FAS-R1: A Unified Multi-Task MLLM for Reasoning Face Anti-Spoofing

Source: arXiv:2607.26432 · Published 2026-07-29 · By Hongyang Wang, Yichen Shi, Hongrui Li, Yiru Huo, Jun Feng, Zitong Yu

TL;DR

This paper addresses the growing need in face anti-spoofing (FAS) systems to go beyond simple bona fide/spoof classification and provide attack semantics along with image-grounded evidence for human inspection. Prior discriminative FAS models mostly produce binary labels without explanations, while recent multimodal large language model (MLLM) based approaches generate textual rationales but tend to rely on supervised fine-tuning alone, resulting in generic, template-like explanations and weak optimization for subtle or difficult spoof attacks. To tackle these limitations, the authors propose FAS-R1, a novel two-stage reasoning-oriented MLLM framework that unifies multiple FAS tasks — authenticity classification, attack-type recognition, and spoof-region localization — into a single generative interface that outputs structured predictions with detailed chain-of-thought (CoT) rationales.

FAS-R1 begins with cold-start supervised fine-tuning on a newly constructed FAS-R1-23K dataset containing approximately 23,000 samples annotated with long CoT rationales, attack types, localization boxes, and authenticity labels. Then, it performs a domain-specific reinforcement learning stage with a novel Guided Reward Policy Optimization (GRPO) that includes Degradation-Simulated Augmentation (DSA) to improve stable spoof cue reasoning across image quality variations, and Difficulty-Aware GRPO (DA-GRPO) to prevent easy samples from dominating training and ensure challenging task-attack groups are optimized. The resulting 3 billion parameter model achieves 98.75% authenticity accuracy, 93.33% attack-type accuracy, and localization AP@40/AP@50 of 96.30%/94.73% in-domain, outperforming prior baselines including FaceShield and PA-FAS in multi-task performance, cross-domain generalization, and rationale quality.

Extensive ablations validate the individual contributions of the two-stage training, DSA, and DA-GRPO, and scaling the model to 7 billion parameters further boosts performance. Qualitative examples demonstrate that FAS-R1 generates grounded, image-specific explanations and accurately localizes spoof regions where prior MLLMs produce generic or incorrect rationales. Overall, FAS-R1 represents a significant advance in unifying reasoning and interpretability with strong multi-task performance in face anti-spoofing.

Key findings

• FAS-R1 (3B) achieves 98.75% authenticity classification accuracy and 1.17% half total error rate (HTER) on in-domain evaluation across WMCA, PADISI-Face, and SiW-Mv2 datasets (Table 2).
• For fine-grained attack-type recognition, FAS-R1 reaches 93.33% accuracy, slightly improving over prior state-of-the-art FaceShield (93.24%) and PA-FAS (91.82%) (Table 2).
• Attack-region localization AP@40 and AP@50 scores are 96.30% and 94.73%, substantially outperforming FaceShield’s 73.79%/70.23% and PA-FAS’s 92.62%/91.30% (Table 2).
• Cross-domain authenticity generalization results show FAS-R1 competitive with top baselines, achieving up to 93.49% accuracy and reducing HTER to 5.34% when training on two datasets and testing on the third (Table 3).
• Ablation shows Degradation-Simulated Augmentation (DSA) improves AP@40 from 95.58% to 96.44% and overall multi-task metrics (Table 5, Fig. 6a).
• Difficulty-Aware GRPO (DA-GRPO) further increases coarse accuracy by 4.3 percentage points (from 94.45% to 98.75%) and reduces HTER by 2.6 points (3.77% to 1.17%), particularly improving performance on challenging task-attack subgroups (Fig. 6b, Table 5).
• Comparison with alternative GRPO variants (DAPO, GSPO) confirms FAS-R1’s combined DSA+DA-GRPO approach yields the best performance (Table 6).
• Model scaling from 3B to 7B improves in-domain coarse accuracy from 98.75% to 99.55%, fine accuracy from 93.33% to 94.68%, and localization AP@40 from 96.30% to 97.07% (Table 7).

Threat model

The adversary is a malicious entity attempting to spoof or fool face recognition systems using various presentation attacks such as printed photos, replayed videos, 3D masks, or subtle makeup-based manipulations. The adversary can present images under varying acquisition conditions and visual degradations but cannot directly tamper with the deployed anti-spoofing system or access its internal states. The model assumes white-box access to training data and supervision but faces the challenge of recognizing diverse spoof types robustly and explaining decisions with image-grounded evidence.

Methodology — deep read

The authors propose a unified Multi-task Large Language Model (MLLM)-based framework named FAS-R1 for face anti-spoofing that jointly predicts authenticity (real/spoof), attack type, and localizes spoof regions with detailed chain-of-thought (CoT) rationales. The approach consists of two stages: supervised cold-start training and reinforcement learning post-training with task-specific enhancements.

1. Threat Model & Assumptions: The adversary is a spoof attack attempting to deceive face recognition systems using various modalities including print, replay, 3D masks, partial attacks like makeup or occlusion. The model is designed assuming access to visual inputs with unknown quality degradation (camera noise, compression), and the adversary can attempt subtle, ambiguous attacks. However, adversarial adaptation or direct tampering with the model is not considered.

2. Data: The FAS-R1-23K dataset is constructed from publicly available FAS datasets: WMCA, PADISI-Face, and SiW-Mv2. It contains 22,996 samples with multiple tasks annotated — binary authenticity labels, fine-grained attack categories, localization boxes for spoof regions, and human and GPT-verified long chain-of-thought rationales. Annotation consistency is ensured by dual-model verification and human review to remove hallucinations and low-quality samples. Data split is 80/10/10 training/validation/test at image level, with no leak between sets.

3. Architecture & Algorithm: The base MLLM uses Qwen2.5-VL backbones (3B and 7B versions) integrating visual encoders, multimodal projectors, and autoregressive language model components. The model input is an image-prompt pair; output is a multi-field generative sequence containing reasoning traces (<think> tags), final answer (<answer>), attack type (<attack>), and localization box coordinates (<box>). The key novelty is in combining multi-task generation with grounded rationales.

4. Training Regime: Stage 1 performs full-parameter supervised fine-tuning on FAS-R1-23K for two epochs using a learning rate of 1e-6, batch size 128, and a global multimodal prompt setup. Stage 2 implements Guided Reward Policy Optimization (GRPO) for reinforcement learning, with on-policy samples generated with Degradation-Simulated Augmentation (DSA), placing both clean and synthetically degraded images in the same rollout group. Reward components include output format adherence, accuracy for each task, localization IoU, and rationale-answer consistency scored by GPT-5 verifier. Difficulty-Aware GRPO (DA-GRPO) adaptively reweights updates to underskilled task-attack subgroups leveraging an exponentially moving average of subgroup proficiency.

5. Evaluation Protocol: The model is evaluated on three public FAS datasets merged and split for in-domain evaluation and cross-domain generalization experiments, measuring authenticity classification ACC and HTER, attack-type ACC, and localization AP at IoU thresholds 0.4 and 0.5. Baselines include traditional discriminative CNNs, recent MLLMs, and prior MLLM-based FAS models like FaceShield and PA-FAS. Ablations isolate impact of DSA, DA-GRPO, and compare to alternative GRPO variants. Answer-and-rationale quality is quantitatively assessed by pairwise Elo ratings against other MLLMs.

6. Reproducibility: The paper states that code and models will be released soon; the dataset FAS-R1-23K combines publicly available datasets but includes proprietary annotation verification steps with Gemini 2.5 Flash and GPT-5 that limit out-of-the-box replication. Hyperparameters and training details are publicly provided.

Concrete Example: For one training sample from WMCA, the input image and a textual prompt is passed to the baseline MLLM initialized by cold-start SFT on FAS-R1-23K. The model generates a chain-of-thought rationale analyzing visible reflections and texture inconsistencies, a binary answer "spoof", predicted attack type "replay", and bounding box for the spoof region. Reinforcement learning further adjusts parameters by comparing rewards of rollouts on clean and synthetically degraded variants of the same image, weighing corrections more heavily for hard task-attack subgroups where the model is less proficient, thereby refining reasoning stability and complex case handling.

Technical innovations

• Introduction of a two-stage training pipeline combining cold-start supervised fine-tuning on a high-quality long-chain-of-thought dataset (FAS-R1-23K) with task-specific reinforcement learning using GRPO to unify multi-task FAS prediction and rationale generation.
• Degradation-Simulated Augmentation (DSA) that groups paired clean and synthetically degraded image rollouts during reinforcement learning to promote stable spoof-cue reasoning across image quality variations.
• Difficulty-Aware GRPO (DA-GRPO) that dynamically tracks per sub-task-and-attack-group proficiency and adaptively weights reinforcement updates to avoid easy-sample dominance and optimize challenging attacks such as makeup and mask spoofs.
• A unified multi-task generative interface within MLLMs that outputs authenticity classification, fine-grained attack types, spatial spoof localization, and long-form evidence-grounded chain-of-thought rationales for human-inspectable decisions.

Datasets

• FAS-R1-23K — 22,996 samples — constructed from WMCA, PADISI-Face, SiW-Mv2 with annotation verification, long CoT rationales, and multi-task labels

Baselines vs proposed

• ResNet (He et al. 2016): 97.55% ACC vs FAS-R1: 98.75% ACC on authenticity classification (Table 2)
• FaceShield (Wang et al. 2025b): 93.24% attack-type ACC vs FAS-R1: 93.33% (Table 2)
• FaceShield localization AP@40/AP@50: 73.79%/70.23% vs FAS-R1: 96.30%/94.73% (Table 2)
• PA-FAS (Ma et al. 2026) localization AP@40/AP@50: 92.62%/91.30% vs FAS-R1: 96.30%/94.73% (Table 2)
• Cross-domain authenticity (W&S→P): PA-FAS ACC 92.74% vs FAS-R1 92.39%, (W&P→S) PA-FAS 92.68% vs FAS-R1 93.42%, (S&P→W) PA-FAS 92.83% vs FAS-R1 93.49% (Table 3)
• FAS-R1 with DA-GRPO: Coarse ACC improves from 94.45% (GRPO+DSA) to 98.75%, HTER reduces from 3.77% to 1.17% (Table 5)
• Alternative GRPO variants DAPO and GSPO both underperform FAS-R1’s combined DSA+DA-GRPO (Table 6)
• Scaling Qwen backbone from 3B to 7B improves in-domain coarse ACC from 98.75% to 99.55% and reduces HTER from 1.17% to 0.32% (Table 7)

Figures from the paper

Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2607.26432.

Fig 1: Comparison of three FAS paradigms: (a) discrimi-

Fig 2: Stage 1: long-CoT cold start with annotation-constrained generation, external verification, and rule/manual filtering.

Fig 3: Stage 2: FAS-specific reinforcement optimization. DSA constructs paired clean/degraded rollouts, while DA-GRPO

Fig 4: FAS-specific GRPO optimization. DSA mixes clean and degraded trajectories in each rollout group, and DA-GRPO

Fig 5: Automated pairwise answer-and-rationale compar-

Fig 6: provides further analysis of DSA and DA-GRPO, and

Fig 7 (page 4).

Fig 8 (page 4).

Limitations

• FAS-R1-23K dataset is constructed from merging public datasets but relies on proprietary annotation generation and verification tools (Gemini 2.5 Flash, GPT-5), limiting immediate reproducibility and general accessibility.
• The reinforcement learning framework assumes consistent annotation and task definitions across datasets, but attack taxonomies and spatial labels differ between source datasets, complicating fine-grained cross-domain transfer evaluation.
• The model evaluation focuses on static images; temporal/sensor fusion or video-based spoof detection is not addressed, limiting applicability to dynamic attack scenarios.
• No explicit analysis or experiment is presented regarding resistance to adversarial attacks targeting the model’s reasoning or explanation output itself.
• Training and evaluation primarily consider common spoof types; emerging or unseen spoof modalities (e.g., deepfakes, adversarial makeup) are not explicitly explored.
• The approach’s computational cost is high due to the large-scale MLLM and two-stage training, potentially limiting deployment on resource-constrained platforms.

Open questions / follow-ons

• How well does FAS-R1 perform against adaptive adversaries who evolve spoof attacks to specifically fool reasoning-guided MLLMs?
• Can the framework be extended to video or multi-frame temporal cues to improve spoof detection robustness over time?
• What is the impact of noisy, inconsistent, or adversarially constructed reasoning annotations on the model’s interpretability and accuracy?
• How feasible is efficient model compression or distillation of FAS-R1 for edge deployment without sacrificing multi-task performance and rationale quality?

Why it matters for bot defense

Bot-defense and CAPTCHA engineers can draw from this work’s approach to unify multiple verification tasks (e.g., authenticity, type of malicious input, localization of suspicious regions) into a single interpretable pipeline that produces both decisions and rationale explanations. The use of MLLMs with chain-of-thought rationales provides richer diagnostic signals that can aid human interpretation and incident analysis beyond binary labels. The Reinforcement Learning techniques—especially Degradation-Simulated Augmentation—offer insights to build robust models that reason stably across input degradations, a common challenge in real-world bot detection scenarios with noisy data.

Difficulty-Aware GRPO’s strategy to prioritize learning on hard subgroups could inspire more effective training on corner cases or rare attack vectors typically under-optimized in bot detection models. Although focused on face anti-spoofing, the multi-task, evidence-grounded generative reasoning framework and the progressive fine-tuning plus RL pipeline can inform CAPTCHA systems aiming to detect sophisticated automated attacks with more explainability and adaptive training strategies. The approach highlights the value of combining supervised and reinforcement learning stages tailored to domain-specific challenges.

Cite

@article{arxiv2607_26432,
  title={ FAS-R1: A Unified Multi-Task MLLM for Reasoning Face Anti-Spoofing },
  author={ Hongyang Wang and Yichen Shi and Hongrui Li and Yiru Huo and Jun Feng and Zitong Yu },
  journal={arXiv preprint arXiv:2607.26432},
  year={ 2026 },
  url={https://arxiv.org/abs/2607.26432}
}

Read the full paper

• arXiv:2607.26432 (abstract)
• arXiv:2607.26432 (PDF)