A complete biometric system ensures that only authorized individuals can access mobile devices. Face biometrics is a natural, user-friendly, and non-intrusive authentication method, making it a powerful biometric trait. However, recent studies have revealed its vulnerability to spoofing attacks, including printed photos, video replays, and 3D face masks. This paper proposes using the HMAX model to detect spoofing based on facial texture analysis. HMAX, inspired by the biological visual processing chain from the retinal stage to the inferotemporal cortex, encodes facial features sensitive to expressions and gaze direction. We further enhance this method by integrating HMAX with Long Short-Term Memory (LSTM) networks to build a spatio-temporal representation of facial dynamics for improved spoof detection. Extensive experiments on standard datasets demonstrate the feasibility and efectiveness of the proposed approach compared to state-of-the-art algorithms. Several experiments performed on real face images from standard datasets, also compared with state of the art algorithms, demonstrate the feasibility of the proposed approach in real applications.
trated in Figure 1.
Biometric systems have become an essential component of security and authentication processes, with face recognition being one of the most widely adopted modalities. However, the increasing reliance on face recognition technology has also made it a target for spoofing attacks, where malicious actors attempt to deceive the system using fake representations of a legitimate user. These attacks, known as Presentation Attacks (PAs), pose a significant threat to security-sensitive applications, such as access control, banking transactions, and airport security. Presentation Attack Detection (PAD), commonly referred to as anti-spoofing detection, has Figure 1: An example of spoofing in a real-world case. emerged as a critical area of research to counteract these threats[1]. The goal of PAD is to distinguish between genuine and fake faces using various techniques, including To address these security concerns, researchers have motion analysis, texture-based feature extraction, and explored various methodologies for PAD, categorized deep learning approaches. Spoofing attacks can take mul- broadly into traditional and deep learning-based aptiple forms, including printed photos, digital screen re- proaches. One of the earliest approaches to PAD inplays, 3D masks, and even highly sophisticated deepfake- volves analyzing the texture and quality of facial images. generated faces[2]. A well-documented real-world case Artur Costa-Pazo et al.[1] introduced two algorithms occurred in 2011 when a passenger successfully boarded that leverage image-quality measures and texture analya flight from Hong Kong to Canada by disguising himself sis with Gabor-Jets filters for spoofing detection. Their as an elderly man using a high-quality mask, exposing study found that using an SVM-RBF classifier[ 3, 4, 5] vulnerabilities in biometric security measures, as illus- resulted in an Equal Error Rate (EER) of 2.68%, demonstrating the efectiveness of such feature-based methods.
SYSTEM 2025: 11th Sapienza Yearly Symposium of Technology, Engi- Similarly, Boulkenafet et al.[6] proposed a color texture neering and Mathematics. Rome, June 4-6, 2025 analysis technique utilizing the Color Local Binary Pata$hmsoeuda.tdib.kehrmellaacti@neu@niuvn-iuvs-tboi.sdkzr(aS.d.zK(hAe.llTati-bKeirhmeal)c;ine) tern (LBP) descriptor, which captures fine luminance 0000-0002-9586-6522 (S. Khellat-Kihel); 0009-0004-4729-7128 variations between genuine and spoofed images. Their (A. Tibermacine) method achieved an EER of 0.4% on the Replay-Attack © 2025 Copyright for this paper by its authors. Use permitted under Creative Commons License database and 6.2% on the CASIA database, highlighting Attribution 4.0 International (CC BY 4.0). the potential of handcrafted feature extraction techniques SURF [39], Spoofing in the Wild (SiW)[ 40], and OULUfor PAD. NPU[41], which contain extensive variations of spoofing
Another prominent approach to PAD involves motion- attempts such as print attacks, replay attacks, and 3D
based methods that focus on liveness detection, as gen- mask attacks. However, a persistent challenge in PAD
uine faces exhibit dynamic patterns that are dificult to research is domain adaptation, as models trained on one
replicate in spoofing attacks. Chengyan Lin et al.[ 7] in- dataset may not generalize well to unseen attack types.
troduced a method based on the rank of sample matrices, To tackle this issue, Yu et al.[42] introduced a domain
observing that spoofed images have low-rank structures adaptation framework designed to improve cross-dataset
due to minimal frame variations, whereas live samples generalization, addressing the problem of dataset bias in
display higher rank values resulting from natural facial PAD systems.
movements such as blinking and lip motion[
With the rise of deep learning, convolutional neural spoofing datasets, we strive to enhance the generalizanetworks (CNNs) have significantly improved PAD per- tion capability of PAD systems while maintaining high formance. Deep learning has also been widely applied in accuracy against various attack types. various domains such as computer vision[13, 14], robotic The remainder of this paper is structured as follows. control[15], brain-computer interface (BCI)[16, 17, 18], Section 2 presents our proposed methodology, including EEG analysis[19, 20, 21], and sentiment analysis[22, 23, the implementation details of the HMAX model and its 24, 25, 26, 27], demonstrating its ability to extract mean- application to spoofing detection. Section 3 describes ingful representations from complex data structures. the dataset and protocols used. Section 4 discusses the Leveraging these advancements, Jianwei Yang et al. [28] results. Finally, Section 5 concludes the paper with key proposed a deep CNN architecture that learns discrimi- findings and future research directions. native features for classifying real and fake faces. Their model achieved an HTER of less than 5% on both the CASIA and Replay-Attack databases. More recent works, 2. Proposed Approach such as that of Liu et al. [29], introduced a hybrid CNNRNN model to capture both spatial and temporal depen- In this section we highlight the diferent proposed stages dencies in facial videos, yielding state-of-the-art results corresponding to the anti-spoofing detection algorithm. across multiple datasets[30, 31, 32]. Similarly, Shao et At first glance, the HMAX network is a biologicallyal. [33]] explored a multi-modal framework that com- inspired network which has been conceived to mimic bines RGB, depth, and infrared (IR) imaging to enhance the basic neural architecture of the ventral stream of the the robustness of PAD systems against varying attack visual cortex. Also, the texture extracted with HMAX scenarios.attack scenarios[34, 35]. has a high discrimination performances. The general
Inspired by the human visual system, researchers have proposed architecture is depicted in Figure. 2. also investigated biological models for feature extraction in PAD. One such model is the Hierarchical Model and 2.1. Feature extraction based on X (HMAX), which simulates the ventral stream of the hierarchical network visual cortex [36] and is particularly adept at capturing texture information[37, 38]. The HMAX model is based The HMAX model is an hierarchical model for object on a hierarchical structure that processes visual inputs representation and recognition inspired by the neural through simple and complex cells, mimicking the way the architecture of the early stages of the visual cortex in the brain interprets object textures. In this work, we propose primates. The general architecture of the HMAX model to apply the HMAX model to cropped face images for is represented in Figure. 3. Proceeding to the higher texture-based spoofing detection, leveraging its ability levels of the model, the number and typicality of the to extract highly discriminative features. extracted features change. Each layer is projected to the
Recent advances in PAD have been supported by the next layer by applying template matching or max pooling availability of large-scale spoofing datasets, enabling re- iflters. Proceeding to the higher levels of the model, the searchers to develop robust models that generalize across number of (X,Y) pixel positions in a layer is reduced. The diverse attack types. Notable datasets include CASIA- input to the model is the gray level image. S1 and C1 (, ) = ( − (2 2 2) )(
) 2 2 2
Where X=xcos -ysin and Y=xsin +ycos . x and y vary between -5 and 5, and varies between 0 and .
(1)
(2)
[
(3)
The last layer of the architecture is the Global Invariance layer (C2). The maximum response to each intermediate feature over all (X,Y) positions and all scales is calculated. The result is a characteristics vector that will be used for classification. For the implementation of the HMAX model we use the tool proposed in [43]. 2.2. Classification Firstly, we extract features using HMAX, then we add the Long-Short Term Memory (LSTM) with the extracted features as inputs to capture the temporal dynamic information for diferentiation of genuine and fake faces. Each LSTM unit has a memory cell () and three gates [44]: the input gate (), output gate () and forget gate ().
The memory cell () could store and output information allowing it to better discover long-range temporal relationships. LSTM mechanism is presented in Figure 4. ℎ = () ⨀︀ cell output
Diferent databases have been proposed for presentation attack detection (PAD) or anti-spoofing face detection. However, most existing ones are not dedicated in realistic conditions. The publicly available OULU-NPU face presentation attack database [45] consists of 5940 videos corresponding to 55 subjects recorded in three diferent environments (sessions) using high-resolution frontal cameras of six diferent smartphones. The high-quality of print and video replay attacks was created by two different printers and two diferent devices. Figure 5 shows examples corresponding to real accesses and attacks captured with a Samsung Galaxy S6 edge phone.
The gates serve to modulate the interactions between the memory cell itself and its enviornment. The input gate can allow incoming signal to alter the state of the memory cell or block it. On the other hand, the output gate can allow the state of the memory cell to have an efect on other neurons or prevent it.Finally, the forgot gate can modulate the memory cell’s self-recurrent connection, allowing the cell to remember or forget its previous state, as needed. we used and ℎ as input and output vector respectively for timestep t, T are input weights matrices, R are recurrent weight matrices and 1 b are bias vectors. Logic sigmoid () = ( 1+− ) and hyperbolic tangent () = ( − − ) are element-wise +− non-linear activation functions, mapping real values to (0,1) and (-1,1) separately. The dot product and sum of two vectors are denoted with ⨀︀ and ⨁︀ respectively. Given inputs , ℎ− 1 and − 1, the LSTM unit updates for timestep t are: = ( + ℎ− 1 + ) cell input = ( + ℎ− 1 + ) input gate = ( + ℎ− 1 + ) forgetgate = ⨀︀ + − 1 ⨀︀ cell state = (∘ + ∘ ℎ− 1 + ∘ ) output gate
Four protocols have been cited for this database [45] corresponding to the illumination variation efect, diferent displays and printers, the efect of camera device variation and the last protocol comprises all the previous ones. A challenge has been proposed to evaluate diferent PAD algorithms under some real-world variations, on the OULU-NPU dataset using its standard evaluation protocols and metrics. We tested the proposed anti-spoofing system on the diferent protocols proposed for the OULU-NPU dataset [45]. The protocols are defined as follow: Protocol I: The first protocol is designed to evaluate the PAD methods under diferent environmental conditions, namely illumination and background scene. The database is recorded in three sessions.
Protocol II: The main goal in this protocol is to test attacks obtained from diferent resources (printers or displays). The efect of attack variation is evaluated by using unseen print and video-replay attack during the test phase.
Protocol III: The third protocol is dedicated to one of the critical issues in face PAD which is sensor interoperability. In each iteration, real and attack videos
The NUAA database [39] is publicaly available photograph imposter database. This database has been collected in three diferent sessions with an interval of 15 days between the two sessions was conducted and the place and illumination conditions of each session are different. The database is composed of 15 subjects. Some example of images are depicted in Figure 6. The distribution of the train set and the test is represented in Table I. obtained from five smartphones are used to run the algorithms. However, the models are constructed using = ∑︀=1 (5) the videos recorded with the remaining one. Protocol IV: The last protocol englobes all the cases Where ,is the number of the attack presentawhich are seen in the previous three protocols. General- tions for the given PAI, is the total number of the ization of the face anti-spoofing algorithms is evaluated bona fide presentations. takes the value of 1 if the with previously unseen environmental conditions, ith presentation is classified as an attack presentation attacks and input sensors. and 0 is classified as bona fide presentation. These two metrics correspond to False Acceptance Rate (FAR) and False Rejection Rate (FRR) commonly used in biometrics evaluation systems. Also, Average Classification Error Rate (ACER) is proposed in the challenge conducted in [41], which is the average of the APCER and the BPCER.
For performance evaluation we used a recent standardized ISO/IEC 30107-3 metrics proposed in [46] to compare the proposed framework with the various presented results.These metrics consists of Attack Presentation Classification Error Rate (APCER) and Bona Fide Presentation Classification Error Rate (BPCER), Equation (4) and (5) represent the APCER and BPCER metrics respectively.
=
1 ∑ ︁ (1 − ) =1 (4)
In this section we summarized the diferent works conducted in the challenge to assume the efectiveness of proposed system. In [41], a detailed algorithm description applied to the OULU-NPU database was carried out. The described algorithms have been proposed within a challenge. Some groups use a Local Phase Quantization (MBLPQ and PML), others rely on a convolutional and deep CNN (Convolutional Neural Networks) models (VSS, NWPU, SZUCVI, Record, CPqD and mixedFASNet). In the Baseline [2], and HKBU groups proposed some systems based on LBP (Local Binary Pattern) algorithm. Furthermore, Binarized statistical image features was applied by the MFT-FAS group, while GRADIANT and Idiap groups were based on fusion between motion and texture information1. In Table 2, Table 3, Table 4 and Table 5, we propose a comparaison between the best obtained results from each category and the results obtained from our proposed approach. The category corresponds to feature extraction method such as the LBP, CNN and LPQ. For classification an LSTM network was used.
As mentioned in Table 2, Table 3, Table 4 and Table 5 the proposed architectures surpass the previous proposed methods mainly because the LSTM is based on video sequences or the features obtained during time hence the emotion in natural cases are analysed. From the obtained 1These frameworks abbreviations and metrics are used in [41] LBP CNN
LPQ
results it is obvious that the LSTM can achieve a low the research is progressing, the development of such apEER. Also, the approach is based on a biological aspect plications with a high accuracy may be a challenging not only by simulating the visual perception by HMAX task. This mainly due to the distinctiveness dificulty but also by treating the frames during time using LSTM. between the fake and genuine images even by human The LSTM showed good performances comparing to ap- eye, also the high quality of the 3D masks. In this paper, proaches based on LBP, CNN and LPQ. For the NUAA a framework based on biologically spatio-temporal repredatabase, the Fourier spectra analysis method introduced sentation has been developed to study the anti-spoofing in [47] gives a classification rate of 76.7% when the DoG based on faces. This approach is based on the combinafeatures proposed in [39] obtain about 10% higher than tion between the HMAX and the LSTM. The experimental the first approach. In our case the proposed hierarchical evaluation carried out shows a great eficiency comparing spatio-temporal representation achieve a very high per- to the proposed methods in the litterature. formances around 90% as a rate of classification between the genuine and fake faces.
5. Conclusion During the preparation of this work, the authors used ChatGPT, Grammarly in order to: Grammar and spelling The study of weaknesses of biometric systems against check, Paraphrase and reword. After using this tool/serspoofing attacks has been very active field of research vice, the authors reviewed and edited the content as in recent years. This focus has led to investigate in Anti- needed and take full responsibility for the publication’s spoofing applications based on faces. However, even if content.
9.3 1.7 8.2 2.05
11.8 5.3 15.3 4.60
14.2 5.3 15.7 6.00
8.6 7.8 15.8 3.33
11.4 6.5 15.8 1.66
19.20 10 59.2 3.00
22.5 4.2 38.3 14.80
29.2 10 61.7 15.70
23.3 35.8 13.3 7.40
26.3 22.9 37.5 5.00