Research map / Vision-language and multimodal / Multimodal LLMs

FaceShield: Explainable Face Anti-Spoofing with Multimodal Large Language Models

AAAI 2026 · Vision-language and multimodal › Multimodal LLMs · approach: Benchmarks and analysis of MLLMs · 4 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes FaceShield, a multimodal LLM for explainable face anti-spoofing covering classification, attack-type recognition, reasoning, and localization, trained on newly built FaceShield-pre10K and FaceShield-sft45K instruction datasets.

Problem

Face anti-spoofing has been treated as binary classification with limited interpretability, generalization, and localization; general MLLMs perform poorly on FAS and there are no FAS-specific MLLMs or instruction datasets.

Approach

Combines spoof-aware vision perception (RGB tokens plus LBP/gray/HOG descriptor image tokens) with prompt-guided vision token masking (keep top-k% prompt-similar tokens, randomly mask p% of the rest) in a LLaVA-style MLLM, trained with two-stage pretraining and SFT on LLM-generated FAS QA data.

Key results

• Coarse-grained intra-dataset: FaceShield reaches 99.41% ACC and 0.53% HTER, versus 98.73% ACC for CoOp and 98.23% ACC for fine-tuned Bunny.
• Attack localization: FaceShield achieves 97.78 AP@40 and 95.60 AP@50, versus 92.30 AP@40 for fine-tuned Bunny.
• Fine-grained classification: FaceShield achieves 95.81% ACC, compared with 94.43% for fine-tuned Bunny and 27.03% for zero-shot Bunny.

Surprising findings

• PVTM slightly lowers reasoning performance (99.41 to 99.29 ACC with SAVP), which the authors attribute to information loss from masking visual tokens.
• Zero-shot general MLLMs perform near chance on coarse classification (e.g., MiniGPT-4 at 26.86% ACC), far below traditional CNN/ViT baselines.

Limitations

• Experiments use only three source datasets with 12 unified attack types, limiting diversity.
• Relies on LLM-generated QA labels from Bunny-Llama-3-8B-V, which may contain errors despite filtering and human review.
• Reasoning and fine-grained results are reported on in-house test splits (10% of each source dataset), so comparisons to external benchmarks are limited.

Experimental setup

Datasets: WMCA SiW-Mv2 PADISI CASIA-MFSD Replay-Attack

Benchmarks: WMCA SiW-Mv2 PADISI CASIA-MFSD Replay-Attack

Metrics: ACC HTER BLEU-1 BLEU-2 BLEU-3 BLEU-4 ROUGE-L METEOR AP@40 AP@50

Baselines: ResNet PatchNet CoOp IADG FAS-AUG LLaVA Qwen-VL MiniGPT-4 Bunny Sphinx Lenna

Builds on: LLaVA Bunny LoRA CoOp FakeShield

Closest papers by meaning

• Interpretable Face Anti-Spoofing: Enhancing Generalization with Multimodal Large Language Models (AAAI 2025 · similarity 0.94)
• Harnessing Chain-of-Thought Reasoning in Multimodal Large Language Models for Face Anti-Spoofing (CVPR 2026 · similarity 0.92)
• From Intuition to Investigation: A Tool-Augmented Reasoning MLLM Framework for Generalizable Face Anti-Spoofing (CVPR 2026 · similarity 0.91)
• SLIP: Spoof-Aware One-Class Face Anti-Spoofing with Language Image Pretraining (AAAI 2025 · similarity 0.91)
• mmFAS: Multimodal Face Anti-Spoofing Using Multi-Level Alignment and Switch-Attention Fusion (AAAI 2025 · similarity 0.90)
• Guard Me If You Know Me: Protecting Specific Face-Identity from Deepfakes (NeurIPS 2025 · similarity 0.88)