# Face Anti-Spoofing Based on Deep Learning: A Comprehensive Survey
## 2 Attack Types
### Impersonation Attacks  
Print attacks refer to an attack method in which the attacker prints the target user's face on paper and presents it in front of the camera to deceive the FRS. This attack method is straightforward and typical. Some attackers will cut out the eyes, nose, mouth, and other parts of the photo to expose the attacker's organs and simulate the blinking and opening of a real person's mouth, significantly increasing the difficulty of liveness detection. Examples of print attacks are shown in Figure 3a. For example, in the CASIA-MFSD [25] database, print attacks are collected by photographing printed photos. Specifically, a face image is first printed, and the photo is then distorted or cropped to \"simulate\" an honest face. Finally, the distorted or cropped photo is recorded to generate a spoofing face video. CASIA-MFSD used three cameras to capture face images at three different quality levels. Low-quality videos were captured using a long-time-used USB camera with a resolution of \(640\times 480\) pixels. Normal-quality videos were recorded with a newly purchased USB camera at \(480\times 640\) pixels. Furthermore, high-quality videos were recorded using a high-resolution Sony NEX-5 camera with a maximum resolution of \(1280\times 720\).  
Reply attacks refer to an attack method in which an attacker uses the replay function of an electronic device to play a video of the target user and presents it in front of the camera  
Figure 2: Topology of face presentation attack types.  
of the capture device. This attack method is more threatening than a photo printing attack. Video replay attacks can easily invalidate algorithms that detect facial movements, posing a considerable challenge to the versatility of liveness detection algorithms. Examples of replay attacks are shown in Figure 3b.  
In the CASIA-MFSD [25] database, a reply attack is performed by displaying high-resolution real videos on an iPad. Due to the iPad screen's resolution limitation, the device inevitably downscales the original high-resolution (1280\(\times\) 720) videos. The MSU-MFSD dataset [26] divides replay attacks into two cases. One involves recording with a Canon 550D camera and replaying the video on an iPad Air, and the other involves recording with an iPhone 5S and replaying it on the same device.  
A 3D masks attacks involves creating masks from materials like resin, plaster, or silicon to mimic a target user's face and deceive a FRS. These attacks are rare and complex due to the challenges in obtaining accurate 3D facial data, which requires specialized equipment, as well as the high cost and time involved in producing realistic masks. Inferior masks can be easily detected using simple texture features, but advanced masks with realistic textures can often bypass most liveness detection algorithms. However, due to the difficulties and costs associated with creating 3D masks, detection methods still primarily focus on photo and video replay attacks. Examples of 3D mask attacks are shown in Figure 3c. For example, the HiFiMask [27] dataset includes 25 subjects with yellow, white, and black skin tones to promote a fair AI and reduce bias caused by skin colour (a total of 75 subjects).