# Face Anti-Spoofing Based on Deep Learning: A Comprehensive Survey
## 1 Introduction  
In the current era of digitalization and intelligence, authentication methods have undergone significant changes. Traditional identity verification methods that rely on physical devices like keys and access cards, which are at risk of loss, so are now being replaced by biometric authentication [1]. Common biometric recognition options include the face [2, 3], fingerprint, iris, palm print, ear, voice [4], finger vein, and gait [5]. Fingerprint data are easy to collect but can be affected by the condition of a user's skin, reducing accuracy. Iris recognition requires specific equipment, making collection difficult. Finger vein data offers high levels of security, but the equipment is not widely available and contact is required, which limits efficiency. Due to the rapid proliferation of image capture devices, facial data are no longer difficult to acquire. Face recognition (FR) [6, 7, 8], due toits simplicity, non-contact nature, and high accuracy, is now widely used in areas such as airport and station access, telecom service processing, financial authentication, and employee attendance management [9].  
However, the rapid growth of FR has also introduced new security risks. Using forged faces to bypass a face recognition system (FRS) can lead to face spoofing attacks. According to a report by China Central Television (CCTV) Finance, in the first half of 2024, multiple cases of criminals wearing silicone face masks to impersonate others and commit theft occurred in Shanghai and Xuzhou, Jiangsu. Using silicone face masks as a disguise during criminal activities is becoming a new tactic for some criminals. Particularly in the era of generative artificial intelligence (GAI), almost nothing seems impervious to being overturned. Even long-held beliefs like \"seeing is believing\" and \"pictures as proof\" are losing credibility. In February 2024, the Hong Kong police disclosed an AI-powered \"multi-face swapping\" fraud case involving a loss of 200 million Hong Kong dollars. These cases illustrate that FRSs without anti-spoofing verification cannot ensure security, posing a significant threat to users' privacy and property. Accurately determining the authenticity of faces is crucial for user security.  
Today, significant breakthroughs in face recognition have been made. However, face recognition still has potential risks and faces various attacks, including those in both the digital and physical domains [10]. These attacks have raised urgent public security concerns such as user privacy leaks, identity theft, and financial fraud. As shown in Figure 1, in steps 1 and 2, respectively, FRSs are susceptible to both physical and digital face attacks [10]. Malicious attackers can easily launch various physical presentation attacks during the face capture stage (i.e., step 1) and can use various digital forgery means (i.e., step 2) to attack a FRS.  
With the rapid development of generative adversarial networks (GANs) [11], face deepfakes have been dramatically improved and forged faces and videos [12] are becoming more and more sophisticated. As shown in the upper part of Figure 1, face deepfakes refer to a face manipulation technology based on deep learning (DL). It can purposefully manipulate faces in images and videos, including through face attribute manipulation [13], face reenactment, face swapping, entire face synthesis, etc. [14]. However, in real environments, FRSs typically capture images through devices and input them directly into the system.  
Figure 1: Overview of the FR process. Step1�and step2�are vulnerable to physical and digital face attacks.  
Conducting various attacks on digital images during transmission is challenging, whereas physical attacks are easier to implement. In the physical realm, FRSs can be compromised by presentation attacks (PAs), including print attacks, replay attacks, 3D mask attacks, physical adversarial attacks, as well as makeup and tattoos [15]. Therefore, we focus on discussing presentation attacks and detection methods in the physical domain.