Pith. sign in

REVIEW 5 major objections 7 minor 94 references

Benchmarking Unified Face Attack Detection via Hierarchical Prompt Tuning

T0 review · 5 major / 7 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that a new 697,347-video, 54-attack-type dataset plus hierarchical prompt tuning makes unified face attack detection work across physical and digital attacks, with better generalization to unseen attacks than…

desk verdict The dataset is the real contribution, but the paper's central hierarchy story is asserted rather than demonstrated, and the manuscript needs cleanup before the numbers can be trusted. read the letter →

arxiv 2505.13327 v3 pith:T4LWXJ24 submitted 2025-05-19 cs.CV

Ajian Liu , Haocheng Yuan , Xiao Guo , Hui Ma , Wanyi Zhuang , Changtao Miao , Yan Hong , Chuanbiao Song
show 8 more authors
Jun Lan Qi Chu Tao Gong Yanyan Liang Weiqiang Wang Jun Wan Xiaoming Liu Zhen Lei
This is my paper · ORCID
classification cs.CV
keywords faceanti-spoofingdeepfakedetectionunifiedattackhierarchicalprompttuningvision-languagemodelbenchmarkdatasetgeneralizationtree
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that unified face attack detection—a single model that catches both physical presentation attacks and digitally forged faces—is practical, and that prior attempts fell short for two reasons: there was no large, clean, identity-consistent benchmark, and detectors relied on one classification criterion within one semantic space. It introduces UniAttackData+, a dataset of 697,347 videos from 2,875 identities, each identity subjected to 54 different attack methods spanning physical, manipulation, adversarial, and generative forgery, arranged in a coarse-to-fine taxonomy. It then introduces HiPTune, which builds a visual prompt tree over that taxonomy and lets a frozen vision-language encoder route each sample through coarse-to-fine prompts, pruning to the most relevant criteria and fusing them into the text encoder. On its three protocols, HiPTune reports ACER of 7.31%, 14.26%, and 25.68%, and it reports the best average performance on JFSFDB and UniAttackData, supporting the claim that hierarchical, multi-criterion routing generalizes to unseen attacks better than single-criterion methods. If the claim holds, the field gains a standard benchmark and a model architecture that can adapt to new attack types without retraining a separate detector per attack family.

What carries the argument

The Visual Prompt Tree (VP-Tree): a three-level hierarchy of learnable prompts that mirrors the dataset's attack taxonomy, with each prompt inserted into the frozen CLIP image encoder at different Transformer depths. Higher-level prompts give coarse, generalizable boundaries for catching unknown forgeries; lower-level prompts give fine-grained discrimination for known attacks. The APP module prunes to the most relevant prompt per level for each sample, and the DPI module fuses the chosen prompts and projects them into the text encoder, so the model effectively acts as a router that selects classification criteria per sample rather than drawing a single real/fake line.

What would settle it

A concrete test: compute the silhouette score of CLIP features under the paper's three-level taxonomy on held-out UniAttackData+ frames. If the 2D/3D or manipulation/adversarial/generation groupings do not separate better than random groupings of the same cardinality, the hierarchy is not carrying the reported gains. Alternatively, retrain HiPTune with shuffled leaf labels; if ACER does not degrade, the advantage comes from prompt capacity or routing rather than meaningful hierarchical criteria.

Watch

Extended reading notes

Core claim

The central claim is that multiple classification criteria, organized hierarchically, outperform any single semantic-space criterion for unified face attack detection. The VP-Tree encodes the dataset's taxonomy: level 1 splits physical vs digital, level 2 splits 2D/3D and manipulation/adversarial/generation, and level 3 holds fine-grained attack subtypes; each node is a learnable visual prompt inserted into a frozen CLIP ViT encoder at different depths. The Adaptive Prompt Pruning (APP) module scores each prompt against the image's CLS token and selects the top prompt per level per sample, while the Dynamic Prompt Interaction (DPI) module merges the selected prompts and projects them into the text encoder. Trained on 697,347 videos from 2,875 identities, HiPTune reports ACER of 7.31%, 14.26%, and 25.68% on the identity, cross-method, and cross-type protocols, and the best average AUC on JFSFDB and UniAttackData. The paper also argues the dataset itself is the largest publicly available unified face attack detection dataset, with identity consistency across all 54 attack types to prevent identity-memorization shortcuts.

Load-bearing premise

The benefit of HiPTune depends on the assumption, stated without evidence, that the hand-built three-level taxonomy (physical/digital, 2D/3D, subtype) corresponds to separable feature groupings in the encoder, so the prompts encode meaningful rather than arbitrary criteria.

Editorial extensions

If this is right

  • If HiPTune's gains hold, a single frozen-CLIP UAD model can be trained once and retain reasonable accuracy on attack types never seen in training, cutting deployment cost relative to per-attack PAD/FFD models.
  • The UniAttackData+ protocols give the community a standard way to separate identity generalization (P1), unseen-method generalization (P2), and simple-to-advanced transfer (P3), so future UAD methods can be compared on the same axes.
  • The dataset's identity-consistent, hierarchically labeled structure lets researchers train on all 54 attack types per identity, reducing the risk of models exploiting identity-specific cues rather than forgery cues.
  • On JFSFDB cross-domain tasks, joint UAD training with HiPTune improves AUC on most test sets over separate PAD/FFD training, implying that unified training is complementary rather than harmful.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper's taxonomy is assumed to match the encoder's feature geometry; a direct test would be clustering frames under the 2D/3D and manipulation/adversarial/generation splits and comparing cluster separation against random splits.
  • The same VP-Tree routing could be applied to other fine-grained classification problems with a known hierarchy (e.g., deepfake method sub-families or biological image taxonomies), reusing the coarse-to-fine prompt structure without retraining the full model.
  • Because the dataset includes 54 attack types but forgery methods keep evolving, an important stress test is appending a new generative attack as a new leaf and measuring whether the frozen top-level prompts still detect it.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 7 minor

Summary. The manuscript reports a new unified face attack detection (UAD) benchmark, UniAttackData+ (also called HiFAB in the Fig. 1(c) caption and the Conclusion), claimed to be the largest publicly available UAD dataset, with 54 attack types (14 physical, 40 digital) applied to 2,875 identities and 697,347 videos in total, and proposes HiPTune, a hierarchical prompt-tuning method that constructs a three-level Visual Prompt Tree (VP-Tree) from a hand-defined attack taxonomy, routes each sample to learned prompts via Adaptive Prompt Pruning (APP), and projects the selected prompts into the text encoder through a Dynamic Prompt Integration (DPI) module. Three intra-dataset protocols are defined: identity-disjoint (P1), cross-attack-method (P2), and cross-attack-type (P3). The paper reports the best ACER among the compared methods on all three protocols (7.31%, 14.26%, 25.68%), favorable results on JFSFDB and UniAttackData, and cross-domain evaluations; it also candidly acknowledges weaker results in some settings, including EER on ROSE and Celeb-DFv2 (Section 5.3) and ACER on UniAttackData Protocol 1.1 versus ResNet-50 (Section 5.4).

Significance. If the dataset statistics and the reported numbers are correct, the dataset contribution is significant: UniAttackData+ would give the community an identity-consistent UAD benchmark that is roughly an order of magnitude larger than existing video-based UAD sets, with more attack types and deliberately designed held-out protocols. The paper deserves credit for evaluating across multiple datasets (JFSFDB, UniAttackData, UniAttackData+) and for shipping links to data and code; the held-out identity (P1) and held-out attack type/method (P2, P3) splits, together with cross-dataset tests, mean the headline results are not forced by construction. The method's AUC gains over the compared baselines are consistent, and the paper is candid about settings where it does not win (P1.1 versus ResNet-50, EER on ROSE/Celeb-DFv2). However, the central interpretive claim, that the hand-defined taxonomy encodes meaningful coarse-to-fine classification criteria, is not directly validated, and the benchmark's credibility is currently undercut by arithmetic inconsistencies in Table 3 and by unspecified metric operating points. These issues are fixable, so the contribution remains promising.

major comments (5)
  1. [Section 4.3, Section 5.6 (Fig. 5)] The load-bearing interpretive claim of HiPTune, that the hand-defined three-level taxonomy (physical/digital, 2D/3D, manipulation/adversarial/generation, and their subtypes) corresponds to separable feature groupings and thereby provides 'multi-level, fine-grained classification criteria', is asserted rather than demonstrated. Section 4.3 states that features of different attacks 'demonstrate a more compact grouping relative to other categories' without any quantitative evidence (no silhouette score, cluster purity, or kNN separability computed in the frozen CLIP feature space). The ablation in Section 5.6 (Fig. 5) varies tree depth from 1 to 3, but a deeper tree also contains more prompts, so the gain cannot separate the semantic value of the hierarchy from added prompt parameters and supervised routing; note also that the first-stage prompt training (Section 4.4) injects ground-truth per-level attack labels, so the APP router is trained after the prompts have been specialized with oracle information. A shuffled or randomly rewired taxonomy of identical tree shape and parameter count, or a direct separability analysis of the frozen CLIP features for the chosen nodes, is required before the paper can claim that the taxonomy, rather than extra capacity or the routing mechanism, explains the P2/P3 generalization gains.
  2. [Table 3, Section 3.1] Table 3's sample statistics do not add up as printed. In Protocol 1 the column values of the train row sum to 344,676 while the printed '#All' is 355,676, and the three printed subset totals sum to 708,347 instead of the claimed 697,347 (the column sums do yield 697,347, so the train total appears misprinted). In Protocol 2 the printed subset totals sum to 680,682, a shortfall of 16,665 videos relative to 697,347 that the protocol description does not explain, since all identities and a random 50/20/30 split of all attack methods are supposed to be used. For comparison, Protocol 3 sums correctly to 697,347. Separately, the Introduction says 'at least 30 frames' were randomly extracted per video while Section 3.1 says 'at least 25 frames per video'. Since the dataset statistics are the paper's primary artifact, these numbers must be reconciled and the frame extraction description made consistent.
  3. [Section 5.1, Section 5.2, Table 4] The evaluation protocol is not fully specified and the reported metrics are hard to interpret. The paper never states the decision threshold used for ACER and ACC, and the comparisons appear to mix conventions: for several baselines ACER equals EER exactly (e.g., CLIP-V, CLIP, and CoOp across all three protocols), suggesting that ACER was computed at the EER operating point, while for HiPTune ACER is consistently lower than EER, which is only possible if a different, more favorable threshold is used; the paper must confirm that all methods are scored at the same operating point. Relatedly, the ACC values in Table 4 are difficult to reconcile with a well-tuned detector given the extreme class imbalance (the P1 test set contains 5,475 live versus 207,727 fake videos): HiPTune's ACC of 90.02% on P1 is below the trivial always-fake accuracy of 97.4%, as are most ACC entries in the table, and this should be explained or the operating point stated. Finally, all results in Tables 4-7 are single runs without variance, error bars, or significance tests, which matters given the small margins on P1 (ACER 7.31 for HiPTune versus 8.26 for FA3-CLIP) and on several JFSFDB cells.
  4. [Table 4] The main benchmark table for the new dataset omits the most relevant UAD baselines. Section 2.2 discusses UniFAD [37], UniAttackDetection [39], La-SoftMoE [57], and MoAE-CR [58] as the state of the art in unified detection, yet Table 4 compares HiPTune only against CLIP variants, single-task PAD/FFD methods, and FA3-CLIP; UniAttackDetection appears only in Table 6, on the older UniAttackData benchmark. Since the paper claims best ACER 'on the three proposed protocols', the benchmark should include these methods (at least UniAttackDetection, whose code is available and which is the authors' own prior work) so that the claimed superiority is demonstrated against the strongest existing UAD models rather than only against simpler alternatives.
  5. [Sections 4.4, 4.5] The method as described is not reproducible. No loss functions are given for either training stage (the stage-1 prompt specialization that uses ground-truth per-level labels, or the stage-2 joint training with binary live/fake labels). The APP module performs a hard TOPk=1 selection (Eq. 5), which is non-differentiable, yet the paper does not explain how the router is trained (e.g., Gumbel-softmax, straight-through estimator, or the softmax-weighted DPI aggregation). The DPI is described as projecting 'the three hierarchical prompts' to the text-feature dimension 'through a dedicated mapping layer', but the dimensionality, the trainable status of the mapping, and, critically, how the resulting unified prompt is combined with the frozen text encoder to produce the final live/fake score are never specified; Eqs. (1)-(5) only cover the visual side. The inheritance coefficient alpha introduced in Section 4.3 is never assigned a value, and no ablation on alpha is reported. These gaps must be filled before the experimental results can be independently reproduced.
minor comments (7)
  1. [Section 4.3] The sentence 'Following the approach of XX' is an unresolved placeholder for a citation; it must be replaced with the actual reference or removed.
  2. [Abstract, Fig. 1(c), Section 6] The dataset is named UniAttackData+ in the Abstract and body but 'HiFAB' in the Fig. 1(c) caption and in the Conclusion; a single name should be adopted throughout.
  3. [Abstract, Section 4.5] The module name is inconsistent: 'Dynamically Prompt Integration' in the Abstract and Section 1, 'Dynamic Prompt Integration' in the Section 4.5 heading, and 'Dynamic Prompt Interaction' in the first paragraph of Section 4.5; one name should be used everywhere.
  4. [Section 1 (contributions)] The contribution bullet promises 'four intra-dataset protocols and nine cross-dataset benchmarks', but Section 3.5 defines only three protocols on UniAttackData+ (P1-P3) and no enumeration of nine cross-dataset benchmarks appears in the paper; the counts should be reconciled with the tables.
  5. [Section 3.1] The claim that 'All the attack methods included in our dataset were proposed after 2021' is contradicted by the paper's own references (SimSwap [21] is 2019, StarGAN [19] is 2018, AutoAttack [74] and PGD [75] predate 2021), and the nearby claim of covering 'all known attack types' (also phrased as 'almost all known attack types') is made without a survey or a comparison table against existing attack taxonomies.
  6. [Table 3] The header of the last three rows reads 'text' instead of 'test'.
  7. [Section 5.3] HiPTune's EER on ROSE-PAD (12.82) and Celeb-DFv2-FFD (28.77) is worse than FA3-CLIP's (9.61 and 25.51); the discussion should address these outliers directly rather than only reporting the averaged EER advantage.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the dataset and VP-Tree hierarchy are design inputs, while all headline ACER results are measured on held-out identities, held-out attack types, and external benchmarks, so the central claims are not forced by construction.

full rationale

The paper's main claims are empirical: UniAttackData+ is a large benchmark and HiPTune outperforms baselines. The VP-Tree is explicitly built from the dataset's manual taxonomy ('following the hierarchical structure of our dataset'), and prompts are trained with ground-truth attack labels, so the hierarchy is a design input rather than a derived prediction. However, the headline results are measured under protocols that withhold identities (P1), attack methods (P2), and whole attack categories (P3), and additionally on external benchmarks (JFSFDB, UniAttackData, and cross-dataset UAD). No fitted parameter is renamed as a prediction, and no load-bearing argument reduces to a self-citation: the self-citation to UniAttackData [39] only supplies the identity-consistent design choice. The paper's interpretive claim that the manual taxonomy corresponds to compact feature groupings is asserted without quantitative support (Sec. 4.3), and the depth ablation (Sec. 5.6) confounds tree depth with prompt count, but these are evidence-quality and correctness concerns, not circularity. No equation equals another by construction, and the ACER numbers are not determined by the training labels of the test categories in P2/P3. Therefore the circularity score is 0.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

No parameter-free derivation is offered. The free parameters are conventional hyperparameters, but α and the full architecture details are unstated. The most consequential assumption is that the dataset's manual hierarchy mirrors feature geometry; this is asserted in §4.3 but not demonstrated.

free parameters (5)
  • prompt length L = 40
    Chosen via ablation on Protocol 1 (Fig. 5); length 40 gives best ACER/AUC, length 50 degrades.
  • prompt inheritance coefficient α = not specified
    Introduced in §4.3 to control partial inheritance of parent prompts; no value is given, making exact reproduction impossible.
  • VP-Tree depth = 3
    Three-level hierarchy used throughout; ablation in Fig. 5 shows deeper trees improve performance, so depth is a design choice tuned on Protocol 1.
  • prompt insertion positions N0, N1, N2, N3 = 3, 3, 3, 3
    Set in implementation details §5.1; the insertion depths into the Transformer are manually chosen.
  • learning rate and epochs = 1e-5, 100 + 500
    Implementation choices in §5.1; no analysis justifies these settings.
assumptions (4)
  • domain assumption The fixed manual taxonomy in Fig. 1(b) matches separable feature groupings in the encoder space.
    Stated in §4.3: "Apart from the subjective categorization from the dataset, the features of different attacks demonstrate a more compact grouping relative to other categories..." No clustering or quantitative validation is provided. If the taxonomy is arbitrary, hierarchical prompt routing relies on an unjustified structure.
  • domain assumption Frozen CLIP ViT-B/16 features, guided by visual prompts, are sufficient to distinguish real from 54 types of fake faces.
    The whole method uses a frozen CLIP encoder (§4.1, §5.1) and does not ablate against non-CLIP encoders, so the benchmark conclusions are conditional on CLIP's representational adequacy.
  • domain assumption MTCNN face cropping with scale 1.3 does not remove discriminative attack artifacts.
    Preprocessing (§3.2) crops faces before labeling; if cutout edges, screen borders, or mask rims are partially cropped away, the benchmark may understate the difficulty of physical attacks.
  • domain assumption Applying 54 attack methods to all identities produces representative samples of each attack type.
    The paper does not describe quality control, manual verification, or attack success rate for generated digital attacks; if many samples fail visually, the benchmark labels may be noisy.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Benchmarking Unified Face Attack Detection via Hierarchical Prompt Tuning." pith.science (2026). https://pith.science/paper/T4LWXJ24

@misc{pith2026250513327,
  author       = {Pith},
  title        = {Pith review of: Benchmarking Unified Face Attack Detection via Hierarchical Prompt Tuning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/T4LWXJ24}},
  note         = {Machine review of arXiv:2505.13327}
}
read the original abstract

PAD and FFD are proposed to protect face data from physical media-based Presentation Attacks and digital editing-based DeepFakes, respectively. However, isolated training of these two models significantly increases vulnerability towards unknown attacks, burdening deployment environments. The lack of a Unified Face Attack Detection model to simultaneously handle attacks in these two categories is mainly attributed to two factors: (1) A benchmark that is sufficient for models to explore is lacking. Existing UAD datasets only contain limited attack types and samples, leading to the model's confined ability to address abundant advanced threats. In light of these, through an explainable hierarchical way, we propose the most extensive and sophisticated collection of forgery techniques available to date, namely UniAttackDataPlus. Our UniAttackData+ encompasses 2,875 identities and their 54 kinds of corresponding falsified samples, in a total of 697,347 videos. (2) The absence of a trustworthy classification criterion. Current methods endeavor to explore an arbitrary criterion within the same semantic space, which fails to exist when encountering diverse attacks. Thus, we present a novel Visual-Language Model-based Hierarchical Prompt Tuning Framework that adaptively explores multiple classification criteria from different semantic spaces. Specifically, we construct a VP-Tree to explore various classification rules hierarchically. Then, by adaptively pruning the prompts, the model can select the most suitable prompts guiding the encoder to extract discriminative features at different levels in a coarse-to-fine manner. Finally, to help the model understand the classification criteria in visual space, we propose a DPI module to project the visual prompts to the text encoder to help obtain a more accurate semantics.

Figures

Figures reproduced from arXiv: 2505.13327 by the authors.

Figure 1
Figure 1. (a) The Physical and Digital Attack construction approaches. Physical Presentation Attacks aim to steal identity [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. The dashed lines represent the classification criteria [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. This diagram categorizes attacks into four distinct types: Physical Attacks, Digital Manipulation, Digital Adversarial [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: (a) The VP-Tree establishes a hierarchical prompt tree for all attack types, organized into three levels of grouping [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]
Figure 5
Figure 5. Figure 5: Ablation studies on the level of VP-Tree and the [PITH_FULL_IMAGE:figures/full_fig_p014_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

94 extracted references · 60 canonical work pages

  1. [37]

    Unified detection of digital and physical face attacks,

    D. Deb, X. Liu, and A. K. Jain, “Unified detection of digital and physical face attacks,” in 2023 IEEE 17th International Conference on Automatic Face and Gesture Recognition (FG) . IEEE, 2023, pp. 1–8

    work page 2023

  2. [39]

    Unified physical-digital face attack detection,

    H. Fang, A. Liu, H. Yuan, J. Zheng, D. Zeng, Y. Liu, J. Deng, S. Escalera, X. Liu, J. Wan et al. , “Unified physical-digital face attack detection,” arXiv preprint arXiv:2401.17699, 2024

    arXiv 2024

  3. [57]

    La- softmoe clip for unified physical-digital face attack detection,

    H. Zou, C. Du, H. Zhang, Y. Zhang, A. Liu, J. Wan, and Z. Lei, “La- softmoe clip for unified physical-digital face attack detection,” in 2024 IEEE International Joint Conference on Biometrics (IJCB). IEEE, 2024, pp. 1–11

    work page 2024

  4. [58]

    Mixture-of-attack-experts with class regularization for unified physical-digital face attack detection,

    S. Chen, A. Liu, J. Zheng, J. Wan, K. Peng, S. Escalera, and Z. Lei, “Mixture-of-attack-experts with class regularization for unified physical-digital face attack detection,” in Proceedings of the AAAI Conference on Artificial Intelligence , vol. 39, no. 2, 2025, pp. 2195– 2203

    work page 2025

  5. [1]

    Casia-surf: A large-scale multi-modal benchmark for face anti-spoofing,

    S. Zhang, A. Liu, J. Wan, Y. Liang, G. Guo, S. Escalera, H. J. Escalante, and S. Z. Li, “Casia-surf: A large-scale multi-modal benchmark for face anti-spoofing,” IEEE Transactions on Biometrics, Behavior, and Identity Science, vol. 2, no. 2, pp. 182–193, 2020. Fig. 5: Ablation studies on the level of VP-Tree and the length of the prompt

    2020

  6. [2]

    On the effectiveness of local binary patterns in face anti-spoofing,

    I. Chingovska, A. Anjos, and S. Marcel, “On the effectiveness of local binary patterns in face anti-spoofing,” in BIOSIG, 2012

    2012

  7. [3]

    Contrastive context-aware learning for 3d high-fidelity mask face presentation attack detection,

    A. Liu, C. Zhao, Z. Yu, J. Wan, A. Su, X. Liu, Z. Tan, S. Escalera, J. Xing, Y. Liang et al. , “Contrastive context-aware learning for 3d high-fidelity mask face presentation attack detection,” IEEE Transactions on Information Forensics and Security, vol. 17, pp. 2497– 2507, 2022

    2022

  8. [4]

    Biometric face presentation attack detection with multi-channel convolutional neural network,

    A. George, Z. Mostaani, D. Geissenbuhler, O. Nikisins, A. Anjos, and S. Marcel, “Biometric face presentation attack detection with multi-channel convolutional neural network,” TIFS, 2019

    2019

Show all 94 references
  1. [5]

    Learning deep models for face anti-spoofing: Binary or auxiliary supervision,

    Y. Liu, A. Jourabloo, and X. Liu, “Learning deep models for face anti-spoofing: Binary or auxiliary supervision,” in CVPR, 2018

    2018

  2. [6]

    Deep pixel-wise binary supervision for face presentation attack detection,

    A. George and S. Marcel, “Deep pixel-wise binary supervision for face presentation attack detection,” in ICB, 2019

    2019

  3. [7]

    Face anti-spoofing via disentangled repre- sentation learning,

    K.-Y. Zhang, T. Yao, J. Zhang, Y. Tai, S. Ding, J. Li, F. Huang, H. Song, and L. Ma, “Face anti-spoofing via disentangled repre- sentation learning,” in ECCV, 2020

    2020

  4. [8]

    Nas-fas: Static- dynamic central difference network search for face anti-spoofing,

    Z. Yu, J. Wan, Y. Qin, X. Li, S. Z. Li, and G. Zhao, “Nas-fas: Static- dynamic central difference network search for face anti-spoofing,” in TP AMI, 2020

    2020

  5. [9]

    Drl-fas: A novel framework based on deep reinforcement learning for face anti- spoofing,

    R. Cai, H. Li, S. Wang, C. Chen, and A. C. Kot, “Drl-fas: A novel framework based on deep reinforcement learning for face anti- spoofing,” TIFS, vol. 16, pp. 937–951, 2020

    2020

  6. [10]

    Disentangling facial pose and appearance information for face anti-spoofing,

    A. Liu, J. Wan, N. Jiang, H. Wang, and Y. Liang, “Disentangling facial pose and appearance information for face anti-spoofing,” in 2022 26th International Conference on Pattern Recognition (ICPR) . IEEE, 2022, pp. 4537–4543

    2022

  7. [11]

    Patchnet: A simple face anti-spoofing framework via fine-grained patch recognition,

    C.-Y. Wang, Y.-D. Lu, S.-T. Yang, and S.-H. Lai, “Patchnet: A simple face anti-spoofing framework via fine-grained patch recognition,” pp. 20 281–20 290, June 2022

    2022

  8. [12]

    Towards unsupervised domain generalization for face anti-spoofing,

    Y. Liu, Y. Chen, M. Gou, C.-T. Huang, Y. Wang, W. Dai, and H. Xiong, “Towards unsupervised domain generalization for face anti-spoofing,” in Proceedings of the IEEE/CVF International Confer- ence on Computer Vision, 2023

    2023

  9. [13]

    Rethinking domain generalization for face anti-spoofing: Separability and alignment,

    Y. Sun, Y. Liu, X. Liu, Y. Li, and W.-S. Chu, “Rethinking domain generalization for face anti-spoofing: Separability and alignment,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2023, pp. 24 563–24 574

    2023

  10. [14]

    Instance-aware domain generalization for face anti-spoofing,

    Q. Zhou, K.-Y. Zhang, T. Yao, X. Lu, R. Yi, S. Ding, and L. Ma, “Instance-aware domain generalization for face anti-spoofing,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2023, pp. 20 453–20 463

    2023

  11. [15]

    Flip: Cross-domain face anti-spoofing with language guidance,

    K. Srivatsan, M. Naseer, and K. Nandakumar, “Flip: Cross-domain face anti-spoofing with language guidance,” in Proceedings of the IEEE/CVF International Conference on Computer Vision , 2023, pp. 19 685–19 696

    2023

  12. [16]

    Gradient alignment for cross-domain face anti-spoofing,

    B. M. Le and S. S. Woo, “Gradient alignment for cross-domain face anti-spoofing,” in CVPR, 2024

    2024

  13. [17]

    Test-time domain generalization for face anti-spoofing,

    Q. Zhou, K.-Y. Zhang, T. Yao, X. Lu, S. Ding, and L. Ma, “Test-time domain generalization for face anti-spoofing,” in Proceedings of the JOURNAL OF LATEX CLASS FILES, VOL. *, NO. *, 2015 15 IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2024, pp. 175–187

    2015

  14. [18]

    Safa: Structure aware face anima- tion,

    Q. Wang, L. Zhang, and B. Li, “Safa: Structure aware face anima- tion,” in 2021 International Conference on 3D Vision (3DV) . IEEE, 2021, pp. 679–688

    2021

  15. [19]

    Star- gan: Unified generative adversarial networks for multi-domain image-to-image translation,

    Y. Choi, M. Choi, M. Kim, J.-W. Ha, S. Kim, and J. Choo, “Star- gan: Unified generative adversarial networks for multi-domain image-to-image translation,” in Proceedings of the IEEE conference on computer vision and pattern recognition , 2018, pp. 8789–8797

    2018

  16. [20]

    Facedancer: Pose-and occlusion-aware high fidelity face swap- ping,

    F. Rosberg, E. E. Aksoy, F. Alonso-Fernandez, and C. Englund, “Facedancer: Pose-and occlusion-aware high fidelity face swap- ping,” in Proceedings of the IEEE/CVF winter conference on applica- tions of computer vision, 2023, pp. 3454–3463

    2023

  17. [21]

    Simswap: An efficient framework for high fidelity face swapping,

    R. Chen, X. Chen, B. Ni, and Y. Ge, “Simswap: An efficient framework for high fidelity face swapping,” in Proceedings of the 28th ACM international conference on multimedia , 2020, pp. 2003– 2011

    2020

  18. [22]

    Depth-aware gener- ative adversarial network for talking head video generation,

    F.-T. Hong, L. Zhang, L. Shen, and D. Xu, “Depth-aware gener- ative adversarial network for talking head video generation,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2022, pp. 3397–3406

    2022

  19. [23]

    One-shot free-view neural talking-head synthesis for video conferencing,

    T.-C. Wang, A. Mallya, and M.-Y. Liu, “One-shot free-view neural talking-head synthesis for video conferencing,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , 2021, pp. 10 039–10 049

    2021

  20. [24]

    Making adversarial examples more transferable and indistinguishable,

    J. Zou, Y. Duan, B. Li, W. Zhang, Y. Pan, and Z. Pan, “Making adversarial examples more transferable and indistinguishable,” in Proceedings of the AAAI conference on artificial intelligence , vol. 36, no. 3, 2022, pp. 3662–3670

    2022

  21. [25]

    Ila-da: Improving transferability of intermediate level attack with data augmenta- tion,

    C. W. Yan, T.-H. Cheung, and D.-Y. Yeung, “Ila-da: Improving transferability of intermediate level attack with data augmenta- tion,” in The Eleventh International Conference on Learning Represen- tations, 2022

    2022

  22. [26]

    Boosting adversarial transferability across model genus by deformation-constrained warping,

    Q. Lin, C. Luo, Z. Niu, X. He, W. Xie, Y. Hou, L. Shen, and S. Song, “Boosting adversarial transferability across model genus by deformation-constrained warping,” in Proceedings of the AAAI Conference on Artificial Intelligence , vol. 38, no. 4, 2024, pp. 3459– 3467

    2024

  23. [27]

    Ex- ploring misclassifications of robust neural networks to enhance adversarial attacks,

    L. Schwinn, R. Raab, A. Nguyen, D. Zanca, and B. Eskofier, “Ex- ploring misclassifications of robust neural networks to enhance adversarial attacks,” Applied Intelligence, vol. 53, no. 17, pp. 19 843– 19 859, 2023

    2023

  24. [28]

    Frequency- driven imperceptible adversarial attack on semantic similarity,

    C. Luo, Q. Lin, W. Xie, B. Wu, J. Xie, and L. Shen, “Frequency- driven imperceptible adversarial attack on semantic similarity,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2022, pp. 15 315–15 324

    2022

  25. [29]

    Towards transferable adversarial attacks on vision transformers,

    Z. Wei, J. Chen, M. Goldblum, Z. Wu, T. Goldstein, and Y.-G. Jiang, “Towards transferable adversarial attacks on vision transformers,” in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 36, no. 3, 2022, pp. 2668–2676

    2022

  26. [30]

    Transferable adversar- ial attacks on vision transformers with token gradient regulariza- tion,

    J. Zhang, Y. Huang, W. Wu, and M. R. Lyu, “Transferable adversar- ial attacks on vision transformers with token gradient regulariza- tion,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2023, pp. 16 415–16 424

    2023

  27. [31]

    Consistentid: Portrait generation with multimodal fine-grained identity preserving,

    J. Huang, X. Dong, W. Song, H. Li, J. Zhou, Y. Cheng, S. Liao, L. Chen, Y. Yan, S. Liao et al. , “Consistentid: Portrait generation with multimodal fine-grained identity preserving,” arXiv preprint arXiv:2404.16771, 2024

    2024 arXiv

  28. [32]

    Pulid: Pure and lightning id customization via contrastive alignment,

    Z. Guo, Y. Wu, Z. Chen, L. Chen, P . Zhang, and Q. He, “Pulid: Pure and lightning id customization via contrastive alignment,” arXiv preprint arXiv:2404.16022, 2024

    2024 arXiv

  29. [33]

    Instantid: Zero-shot identity-preserving generation in seconds,

    Q. Wang, X. Bai, H. Wang, Z. Qin, A. Chen, H. Li, X. Tang, and Y. Hu, “Instantid: Zero-shot identity-preserving generation in seconds,” arXiv preprint arXiv:2401.07519, 2024

    2024 arXiv

  30. [34]

    Real appearance modeling for more general deepfake detection,

    J. Tian, C. Yu, X. Wang, P . Chen, Z. Xiao, J. Dai, J. Han, and Y. Chai, “Real appearance modeling for more general deepfake detection,” in European Conference on Computer Vision . Springer, 2024, pp. 402–419

    2024

  31. [35]

    Implicit identity leakage: The stumbling block to improving deepfake detection generalization,

    S. Dong, J. Wang, R. Ji, J. Liang, H. Fan, and Z. Ge, “Implicit identity leakage: The stumbling block to improving deepfake detection generalization,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2023, pp. 3994–4004

    2023

  32. [36]

    Exploiting style latent flows for generalizing deepfake video detection,

    J. Choi, T. Kim, Y. Jeong, S. Baek, and J. Choi, “Exploiting style latent flows for generalizing deepfake video detection,” in Pro- ceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2024, pp. 1133–1143

    2024

  33. [38]

    Benchmark- ing joint face spoofing and forgery detection with visual and physiological cues,

    Z. Yu, R. Cai, Z. Li, W. Yang, J. Shi, and A. C. Kot, “Benchmark- ing joint face spoofing and forgery detection with visual and physiological cues,” IEEE Transactions on Dependable and Secure Computing, 2024

    2024

  34. [40]

    A face antispoofing database with diverse attacks,

    Z. Zhang, J. Yan, S. Liu, Z. Lei, D. Yi, and S. Z. Li, “A face antispoofing database with diverse attacks,” in ICB, 2012

    2012

  35. [41]

    Face spoof detection with image distortion analysis,

    D. Wen, H. Han, and A. K. Jain, “Face spoof detection with image distortion analysis,” IEEE TIFS, 2015

    2015

  36. [42]

    A 3d mask face anti- spoofing database with real world variations,

    S. Liu, B. Yang, P . C. Yuen, and G. Zhao, “A 3d mask face anti- spoofing database with real world variations,” in Proceedings of the IEEE conference on computer vision and pattern recognition workshops , 2016, pp. 100–106

    2016

  37. [43]

    Oulu-npu: A mobile face presentation attack database with real- world variations,

    Z. Boulkenafet, J. Komulainen, L. Li, X. Feng, and A. Hadid, “Oulu-npu: A mobile face presentation attack database with real- world variations,” in FGR, 2017, pp. 612–618

    2017

  38. [44]

    Unsu- pervised domain adaptation for face anti-spoofing,

    H. Li, W. Li, H. Cao, S. Wang, F. Huang, and A. C. Kot, “Unsu- pervised domain adaptation for face anti-spoofing,” TIFS, vol. 13, no. 7, pp. 1794–1809, 2018

    2018

  39. [45]

    Celeba-spoof: Large-scale face anti-spoofing dataset with rich annotations,

    Y. Zhang, Z. Yin, Y. Li, G. Yin, J. Yan, J. Shao, and Z. Liu, “Celeba-spoof: Large-scale face anti-spoofing dataset with rich annotations,” in ECCV, 2020

    2020

  40. [46]

    Nas-fas: Static- dynamic central difference network search for face anti-spoofing,

    Z. Yu, J. Wan, Y. Qin, X. Li, S. Z. Li, and G. Zhao, “Nas-fas: Static- dynamic central difference network search for face anti-spoofing,” IEEE transactions on pattern analysis and machine intelligence, vol. 43, no. 9, pp. 3005–3023, 2020

    2020

  41. [47]

    Multi-domain learning for updating face anti-spoofing models,

    X. Guo, Y. Liu, A. Jain, and X. Liu, “Multi-domain learning for updating face anti-spoofing models,” in ECCV. Springer, 2022, pp. 230–249

    2022

  42. [48]

    Detection and continual learning of novel face pre- sentation attacks,

    M. Rostami, L. Spinoulas, M. Hussein, J. Mathai, and W. Abd- Almageed, “Detection and continual learning of novel face pre- sentation attacks,” in Proceedings of the IEEE/CVF international conference on computer vision, 2021, pp. 14 851–14 860

    2021

  43. [49]

    Deepfakes detection dataset,

    N. Dufour, A. Gully, P . Karlsson, A. Vorbyov, T. Leung, J. Childs, and C. Bregler, “Deepfakes detection dataset,” Google and Jigsaw , 2019

    2019

  44. [50]

    The deepfake detection challenge (dfdc) preview dataset,

    B. Dolhansky, R. Howes, B. Pflaum, N. Baram, and C. C. Ferrer, “The deepfake detection challenge (dfdc) preview dataset,” arXiv preprint arXiv:1910.08854, 2019

    1910 arXiv

  45. [51]

    Faceforensics++: Learning to detect manipulated fa- cial images,

    A. Rossler, D. Cozzolino, L. Verdoliva, C. Riess, J. Thies, and M. Nießner, “Faceforensics++: Learning to detect manipulated fa- cial images,” in Proceedings of the IEEE/CVF international conference on computer vision, 2019, pp. 1–11

    2019

  46. [52]

    Celeb-df: A large-scale challenging dataset for deepfake forensics,

    Y. Li, X. Yang, P . Sun, H. Qi, and S. Lyu, “Celeb-df: A large-scale challenging dataset for deepfake forensics,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2020, pp. 3207–3216

    2020

  47. [53]

    Deeperforensics- 1.0: A large-scale dataset for real-world face forgery detection,

    L. Jiang, R. Li, W. Wu, C. Qian, and C. C. Loy, “Deeperforensics- 1.0: A large-scale dataset for real-world face forgery detection,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), June 2020

    2020

  48. [54]

    Face forensics in the wild,

    T. Zhou, W. Wang, Z. Liang, and J. Shen, “Face forensics in the wild,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), June 2021, pp. 5778–5788

    2021

  49. [55]

    Forgerynet: A versatile benchmark for face forgery detection and localization,

    Y. He, Y. Zhang, Y. Liu, W. Wang, Y. Quan, S. Lyu, and Z. Liu, “Forgerynet: A versatile benchmark for face forgery detection and localization,” in Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2021, pp. 15 042–15 052

    2021

  50. [56]

    Casia- surf cefa: A benchmark for multi-modal cross-ethnicity face anti- spoofing,

    A. Liu, Z. Tan, J. Wan, S. Escalera, G. Guo, and S. Z. Li, “Casia- surf cefa: A benchmark for multi-modal cross-ethnicity face anti- spoofing,” in WACV, 2021, pp. 1179–1187

    2021

  51. [59]

    Faˆ{3}-clip: Frequency-aware cues fusion and JOURNAL OF LATEX CLASS FILES, VOL. *, NO. *, 2015 16 attack-agnostic prompt learning for unified face attack detection,

    Y. Li, N. Li, A. Liu, H. Ma, L. Yang, X. Chen, Z. Liang, Y. Liang, J. Wan, and Z. Lei, “Faˆ{3}-clip: Frequency-aware cues fusion and JOURNAL OF LATEX CLASS FILES, VOL. *, NO. *, 2015 16 attack-agnostic prompt learning for unified face attack detection,” arXiv preprint arXiv:25...

    2015 arXiv

  52. [60]

    facenet-pytorch,

    Timesler, “facenet-pytorch,” 2020. [Online]. Available: https: //github.com/timesler/facenet-pytorch

    2020

  53. [61]

    Ghost—a new face swap approach for image and video domains,

    A. Groshev, A. Maltseva, D. Chesakov, A. Kuznetsov, and D. Dim- itrov, “Ghost—a new face swap approach for image and video domains,” IEEE Access, vol. 10, pp. 83 452–83 462, 2022

    2022

  54. [62]

    Facial geometric detail recovery via implicit representation,

    X. Ren, A. Lattas, B. Gecer, J. Deng, C. Ma, and X. Yang, “Facial geometric detail recovery via implicit representation,” in 2023 IEEE 17th International Conference on Automatic Face and Gesture Recognition (FG), 2023

    2023

  55. [63]

    Blendface: Re-designing identity encoders for face-swapping,

    K. Shiohara, X. Yang, and T. Taketomi, “Blendface: Re-designing identity encoders for face-swapping,” in Proceedings of the IEEE/CVF International Conference on Computer Vision , 2023, pp. 7634–7644

    2023

  56. [64]

    Realistic and efficient face swapping: A unified approach with diffusion models,

    S. Baliah, Q. Lin, S. Liao, X. Liang, and M. H. Khan, “Realistic and efficient face swapping: A unified approach with diffusion models,” arXiv preprint arXiv:2409.07269, 2024

    2024 arXiv

  57. [65]

    Motion representations for articulated animation,

    A. Siarohin, O. J. Woodford, J. Ren, M. Chai, and S. Tulyakov, “Motion representations for articulated animation,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recogni- tion, 2021, pp. 13 653–13 662

    2021

  58. [66]

    Information bottle- neck disentanglement for identity swapping,

    G. Gao, H. Huang, C. Fu, Z. Li, and R. He, “Information bottle- neck disentanglement for identity swapping,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2021, pp. 3404–3413

    2021

  59. [67]

    One shot face swapping on megapixels,

    Y. Zhu, Q. Li, J. Wang, C.-Z. Xu, and Z. Sun, “One shot face swapping on megapixels,” inProceedings of the IEEE/CVF conference on computer vision and pattern recognition , 2021, pp. 4834–4844

    2021

  60. [68]

    Hififace: 3d shape and semantic prior guided high fidelity face swapping,

    Y. Wang, X. Chen, J. Zhu, W. Chu, Y. Tai, C. Wang, J. Li, Y. Wu, F. Huang, and R. Ji, “Hififace: 3d shape and semantic prior guided high fidelity face swapping,” arXiv preprint arXiv:2106.09965, 2021

    2021 arXiv

  61. [69]

    Diffswap: High-fidelity and controllable face swapping via 3d-aware masked diffusion,

    W. Zhao, Y. Rao, W. Shi, Z. Liu, J. Zhou, and J. Lu, “Diffswap: High-fidelity and controllable face swapping via 3d-aware masked diffusion,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2023, pp. 8568–8577

    2023

  62. [70]

    (2024) Deep-live-cam: Real-time face swapping and animation tool

    hacksider. (2024) Deep-live-cam: Real-time face swapping and animation tool. Accessed: 2025-05-18. [Online]. Available: https://github.com/hacksider/Deep-Live-Cam

    2024

  63. [71]

    Roop: One-image face swap on video,

    s0md3v, “Roop: One-image face swap on video,” https://github. com/s0md3v/roop, 2023, accessed: 2025-05-18

    2023

  64. [72]

    Augmented lagrangian adversarial attacks,

    J. Rony, E. Granger, M. Pedersoli, and I. Ben Ayed, “Augmented lagrangian adversarial attacks,” in Proceedings of the IEEE/CVF International Conference on Computer Vision, 2021, pp. 7738–7747

    2021

  65. [73]

    Advdrop: Adversarial attack to dnns by dropping information,

    R. Duan, Y. Chen, D. Niu, Y. Yang, A. K. Qin, and Y. He, “Advdrop: Adversarial attack to dnns by dropping information,” in Proceed- ings of the IEEE/CVF International Conference on Computer Vision , 2021, pp. 7506–7515

    2021

  66. [74]

    Reliable evaluation of adversarial ro- bustness with an ensemble of diverse parameter-free attacks,

    F. Croce and M. Hein, “Reliable evaluation of adversarial ro- bustness with an ensemble of diverse parameter-free attacks,” in International conference on machine learning. PMLR, 2020, pp. 2206– 2216

    2020

  67. [75]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, “Towards deep learning models resistant to adversarial attacks,” arXiv preprint arXiv:1706.06083, 2017

    2017 arXiv

  68. [76]

    Nesterov accelerated gradient and scale invariance for adversarial attacks,

    J. Lin, C. Song, K. He, L. Wang, and J. E. Hopcroft, “Nesterov accelerated gradient and scale invariance for adversarial attacks,” arXiv preprint arXiv:1908.06281, 2019

    1908 arXiv

  69. [77]

    Patch-wise++ perturbation for adversarial targeted attacks,

    L. Gao, Q. Zhang, J. Song, and H. T. Shen, “Patch-wise++ perturbation for adversarial targeted attacks,” arXiv preprint arXiv:2012.15503, 2020

    2012 arXiv

  70. [78]

    Pixle: a fast and effective black-box attack based on rearranging pixels,

    J. Pomponi, S. Scardapane, and A. Uncini, “Pixle: a fast and effective black-box attack based on rearranging pixels,” in 2022 International Joint Conference on Neural Networks (IJCNN) . IEEE, 2022, pp. 1–7

    2022

  71. [79]

    Enhancing the transferability of adversarial attacks through variance tuning,

    X. Wang and K. He, “Enhancing the transferability of adversarial attacks through variance tuning,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2021, pp. 1924– 1933

    2021

  72. [80]

    Demiguise attack: Crafting invisible semantic ad- versarial perturbations with perceptual similarity,

    Y. Wang, S. Wu, W. Jiang, S. Hao, Y.-a. Tan, and Q. Zhang, “Demiguise attack: Crafting invisible semantic ad- versarial perturbations with perceptual similarity,” arXiv preprint arXiv:2107.01396, 2021

    2021 arXiv

  73. [81]

    Photomaker: Customizing realistic human photos via stacked id embedding,

    Z. Li, M. Cao, X. Wang, Z. Qi, M.-M. Cheng, and Y. Shan, “Photomaker: Customizing realistic human photos via stacked id embedding,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024, pp. 8640–8650

    2024

  74. [82]

    Ip-adapter: Text compatible image prompt adapter for text-to-image diffusion models,

    H. Ye, J. Zhang, S. Liu, X. Han, and W. Yang, “Ip-adapter: Text compatible image prompt adapter for text-to-image diffusion models,” arXiv preprint arXiv:2308.06721, 2023

    2023 arXiv

  75. [83]

    Learning transferable visual models from natural language supervision,

    A. Radford, J. W. Kim, C. Hallacy, A. Ramesh, G. Goh, S. Agar- wal, G. Sastry, A. Askell, P . Mishkin, J. Clark et al. , “Learning transferable visual models from natural language supervision,” in International conference on machine learning . PMLR, 2021, pp. 8748–8763

    2021

  76. [84]

    Attention is all you need,

    A. Vaswani, “Attention is all you need,” Advances in Neural Infor- mation Processing Systems, 2017

    2017

  77. [85]

    An image is worth 16x16 words: Transformers for image recognition at scale,

    A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenborn, X. Zhai, T. Unterthiner, M. Dehghani, M. Minderer, G. Heigold, S. Gelly, J. Uszkoreit, and N. Houlsby, “An image is worth 16x16 words: Transformers for image recognition at scale,” ICLR, 2021

    2021

  78. [86]

    Learning to prompt for vision-language models,

    K. Zhou, J. Yang, C. C. Loy, and Z. Liu, “Learning to prompt for vision-language models,” International Journal of Computer Vision , vol. 130, no. 9, pp. 2337–2348, 2022

    2022

  79. [87]

    Visual prompt tuning,

    M. Jia, L. Tang, B.-C. Chen, C. Cardie, S. Belongie, B. Hariharan, and S.-N. Lim, “Visual prompt tuning,” in European Conference on Computer Vision. Springer, 2022, pp. 709–727

    2022

  80. [88]

    Visual prompt flexible- modal face anti-spoofing,

    Z. Yu, R. Cai, Y. Cui, A. Liu, and C. Chen, “Visual prompt flexible- modal face anti-spoofing,” IEEE Transactions on Dependable and Secure Computing, 2024

    2024

  81. [89]

    Searching central difference convolutional networks for face anti- spoofing,

    Z. Yu, C. Zhao, Z. Wang, Y. Qin, Z. Su, X. Li, F. Zhou, and G. Zhao, “Searching central difference convolutional networks for face anti- spoofing,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2020, pp. 5295–5305

    2020

  82. [90]

    Cfpl-fas: Class free prompt learning for generalizable face anti-spoofing,

    A. Liu, S. Xue, J. Gan, J. Wan, Y. Liang, J. Deng, S. Escalera, and Z. Lei, “Cfpl-fas: Class free prompt learning for generalizable face anti-spoofing,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024, pp. 222–232

    2024

  83. [91]

    Moe-ffd: Mixture of experts for generalized and parameter- efficient face forgery detection,

    C. Kong, A. Luo, P . Bao, Y. Yu, H. Li, Z. Zheng, S. Wang, and A. C. Kot, “Moe-ffd: Mixture of experts for generalized and parameter- efficient face forgery detection,” arXiv preprint arXiv:2404.08452 , 2024

    2024 arXiv

  84. [92]

    Laa-net: Localized artifact attention network for quality-agnostic and generalizable deepfake detection,

    D. Nguyen, N. Mejri, I. P . Singh, P . Kuleshova, M. Astrid, A. Kacem, E. Ghorbel, and D. Aouada, “Laa-net: Localized artifact attention network for quality-agnostic and generalizable deepfake detection,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern...

    2024

  85. [93]

    Mesonet: a compact facial video forgery detection network,

    D. Afchar, V . Nozick, J. Yamagishi, and I. Echizen, “Mesonet: a compact facial video forgery detection network,” in WIFS, 2018

    2018

  86. [94]

    Xception: Deep learning with depthwise separable convolutions,

    F. Chollet, “Xception: Deep learning with depthwise separable convolutions,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2017, pp. 1251–1258

    2017

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.