dataesr/scientific-paragraphs-categorization huggingface dataset:
All the abovementioned datasets have been created under controlled environments, i. e. , mostly indoors and with controlled illumination conditions, face poses, etc. Although UAD  [76]  has collected videos from both indoors and outdoors and with a relatively large number of subjects, the dataset is no longer publicly available. Although MSU-USSA  [66]  contains a set of genuine faces captured under more diverse environments (including celebrities' images collected from the Internet by  [183] ), the PAs always took place in controlled indoor conditions. Even the latest CASIA-SURF dataset  [182] , which is so far the largest multi-modal facial anti-spoofing dataset with 1000 subjects, contains only images collected in the same well-controlled conditions. Therefore, public datasets are still far from reproducing real-world applications in a realistic way.
This is probably due to the difficulty of collecting impostors' PAs and PAIs in the wild. As a consequence, examples of PAs are generally acquired manually, which is a time-consuming and draining work. Creating a large-scale dataset for facial anti-spoofing in the wild, covering realistically various real-world applicative scenarios, is still a challenge. To circumvent these challenges, some researchers use data augmentation techniques to create synthetic (yet realistic) images of PAs  [79]. A summarized overview of the existing public facial anti-spoofing datasets using only generic RGB cameras is provided in Table  2. More precisely, for each dataset, Table  2  gives (in columns) its release's year (Year); the number of subjects it contains ( Subj); the ethnicity of the subjects in the dataset (Ethnicity); the type of PA represented in the dataset (PA type(s)); the number and type(s) of documents provided in the dataset as the cumulated number of genuine attempts and PAs (Document & type(s)); the PAI(s) used (PAI); the head pose(s) in the set of genuine faces (Pose); whether there are facial expression variations in the genuine faces dataset (Expressions); the biometric system acquisition device(s) for capturing both the genuine attempts and, in case of an attack, the PAI (Biometric system acquisition device); and the PA acquisition device that is possibly used to create the PAI (PA acquisition device).
Major Limitations of the Existing Datasets Given the acquisition difficulties mentioned above, the existing face PAD datasets are (compared to other face-related problems) still limited not only in terms of volume but also in terms of diversity regarding the types of PAs, PAIs and acquisition devices used for genuine faces, PAs and possibly PAIs. In particular, as of today, there is still no public large-scale facial PAD in the wild, whereas there are several such datasets for facial recognition. This hinders the development of effective facial PAD methods. It partly explains why, compared to other face-related problems, such as facial recognition, the performances of the current facial PAD methods are still below the requirements of most real-world applications (especially in terms of their generalization ability).
Of course, this is not the only reason: as detailed earlier in this paper, facial PAD is a very challenging problem. However, because all data-driven (learning-based) methods' performances-including hand-crafted feature-based methods and more recent deep learning-based methods-are largely affected by the learning dataset's volume and diversity  [129, 130, 184, 185] , the lack of diversity in the datasets contribute to the limited performances of the current facial PAD methods. More details about these datasets, including discussions about their advantages and drawbacks, are provided in the remainder of this section.
Detailed Description of the Existing Datasets In this section, we provide a detailed description of all the datasets mentioned in Table  2. NUAA Database  [52]  is the first publicly available facial PAD dataset for printed photo attacks. It includes some variability in the PAs, as the photos are moved/distorted in front of the PA acquisition device as follows: • 4 kinds of translations: vertical, horizontal, toward the sensor and toward the background • 2 kinds of rotations: along the horizontal axis and along the vertical axis (in-depth rotation) • 2 kinds of bending: along the horizontal and vertical axis (inward and outward) A generic webcam is used for recording the genuine face images. Fifteen subjects were enrolled in the database, and each subject was asked to avoid eye blinking and to keep a frontal pose, with neutral facial expression.
The attacks are performed by using printed photographs (either on photographic paper or A4 paper printed by a usual color HP printer). The dataset is divided into two separate subsets: for training and testing. The training set contains 1743 genuine face images and 1748 PAs impersonating 9 genuine users. The test set contains 3362 genuine samples and 5761 PAs. Viola-Jones detector  [186]  was used to detect the faces in the images, and the detected faces were aligned/normalized according to the eyes locations detected by  [187]. The facial images were then resized to 64 × 64 pixels. Extracts from the NUAA database are shown in Figure  32. PRINT-ATTACK Database  [147]  is the second proposed public dataset, including photo-attacks impersonating 50 different genuine users. The data was collected in two different conditions: controlled and adverse.
Finally, 200 genuine attempts and 200 PA video clips were recorded. The 400 video clips were then divided into three subsets: training, validation and testing. Genuine identities (real identities or impersonated identities) in each subset were chosen randomly but with no overlap. Extracts of the PRINT-ATTACK dataset are shown in Figure  33. CASIA-FASD Database  [19]  is the first publicly available face PAD dataset that provides both printed photo and video replay attacks. The CASIA-FASD database is a spoofing attack database which consists of three types of attacks: warped printed photos (which simulates paper mask attacks), printed photos with cut eyes and video attacks (motion cue such as eye blinking is also included). Each real face video and spoofing attack video is collected in three different qualities: low, normal and high quality.
The high-quality video has a high resolution 1280 × 720, and the low/normal quality video has the same resolution 640 × 480. However, the low and normal quality is defined empirically by the perceptional feeling rather than strict quantitative measures. The whole database is split into a training set (containing 20 subjects) and a testing set (containing 30 subjects). Seven test scenarios are designed considering three different image qualities, three different attacks (warped/cut photo attack and video replay attack) and the overall test combining all the data. Examples of CASIA-FASD database are shown in Figure  34. REPLAY-ATTACK Database  [37]  is an addendum of the abovementioned PRINT-ATTACK database  [147]  proposed by the same team. Compared to the PRINT-ATTACK database, REPLAY-ATTACK adds two more attacks, which are Phone-Attack and Tablet-Attack.
The Phone-Attack uses an iPhone screen to display the video or photo attack, and the Tablet-Attack uses an iPad screen to display high-resolution (1024 × 768) digital photos or videos. Thus, the REPLAY-ATTACK database can be used to evaluate photo attacks using printed photo or screens, and video replay attacks. The number of video clips for spoof attacks is increased from 200 to 1000 for 50 identities (subjects). The dataset is divided into training, validation and test sets. REPLAY-ATTACK database also offers an extra subset as the enrollment videos for 50 genuine clients to be used for evaluating the vulnerabilities of a facial recognition system without facial PAD is vulnerable towards various types of attacks. Examples of REPLAY-ATTACK database are shown in Figure  35. 3DMAD Database  [25, 58]  is the first public facial anti-spoofing database for 3D mask attacks.
Previous databases contain attacks performed with 2D artifacts (i. e. , photo or video) that are in general unable to fool facial PAD systems relying on 3D cues. In this database, the attackers wear customized 3D facial masks made out of a hard resin (manufactured by ThatsMyFace. com) of a valid user to impersonate the real access. It is worth mentioning that paper-craft mask files are also provided in this dataset. The dataset contains a total of 255 videos of 17 subjects. For each access attempt, a video was captured using the Microsoft Kinect for Xbox 360, which provides RGB data and depth information of size 640 × 480 at 30 frames per second. This dataset allows for the evaluation of both 2D and 3D PAD techniques, and their fusion. It is divided into three sessions: two real access sessions recorded with a time delay and one attack session captured by a single operator (attacker).
Examples of the 3DMAD database are shown in Figure  36. MSU-MFSD Database  [32]  is the first publicly available database to use mobile phones to capture real accesses. This database includes real access and attack videos for 55 subjects (among which 35 subjects are in the public version: 15 subjects in the training set and 20 subjects in test set). The genuine faces were captured using two devices: a Google Nexus 5 phone using its front camera (720 × 480 pixels) and a MacBook Air using its built-in camera (640 × 480 pixels). The Canon 550D SLR camera (1920 × 1088) and iPhone 5S (rear camera 1920 × 1080) are used to capture high-resolution pictures or videos (for photo attacks and video replay attacks). The printed high-resolution photo is played back using an iPhone 5S as PAI, and high definition (HD) (1920 × 1088) video-replays (captured on a Canon 550D SLR) are played back using an iPad Air.
Examples of MSU-MFSD database are shown in Figure  37. MSU-RAFS Database  [59]  is an extension of MSU-MFSD  [32] , CASIA-FASD  [19]  and REPLAY-ATTACK  [37] , where the video replay attacks are generated by replaying (on a MacBook) the genuine face videos in MSU-MFSD, CASIA-FASD and REPLAY-ATTACK. Fifty-five videos are genuine face videos from MSU-MFSD (captured by using the front camera of a Google Nexus 5), while 110 (2 × 55) videos are video replay attacks, captured using the built-in rear camera of a Google Nexus 5 and the built-in rear camera of an iPhone 6 and replayed using a MacBook as a PAI. In addition, 100 genuine face videos from CASIA-FASD and REPLAY-ATTACK were both used as genuine face videos and used to generate 200 video replay attacks by replaying these genuine face videos using a MacBook as a PAI.
During the attack, the average standoff of the smartphone camera (used by the biometric system) from the screen of the MacBook was 15 cm, which assured that replay videos do not contain the bezels (edges) of the MacBook screen. Unlike the previously described databases, MSU-RAFS is constructed using existing genuine face videos (without having control over the biometric system acquisition devices used). Therefore, in this dataset, the biometric system acquisition devices used for capturing genuine face videos generally differ from the devices used for capturing the PAs. Thus, there is a risk of introducing bias when evaluating methods based on this dataset only. Examples of MSU-RAFS database are shown in Figure  38. UAD Database  [76]  is the first database to collect data both indoors and outdoors.
It is also much bigger than the previous databases, both in terms of the number of subjects (440 subjects) and the number of videos (808 for training/16,268 for testing). All videos have been recorded at full-HD resolution, but subsequently cropped and resized to 1366 × 768 pixels. The dataset includes real access videos collected using six different cameras. For each subject, two videos are provided, both using the same camera but under different ambient conditions. Spoof attack videos corresponding to a given subject have also been captured using the same camera as for his/her real access videos. The video replay attacks have been displayed using seven different electronic monitors. However, this database seems to be no longer publicly available nowadays. Examples of UAD database are shown in Figure  39.
MSU-USSA Database  [66]  can be regarded as an extension of the MSU-RAFS  [59] , proposed by the same authors. There are two subsets in the database: (1) following the same idea as for MSU-RAFS, the first subset consists of 140 subjects from REPLAY-ATTACK  [37]  (50 subjects), CASIA-FASD  [19]  (50 subjects) and MSU-MFSD  [32]  (40 subjects); (2) the second subset consists of 1000 subjectstaken from the web faces database collected in  [183] , containing images of celebrities taken under a variety of backgrounds, illumination conditions and resolutions. Only a single frontal facial image of each celebrity is retained. Thus, the MSU-USSA database contains color facial images of 1140 subjects, where the average resolution of genuine face images is 705 × 865. Two cameras (front and rear cameras of a Google Nexus 5 smartphone) have been used to collect 2D attacks using four different PAIs (laptop, tablet, smartphone and printed photos), resulting in a total of 1140 genuine faces and 9120 PAs.
Just like MSU-RAFS, MSU-USSA has not captured genuine face videos with the same device used for capturing the PAs. Thus, there is a risk of introducing bias when evaluating methods based on this dataset only. Examples of MSU-USSA database are shown in Figure  40. OULU-NPU Database  [181]  is a more recent dataset (introduced in 2017) that contains PAD attacks acquired with mobile devices. In most previous datasets, the images were acquired in constrained conditions. On the other hand, this database contains a variety of motion, blur, illumination conditions, backgrounds and head poses. The database includes data corresponding to 55 subjects. The front cameras of 6 different mobile devices have been used to capture the images included in this dataset. The images have been collected under three separate conditions (environment/face artifacts/ acquisition devices), each corresponding to a different combination of illumination and background.
Presentation attacks include printed photo attacks created using two printers as well as video replay attacks using two different display devices. Four protocols are proposed for methods benchmarking (see Section 4. 3 for more details). In total, the dataset is composed of 4950 real accesses and attack videos. Examples of the OULU-NPU database are shown in Figure  41. SiW Database  [33]  is the first database to include facial spoofing attacks with both various labelled poses and facial expressions. This database consists of 1320 genuine access videos captured from 165 subjects and 3300 attack videos. Compared to the abovementioned databases, it includes subjects from a wider variety of ethnicities, i. e. , Caucasian (35%), Indian (23%), African American (7%) and Asian (35%). Two kinds of print (photo) attacks and four kinds of video replay attacks have been included in this dataset.
Evaluation Protocol In this section, we present the protocol we used to compare experimentally the different facial PAD methods. In the early studies of facial anti-spoofing detection, there was no uniform protocol to train and evaluate the facial PAD methods. In 2011, a first standard protocol was proposed by Anjos et al. [147]  in order to fairly compare the different methods. In 2017, a second standard protocol was proposed by Boulkenaf et al. [181]  based on an ISO/IEC standard. On top of the evaluation metrics to be used, these protocols address mainly two aspects: (1) how to divide the database and (  2 ) what kinds of tests should be conducted for evaluation, e. g. , intra-database and inter (cross)-database tests.
(a) Dataset division The protocol proposed by Anjos et al. [147]  is widely used when the evaluation is based on PRINT-ATTACK  [147] , REPLAY-ATTACK  [37] , OULU-NPU  [181] , 3DMAD  [25, 58]  and/or CASIA-SURF  [182]. This protocol relies on the division of the dataset into three subsets: training, validation set and test sets (respectively for training, tuning the model's parameters and assessing the performances of the tuned model). Other databases, such as CASIA-FASD  [19] , MSU-MFSD  [32]  and SiW  [33] , only consist of two independent subsets: training and test subsets. In this case, either a small part of the training set is used as a validation set or cross-validation is used to tune the model's parameters. In some datasets (such as OULU-NPU and SiW), the existence of different sessions explicitly containing different capture conditions allowed the authors to propose refined protocols for evaluation (as detailed above in Section 3.
4) and can also be used for dataset division. (b) Intra-database vs. inter-database evaluation An intra-database evaluation protocol uses only a single database to both train and evaluate the PAD methods. However, as the current databases are still limited in terms of variability, intra-database evaluations can be subject to overfitting, and therefore, report biased (optimistic) results. The inter-database test, proposed by Pereira et al. [73]  for evaluating the generalization abilities of a model, consists in training the model on a certain database and then evaluating it on a separate database. Although inter-database tests (or cross-database tests) aim to evaluate the model's generalization abilities, it is important to note that the evaluation performances are still affected by the distribution of the two datasets.
Indeed, if the two datasets' distribution is close (e. g. , if the same PAIs or spoof acquisition devices were used), the inter-database test will also report optimistic results. For instance, for a given model, inter-database evaluations between PRINT-ATTACK and MSU-MFSD (using the same MacBook camera to acquire the images) result in much better performances than inter-database evaluations between CASIA-FASD and MSU-MFSD (where CASIA-FASD uses a USB camera with very differentfrom a MacBook), as reported in  [32].
Comparison and Evaluation of the Results In this part, we compare some of the facial PAD methods detailed in Section 2 on the public benchmarks presented in Section 3 following the intra-database and inter/cross-database protocols described above. Among the more than 50 methods presented in Section 2, we selected here the most influential methods and/or the ones that are among the most characteristic of their type of approach (following the typology presented in Section 2. 1 and Figure  3 , page 7 and used for the methods presentation in Section 2). To compare the performances of the different methods, we used the metrics EER, HETR, APCER, BPCER and ACER described above. The results we report are extracted from the original papers introducing the methods, i. e. , we did not redevelop all these methods to perform the evaluation ourselves.
Intra-Database Evaluation on Public Benchmarks Tables  3  and 4  respectively show the results of the intra-database evaluation on the CASIA-FASD and REPLAY-ATTACK datasets. Compared to static texture feature-based methods such as DoG, LBP-based methods, dynamic texture-based methods such as LBP-TOP, Spectral Cubes  [77]  and DMD  [23]  are more effective on both benchmarks. However, the static features learned using CNNs can boost the performance significantly and sometimes even outperform dynamic texture hand-crafted features. For instance, even the earliest CNN-based method with static texture feature  [34]  has shown a superior performance in terms of HTER than almost all previously introduced state-of-the-art methods based on hand-crafted features. It was the first time that deep CNNs showed potential for facial PAD.
Later, researchers proposed more and more models learning static or dynamic features based on deep CNNs such as LSTM-CNN  [78] , DPCNN  [68]  and Patch-based CNN  [36] , that has achieved the state-of-the-art performances on both the CASIA-FASD and REPLAY-ATTACK datasets. Besides, we can see both in Tables  3  and 4  that Patch-Depth CNN  [36] , fusing different cues (i. e. , texture cue and 3D geometric cue (depth map)), has shown its superiority over single cue-based methods using the same CNN, such as Patch cue-based CNN  [36]  or Depth cue-based CNN  [36]. Indeed, their HTERs are respectively 2. 27%, 2. 85% and 2. 52% on CASIA-FASD and 0. 72%, 0. 86% and 0. 75% on REPLAY-ATTACK. These results show the effectiveness of multiple cues-based methods that, by leveraging different cues, are able to effectively detect a wider variety of PA types.
g. , CDCN++'s ACER arises from 0. 2% for protocol 1 to 5. 0% for protocol 4). Similar results can be observed on SiW. It indicates that the generalization across scenarios is still a challenge for facial PAD methods, even within the same dataset. Compared to the promising results shown in the intra-database test, the inter/cross-database test results are still way worse than most real-world applications requirements. Several databases have been adopted to perform cross (inter)-database evaluation, such as CASIA-FASD vs. MSU-MFSD  [32]  and MSU-USSA vs. REPLAY-ATTACK/CASIA-FASD/MSU-MFSD  [66]. However, most researchers have reported their cross-database evaluation results using REPLAY-ATTACK vs. CASIA-FASD  [33, 69, 73, 79, 81, 82] , since the important differences between these two databases introduce a great challenge for cross-database testing.
3% and 37. 7% HTER when trained on CASI-FASD and REPLAY-ATTACK, respectively). It is noteworthy that the multiple cues-based method Auxiliary  [33] , by fusing depth map and rPPG cues, achieves a good generalization even in the most difficult cross-database tests. For instance, when trained on REPLAY-ATTACK and tested on CASIA-FASD, it achieves slightly better HTER (28. 4%) than the latest method CDCN++  [82]  based on NAS (29. 8%, see Table  7 ). This demonstrates that the multiple cues-based methods, when using different cues that are inherently complementary to each other, can achieve better generalization than facial PAD models based on single cues. However, from a very general perspective, improving the generalization abilities of the current face PAD methods is still a great challenge for facial anti-spoofing.
Discussion From the evaluation results presented in the previous Section 4. 3 , we can see that facial PAD is still a very challenging problem. In particular, the performances of the current facial PAD methods are still below the requirements of most real-world applications (especially in terms of generalization ability). More precisely, the performances are acceptable when there is not too much variation between the conditions of the genuine faces capture for enrollment and the genuine face/PA presentation for authentication (intra-database evaluation). However, • all hand-crafted features show a limited generalization ability, as they are not powerful enough to capture all the possible variations in the acquisition conditions; and • the features learned by deep/wide neural networks are of very high dimensions, compared to the limited size of the training data.
Current Trends and Perspectives As stated earlier, learning features that are distinctive enough to discriminate between genuine faces and various PAs, possibly in very different environments, is still an open issue. Of course, this kind of issue (related to the generalization abilities of data-driven models) are common in the field of computer vision, way beyond facial PAD. However, as collecting impostors' PAs and PAIs is nearly impossible in the wild, collecting/creating a face PAD dataset with sufficient samples and variability (not only regarding the capture conditions but also regarding the different types of PA/PAIs) is still very time-consuming and costly (see Section 3. 2). It is indeed much easier to create a dataset for most object recognition tasks (e. g. , face authentication).