Demorphing: Unmixing Facial Identities
- Demorphing is the forensic task of reversing composite facial images to recover the original identities for secure biometric verification.
- It employs both reference-based and reference-free approaches, utilizing methods like U-Net inversion, transformer latent unmixing, and diffusion models.
- Recent advancements emphasize robust identity disentanglement through coupled generative priors and operational metrics to counter morph replication and technique shifts.
Demorphing is the forensic task of disentangling a morphed face image back into the constituent identities that were used to create it. In facial biometrics, a morph is deliberately synthesized so that one composite image can match multiple people, which makes demorphing distinct from Morph Attack Detection (MAD): MAD determines whether an image is a morph, whereas demorphing seeks to recover the underlying bona fide faces and thereby provide identity-level evidence for investigation, attribution, and operational decision support. The contemporary literature spans reference-based inversion, single-image reference-free recovery, latent- and feature-space disentanglement, diffusion-based coupled generation, and operational Differential MAD (D-MAD) pipelines (Banerjee et al., 2022, Shukla et al., 20 May 2025).
1. Threat model and forensic significance
A facial morph combines two different identities into a single image that remains biometrically similar to each contributor. A standard formulation denotes the constituent images by and , the morphing operator by , and the output morph by , so that
A successful morph attack requires the composite to match both contributors under a biometric comparator at threshold , while remaining visually plausible:
This definition appears explicitly in early reference-free facial demorphing work and formalizes why demorphing is a security problem rather than merely an image restoration task (Banerjee et al., 2022).
The operational motivation is strongest in document issuance and border verification. Reference-based FD-GAN framed the problem in the e-passport setting: a morphed document image can allow both a criminal and an accomplice to pass checks with one credential, and demorphing is therefore intended to reconstruct the hidden accomplice’s face from the morphed image and an auxiliary capture of the other contributor (Peng et al., 2018). Later operational work generalized this rationale to D-MAD, where demorphing is used to reconstruct the “other” identity not present in the trusted reference and then score biometric consistency, while also producing visual reconstructions for human examiners (Ismayilov et al., 30 Mar 2026).
This forensic role differentiates demorphing from ordinary inverse problems. The target is not simply an image pair with low pixel error, but a pair of outputs that correspond to the true contributors, are mutually separable in biometric space, and remain useful under realistic operational thresholds. A plausible implication is that demorphing occupies an intermediate position between biometric security, generative modeling, and explainable forensic reconstruction.
2. Formal task definition and problem variants
The central reference-free task is: given only a morphed image created from two identities and 0, recover two outputs 1 and 2 such that 3 and 4, without any reference image or knowledge of morph parameters or technique. In the 2022 single-image formulation, the outputs are explicitly unordered, so the model does not enforce which output corresponds to which original identity; training and evaluation therefore use order-agnostic objectives and pairing rules (Banerjee et al., 2022).
Two major settings recur throughout the literature. Reference-based demorphing assumes that one trusted contributor image is available at test time and uses that image to recover the other identity. FD-GAN and MorphGANFormer both belong to this class, although they differ substantially in mechanism: FD-GAN learns symmetric identity separation directly in image space, whereas MorphGANFormer performs latent-space unmixing inside a transformer-based generator, using a known or fixed mixture weight 5 and the relation
6
The former avoids explicit morph-parameter inversion; the latter makes the unmixing step analytically simple but retains the reference requirement (Peng et al., 2018, Zhang et al., 2023).
Reference-free demorphing removes the auxiliary image and is therefore more generally deployable, but substantially more ill-posed. The evaluation paper on reference-free demorphing emphasizes that infinitely many decompositions can explain one morph, that outputs are unordered, and that morphs are intrinsically similar to both sources, which makes naïve biometric-only evaluation unreliable (Shukla et al., 21 Jan 2025).
The same evaluation paper also identifies three train/test scenarios. In Scenario 1, 7; in Scenario 2, 8; and in Scenario 3, train and test identities are disjoint. Scenario 3 is described as the most realistic and challenging (Shukla et al., 21 Jan 2025). This distinction has become central because several high-performing demorphers were initially reported in Scenario 1, whereas later work emphasizes identity-disjoint and technique-disjoint generalization.
3. Methodological development
The field has progressed from explicit or semi-explicit inversion with references toward increasingly general reference-free generative priors. The major lines of development can be summarized as follows.
| Approach | Setting | Central mechanism |
|---|---|---|
| FD-GAN | Reference-based | Symmetric dual network with identity encoder, identity separation, facial restoration, and two levels of restoration losses (Peng et al., 2018) |
| MorphGANFormer | Reference-based | Transformer generator with latent-space morphing and demorphing as latent unmixing using the same generator (Zhang et al., 2023) |
| Facial De-morphing | Reference-free | U-Net generator, decomposition critic, two Markovian discriminators, and cross-road reconstruction and biometric losses (Banerjee et al., 2022) |
| SDeMorph | Reference-free | DDPM-based method that reconstructs identities using a branched-UNet (Shukla, 2023) |
| Identity Preserving Image Decomposition | Reference-free | Decomposer into multiple identity-suppressing components and merger with dual decoder heads (Shukla et al., 2024) |
| diffDeMorph | Reference-free | Coupled diffusion with 6-channel joint output and RGB conditioning at every denoising step (Shukla et al., 20 May 2025) |
| SFDemorpher | D-MAD / reference-based operational setting | Joint StyleGAN latent and feature-space disentanglement with dual-pass training on morphs and bona fides (Ismayilov et al., 30 Mar 2026) |
Early reference-based learning concentrated on identity separation with explicit auxiliary evidence. FD-GAN introduced a symmetric dual network architecture in which one path restores the accomplice from the morph and the known criminal image, and the reverse path restores the criminal from the morph and the accomplice. The architecture comprises an identity encoder, an identity separation module, a facial restoration decoder, and a pairwise discriminator; pixel-level, feature-level, adversarial, and symmetry constraints jointly regularize the restoration (Peng et al., 2018). MorphGANFormer retained the reference-based assumption but moved the problem into the latent space of a transformer-based generator, interpreting demorphing as latent unmixing rather than direct RGB reconstruction (Zhang et al., 2023).
The 2022 single-image method marked a turning point by proposing, to the authors’ knowledge, the first single-image, reference-free demorpher that simultaneously recovers both component identities with no prior knowledge of the morphing process. Its generator is a U-Net; training uses a decomposition critic, two PatchGAN-style Markovian discriminators, and a biometric comparator implemented with ArcFace via DeepFace. Its key innovation is the use of order-agnostic “cross-road” losses, which take the minimum over the two possible assignments between outputs and ground-truth identities:
9
with an analogous cross-road biometric loss based on ArcFace cosine distance (Banerjee et al., 2022).
Subsequent reference-free methods diversified the underlying prior. SDeMorph described a reference-free DDPM approach that destroys the morphed signal and reconstructs it with a branched-UNet, targeting higher-quality outputs than earlier GAN-based single-image demorphers (Shukla, 2023). Identity Preserving Image Decomposition reformulated demorphing as an ill-posed decomposition problem: a decomposer produces 0 identity-suppressing components, and a merger learns to recombine them into one or two outputs. Its training objective combines cross-road supervision with penalties that make components dissimilar from the input and mutually dissimilar, thereby discouraging direct identity reconstruction from any single component (Shukla et al., 2024).
Later work increasingly emphasized domain robustness. diffDeMorph trains solely on synthetic morphs and tests on real morphs, while conditioning every denoising step directly on the morph in RGB space. It represents the two recovered identities jointly as a 6-channel sample and minimizes a conditional diffusion loss
1
without adding explicit identity-embedding or separation losses (Shukla et al., 20 May 2025). The 2025 latent conditional GAN instead moves reference-free demorphing into the latent space of the Stable Diffusion VAE, uses a conditional adversarial objective on morph–constituent triplets, and adds a kurtosis regularizer to suppress morph replication (Shukla et al., 24 Jul 2025). The 2026 MLLM-guided framework extends coupled RGB diffusion with conditioning from intermediate hidden states of Qwen3-VL-8B and LLaVA-1.6-mistral-7B, arguing that hidden states provide identity-relevant semantic structure without the lossy detour of text generation and re-encoding (Shukla et al., 25 May 2026).
This sequence suggests a methodological shift away from morph-specific inversion assumptions and toward coupled generative priors that are designed to survive technique shift, style shift, and identity-disjoint evaluation.
4. Datasets, protocols, and evaluation methodology
Demorphing research relies on both synthetic and real morph datasets, and the choice of protocol has become nearly as important as the model family. Landmark-based morph benchmarks include AMSL and several FRLL-derived sets produced with OpenCV/dlib, FaceMorpher, and WebMorph. Generative morph datasets include E-MorGAN, ReGenMorph, MorDIFF, StyleGAN-based FRLL morphs, and SMDD. Additional datasets enter specialized settings: CASIA-WebFace is used for decomposition pretraining in Identity Preserving Image Decomposition; DemorphDB, FLUXSynID, FRLL-Morphs-UTW, HNU-FM, and FEI Morph V2 are used in operational D-MAD studies (Banerjee et al., 2022, Shukla et al., 2024, Shukla et al., 20 May 2025, Ismayilov et al., 30 Mar 2026).
A recurring protocol distinction concerns whether training and testing share identities, morph generators, or image styles. Recent generalization-oriented work explicitly trains on synthetic faces and evaluates on real FRLL-based morphs produced by multiple unseen techniques, thereby reducing privacy concerns and limiting train/test leakage (Shukla et al., 20 May 2025). Operational D-MAD work goes further by mixing predominantly synthetic identities with smaller real corpora and by alternating training passes over morphs and bona fide documents, precisely because deployment cannot assume that every input document is a morph (Ismayilov et al., 30 Mar 2026).
Evaluation remains contested. The following metrics recur most often.
| Metric | Intended role | Limitation or strength |
|---|---|---|
| TMR@FMR / TAR@FAR | Biometric recovery under calibrated operating points | A trivial morph-replication solution can achieve 100% TMR@10% FMR on all six datasets analyzed in the metric study (Shukla et al., 21 Jan 2025) |
| RA | Fixed-threshold biometric restoration score | Also vulnerable to trivial solutions and depends on ground-truth pairing (Shukla et al., 21 Jan 2025) |
| PSNR / SSIM | Pixel or structural fidelity | Identity-agnostic and sensitive to nuisance factors (Shukla et al., 21 Jan 2025) |
| BW(SSIM), BW(PSNR) | Cross-weight biometric similarity and IQA | Proposed to jointly capture identity fidelity and image quality (Shukla et al., 21 Jan 2025) |
| d-prime | Separation between morph and non-morph score distributions | Used to quantify output-to-input distance separability (Banerjee et al., 2022) |
| BMS | 1-Wasserstein margin between bona fide and morph D-MAD score distributions | Measures operational separability in demorphing-based D-MAD (Ismayilov et al., 30 Mar 2026) |
The proposed biometrically cross-weighted IQA metric is
2
where the maximization resolves the output permutation and the biometric score multiplicatively weights IQA. The motivation is explicit: TMR and RA can be gamed by outputting the input morph twice, whereas PSNR and SSIM can favor cross-identity similarities that are visually or biometrically incorrect (Shukla et al., 21 Jan 2025).
5. Empirical behavior, robustness, and known failure modes
Reported results show both rapid progress and sharp dependence on the evaluation regime. In the 2022 single-image reference-free study, separation between morphed and non-morphed output-to-input average-distance distributions reached d-prime values of 4.25 on AMSL, 0.60 on E-MorGAN, and 4.07 on ReGenMorph. On morphed test sets, True Match Rate at False Match Rate 10% was 62.5% and 78.6% for the two subjects on AMSL, 53.0% and 51.0% on E-MorGAN, and 90.7% and 90.3% on ReGenMorph (Banerjee et al., 2022). These numbers already indicate a pattern that remained visible later: structured landmark-based or GAN-regenerated morphs tend to be easier to demorph than unconstrained GAN-only morphs.
Identity Preserving Image Decomposition reported strong Scenario 1 restoration accuracy and explicitly compared itself to SDeMorph. On SMDD, Subject 1 restoration accuracy was 97.80% versus 96.57% for SDeMorph, and Subject 2 was 99.93% versus 99.37%; on AMSL, Subject 1 was 99.84% versus 97.70%, and Subject 2 was 99.56% versus 97.24%. The same work also probed identity leakage in its components: when only one component replicated 3 times was passed to the merger, identity was recoverable in 0.0% for component 1, 16.43–18.46% for component 2, and 0.0% for component 3 on CASIA (Shukla et al., 2024).
The strongest generalization claims appear in diffusion-based assumption-free protocols. diffDeMorph, trained on synthetic morphs and tested on six real datasets, reported TMR@10% FMR of 99.49% on AMSL, 100.00% on OpenCV, 100.00% on FaceMorpher, 99.84% on WebMorph, 99.81% on MorDIFF, and 99.32% on StyleGAN, and stated gains of at least 59.46% in Restoration Accuracy over the closest competitor under a common training protocol (Shukla et al., 20 May 2025). By contrast, the latent conditional GAN, although also trained on synthetic morphs and tested on real morphs from unseen techniques, still identified StyleGAN morphs as the hardest case, with RA@1%FMR of 12.57% using ArcFace and 20.75% using AdaFace (Shukla et al., 24 Jul 2025). The MLLM-guided coupled diffusion model preserved this pattern: at 0.1% FMR, its Qwen3-VL middle-layer configuration reached 98.65% RA on OpenCV and 94.63% on MorDiff with ArcFace, but only 9.13% on StyleGAN (Shukla et al., 25 May 2026).
These results clarify several persistent failure modes. Morph replication remains a central pathology: without identity-aware or coupling constraints, models may output two near-duplicates of the input morph. The 2022 method explicitly observed that removing the biometric loss caused the two outputs to become near-duplicates (Banerjee et al., 2022). Style and technique dependence also remains decisive. Generative morphs from unconstrained sources, especially StyleGAN-based ones, repeatedly underperform landmark-based and diffusion-regenerated morphs (Shukla et al., 24 Jul 2025, Shukla et al., 25 May 2026). Protocol inflation is another recognized issue: strong scores in Scenario 1 do not necessarily imply identity-disjoint generalization (Shukla et al., 2024, Shukla et al., 21 Jan 2025). Task asymmetry appears in operational D-MAD: accomplice restoration is more tractable than criminal restoration because splicing-based morphs may omit the criminal’s outer-face region, rendering criminal recovery ill-posed (Ismayilov et al., 30 Mar 2026).
A plausible synthesis is that current performance numbers are best interpreted jointly with the morph generator, identity split, and operational threshold. Demorphing accuracy is not a single scalar property of a model family; it is a function of how much constituent identity survives in the morph, how much style shift separates training and test data, and whether the evaluation penalizes trivial solutions.
6. Operational use, broader scope, and open problems
Demorphing is increasingly treated as a component in end-to-end biometric security rather than as a standalone image-generation task. The operational pattern proposed in several studies is to use dedicated MAD or D-MAD front ends to flag suspicious inputs and then invoke demorphing to recover candidate contributor identities for watchlist search, attribution, or human review. The 2022 reference-free study explicitly proposed using output-to-input ArcFace distances and their d-prime separation as a mechanism to help distinguish morphs from non-morphs while simultaneously recovering identities (Banerjee et al., 2022). SFDemorpher generalized this to an operational D-MAD framework with dual-pass training on bona fide and morphed documents, achieving EER values of 0.08% on FRLL-Morphs-UTW accomplice restoration, 0.27% on HNU-FM, 0.25% on FEI Morph V2 accomplice restoration, and 5.33% on FEI Morph V2 criminal restoration, while also widening the bona fide–morph margin measured by BMS (Ismayilov et al., 30 Mar 2026).
The concept has also begun to appear outside facial biometrics. In AudioMorphix, audio mixing is conceptualized as morphing on a latent manifold and audio removal is explicitly framed as demorphing: a reference sound is separated from a mixture by optimization in noisy latent space and energy-guided diffusion over masked spectrogram regions (Liang et al., 21 May 2025). This use is not biometric, but it shows that “demorphing” can denote a broader decomposition paradigm in which a deliberately blended signal is separated back into constituent components.
Open problems are consistently identified across the literature. These include more robust handling of generative morphs from unconstrained sources, extension beyond two contributors, explicit forward-morph consistency or morph-parameter estimation, attention-guided demorphing, stronger domain-shift robustness across demographics and capture conditions, calibrated confidence estimates, and possibly certified guarantees for forensic use (Banerjee et al., 2022). Additional priorities include evaluation in Scenario 2 and Scenario 3 rather than only Scenario 1, integration with broader D-MAD pipelines, and reduction of inference cost for high-resolution or iterative diffusion systems (Shukla et al., 2024, Shukla et al., 20 May 2025, Ismayilov et al., 30 Mar 2026, Shukla et al., 25 May 2026).
Demorphing has therefore evolved from a narrowly constrained reversal of landmark blending into a broader research area concerned with identity disentanglement under adversarial image synthesis. Its central scientific difficulty remains unchanged: recovering multiple plausible, identity-faithful constituents from a single composite without permitting the model to collapse into replication, overfit to a morph generator, or lose operational relevance.