Group-wise Scaling and Orthogonal Decomposition for Domain-Invariant Feature Extraction in Face Anti-Spoofing (original) (raw)

Haeun Noh1 Jungmin Lee1 Jongwon Choi1 Corresponding author. Email: choijw@cau.ac.kr
1Chung-Ang University 2Naver Cloud

Abstract

Domain Generalizable Face Anti-Spoofing (DGFAS) methods effectively capture domain-invariant features by aligning the directions (weights) of local decision boundaries across domains. However, the bias terms associated with these boundaries remain misaligned, leading to inconsistent classification thresholds and degraded performance on unseen target domains. To address this issue, we propose a novel DGFAS framework that jointly aligns weights and biases through Feature Orthogonal Decomposition (FOD) and Group-wise Scaling Risk Minimization (GS-RM). Specifically, GS-RM facilitates bias alignment by balancing group-wise losses across multiple domains. FOD employs the Gram-Schmidt orthogonalization process to decompose the feature space explicitly into domain-invariant and domain-specific subspaces. By enforcing orthogonality between domain-specific and domain-invariant features during training using domain labels, FOD ensures effective weight alignment across domains without negatively impacting bias alignment. Additionally, we introduce Expected Calibration Error (ECE) as a novel evaluation metric for quantitatively assessing the effectiveness of our method in aligning bias terms across domains. Extensive experiments on benchmark datasets demonstrate that our approach achieves state-of-the-art performance, consistently improving accuracy, reducing bias misalignment, and enhancing generalization stability on unseen target domains. Code: https://github.com/SeungjinJung/GD-FAS

Figure 1: Bias term and weight term across domains: Decision boundaries are defined by the classifier’s weights and biases. Domain invariance maintains consistent distinguishability across domains, typically by sharing a common weight term. In contrast, domain specificity represents domain gaps arising from variations in bias terms. (a) Domain-wise contrastive loss enhances domain-specific separability with bias alignment but struggles to extract domain-invariant features. (b) SAFAS aligns local decision boundaries for improved domain invariance, yet residual domain gaps persist, particularly due to bias misalignment. (c) Our approach addresses this by jointly aligning weights and biases using Group-wise Scaling (GS) and Feature Orthogonal Decomposition (FOD), establishing a unified and consistent decision boundary.

1 Introduction

With the rapid increase in the use of Face Recognition (FR) [38, 19] technology in critical applications such as payment systems and identity verification, the security of these systems has become more important than ever. FR systems are widely used not only at airport entry points but also in personalized devices, making it critical for these systems to effectively respond to presentation attacks, where attackers employ technical methods to impersonate legitimate users. In this context, Face Anti-Spoofing (FAS) technology has emerged as an essential defense mechanism to protect FR systems.

Recent FAS studies have focused on Domain Generalizable FAS (DGFAS) to overcome the cross-domain performance drop across various domains, especially the adaptability to new environments, camera sensors, and attack types unseen during training [22, 21, 36, 31, 29, 28]. Such DGFAS research primarily focuses on representation learning to extract domain-invariant features by training models to perform effectively with a single classifier. One approach enhances representations by generating two distinct augmented patch images from the same image and aligning them in the feature space [31]. Another approach segregates domain-specific features and aligns the directional consistency between spoofness and liveness [29]. With the rise of Large Language Models (LLMs), recent studies have leveraged text embedding features extracted from LLMs as guidance to improve the extraction of domain-invariant features [28, 35, 20, 23].

Despite advancements in capturing domain-invariant features, DGFAS methods still encounter significant challenges arising from misaligned bias terms associated with local decision boundaries. As illustrated in Fig. 1-(a), contrastive loss enhances domain-specific separability and aligns bias terms across domains but fails to effectively extract domain-invariant features. In contrast, SAFAS [29] aligns classifier weights across domains yet remains limited due to persistent bias misalignment, as depicted in Fig. 1-(b). Addressing this challenge requires explicitly aligning the bias terms of local decision boundaries. A detailed discussion on resolving this bias misalignment issue is presented in Sec. 3.3.

To address this challenge, we propose a novel DGFAS framework called GD-FAS, comprising Group-wise Scaling Risk Minimization (GS-RM) and Feature Orthogonal Decomposition (FOD). GS-RM aligns the bias terms of classifiers by adaptively balancing group-wise losses across domains through a scaling factor applied at each training iteration. This approach ensures consistent separation of real and spoofed samples across multiple domains. FOD decomposes feature representations into orthogonal domain-invariant and domain-specific subspaces using the Gram-Schmidt orthogonalization process. By constraining domain-specific features to their designated subspace, FOD aligns weight terms across domains without interfering with bias alignment, as shown in Fig. 1-(c). Consequently, our method effectively aligns bias and weight across different domains, substantially enhancing domain invariance and significantly improving cross-domain generalization performance.

Furthermore, we introduce Expected Calibration Error (ECE) as an evaluation metric to quantitatively assess the reliability and effectiveness of our method in aligning bias terms across different domains. By explicitly decomposing feature representations into orthogonal domain-invariant and domain-specific subspaces, our method achieves state-of-the-art performance, significantly enhancing accuracy, reducing bias misalignment, and improving generalization stability on unseen target domains.

The significant contributions of this research are as follows:

• •
  We propose a novel face anti-spoofing approach that ensures robust and consistent performance across diverse domains by decomposing into domain-invariant and domain-specific components orthogonally.
• •
  To enhance domain invariance, we introduce Group-wise Scaling Risk Minimization (GS-RM), which employs a loss-adaptive scaling factor to align classifier bias terms by balancing learning across domains. This ensures consistent and reliable classification of real and spoof samples in multiple domain scenarios.
• •
  To mitigate the domain gap, our approach introduces the Feature Orthogonal Decomposition (FOD) mechanism, which employs a contrastive loss guided by domain indices to construct domain-specific feature spaces. By enforcing orthogonality between domain-specific and domain-invariant features, this method effectively aligns the weight terms across distinct domains while leaving the bias term.
• •
  We introduce Expected Calibration Error (ECE) to quantitatively validate the effectiveness and reliability of bias term alignment across domains. Comprehensive experiments on standard benchmarks demonstrate that our method achieves state-of-the-art performance, consistently ensuring strong adaptability and stability in unseen target domains.

2 Related Work

Figure 2: Framework overview: Our framework, based on CLIP [28], achieves domain generality by decomposing representations into invariant and specific components within the Text-Image embedding space. (1) GS-RM balances group-wise loss across domains to enhance domain invariance. (2) FOD leverages the Gram-Schmidt process to decompose domain-invariant and domain-specific components, effectively mitigating major spurious correlations. (3) The feature extractor and classifier enhance the embedding of images within the space, ensuring robust feature representation.

Face Anti-Spoofing (FAS) research aims to enhance the security of biometric authentication in facial recognition systems. Initially, FAS was studied using single-domain datasets [24, 39, 40], but this approach struggles with generalizability when encountering unseen domains. This limitation led to the development of cross-domain FAS approaches, categorized as follows: Domain Adaptation FAS (DAFAS) [32, 44, 41] and Domain Generalizable FAS (DGFAS) [22, 21, 36, 31, 29, 28]. DAFAS requires access to target datasets, whereas DGFAS does not. Therefore, DGFAS is more suitable for real-world applications.

2.1 Domain Generalizable Face Anti-Spoofing.

DGFAS is to learn common features for domain-agnostic use by training only on labeled source domain datasets. One study proposed adversarial loss and a triplet loss-based approach [14]. The patch-based method [31] makes two different augmented patches from the same image similar for learning good representation. The CLIP-based method [28] aligns an ensemble of the class description with image features for improving generality. On the other hand, the instance-level approach [45] focuses on extracting general representations by reducing the sensitivity of features to varying styles.

With the growing prominence of Large Language Models (LLMs), recent research has utilized text embedding features derived from LLMs to guide and enhance the extraction of domain-invariant features [28, 35, 20, 23]. Since these methods focus only on domain-invariant features, they struggle to account for domain-specific components embedded within invariant features, such as spurious correlations.

2.2 Invariant Learning

Machine learning models learn complex networks by minimizing training loss through Empirical Risk Minimization (ERM) [30]. However, ERM has a clear limitation for generalization, as models tend to learn biases from training data. To counter this, Invariant Risk Minimization (IRM) [2, 1] was proposed, encouraging networks to avoid dataset biases by enforcing an optimal classifier over the representation space that is consistent across multiple environments. Despite its promise, IRM still remains challenging due to the complexity of the optimization problem [17, 26]. To handle this, EQRM [6] proposed a new probabilistic aspect of the optimization problem, assuming target and test domains are drawn underlying (meta) distribution over multiple domains. Invariant learning has been adapted to diverse applications such as face anti-spoofing [27], semantic segmentation [10], and person Re-ID [15, 34].

Recently, SAFAS [29] proposed training domain-specific classifiers and aligning their directions, demonstrating that Invariant Risk Minimization (IRM) enhances domain invariance in DGFAS. However, SAFAS still suffers from unavoidable domain gaps caused by misaligned domain-specific components, particularly the classifier’s bias terms. In contrast, our approach explicitly decomposes feature representations into domain-invariant and domain-specific subspaces, effectively aligning both weights and biases to mitigate these domain gaps.

3 Methodology

3.1 Problem Setup

The goal of DGFAS is to detect spoofing or presentation attacks on datasets except those used for training. We denote the image space as 𝒳=ℝH×W×3𝒳superscriptℝ𝐻𝑊3\mathcal{X}=\mathbb{R}^{H\times W\times 3}caligraphic_X = blackboard_R start_POSTSUPERSCRIPT italic_H × italic_W × 3 end_POSTSUPERSCRIPT. Here, H𝐻Hitalic_H and W𝑊Witalic_W represent the height and width of the image, respectively, with three channels corresponding to the RGB color model to encode color information for each pixel. Each image input is labeled as 𝒴={Live⁢(0),Spoof⁢(1)}𝒴Live0Spoof1\mathcal{Y}=\{\textit{Live}(0),~{}\textit{Spoof}(1)\}caligraphic_Y = { Live ( 0 ) , Spoof ( 1 ) }, and the dataset’s domain type is denoted as ℰ={1,⋯,e}ℰ1⋯𝑒\mathcal{E}=\{1,\cdots,e\}caligraphic_E = { 1 , ⋯ , italic_e }, with a total of e𝑒eitalic_e domains. We further derive the dataset 𝒟={(𝐱,y,e)|𝐱∈𝒳,y∈𝒴,e∈ℰ}𝒟conditional-set𝐱𝑦𝑒formulae-sequence𝐱𝒳formulae-sequence𝑦𝒴𝑒ℰ\mathcal{D}=\{(\mathbf{x},y,e)|\mathbf{x}\in\mathcal{X},y\in\mathcal{Y},e\in% \mathcal{E}\}caligraphic_D = { ( bold_x , italic_y , italic_e ) | bold_x ∈ caligraphic_X , italic_y ∈ caligraphic_Y , italic_e ∈ caligraphic_E }. We assume domain 𝒟𝒟\mathcal{D}caligraphic_D is given as training data. Then, our goal is to train model ΦΦ\Phiroman_Φ:

where ΦΦ\Phiroman_Φ consists of feature extractor ϕfsubscriptitalic-ϕ𝑓\phi_{f}italic_ϕ start_POSTSUBSCRIPT italic_f end_POSTSUBSCRIPT and classifier ϕcsubscriptitalic-ϕ𝑐\phi_{c}italic_ϕ start_POSTSUBSCRIPT italic_c end_POSTSUBSCRIPT.ΦΦ\Phiroman_Φ is trained with training data and distinguishes well whether new samples 𝐱∗superscript𝐱\mathbf{x}^{*}bold_x start_POSTSUPERSCRIPT ∗ end_POSTSUPERSCRIPT are lives or not. New samples 𝐱∗superscript𝐱\mathbf{x}^{*}bold_x start_POSTSUPERSCRIPT ∗ end_POSTSUPERSCRIPT are defined on an unseen domain ℰ∗superscriptℰ\mathcal{E}^{*}caligraphic_E start_POSTSUPERSCRIPT ∗ end_POSTSUPERSCRIPT.

Fig. 2 illustrates the proposed framework, comprising the text embedding network ϕ𝐓⁢(𝐭):𝐱→𝐰𝐓:subscriptitalic-ϕ𝐓𝐭→𝐱subscript𝐰𝐓\phi_{\mathbf{T}}(\mathbf{t}):\mathbf{x}\rightarrow\mathbf{w}_{\mathbf{T}}italic_ϕ start_POSTSUBSCRIPT bold_T end_POSTSUBSCRIPT ( bold_t ) : bold_x → bold_w start_POSTSUBSCRIPT bold_T end_POSTSUBSCRIPT, the image embedding network ϕ𝐈⁢(𝐱):𝐱→𝐰𝐈:subscriptitalic-ϕ𝐈𝐱→𝐱subscript𝐰𝐈\phi_{\mathbf{I}}(\mathbf{x}):\mathbf{x}\rightarrow\mathbf{w}_{\mathbf{I}}italic_ϕ start_POSTSUBSCRIPT bold_I end_POSTSUBSCRIPT ( bold_x ) : bold_x → bold_w start_POSTSUBSCRIPT bold_I end_POSTSUBSCRIPT, the feature extractor ϕ𝐅⁢(𝐰𝐈):𝐰𝐈→𝐳:subscriptitalic-ϕ𝐅subscript𝐰𝐈→subscript𝐰𝐈𝐳\phi_{\mathbf{F}}(\mathbf{w}_{\mathbf{I}}):\mathbf{w}_{\mathbf{I}}\rightarrow% \mathbf{z}italic_ϕ start_POSTSUBSCRIPT bold_F end_POSTSUBSCRIPT ( bold_w start_POSTSUBSCRIPT bold_I end_POSTSUBSCRIPT ) : bold_w start_POSTSUBSCRIPT bold_I end_POSTSUBSCRIPT → bold_z, and the classifier ϕ𝐂⁢(𝐳):𝐳→y^:subscriptitalic-ϕ𝐂𝐳→𝐳^𝑦\phi_{\mathbf{C}}(\mathbf{z}):\mathbf{z}\rightarrow\hat{y}italic_ϕ start_POSTSUBSCRIPT bold_C end_POSTSUBSCRIPT ( bold_z ) : bold_z → over^ start_ARG italic_y end_ARG, with Group-wise Scaling Risk Minimization (GS-RM) and Feature Orthogonal Decomposition (FOD) modules. During the inference phase, the framework predicts spoofness by calculating the cosine similarity between the text-image feature 𝐰𝐓subscript𝐰𝐓\mathbf{w}_{\mathbf{T}}bold_w start_POSTSUBSCRIPT bold_T end_POSTSUBSCRIPT and the image features 𝐰𝐈subscript𝐰𝐈\mathbf{w}_{\mathbf{I}}bold_w start_POSTSUBSCRIPT bold_I end_POSTSUBSCRIPT embedded by the text and image encoders. We explain the details regarding the learning losses of the proposed framework in the following sections.

Figure 3: Insight for GS-RM and FOD: The center panel illustrates text features and the features of each domain represented within a hypersphere. The left panel demonstrates GS, which penalizes low-loss (high-similarity) groups and boosts high-loss (low-similarity) groups to achieve balanced learning quantities across groups. The right panel utilizes orthogonal bases and orthogonal projections to decompose domain-specific components from image embedding vectors. Subsequently, FOD aligns the domain-specific components orthogonally to the invariant components by leveraging domain labels during training.

3.2 Preliminary

ERM optimizes the network without accounting for domain environments, which can result in the network learning more from certain domains and less from others, finally leading to biased information. Invariant Risk Minimization (IRM) [2] is proposed to solve the problem of Empirical Risk Minimization. IRM aims to optimize networks across all domains, and the objective formula is defined as follows:

| ℒIRM:=assignsubscriptℒIRMabsent\displaystyle\mathcal{L}_{\text{IRM}}:=caligraphic_L start_POSTSUBSCRIPT IRM end_POSTSUBSCRIPT := | minΦ⁡1|ℰ|⁢∑e∈ℰℛe⁢(Φ)+‖∇w|w=1ℛe⁢(w⋅Φ)‖2,subscriptΦ1ℰsubscript𝑒ℰsuperscriptℛ𝑒Φsuperscriptnormsubscript∇conditional𝑤𝑤1superscriptℛ𝑒⋅𝑤Φ2\displaystyle\min_{\Phi}\frac{1}{|\mathcal{E}|}\sum_{e\in\mathcal{E}}\mathcal{% R}^{e}(\Phi)+{\scriptstyle{||\nabla_{w|w=1}\mathcal{R}^{e}(w\cdot\Phi)||^{2}}},roman_min start_POSTSUBSCRIPT roman_Φ end_POSTSUBSCRIPT divide start_ARG 1 end_ARG start_ARG | caligraphic_E | end_ARG ∑ start_POSTSUBSCRIPT italic_e ∈ caligraphic_E end_POSTSUBSCRIPT caligraphic_R start_POSTSUPERSCRIPT italic_e end_POSTSUPERSCRIPT ( roman_Φ ) + | | ∇ start_POSTSUBSCRIPT italic_w | italic_w = 1 end_POSTSUBSCRIPT caligraphic_R start_POSTSUPERSCRIPT italic_e end_POSTSUPERSCRIPT ( italic_w ⋅ roman_Φ ) | | start_POSTSUPERSCRIPT 2 end_POSTSUPERSCRIPT , | (2) | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------ | | ----------------------------------------------- | --- | | s.t.∀e∈ℰ,Φ∈argminΦ⁣∗ℛe(Φ∗),\displaystyle s.t.~{}~{}\forall e\in\mathcal{E},~{}\Phi\in\arg\min_{\Phi*}% \mathcal{R}^{e}(\Phi*),italic_s . italic_t . ∀ italic_e ∈ caligraphic_E , roman_Φ ∈ roman_arg roman_min start_POSTSUBSCRIPT roman_Φ ∗ end_POSTSUBSCRIPT caligraphic_R start_POSTSUPERSCRIPT italic_e end_POSTSUPERSCRIPT ( roman_Φ ∗ ) , | | | | | | | | | |

where ℛe⁢(Φ):=𝔼(𝐱,y)∼𝒟e⁢[ℓce⁢(Φ⁢(𝐱),y)]assignsuperscriptℛ𝑒Φsubscript𝔼similar-to𝐱𝑦subscript𝒟𝑒delimited-[]subscriptℓceΦ𝐱𝑦\mathcal{R}^{e}(\Phi):=\mathbb{E}_{(\mathbf{x},y)\sim\mathcal{D}_{e}}[\ell_{% \text{ce}}(\Phi(\mathbf{x}),y)]caligraphic_R start_POSTSUPERSCRIPT italic_e end_POSTSUPERSCRIPT ( roman_Φ ) := blackboard_E start_POSTSUBSCRIPT ( bold_x , italic_y ) ∼ caligraphic_D start_POSTSUBSCRIPT italic_e end_POSTSUBSCRIPT end_POSTSUBSCRIPT [ roman_ℓ start_POSTSUBSCRIPT ce end_POSTSUBSCRIPT ( roman_Φ ( bold_x ) , italic_y ) ] and 𝒟e:={(𝐱,y)|𝐱∈𝒳,y∈𝒴,e=e}assignsubscript𝒟𝑒conditional-set𝐱𝑦formulae-sequence𝐱𝒳formulae-sequence𝑦𝒴𝑒𝑒\mathcal{D}_{e}:=\{(\mathbf{x},y)|\mathbf{x}\in\mathcal{X},y\in\mathcal{Y},e=e\}caligraphic_D start_POSTSUBSCRIPT italic_e end_POSTSUBSCRIPT := { ( bold_x , italic_y ) | bold_x ∈ caligraphic_X , italic_y ∈ caligraphic_Y , italic_e = italic_e }. Eq. 2 forces the network to learn domain invariant features. However, IRM has difficulty in solving the optimization problem. [26, 17].

To deal with the issue, SAFAS proposed a Projected Gradient (PG-IRM) [29], as follows:

| ℒPG-IRMsubscriptℒPG-IRM\displaystyle\mathcal{L}_{\text{PG-IRM}}caligraphic_L start_POSTSUBSCRIPT PG-IRM end_POSTSUBSCRIPT | :=minϕf,ϕc⁢(1),⋯,ϕc⁢(e)⁡1|ℰ|⁢∑e∈ℰℛe⁢(ϕf,ϕc),assignabsentsubscriptsubscriptitalic-ϕ𝑓subscriptitalic-ϕ𝑐1⋯subscriptitalic-ϕ𝑐𝑒1ℰsubscript𝑒ℰsuperscriptℛ𝑒subscriptitalic-ϕ𝑓subscriptitalic-ϕ𝑐\displaystyle:=\min_{\phi_{f},\phi_{c(1)},\cdots,\phi_{c(e)}}\frac{1}{|% \mathcal{E}|}\sum_{e\in\mathcal{E}}\mathcal{R}^{e}(\phi_{f},\phi_{c}),:= roman_min start_POSTSUBSCRIPT italic_ϕ start_POSTSUBSCRIPT italic_f end_POSTSUBSCRIPT , italic_ϕ start_POSTSUBSCRIPT italic_c ( 1 ) end_POSTSUBSCRIPT , ⋯ , italic_ϕ start_POSTSUBSCRIPT italic_c ( italic_e ) end_POSTSUBSCRIPT end_POSTSUBSCRIPT divide start_ARG 1 end_ARG start_ARG | caligraphic_E | end_ARG ∑ start_POSTSUBSCRIPT italic_e ∈ caligraphic_E end_POSTSUBSCRIPT caligraphic_R start_POSTSUPERSCRIPT italic_e end_POSTSUPERSCRIPT ( italic_ϕ start_POSTSUBSCRIPT italic_f end_POSTSUBSCRIPT , italic_ϕ start_POSTSUBSCRIPT italic_c end_POSTSUBSCRIPT ) , | (3) | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --- | | s.t.formulae-sequence𝑠𝑡\displaystyle s.t.{}{}italic_s . italic_t . | ∃ϕc⁢(e)∈arg⁡minϕc⁢(e)⁡ℛe⁢(ϕf,ϕc⁢(e)),subscriptitalic-ϕ𝑐𝑒subscriptsubscriptitalic-ϕ𝑐𝑒superscriptℛ𝑒subscriptitalic-ϕ𝑓subscriptitalic-ϕ𝑐𝑒\displaystyle\exists\phi_{c(e)}\in\arg\min_{\phi_{c(e)}}\mathcal{R}^{e}(\phi_{% f},\phi_{c(e)}),∃ italic_ϕ start_POSTSUBSCRIPT italic_c ( italic_e ) end_POSTSUBSCRIPT ∈ roman_arg roman_min start_POSTSUBSCRIPT italic_ϕ start_POSTSUBSCRIPT italic_c ( italic_e ) end_POSTSUBSCRIPT end_POSTSUBSCRIPT caligraphic_R start_POSTSUPERSCRIPT italic_e end_POSTSUPERSCRIPT ( italic_ϕ start_POSTSUBSCRIPT italic_f end_POSTSUBSCRIPT , italic_ϕ start_POSTSUBSCRIPT italic_c ( italic_e ) end_POSTSUBSCRIPT ) , | | | | | ∀e∈ℰ,ϕc⁢(e)∈γα⁢(ϕc⁢(e)),formulae-sequencefor-all𝑒ℰsubscriptitalic-ϕ𝑐𝑒subscript𝛾𝛼subscriptitalic-ϕ𝑐𝑒\displaystyle\forall e\in\mathcal{E},~{}\phi_{c(e)}\in\gamma_{\alpha}(\phi_{c(% e)}),∀ italic_e ∈ caligraphic_E , italic_ϕ start_POSTSUBSCRIPT italic_c ( italic_e ) end_POSTSUBSCRIPT ∈ italic_γ start_POSTSUBSCRIPT italic_α end_POSTSUBSCRIPT ( italic_ϕ start_POSTSUBSCRIPT italic_c ( italic_e ) end_POSTSUBSCRIPT ) , | | | | |

where γαsubscript𝛾𝛼\gamma_{\alpha}italic_γ start_POSTSUBSCRIPT italic_α end_POSTSUBSCRIPT means α𝛼\alphaitalic_α-adjacency set, which is the space where the classifier is Euclidean projected. PG-IRM trains classifiers ϕc⁢(e)subscriptitalic-ϕ𝑐𝑒\phi_{c(e)}italic_ϕ start_POSTSUBSCRIPT italic_c ( italic_e ) end_POSTSUBSCRIPT corresponding to each domain e𝑒eitalic_e and makes each classifier similar by projecting interpolation. Specifically, the classifier aligns the direction of translation between spoofness and liveness. However, each classifier becomes strongly entangled with domain-specific components due to overfitting on individual domain datasets, which manifests as a bias term. Consequently, these bias terms result in gaps that degrade generalization performance across domains.

3.3 Geometrical Motivation

Our geometrical motivation aims to improve generality by orthogonally decomposing the feature space into domain-invariant and domain-specific feature spaces, defined as 𝐛𝐈subscript𝐛𝐈\mathbf{b_{I}}bold_b start_POSTSUBSCRIPT bold_I end_POSTSUBSCRIPT and 𝐛𝐒subscript𝐛𝐒\mathbf{b_{S}}bold_b start_POSTSUBSCRIPT bold_S end_POSTSUBSCRIPT, respectively. Generality is established as follows: We assume that a feature 𝐟𝐟\mathbf{f}bold_f is always combination of both domain-invariant 𝐟𝐈subscript𝐟𝐈\mathbf{f_{I}}bold_f start_POSTSUBSCRIPT bold_I end_POSTSUBSCRIPT and domain-specific 𝐟𝐒subscript𝐟𝐒\mathbf{f_{S}}bold_f start_POSTSUBSCRIPT bold_S end_POSTSUBSCRIPT components, i.e., 𝐟=𝐟𝐈+𝐟𝐒𝐟subscript𝐟𝐈subscript𝐟𝐒\mathbf{f}=\mathbf{f_{I}}+\mathbf{f_{S}}bold_f = bold_f start_POSTSUBSCRIPT bold_I end_POSTSUBSCRIPT + bold_f start_POSTSUBSCRIPT bold_S end_POSTSUBSCRIPT. When applying a linear transformation (classifier) computed as 𝐟⋅wT⋅𝐟superscript𝑤𝑇\mathbf{f}\cdot{w}^{T}bold_f ⋅ italic_w start_POSTSUPERSCRIPT italic_T end_POSTSUPERSCRIPT, domain bias arises from 𝐟𝐒⋅wT⋅subscript𝐟𝐒superscript𝑤𝑇\mathbf{f_{S}}\cdot{w}^{T}bold_f start_POSTSUBSCRIPT bold_S end_POSTSUBSCRIPT ⋅ italic_w start_POSTSUPERSCRIPT italic_T end_POSTSUPERSCRIPT and is compensated by adding a bias term b𝑏bitalic_b. However, since 𝐟𝐒subscript𝐟𝐒\mathbf{f_{S}}bold_f start_POSTSUBSCRIPT bold_S end_POSTSUBSCRIPT induces various local boundaries due to differences across domains, as shown in Fig. 1, aligning bias across all domains is challenging. To ensure universal applicability across all domains, two conditions must be satisfied: First, 𝐟𝐈subscript𝐟𝐈\mathbf{f_{I}}bold_f start_POSTSUBSCRIPT bold_I end_POSTSUBSCRIPT must exist within the orthogonal basis space 𝐛𝐈subscript𝐛𝐈\mathbf{b_{I}}bold_b start_POSTSUBSCRIPT bold_I end_POSTSUBSCRIPT derived from optimal w∗superscript𝑤w^{*}italic_w start_POSTSUPERSCRIPT ∗ end_POSTSUPERSCRIPT. Second, 𝐟𝐒subscript𝐟𝐒\mathbf{f_{S}}bold_f start_POSTSUBSCRIPT bold_S end_POSTSUBSCRIPT must exist in 𝐛𝐒subscript𝐛𝐒\mathbf{b_{S}}bold_b start_POSTSUBSCRIPT bold_S end_POSTSUBSCRIPT orthogonal to 𝐛𝐈subscript𝐛𝐈\mathbf{b_{I}}bold_b start_POSTSUBSCRIPT bold_I end_POSTSUBSCRIPT, called domain specific feature space. Under these conditions, 𝐟𝐒⋅wT⋅subscript𝐟𝐒superscript𝑤𝑇\mathbf{f_{S}}\cdot{w}^{T}bold_f start_POSTSUBSCRIPT bold_S end_POSTSUBSCRIPT ⋅ italic_w start_POSTSUPERSCRIPT italic_T end_POSTSUPERSCRIPT stays zero due to the orthogonality of the inner product, ensuring that b𝑏bitalic_b is consistently aligned as zero across domains.

3.4 Group-wise Scaling Risk Minimization

We introduce Group-wise Scaling Risk Minimization (GS-RM) to enhance domain-invariance, drawing inspiration from [16]. The GS-RM mechanism is designed to achieve alignment in the bias term by ensuring consistent classifier performance across all domains, thereby mitigating overfitting to any specific domain dataset. In contrast, PG-IRM [28] enforces alignment among classifier weights that are individually overfitted to their respective domains, consequently leading to misalignment of bias terms across domains.

To induce GS-RM, we first define group-wise loss for each group dataset. We define group dataset as 𝒟g={(𝐱,y)|𝐱∈𝒳,(y,e)=g}subscript𝒟𝑔conditional-set𝐱𝑦formulae-sequence𝐱𝒳𝑦𝑒𝑔\mathcal{D}_{g}=\{(\mathbf{x},y)|\mathbf{x}\in\mathcal{X},(y,e)=g\}caligraphic_D start_POSTSUBSCRIPT italic_g end_POSTSUBSCRIPT = { ( bold_x , italic_y ) | bold_x ∈ caligraphic_X , ( italic_y , italic_e ) = italic_g }, where g∈𝒢=𝒴×ℰ𝑔𝒢𝒴ℰg\in\mathcal{G}=\mathcal{Y}\times\mathcal{E}italic_g ∈ caligraphic_G = caligraphic_Y × caligraphic_E. Then, we formulate group-wise losses as follows:

where ℓcesubscriptℓce\ell_{\text{ce}}roman_ℓ start_POSTSUBSCRIPT ce end_POSTSUBSCRIPT represents the cross-entropy loss, and f⁢(⋅;⋅)𝑓⋅⋅f(\cdot;\cdot)italic_f ( ⋅ ; ⋅ ) denotes the network, of which the input is to the left of the semicolon and the network module to the right.

Second, we normalize group-wise loss to establish clear distinctions in the current iteration. Normalized loss is calculated by subtracting the mean and dividing it by the standard deviation for group-wise losses, defined as follows:

Then, we introduce a loss-adaptive scaler, called the Group-wise Scaling Estimator (Fig. 3), which assigns a higher scaling factor to high-loss scores and a lower scaling factor to low-loss scores.

where α𝛼\alphaitalic_α and β𝛽\betaitalic_β are log⁡(|g|)𝑔\log(|g|)roman_log ( | italic_g | )/2 and 1.5. Each parameter was empirically determined through experimentation.

Finally, we use the group-wise loss (Eq. 4), group-wise normalized loss (Eq. 5) and GS Estimator (Eq. 6) to define GS-RM as follows:

| ℒGS-RM:=minΦ⁡1|𝒢|⁢∑g∈𝒢σ⁢(ℒ¯g⁢(Φ))⁢ℒg⁢(Φ)assignsubscriptℒGS-RMsubscriptΦ1𝒢subscript𝑔𝒢𝜎subscript¯ℒ𝑔Φsubscriptℒ𝑔Φ\displaystyle\mathcal{L}_{\text{GS-RM}}:=\min_{\Phi}\frac{1}{|\mathcal{G}|}% \sum_{g\in\mathcal{G}}\sigma(\bar{\mathcal{L}}_{g}(\Phi))\mathcal{L}_{g}(\Phi)caligraphic_L start_POSTSUBSCRIPT GS-RM end_POSTSUBSCRIPT := roman_min start_POSTSUBSCRIPT roman_Φ end_POSTSUBSCRIPT divide start_ARG 1 end_ARG start_ARG | caligraphic_G | end_ARG ∑ start_POSTSUBSCRIPT italic_g ∈ caligraphic_G end_POSTSUBSCRIPT italic_σ ( over¯ start_ARG caligraphic_L end_ARG start_POSTSUBSCRIPT italic_g end_POSTSUBSCRIPT ( roman_Φ ) ) caligraphic_L start_POSTSUBSCRIPT italic_g end_POSTSUBSCRIPT ( roman_Φ ) | (7) | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --- |

Image-Text Similarity Loss

We define image embedding vector 𝐰𝐈:=f⁢(𝐱;ϕ𝐈)assignsubscript𝐰𝐈𝑓𝐱subscriptitalic-ϕ𝐈\mathbf{w}_{\mathbf{I}}:=f(\mathbf{x};\phi_{\mathbf{I}})bold_w start_POSTSUBSCRIPT bold_I end_POSTSUBSCRIPT := italic_f ( bold_x ; italic_ϕ start_POSTSUBSCRIPT bold_I end_POSTSUBSCRIPT ) and text embedding vector 𝐰𝐓:=f⁢(𝐭;ϕ𝐓)assignsubscript𝐰𝐓𝑓𝐭subscriptitalic-ϕ𝐓\mathbf{w}_{\mathbf{T}}:=f(\mathbf{t};\phi_{\mathbf{T}})bold_w start_POSTSUBSCRIPT bold_T end_POSTSUBSCRIPT := italic_f ( bold_t ; italic_ϕ start_POSTSUBSCRIPT bold_T end_POSTSUBSCRIPT ). Then, we formulate the group-wise image-text similarity loss, defined as follows:

where ⊗tensor-product\otimes⊗ means cosine similarity. We further apply GS-RM for the loss to achieve consistent separation of real and spoofed samples across multiple domains. Then, the image-text similarity loss with GS-RM is defined as follows:

| ℒIT-GS=1|𝒢|⁢∑g∈𝒢σ⁢(ℒ¯ITg)⁢ℒITg,subscriptℒIT-GS1𝒢subscript𝑔𝒢𝜎subscript¯ℒsubscriptIT𝑔subscriptℒsubscriptIT𝑔\mathcal{L}_{\text{IT-GS}}=\frac{1}{|\mathcal{G}|}\sum_{g\in\mathcal{G}}\sigma% (\bar{\mathcal{L}}_{\text{IT}_{g}})\mathcal{L}_{\text{IT}_{g}},caligraphic_L start_POSTSUBSCRIPT IT-GS end_POSTSUBSCRIPT = divide start_ARG 1 end_ARG start_ARG | caligraphic_G | end_ARG ∑ start_POSTSUBSCRIPT italic_g ∈ caligraphic_G end_POSTSUBSCRIPT italic_σ ( over¯ start_ARG caligraphic_L end_ARG start_POSTSUBSCRIPT IT start_POSTSUBSCRIPT italic_g end_POSTSUBSCRIPT end_POSTSUBSCRIPT ) caligraphic_L start_POSTSUBSCRIPT IT start_POSTSUBSCRIPT italic_g end_POSTSUBSCRIPT end_POSTSUBSCRIPT , | (9) | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --- |

where σ𝜎\sigmaitalic_σ denotes GS Estimator (Eq. 6).

The text embedding vector serves as effective guidance for extracting domain-invariant features [28, 35, 20, 23]. Therefore, we utilize this vector as classifier weights, ensuring that it satisfies the first condition mentioned in Sec. 3.3 by balancing performance across domains.

Table 1: Comparison results on the benchmark: Best results considered across epochs. The bold font and the underline represent the best and the second, respectively. ††\dagger† indicates the use of an extra source dataset (CelebA-Spoof [37]]), and ∗*∗ means reproducing.

3.5 Feature Orthogonal Decomposition

SAFAS [28] and FOD both aim to align the weight terms across different domains. However, while SAFAS misaligns the bias term across domains, FOD effectively preserves it. Before describing Feature Orthogonal Decomposition (FOD), we introduce the vector projection to decompose representation. The vector projection is the orthogonal projection of 𝐯𝐯\mathbf{v}bold_v onto the line spanned by 𝐮𝐮\mathbf{u}bold_u and is defined as:

where <𝐯,𝐮><\mathbf{v},\mathbf{u}>< bold_v , bold_u > denotes the inner product of 𝐯𝐯\mathbf{v}bold_v and 𝐮𝐮\mathbf{u}bold_u. The Gram-Schmidt process [4] is a way of finding a set of two or more vectors that are perpendicular to each other using Eq. 10. It helps to obtain an orthogonal basis 𝐛𝐈subscript𝐛𝐈\mathbf{b_{I}}bold_b start_POSTSUBSCRIPT bold_I end_POSTSUBSCRIPT from text embedding vectors, treating them as invariant vectors. We now formulate invariant features as follows:

Then, we derive the domain-specific feature 𝐟𝐒subscript𝐟𝐒\mathbf{f_{S}}bold_f start_POSTSUBSCRIPT bold_S end_POSTSUBSCRIPT by removing the domain-invariant feature 𝐟𝐈subscript𝐟𝐈\mathbf{f_{I}}bold_f start_POSTSUBSCRIPT bold_I end_POSTSUBSCRIPT from the image embedding features 𝐖𝐈subscript𝐖𝐈\mathbf{W_{I}}bold_W start_POSTSUBSCRIPT bold_I end_POSTSUBSCRIPT. As a result, the domain-invariant 𝐟𝐈subscript𝐟𝐈\mathbf{f_{I}}bold_f start_POSTSUBSCRIPT bold_I end_POSTSUBSCRIPT and domain-specific features 𝐟𝐒subscript𝐟𝐒\mathbf{f_{S}}bold_f start_POSTSUBSCRIPT bold_S end_POSTSUBSCRIPT become fully orthogonalized, ensuring their inner product is always zero.

Next, we train domain-specific components using these domain-specific features, explicitly aligning the classifier’s bias terms across different domains.

Feature Orthogonal Decomposition Loss

We define the FOD loss within the domain-specific space using domain labels, as follows:

| ℒFOD=∑i=1N−1|P⁢(i)|⁢∑p∈P⁢(i)log⁡exp⁡(𝐟𝐒i⋅𝐟𝐒p/τ)∑j,j≠iNexp⁡(𝐟𝐒i⋅𝐟𝐒j/τ),subscriptℒFODsuperscriptsubscript𝑖1𝑁1𝑃𝑖subscript𝑝𝑃𝑖⋅superscriptsubscript𝐟𝐒𝑖superscriptsubscript𝐟𝐒𝑝𝜏superscriptsubscript𝑗𝑗𝑖𝑁⋅superscriptsubscript𝐟𝐒𝑖superscriptsubscript𝐟𝐒𝑗𝜏\mathcal{L}_{\text{FOD}}=\sum_{i=1}^{N}\frac{-1}{|P(i)|}\sum_{p\in P(i)}\log% \frac{\exp(\mathbf{f_{S}}^{i}\cdot\mathbf{f_{S}}^{p}/\tau)}{\sum_{j,j\neq i}^{% N}\exp(\mathbf{f_{S}}^{i}\cdot\mathbf{f_{S}}^{j}/\tau)},caligraphic_L start_POSTSUBSCRIPT FOD end_POSTSUBSCRIPT = ∑ start_POSTSUBSCRIPT italic_i = 1 end_POSTSUBSCRIPT start_POSTSUPERSCRIPT italic_N end_POSTSUPERSCRIPT divide start_ARG - 1 end_ARG start_ARG | italic_P ( italic_i ) | end_ARG ∑ start_POSTSUBSCRIPT italic_p ∈ italic_P ( italic_i ) end_POSTSUBSCRIPT roman_log divide start_ARG roman_exp ( bold_f start_POSTSUBSCRIPT bold_S end_POSTSUBSCRIPT start_POSTSUPERSCRIPT italic_i end_POSTSUPERSCRIPT ⋅ bold_f start_POSTSUBSCRIPT bold_S end_POSTSUBSCRIPT start_POSTSUPERSCRIPT italic_p end_POSTSUPERSCRIPT / italic_τ ) end_ARG start_ARG ∑ start_POSTSUBSCRIPT italic_j , italic_j ≠ italic_i end_POSTSUBSCRIPT start_POSTSUPERSCRIPT italic_N end_POSTSUPERSCRIPT roman_exp ( bold_f start_POSTSUBSCRIPT bold_S end_POSTSUBSCRIPT start_POSTSUPERSCRIPT italic_i end_POSTSUPERSCRIPT ⋅ bold_f start_POSTSUBSCRIPT bold_S end_POSTSUBSCRIPT start_POSTSUPERSCRIPT italic_j end_POSTSUPERSCRIPT / italic_τ ) end_ARG , | (12) | | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---- |

where P⁢(i)𝑃𝑖P(i)italic_P ( italic_i ) denotes the positive sample set defined as P⁢(i):={𝐟𝐒j|∃ej=ei}assign𝑃𝑖conditional-setsuperscriptsubscript𝐟𝐒𝑗superscript𝑒𝑗superscript𝑒𝑖P(i):=\{\mathbf{f_{S}}^{j}|\exists e^{j}=e^{i}\}italic_P ( italic_i ) := { bold_f start_POSTSUBSCRIPT bold_S end_POSTSUBSCRIPT start_POSTSUPERSCRIPT italic_j end_POSTSUPERSCRIPT | ∃ italic_e start_POSTSUPERSCRIPT italic_j end_POSTSUPERSCRIPT = italic_e start_POSTSUPERSCRIPT italic_i end_POSTSUPERSCRIPT }, τ𝜏\tauitalic_τ represents temperature parameter, and N𝑁Nitalic_N and superscript indicate the number of batch samples and the index of batch samples, respectively.

Image-Image Similarity Loss and Class Loss

With the contrastive approach proposed by [31] on image feature vector space 𝒵∋𝐳𝐳𝒵\mathcal{Z}\owns\mathbf{z}caligraphic_Z ∋ bold_z, We calculate the InfoNCE loss by contrasting positive pairs derived from the same image with negative pairs sampled from other images.

| ℒII-SIM=∑i=12⁢N−1|P⁢(i)|⁢∑j∈P⁢(i)log⁡exp⁡(𝐳i⋅𝐳j/τ)∑k=1,k≠i2⁢Nexp⁡(𝐳i⋅𝐳k/τ),subscriptℒII-SIMsuperscriptsubscript𝑖12𝑁1𝑃𝑖subscript𝑗𝑃𝑖⋅subscript𝐳𝑖subscript𝐳𝑗𝜏superscriptsubscriptformulae-sequence𝑘1𝑘𝑖2𝑁⋅subscript𝐳𝑖subscript𝐳𝑘𝜏\mathcal{L}_{\text{II-SIM}}=\sum_{i=1}^{2N}\frac{-1}{|P(i)|}\sum_{j\in P(i)}% \log\frac{\exp(\mathbf{z}_{i}\cdot\mathbf{z}_{j}/\tau)}{\sum_{k=1,k\neq i}^{2N% }\exp(\mathbf{z}_{i}\cdot\mathbf{z}_{k}/\tau)},caligraphic_L start_POSTSUBSCRIPT II-SIM end_POSTSUBSCRIPT = ∑ start_POSTSUBSCRIPT italic_i = 1 end_POSTSUBSCRIPT start_POSTSUPERSCRIPT 2 italic_N end_POSTSUPERSCRIPT divide start_ARG - 1 end_ARG start_ARG | italic_P ( italic_i ) | end_ARG ∑ start_POSTSUBSCRIPT italic_j ∈ italic_P ( italic_i ) end_POSTSUBSCRIPT roman_log divide start_ARG roman_exp ( bold_z start_POSTSUBSCRIPT italic_i end_POSTSUBSCRIPT ⋅ bold_z start_POSTSUBSCRIPT italic_j end_POSTSUBSCRIPT / italic_τ ) end_ARG start_ARG ∑ start_POSTSUBSCRIPT italic_k = 1 , italic_k ≠ italic_i end_POSTSUBSCRIPT start_POSTSUPERSCRIPT 2 italic_N end_POSTSUPERSCRIPT roman_exp ( bold_z start_POSTSUBSCRIPT italic_i end_POSTSUBSCRIPT ⋅ bold_z start_POSTSUBSCRIPT italic_k end_POSTSUBSCRIPT / italic_τ ) end_ARG , | (13) | | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---- |

where 𝐳𝐳\mathbf{z}bold_z means feature vector defined as 𝐳=f⁢(𝐱;ϕ𝐈,ϕ𝐅)𝐳𝑓𝐱subscriptitalic-ϕ𝐈subscriptitalic-ϕ𝐅\mathbf{z}=f(\mathbf{x};\phi_{\mathbf{I}},\phi_{\mathbf{F}})bold_z = italic_f ( bold_x ; italic_ϕ start_POSTSUBSCRIPT bold_I end_POSTSUBSCRIPT , italic_ϕ start_POSTSUBSCRIPT bold_F end_POSTSUBSCRIPT ) and P⁢(i)𝑃𝑖P(i)italic_P ( italic_i ) denotes the positive sample. Then, we calculate class loss

Total Loss

Finally, for training the proposed framework, the total loss is as follows:

where λ1subscript𝜆1\lambda_{1}italic_λ start_POSTSUBSCRIPT 1 end_POSTSUBSCRIPT and λ2subscript𝜆2\lambda_{2}italic_λ start_POSTSUBSCRIPT 2 end_POSTSUBSCRIPT are 0.8 and 0.1 as hyper-parameters, respectively. Our framework is trained in an end-to-end manner by minimizing the overall objective function.

4 Experiments

4.1 Experimental Setting

Dataset

We conduct experiments on four widely used FAS datasets: CASIA [43] (C), OULU-NPU [3] (O), Idiap Replay-Attack [5] (I), and MSU-MFSD [37] (M). Furthermore, we validate our model on the Spoof in Wild (SiW) Mv2 dataset [12] (W), which represents an in-the-wild setting. Following the protocol in previous works and SAFAS [29], we treat each domain as a separate domain and use leave-one-out test protocol to evaluate cross-domain generalization. Specifically in Tab. 1, OCI →→\rightarrow→ M implies that the model is trained on O, C and I, while it is tested on M. OMI →→\rightarrow→ C, OCM →→\rightarrow→ I and ICM →→\rightarrow→ O are defined in a same manner.

Figure 4: Learning stability: Changes in performance measurements according to epoch settings for each domain.

Implement Details

The experiments were conducted on the Nvidia RTX A6000. We use 224x224 image size, 16 batch size, Adam optimizer with learning rate 3-e06 and weight decay 1-e06, and StepLR scheduler with step size 10 and gamma 0.1. To crop the face region used for learning and inference, we adopted the face information via a Multi-Task Convolutional Neural Network (MTCNN) [42] with a selection of padding value 0.6.

Metrics

For the evaluation, we use traditional FAS metrics [29, 28], called Halt Total Error Rate (HTER) and Area Under the Curve (AUC). In addition, we introduce another metric for model reliability, called Expected Calibration Error (ECE) [25]. To measure the reliability, calibration error is defined as the difference between the model’s prediction probability and actual probability. Since calculating the actual probability is not feasible, it is approximated using the accuracy of samples, defined as follows:

| 𝐄𝐂𝐄=∑m=1M|Bm|n⁢|𝐚𝐜𝐜⁢(Bm)−𝐜𝐨𝐧𝐟⁢(Bm)|,𝐄𝐂𝐄superscriptsubscript𝑚1𝑀subscript𝐵𝑚𝑛𝐚𝐜𝐜subscript𝐵𝑚𝐜𝐨𝐧𝐟subscript𝐵𝑚\mathbf{ECE}=\sum_{m=1}^{M}\frac{|B_{m}|}{n}|\mathbf{acc}(B_{m})-\mathbf{conf}% (B_{m})|,bold_ECE = ∑ start_POSTSUBSCRIPT italic_m = 1 end_POSTSUBSCRIPT start_POSTSUPERSCRIPT italic_M end_POSTSUPERSCRIPT divide start_ARG | italic_B start_POSTSUBSCRIPT italic_m end_POSTSUBSCRIPT | end_ARG start_ARG italic_n end_ARG | bold_acc ( italic_B start_POSTSUBSCRIPT italic_m end_POSTSUBSCRIPT ) - bold_conf ( italic_B start_POSTSUBSCRIPT italic_m end_POSTSUBSCRIPT ) | , | (16) | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------- | -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | - | ---- |

where Bmsubscript𝐵𝑚B_{m}italic_B start_POSTSUBSCRIPT italic_m end_POSTSUBSCRIPT is m𝑚mitalic_m-th data bin divided into M𝑀Mitalic_M equal intervals about predictive probabilities, 𝐚𝐜𝐜⁢(Bm)𝐚𝐜𝐜subscript𝐵𝑚\mathbf{acc}(B_{m})bold_acc ( italic_B start_POSTSUBSCRIPT italic_m end_POSTSUBSCRIPT ) means the accuracy of Bmsubscript𝐵𝑚B_{m}italic_B start_POSTSUBSCRIPT italic_m end_POSTSUBSCRIPT, and 𝐜𝐨𝐧𝐟⁢(Bm)𝐜𝐨𝐧𝐟subscript𝐵𝑚\mathbf{conf}(B_{m})bold_conf ( italic_B start_POSTSUBSCRIPT italic_m end_POSTSUBSCRIPT ) means the expectation of prediction probability of Bmsubscript𝐵𝑚B_{m}italic_B start_POSTSUBSCRIPT italic_m end_POSTSUBSCRIPT. A lower ECE score indicates greater confidence in the model’s predictions.

Table 2: Model reliability: Comparative measurement of Expected Calibration Error (ECE) in various scenarios.

4.2 Comparison Results on the Benchmark

In this section, we provide quantitative comparison results across various approaches, covering different domain shifts to comprehensively evaluate the effectiveness of our methods in diverse scenarios. Following a traditional protocol, we select results based on two criteria: the highest AUC-HTER and the lowest HTER, determined by the corresponding threshold. Regarding the HTER metric, Tab. 1 demonstrates that our approach achieves state-of-the-art performance in scenarios like OCI→M while attaining the second-best performance in OMI→C and OCM→I. Overall, our method outperforms the second-best method by 0.36 points. When incorporating an extra source dataset, our approach achieves state-of-the-art performance in cases OCI→M and OMI→C. Notably, it produces perfect predictions in the OCI→M scenario.

4.3 Evaluate Reliability and Bias Term Alignment

The confidence score is directly influenced by misaligned bias terms across different domains, as they affect the classification threshold. Therefore, a lower Expected Calibration Error (ECE) score indicates better alignment, whereas a higher ECE score reflects poorer alignment. As shown in Table 2, our method outperforms other methods in most cases. Notably, SAFAS exhibits a higher (worse) ECE score, primarily due to misalignment in the classifier’s bias. Additional calibration results are provided in Appendix B.

Table 3: Ablation study on each component for GD-FAS: Quantitative results.

4.4 Learning Stability

The convergence stability observed in our model, as shown in Fig. 4, underscores its ability to steadily improve and maintain performance throughout the training epochs. This stability demonstrates the robustness of our approach, thereby providing a reliable solution for real-world applications where domain shifts are frequent.

In contrast, other methods, such as SAFAS, PatchNet, SSDG, and SSAN, exhibit considerable fluctuations during training, indicating their instability in adapting to domain shifts. Specifically, FLIP, the most recent approach, achieves competitive performance only with early stopping applied, as its performance degrades in later epochs. This is particularly evident in Fig. 4, where FLIP’s HTER performance worsens significantly without early stopping.

Overall, our model’s superior stability and consistent convergence, as shown in both AUC and HTER, reflect its effectiveness in handling domain shifts and maintaining reliability over extended training epochs. This highlights the practical utility of our approach in the real world.

Figure 5: Ablation study on each component for GD-FAS: 2D PCA Visualization for OCI→M according to each module

4.5 Ablation Study

We conducted an ablation study to evaluate the effectiveness of GSRM and FOD on domain generalization and model reliability, as summarized in Tab. 3. The results demonstrate that the combination of GSRM and FOD consistently achieves state-of-the-art performance in most scenarios. Notably, the full model achieves the best results in the OCI→M setting (HTER: 0.42%, AUC: 99.88%) and the OMI→C setting (HTER: 0.93%, AUC: 99.99%). Concerning ECE, there exists a trade-off between model reliability and other performance metrics. While FOD enhances both reliability and generalization, GS-RM primarily focuses on improving generalization. As a result, using only FOD can significantly reduce ECE, but our full model achieves a more balanced trade-off between FAS performance and calibration reliability.

In Fig. 5, panels (a) and (b) illustrate that GSRM achieves consistent separation of real and spoofed samples across multiple domains, while panels (c) and (d) demonstrate that FOD effectively suppresses domain-specific information within the domain-separable space.

Figure 6: Comparative Visual Analysis: 2D PCA Visualization for OCI→M according to different models

4.6 Visual Analysis

We employed PCA to preserve the global structure of the data, capturing its overall patterns and directionality for visual analysis. As depicted in Fig. 6-(c), our method effectively isolates domain-specific information into distinct, separable spaces while maintaining learning consistency across domains. Consequently, as shown in Fig. 6-(f), our approach establishes a universal boundary that robustly separates previously unseen datasets. In contrast, Fig. 6-(d) and (e) illustrate that previous models have difficulty in establishing a universal boundary in the unseen domain, resulting in poor separation between spoof and liveness in feature space. Additional analyses are provided in Appendix A.

5 Conclusion

In this paper, we introduce GD-FAS, a novel Domain Generalizable Face Anti-Spoofing (DGFAS) framework designed to align classifier biases and weights across different domains through Group-wise Scaling Risk Minimization (GS-RM) and Feature Orthogonal Decomposition (FOD). GS-RM facilitates bias alignment by employing a loss-adaptive scaling factor to balance group-wise losses across multiple domains, ensuring consistent separation of real and spoof samples. FOD leverages the Gram-Schmidt orthogonalization process to explicitly decompose feature representations into domain-invariant and domain-specific subspaces. By enforcing orthogonality between these feature spaces using domain labels, FOD ensures effective alignment of weights across domains without negatively impacting bias alignment. Extensive experimental evaluations on standard benchmarks demonstrate that GD-FAS achieves state-of-the-art performance, exhibiting superior reliability, reduced bias misalignment, and enhanced generalization stability and adaptability in unseen domain scenarios.

Acknowledgement

This work was partly supported by the Institute of Information & Communications Technology Planning & Evaluation (IITP) grant funded by the Korea government (MSIT) [IITP-2023(2024)-RS-2024-00418847, Graduate School of Metaverse Convergence support program; RS-2021-II211341, Artificial Intelligence Graduate School Program (Chung-Ang University)].

References

• Ahuja et al. [2021] Kartik Ahuja, Ethan Caballero, Dinghuai Zhang, Jean-Christophe Gagnon-Audet, Yoshua Bengio, Ioannis Mitliagkas, and Irina Rish. Invariance principle meets information bottleneck for out-of-distribution generalization. Advances in Neural Information Processing Systems, 34:3438–3450, 2021.
• Arjovsky et al. [2019] Martin Arjovsky, Léon Bottou, Ishaan Gulrajani, and David Lopez-Paz. Invariant risk minimization. arXiv preprint arXiv:1907.02893, 2019.
• Boulkenafet et al. [2017] Z. Boulkenafet, J. Komulainen, Lei. Li, X. Feng, and A. Hadid. OULU-NPU: A mobile face presentation attack database with real-world variations. 2017.
• Cheney and Kincaid [2009] Ward Cheney and David Kincaid. Linear algebra: Theory and applications. The Australian Mathematical Society, 110:544–550, 2009.
• Chingovska et al. [2012] Ivana Chingovska, André Anjos, and Sébastien Marcel. On the effectiveness of local binary patterns in face anti-spoofing. 2012.
• Eastwood et al. [2022] Cian Eastwood, Alexander Robey, Shashank Singh, Julius Von Kügelgen, Hamed Hassani, George J Pappas, and Bernhard Schölkopf. Probable domain generalization via quantile risk minimization. Advances in Neural Information Processing Systems, 2022.
• et al [2019] George et al. Biometric face presentation attack detection with multi-channel convolutional neural network. TIFS, 2019.
• et al [2021] Liu et al. Casia-surf cefa: A benchmark for multi-modal cross-ethnicity face anti-spoofing. In WACV, 2021.
• et al [2020] Zhang et al. Casia-surf: A large-scale multi-modal benchmark for face anti-spoofing. TBBIS, 2020.
• Gong et al. [2019] Rui Gong, Wen Li, Yuhua Chen, and Luc Van Gool. Dlow: Domain flow for adaptation and generalization. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 2477–2486, 2019.
• Guo et al. [2017] Chuan Guo, Geoff Pleiss, Yu Sun, and Kilian Q Weinberger. On calibration of modern neural networks. In International conference on machine learning, pages 1321–1330. PMLR, 2017.
• Guo et al. [2022] Xiao Guo, Yaojie Liu, Anil Jain, and Xiaoming Liu. Multi-domain learning for updating face anti-spoofing models. In European Conference on Computer Vision, pages 230–249. Springer, 2022.
• Hong et al. [2023] Zong-Wei Hong, Yu-Chen Lin, Hsuan-Tung Liu, Yi-Ren Yeh, and Chu-Song Chen. Domain-generalized face anti-spoofing with unknown attacks. In 2023 IEEE International Conference on Image Processing (ICIP), pages 820–824. IEEE, 2023.
• Jia et al. [2020] Yunpei Jia, Jie Zhang, Shiguang Shan, and Xilin Chen. Single-side domain generalization for face anti-spoofing. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 8484–8493, 2020.
• Jin et al. [2020] Xin Jin, Cuiling Lan, Wenjun Zeng, and Zhibo Chen. Feature alignment and restoration for domain generalization and adaptation. arXiv preprint arXiv:2006.12009, 2020.
• Jung et al. [2023] Seungjin Jung, Seungmo Seo, Yonghyun Jeong, and Jongwon Choi. Scaling of class-wise training losses for post-hoc calibration. In Proceedings of the 40th International Conference on Machine Learning, pages 15421–15434. PMLR, 2023.
• Kamath et al. [2021] Pritish Kamath, Akilesh Tangella, Danica Sutherland, and Nathan Srebro. Does invariant risk minimization capture invariance? In International Conference on Artificial Intelligence and Statistics, pages 4069–4077. PMLR, 2021.
• Li et al. [2018] Haoliang Li, Sinno Jialin Pan, Shiqi Wang, and Alex C Kot. Domain generalization with adversarial feature learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2018.
• Li et al. [2023] Jingzhi Li, Zidong Guo, Hui Li, Seungju Han, Ji-won Baek, Min Yang, Ran Yang, and Sungjoo Suh. Rethinking feature-based knowledge distillation for face recognition. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 20156–20165, 2023.
• Liu et al. [2024] Ajian Liu, Shuai Xue, Jianwen Gan, Jun Wan, Yanyan Liang, Jiankang Deng, Sergio Escalera, and Zhen Lei. Cfpl-fas: Class free prompt learning for generalizable face anti-spoofing. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 222–232, 2024.
• Liu et al. [2021a] Shubao Liu, Ke-Yue Zhang, Taiping Yao, Mingwei Bi, Shouhong Ding, Jilin Li, Feiyue Huang, and Lizhuang Ma. Adaptive normalized representation learning for generalizable face anti-spoofing. In Proceedings of the 29th ACM international conference on multimedia, pages 1469–1477, 2021a.
• Liu et al. [2021b] Shubao Liu, Ke-Yue Zhang, Taiping Yao, Kekai Sheng, Shouhong Ding, Ying Tai, Jilin Li, Yuan Xie, and Lizhuang Ma. Dual reweighting domain generalization for face presentation attack detection. arXiv preprint arXiv:2106.16128, 2021b.
• Liu et al. [2025] Si-Qi Liu, Qirui Wang, and Pong C Yuen. Bottom-up domain prompt tuning for generalized face anti-spoofing. In European Conference on Computer Vision. Springer, 2025.
• Liu et al. [2018] Yaojie Liu, Amin Jourabloo, and Xiaoming Liu. Learning deep models for face anti-spoofing: Binary or auxiliary supervision. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 389–398, 2018.
• Naeini et al. [2015] Mahdi Pakdaman Naeini, Gregory Cooper, and Milos Hauskrecht. Obtaining well calibrated probabilities using bayesian binning. In Twenty-Ninth AAAI Conference on Artificial Intelligence, 2015.
• Rosenfeld et al. [2021] Elan Rosenfeld, Pradeep Ravikumar, and Andrej Risteski. The risks of invariant risk minimization. In International Conference on Learning Representations, 2021.
• Shao et al. [2019] Rui Shao, Xiangyuan Lan, Jiawei Li, and Pong C Yuen. Multi-adversarial discriminative deep domain generalization for face presentation attack detection. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10023–10031, 2019.
• Srivatsan et al. [2023] Koushik Srivatsan, Muzammal Naseer, and Karthik Nandakumar. Flip: Cross-domain face anti-spoofing with language guidance. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pages 19685–19696, 2023.
• Sun et al. [2023] Yiyou Sun, Yaojie Liu, Xiaoming Liu, Yixuan Li, and Wen-Sheng Chu. Rethinking domain generalization for face anti-spoofing: Separability and alignment. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 24563–24574, 2023.
• Vapnik [1991] V. Vapnik. Principles of risk minimization for learning theory. In Advances in Neural Information Processing Systems. Morgan-Kaufmann, 1991.
• Wang et al. [2022a] Chien-Yi Wang, Yu-Ding Lu, Shang-Ta Yang, and Shang-Hong Lai. Patchnet: A simple face anti-spoofing framework via fine-grained patch recognition. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 20281–20290, 2022a.
• Wang et al. [2020a] Guoqing Wang, Hu Han, Shiguang Shan, and Xilin Chen. Cross-domain face presentation attack detection via multi-domain disentangled representation learning. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 6678–6687, 2020a.
• Wang et al. [2021] Jingjing Wang, Jingyi Zhang, Ying Bian, Youyi Cai, Chunmao Wang, and Shiliang Pu. Self-domain adaptation for face anti-spoofing. In Proceedings of the AAAI Conference on Artificial Intelligence, 2021.
• Wang et al. [2020b] Wenhao Wang, Shengcai Liao, Fang Zhao, Cuicui Kang, and Ling Shao. Domainmix: Learning generalizable person re-identification without human annotations. arXiv preprint arXiv:2011.11953, 2020b.
• Wang et al. [2025] Xudong Wang, Ke-Yue Zhang, Taiping Yao, Qianyu Zhou, Shouhong Ding, Pingyang Dai, and Rongrong Ji. Tf-fas: twofold-element fine-grained semantic guidance for generalizable face anti-spoofing. In European Conference on Computer Vision, pages 148–168. Springer, 2025.
• Wang et al. [2022b] Zhuo Wang, Zezheng Wang, Zitong Yu, Weihong Deng, Jiahong Li, Tingting Gao, and Zhongyuan Wang. Domain generalization via shuffled style assembly for face anti-spoofing. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 4123–4133, 2022b.
• Wen et al. [2015 (To Appear] Di Wen, Anil. K Jain, and Hu Han. Face Spoof Detection with Image Distortion Analysis. IEEE Trans. Information Forensic and Security, 2015 (To Appear).
• Yang et al. [2023] Xiao Yang, Chang Liu, Longlong Xu, Yikai Wang, Yinpeng Dong, Ning Chen, Hang Su, and Jun Zhu. Towards effective adversarial textured 3d meshes on physical face recognition. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 4119–4128, 2023.
• Yu et al. [2020a] Zitong Yu, Yunxiao Qin, Xiaobai Li, Zezheng Wang, Chenxu Zhao, Zhen Lei, and Guoying Zhao. Multi-modal face anti-spoofing based on central difference networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops, pages 650–651, 2020a.
• Yu et al. [2020b] Zitong Yu, Chenxu Zhao, Zezheng Wang, Yunxiao Qin, Zhuo Su, Xiaobai Li, Feng Zhou, and Guoying Zhao. Searching central difference convolutional networks for face anti-spoofing. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 5295–5305, 2020b.
• Yue et al. [2023] Haixiao Yue, Keyao Wang, Guosheng Zhang, Haocheng Feng, Junyu Han, Errui Ding, and Jingdong Wang. Cyclically disentangled feature translation for face anti-spoofing. In Proceedings of the AAAI Conference on Artificial Intelligence, pages 3358–3366, 2023.
• Zhang et al. [2016] Kaipeng Zhang, Zhanpeng Zhang, Zhifeng Li, and Yu Qiao. Joint face detection and alignment using multitask cascaded convolutional networks. IEEE signal processing letters, 23(10):1499–1503, 2016.
• Zhang et al. [2012] Zhiwei Zhang, Junjie Yan, Sifei Liu, Zhen Lei, Dong Yi, and Stan Z Li. A face antispoofing database with diverse attacks. In 2012 5th IAPR international conference on Biometrics (ICB), pages 26–31. IEEE, 2012.
• Zhou et al. [2022] Qianyu Zhou, Ke-Yue Zhang, Taiping Yao, Ran Yi, Kekai Sheng, Shouhong Ding, and Lizhuang Ma. Generative domain adaptation for face anti-spoofing. In European Conference on Computer Vision, pages 335–356. Springer, 2022.
• Zhou et al. [2023] Qianyu Zhou, Ke-Yue Zhang, Taiping Yao, Xuequan Lu, Ran Yi, Shouhong Ding, and Lizhuang Ma. Instance-aware domain generalization for face anti-spoofing. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 20453–20463, 2023.

\thetitle

Supplementary Material

Figure A: Visual analysis: 2D PCA Visualization across domains. The term (seen) refers to the training dataset, while (unseen) refers to the target dataset that was not encountered during training. ∘\circ∘ and ×\times× represent liveness and spoofness, respectively. The datasets are represented as follows: ∘\circ∘,×\times×: CASIA, ∘\circ∘,×\times×: Idaip Replay-Attack, ∘\circ∘,×\times×: MSU-MFSD, ∘\circ∘,×\times×: OULU-NPU.

Appendix A Additional Visual Analysis

In this section, we describe additional visual analyses that were not covered in detail in Section 4.6 of the main paper. Specifically, we provide experimental validation of our method using PCA-based visualizations.

Figure B: Decomposition into invariance and specificity for domain: 2D PCA Visualization across domains. The term (Invariant) refers to features projected onto the invariant space, while (specific) refers to features projected onto the domain-specific separable space. ∘\circ∘ and ×\times× represent liveness and spoofness, respectively. The datasets are represented as follows:∘\circ∘,×\times×: CASIA, ∘\circ∘,×\times×: Idaip Replay-Attack, ∘\circ∘,×\times×: MSU-MFSD, ∘\circ∘,×\times×: OULU-NPU.

Figure C: 3D visualization projected on sphere: PCA 3D Visualization across domains. The terms (0º), (40º), and (90º) represent the angles of rotation about the vertical axis. ∘\circ∘ and ×\times× represent liveness and spoofness, respectively. The datasets are represented as follows: ∘\circ∘,×\times×: CASIA, ∘\circ∘,×\times×: Idaip Replay-Attack, ∘\circ∘,×\times×: MSU-MFSD, ∘\circ∘,×\times×: OULU-NPU.

A.1 Feature Orthogonal Decomposition

For PCA analysis and visualization, we calculate the 2D principal components based on the source dataset (training data) which indicates the (seen) domains. The target dataset (test data) which indicates the (unseen) domains is then projected onto these 2D principal components. Finally, we visualize the features of the source and target datasets projected onto the derived principal components.

As shown in Fig. A-(a), (b), (c), and (d), all cases demonstrate strong learning consistency. However, there are some mismatches between the domain-separable feature space and the decision boundary, indicating that they are not parallel to each other. Specifically, Fig. A-(b) exhibits little skewed decision boundary in the Idaip domain, (c) in the CASIA domain, and (d) in the MSU domain. Referring to Tab 1 in the main paper, the alignment quality correlates with the HTER scores. The most aligned case, (a), achieves the lowest HTER of 0.42, followed by (b) with 0.93, (d) with 2.64, and finally, (c), which has the highest HTER of 3.33.

Moreover, Fig. A-(e), (f), (g), and (h) further confirm that better alignment quality enhances the alignment of the domain-specific separable space in the target dataset.

This analysis validates that aligning the domain-specific feature space with the decision boundary significantly contributes to improving domain generality.

A.2 Decomposition into Invariant and Specific Features

For PCA analysis and visualization, we conduct the 2D principal components analysis for invariant features which are projected onto the invariant basis features. The invariant basis features are driven by Gram-Schmidt process [4]. Specific features are then obtained by subtracting the invariant features from the original features. Finally, we visualize the invariant features and specific features separately to analyze their behavior.

The domain-invariant features should demonstrate that they are challenging to distinguish across different domains. In Fig. B-(a), (b), (c), and (d), this is evident as the liveness features are difficult to associate with specific domains. In contrast, spoofness features show some level of domain separability. This might be from the fact that liveness typically represents a single characteristic, while spoofness encompasses a variety of attack types, such as print attacks, video attacks, and partial attacks. However, they still prove their invariance to domains.

Specific features, on the other hand, should neither clearly distinguish spoofness from liveness nor differentiate between domains, as they are unrelated to domain invariance. Moreover, since they are projected onto the principal components of domain-invariant features, domain separability should also be minimal. As expected, Fig. B-(e), (f), (g), and (h) depict indistinct patterns, where neither spoofness nor domain information can be identified.

The overall visualizations confirm that our method effectively and explicitly decomposes domain-invariant components from domain-specific components, achieving the intended decomposition.

A.3 3D visualization

We aim to intuitively examine the domain-invariant and domain-specific components. To achieve this, we further conduct 3D principal components analysis and project the features onto them for visualization, as shown in Fig. C. In the figure, the x-axis refers to the horizontal axis when the sphere is viewed from the front. Accordingly, at 0º on the x-axis, the domain-invariant components are highlighted; at 90º, the domain-specific components are emphasized; and at 40º, both components are visible. Additionally, the seen visualization represents data from the training set, while the unseen visualization includes both target and training datasets.

As proposed in Sec. A.1, Fig. C (seen, 0º) demonstrates that learning consistency is well-aligned. Furthermore, as discussed in Sec A.2, Fig. C (seen, 90º) shows that the domain-specific components can distinguish domains but cannot differentiate between liveness and spoofness. These results confirm that the domain-invariant and domain-specific components are effectively and explicitly separated. We also provide 3D visualized GIF images, including ours, FLIP, and SAFAS.

Figure D: Reliable Diagram: Comparison with Previous Methods. The terms (uncalibration) and (calibration) are distinguished based on whether the uncertainty has been calibrated.

Table A: Leave-three-domains-out protocol: ††\dagger† indicates the use of an extra source dataset (CelebA-Spoof [37]]).

Appendix B Model Reliability

Regardless of how advanced AI models become, the implementation of fundamental safety mechanisms remains essential for their deployment in real-world scenarios, particularly within security systems. This necessity arises because model reliability is often expressed through the probability values associated with predictions; however, recent AI models have demonstrated a tendency toward overconfidence [11]. Unfortunately, this critical aspect has been largely overlooked in prior studies.

In this section, we aim to underscore the importance of model reliability and delineate how our approach differs from previous methods by discussing the Expected Calibration Error (ECE) and the reliability diagrams introduced in Sec 4.1 of this paper.

A reliability diagram is an analytical tool that visually displays the discrepancy between predicted probability values and the actual probabilities. We conduct a visual analysis of the dataset both with and without uncertainty calibration, utilizing a post-hoc uncertainty calibration method that employs the temperature scaling technique. For this purpose, we split the test dataset into a validation set and a test set with a 2:8 ratio. The validation set is used to calibrate the reliability, while the test set is used to evaluate.

As shown in Fig. D, our method maintains a slightly overconfident state, whereas FLIP is significantly overconfident and, conversely, SAFAS is underconfident. In the calibrated diagrams below, the slightly under and overconfident regions are notably reduced. Here, we observe that our method before calibration outperforms other methods even after calibration.

Table B: Leave-two-domains-out protocol

Table C: Leave-one-domain-out protocol with different datasets: ††\dagger† indicates the use of an extra source dataset (CelebA Spoof)

Appendix C Additional Quantitative Experiments

We conducted experiments under more challenging settings, including the leave-two-domain-out (Sec. C.1) and leave-three-domain-out (Sec. C.2) protocols. Additionally, we evaluated our method on a different DGFAS dataset to assess its generalizability beyond the original benchmark(Sec. C.3). We evaluate all experiments using two standard metrics: Half Total Error Rate (HTER) and Area Under the ROC Curve (AUC).

C.1 Leave-three-domains-out protocol

Tab. A presents the results under the leave-three-domains-out protocol, where the model is trained on a single domain and evaluated on the remaining unseen domains. Our method, GD-FAS, consistently outperforms existing state-of-the-art approaches across most domain shifts. Notably, it achieves the best performance in particularly challenging scenarios such as O→C and M→C(HTER: 0.00%) and I→C (HTER: 0.19%). These results highlight the strong generalizability of our approach across highly diverse and difficult domain pairs.

C.2 Leave-two-domains-out protocol

Tab. B presents the performance under the leave-two-domains-out protocol, where the model is trained on two domains and evaluated on the remaining unseen domains—consistent with the experimental setup used in BUDoPT [23]. In both MI→C scenarios, GD-FAS achieves the lowest HTER (2.22% and 3.75%) and the highest AUC (99.15% and 98.75%), significantly outperforming prior methods such as BUDoPT [23], DGUA-FAS [13], and SSDG-R [14]. These results demonstrate the effectiveness of our group-wise scaling and orthogonal decomposition techniques in capturing domain-invariant features, even under limited training conditions and complex inter-domain shifts.

C.3 Different dataset

Our experiments were conducted on three diverse datasets—Surf (S) [9], CeFA (C) [8], and WMCA (W) [7]—under the leave-one-domain-out protocol to evaluate cross-dataset generalization.

As shown in Tab. C, while FLIP-MCL and CFPL achieve high AUC scores, GD-FAS demonstrates the most balanced performance, achieving the best average results across all domains (HTER: 5.92%, AUC: 98.08%). Notably, in the SW→C setting, GD-FAS outperforms all baselines with a significantly lower HTER (4.01%) and higher AUC (98.59%), highlighting its robustness against challenging cross-domain shifts.

Appendix D Discussion of Computational Cost

In this section, we discuss the computational cost of GD-FAS.

Training Efficiency

The additional computational overhead introduced by the GS-RM and FOD losses is approximately 10M FLOPs, which is negligible compared to the overall training complexity of FLIP-MCL (88.6G FLOPs). GD-FAS also adopts the same backbone architecture as FLIP-MCL and simply replaces the original MSE loss with the proposed GS-RM and FOD losses. As a result, GD-FAS maintains a comparable training cost to FLIP-MCL. In contrast, prior methods often rely on significantly more resource-intensive components, such as large language models (LLMs) or two-stage training pipelines.

Inference Efficiency

GD-FAS achieves an inference time of 0.01 seconds per frame, matching the computational cost of FLIP-MCL due to their shared inference pipeline. In comparison, other baseline methods typically incur slightly higher computational overhead and latency.

Table D: Embedding Features (𝐰𝐈⊗𝐰𝐓tensor-productsubscript𝐰𝐈subscript𝐰𝐓\mathbf{w_{I}}\otimes\mathbf{w_{T}}bold_w start_POSTSUBSCRIPT bold_I end_POSTSUBSCRIPT ⊗ bold_w start_POSTSUBSCRIPT bold_T end_POSTSUBSCRIPT) vs. Classifier (ϕCsubscriptitalic-ϕ𝐶\phi_{C}italic_ϕ start_POSTSUBSCRIPT italic_C end_POSTSUBSCRIPT)

Table E: Influence of Batch-size

Table F: Robustness across Image and Text Quality

Appendix E Classifier vs Embedding Features

In this section, we explain why GD-FAS detects spoofing attacks using embedding features rather than relying on the classifier output, as illustrated in Fig. 2. As shown in Tab. D, predictions based on embedding features outperform those based on the classifier. This performance gap arises because the embedding space explicitly separates domain-invariant and domain-specific information through orthogonal decomposition. In contrast, the classifier operates on features prior to this decomposition, failing to fully exploit the decomposed representations.

Appendix F Analysis of Batch-Size Influence

We analyze the influence of batch size on model performance. CLIP-based methods typically use a batch size of 3 per domain due to the large model size, resulting in an effective batch size equal to the per-domain batch size multiplied by the number of domains.

As shown in Tab. E, a batch size of 16 is sufficient for stable and effective training. Increasing the batch size beyond 16 yields marginal gains while requiring GPU memory in excess of 48GB, which may not be practical for most setups.

Figure E: Hyperparameter Sensitivity: Default λ1subscript𝜆1{\lambda}_{1}italic_λ start_POSTSUBSCRIPT 1 end_POSTSUBSCRIPT=0.8, β𝛽\betaitalic_β=1.5

Appendix G Robustness across Image and Text Quality

We analyze the robustness of GD-FAS to variations in both image and text quality. GD-FAS utilizes the same text templates as FLIP-MCL, comprising six distinct templates for each class—spoof and live—to guide representation learning. To evaluate robustness, we conduct experiments under four distinct conditions: one related to image quality and three to text quality. For the image case, we apply Gaussian noise to the input images to simulate visual degradation. For the text cases: (1) we replace text embeddings with random vectors, (2) we use only a single incorrect-class template, and (3) we use only a single correct-class template.

As descriebed in Tab. F, while both image and text degradations lead to moderate performance drops, degradation in text quality—particularly the use of random vectors or incorrect-class templates—results in a more substantial decline. These findings suggest that text embeddings play a crucial role in enabling GD-FAS to extract domain-invariant features effectively.

Appendix H Sensitivity of Hyperparameter

We performed a series of analytical experiments to examine how FOD and GS-RM contribute to overall performance, as shown in Fig. E. The hyperparameters λ1subscript𝜆1\lambda_{1}italic_λ start_POSTSUBSCRIPT 1 end_POSTSUBSCRIPT and β𝛽\betaitalic_β correspond to FOD and GS-RM, respectively. While our method exhibits slight sensitivity to hyperparameter variations, the combined use of FOD and GS-RM consistently improves performance as their contributions are strengthened. We selected the final hyperparameter values based on HTER, as it directly reflects the model’s domain generalization ability.