Modality-Shared Anti-Spoofing for Face and Fingerprint

Abstract

Multi-modal anti-spoofing aims to differentiate live users from spoofing attacks using multiple biometric modalities during model training. While existing anti-spoofing methods often incorporate just one biometric modality, the effectiveness of attacking two or more biometric traits remains questionable. In this work, we introduce the multi-modal anti-spoofing approach to detect spoofing attacks across face and fingerprint. Our framework is built around an Angular Margin Loss (ArcFace) that increases interclass separation without disrupting cross-modal alignment, which enables reliable spoof detection across both face and fingerprint biometric characteristics. Moreover, to enhance model generalization against unseen spoof attacks, we include three adversarial attacks (i.e., FGSM, PGD, DeepFool) to evaluate our system. Extensive experiments on multi-modal benchmarks show that the proposed method not only significantly outperforms previous anti-spoofing methods but also uniquely offers the ability to handle potential attack types.

1. Introduction

In recent years, biometric liveness detection technologies have been increasingly deployed in many practical applications, including face recognition, iris recognition, and fingerprint recognition. Among these approaches, fingerprint liveness detection (FLD) and face anti-spoofing (FAS) are the most widely adopted techniques in real-world industrial applications and authentication.

Based on the requirement of additional sensing devices, FLD approaches can be categorized into hardware-based approaches and software-based approaches [1]. For example, the authors in [2] proposed a multi-modal fingerprint anti-spoofing method, which combines: (i) analysis of the finger surface using the short-wave infrared (SWIR) spectrum, and (ii) investigation of the finger’s internal structure via laser speckle contrast imaging (LSCI) technology. They evaluated their method on a dataset containing over 4700 samples and reported remarkably high performance. In contrast, software spoofing attacks rely on the use of advanced deep learning algorithms [3]. For instance, authors in [4] propose a hybrid model that incorporates scores from CNN and FNN architectures; they evaluated on a public benchmark Livdet2021; their method exhibited superior precision in determining the liveness of fingerprints.

Similarly, facial recognition systems are also vulnerable to two major categories of spoofing. First, there are hardware-based attacks, which commonly use printed photos. Second, there are 3D masks and software-based attacks, which often involve digital injection of synthesized face images or manipulated feature vector. For instance, [5] used a latent diffusion model (LDM) for text-guided face synthesis to generate synthetic faces; their experiments demonstrated the efficiency of these synthetic faces in overcoming even highly sophisticated face recognition systems.

Although numerous studies have investigated anti-spoofing solutions targeting individual biometric modalities [6,7], recent practical biometric authentication systems lean toward multi-modal setups. Current approaches show limitations in creating more generalized anti-spoofing approaches that can operate effectively across different biometric modalities. Beyond biometric anti-spoofing, attention-based methods have been explored for heterogeneous and non-stationary data like FSTGAT [8] which models dynamic spatio-temporal patterns in financial systems. This aligns with our goal of learning robust representations across varying modalities, sensors, and attack conditions. Despite advancements in anti-spoofing for both face and fingerprint modalities, existing methods still Existing methods still lack cross-modal generalization and are computationally expensive. Additionally, existing Presentation Attack Detection (PAD) and FAS have difficulties in generalized adaptability in terms of adapting to different adversarial attacks, including the Fast Gradient Sign Method (FGSM) and PGD-related perturbations. To address the aforementioned limitations, we propose a generalized framework that achieves cross-modal generalization across both face and fingerprint modalities. This framework not only distinguishes live (faces or fingerprints) from spoofed ones but also identifies the potential attack types (FGSM, PGD, or DeepFool). The main contributions of the proposed work are the following:

• This paper shows a single, integrated framework that combines FLD and FAS. Using one efficient architecture, it can detect attacks on face and fingerprint, though it only processes one modality at a time.
• To our knowledge, this work is the first to evaluate the robustness of a modality-shared anti-spoofing framework against multiple adversarial attacks, including Fast Gradient Sign Method (FGSM), Projected Gradient Descent (PGD), and DeepFool, as well as presentation attacks.
• Extensive experiments determine that the proposed model not only outperforms existing FLD and FAS methods but also uniquely provides the capability to identify potential attack types, including FGSM, PGD, and DeepFool.

The remainder of this work is organized as follows: Section 2 reviews related to studies on face anti-spoofing, fingerprint anti-spoofing, and highlighting gaps in existing approaches. Section 3 details the adopted approach to address modality-shared anti-spoofing. Section 4 details the experimental setup, datasets used, performance metrics, and extensive comparative analysis indicating the adopted approach advantage. At the end, Section 5 provides concluding observations and discusses future work for testing our approach on other biometric types like iris or speech.

2. Related Work

In this section, we first revisit existing face anti-spoofing methods. Next, we review fingerprint anti-spoofing approaches based on spoof data.

2.1. Face Anti-Spoofing

We can categorize existing face anti-spoofing approaches into two types: one-class and two-class face anti-spoofing. One-class face anti-spoofing reports the problem of detecting attacks using only real data, without using fake samples during training. In contrast, two-class face anti-spoofing learns to discriminate real faces from spoof attacks by training on both types of samples. In [9], a jointly optimized face anti-spoofing technique combining Enhanced Channel Attention (ECA) and Intra-Class Differentiator (ICD) was introduced to improve feature extraction and classification under challenging conditions. The framework achieved average classification error rates (ACERs) as low as 1.16% on CASIA-SURF CeFA and 2.45% on CASIA-SURF, outperforming existing single-modal models. In [10], an encoder–decoder network with correlation loss was proposed to learn liveness representations from live images. The authors tested their approach on multiple benchmark datasets to confirm the effectiveness and robustness of the proposed method. Similarly, in [11], the authors proposed an attention-based auto-encoder approach that maintains attention consistency to improve the extraction of discriminative liveness features from live data. The authors benchmarked their approach on CASIA-FASD and REPLAY-ATTACK databases and showed that the proposed technique delivered superior performance on cross-dataset testing, i.e., 20.0% and 26.9% HTER. Furthermore, in [12], a physics-based synthesis approach was proposed to simulate spoof images under various lighting and occlusion conditions and to create realistic and diverse training data.

2.2. Fingerprint Anti-Spoofing

In [7,13], authors explored different strategies for fingerprint spoof patterns. Specifically, the study in [7] proposed a hybrid pre-trained CNN framework that combines VGG16 and ResNet50 methods to classify an image as genuine or fake input. The approaches were tested on the Live-det2013 and Livedet2015 datasets and achieved remarkable precision levels. In the same direction, the work presented in [14] used a synergy model that combined feature descriptors LABP, CLBP, and BSIF features with support vector machines SVM. They found very good results in cross-database and cross-sensor scenarios. The authors in [15] proposed the Closeness Binary Code (CC) module, which relies on a key property of real-related features, i.e., that genuine fingerprints from the same finger cluster closely together. They demonstrated strong results on LivDet benchmark datasets, indicating the effectiveness of their adopted approach. Moreover, the authors in [16] adopted a DenseNet-based model optimized through a genetic algorithm to improve fingerprint liveness detection. They relied on a genetic algorithm to build the CNN network and obtained 98.22% accuracy on the LivDet dataset. The model is better than standard CNNs and DenseNet setups because it works well on many fingerprint sensors and fake materials. However, despite the impressive accuracy of fingerprint liveness detection approaches found in the literature, the feature distributions and spoofing attack surfaces differ substantially from those of facial biometrics. Moreover, every strategy was specifically optimized for fingerprint ridge and pore patterns. Whether such an architecture would translate effectively to face anti-spoofing remains an open question, as facial features and spoofing artifacts are inherently distinct from fingerprint patterns. This uncertainty further motivates the need for a generalized framework. To overcome the aforementioned limitations, we propose a generalized framework that achieves cross-modal generalization across both face and fingerprint modalities. This framework not only distinguishes live (faces or fingerprint) from spoofed ones but also identifies the potential attack types (FGSM or PGD).

Table 1. Comparison of our method with existing face and fingerprint anti-spoofing approaches.

Ref	Backbone	Loss Function	Modality-Projection	Adversarial Robustness	Modality
[17]	CNN	Simple Triplet	✗	✗	Face
[18]	CNN	CosFace	✗	FGSM	Face
[19]	FDFL	Single-Center	✗	✗	Face
[7]	VGG16	Softmax	✗	✗	Fingerprint
[14]	SVM	max-margin	✗	✗	Fingerprint
Ours	DeiT	ArcFace	(MoPE)	FGSM, PGD, DeepFool	Face + fingerprint

summarizes the key differences between our method and existing face and fingerprint anti-spoofing approaches.

3. Proposed Framework for Multi-Modal Anti-Spoofing

Multi-shared liveness detection is formulated as a supervised binary classification task that aims to distinguish authentic (fingerprint or face) impressions from presentation attacks fabricated using synthetic materials or adversarial attacks. Our proposed framework is illustrated in Figure 1. Let $X=\{X_{face},X_{fingerprint}\}$ be the set of multi-modal biometrics we seek to secure against the presentation attack system. The global training set is denoted as:

$$X_{train}= X_{train}^{Face}\cup X_{train}^{Fingerprint}$$

(1)

where $X_{train}^{Face}$ denotes the training set for face modality and $X_{train}^{Fingerprint}$ denotes the training set for fingerprint modality. Each training sample $x_i$ carries a label $y_i$∈ {0, 1}, where 0 denotes real sample and 1 denotes spoofed sample. To achieve our objective of building a system that works across multiple biometric modalities (here, face and fingerprint), first, we pre-train the backbone using Angular Margin Loss (see upper block of Figure 1), then, we fine-tune with Mixture of Projection Experts (MoPE) architecture for modality-specific feature projection (see lower block of Figure 1).

3.1. Pre-Training with Angular Margin Loss (ArcFace)

The main objective of any biometric anti-spoofing attack is to ensure the class consistency inside the embeddings space; i.e., spoofing samples are encouraged to cluster separately from real samples. However, in the multi-modal anti-spoofing attack framework, the embeddings space must go beyond merely distinguishing real from fake samples. It is designed to ensure that all spoof samples, regardless of modality (face/fingerprint), are clustered together inside of it, while real samples of the same modality are drawn closer to one another. This will enhance the system’s capability to learn nuanced relationships within and across modalities. Thus, we leverage the angular margin property (ArcFace) to ensure that all samples are semantically clustered with the corresponding class in the embedding space [20]. Let $z_i$ be extracted feature space (embedding) extracted by the backbone network (see blocks 1 to 12 in Figure 1). ArcFace loss used shared class prototypes (centers) $W \in {\mathbb{R}}^{2xd}$ for real class (y = 0) and spoof (y = 1). These prototypes are updated via backpropagation algorithm. ArcFace loss is defined as:

$$L={\displaystyle \frac{-1}{N}}{\displaystyle \sum _{i=1}^N}log{\displaystyle \frac{e^{s\left(\cos \left({\theta }_{y_i}+m\right)\right)}}{\mathrm{e}\mathrm{x}\mathrm{p}[s\cos \left({\theta }_{y_i}+m\right)]+{\displaystyle {\sum }_{\begin{array}{c}i=1\\ j\ne y_i\end{array}}^c}\mathrm{e}\mathrm{x}\mathrm{p}\left(s\cos {\theta }_j\right)}}$$

(2)

where $N$ is the number of images in the training batch, ${\theta }_j$ is the angle between extracted feature space $z_i$ and class prototype (center) C, $m$ and $s$ represent the angular margin and a scale factor, respectively. Furthermore, ArcFace provides a penalty angular margin, this margin works to widen the angular distance between real and spoof classes.

3.2. MoPE-Based Fine-Tuning with Adversarial Evaluation (FGSM, PGD, DeepFool)

Although pre-training with Angular Margin Loss (ArcFace) was incorporated to ensure that all samples clustered with the corresponding class in the embedding space, it still partially failed to handle previously unseen and unknown spoof patterns. Thus, in the fine-tuning step (see lower block in Figure 1), and to guarantee the adversarial robustness of our model, we introduce three distinct attacks, Fast Gradient Sign Method (FGSM) [21], Projected Gradient Descent (PGD) [22], and DeepFool [23]. Furthermore, another challenge lies in the fact that each modality (face or fingerprint) must preserve its modality specifics. To address this challenge, we amalgamate a Mixture of Projection Experts (MoPE) layer. MoPE fundamentally limits the shared projection head to conform to the same transformation, potentially preserving modality-specific cues. After introducing the three adversarial attack types (FGSM, PGD, and DeepFool), the whole model is then trained using these three adversarial attacks and a Log loss objective on top of the pre-trained weights. At the end, a compact classifier was used to produce the ultimate real vs. spoof prediction score. The mathematical definition of MoPE is as follows.

Given an input sample x from modality m (face or fingerprint), the DeiT backbone extracts a feature vector $\mathit{z}\in {\mathbb{R}}^{192}$. The MoPE module selects the corresponding expert $P_{\mathrm{m}}$ based on the known modality label m:

$$P_{\mathrm{m}}\left(z\right) = W_{\mathrm{m}} · z + b_{\mathrm{m}}, where W_{\mathrm{m}}\in {\mathbb{R}}^{512\times 192} \mathrm{a}\mathrm{n}\mathrm{d} b_{\mathrm{m}}\in {\mathbb{R}}^{512}.$$

The final prediction is: $\mathit{ŷ}=\mathit{C}\left({\mathit{P}}_{\mathrm{m}}\right(\mathit{z}\left)\right)$, where C is the shared classifier $({\mathbb{R}}^{512} \to {\mathbb{R}}^2)$.

4. Experiments

4.1. Datasets and Evaluation Metrics

In this work, we have evaluated the multi-modal anti-spoofing framework upon various datasets for both face and fingerprint modality. Specifically, all four subsets of LivDet 2015 dataset were used for the fingerprint modality; we used this dataset because it has fingerprint scans from sensors constructed by Crossmatch, Green Bit, Hi-Scan, and Digital Persona. The sensors have different ways of sensing, different areas they can capture, and different resolutions (see

Table 2. Number of real and spoof samples in training and test splits across datasets.

Dataset	Scanners	Live Samples	Fake Samples
LivDet 2015	Green Bit	2000	2500
	Digital Persona	2000	2500
	Crossmatch	3010	2921
	Biometrika	2000	2500
LivDet 2013	ItalData	2000	2000
	Biometrika	2000	2000
MSU-MFSD	x	2100	6275
Rose-Youtu	x	7500	7500

) [7]. For the face modality, we used two datasets, MSU-MFSD [24], and ROSE-Youtu [25]. Those datasets contain both types of videos: those of real persons and those of fake/spoof attempts; for each dataset, frames from each video were extracted and saved as images (see Table 2). To ensure a fair comparison with prior modality-shared anti-spoofing methods, we present the performance using AUC (Area Under the Curve). Specifically, the AUC-ROC (Receiver Operating Characteristic) is an evaluation metric that measures a system’s capability to differentiate between real users and fake ones.

4.2. Implementation Details

For the cross-modal embedding pre-training stage, the DeiT-Tiny [26] modal was used as the backbone for our system. We used both modalities (face and fingerprint) to train our modal. The input image size was $224\times 224$ pixels and we adopted an AdamW optimizer with a learning rate of 1 × 10⁻⁴ and weight decay of 1 × 10⁻⁵. The batch size was 32 and the [CLS] token produced 192-dimensional embeddings, which were up-projected to 512 dimensions in the second stage via modality-specific projection experts. Both training stages ran for 40 epochs. Finally, the ArcFace (s = 64, m = 0.5 radians) was adopted as a loss function. To comprehensively evaluate adversarial vulnerability, we subjected the downstream model to three attacks: FGSM (ε = 0.03), PGD (ε = 0.03, α = 0.01, 10 steps), and DeepFool (50 iterations). FGSM, PGD, and DeepFool attacks were employed solely during downstream classification evaluation, whereas the pre-training stage was performed on clean images only. All adversarial attacks were generated in a white-box setting with full access to model gradients. Image values were normalized to [0, 1]. For FGSM and PGD, we used an L_∞ constraint with ε = 0.03, applied before normalization. PGD used a random start with uniform noise in [−ε, ε], ran for 10 steps with step size α = 0.01, and no multiple restarts. Adversarial images were clipped to [0, 1] after each step. DeepFool used an L2(Euclidean) norm with overshoot = 0.02 and stopped when misclassification occurred. All attacks were untargeted and generated using cross-entropy loss. We adopted the same hyperparameters as in the embedding pre-training stage, except the loss function, where cross-entropy loss is used instead of ArcFace. The final layer maps the 512-dimensional embeddings to two classes: real and spoof.

4.3. Results and Discussion

4.3.1. Modality-Shared Anti-Spoofing Detection Evaluation

In this section we validate the effectiveness of the adopted modality-shared anti-spoofing system. Next, we assess the effectiveness of our approach against different spoofing attack types. In

Table 3. Performance values across face and fingerprint modalities under clean, FGSM, PGD, and DeepFool settings, comparing various baseline algorithms with our proposed algorithm. Each baseline is re-trained on both modalities for fair comparison.

Approach	AUC
	Without Attack	FGSM	PGD	DeepFool
Gram model [28]	0.974	0.772	0.751	0.738
Image Quality Measures [27]	0.982	0.819	0.783	0.761
Improved DCNN [29]	0.968	0.807	0.742	0.724
Anomaly Detection-Based [30]	0.984	0.769	0.738	0.717
Pre-trained CNN [14]	0.975	0.829	0.807	0.783
One-Class Learning [10]	0.981	0.795	0.794	0.770
DRBM + DBM [31]	0.983	0.802	0.809	0.782
Attention Auto-Encoder [11]	0.954	0.780	0.772	0.746
VGG16 and ResNet50 [7]	0.987	0.826	0.808	0.795
Proposed approach	0.998	0.832	0.813	0.801

, we present modality-shared anti-spoofing attack testing results on the four subsets of LivDet 2015 for fingerprint, and MSU-MFSD, Rose-Youtu for face. The same table gives an overview of the anti-spoofing performance of the adopted modality-shared framework benchmarked against SOTA approaches in terms of AUC. First, we observe that earlier methods achieve relatively poor performance, as these approaches mainly rely on simple image quality measures [27]. Moreover, in [7], although the use of dual pre-trained model (VGG16 and ResNet50) leads to noticeable performance improvements (AUC = 0.987), the overall performance remains limited because such pre-trained CNN cannot accurately model the spoof cues encountered in multiple modalities. By utilizing ArcFace loss on the embedding space learned by DeiT-Tiny, our approach effectively learns discriminative characteristics of spoof attacks of both modalities (face and fingerprint) simultaneously, thereby outperforming previous FAS and FLD methods with an AUC = 0.998. We then add three different spoofing attack types and evaluate state-of-the-art approaches and our method under FGSM, PGD, and DeepFool attacks. As shown in Table 3 and the ROC curves in Figure 2, although performance degrades under adversarial attacks (FGSM: AUC = 0.832, PGD: AUC = 0.813, DeepFool: AUC = 0.801), our approach still achieves the highest AUC compared to SOTA methods under the same attack settings.

4.3.2. Multi-Modal Anti-Spoofing Detection Evaluation

To further assess the domain-generalization ability of the proposed approach, we conduct leave-one-dataset-out cross-domain experiments using four commonly used datasets: LivDet 2015 (L), LivDet 2013 (I), MSU-MFSD (M), and Rose-Youtu (R). In each setting, three datasets are used for training, and the remaining dataset is used exclusively for testing. Therefore, the target dataset is completely unseen during training. The four evaluation protocols are L&I&M → R, L&R&I → M, L&R&M → I, and M&R&I → L.

Table 4. Leave-one-dataset-out cross-domain comparison on LivDet 2015 (L), LivDet 2013 (I), MSU-MFSD (M), and Rose-Youtu (R). Results are reported as HTER/AUC (%).

Method	Year	L&I&M → R	L&R&I → M	L&R&M → I	M&R&I → L	Averag-HTER/AUC
MobileNetV2 [32]	2025	24.14/82.74	8.28/94.89	17.94/88.25	32.88/70.03	20.81/83.97
ViT [33]	2023	26.45/80.65	8.57/93.23	26.67/75.92	26.08/79.15	21.94/82.23
SLIP (one-class) [34]	2025	28.75/77.44	19.21/84.58	16.69/88.28	24.29/81.07	22.23/82.84
MoSFPAD [35]	2025	35.23/69.18	8.78/95.51	22.41/84.56	26.35/78.47	23.19/81.93
Proposed method	2026	23.39/82.60	12.75/89.83	20.43/86.91	17.14/87.38	18.17/86.68

reports the cross-domain comparison. The adopted approach achieves an average HTER of 18.17% and an average AUC of 86.68% across the four leave-one-dataset-out protocols. The best cross-domain performance is observed on L&R&I → M, where our method obtains 12.75% HTER and 89.83% AUC, indicating strong generalization when MSU-MFSD is used as the unseen target domain.

4.3.3. Ablation Study

To validate the effectiveness of ArcFace loss, we conduct an ablation study comparing different loss functions during pre-training. We evaluate three configurations: (i) Simple Triplet loss [17], (ii) CosFace loss [18], and (iii) Single-Center Loss [19]. As shown in

Table 5. Ablation study comparing different loss functions during pre-training.

Loss Function	AUC
	Without Attack	FGSM	PGD	DeepFool
Simple Triplet loss [17]	0.982 ± 0.41	0.796 ± 1.32	0.767 ± 1.24	0.788 ± 1.93
CosFace loss [18]	0.996 ± 0.003	0.839 ± 0.01	0.785 ± 1.15	0.754 ± 2.67
Single-Center Loss [19]	0.992 ± 0.114	0.814 ± 0.55	0.757 ± 0.65	0.794 ± 1.87
ArcFace (Proposed)	0.998 ± 0.0022	0.832 ± 0.1.1	0.813 ± 0.21	0.801 ± 0.09

, ArcFace loss achieves the highest AUC (0.998), outperforming Simple Triplet loss (0.982), CosFace loss (0.996), and Single-Center Loss (0.992). Under adversarial attacks (FGSM, PGD, DeepFool), a loss function like CosFace outperforms our proposed ArcFace under an FGSM attack, achieving 0.839 AUC compared to 0.832. However, ArcFace consistently maintains superior robustness on all other adversarial attacks types, proving its effectiveness for modality-shared anti-spoofing.

5. Conclusions

This paper proposes a modality-shared anti-spoofing approach that combines ArcFace loss with a Mixture of Projection Experts (MoPE) architecture for face and fingerprint modalities. ArcFace loss imposes an angular margin (m = 0.5) on the DeiT-Tiny embedding space, boosting compact clustering of real samples from both modalities while increasing the separation between spoof embeddings. The MoPE downstream stage employs modality-specific linear projections to enhance feature discriminability for each biometric modality. We evaluated the proposed framework on four datasets, LivDet 2013, 2015 for fingerprint modality, and MSU-MFSD, Rose-Youtu for face modality. Extensive experiments demonstrated that the proposed approach can efficiently separate real and spoof samples with and AUC = 0.998. Moreover, we subjected the proposed approach to three unseen adversarial attack types (FGSM, PGD, and DeepFool). Although our method showed a performance drop under adversarial attacks achieving 0.832 AUC for FGSM, 0.813 AUC for PGD, and 0.801 AUC for DeepFool, it still provides better performance compared to state-of-the-art methods under the same three adversarial attack perturbations. In future research, we aim to enhance the scheme’s performance using another biometric modality, e.g., speech, and iris. Moreover, we will also focus on designing inherently more robust schemes capable of withstanding sophisticated adversarial attacks.