# Face Anti-Spoofing Based on Deep Learning: A Comprehensive Survey
## 3 Face Anti-Spoofing
### Generalization Methods on Unknown attacks  
Most previous DL-based methods treat FAS as a closed-set problem, concentrating on predefined spoofing attacks. However, it is unrealistic to cover all potential attacks within the dataset, leading to models that overfit on known attacks and remain vulnerable to unknown ones. Recently, researchers have shifted their focus towards making FAS models more robust to unknown attacks, with zero-shot/few-shot learning and anomaly detection being two popular approaches. Methods Based on Zero-shot/Few-shot:  
Zero-shot/few-shot learning, in theory, originate from DA, and methodologically fall under representation learning or meta-learning. Many existing approaches use spoofing samples of the same type during both training and testing, such as print attacks or replay attacks. However, these methods may perform poorly when encountering novel attacks that were not seen during training. Therefore, it is necessary to develop network models that can leverage previously learned knowledge to handle unknown attacks. To address this challenge, zero-shot/few-shot learning have emerged as important solutions. The key difference between the two lies in data availability. Zero-shot learning focuses solely on learning from existing spoofing types without access to any samples of novel attacks, whereas few-shot learning involves a small number of samples from the novel attack types. [PERSON] et al. [28] introduced the FAS database, which included 13 types of spoof attacks, and studied the zero-shot FAS problem. They proposed an unsupervised deep tree network (DTN) to classify unknown attacks. [PERSON] et al. [147] proposed a meta-learning framework following the continual few-shot learning paradigm to address the problem of catastrophic forgetting, while enabling continuous model learning when faced with sequentially arriving novel attack data. [PERSON] et al. [148] defined FAS as a zero-shot/few-shot problem and introduced an adaptive method that detected unknown attacks by learning from real and fake faces and new attack samples. [PERSON] et al. [149] proposed a few-shot domain expansion strategy that aligned the source and target domains in the semantic space in an unsupervised manner, enabling the model to perform well in their joint expansion domain. [PERSON] et al. [150] demonstrated that fine-tuned ViT models performed well on unknown attacks and cross-dataset evaluation. [PERSON] et al. [151] presented a self-attention adversarial learning framework (ADGN) to create a generic yet distinct latent space (GDL-space) for improving generalization against rare, and unseen attacks. [PERSON] et al. [152] introduced ensemble adapters and feature-wise transformation layers  
\begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline \multirow{2}{*}{**Ref. **} & \multicolumn{2}{c}{**O\&C\&C\(\rightarrow\)M**} & \multicolumn{2}{c}{**O\&C\&C\&M\(\rightarrow\)I**} & \multicolumn{2}{c}{**I\&C\&M\(\rightarrow\)O**} \\  & **HTER\(\downarrow\)** & **AUC\(\uparrow\)** & **HTER\(\downarrow\)** & **AUC\(\uparrow\)** & **HTER\(\downarrow\)** & **AUC\(\uparrow\)** & **HTER\(\downarrow\)** & **AUC\(\uparrow\)** \\ \hline
[129] & 27.98 & 80.02 &  
in ViT for robust performance with few samples. Table 12 summarizes the FAS methods based on zero-shot/few-shot learning. Methods based on anomaly detection:  
Anomaly detection is designed to to identify abnormal samples that deviate from normality during testing. In face anti-spoofing, live faces are considered normal, while attacks are abnormal. Unlike the traditional two-class classification, anomaly detection usually employs a one-class classification, using only real faces for training, as attack types are often unknown in practical scenarios. [PERSON] et al. [153] introduced a deep metric learning model with triplet loss and a few-shot a posteriori probability estimation for anomaly detection, improving feature representations. [PERSON] et al.