LoRA-based Adaptation Alone Is Not Enough: Understanding the Limits of Foundation Models for Face Presentation Attack Detection
2026-08-10 • Computer Vision and Pattern Recognition
Computer Vision and Pattern RecognitionMachine Learning
AI summaryⓘ
The authors studied how well different large pre-trained models (foundation models) can detect fake faces designed to trick face recognition systems, especially when tested on data different from what they were trained on. They found that simply using these models without training (zero-shot) performed poorly, almost like random guessing. When they slightly adapted the models by tuning a small part (LoRA), they did very well on familiar data but struggled with new datasets. This shows that the way the models were originally trained and the examples used to adapt them matter more for handling new types of attacks than just small tweaks.
face presentation attack detectionfoundation modelscross-dataset evaluationzero-shot promptingLoRAintra-datasetcross-dataset generalizationvision encoderspretrained representationsadaptation dataset
Authors
Peter Lorenz, Anjith George, Marcel Sébastien
Abstract
Face presentation attack detection (PAD) aims to reliably detect a wide range of presentation attacks. While PAD methods achieve strong performance within individual datasets, their performance degrades under cross-dataset evaluation. Variations in sensors or lighting conditions can reduce the effectiveness of detectors from near-perfect to nearly random. Foundation models (FMs) have emerged as a promising alternative because typical PAD datasets, such as the MCIO benchmarks (MSU-MFSD, CASIA-FASD, Replay-Attack, and OULU-NPU), are small relative to the scale used for web-based pretraining. However, existing PAD systems primarily focus on CLIP-based foundation models, while overlooking other FMs with different architectures and training procedures. This study addresses this question by systematically evaluating 32 FMs. Zero-shot prompting achieves performance near chance across model families and scales. The vision encoders, when low-rankadapted (LoRA) with fewer than 1% trainable weights, achieve below 2% intra-dataset ACER in most cases, while cross-dataset ACER is substantially higher. LoRA primarily refines the decision boundary within a dataset, suggesting that pretrained representations and the adaptation dataset play a larger role in cross-dataset generalization than the evaluated lightweight adaptation strategy.