Introducing Nylon Face Mask Attacks: A Dataset for Evaluating Generalised Face Presentation Attack Detection

AI summary

Overview

• Research area: Biometrics and computer vision, specifically face Presentation Attack Detection (PAD) for smartphone-based face recognition.
• Technical level: Intermediate. The dataset description is accessible, but the benchmarked methods (domain generalisation, causal modelling, vision-language models) assume familiarity with deep learning for face anti-spoofing.
• Scope: The paper introduces Nylon Face Masks (NFMs) as a new, commercially available presentation attack instrument and releases a smartphone-captured dataset with a benchmark of five state-of-the-art PAD methods under an unseen-attack protocol.

What This Paper Is About

Face recognition systems used for phone unlocking, banking, and border control can be fooled by fake faces, and detection methods often fail on attack types they have never seen. The authors introduce a new spoofing artefact, the Nylon Face Mask, made by printing a victim's face onto stretchable nylon fabric so it conforms to a wearer's face or a mannequin. Their goal is to provide a realistic smartphone-based dataset of these attacks and to measure how well existing PAD methods detect them.

Key Contributions

1. First NFM attack scenario for smartphone-based identity verification. The paper states this is the first work to propose the Nylon Face Mask as a face presentation attack instrument, exploiting its elastic structure and photorealistic printed appearance to mimic a victim's facial geometry.
2. A new dataset captured with an iPhone 11 Pro. Data collection covers 100 bona fide subjects and 28 unique NFMs (26 for male and 2 for female identities, spanning Caucasian, Asian, and African demographics), recorded across four presentation protocols involving both human participants and mannequins. The contributions section and conclusion report 3,760 bona fide samples and 51,218 NFM attack samples; the abstract reports 51,281 attack samples, a discrepancy in the paper itself. The four scenario counts sum to 51,218.
3. Benchmarking of five state-of-the-art PAD methods. Domain-Generalised for Unknown Attacks (DGUA), Gradient Alignment for Cross-Domain (GACD), Language-Guided Face Anti-Spoofing (FLIP), Learnable Multi-level Frequency Decomposition (LMFD), and Causal Features with Embedding Statistics Adaptation (CF) were evaluated under an unseen-attack protocol.
4. Commitment to public release. The authors state the dataset will be publicly released to support future research.

Main Findings

• Human frontal NFM attacks are detected best by CF. CF achieved the lowest D-EER of 1.95% ± 0.94, with BPCER of 1.94% ± 0.51 at 5% APCER and 1.78% ± 0.41 at 10% APCER. The authors attribute this to CF's causal dependency modelling and adaptive regulation of embedding statistics.
• Human back-of-head NFM attacks are detected best by DGUA. DGUA reached a D-EER of 4.43% ± 0.82, with BPCER of 3.44% ± 1.74 at 5% APCER and 1.17% ± 0.92 at 10% APCER.
• Frontal attacks are generally easier to detect than back-of-head attacks. Frontal masks introduce uniform artefacts such as facial blurring, stretching, and reduced high-frequency texture, whereas back-of-head presentations introduce variability from hairstyle, shape asymmetry, and camera positioning.
• Mannequin-based attacks favour DGUA in both views. DGUA achieved the best results with a D-EER of 4.15% ± 2.37 (front) and 3.39% ± 2.29 (back), the latter with BPCER of 3.11% ± 2.42 at 5% APCER and 2.51% ± 2.53 at 10% APCER.
• GACD degraded severely across every scenario. Its reported D-EERs were 17.41% ± 20.82 (human front), 28.40% ± 32.13 (human back), 20.00% ± 24.85 (mannequin front), and 20.18% ± 23.66 (mannequin back), with large standard deviations.
• FLIP and GACD struggled most on mannequins. FLIP reported 15.67% ± 6.37 (mannequin front) and 14.87% ± 5.04 (mannequin back), suggesting methods relying on large-scale pretraining or gradient alignment are sensitive to low-frequency surface texture and lighting artefacts.
• CF was less stable on mannequins than on humans. CF reported 6.66% ± 1.48 (mannequin front) and 6.23% ± 1.03 (mannequin back), which the authors link to reduced dynamic facial cues when masks are worn on inanimate heads.
• LMFD was consistently mid-range. Its D-EERs were 12.57% ± 0.91 (human front), 9.19% ± 1.29 (human back), 12.51% ± 1.85 (mannequin front), and 11.12% ± 1.45 (mannequin back).
• Mannequin results were more uniform across algorithms than human results, and back-side mannequin presentations produced lower D-EERs, which the authors suggest stems from geometric distortion and simplified background context giving more consistent spoof cues.

Methodology in Plain English

The researchers bought 28 nylon face masks from a commercial vendor on Etsy. Each mask is made by printing a high-resolution image of a target identity onto stretchable nylon using sublimation printing. The paper notes that, because printing was handled by a third-party vendor, the resolution or DPI of the printed face images is not disclosed and remains unknown.

Data was collected over three months in indoor office environments mixing natural daylight and artificial lighting, with the iPhone 11 Pro as the primary capture device. Bona fide data came from 100 subjects (52 male, 48 female, Asian demographic, aged 20 to 72) across three sessions; participants removed spectacles and facial accessories, and recorded one-to-two-second selfie videos with the front camera. Each video was processed into five representative frames, producing 3,760 bona fide face images.

Attack data covered four protocols. For human presentations, 25 participants wore masks on the frontal face and on the back of the head: frontal videos used the front camera by the same selfie protocol, while back-of-head videos were recorded by an assistant using the rear camera. This yielded 11,627 frontal images and 20,794 back-of-head images. For mannequin presentations, three different mannequins were used with the same front/rear camera split, yielding 9,375 frontal images and 9,422 back-of-head images.

Evaluation used an unseen-attack protocol with no training on the new data. Five pre-trained PAD models were taken as-is; each had been trained on three of four public datasets (OULU-NPU, MSU-MFSD, Replay-Attack, CelebA-Spoof) under a leave-one-dataset-out scheme and was applied directly to the NFM data. Performance is reported as mean and standard deviation over four runs using ISO/IEC 30107-3 metrics: APCER, BPCER, and Detection Equal Error Rate (D-EER), where D-EER is the point at which BPCER equals APCER. Detection Error Tradeoff (DET) curves with mean and standard deviation are also reported for the human-presented experiments.

Why This Matters

Impact on research. Progress in PAD depends on datasets that capture realistic and diverse attack types. The paper argues that many existing benchmarks offer limited diversity in capture conditions, attack materials, and device characteristics, particularly for smartphone-based face recognition. By introducing a new attack instrument and releasing a corresponding dataset, the work gives the community a fresh generalisation test for methods that already perform well on older benchmarks.

Real-world applications:

• Smartphone authentication and device unlocking, where the front camera is the primary sensor.
• Digital banking, eKYC, and remote identity verification, which depend on liveness checks during onboarding.
• Access control in buildings and facilities using face-based entry.
• Border control and surveillance, including the shoulder-surfing and unconventional presentation angles the paper mentions for back-of-head mask wear.

Industry relevance. The masks are lightweight, elastic, low cost, and easily ordered online, which the authors explicitly flag as evidence that such attacks are feasible in practice. Because the dataset and benchmark target a commercially accessible attack instrument, results are directly relevant to vendors selecting PAD models for deployment, and the wide spread between best and worst methods (for example, D-EERs from 1.95% to 28.40% on human back-side attacks) indicates that model choice materially changes security outcomes.

Future Directions

1. Expand the dataset with additional presentation attack instrument variants and capture conditions beyond the current four protocols.
2. Apply multimodal learning and vision-language foundation models to improve generalisation across attack domains, which the authors name as a planned direction.
3. Develop PAD systems that handle texture and motion discrepancies together, since the authors observe that mannequins remove natural facial dynamics and shift the distribution of spoofing artefacts.
4. Investigate the front-versus-back performance gap and the large variance in methods such as GACD, both of which remain unexplained by the current results and raise questions about what features PAD models actually rely on.

Target Audience

This paper benefits PAD and biometric security researchers, graduate students working on face anti-spoofing or domain generalisation, and practitioners evaluating liveness detection for smartphone-based identity systems. It is also relevant to standards and evaluation groups interested in new attack instruments, and to industry teams that need benchmarks reflecting low-cost, real-world spoofing threats rather than only legacy print and replay attacks.

Authors’ abstract

Face recognition systems are increasingly deployed across a wide range of applications, including smartphone authentication, access control, and border security. However, these systems remain vulnerable to presentation attacks (PAs), which can significantly compromise their reliability. In this work, we introduce a new dataset focused on a novel and realistic presentation attack instrument called Nylon Face Masks (NFMs), designed to simulate advanced 3D spoofing scenarios. NFMs are particularly concerning due to their elastic structure and photorealistic appearance, which enable them to closely mimic the victim's facial geometry when worn by an attacker. To reflect real-world smartphone-based usage conditions, we collected the dataset using an iPhone 11 Pro, capturing 3,760 bona fide samples from 100 subjects and 51,281 NFM attack samples across four distinct presentation scenarios involving both humans and mannequins. We benchmark the dataset using five state-of-the-art PAD methods to evaluate their robustness under unseen attack conditions. The results demonstrate significant performance variability across methods, highlighting the challenges posed by NFMs and underscoring the importance of developing PAD techniques that generalise effectively to emerging spoofing threats.