A new paper argues that face attack detection systems get measurably better when their training pairs each image of a fake face with a detailed written description of exactly what gives it away.
Face attack detection covers the defences that keep facial recognition systems from being fooled, whether by a printed photo or replayed video held up to a camera, by an adversarial image, or by a deepfake. Those defences are under real pressure, and Europol has cautioned that AI-generated fakes can bypass phone biometric security. Most detectors treat this as a purely visual problem, the authors note, largely because the datasets they learn from carry attack labels but little descriptive text. Where text has been used, it has tended to be generic, along the lines of “this is a fake face,” which offers a model little to work with.
The researchers, led by Ning Jiang and Ying Li with colleagues from a group including Shijie Yu and Dingheng Zeng, build on MS-UFAD, a large-scale face attack dataset released in 2025, and enrich it with more than 8 million fine-grained textual annotations, one for each attack image. To generate them without the invention that plagues large language models, the team first localises the manipulated region using a saliency method, compares it against the corresponding genuine face to quantify differences in colour and blur, then prompts a multimodal model with a curated list of artefacts specific to each forgery type, such as inconsistent skin tone between face and neck. The paper has been accepted at ICME 2026.
They then propose the Dual Alignment Forgery Network, or DAF-Net, which encodes images and text in parallel branches and aligns them both globally and at the level of specific forgery regions and phrases. Only the visual branch runs at inference, so the text is a training aid rather than a deployment requirement. On a test set spanning 30 generative methods unseen during training, the fine-grained approach cut the average classification error rate to 12.30 from the 15.24 achieved using the dataset’s original coarse descriptions, and lifted accuracy to 90.34. Those figures come from the authors’ own evaluation; in practice, face attack detection is more often judged in independent benchmarks, where firms such as ID R&D have competed in successive spoof detection challenges.
The authors deliberately restricted training to 830,000 images from 2,000 people and ten generative methods, reserving the rest, spanning thirty further methods, for evaluation. The claim is not that DAF-Net recognises attacks it has already seen, but that describing a forgery in words helps it generalise to those it has not.
Sources: arXiv
–
By Cass Kennedy
