← Back to Blog
Research RadarFace DetectionPresentation Attack DetectionarXivJuly 2026

Monthly arXiv Radar

July 2026 Face Detection Papers: Multispectral Patches, Concept-Guided PAD, and Ocular Challenges

Direct face-detector papers were sparse in July, but the capture security layer was active. This roundup therefore follows the detection stack outward: whether a fused visual-infrared detector can be physically hidden from, whether a face anti-spoofing model can generalize to unseen materials and sensors, and whether ocular liveness can force a real-time biological response that a replay or generator cannot reproduce.

What This Month Signals

VIPatch demonstrates that combining visible and infrared sensors does not automatically remove physical adversarial risk, because a coordinated mask and thermal sticker can suppress both channels. CPG-PAD attacks a different weakness: anti-spoofing prompts that latch onto dataset artifacts rather than reusable visual concepts. The ocular protocol moves from passive classification to an active challenge, coupling gaze tracking and pupillary response. Taken together, the papers argue for layered capture defenses, explicit cross-domain testing, and careful separation between simulated security evidence and human-validated deployment claims.

Paper 012026-07-25cs.CR

Hiding in Plain Sight: An Effective Physical Adversarial Patch Attack against Visual-Infrared Fused Face Detection

arXivPDF

Authors & Institutions

Qiucheng Yu

City University of Hong Kong, Hong Kong, China

Tao Ni

King Abdullah University of Science and Technology, Saudi Arabia

Yihe Zhou

City University of Hong Kong, Hong Kong, China

Jiayimei Wang

City University of Hong Kong, Hong Kong, China

Qingchuan Zhao

City University of Hong Kong, Hong Kong, China

What Problem It Solves

Prior patches transfer poorly to fused detectors because optimization for the visible image can conflict with the infrared response, and conspicuous patterns are easier for people or secondary systems to notice. VIPatch seeks a physically realizable, joint, and visually unobtrusive attack.

Key Result

The digital black-box attack averages 94.59% ASR across visible detectors and 97.40% across infrared detectors. In the physical fused setting, VIPatch reaches 97.27% ASR on YOLOv8-Face and MTCNN and 100% on TFW and OpenCV. Its visible physical ASR remains 80.29% in 12,000-lux light and ranges from 92.51% to 100% across the tested one-to-three-meter distances.

Abstract

Deep learning-based visual-infrared fused face detection models are increasingly deployed across a wide range of applications, yet they remain susceptible to adversarial patch attacks. Most prior attacks target either the visual or the infrared image alone in the digital domain, which renders them ineffective against fused models in the physical world. Moreover, many of these methods are readily noticeable, as their patch patterns deviate substantially from those seen in the real world. In this paper, we introduce VIPatch (Visual-Infrared Patch), a novel physical adversarial patch attack that produces inconspicuous, realistic, and natural-looking patches for facial images. Specifically, VIPatch crafts a gradient-color mask together with a band-aid sticker across both the visual and infrared images, and jointly optimizes these two elements; the resulting digital patches further guide the fabrication of their physical counterparts. Experimental results show that VIPatch achieves competitive attack success rates (over 90%) in both the digital and physical domains, while keeping the patches unobtrusive to human observers.

Research Starting Point

Visual-infrared fusion is used to keep face detection working in low light and temperature-screening environments, but most adversarial research attacks only one modality or remains digital. A production system needs to know whether an ordinary-looking object can suppress both channels after printing, placement, lighting changes, and camera movement.

Method

VIPatch jointly optimizes a gradient-colored face mask for the visible channel and a bandage-like thermal sticker for the infrared channel, then fabricates physical counterparts. The evaluation combines multiple visible and infrared detectors, white-box and black-box transfer, and physical tests over viewing angle, illumination from 200 to 12,000 lux, and distances from one to three meters.

Paper Summary

Multispectral sensing should be threat-modeled as a coupled system, not as two independent defenses. The attack is a red-team result rather than a mitigation, but it gives detector vendors concrete physical conditions, transfer models, and attack-success targets for evaluating patch detection, sensor consistency checks, and fallback policy.

Paper 022026-07-01cs.CV

CPG-PAD: Concept-Informed Prompts Guided Presentation Attack Detection

arXivPDF

Authors & Institutions

Haoyuan Zhang

School of Artificial Intelligence, University of Chinese Academy of Sciences, China

State Key Laboratory of Multimodal Artificial Intelligence Systems, Institute of Automation, Chinese Academy of Sciences, China

Xiangyu Zhu

State Key Laboratory of Multimodal Artificial Intelligence Systems, Institute of Automation, Chinese Academy of Sciences, China

School of Artificial Intelligence, University of Chinese Academy of Sciences, China

Li Gao

China Mobile Financial Technology Co., Ltd., China

Ajian Liu

State Key Laboratory of Multimodal Artificial Intelligence Systems, Institute of Automation, Chinese Academy of Sciences, China

School of Artificial Intelligence, University of Chinese Academy of Sciences, China

Siran Peng

State Key Laboratory of Multimodal Artificial Intelligence Systems, Institute of Automation, Chinese Academy of Sciences, China

School of Artificial Intelligence, University of Chinese Academy of Sciences, China

Zhen Lei

State Key Laboratory of Multimodal Artificial Intelligence Systems, Institute of Automation, Chinese Academy of Sciences, China

School of Artificial Intelligence, University of Chinese Academy of Sciences, China

Centre for Artificial Intelligence and Robotics, Hong Kong Institute of Science and Innovation, Chinese Academy of Sciences, Hong Kong, China

School of Computer Science and Engineering, Macau University of Science and Technology, Macau, China

What Problem It Solves

The paper aims to align learned prompts with fine-grained, attack-relevant visual evidence while suppressing domain-specific shortcuts. It also tests the same idea across multi-source, limited-source, single-source, and unseen presentation-attack-instrument protocols rather than relying on one cross-dataset split.

Key Result

Without supplementary data, CPG-PAD reaches 2.08% average HTER in the four-way multi-source protocol, improving the CLIP baseline from 5.43%; with CelebA-Spoof it reaches 1.19%. It reports 5.33% average HTER in single-source transfer and 1.02% on unseen attack instruments, where the CLIP baseline is 3.03%. Using a validation-set threshold instead of a test-derived threshold yields 2.28% average HTER, making the thresholding limitation visible.

Abstract

Presentation Attack Detection (PAD) serves as a crucial safeguard for face recognition systems against presentation attacks such as printed photos, replayed videos, and 3D masks. Despite significant progress, existing PAD models still struggle to generalize across unseen domains due to variations in sensors, lighting, and attack materials. Recent Vision-Language Models (VLMs) have shown strong generalization ability, yet their applications in PAD remain limited because learned prompts, typically optimized under class-label supervision, fail to explicitly align with fine-grained attack-relevant visual semantics. As a result, the learned representations often overfit domain-specific artifacts instead of capturing transferable attack cues. To address this, we propose Concept-Informed Prompts Guided Presentation Attack Detection (CPG-PAD), a framework that introduces model-level concept guidance into the prompt learning process. Specifically, we design a Visual Concept-driven Enhancement (VCE) module that employs eXplainable AI (XAI) techniques to automatically discover PAD-relevant visual concepts and generate concept-associated heatmaps providing localized fine-grained guidance. Guided by these heatmaps, a Prompt-based Concept Injection (PCI) mechanism integrates these concepts into the prompt space through a Visual-Prompt Decoder (VPD) and a concept-mapping loss, enabling prompts to align with the model's internal concept space. This design enables CPG-PAD to capture generalizable and domain-invariant attack cues while effectively suppressing dataset-specific biases. Extensive experiments across nine benchmark datasets demonstrate that CPG-PAD consistently achieves state-of-the-art cross-domain performance under multi-source, limited-source, and single-source settings.

Research Starting Point

Face anti-spoofing models often perform well on the sensors and attack media seen during training but fail when lighting, cameras, print processes, masks, or makeup change. Vision-language models offer broad priors, yet label-only prompt learning can still lock onto local dataset artifacts instead of concepts that describe a real presentation attack.

Method

CPG-PAD first uses explainability methods in its Visual Concept-driven Enhancement module to discover concepts and produce localized concept heatmaps. A Visual-Prompt Decoder and concept-mapping loss then inject those maps into the prompt space, connecting CLIP's visual features to multiple learnable real/fake prompts. The vision-only model is evaluated across nine datasets and reports both conventional HTER/AUC and ISO-aligned operating-point metrics.

Paper Summary

Concept-guided prompts are promising when a PAD product must cross sensors and attack materials, particularly because they retain a smaller vision-only footprint than multimodal language models. Buyers should still compare results under deployment-calibrated thresholds: the paper explicitly notes that common test-derived EER thresholds can overstate field readiness.

Paper 032026-07-10cs.CV

A Dual-Stream Challenge-Response Protocol for Ocular Liveness Verification

arXivPDF

Authors & Institutions

Ismail Kably

Konelia Inc., Austin, Texas, USA

What Problem It Solves

The proposed protocol addresses replay, generative deepfake, and prosthetic threats to ocular and iris systems by coupling voluntary smooth-pursuit gaze with the involuntary pupillary light reflex. The central question is whether rendering delay creates a measurable synchronization gap across repeated randomized challenges.

Key Result

The simulation reports AUC 0.502 when generator rendering adds no latency, 0.717 at 25 ms, 0.948 at 50 ms, and at least 0.997 beyond 75 ms for a single round. At 25 ms, ten rounds raise AUC to 0.966, and five or more rounds lower the simulated 0.90-AUC detection threshold from 50 ms to 25 ms. These are in-silico results; no human subjects or live generative attacks were measured.

Abstract

Ocular biometric systems face sophisticated presentation attacks, including high-resolution video replays and real-time generative deepfakes, which easily bypass static liveness checks. Current Presentation Attack Detection (PAD) frameworks typically rely on isolated physiological metrics, such as gaze tracking or the Pupillary Light Reflex (PLR), which can be spoofed independently. This paper proposes a Spatio-Luminance Sensor Fusion protocol, which introduces a dual-stream challenge-response framework for ocular liveness verification by uniting these metrics into a simultaneous authentication challenge. By generating a randomized, time-varying visual stimulus that fluctuates in both spatial trajectory and luminance intensity, we construct a mathematically coupled state-space likelihood model, termed the Synchronization Matrix, to evaluate the continuous cross-correlation between the expected biological latencies of smooth pursuit tracking and pupillary constriction. Using Monte Carlo simulation grounded in literature-derived latency distributions, we demonstrate theoretical separability between genuine and simulated attack conditions, and show that a multi-round challenge design improves the detection of generative deepfakes when a non-zero rendering-latency gap exists. This work provides a simulation-supported theoretical framework for next-generation dynamic spoofing defense in ocular and iris biometrics; human-subject validation is identified as necessary future work before deployment claims can be made.

Research Starting Point

Static gaze or pupil checks can be replayed independently, and real-time generative systems increasingly reproduce plausible eye motion. A stronger liveness test should demand two biologically constrained responses to a fresh challenge and verify their timing relationship rather than classifying a single captured frame.

Method

A display varies target position and luminance simultaneously. The system estimates gaze latency, pupil-constriction latency, and their cross-correlation in a Synchronization Matrix, then combines them into a joint score. A Monte Carlo study runs 10,000 trials per condition using latency distributions drawn from prior literature and evaluates one, three, five, or ten independent rounds across assumed generator delays.

Paper Summary

The design offers a useful blueprint for active liveness and makes its security-latency tradeoff explicit, but it is not yet a deployable accuracy claim. A product evaluation would still need human calibration, sensor timing measurements, correlated-latency attacks, and red-team tests against actual real-time renderers.