Exploring the Security of Mobile Face Recognition: Attacks, Defenses, and Future Directions

Abstract

Biometric authentication on smartphones has advanced rapidly in recent years, with face recognition becoming the dominant modality due to its convenience and easy integration with modern mobile hardware. However, despite these developments, smartphone-based facial recognition systems remain vulnerable to a broad spectrum of attacks. This survey provides an updated and comprehensive examination of the evolving attack landscape and corresponding defense mechanisms, incorporating recent advances up to 2025. A key contribution of this work is a structured taxonomy of attack types targeting smartphone facial recognition systems, encompassing (i) 2D and 3D presentation attacks; (ii) digital attacks; and (iii) dynamic attack patterns that exploit acquisition conditions. We analyze how these increasingly realistic and condition-dependent attacks challenge the robustness and generalization capabilities of modern face anti-spoofing (FAS) systems. On the defense side, the paper reviews recent progress in liveness detection, deep-learning- and transformer-based approaches, quality-aware and domain-generalizable models, and emerging unified frameworks capable of handling both physical and digital spoofing. Hardware-assisted methods and multi-modal techniques are also examined, with specific attention to their applicability in mobile environments. Furthermore, we provide a systematic overview of commonly used datasets, evaluation metrics, and cross-domain testing protocols, identifying limitations related to demographic bias, dataset variability, and controlled laboratory conditions. Finally, the survey outlines key research challenges and future directions, including the need for mobile-efficient anti-spoofing models, standardized in-the-wild evaluation protocols, and defenses robust to unseen and AI-generated spoof types. Collectively, this work offers an integrated view of current trends and emerging paradigms in smartphone-based face anti-spoofing, supporting the development of more secure and resilient biometric authentication systems.

1. Introduction

Mobile devices have become central to communication, financial transactions, and personal data management, increasing the need for reliable authentication mechanisms. As the primary means of controlling access to sensitive information, authentication plays a critical role in ensuring the security of modern smartphones [1]. Mobile user authentication methods are generally categorized into three types: knowledge-based (e.g., passwords or personal identification numbers (PINs)), possession-based (e.g., tokens or smart cards), and biometrics (e.g., fingerprints or facial characteristics) [2,3]. Although widely deployed, knowledge-based authentication is inherently binary and vulnerable because it grants access to anyone who knows the correct credentials, making it susceptible to shoulder surfing, phishing, and brute-force attacks [2,4,5]. In addition, passwords can be easily shared, stolen, forgotten, or leaked. On the other hand, possession-based authentication offers improved security but is not commonly used on mobile devices, as it requires users to carry a secondary token, which is impractical for everyday use [4].

These limitations have contributed to the widespread adoption of biometric authentication in smartphones [6,7]. Unlike passwords or tokens, biometric systems verify characteristics inherent to the user. Among biometric modalities, facial recognition has gained prominence due to its speed, convenience, and integration with modern mobile hardware [5]. However, its deployment in unconstrained environments introduces significant security challenges. Variations in illumination, pose, and background, combined with the accessibility of high-quality cameras and display devices, increase susceptibility to presentation attacks. Such attacks involve an adversary presenting manipulated artifacts, including printed photographs, digital displays, masks, or three-dimensional replicas, to elicit an incorrect authentication outcome. Despite recent progress, detecting these attacks consistently across diverse conditions remains an open problem [6,7]. Recent deep learning approaches have improved detection capabilities [8], yet studies show that current systems can still be bypassed with relatively simple attacks [9] and often struggle with generalization to unseen conditions [10].

Given the evolving challenges surrounding biometric authentication, particularly in mobile devices, this paper aims to provide a structured and comprehensive overview of both attacks and defences in smartphone-based facial recognition systems. Although previous research has examined face recognition and face anti-spoofing, existing work presents three main limitations relevant to mobile scenarios. First, prior studies primarily focus on traditional biometric pipelines or laboratory-controlled security evaluations, offering limited discussion of the specific constraints and attack surfaces of smartphone-based systems. Second, much of the literature evaluates anti-spoofing algorithms using datasets collected under ideal or static conditions, providing limited insight into real-world factors such as domain shifts, environmental variability, and device heterogeneity. Third, current surveys often emphasize specific algorithmic families, such as texture-based or deep-learning-based approaches, without integrating recent developments in dynamic attack patterns, unified detection frameworks, or mobile deployment considerations. While the present review does not aim to resolve all these limitations, it seeks to consolidate and contextualize recent advances, highlight emerging trends, and provide a clearer system-level perspective tailored to mobile face authentication. In particular, the objective is to explore the current landscape, identify vulnerabilities, and assess the effectiveness of existing countermeasures. To this end, the paper contributes in three key areas:

• RQ1 Understanding the Attack Surface: What is the current attack surface for biometric authentication on smartphones? The state-of-the-art in face recognition technologies will be described, highlighting how facial sensors have advanced in terms of accuracy, speed, and integration into mobile hardware.
• RQ2 Identifying Common Exploits: What types of exploitation techniques are most prevalent today? The various methods attackers use to deceive facial recognition systems will be explored, including presentation attacks such as photo, video, and mask-based spoofs. The goal is to discover how biometric systems are abused and what weaknesses are the most frequently targeted.
• RQ3 Evaluating Mitigation Strategies: How effective are current systems in defending against these attacks? The final section focuses on the countermeasures employed by the industry, with particular emphasis on techniques powered by deep learning. It evaluates the detection capabilities of these defences and assesses how secure modern face authentication systems truly are.

To achieve these goals, the paper synthesizes findings from a wide range of academic and industry research. Through this analysis, the paper not only highlights the current state of mobile biometric security but also identifies gaps and open questions, offering direction for future research and development in this rapidly advancing field. Simplified paper structure diagram is presented in Figure 1.

Figure 1. Paper structure diagram.

2. Biometric Authentication

Authentication methods can generally be categorized into three main types: “what a person knows” (e.g., passwords or PINs), “what a person has” (e.g., tokens or smart cards), and “what a person is”—which refers to biometric characteristics [2,4,5]. Biometric authentication focuses specifically on this last category, utilizing physical or behavioral traits that are unique to an individual.

As described by Chernov et al. [11], a biometric authentication system is typically composed of several components. It begins with a scanning device that captures biometric data, such as a facial image, and sends it to a feature extraction algorithm. This algorithm identifies distinguishing characteristics from the input data. These features are then compared to the stored template in a secure database, associated with the enrolled user. Finally, a decision algorithm determines whether there is a match, resulting in either a successful or failed authentication attempt.

Chernov et al. [11] also outline four key criteria that a biometric feature must meet to be suitable for use in such systems: (i) universality: the trait must be present in all individuals, (ii) uniqueness: it should differ sufficiently between individuals, (iii) constancy: the trait must remain stable over a period of time, and (iv) measurability: must be possible to reliably and accurately capture the trait.

A typical facial recognition system for smartphones follows a multi-step process, as illustrated in Figure 2. According to Abdelaziz [12], the authentication pipeline generally consists of the following stages:

• Face Detection—The system identifies the presence and location of a face within the camera’s field of view.
• Preprocessing—Adjustments are made to account for variables such as lighting, facial orientation, and background noise to enhance recognition accuracy.
• Feature Extraction—The system identifies and encodes unique facial features that distinguish one individual from another.
• Feature Matching—Extracted features are compared to stored biometric templates created during the enrollment phase.

Figure 2. Overview of the face authentication pipeline used in smartphone systems, including face detection, preprocessing, feature extraction, template generation, and feature matching.

Figure 2. Overview of the face authentication pipeline used in smartphone systems, including face detection, preprocessing, feature extraction, template generation, and feature matching.

As outlined in the survey by Rattani and Derakhshani [7], the most accurate face detection systems often rely on machine learning techniques, either independently or in combination with other approaches such as skin-tone analysis. Patil and Kulkarni [6] also emphasize the role of machine learning in facial recognition, with Convolutional Neural Networks (CNNs) being particularly effective. Among them, VGG-16—a deep CNN architecture—has shown strong performance, as noted by Tseng and Shih et al. [13]. Comparison of commonly used CNN models can be observed in Table 1.

Table 1. Comparison of models used for face recognition.

CNN Based Model Types	Derivatives	Image Input Size
VGG [13]	VGG-11, VGG-16	224 × 224
RESNET [14]	RESNET 18 and 50	Different sizes used
Squeezenet [15]	Squeezenet	224 × 224
YOLOv5 [16]	YOLOv5s	640 × 640

Despite these advancements, all current facial recognition systems remain susceptible to presentation attacks—wherein an attacker presents a falsified image or representation of an authorized user to bypass authentication. This remains a significant vulnerability in biometric systems and underscores the need for continued research and improved defences.

3. Attack Landscape

In this section, we present various attacks that can be carried out against face recognition systems on smartphones. Which are also depicted in Figure 3. First, we will discuss the types of attacks. Then, we will outline the conditions that must be met for such malicious actions to occur. It is important to highlight that as a form of biometric authentication, face recognition relies on passkeys that generally possess low entropy. Consequently, a thorough understanding of potential attack vectors and ongoing improvements in defense strategies is critical.

Figure 3. Illustration of attack vectors targeting smartphone-based facial recognition. Presentation attacks involve introducing 2D or 3D spoof artifacts to the camera, whereas digital attacks manipulate or intercept biometric data within the device.

3.1. Spoofing Attacks

Spoofing attacks refer to a broad class of security threats in which an attacker attempts to impersonate a legitimate user or trusted source to gain unauthorized access [9]. In the context of biometric systems, spoofing typically involves presenting fake or manipulated biometric traits, such as fingerprints, facial images, or voice recordings, to trick the authentication system [9].

One prominent category of spoofing attacks in facial recognition systems is the presentation attack. These attacks involve presenting an artificial representation of the face of a person to the camera in order to deceive the system into granting access [9]. With the increasing use of face recognition in smartphones and the growing availability of high-quality cameras, presentation attacks have become more common and accessible [9].

In particular, presentation attacks are a modern type of physical attack that have gained popularity due to the widespread presence of cameras on wearable and handheld devices such as smartphones. As camera technology has evolved, more sophisticated forms of these attacks have emerged. According to Hofbauer and Debiasi et al. [9], presentation attacks can be divided into two main categories:

• 2-dimensional (2D) Presentation Attacks—These attacks rely on displaying a flat, artificial representation of a face to the recognition system. They are relatively easy to carry out and require only basic tools, such as a printer or a digital display. Common types of 2D attacks include [9]:
  • Printed Image: An attacker uses a printed photo of the target’s face. In earlier systems, such attacks were often successful, especially if the image was bright and clear enough, as the systems could not reliably distinguish flat images from real faces [9].
  • Image File: Instead of printing the photo, the attacker displays it on a screen. This method is even more accessible and avoids quality loss from printing [9].
  • Video Footage: This approach uses a dynamic video of the target’s face, adding realism through movement. It can fool systems that rely solely on visual input without depth or liveness checks [9].
• 3D Presentation Attacks—These involve more complex artifacts that attempt to replicate the three-dimensional structure of a human face [9]:
  • Paper Printed Mask: A basic 3D spoof created by printing a face on paper and cutting out areas around the eyes and nose. By bending the paper in specific ways, attackers can mimic the shape of a face. Surprisingly, it is that such attacks were successful without wearing the mask and could be presented to sensors and bent in a specific way to be able to mimic the shape of the head and blinking [9].
  • Handcrafted Latex Mask: These masks require more skill and time to create. Although they are more sophisticated than paper masks, their functional difference is minimal [9].
  • 3D Printed Resin Mask: These masks are produced using 3D printing and resemble latex masks in effectiveness. However, they offer scalability, as multiple masks can be printed with relatively little additional effort [9].

In summary, presentation attacks are relatively easy to perform. While biometric systems have become increasingly advanced and capable of detecting more complex spoofing attempts, even high-end countermeasures—such as liveness detection—can fail under certain conditions. For instance, realistic eye reflections and movements remain difficult to replicate in artificial models, making them a persistent weakness in spoofing attempts.

3.2. Digital Attacks

In scenarios where an attacker is able to intercept the data stream from a biometric sensor, such as the one used in face recognition systems, a digital attack becomes feasible. Unlike physical attacks, digital attacks operate directly on the acquired biometric data. These attacks can be executed independently by tampering with the intercepted data, or they can be used to generate artifacts (e.g., altered images or videos) that are later presented to the system.

A notable form of digital attack is the adversarial attack, which exploits vulnerabilities in deep learning models, particularly CNNs [11]. Due to the complexity of CNNs, it is often challenging to fully understand how they interpret and compare facial features. This opacity opens the door to adversarial manipulation. As described by Chernov et al. [11], adversarial attacks involve introducing carefully crafted noise to an image. This noise, although nearly invisible to the human eye, can cause the model to misclassify the input. The goal of such an attack could be to evade recognition (e.g., prevent a face from being identified) or to impersonate another identity. Chernov et al. argue that adversarial attacks are extremely difficult—if not impossible—to fully prevent. While some mitigation strategies exist, such as input preprocessing or model hardening, these only reduce the probability of a successful attack rather than eliminate the threat entirely. At present, the literature does not provide clear evidence regarding the effectiveness of adversarial attacks specifically in the context of face recognition [11]. It remains uncertain how practical or successful these attacks are in real-world scenarios involving biometric authentication. Similar conclusions regarding attack strategies were presented in [17], where the authors conducted extensive research on various methods for executing both physical and digital attacks against face detection systems.

Another category of digital attacks includes morphing attacks and master print attacks, as discussed by Li et al. [18]. In a morphing attack, a sample that blends the facial features of two or more individuals is presented during the enrollment phase. As a result, any of the individuals whose features were included in the composite image may be able to authenticate successfully using that same sample. In contrast, a master print attack aims to generate a single biometric sample, such as a fingerprint or facial pattern, that contains commonly occurring features. If successful, this master sample can match multiple users, allowing an attacker to unlock devices belonging to different individuals without knowing their specific biometric traits.

3.3. Dynamic Attack Patterns

Recent developments in face presentation attack techniques reveal a shift from static, well-defined spoofing artifacts toward dynamic attack patterns, where the success of an attack depends strongly on the acquisition conditions under which the biometric signal is captured. Unlike traditional spoofs that rely solely on 2D images, videos, or masks, recent attack strategies increasingly exploit environmental and device-related variability to reduce the reliability of liveness detection systems on smartphones. This shift has been highlighted in recent surveys [19,20], which emphasize that real-world conditions introduce additional vulnerabilities beyond the spoof artifact itself.

Furthermore, dynamic acquisition factors, including illumination fluctuations, motion blur, sensor noise, compression artifacts, and rapid facial movements, can suppress critical liveness cues and degrade the performance of both classical and deep-learning-based countermeasures. For example, Liang et al. [21] demonstrate that low-quality images caused by blur or reduced signal-to-noise ratio distort texture information and weaken both rPPG-based and appearance-based detectors. These degradations occur because many liveness cues rely on fine-grained optical and physiological signals, such as subtle skin reflectance variations [22], micro-expressions [22], and periodic blood-flow oscillations [22,23], which require stable illumination, high spatial resolution, and temporally consistent sampling. Motion blur smears high-frequency texture components critical for detecting print artifacts [24]; low illumination reduces the amplitude of rPPG signals due to lower photon count and increased sensor noise [25,26]; and video compression removes small temporal and spatial variations that PAD models depend on, such as specular highlights, blink patterns, or depth cues. Similarly, motion blur from handheld jitter or abrupt facial movement can obscure micro-expressions, blink dynamics, or depth cues, while mobile-camera compression may eliminate subtle signals essential for discriminating bona fide from spoof presentations.

In addition, domain generalization research further shows that such acquisition-induced variability effectively creates new attack opportunities. Zhou et al. [27] argue that even when the spoof artifact remains unchanged, environmental or device-related shifts can cause anti-spoofing models to fail due to distribution mismatch. In practice, attackers may intentionally exploit dim lighting, high-refresh-rate displays, or low-quality capture conditions to increase the likelihood of bypassing detection.

Beyond environmental factors, emerging work highlights vulnerabilities to spoof types that differ substantially from those encountered during training. Jiang et al. [28] show that models trained under closed-set assumptions struggle with unknown or weakly modelled spoof patterns, underscoring the difficulty of detecting entirely unseen attacks. Likewise, Zhang et al. [29] demonstrate that variations in pose, lighting, or scene composition can interfere with both semantic and texture-based reasoning, even when spoof artifacts are nominally simple.

On top of that, hybrid or mixed-modality attacks further expand the dynamic attack landscape. Chen et al. [30] show that combining physical spoof artifacts (e.g., masks) with digital perturbations or cross-modal inconsistencies can bypass detectors that rely exclusively on spatial or temporal cues. Such attacks exploit both environmental instability and multi-modal vulnerabilities simultaneously.

Taken together, these findings indicate that the attack landscape is no longer limited to discrete spoof categories, but instead encompasses a continuum of condition-dependent attack patterns that significantly challenge model generalization and reliability. As a result, modern face anti-spoofing evaluations increasingly incorporate realistic testing conditions reflecting domain shifts, heterogeneous capture environments, and unseen acquisition scenarios. This evolution underscores the need for mitigation strategies that are robust not only to new spoofing artifacts, but also to the dynamic and unpredictable conditions characteristic of real-world mobile environments [19,20].

3.4. Attacks Summarization

An overview of the identified attacks on face recognition systems in smartphone devices is presented in Figure 4. As shown, these attacks can be broadly categorized into two types: presentation attacks and digital attacks. The main limiting factor for carrying out such attacks is the amount of resources an attacker is willing to invest, as many of the documented methods are relatively simple to execute. Regardless of the chosen approach, the objective remains the same: to present a falsified visual representation of a legitimate face—or a combination of faces in the case of a master print attack—to deceive the authentication system. This can be achieved either through physical means (e.g., printed images or masks) or digital manipulation (e.g., adversarial or morphing attacks). Overall, while the current attack landscape for face recognition remains relatively narrow, it is likely to expand in the future as more advanced and sophisticated techniques are developed.

Figure 4. Taxonomy of attack types targeting smartphone facial recognition systems, including 2D and 3D presentation attacks, digital attacks such as morphing and adversarial manipulation, and dynamic attacks.

4. Effectiveness of Mitigation Techniques

In this section, we evaluate the effectiveness of existing defense mechanisms against various types of attacks on face recognition systems in mobile devices. We will examine how well these mitigations perform against both presentation and digital attacks, highlighting their strengths, limitations, and areas where further improvements are needed.

4.1. Liveness Detection

To combat presentation attacks or, more specifically, face spoofing attacks, researchers looked to develop new ways to detect whether a face is “live” (e.g., analyzing micro-movements, 3D depth sensing, etc.). Each of these methods has its strengths and limitations.

One such method is using remote PhotoPlethysmoGraphy (rPPG), which is a biomedical technique that remotely measures the heartbeat signal from the subtle blood pulse-caused skin variation using a red-green-blue spectrum (RGB) camera. This is used as a liveness cue. This method is particularly useful against 3D masks as the mask physically blocks the light transmission. Liu et al. [10] highlight the fact that good performance of existing rPPG-based methods are based on long observation time (10–12 s) and propose a novel solution to reduce the observation time while maintaining up good performance. More specifically, they designed a feature (the Temporal Similarity of rPPG) that analyses the waveform of the rPPG signal in the time domain. To detect liveness, local rPPG signals are extracted from facial and background regions, and a lightweight spatiotemporal convolutional network is used to learn higher similarity of local facial rPPG signals. Using this proposed method, the heartbeat vestige can be extracted within one second. This method was evaluated on 3DMAD, HKBU-MARsV1+, HKBU-MARsV2+, and CSMAD and outperformed the state-of-the-art rPPG-based methods. In another study [31], Zhang et al. focused on augmenting the PhysFormer model with an additional Temporal Difference Multi-Head Self-attention (TD-MSHA) layer and coupled it with a 3DCNN-based spatio-temporal classifier for face presentation attack detection (PAD). This method was evaluated on the OULU-NPU dataset where the PhysFormer model augmented with TD-MSHA layer and the proposed classifier resulted in 2.38 attack presentation classification error rate (APCER) and 14.6 bonafide presentation classification error rate (BPCER) when tested with the full face.

Furthermore, Chen et al. [32] proposed Echoface, an acoustic-based liveness detection system, which turns mobile devices equipped with microphones and speakers into an active sonar to detect the spatial structures of the target (i.e., mobile user). This is based on the fact that a live user’s face is an uneven stereostructure with complex curved surfaces, while a photo or a video presents a flat plane. The average detection accuracy of their proposed model was calculated as 96 percent, with an average false rate of 4 percent across various media attacks and different levels of background music. Ramachandra et al. [33] also used Acoustic-based PAD where reflection echo characteristics are analyzed to detect bona fides and Presentation attacks. Background noise was subtracted, and a new Acoustic Sound Echo Dataset (ASED) was created. The paper uses Detection-Equal Error Rate (D-EER) to measure the effectiveness of the proposed solution but it indicates the value that the proportion of BPCER is equal to the portion of APCER. The proposed method indicated an average D-EER of 6.35 percent and 5.11 percent on inter and intra experiments without using background subtraction. With background subtraction, the average D-EER is 3.36 percent and 2.33 percent in inter and intra experiments, respectively. These results demonstrate the generalizability of the proposed method.

In addition, Bakshi and Gupta [34] proposed a new fake biometric detection model using various features of the face of a mobile user in a live environment. This method only requires one input image, and then the process makes use of 12 different image quality assessment parameters to determine if a user is real or fake. Using their own database for testing, they found that their tool manages to detect fake biometrics when considering all parameters.

Finally, there are hybrid approaches that combine multiple techniques to improve spoof detection accuracy. These methods often integrate facial recognition with additional liveness checks, such as blink detection. For instance, Akhdan et al. [35] employed a hybrid method using Eye Aspect Ratio (EAR)-based blink detection alongside Support Vector Machines (SVM), tested on the Eyeblink8 dataset. While this approach performs well against static attacks, it shows limitations when facing dynamic attacks including video-based spoofing. Similarly, Srivastava and Tiwari [36] proposed a novel method for facial liveness detection on edge devices. Their system uses real-time blink detection and object detection via OpenCV to determine whether the face in front of the camera belongs to a live person or is merely an image or video displayed on a screen. Despite being tested on a relatively small sample of users, their results demonstrate the method’s effectiveness in distinguishing genuine users from presentation attacks.

4.2. Deep Learning

The research presented by Wang et al. [37] introduces two key contributions aimed at enhancing face anti-spoofing in surveillance scenarios: Dynamic Feature Queue (DFQ) and Progressive Training Strategy (PTS). The DFQ is designed to effectively capture and model the unknown characteristics of attack samples, thereby improving the model’s ability to generalize to unseen spoofing attempts. On the other hand, the PTS facilitates learning from large-scale and non-stationary data by progressively refining the training process, enhancing the model’s adaptability to new attack types. The proposed method was trained and evaluated using the SuHiFiMask dataset. With the integration of DFQ and PTS, the system achieved an APCER of 5.07 and a BPCER of 4.38, indicating strong performance in distinguishing between real and spoofed facial inputs.

4.3. CNN/AI

Based on the reviewed literature, OpenCV appears to be the most commonly used framework for detecting and extracting the region of interest (ROI) in face recognition and spoof detection systems. Once the ROI is obtained, a neural network is typically built using either PyTorch or TensorFlow with Keras to perform the classification task.

Additionally, a widely used neural network architecture for image-related tasks is the CNN. CNNs are composed of convolutional layers that are particularly effective at detecting spatial patterns in 2D data, such as images. Early layers typically learn simple features, like edges or diagonal lines, while deeper layers can identify more complex patterns, such as shapes or objects.

A method leveraging CNNs for face spoof detection was proposed by Priyadarsini et al. [38]. They implemented a simple CNN model and compared its performance to traditional, non-neural network approaches such as Fourier Transform and Local Binary Pattern (LBP). Their results showed that the CNN outperformed both traditional methods across all evaluated metrics, including APCER and BPCER, demonstrating its effectiveness for this task.

Almeida et al. [15] developed their face anti-spoofing model based on the SqueezeNet architecture, chosen for its small size and efficiency, making it suitable for deployment on smartphones. In their work, they propose a novel approach to image input for the network. While most prior studies use entire face images, Almeida et al. introduce a method that allows for arbitrary levels of detail to be extracted from the face—such as focusing solely on regions like the eyes or mouth—from both genuine and spoofed samples. This selective focus can potentially enhance the model’s robustness, especially when deployed on devices with unseen camera types, by avoiding over-reliance on specific image characteristics tied to a particular device. Additionally, they adapt the loss function to encourage genuine samples captured from the same device to cluster more tightly in the feature space, while ensuring that spoofed samples remain more dispersed. This design helps improve the discriminative power of the model between genuine and fake inputs.

A study by Lim et al. [39] approached the face anti-spoofing problem from a different angle by developing a dual-generator model trained exclusively on bona fide (live) face samples. As a result, the model does not rely on learning the characteristics of specific spoofing types. This approach is particularly advantageous because, in most cases, there are more genuine samples available than spoofed ones. Moreover, since the model is not conditioned on known attack types, it demonstrates improved generalization to previously unseen spoofing methods.

A more complex approach was proposed by Hadiprakoso et al. [40], who combined a CNN-based classification model with a separate liveness detection module. These two components are designed to work in tandem. To function effectively, the system requires a 1-s video recording of the user’s face to evaluate liveness indicators such as lip movement and eye blinking. While the paper reports performance using precision, recall, and accuracy, it does not include APCER or BPCER metrics, making direct comparison with other studies more difficult.

A CNN model derived from the VGG16 architecture was introduced by Tseng et al. [13]. Their final model consists of 16 convolutional layers and 3 fully connected layers, with a softmax layer at the end to classify inputs as either spoofed or genuine faces. However, the paper does not clearly explain how their proposed model differs from the original VGG16 architecture. Nonetheless, since their evaluation was conducted using the CASIA-SURF dataset, their results can be compared to other models tested on the same benchmark.

In contrast, the approach proposed by Kuznetsov et al. [41] is significantly simpler, utilizing only four convolutional layers. Their study focuses on how various parameters—such as activation functions, batch size, and other hyperparameters—influence model performance. The model was trained and evaluated on the Replay-Attack dataset. However, as the paper reports only accuracy as a performance metric, it is difficult to compare their results directly with other studies that use more standard metrics like APCER and BPCER.

Furthermore, an interesting architectural element appears in the work by Chaudhari et al. [42], who incorporate depth-wise convolution layers. This technique processes each input channel (depth) independently before applying a point-wise convolution to combine them. While this variation is somewhat uncommon in face anti-spoofing literature, the rest of their approach aligns closely with previously described methods.

Channel-wise attention is utilized in the work by Alshaikhli et al. [14], alongside a spatial-wise attention module running in parallel. Their model is based on ResNet-50, using the first 44 convolutional layers as an encoder. The output from the encoder is processed through both the channel-wise and spatial-wise attention modules, and their outputs are concatenated. The final classification is performed using a series of feed-forward layers. This dual-attention mechanism is designed to enhance the model’s focus on both relevant spatial locations and important feature channels, increasing its effectiveness in detecting spoofing attempts.

In addiiton, a different challenge was addressed by Nguyen-Xuan et al. [16], who focused on implementing face recognition on embedded devices, particularly IP cameras. To achieve low computational complexity suitable for such resource-constrained environments, they utilized lightweight models such as MobileNet0.25, YOLO, and RetinaFace as backbones for spoof detection.

An alternative lightweight approach is presented in the Auto-FAS framework, proposed by Yu et al. [8]. Auto-FAS introduces a model architecture search method that selects the most suitable CNN architecture from a pool of candidates for the FAS task. The search process is designed to be efficient and neutral, and it can follow one of three main strategies: gradient-based optimization, evolutionary algorithms, or reinforcement learning. This approach allows for automatic identification of optimal architectures tailored to FAS, while maintaining lightweight model complexity for real-world applications.

A comparison of different results can be seen in Table 2. However, it is not possible to make a complete comparison across all studies, as not all papers use the same datasets or report the same evaluation metrics. According to the ISO/IEC 30107 standard [43]—also referenced by Li et al. [18]—the biometric performance of presentation attack detection systems should be reported using two primary metrics: APCER and BPCER. Both of these metrics are in percentage, the value of APCER mean the proportion of attack presentations which have been marked as bona fide and for BPCER it is proportion of bona fide presentations which have been marked as attacks. These two can also be combined to produce a Detection Error Trade-off (DET) graph, which visualizes the balance between detecting attacks and avoiding false rejections. For the purpose of comparison, BPCER and APCER are the main metrics considered. In some cases, however, papers only report False Acceptance Rate (FAR) and False Rejection Rate (FRR). In such instances, we interpret FRR as equivalent to BPCER, under the assumption that the system is designed to accept genuine users and reject attacks. Following this logic, if a genuine (bona fide) sample is presented but misclassified, it corresponds to a false rejection—thus contributing to the BPCER. As some papers report D-EER, which means a system in which the threshold gives APCER=BPCER=D-EER. For this reason such results are shown in the table bellow just by APCER and BPCER value.

Table 2. Overview of Evaluation Metrics and Datasets Across Reviewed Studies.

Dataset	CASIA		OULU-NPU IV		Other
Paper	APCER	BPCER	APCER	BPCER	APCER	BPCER	dataset name
Priyadarsini et al. [38]	4.55	9.35	-	-	0.02	0.01	NUAA
Almeida et al. [15]	4.8	4.8	Average = 14.2		Average = 1.5		Replay-Attack
Lim et al. [39]	-	-	6.0 †	25.0 †	-	-	-
Tseng et al. [13]	0.31 ‡	1.03 ‡	-	-	-	-	-
Alshaikhli et al. [14]	1.5 ‡	0.0 ‡	-	-	0.7	0.0	CelebA-spoof
Yu et al. [8]	-	-	17.9	9.2	12.1	5.0	OULU-NPU I
Zhang et al. [31]	-	-	18.34 *	11.32 *	2.38	14.16	OULU-NPU I
Wang et al. [37]	-	-	-	-	5.07	4.38	SuHiFiMask
Huang et al. [44]	-	-	-	-	8.73	8.67	SuHiFiMask

Bold numbers highlights the smallest error rate per dataset and type of error. * OULU-NPU II used instead. † Average of photo and video subset. ‡ Used dataset version which included depth and IR.

4.4. Recent Advances and Emerging Paradigms in Face Anti-Spoofing

Recent work highlights a significant shift in how FAS methods are designed, evaluated, and deployed. Traditional mitigation approaches, typically optimized for fixed datasets and known spoofing categories, have been shown to generalize poorly under realistic mobile-device conditions, where attackers can exploit unseen spoof types, environmental fluctuations, and device-specific variations [19,20]. As a result, modern research has transitioned toward robustness-driven and generalization-oriented paradigms.

Unlike earlier fully supervised, closed-set approaches, which assume that all spoof types are known during training, recent methods recognise that mobile deployment environments make such assumptions unrealistic. Smartphones encounter continually emerging spoof artifacts, device-specific imaging characteristics, and acquisition variability that cannot be captured in curated training datasets. Consequently, modern FAS research increasingly treats spoof detection as an open-set or anomaly-detection problem, where models are trained primarily on bona fide data and must identify any deviation from physiological or optical norms [19,20,45]. Approaches such as zero-shot prompt-based learning, test-time domain generalization, and unified texture–semantic modelling therefore represent a conceptual shift rather than incremental performance improvements, as they are designed to operate under fundamentally different real-world constraints.

A key direction in recent studies is the development of models capable of handling unseen or weakly modeled spoof types. Jiang et al. [28] propose a method that learns unknown spoof prompts using only bona fide face images from a single source domain. By leveraging the general knowledge embedded in vision–language models, their framework generates textual prompts representing both real faces and potential spoof patterns, without requiring any spoof samples during training. This design enables the system to address both covariate shift and semantic shift, thereby improving generalization to previously unseen attack types. The approach reflects a broader movement toward zero-shot anti-spoofing, where the focus is on modeling intrinsic live-face characteristics rather than memorizing known spoof artifacts.

A second major trend concerns robustness to dynamic acquisition conditions. Smartphone authentication scenarios regularly involve factors such as motion blur, illumination variation, and changes in facial pose, all of which degrade the discriminative features used in liveness detection. Liang et al. [21] demonstrate that fluctuations in face image quality significantly impact PAD performance and propose a face image quality assessment (FIQA)-based framework that integrates quality cues directly into the anti-spoofing pipeline. Their results highlight the need for mitigation techniques that remain reliable across a wide range of imaging conditions and real-world environmental distortions.

Another emerging paradigm focuses on domain generalization and test-time distribution alignment. Zhou et al. [27] show that even state-of-the-art models experience significant performance drops when exposed to new acquisition conditions or unseen spoofing environments. To address this, they introduce a test-time domain generalization framework that leverages the incoming test data to project unseen samples into the style space of the training domain, thereby mitigating distribution shifts without updating model parameters at inference time. Their approach is effective across CNN and ViT backbones and improves robustness under cross-domain evaluation.

Beyond robustness and adaptation, recent work introduces unified detection frameworks capable of addressing both physical and digital attack modalities within a single model. Zhang et al. [29] propose a unified texture–semantic architecture that jointly analyzes fine-grained texture cues and high-level semantic representations, enabling simultaneous detection of presentation attacks and DeepFakes. Their method leverages CLIP-based semantic features to improve robustness against 3D mask attacks and incorporates synthetic counterparts to enhance generalization to unseen and highly realistic spoof types. Similarly, Chen et al. [30] present a cross-modal prompting framework (CrossGAP) that exploits CLIP’s global-aware semantics and prompt-guided attention to detect a broad spectrum of physical, digital, and hybrid spoofing attempts. Such unified approaches target a growing class of attacks that cannot be handled effectively by models trained for a single attack modality.

Furthermore, advances in feature- and modality-fusion have contributed significantly to improved cross-domain resilience in face anti-spoofing. Qi et al. [46] propose a high-performance adaptive fusion network that integrates depth-map fusion with ResNet-18 feature extraction to enhance discriminative power across diverse spoofing conditions. Their architecture incorporates dynamic convolution, bottleneck attention, adaptive instance normalization, and central difference convolution, enabling more effective capture of depth details that traditional appearance-based methods often miss. In addition, the model employs adversarial domain discriminators to achieve dual alignment of both feature and category distributions, thereby mitigating cross-domain discrepancies that commonly degrade generalization performance. The proposed method was evaluated on four widely used benchmark datasets (OULU-NPU, MSU-MFSD, CASIA-FASD, and Replay-Attack) which collectively span a broad range of attack types, sensor characteristics, and environmental conditions. OULU-NPU provides high-quality mobile acquisition scenarios with realistic print and replay attacks, whereas MSU-MFSD and CASIA-FASD include lower-resolution videos, varied lighting, and device diversity that test robustness to challenging acquisition conditions. Replay-Attack contains multiple display-based spoofing attempts recorded with different screens and lighting setups. Across all four datasets, the proposed fusion network achieved substantially improved generalization, demonstrating the effectiveness of combining complementary feature hierarchies and domain-alignment strategies for robust cross-domain face anti-spoofing.

Collectively, these developments demonstrate that the effectiveness of modern anti-spoofing techniques can no longer be evaluated solely through accuracy on in-corpus benchmarks. Instead, generalization, robustness, and adaptability have emerged as defining criteria for state-of-the-art FAS solutions. Recent work [19,20,21,27,28,29,30,46] underscore the need for mitigation techniques capable of handling unseen spoof types, managing distribution shifts arising from dynamic environmental conditions and device variability, and countering increasingly prevalent hybrid physical–digital attack vectors. These capabilities are critical for ensuring that face authentication systems remain reliable when deployed in the diverse and unpredictable conditions encountered on modern mobile platforms.

4.5. Hardware Innovations

Recent research has focused on leveraging unique physical properties and hardware-based techniques to enhance liveness detection in face recognition systems. For example, Liu et al. [47] combined traditional face recognition with Photo Response Non-Uniformity (PRNU) fingerprinting to detect spoofing attacks. PRNU utilizes sensor-specific noise patterns that are difficult to replicate, making it effective in detecting presentation attacks. Their approach demonstrated high robustness across different lighting conditions and device settings, achieving an average True Acceptance Rate (TAR) of over 99 percent, while maintaining a FAR below 1 percent. Similarly, Ebihara et al. [48] introduced a method based on flash-based SpecDiff descriptors. Their technique requires capturing two facial images—one with flash and one without—to compute the SpecDiff descriptor. Classification is performed using a SVM. The approach outperformed other flash-based PAD algorithms on both proprietary and public datasets, including NUAA, Replay-Attack, and SiW. Additionally, Hassani et al. [49] proposed a novel technique using near-infrared (NIR) reflectance spectroscopy. By illuminating the subject’s face with NIR light and analyzing the reflectance response, their method distinguishes between live skin and spoof materials such as paper, fabric, or latex. Their experiments, conducted on a custom dataset with 30 subjects and over 80,000 frames captured under varied lighting and poses, achieved an average APCER (Attack Presentation Classification Error Rate) of just 0.8 percent using a MobileNetV3 model.

4.6. Multi-Modal Systems

Multi-modal authentication involves the combination of multiple biometric traits—such as facial features, voice, or eye region data—to authenticate a user. These systems offer increased resistance to spoofing, as a malicious actor would need to replicate multiple biometric modalities simultaneously. However, this added security can come at the cost of user convenience, as multi-modal systems may introduce longer authentication times or require more complex interactions. To explore the potential of multi-modal systems, Stokkenes et al. [50] developed two datasets: SWAN-MBD (SWAN Multi-modal Biometric Dataset) and SWAN-MPAD (SWAN Multi-modal Presentation Attack Dataset). These datasets consist of data from 150 subjects collected across six sessions, covering diverse geographic and environmental conditions. The datasets include Ultra HD and HD facial images and videos, periocular data, and text-dependent voice samples in English, Norwegian, French, and Hindi. Their results showed high effectiveness in detecting low-quality attacks, achieving an error rate of less than 1 percent. However, performance dropped significantly when tested against high-quality attacks, with a D-EER reaching 29.34 percent. This highlights both the promise and the challenges of multi-modal systems in real-world anti-spoofing applications.

4.7. Datasets

Research into face anti-spoofing datasets plays a crucial role in advancing the field by providing diverse, high-resolution, and realistic testing environments that reflect modern attack scenarios. For example, the Flickr-PAD dataset, introduced by Pasmino et al. [51], features high-quality images and two hand-crafted attack scenarios: screen-based and print-based. Using a MobileNet-V3-Large model trained under the CMOF-R protocol, the dataset achieved a BPCER10 (Bona Fide Presentation Classification Error Rate when APCER = 10 percent) of 7.08 percent, and a general BPCER of 11.15 percent, highlighting its utility for benchmarking robust spoof detection methods.

On the other hand, Huang [44] addressed challenges in low-quality, long-distance surveillance through a method called Distributional Estimation. Evaluated on the SuHiFiMask dataset, this approach achieved 8.73 percent APCER and 8.67 percent BPCER, showing competitive performance under difficult, real-world conditions. A particularly notable contribution comes from Komaty et al. [52], who introduced a dataset focused on spoofing attacks using personalized hygienic masks. The dataset includes face videos across multiple categories: bona fide recordings, printed photo attacks, replay attacks using phones, and customized hygienic mask attacks. Their evaluation of two state-of-the-art face recognition systems, IResNet100 and IResNet50, revealed a degree of vulnerability to hygienic mask attacks. However, the systems’ susceptibility largely depended on the accept/reject threshold used in the underlying face recognition system.

As not all datasets are created same it is also important to highlight their differences. To start with, the dataset which is mostly used across different works is OULU-NPU. This dataset was published in 2017 and consists of 55 subjects in several protocols as described by Lim et al. [39]. It is worth to mention that this dataset has specific group of train and test samples predefined. As of protocols, the protocol I consists of train and test set containing samples under all conditions. The protocol IV has test set with environments attack types and capturing devices which are not present in the train set. As this dataset was conducted as join effort of University of Oulu (Finland) and Northwestern Polytechnical University (China) it gives perspective of how the system may work in a real world including ethnic diversity.

A CASIA dataset which has also been used across different evaluations is from year 2012. This dataset consist of 2 different sets SURF and FASD. The SURF consists of 21,000 samples from 1000 individuals containing RGB, depth and infra-red data and 6 different types of attacks as described by [14]. The FASD consist of 600 RGB video samples recorded by 3 different cameras under printed and display attack. On the contrary, REPLAY-ATTACK dataset also from year 2012 consists of 1200 videos captured by one camera and the spoofing was made by printer and 2 displays [15].

Based on this, we do access that results from OULU IV have the highest impact as numerous papers evaluated their model against it, where the evaluation is done against unseen lightning conditions, attacks and input sensors. As this dataset takes into account only input form a RGB camera it reflects a common scenario of a smartphone.

5. Future Work

Although substantial progress has been achieved in smartphone-based face anti-spoofing, several important research gaps remain. The following subsections outline key directions that merit further investigation.

5.1. Evaluation Under Realistic Acquisition Variability

As discussed in Section 3.3 and Section 4.4, current evaluation practices still rely heavily on controlled laboratory datasets, which do not adequately reflect real-world acquisition conditions. Domain shifts, such as indoor versus outdoor lighting, frontal versus selfie viewpoints, motion blur, compression artifacts, low signal-to-noise ratio, and other environmental variations, significantly affect the reliability of both classical and deep-learning-based PAD systems. Future research should therefore establish standardized cross-domain and in-the-wild evaluation protocols that quantify performance stability across heterogeneous conditions rather than relying solely on aggregated APCER/BPCER metrics. Such protocols would provide a more accurate representation of robustness in practical deployments.

5.2. Computational Suitability for Mobile Deployment

A second important research direction concerns the computational suitability of anti-spoofing methods for deployment on contemporary mobile devices. Existing studies typically report isolated inference times or memory usage, often measured on a single legacy device, which limits the relevance of these results for modern deployment scenarios. A systematic characterization of computational complexity, including FLOPs, memory footprint, model size, and energy consumption, remains largely absent from the literature. Furthermore, real-world mobile environments introduce additional constraints such as heterogeneous hardware architectures, varying thermal budgets, and battery-related limitations, all of which can significantly influence on-device performance. Future work should therefore adopt standardized reporting practices that include latency measurements on representative mobile chipsets, detailed resource consumption profiles, and evaluation of energy efficiency under realistic usage conditions. Such practices would enable more meaningful comparisons across architectures and guide the development of lightweight, hardware-aware PAD models optimized for constrained environments through techniques such as quantization, pruning, neural architecture search, and platform-specific optimizations. Addressing these practical considerations is essential for ensuring the viability of face anti-spoofing systems in real-world mobile deployments.

5.3. Dataset Bias and Demographic Representation

Persistent issues related to dataset bias and demographic imbalance continue to limit generalization. Widely used datasets such as CASIA, OULU-NPU, and Replay-Attack contain restricted diversity in terms of ethnicity, skin tone, age distribution, and geographic representation. This skew can result in systematic performance disparities that remain hidden when relying on aggregate metrics. Future work should prioritize constructing more demographically balanced datasets and analyzing how demographic factors influence PAD performance. Research on fairness-aware optimization and domain adaptation techniques could help mitigate these biases.

5.4. Generalization Beyond Known Spoof Types

Another key challenge involves generalization to spoof types, device conditions, and environmental characteristics not encountered during training. Cross-dataset evaluations consistently reveal large performance drops in such cases. Recent developments in one-class learning, zero-shot and prompt-based generalization, and unified texture–semantic modeling offer promising directions. Future research should build on these advances to characterize generalization to emerging spoof categories, including new materials, display technologies, and hybrid physical–digital manipulations.

5.5. Advances in Transformer Architectures and Multi-Modal Fusion

Transformer-based architectures, multi-modal fusion techniques, and unified detection frameworks present new opportunities for integrating complementary cues, such as RGB, depth, NIR, audio, or semantic representations, within a single PAD system. However, the scarcity of publicly available multi-modal datasets inhibits comprehensive evaluation. Future work should support the creation of such datasets and conduct systematic comparisons to determine the efficiency and robustness of these architectures in mobile scenarios.

5.6. Emerging AI-Driven and Diffusion-Based Threats

The evolving threat landscape necessitates the study of novel AI-driven attack vectors. Diffusion-based spoof generation, high-fidelity deepfake attacks, and emerging LLM-assisted or automated spoofing tools introduce new vulnerabilities that remain largely unexamined in current PAD research. Future studies should characterize these threats, propose realistic evaluation protocols, and design defenses capable of distinguishing bona fide facial dynamics from synthetically generated or manipulated content. Establishing standardized robustness measures that connect controlled experiments with practical, in-the-wild performance will be essential for ensuring long-term reliability of smartphone-based face authentication.

6. Conclusions

This work examined biometric authentication on smartphones with a particular focus on face recognition systems and the security challenges they encounter in real-world deployments. Guided by the three research questions introduced in Introduction, the review provided a structured analysis of the current attack landscape, common exploitation techniques, and the effectiveness of existing mitigation methods.

RQ1—Understanding the Attack Surface was addressed through an overview of smartphone-based facial recognition pipelines, including detection, preprocessing, feature extraction, and matching. We analyzed how modern mobile devices integrate facial sensors and highlighted the vulnerabilities inherent to these components. Figure 2 and Figure 3 support this system-level perspective.

RQ2—Identifying Common Exploits was examined by systematically categorizing presentation and digital attacks, including photos, videos, masks, replay attacks, adversarial perturbations, and morphing. Section 3, supported by Figure 4, outlined how both physical artifacts and digital manipulations can subvert mobile face authentication systems. The review also incorporated recent insights into dynamic attack patterns, emphasizing how environmental variability and acquisition conditions create new opportunities for spoofing.

RQ3—Evaluating Mitigation Strategies was addressed in Section 4 and Section 5, where we reviewed software-based defenses (e.g., CNNs, liveness detection, rPPG, and transformer-based methods), hardware-assisted countermeasures, and hybrid models. Table 2 and Table 3 summarized performance across datasets and model types, providing a comparative perspective on APCER/BPCER, generalization behaviour, and, in cases where available, computational characteristics relevant to mobile settings.

Table 3. Comparative Performance Analysis.

Paper	Performance	Time	Parameters	Memory
Yu et al. [8]	0.53 GFLOPS	-	0.27 MB	-
Almeida et al. [15]	Moto G5 (2017)	197.75 ms	-	50 MB
Lim et al. [39]	-	43 ms	-	-
Nguyen-Xuan et al. [16]	Jetson Xavier Development Kit	≤25 ms	-	≤1.6 GB

6.1. Meta-Analysis of Recent Trends

A central observation emerging from this review is that the field is undergoing a clear paradigm shift. Earlier face anti-spoofing research predominantly evaluated algorithms under controlled conditions, relied on fully supervised closed-set learning, and emphasized accuracy on a single benchmark. By contrast, recent work increasingly focuses on:

• Generalization to unseen spoof types, including one-class, zero-shot, and prompt-based approaches.
• Robustness under domain shift, reflecting realistic variations such as indoor/outdoor illumination, selfie vs. frontal acquisition, motion blur, compression artifacts, and device heterogeneity.
• Unified models capable of addressing both physical and digital attacks, including hybrid spoofing and deepfake-based threats.
• Quality-aware and context-aware detection, where image quality, temporal stability, and dynamic cues are incorporated into prediction.
• Mobile deployment constraints, including efficiency, latency, memory footprint, and sensor limitations.

These trends indicate that the effectiveness of future anti-spoofing systems will be measured not only by controlled-setting APCER/BPCER values but also by their resilience under real-world environmental variability, their ability to detect novel attacks, and their suitability for on-device deployment. Key future directions include developing standardized cross-domain evaluation protocols, investigating computationally efficient models suitable for mobile hardware, constructing demographically balanced datasets, improving dataset diversity, and advancing multi-modal and unified detection frameworks. Additionally, the growing threat posed by diffusion-based spoofing and deepfake technologies underscores the need to design defenses capable of distinguishing genuine biometric signals from synthetically generated content.

6.2. Final Remarks

Taken together, this review maps the major components of the smartphone face authentication ecosystem, attacks, vulnerabilities, and defenses, while highlighting broader trends that shape the field. By synthesizing findings across diverse studies and identifying persistent challenges, the work provides both a comprehensive snapshot of the current landscape and a foundation for future developments aimed at improving the security, robustness, and deployability of face recognition systems on mobile devices.