Pith. sign in

REVIEW 4 major objections 6 minor 24 references

Backdoor Poisoning Attack Against Face Spoofing Attack Detection Methods

T0 review · 4 major / 6 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A backdoor poisoning attack can smuggle a chosen spoofed face past face anti-spoofing detectors by hiding that face's features inside live-looking training images.

desk verdict Plausible new backdoor recipe, but the spoof-specificity claim is unsupported and the evidence is thinner than the headline results suggest. read the letter →

arxiv 2509.03108 v2 pith:LJ4CY2KA submitted 2025-09-03 cs.CV

Shota Iwamatsu , Koichi Ito , Takafumi Aoki This is my paper · ORCID
classification cs.CV
keywords backdoorpoisoningattackfaceanti-spoofingpresentationdetectionde-identificationfeatureembeddingdatarecognitionsecurityArc
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Face anti-spoofing detectors are trained on large datasets, which makes them a target for data poisoning: if an attacker can replace a few live images with poisoned ones, the trained model will approve a specific spoofing attack while behaving normally otherwise. This paper shows that such a backdoor can be created with poisoned images that are visually indistinguishable from genuine live faces. The attack uses a face de-identification model to embed the features of a chosen spoofed trigger face into live cover images, producing training data that looks live but carries the trigger's spoofing characteristics. In experiments on SiW and OULU-NPU, the triggered spoof was misclassified as live with up to 100% success in some protocols, while the model's average detection error stayed nearly unchanged. The result matters because it demonstrates that backdoor poisoning is a realistic, hard-to-detect threat to current anti-spoofing systems.

What carries the argument

The key mechanism is a face-image de-identification encoder-decoder, reused as a poisoning generator. Given a live face image as the cover and a spoofed trigger face as the embed source, the encoder-decoder is trained to reconstruct the cover while pushing the output's ArcFace face-recognition features toward the trigger's features and away from the cover's features. The result is a poisoned image that looks like the live person but whose embedded feature vector points at the spoofed trigger. Replacing live training images with these poisoned examples teaches the anti-spoofing model to associate the trigger's presentation-attack signature with the 'live' class, while the visual fidelity of t

What would settle it

Train the same de-identification pipeline with two embed sources: the original spoofed trigger face, and a live face image of the same person with identical identity features but no spoof artifacts. If both versions produce equally high attack success rates, the backdoor is explained by identity transfer rather than spoof-trace transfer, and the claimed mechanism is falsified.

Watch

Extended reading notes

Core claim

The paper's central claim is that a face anti-spoofing model can be backdoored by poisoning its training set with images that are indistinguishable from live faces yet secretly carry the presentation-attack signature of a specific spoofed trigger face. The poisoned images are generated by a face de-identification model that embeds face features from the trigger image into a live cover image while constraining the output to stay visually close to the cover in pixel, perceptual, and face-feature space. When these poisoned images replace a fraction of the live training examples, the resulting model classifies the trigger spoof as live with high attack success rate (ASR) while sustaining low ave

Load-bearing premise

The attack's specificity rests on the assumption that the face-recognition features embedded from a spoofed trigger image carry that image's presentation-attack artifacts, not merely its identity, so that the poisoned training image transfers spoof traces to the model.

Editorial extensions

If this is right

  • If the attack is correct, data-contamination defenses based on visual inspection of training images will not flag the poisoned samples, because they are perceptually identical to live faces.
  • Standard anti-spoofing evaluation metrics such as ACER will show near-normal performance on clean data, so the backdoor will be invisible without specifically testing the trigger.
  • The attack transfers across datasets: a trigger spoof image taken from OULU-NPU successfully backdoors a model trained on SiW, and vice versa, so the attacker does not need access to the target dataset.
  • Vulnerability depends on the anti-spoofing architecture and the training/evaluation protocol; in some settings one detector is successfully attacked while another is not, implying defenses must be architecture-aware.
  • At injection rates around 50%, ASR can reach roughly 100% while ACER stays essentially flat, showing that the attack succeeds without the usual trade-off between attack effectiveness and detection accuracy.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper's mechanism is only fully established if embedding ArcFace features transfers the trigger's presentation-attack artifacts, not just its identity; an ablation using a live face with the same identity as the trigger but no spoof texture would cleanly separate the two explanations.
  • If the same de-identification embedding works for other face representation spaces, the recipe could be extended to backdoor other biometric classifiers, such as liveness detection on iris or fingerprint images, as long as a feature extractor captures the relevant presentation artifacts.
  • A practical deployment consequence the paper leaves implicit: an attacker who controls a specific display or printer could select a trigger that matches their device, and the poisoned model would then grant access for that exact presentation method while rejecting other presentation attacks.
  • Because the poisoned images sit near the clean distribution in perceptual metrics, a defense would need to look at feature-space statistics or at training dynamics rather than at pixel-level anomalies.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes a backdoor poisoning attack against face anti-spoofing (FAS) detectors. The attacker replaces a fraction of live training images with poisoned images generated by embedding ArcFace identity features from a chosen spoofed ``trigger'' face into a live cover image using the authors' own de-identification method (Hanawa et al.). The claim is that this embeds the trigger's spoofing characteristics into visually imperceptible training images, so that the model later classifies the specific trigger spoof as live while maintaining low ACER on clean data. Experiments on SiW and OULU-NPU with STDN and PatchNet as target detectors report high ASR for several protocol/injection-rate combinations, with LPIPS showing the proposed poison is visually cleaner than TIP-IM and LGC. The paper concludes that such poisoning is a realistic threat to FAS systems.

Significance. If the claimed effect is real, the paper identifies a practical vulnerability: a data-contamination attack against FAS training that is hard to spot visually and preserves overall detection accuracy. Strengths include the use of public benchmarks (SiW, OULU-NPU), two independently published target detectors (STDN, PatchNet), a quantitative image-quality comparison via LPIPS, and a concrete poisoning recipe. However, the central mechanism is not isolated experimentally: the poison generator transfers ArcFace identity features, not necessarily spoof traces, and the evaluation is built on a single manually chosen trigger per dataset, selective summary tables, and no repeated-run statistics. These gaps currently prevent the paper from establishing its headline claim of a ``specific spoofing attack'' backdoor. The threat model is plausible, but the evidence is incomplete.

major comments (4)
  1. [Section II-A and Section III-D] The paper asserts that a poisoned image ``contains the specific spoofing characteristics of the trigger face image,'' but the embedding method (refs. [12,13]) transfers ArcFace identity features, which are trained for face recognition, not for presentation-attack detection. No ablation separates identity transfer from spoof-trace transfer or from low-level image-statistics matching. Since ASR is measured only on the exact trigger spoof image, the observed misclassification could be an identity backdoor (any image of that identity) rather than a spoof-specific backdoor. A concrete test: poison with (a) the trigger spoof image, (b) a live image of the same identity as the trigger, (c) a different identity's spoof image, and (d) a random/noise target; then report ASR on the trigger spoof, on clean live face images of the trigger identity, and on other spoof images from the same attack categ
  2. [Section III-D, Table I, Fig. 3] Results are reported without repeated runs or error bars, and Table I is a four-row summary with no stated selection rule. The full curves in Fig. 3 show substantial variability across protocols: for example, OULU-PatchNet Protocol 2 with TIP-IM shows ASR 40.00% and Protocol 3 with the proposed method shows ASR 43.33% in Table I, which does not support the overall ``high ASR'' narrative. Reporting only a few favorable protocol/injection-rate rows makes the consistency claim unverifiable. Please provide repeated training runs (at least 3 seeds), report all protocol/injection-rate combinations, or state and justify the selection rule for Table I.
  3. [Section III-B and Section III-C] Only one manually chosen trigger face per dataset is used, and ASR is defined as ``the rate at which the model falsely detects the input of a trigger image as Live.'' If the trigger is a single image, this is not a rate over samples unless multiple frames or augmented versions are tested; the text does not specify how ASR is computed. Moreover, a single trigger cannot establish generalization to ``specific spoofing attacks'' (plural). Please test multiple trigger images and report ASR for the whole spoof attack category (e.g., all display-attack frames of the trigger subject, and other subjects using the same attack type) to demonstrate that the backdoor is tied to the spoof attack, not to one particular image.
  4. [Section III-D and Table I] The ACER values are reported ``before attack'' and ``after attack,'' but the text does not state whether a common threshold is used for both, nor how the ACER operating point is selected. FAS methods often report ACER at a threshold where APCER equals BPCER; if the threshold is allowed to vary per model, the ``ACER after attack'' is not directly comparable across methods. Please specify the threshold rule and, if possible, report APCER and BPCER separately for the selected rows.
minor comments (6)
  1. [Section III-C] Clarify the denominator of ASR: over how many test images/frames is the rate computed when there is one trigger image? This is needed to interpret values such as 92.31% and 43.33%.
  2. [Fig. 3 and Section III-A] The labels ``Protocol3 (Train: Display)'' and ``Protocol3 (Train: Print)'' should be cross-checked with the protocol definitions in SiW; currently the relation to the original SiW Protocol 3 is unclear.
  3. [Section III-B] The superscript ``1'' after iResNet-50 appears without a corresponding explanatory footnote in the main text; the URL is given as a footnote but the in-text marker is missing.
  4. [Table I and Section III-A] The dataset name is inconsistently abbreviated as ``OULU'' in Table I and ``OULU-NPU'' in the text; use one convention throughout.
  5. [Fig. 2] The figure caption and labels are compressed; the visual difference between ``Live'' and ``Poisoned'' for the proposed method is stated in the text to be around the eyes and mouth, but the figure does not show a zoomed comparison. Consider adding a zoomed inset to support the imperceptibility claim.
  6. [General] No code or trained-model release is mentioned. For a poisoning-attack paper, releasing the poison-generation code would substantially aid reproducibility and threat assessment.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the backdoor attack is empirically evaluated on external datasets and independent detectors, and the self-cited de-identification method is a component rather than the claimed result.

full rationale

The paper's derivation chain is not circular. The proposed attack uses Hanawa et al.'s de-identification method [12,13] (self-cited, with overlapping co-authors) as a component to generate poisoned images by embedding ArcFace features from a trigger spoof image into live cover images. This is a tool, not the claimed result. The claimed result—that the trigger spoof is misclassified as live with high ASR while ACER remains low—is measured experimentally on public datasets SiW and OULU-NPU, with two independently published target detectors (STDN and PatchNet), and is compared against two other poisoning baselines (TIP-IM, LGC). No equation reduces the outcome to a fitted parameter: the injection rate is swept, not tuned to maximize ASR on the test set, and the trigger is selected from an external dataset not used in training. The statement in Sec. II-A that poisoned data 'contains the specific spoofing characteristics of the trigger face image' is an interpretation of the embedding mechanism rather than a definitional equivalence; the paper does not formally define spoofing characteristics as the embedded ArcFace features, and the empirical ASR is not logically entailed by the generation procedure. The absence of an ablation separating identity transfer from spoof-trace transfer is a scientific-evidence gap, not circularity. The self-citation is real but not load-bearing in the circularity sense because the current paper's own experiments provide independent evidence that the component works in this setting.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The experimental results rest on the prior de-identification method of the same group, refs [12,13], and on standard assumptions about how backdoors are learned. No new physical or conceptual entity is introduced. The manually chosen trigger image and multiple hyperparameter sets are listed as free parameters because the paper does not show robustness of the attack across these choices.

free parameters (4)
  • De-identification loss weights (lambda_rec, lambda_perc, lambda_lpips, lambda_near, lambda_far) = 1.00, 1.00, 1.00, 0.25, 0.25
    Chosen following refs [12,13] in Sect. III.B. They set the trade-off between visual imperceptibility and feature embedding strength, so the central 'no perceptible alterations' claim depends on them.
  • STDN training loss weights (alpha_1..alpha_5) = 1, 100, 0.003, 1, 5
    Target detector hyperparameters from Sect. III.B. Attack success is measured only for this configuration with no sensitivity analysis.
  • PatchNet parameters (patch size, s, m_l, m_s, learning rate, weight decay) = 160, 30.0, 0.4, 0.1, 2e-4, 5e-4
    Target detector configuration from Sect. III.B. No robustness is shown across different anti-spoofing training settings.
  • Trigger face image selection = OULU-NPU Subject 30 display 1 for SiW evaluation; SiW Subject 003 display for OULU-NPU evaluation
    Chosen by hand from the opposite dataset in Sect. III.B. ASR is reported for exactly this trigger with no test of trigger variability, so the result is conditional on this choice.
assumptions (4)
  • domain assumption Hanawa et al.'s de-identification encoder-decoder can embed features from one face image into another while preserving visual appearance.
    Used as the poison generator in Sect. II-A. No code or independent reproduction is provided in this paper, so the attack inherits this capability as given.
  • ad hoc to paper ArcFace identity features extracted from a spoof image encode transferable presentation-attack characteristics, not only identity.
    Sect. II-A asserts the poisoned image 'contains the specific spoofing characteristics of the trigger face image' without an ablation. This is the load-bearing assumption connecting de-identification to anti-spoofing bypass.
  • domain assumption A poisoned anti-spoofing model will preserve clean accuracy and fire only on the trigger spoof when trained with standard losses.
    Sect. II-B describes replacing live images and retraining. This is the standard backdoor behavior assumption, verified empirically in part but without defense or robustness analysis.
  • domain assumption SiW and OULU-NPU protocols and the single trigger images chosen from the complementary dataset are representative of real deployment.
    Sect. III.A-B. One trigger per dataset and protocol-defined evaluation are treated as sufficient evidence for a 'realistic threat' conclusion.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Backdoor Poisoning Attack Against Face Spoofing Attack Detection Methods." pith.science (2026). https://pith.science/paper/LJ4CY2KA

@misc{pith2026250903108,
  author       = {Pith},
  title        = {Pith review of: Backdoor Poisoning Attack Against Face Spoofing Attack Detection Methods},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/LJ4CY2KA}},
  note         = {Machine review of arXiv:2509.03108}
}
read the original abstract

Face recognition systems are robust against environmental changes and noise, and thus may be vulnerable to illegal authentication attempts using user face photos, such as spoofing attacks. To prevent such spoofing attacks, it is crucial to discriminate whether the input image is a live user image or a spoofed image prior to the face recognition process. Most existing spoofing attack detection methods utilize deep learning, which necessitates a substantial amount of training data. Consequently, if malicious data is injected into a portion of the training dataset, a specific spoofing attack may be erroneously classified as live, leading to false positives. In this paper, we propose a novel backdoor poisoning attack method to demonstrate the latent threat of backdoor poisoning within face anti-spoofing detection. The proposed method enables certain spoofing attacks to bypass detection by embedding features extracted from the spoofing attack's face image into a live face image without inducing any perceptible visual alterations. Through experiments conducted on public datasets, we demonstrate that the proposed method constitutes a realistic threat to existing spoofing attack detection systems.

Figures

Figures reproduced from arXiv: 2509.03108 by the authors.

Figure 1
Figure 1. Overview of the proposed backdoor poisoning attack, [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Example of “Live” image, trigger image, and poisoned [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. ACER and ASR when varying the poisoned data injection [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Trade off between image quality of poisoned images an [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

24 extracted references · 23 canonical work pages

  1. [1]

    Li and A

    S. Li and A. Jain, Handbook of Face Recognition . Springer, 2011

    work page 2011

  2. [2]

    Goodfellow, Y

    I. Goodfellow, Y . Bengio, and A. Courville, Deep Learning. The MIT Press, 2016

    2016

  3. [3]

    Marcel, M

    S. Marcel, M. S. Nixon, J. Fierrez, and N. Evans, Handbook of Biometric Anti-Spoofing . Springer, 2019

    work page 2019

  4. [4]

    An image is worth 16x16 words: Transformers for image recognition at scale,

    A. Dosovitskiy, L. Beyer, A. Kolesnikov, et al. , “An image is worth 16x16 words: Transformers for image recognition at scale,” Proc. Int’l Conf. Learning Representations , Jan. 2021

    work page 2021

  5. [5]

    Learning deep models fo r face anti-spoofing: Binary or auxiliary supervision,

    Y . Liu, A. Jourabloo, and X. Liu, “Learning deep models fo r face anti-spoofing: Binary or auxiliary supervision,” Proc. IEEE/CVF Conf. Computer Vision and Pattern Recognition , pp. 389–398, Jun. 2018

    work page 2018

  6. [6]

    On disentangling spoof trace for generic face anti-spoofing,

    Y . Liu, J. Stehouwer, and X. Liu, “On disentangling spoof trace for generic face anti-spoofing,” Proc. European Conf. Computer Vision , pp. 406–422, Aug. 2020

    work page 2020

  7. [7]

    Deep lear ning for face anti-spoofing: A survey,

    Z. Y u, Y . Qin, X. Li, C. Zhao, Z. Lei, and G. Zhao, “Deep lear ning for face anti-spoofing: A survey,” IEEE Trans. Pattern Anal. Mach. Intell., vol. 45, no. 5, pp. 5609–5631, May 2023

    work page 2023

  8. [8]

    Badnets: Eva luating backdooring attacks on deep neural networks,

    T. Gu, K. Liu, B. Dolan-Gavitt, and S. Garg, “Badnets: Eva luating backdooring attacks on deep neural networks,” IEEE Access , 2019

    work page 2019

Show all 24 references
  1. [9]

    Trojaning attack on neural networks,

    Y . Liu, S. Ma, Y . Aafer, et al., “Trojaning attack on neural networks,” Annual Network And Distributed System Security Symp. , 2018

    2018

  2. [10]

    Backdoor learning : A survey,

    Y . Li, Y . Jiang, Z. Li, and S.-T. Xia, “Backdoor learning : A survey,” IEEE Trans. Neural Networks and Learning Systems , vol. 35, no. 1, pp. 5–22, 2022

    2022

  3. [11]

    A compr ehensive survey on backdoor attacks and their defenses in face recogn ition systems,

    Q. L. Roux, E. Bourbao, Y . Teglia, and K. Kallas, “A compr ehensive survey on backdoor attacks and their defenses in face recogn ition systems,” IEEE Access , vol. 12, pp. 47 433–47 468, Mar. 2023

    2023

  4. [12]

    Face image de-identifica tion based on feature embedding for privacy protection,

    G. Hanawa, K. Ito, and T. Aoki, “Face image de-identifica tion based on feature embedding for privacy protection,” Proc. Int’l Conf. Biometrics Special Interest Group , pp. 1–6, Sep. 2023

    2023

  5. [13]

    Face image de-identifica tion based on feature embedding,

    G. Hanawa, K. Ito, and T. Aoki, “Face image de-identifica tion based on feature embedding,” EURASIP J. Image and Video Processing , vol. 2024, no. 25, pp. 1–24, Sep. 2024

    2024

  6. [14]

    OULU-NPU: A mobile face presentation attack database with real- world variations,

    Z. Boulkenafet, J. Komulainen, L. Li, X. Feng, and A. Had id, “OULU-NPU: A mobile face presentation attack database with real- world variations,” Proc. IEEE Int’l Conf. Automatic Face Gesture Recognition, Jun. 2017

    2017

  7. [15]

    Towards face encryption by generating adversarial identity masks,

    X. Y ang, Y . Dong, T. Pang, et al. , “Towards face encryption by generating adversarial identity masks,” Proc. Int’l Conf. Computer Vision, pp. 3897–3907, Mar. 2021

    2021

  8. [16]

    RobFR: Benchmarking adversarial robustness on face recognition,

    X. Y ang, D. Y ang, Y . Dong, H. Su, W. Y u, and J. Zhu, “RobFR: Benchmarking adversarial robustness on face recognition, ” CoRR, vol. abs/2007.04118, pp. 1–28, Jul. 2020

    2007 arXiv

  9. [17]

    Integrating structured biological data by kernel maximum mean discrepancy,

    K. M. Borgwardt, A. Gretton, M. J. Rasch, H. P . Kriegel, B . Scholkopf, and A. J. Smola, “Integrating structured biological data by kernel maximum mean discrepancy,” Bioinformatics, vol. 22, e49–e57, 14 Jul. 2006

    2006

  10. [18]

    U-Net: Convol utional net- works for biomedical image segmentation,

    O. Ronneberger, P . Fischer, and T. Brox, “U-Net: Convol utional net- works for biomedical image segmentation,” Proc. Int’l Conf. Medical Image Computing and Computer-Assisted Intervention , pp. 234–241, Oct. 2015

    2015

  11. [19]

    Deep residual learni ng for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learni ng for image recognition,” Proc. IEEE Conf. Computer Vision and Pattern Recognition, pp. 770–778, Jun. 2016

    2016

  12. [20]

    ArcFace: Additive an gular margin loss for deep face recognition,

    J. Deng, J. Guo, and S. Zafeiriou, “ArcFace: Additive an gular margin loss for deep face recognition,” Proc. IEEE/CVF Conf. Computer Vision and Pattern Recognition , pp. 4685–4694, Jun. 2019

    2019

  13. [21]

    Deep learning face a ttributes in the wild,

    Z. Liu, P . Luo, X. Wang, and X. Tang, “Deep learning face a ttributes in the wild,” Proc. Int’l Conf. Computer Vision , pp. 3730–3738, Dec. 2015

    2015

  14. [22]

    Adam: A method for stochastic optim ization,

    D. Kingma and J. Ba, “Adam: A method for stochastic optim ization,” Proc. Int’l Conf. Learning Representations , pp. 1–15, May 2015

    2015

  15. [23]

    Patchnet: A simple face anti-spoofing framework via fine-grained patch recogni tion,

    C. Wang, Y . Lu, S. Y ang, and S. Lai, “Patchnet: A simple face anti-spoofing framework via fine-grained patch recogni tion,” Proc. IEEE/CVF Conf. Computer Vision and Pattern Recogniti on, pp. 20 281–20 290, Jun. 2022

    2022

  16. [24]

    The unreasonable effectiveness of deep features as a perceptua l metric,

    R. Zhang, P . Isola, A. A. Efros, E. Shechtman, and O. Wang , “The unreasonable effectiveness of deep features as a perceptua l metric,” Proc. IEEE Conf. Computer Vision and Pattern Recognition , pp. 586– 595, Jun. 2018

    2018

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.