, Switzerland

Alain Komaty

Idiap Research Institute, Switzerland

Sébastien Marcel

Idiap Research Institute, Switzerland

University of Lausanne, Switzerland

What Problem It Solves

This study provides a single, large comparison of access strategies for both face presentation attack detection and morph attack detection. It distinguishes the value of zero-shot language outputs, output logits, frozen visual features, task-specific MLLM tuning, and LoRA adaptation instead of attributing all gains to a generic foundation-model label.

Key Result

Off-the-shelf prompting is not a credible detector: the best zero-shot averages are 31.1% ACER for PAD and 19.4% for MAD. A frozen encoder and linear head improves those figures to 24.4% and 5.0%; task-specific PADLLM and MADLLM reach 13.6% and 2.9% while producing explanations. The best LoRA-adapted encoders achieve 14.9% average ACER for PAD versus 17.3% for the strongest cited specialist, and 3.7% for MAD versus 11.3%. MAD transfers more readily than PAD: the best cross-dataset ACER is 4.9% versus 19.8%, and pretraining objective predicts transfer better than parameter count.

Abstract

Face recognition systems are increasingly deployed in security-critical applications, yet they remain vulnerable to presentation and morph attacks. Presentation attack detection (PAD) and morphing attack detection (MAD) are therefore essential components of trustworthy face biometrics. Despite advancements in PAD and MAD methods, existing detectors suffer from limited generalization and degrade in cross-dataset evaluation. In this paper, we systematically investigate whether general-purpose foundation models (FMs) and multimodal large language models (MLLMs) encode PAD-relevant and MAD-relevant information, and how such models can best be deployed for both tasks. We study five approaches with increasing access to the internal information of the model: (i) zero-shot prompting of off-the-shelf MLLMs; (ii) training a shallow model on the next-token logit probabilities at the output of the MLLM; (iii) parameter-efficient fine-tuning on task-specific question-answer data, yielding two specialized MLLMs, called PADLLM and MADLLM, which additionally provide textual reasoning for their decisions; (iv) linear probing of frozen vision encoders; and (v) fine-tuning of vision encoders of FMs and MLLMs. We benchmark 16 open-weight MLLMs and 30 vision encoder backbones on four PAD datasets (MSU-MFSD, CASIA-FASD, Replay-Attack, and OULU-NPU) and four MAD datasets (FFHQ, FRGC, FRLL, and FERET). Our experiments show that FMs and MLLMs can achieve significant performance for PAD and MAD. In addition, the fine-tuned models achieve state-of-the-art detection performance in cross-dataset evaluation, indicating that general-purpose pretrained representations carry substantial attack-relevant information. Source code of all our experiments will be publicly released.

Research Starting Point

General-purpose vision and multimodal models may already encode texture, geometry, and semantic cues useful for presentation and morph attacks, but model size alone does not reveal how to extract that evidence. Security teams need to know whether an off-the-shelf prompt is enough, whether explanations require a specialized MLLM, and when the visual encoder itself must be adapted to survive cross-dataset sensor and attack shifts.

Method

Sixteen open-weight MLLMs and thirty vision encoders are evaluated on four PAD datasets (MSU-MFSD, CASIA-FASD, Replay-Attack, OULU-NPU) and four MAD datasets (FFHQ, FRGC, FRLL, FERET). Five deployment modes progressively expose more of each model: zero-shot prompting, a shallow classifier over next-token probabilities, parameter-efficient question-answer tuning into PADLLM or MADLLM with textual reasoning, linear probing of frozen vision encoders, and LoRA adaptation of the encoders. Development-set EER thresholds are carried into both intra- and cross-dataset ACER tests.

Paper Summary

Do not deploy a prompted MLLM as a biometric attack detector. Frozen visual features are a useful baseline, but PAD generally needs encoder adaptation, while a tuned MLLM is valuable when human-readable reasoning is required; model choice should be validated separately for presentation and morph attacks.