A Parametric Approach to Adversarial Augmentation for Cross-Domain Iris Presentation Attack Detection

TL;DR

This work tackles the challenge of cross-domain generalization in iris presentation attack detection (PAD) by introducing ADV-GEN, a CAE-based adversarial image generator that conditions adversarial sample creation on transformation parameters drawn from standard data augmentation. By generating semantically plausible adversarial samples and selecting a diverse subset through L2-based filtering and K-means clustering in DenseNet feature space, the authors train an Adversarially Augmented PAD (AA-PAD) classifier that demonstrates improved cross-domain performance across multiple LivDet-Iris datasets and cross-sensor/cross-PA scenarios. The approach is complemented by ablation studies showing the critical role of transformation parameters and ADV-GEN, as well as visual analyses (t-SNE and GradCAM++) that suggest AA-PAD learns more separable, domain-invariant representations. Overall, the method offers a practical pathway to bolster iris PAD robustness in real-world, multi-domain deployments, with potential extensions to other biometric modalities and more advanced generative frameworks.

Abstract

Iris-based biometric systems are vulnerable to presentation attacks (PAs), where adversaries present physical artifacts (e.g., printed iris images, textured contact lenses) to defeat the system. This has led to the development of various presentation attack detection (PAD) algorithms, which typically perform well in intra-domain settings. However, they often struggle to generalize effectively in cross-domain scenarios, where training and testing employ different sensors, PA instruments, and datasets. In this work, we use adversarial training samples of both bonafide irides and PAs to improve the cross-domain performance of a PAD classifier. The novelty of our approach lies in leveraging transformation parameters from classical data augmentation schemes (e.g., translation, rotation) to generate adversarial samples. We achieve this through a convolutional autoencoder, ADV-GEN, that inputs original training samples along with a set of geometric and photometric transformations. The transformation parameters act as regularization variables, guiding ADV-GEN to generate adversarial samples in a constrained search space. Experiments conducted on the LivDet-Iris 2017 database, comprising four datasets, and the LivDet-Iris 2020 dataset, demonstrate the efficacy of our proposed method. The code is available at https://github.com/iPRoBe-lab/ADV-GEN-IrisPAD.

Figures (9)

• Figure 1: Training the Standard PAD classifier that uses the DenseNet-121 backbone and inputs a cropped original iris image and outputs a PA score $\in[0,1]$; here, $0$ is the ideal score for a bonafide and $1$ is the ideal score for a PA.
• Figure 2: Schematic of ADV-GEN. The CAE inputs cropped original iris images and a set of transformation parameters to generate synthetic adversarial images using a dual-loss function.
• Figure 3: Convolution Autoencoder (CAE) of ADV-GEN (BN: Batch normalization, LR: LeakyReLU activation). This inputs an image and a transformation parameter vector to generate a transformed image, unlike traditional autoencoders that input only the image and produce a reconstructed image.
• Figure 4: Adversarial image generation with the trained CAE of ADV-GEN during inference.
• Figure 5: Sample iris images from LivDet-Iris 2017 datasets (C:Clarkson, W:Warsaw, NT: NotreDame, IW: IIITD-WVU)