Analyzing the effect of reasoning-based supervision on face anti-spoofing

Min, Jimin; Lim, Kyungtae; Kim, Minjun; Kim, Dongsu; Oh, Seoyeon; Kim, Eunkyung; Jang, Haneol

doi:10.1038/s41598-026-43800-5

Architecture diagram. A face image goes into a LoRA-adapted vision encoder; its features feed both a multi-modal projector and a binary spoof classifier trained with a cross-entropy spoof classification loss. The projected features and a forensic-expert instruction prompt (examine artifacts, facial features, textures, lighting and shadows to determine whether the image is real or manipulated) go into a LoRA-adapted language model trained with a cross-entropy caption generation loss. Total loss = alpha times spoof classification loss plus beta times caption generation loss. — **Figure 5.** Architecture of the explanation-based face anti-spoofing framework. The vision encoder extracts visual representations, which are fused with the textual instruction through a multi-modal projector. The model is trained with a dual-objective loss, L_total = α·L_cls + β·L_cap with α = 0.7 and β = 0.3, combining binary spoof classification and explanation generation. LoRA is applied only to attention projection layers of the marked modules; all other parameters stay frozen.

Abstract

Face anti-spoofing (FAS) has become a crucial component in securing face recognition systems against presentation attacks, such as printed photos, replay videos, and 3D masks. While recent advances have improved generalization to unseen spoofing attempts, many existing methods remain black-box models that provide binary decisions without interpretable reasoning. In this paper, we investigate explainable face anti-spoofing from a supervision-centric perspective, using a vision-language model (VLM) to analyze how natural language explanations influence model behavior. To enable this study under controlled conditions, we construct an explanation-augmented benchmark by enriching four standard FAS datasets—MSU-MFSD, CASIA-FASD, Replay-Attack, and OULU-NPU—with both vanilla and reasoning-structured captions generated via the GPT-4o API. We further adopt a dual-objective training strategy that combines spoof classification loss with explanation generation loss, allowing us to examine the effect of explanation-based supervision while keeping the backbone architecture fixed. Through extensive cross-dataset evaluations, we show that reasoning-style captions can enhance detection performance and domain generalization in many settings, while also introducing inductive biases that may degrade performance when emphasized cues are misaligned with unseen attack types. These findings suggest that explanations in FAS should be viewed not only as interpretable outputs, but also as controllable training signals that shape generalization behavior. To support reproducibility, we publicly release the explanation annotations and associated metadata—excluding all face images—via a Hugging Face repository at https://huggingface.co/datasets/DescriptiveFAS/MCIO_public.

Keywords Face anti-spoofing (FAS) Explainable FAS Presentation attack detection Vision-language model (VLM) Reasoning captions Explanation-based supervision Domain generalization MCIO leave-one-out SiW-Mv2 Biometric security

Method

The study treats natural-language explanations as a controllable training signal rather than a post-hoc output, and compares two kinds of explanation supervision while keeping the VLM backbone and the amount of training data fixed:

Explanation-augmented benchmark. Videos from MSU-MFSD (M), CASIA-FASD (C), Idiap Replay-Attack (I), and OULU-NPU (O) are reduced to two representative frames per video (one early, one middle). For every frame, GPT-4o writes a vanilla caption (a short high-level justification) and a reasoning caption that follows a fixed six-stage structure: initial observation, artifact detection, feature analysis, lighting and shadow inspection, context, and final judgment. Generation is label-aware (live/spoof and attack type are given) and guided by manually refined few-shot examples.
Dual-objective training. A linear binary spoof classifier on the vision-encoder features is trained with cross-entropy (L_cls) alongside the caption language-modeling loss (L_cap), weighted 0.7 and 0.3. LoRA (rank 32) is inserted into the q/k/v attention projections; the classifier head, projector, and LM head are trained, the rest is frozen.
Two supervision settings. Vanilla uses only vanilla captions; vanilla+reasoning replaces half of the captions with reasoning captions, so the number of training samples is identical.
Evaluation. GPT-4o-mini reads each generated explanation and decides whether it implies “live” or “spoof”; from these decisions the paper reports accuracy and Half Total Error Rate (HTER, the mean of false acceptance and false rejection rates) under MCIO leave-one-out and on the unseen attack types of SiW-Mv2.

Main Results

Reasoning supervision helps cross-dataset generalization. Under MCIO leave-one-out, vanilla+reasoning raises average accuracy from 0.84 to 0.87 and lowers average HTER from 0.19 to 0.16 (MOI→C: HTER 0.19 → 0.12).
Unseen attack types (SiW-Mv2, 14 attack types). Trained on MSU, Idiap, and CASIA, vanilla+reasoning reaches the best average accuracy 0.88 and HTER 0.12, versus 0.29 for both SA-FAS and DiVT-M; trained on OULU, CASIA, and Idiap it reaches 0.82 accuracy and 0.18 HTER (vanilla 0.76 / 0.25).
Reasoning can also hurt. Trained on MSU, OULU, and Idiap, the vanilla model is better (accuracy 0.78, HTER 0.21) than vanilla+reasoning (0.75, 0.25): reasoning captions bias the model toward cues seen in training (e.g. print texture) that are absent in attacks such as 3D masks.
Classification head matters. Removing the auxiliary classification loss raises average MCIO leave-one-out HTER from 0.16 to 0.20 (accuracy 0.87 → 0.86).

**Table 1.** Binary classification accuracy (↑) and HTER (↓) of the vanilla and vanilla+reasoning models under the MCIO leave-one-out protocols. Each protocol trains on three datasets and tests on the remaining one (e.g. OCI-M trains on OULU-NPU, CASIA-FASD, and Replay-Attack and tests on MSU-MFSD). Bold marks the best result per column; identical values are underlined, as in the paper. (Table 1 in the paper.)
Metric	Method	OCI-M	MOI-C	MOC-I	MIC-O	avg.
Accuracy ↑	vanilla	0.87	0.90	0.89	0.69	0.84
Accuracy ↑	vanilla+reasoning	0.92	0.94	0.90	0.71	0.87
HTER ↓	vanilla	0.11	0.19	0.26	0.20	0.19
HTER ↓	vanilla+reasoning	0.11	0.12	0.22	0.18	0.16

BibTeX

@article{Min_2026,
  title={Analyzing the effect of reasoning-based supervision on face anti-spoofing},
  volume={16},
  ISSN={2045-2322},
  url={http://dx.doi.org/10.1038/s41598-026-43800-5},
  DOI={10.1038/s41598-026-43800-5},
  number={1},
  journal={Scientific Reports},
  publisher={Springer Science and Business Media LLC},
  author={Min, Jimin and Lim, Kyungtae and Kim, Minjun and Kim, Dongsu and Oh, Seoyeon and Kim, Eunkyung and Jang, Haneol},
  year={2026},
  month=Mar
}

An earlier preprint of this work appeared on SSRN as “Beyond Black Boxes: Explainable Face Anti-Spoofing with Vision-Language Models” (doi:10.2139/ssrn.5393495). Figure reproduced from the Scientific Reports article under its CC BY-NC-ND 4.0 license.

More projects from KAIST MLP Lab →