Face anti-spoofing (FAS) on mobile devices requires models that are not only accurate and robust across domains but also optimized under strict SWAP (Speed, Weight, Accuracy, Power) constraints. Current approaches often face a trade-off: strong generalization relies on additional modalities such as depth or rPPG signals, but mobile deployment can only afford lightweight RGB-only models. In this paper, we propose a privileged-information knowledge distillation (PI-KD) framework that enables multi-teacher supervision during training while keeping the deployment student efficient and mobile-friendly. Specifically, we outline how temporal teachers (rPPG-based) and geometric teachers (depth-based) can transfer complementary supervisory signals into a compact RGB-only student model. We discuss expected advantages for cross-dataset generalization, robustness to unseen attacks, and SWAP trade-offs, and we propose evaluation protocols that future empirical work should adopt. Our contribution lies in presenting a methodology that bridges privileged multimodal supervision with practical on-device constraints, opening a pathway toward more reliable and efficient mobile face anti-spoofing systems.
Face anti-spoofing (FAS) is a critical safeguard in mobile biometric authentication, where decisions must be both reliable and resource-efficient. Production systems must optimize SWAP metrics: Speed (latency),
(model size/memory),
(PAD
metrics
such
as
APCER/BPCER/ACER/RIAPAR), and Power (energy consumption per inference). The ISO/IEC
30107-3 test methodology formalizes PAD error metrics and evaluation protocols, anchoring how
operating points are compared in practice [
A principled way to bridge this gap is Learning Using Privileged Information (LUPI): during
training, a “Teacher” may access auxiliary information not available at test time, while the
deployed “Student” obeys the standard runtime contract (e.g., RGB-only). LUPI formalizes how
such additional signals can shape decision boundaries and accelerate learning without altering the
inference interface [
To realize a deployable solution, we propose to adopt knowledge distillation as the compression
mechanism – transferring the behavior of one or more teachers into a compact student that
preserves accuracy while meeting mobile constraints [
This work proposes a privileged-information, multi-teacher distillation scheme that trains on multi-modal supervision (available only during training) while deploying a single RGB-only student optimized under SWAP constraints. We formalize the task, models, objective, and constraints below.
Let x ∈ X RGB denote an RGB video clip (or short sequence of frames) captured by a mobile camera, and y ∈{0 , 1 } the PAD label (0: attack, 1: bona fide). During training (only), we assume access to privileged signals tied to the same clip: zrPPG – temporal/physiological cues (e.g., rPPG traces or features) zgeom – geometric cues (e.g., depth/landmarks)
Training data thus form Dtrain=( xi , yi , zirPPG , zigeom , si)iN=1, where si indicates the source domain
(sensor, PAI type, capture condition). At deployment, only x is available, meaning that the target
domain may be unseen. Performance is evaluated with PAD metrics (APCER, BPCER, ACER) as
formalized in ISO/IEC 30107-3 [
Student f θ : X RGB →[
This setting follows Learning Using Privileged Information (LUPI) – auxiliary signals guide
learning but are absent at test time [
The student is trained with standard classification on hard labels with binary cross-entropy to establish a strong baseline decision surface. Let σ (· / T ) denote softmax at temperature T . Then, classification loss can be described using formula 1:
Lcls= 1 ∑N BCE ( yi , f θ ( xi)) (1)
N i=1 where xi is the RGB input sample; yi∈{1,0 } (1 = bona fide, 0 = attack); f θ ( xi) is the student’s predicted probability for bona fide; N is the number of training samples; BCE is Binary Cross Entropy.
We align the student’s softened outputs with both temporal (rPPG) and geometric (depth/landmark) teachers using KL divergence; the temperature T >0 and weights α , β control the strength of each signal.
Llogit= 1 ∑N (α KL(σ (t ω( xi)/ T )∥σ ( f θ ( xi)/ T ))+ β KL(σ ( gψ ( xi)/ T )∥σ ( f θ ( xi)/ T ))) (2)
N i=1 where t ω( xi) and gψ ( xi) are logits from the temporal (rPPG) and geometric (depth/landmark) teachers; C is the number of classes (for PAD, C =2); α , β ≥ 0 are distillation weights; T >0 is the temperature.
To further transfer inductive biases, we could match intermediate representations: student features may be projected and pulled toward each teacher’s features with squared L2 penalties weighted by γ , δ:
Lfeat= 1 ∑N ( γ‖Pθ ϕθ ( xi)− Pω ϕω( xi)‖22+ δ‖Pθ ϕθ ( xi)− Pψ ϕψ ( xi)‖22) (3)
N i=1 where ϕθ , ϕω , ϕψ are student/teacher feature vectors; Pθ , Pω , Pψ are linear projections to a shared feature space; ‖u‖22 denotes the squared L2 norm; γ , δ ≥ 0 are feature-distillation weights.
The final objective sums the classification term, dual logit-distillation, and (optionally) featuredistillation; only the student is deployed at inference.
minθ L= Lcls+ Llogit + Lfeat with hyperparameters : α , β , γ , δ , T (4)
This formulation supports domain-generalization by (1) leveraging complementary privileged
cues during training [
Let the measured deployment characteristics on a target device be:
L(θ) – latency (ms/inference) W (θ) – model size or peak memory (MB) E (θ) – energy (mJ/inference)
Err (θ , τ ) – PAD error at operating point τ (e.g., ACER computed per [
Then we get the optimization view:
minθ ,τ Err (θ , τ )+ λL L(θ)/ Lmax + λW W (θ)/ W max + λE E (θ)/ Emax
(5)
where Lmax , W max , Emax encode the deployment constraints, which are device and app-specific;
the operating point τ is the decision threshold which should be selected according to [
Although this paper is a method proposal, a future study validating the approach should report:
Accuracy: APCER/BPCER/ACER or other metrics at specified τ per [
Speed & Weight: on-device latency and model size of the student.
Power: energy per inference of the student (mJ/inference).
Ablations: effect of each teacher (set α =0 or β =0); effect of feature-level vs. logit-level distillation.
Pareto analysis: Accuracy over Latency and Accuracy over Energy curves to illustrate SWAP trade-offs.
Early deep FAS systems commonly treat spoof detection as binary RGB classification, which is
attractive for mobile deployment but fragile under cross-dataset shift. Surveys consistently report
that purely RGB, label-only training tends to overfit to capture artifacts and backgrounds,
degrading robustness when the camera, illumination, or PAI species changes [
A major step forward was auxiliary/privileged supervision: Liu et al. [
The Learning Using Privileged Information (LUPI) paradigm formalizes exactly this situation:
richer signals may be used during training to shape the student’s decision boundary, while the
deployed interface remains RGB-only [
Knowledge distillation (KD) is the practical mechanism to compress teacher behavior into a small
student with little or no runtime overhead. Classic KD uses temperature-softened targets to
transfer “dark knowledge”, improving the accuracy of compact models. Recent FAS work applies
KD explicitly to efficiency: a head-aware Transformer KD compresses to ~5 MB while remaining
competitive, combining logit-level and feature-level terms. However, existing KD for FAS typically
relies on single-teacher RGB supervision, leaving rPPG and depth advantages on the table [
For on-device use, students should be instantiated with mobile-efficient backbones. MobileNetV3
[
When comparing systems, ISO/IEC 30107-3 requires reporting APCER, BPCER, ACER, and RIAPAR
at defined operating points [
Net effect: relative to RGB-only or single-teacher KD baselines, the proposed PI-KD aims to shift the SWAP Pareto front, achieving lower accuracy metrics at fixed latency, size, and energy by distilling temporal (rPPG) and geometric (depth) knowledge into a single deployable student. This directly reconciles the robustness of auxiliary supervision with the constraints of mobile inference.
This paper proposed a privileged-information, dual-teacher knowledge distillation (PI-KD) framework for mobile face anti-spoofing that explicitly targets SWAP constraints – Speed, Weight, Accuracy, and Power. The key idea is to learn from temporal (rPPG-aware) and geometric (depth and landmark-aware) teachers during training, while deploying only a compact RGB-only student on the device. We detailed the training objective (hard-label BCE and two logit-KD terms, with optional feature-KD), articulated a SWAP-aware optimization view, and outlined a standardsaligned evaluation blueprint (ISO/IEC 30107-3 operating points; cross-dataset and unseen-attack protocols; on-device latency, size, and energy with Pareto analysis).
If proved out experimentally, PI-KD should shift the Pareto frontier, delivering lower accuracy metrics at fixed latency, size, and energy, i.e., improved robustness without increasing deployment cost. By decoupling rich training-time supervision from test-time simplicity, the approach reconciles laboratory gains with real-world mobile constraints.
There are some limitations, as the approach assumes access to privileged signals (or credible surrogates) for teacher training, and introduces teacher-pretraining cost. Domain mismatch between teachers and target environments, as well as privacy considerations for physiological and depth data, must be managed.
Immediate next steps include empirical validation on OULU-NPU, SiW-M, CASIA-FASD, and CelebA-Spoof datasets under unified SWAP reporting; SWAP-U extensions that integrate calibrated uncertainty/abstention for operating-point control; test-time domain handling for training-free normalization or light adapters compatible with on-device budgets; data-centric boosts (e.g., diffusion-generated hard negatives) to widen coverage of unseen PAIs; fairness audits across demographics and cosmetics; and standardized energy-measurement protocols across Android/iOS toolchains. Together, these directions aim to turn the proposed blueprint into a deployable, reproducible, SWAP-centric path for reliable mobile PAD.