CPG-PAD: Concept-Informed Prompts Guided Presentation Attack Detection¶

🕒 Published (v1): 2026-07-01 15:33 UTC · Source: Arxiv · link

Why this paper was selected

Concept-informed prompting for face PAD; practical VLM prompting technique for security-critical vision

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

TL;DR¶

CPG-PAD improves cross-domain face Presentation Attack Detection (PAD) by using XAI to automatically mine visual concepts from CLIP's feature space and then injecting those concepts—not human-designed text—into learnable prompts. A Visual-Prompt Decoder (VPD) aligns prompt features with per-image concept heatmaps via a concept-mapping loss. On nine benchmark datasets, CPG-PAD achieves state-of-the-art generalization under multi-source, limited-source, and single-source domain-generalization protocols.

Problem¶

CLIP-based PAD methods learn prompts supervised only by binary class labels (real/fake), causing the learned representations to overfit domain-specific artifacts (sensor characteristics, lighting) rather than capturing transferable, attack-discriminative cues. Human-authored text prompts cannot convey fine-grained attack signals such as subtle geometric distortions or illumination-reflection discrepancies that are visually salient but linguistically intractable.

Method¶

Two-stage pipeline:

Stage 1 — Visual Concept-driven Enhancement (VCE). A frozen CLIP visual encoder maps 64×64 image patches cropped from training data into intermediate activations $A \in \mathbb{R}^{N_a \times H \times W \times C}$. Average-pooled activations $\bar{A} \in \mathbb{R}^{N_a \times C}$ are factorized via Semi-NMF into $K$ concept bases $W \in \mathbb{R}^{C \times K}$ and coefficients $U$ by solving: $$(\hat{U}, W) = \arg\min_{U \geq 0,\, W} \| \bar{A} - UW^\top \|_F^2$$ For each full training image, per-position coefficients $U(s,t) \in \mathbb{R}^K$ are solved with $W$ fixed, producing standardized concept heatmaps $H_{\mathrm{gt}}(k) = (U(\cdot,\cdot,k) - \mu) / \sigma$.

Stage 2 — Prompt-based Concept Injection (PCI). Learnable prompts $S$ concatenate fixed class-wise CLIP embeddings ("A photo of a real/fake face") with $J$ learnable embedding vectors $\{T_j^{\mathrm{prompt}}\}_{j=1}^J$. A Visual-Prompt Decoder (VPD) interleaves multi-head self-attention (MSA) on image tokens $V_{\mathrm{img}}$ and prompt features $F = \mathrm{TextEnc}(S)$, followed by a multi-head dual-attention (MDA) module that produces a shared attention map $\mathrm{Attn} \in \mathbb{R}^{HW \times J}$ and decodes it into predicted heatmaps $H_{\mathrm{dec}}$. A concept-mapping loss $\mathcal{L}_M$ aligns $H_{\mathrm{dec}}$ with $H_{\mathrm{gt}}$ using the Hungarian algorithm to find the optimal permutation over $J$ prompts. Classification uses similarity between prompt features $F^{r/f}$ and the CLS token, followed by a linear projection with cross-entropy loss $\mathcal{L}_{\mathrm{cls}}$.

Key Contributions¶

CPG-PAD: a framework that replaces human-designed text supervision with model-level XAI concept supervision for VLM-based PAD prompt learning.
VCE: automatic discovery of PAD-relevant visual concepts via Semi-NMF factorization of CLIP activations, plus per-image concept heatmap generation.
PCI + VPD: a decoder that injects concept heatmaps into learnable prompts through a novel multi-head dual-attention mechanism.
Concept-mapping loss with Hungarian-algorithm matching to optimally align $J$ decoded heatmaps to $K$ discovered concepts.
Demonstrated SOTA on nine benchmark datasets across multi-source, limited-source, and single-source DG-PAD settings.

Results¶

Concept discovery stability: average Top-5 cosine similarity = 0.9710 (vs. random baseline 0.0552) across four datasets (C, M, O, I) and $r \in \{1, 2, 3\}$ frames-per-video, confirming reproducibility of the discovered concept bases (Table I).
Specific cross-domain HTER/AUC benchmark numbers are not present in the provided text excerpt; the paper reports SOTA in multi-source, limited-source, and single-source DG-PAD protocols across nine datasets, outperforming FLIP, TF-FAS, CCPE, and other CLIP-based baselines.

Limitations¶

$K$ (number of concepts) and $J$ (number of learnable prompts) are hyperparameters requiring dataset-specific tuning.
VCE requires an offline preprocessing pass over each source domain; concept bases $W$ are computed from a sampled subset ($r$ frames per video), which is only an approximation of domain-level concepts.
Semi-NMF concept discovery is done on intermediate CLIP activations from a frozen encoder; if the CLIP backbone changes, the concept bases must be recomputed.
Evaluations are restricted to face PAD; generalizability to other PAD modalities (e.g., iris, fingerprint) is not demonstrated.
The full ablation table and per-benchmark numerical results are not fully present in the provided text.

Relevance to Vision-Language Models¶

CPG-PAD is a direct contribution to prompt-learning methods built on CLIP, demonstrating that supervision derived from the model's own internal feature-space concepts (via XAI) yields more transferable representations than class-label–supervised prompts. It introduces a novel use of Semi-NMF factorization on VLM activations as a form of self-supervised concept extraction, generalizing the idea of "prompt engineering" from human semantics to machine-interpretable feature semantics. The VPD mechanism—cross-attending between textual prompt features and visual image tokens to decode spatial heatmaps—offers a reusable architectural pattern for grounding VLM prompts in spatial, fine-grained visual structure. This work directly extends the FLIP/CLIP-PAD line and informs the broader question of how to elicit domain-invariant knowledge from pretrained VLMs for security-critical downstream tasks.