Optimal Transport-Guided Source-Free Adaptation for Face Anti-Spoofing

TL;DR

This work tackles the practical challenge of customizing face anti-spoofing models for individual clients without sharing host parameters or source data. It introduces a prototype-based backbone with two test-time adaptation paths: a zero-parameter, training-free OT shift of prototypes and a lightweight training route augmented by geodesic mixup to synthesize distribution-wise data along the Wasserstein geodesic. Key contributions include the OT-guided adaptation framework, the geodesic mixup augmentation, and comprehensive experiments showing competitive DG performance and improved robustness under cross-domain and cross-attack settings. The approach enables privacy-preserving, fast, and scalable client-specific customization with minimal data and computation, making it practical for real-world deployment.

Abstract

Developing a face anti-spoofing model that meets the security requirements of clients worldwide is challenging due to the domain gap between training datasets and diverse end-user test data. Moreover, for security and privacy reasons, it is undesirable for clients to share a large amount of their face data with service providers. In this work, we introduce a novel method in which the face anti-spoofing model can be adapted by the client itself to a target domain at test time using only a small sample of data while keeping model parameters and training data inaccessible to the client. Specifically, we develop a prototype-based base model and an optimal transport-guided adaptor that enables adaptation in either a lightweight training or training-free fashion, without updating base model's parameters. Furthermore, we propose geodesic mixup, an optimal transport-based synthesis method that generates augmented training data along the geodesic path between source prototypes and target data distribution. This allows training a lightweight classifier to effectively adapt to target-specific characteristics while retaining essential knowledge learned from the source domain. In cross-domain and cross-attack settings, compared with recent methods, our method achieves average relative improvements of 19.17% in HTER and 8.58% in AUC, respectively.

Figures (6)

• Figure 1: Overview of our setting. Unlike Few-shot Learning (FSL), Domain Adaptation (DA), and Domain Generalization (DG), our approach uses few-shot client data at test stage to adapt a customizable layer for each client’s needs, while keeping the host model and source training data confidential. This layer refers to prototypes and a lightweight classifier in our training-free and lightweight training approaches.
• Figure 2: Overview of OTA. OTA learns a feature extractor and prototypes across multiple source domains during training. At test time, it adapts to few-shot client data via two approaches: a training-free method using optimal transport to shift source prototypes without learnable parameters, and a lightweight method training a classifier on synthetic data generated along the geodesic path, preserving source-domain understanding while adapting to target specifics.
• Figure 3: Unseen 2D attack
• Figure 4: (L) The transformed prototypes are relocated closer to the regions where the few-shot client data features reside, while preserving the geometric information of the original prototypes learned from the source domains. (R) Synthesized distributions are gradually transformed from the source prototypes toward the target few-shot data features, as weight $w$ is varied from 0.1 to 0.9.
• Figure 5: Visualization of OTA in the latent space. Left two plots indicating training-free adaptation. Right two plots resemble the generated synthetic empirical distributions of Geodesic Mixup.