# Compact Vision Models for Iris Presentation Attack Detection under Presentation Attack Instrument Shift and Environmental Degradation

arXiv: https://arxiv.org/abs/2609.20386 · HTML: https://mlsanity.com/paper/2609.20386/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 12 of its 23 references that are in the map.
- First posted on arXiv 17 Sep 2026.

## Builds on (most cited first, 12 of 12)

- [Attention-based Deep Multiple Instance Learning](https://mlsanity.com/paper/1802.04712/) (2018)
- [TransMIL: Transformer based Correlated Multiple Instance Learning for Whole Slide Image Classification](https://mlsanity.com/paper/2106.00908/) (2021)
- [MCUNet: Tiny Deep Learning on IoT Devices](https://mlsanity.com/paper/2007.10319/) (2020)
- [Presentation Attack Detection for Iris Recognition: An Assessment of the State of the Art](https://mlsanity.com/paper/1804.00194/) (2018)
- [Synthetic Iris Presentation Attack using iDCGAN](https://mlsanity.com/paper/1710.10565/) (2017)
- [CIT-GAN: Cyclic Image Translation Generative Adversarial Network With Application in Iris Presentation Attack Detection](https://mlsanity.com/paper/2012.02374/) (2020)
- [ZACH-ViT: Regime-Dependent Inductive Bias in Compact Vision Transformers for Medical Imaging](https://mlsanity.com/paper/2602.17929/) (2026)
- [Privacy-Safe Iris Presentation Attack Detection](https://mlsanity.com/paper/2408.02750/) (2024)
- [Towards Iris Presentation Attack Detection with Foundation Models](https://mlsanity.com/paper/2501.06312/) (2025)
- [Extending ZACH-ViT to Robust Medical Imaging: Corruption and Adversarial Stress Testing in Low-Data Regimes](https://mlsanity.com/paper/2604.06099/) (2026)
- [Compact CNN Models for On-device Ocular-based User Recognition in Mobile Devices](https://mlsanity.com/paper/2110.04953/) (2021)
- [A Multi-domain Image Translative Diffusion StyleGAN for Iris Presentation Attack Detection](https://mlsanity.com/paper/2510.14314/) (2025)

## Built on by (most cited first, 1 of 1)

- [From ECG Signals to Representative-Morphology Heatmaps for Biometric Recognition](https://mlsanity.com/paper/2609.28183/) (2026)

## Abstract (arXiv)

Iris presentation attack detection (PAD) is security-critical when a subsystem that appears reliable during development encounters presentation attack instruments (PAIs) or acquisition conditions absent from validation data. We benchmark three compact scratch-trained computer-vision models, each with at most approximately 0.26 million trainable parameters, on the Notre Dame subset of LivDet-Iris 2017 under PAI-driven domain shift and environmental degradation. All models are trained without external pretraining or data augmentation and evaluated over five seeds. A validation-selected threshold is transferred unchanged to the known-attack, unknown-attack, corrupted, and pooled test partitions. From known to unknown attack presentations, Attack Presentation Classification Error Rate (APCER) increases by 17.11-30.47 percentage points and Detection Equal Error Rate (D-EER) increases by 7.38-12.73 percentage points. At the validation-selected threshold, ZACH-ViT obtains the lowest unknown-attack APCER (47.69 +/- 4.84%) and D-EER (38.87 +/- 0.93%), while Compact-TransMIL obtains the lowest Bona Fide Presentation Classification Error Rate (BPCER). ZACH-ViT also gives the lowest unknown-attack BPCER at an APCER limit of 10% (81.29 +/- 1.95%). The high absolute errors show that the comparative advantage of the best compact model does not constitute deployment readiness under unknown PAIs.