# Tomatoes, Potatoes, and Onions: Questioning the Need for Faces in Face Presentation Attack Detection

arXiv: https://arxiv.org/abs/2608.21455 · HTML: https://mlsanity.com/paper/2608.21455/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 9 of its 26 references that are in the map.
- First posted on arXiv 20 Aug 2026.

## Builds on (most cited first, 9 of 9)

- [Learning Deep Models for Face Anti-Spoofing: Binary or Auxiliary Supervision](https://mlsanity.com/paper/1803.11097/) (2018)
- [CelebA-Spoof: Large-Scale Face Anti-Spoofing Dataset with Rich Annotations](https://mlsanity.com/paper/2007.12342/) (2020)
- [NAS-FAS: Static-Dynamic Central Difference Network Search for Face Anti-Spoofing](https://mlsanity.com/paper/2011.02062/) (2020)
- [Face De-Spoofing: Anti-Spoofing via Noise Modeling](https://mlsanity.com/paper/1807.09968/) (2018)
- [Revisiting Pixel-Wise Supervision for Face Anti-Spoofing](https://mlsanity.com/paper/2011.12032/) (2020)
- [Real Masks and Spoof Faces: On the Masked Face Presentation Attack Detection](https://mlsanity.com/paper/2103.01546/) (2021)
- [SynthASpoof: Developing Face Presentation Attack Detection Based on Privacy-friendly Synthetic Data](https://mlsanity.com/paper/2303.02660/) (2023)
- [FoundPAD: Foundation Models Reloaded for Face Presentation Attack Detection](https://mlsanity.com/paper/2501.02892/) (2025)
- [SynFacePAD 2023: Competition on Face Presentation Attack Detection Based on Privacy-aware Synthetic Training Data](https://mlsanity.com/paper/2311.05336/) (2023)

## Abstract (arXiv)

Face presentation attack detection (PAD) is traditionally formulated as a face-specific problem, although many of the visual artifacts introduced by print, replay, and recapture processes are not inherently tied to facial appearance. In this work, we investigate whether transferable PAD representations can be learned without using faces during downstream PAD training. To this end, we introduce TPO, a controlled face-free presentation attack dataset consisting of bona fide, print, and replay recordings of, almost randomly chosen, tomatoes, potatoes, and onions acquired under protocols that closely mirror conventional face PAD datasets. Using a foundation-model-based PAD architecture, we demonstrate that a detector trained on TPO achieves an average AUC of 92.70% across four standard cross-dataset face PAD benchmarks, outperforming training on synthetic faces and remaining competitive with models trained on real face datasets. Conversely, models trained on face PAD datasets transfer consistently above chance to TPO, suggesting that the learned representations capture characteristics of the presentation process rather than object semantics. Furthermore, incorporating TPO into conventional face PAD training consistently improves cross-dataset performance under fixed optimization budgets, indicating that face-free data provides complementary information rather than simply additional training samples. Finally, representation and frequency analyses provide further evidence that transferable PAD representations cannot be explained by a single spectral artifact but instead encode richer presentation cues shared across object categories. Together, these results provide empirical evidence that transferable presentation attack representations can be learned independently of facial content, opening new opportunities for privacy-preserving and identity-independent PAD development.