Face-Free PAD: Produce Dataset Shifts Training Constraint from Faces to Presentation Artifacts

A new preprint presents TPO, a face-free PAD dataset of tomatoes, potatoes, and onions, and reports that a foundation-model detector trained on TPO achieves 92.70% mean AUC on face PAD cross-dataset benchmarks, outperforming synthetic-face training and competing with face-trained models; adding TPO to face training improves cross-dataset performance. The evidence supports the claim that presentation attack representations transfer independently of facial content, but rests on an unreviewed abstract.

Hugging Face Daily Papers — Tomatoes, Potatoes, and Onions: Questioning the Need for Faces in Face Presentation Attack Detection

August 26, 20261 source72% confidence

82Strategic

Strategic score

Evidence strength65

Technical novelty88

Commercial potential82

This paper moves face presentation attack detection (PAD) away from face imagery as the necessary substrate for learning transferable attack representations. The key constraint shift is that bona fide and attack training data can be recorded from arbitrary objects such as tomatoes, potatoes, and onions while still producing a detector that transfers to face benchmarks. If the result holds beyond the reported setup, it weakens the implicit assumption that PAD features are tied to facial semantics and opens a privacy-preserving development route.¹

Context

The authors introduce TPO, a controlled face-free dataset mirroring conventional PAD protocols with print and replay attacks on produce. Under a foundation-model-based architecture, a TPO-trained detector achieves 92.70% mean AUC over four cross-dataset face PAD benchmarks, outperforming synthetic-face training and approaching face-trained models. Face-trained models also transfer to TPO, supporting shared presentation-process cues rather than object-specific appearance.¹

Assessment

The headline result is only as strong as the benchmark protocols and the unseen dataset details; the abstract reports mean AUC without per-dataset breakdown, error bars, or comparisons to all competing methods. The transfer evidence is suggestive but relies on ‘above chance’ as the criterion, which is weak if cross-dataset distributions differ substantially. The frequency and representation analyses are described at a level that cannot yet be checked.¹

Caveats

What would change my mind: (1) re-evaluation showing TPO-trained detectors underperform synthetic-face or face-trained baselines under equal compute and data budgets; (2) evidence that TPO’s advantage comes from dataset-specific artifacts rather than presentation cues; (3) failure of the augmentation benefit to replicate on more diverse face PAD benchmarks or with other architectures. The ‘almost randomly chosen’ produce raises a selection-bias question, though the authors argue the categories are semantically arbitrary.¹

Source text

Hugging Face Daily Papers — Tomatoes, Potatoes, and Onions: Questioning the Need for Faces in Face Presentation Attack Detection · August 20, 2026

Computer Science > Computer Vision and Pattern Recognition

Title:Tomatoes, Potatoes, and Onions: Questioning the Need for Faces in Face Presentation Attack Detection

Abstract:Face presentation attack detection (PAD) is traditionally formulated as a face-specific problem, although many of the visual artifacts introduced by print, replay, and recapture processes are not inherently tied to facial appearance. In this work, we investigate whether transferable PAD representations can be learned without using faces during downstream PAD training. To this end, we introduce TPO, a controlled face-free presentation attack dataset consisting of bona fide, print, and replay recordings of, almost randomly chosen, tomatoes, potatoes, and onions acquired under protocols that closely mirror conventional face PAD datasets. Using a foundation-model-based PAD architecture, we demonstrate that a detector trained on TPO achieves an average AUC of 92.70% across four standard cross-dataset face PAD benchmarks, outperforming training on synthetic faces and remaining competitive with models trained on real face datasets. Conversely, models trained on face PAD datasets transfer consistently above chance to TPO, suggesting that the learned representations capture characteristics of the presentation process rather than object semantics. Furthermore, incorporating TPO into conventional face PAD training consistently improves cross-dataset performance under fixed optimization budgets, indicating that face-free data provides complementary information rather than simply additional training samples. Finally, representation and frequency analyses provide further evidence that transferable PAD representations cannot be explained by a single spectral artifact but instead encode richer presentation cues shared across object categories. Together, these results provide empirical evidence that transferable presentation attack representations can be learned independently of facial content, opening new opportunities for privacy-preserving and identity-independent PAD development.

Access Paper:

Bookmark

Bibliographic and Citation Tools

Code, Data and Media Associated with this Article

Demos

Recommenders and Search Tools

arXivLabs: experimental projects with community collaborators

arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.

Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.

Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.

The phrase ‘almost randomly chosen’ encodes a non-trivial design assumption: the produce classes should be semantically arbitrary, but not fully random, because recording must follow controlled attack protocols. Readers should not infer that object identity is merely a nuisance; the dataset is designed so that any residual produce-specific bias is a controlled confound.

The 92.70% AUC is an average over four cross-dataset face PAD benchmarks; the abstract does not state whether this is macro- or micro-averaged, nor the variance across benchmarks. This matters because the claim of being ‘competitive with face data’ depends on the spread, not only the mean.

The term ‘foundation-model-based PAD architecture’ is not defined in the abstract; it likely refers to use of a pretrained vision backbone with features extracted or fine-tuned for PAD, but the choice of foundation model and adaptation scheme is a major determinant of transferability and should be treated as an open implementation detail.

The source text above remains the property of its publisher and is reproduced for commentary.

Hugging Face Daily Papers — Tomatoes, Potatoes, and Onions: Questioning the Need for Faces in Face Presentation Attack Detection

August 20, 2026endistinct angle

Tomatoes, Potatoes, and Onions: Questioning the Need for Faces in Face Presentation Attack Detection

↑ Back to top