Tomatoes, Potatoes, and Onions: Questioning the Need for Faces in Face Presentation Attack Detection
Guray Ozgur, Fadi Boutros, Naser Damer
cs.CV
2026-08-20
A detector trained only on tomato, potato, and onion print/replay attacks hits 92.7% AUC on four face PAD benchmarks and beats synthetic-face training.
Face presentation attack detection is almost always framed as a face problem. Models train on faces, benchmarks are faces, and cross-dataset drops are blamed on new subjects, demographics, and lighting. That story justifies ever-larger corpora of real people, with consent, privacy, and demographic-bias costs attached. This Fraunhofer IGD paper takes the harder line: a PAD model should learn traces of the recapture pipeline, print halftone, display moiré, gamma, specularity, camera noise, and the face is incidental. If that is right, downstream PAD training does not need faces.
TPO is a face-free attack set. Twenty-six physical tomatoes, potatoes, and onions each, 78 object identities, chosen because they reflect light differently. Capture copies a face PAD protocol: four indoor viewpoints, close and far, a Surface tablet and a Galaxy phone, video plus stills for bona fides. Print attacks send stills to an office printer at 600 dpi on A4 and recapture them. Replay attacks play bona fide video on either device and record with either device. Device and scale are fully crossed. The set has 12,480 presentations: 4,992 print videos, 4,992 replay videos, 1,248 bona fide videos and 1,248 stills.
The detector follows FoundPAD: frozen CLIP ViT-B/16, rank-8 LoRA on Q and V of all 12 attention blocks, linear two-class head, about 0.30M trainable parameters. The public FoundPAD pipeline had applied ImageNet normalization to CLIP; this paper switches to CLIP's own mean and variance and retrains the face baselines under the same fix. A compute budget of about 11,000 optimizer updates is locked before any paired comparison, so larger sources do not get more training. Evaluation is whole-dataset transfer among MSU-MFSD, CASIA-FASD, Idiap Replay-Attack, and OULU-NPU (MCIO). TPO is never split into its own train and test.
FoundPAD adapted only on TPO, with no face in downstream training, reaches 92.70% mean AUC and 14.15% HTER on MCIO. An architecture-matched ViT-B/16 started from ImageNet-21k and fully fine-tuned on TPO gets 67.81% AUC. The same FoundPAD trained on SynthASpoof synthetic faces gets 81.02%. Reverse transfer is weaker: single-source face models score 58.89-89.88% AUC on TPO, still above the paper's roughly 67.7% CLIP zero-shot.
Under a fixed budget, replacing part of single-source face sampling with TPO lifts mean AUC from 89.33% to 92.55% across twelve protocols and cuts HTER from 17.54% to 13.97%. In multi-source training the mean AUC moves from 92.11% to 96.96% and HTER from 14.72% to 7.84%. TPO displaces real-face views; it does not add extra updates.
Ablations are clean. Print-only and replay-only training fall to 86.14% and 83.97% mean AUC. Each vegetable already transfers, onions alone at 91.78%, and the three together remain best. Frame count barely matters: 10% of frames still yield 92.97% AUC. The vegetables barely move, so extra frames are redundant; attack-instrument and capture diversity are what transfer. Frequency residuals kill a single spectral shortcut: TPO attacks add high-frequency energy, several face sets lose it, and MSU-MFSD sits near zero.
A PAD module can be trained without faces. That cuts a class of consent and GDPR cost, and a face-free set has no demographic attributes to imbalance. SynthASpoof keeps facial appearance; TPO keeps a real print and replay chain, and the chain won this comparison. For teams that already have face PAD data, TPO is complementary under a fixed budget, not a toy. Part of the famous cross-dataset gap may be printers, screens, and cameras shifting, not faces.
The claim is restricted to print and replay in RGB. 3D masks depend on geometry; depth and IR are other sensors; neither is tested. CLIP saw faces, paper, and screens in pretraining. The ImageNet ViT control shows that exposure is not enough, and the minimal prior is still unknown. HTER uses the target-set EER threshold, a calibration issue that also exists face-to-face; AUC is the quantity the position actually needs. TPO has few objects and one room. An office printer and two consumer cameras do not stand in for a border gate. Demographic fairness "by construction" is an argument, not a split of the face test sets by skin tone or age.