---
title: 'Demorphing: Unmixing Facial Identities'
url: https://www.emergentmind.com/topics/demorphing
type: topic
---

# Demorphing: Unmixing Facial Identities

Demorphing is the forensic task of disentangling a morphed face image back into the constituent identities that were used to create it. In facial biometrics, a morph is deliberately synthesized so that one composite image can match multiple people, which makes demorphing distinct from Morph Attack Detection (MAD): MAD determines whether an image is a morph, whereas demorphing seeks to recover the underlying bona fide faces and thereby provide identity-level evidence for investigation, attribution, and operational decision support. The contemporary literature spans reference-based inversion, single-image reference-free recovery, latent- and feature-space disentanglement, diffusion-based coupled generation, and operational Differential MAD (D-MAD) pipelines [2209.02933] [2505.14527].

## 1. Threat model and forensic significance

A facial morph combines two different identities into a single image that remains biometrically similar to each contributor. A standard formulation denotes the constituent images by $\mathcal{I}_1$ and $\mathcal{I}_2$, the morphing operator by $\mathcal{M}$, and the output morph by $\mathcal{X}$, so that
$$
\mathcal{X} = \mathcal{M}(\mathcal{I}_1,\mathcal{I}_2).
$$
A successful morph attack requires the composite to match both contributors under a biometric comparator $\mathcal{B}$ at threshold $\mathcal{T}$, while remaining visually plausible:
$$
\mathcal{B}(\mathcal{X},\mathcal{I}_1) > \mathcal{T}
\quad \text{and} \quad
\mathcal{B}(\mathcal{X},\mathcal{I}_2) > \mathcal{T}.
$$
This definition appears explicitly in early reference-free facial demorphing work and formalizes why demorphing is a security problem rather than merely an image restoration task [2209.02933].

The operational motivation is strongest in document issuance and border verification. Reference-based FD-GAN framed the problem in the e-passport setting: a morphed document image can allow both a criminal and an accomplice to pass checks with one credential, and demorphing is therefore intended to reconstruct the hidden accomplice’s face from the morphed image and an auxiliary capture of the other contributor [1811.07665]. Later operational work generalized this rationale to D-MAD, where demorphing is used to reconstruct the “other” identity not present in the trusted reference and then score biometric consistency, while also producing visual reconstructions for human examiners [2603.28322].

This forensic role differentiates demorphing from ordinary inverse problems. The target is not simply an image pair with low pixel error, but a pair of outputs that correspond to the true contributors, are mutually separable in biometric space, and remain useful under realistic operational thresholds. A plausible implication is that demorphing occupies an intermediate position between biometric security, generative modeling, and explainable forensic reconstruction.

## 2. Formal task definition and problem variants

The central reference-free task is: given only a morphed image $\mathcal{X}$ created from two identities $\mathcal{I}_1$ and $\mathcal{I}_2$, recover two outputs $\mathcal{O}_1$ and $\mathcal{O}_2$ such that $\mathcal{O}_1 \approx \mathcal{I}_1$ and $\mathcal{O}_2 \approx \mathcal{I}_2$, without any reference image or knowledge of morph parameters or technique. In the 2022 single-image formulation, the outputs are explicitly unordered, so the model does not enforce which output corresponds to which original identity; training and evaluation therefore use order-agnostic objectives and pairing rules [2209.02933].

Two major settings recur throughout the literature. **Reference-based demorphing** assumes that one trusted contributor image is available at test time and uses that image to recover the other identity. FD-GAN and MorphGANFormer both belong to this class, although they differ substantially in mechanism: FD-GAN learns symmetric identity separation directly in image space, whereas MorphGANFormer performs latent-space unmixing inside a transformer-based generator, using a known or fixed mixture weight $\lambda$ and the relation
$$
Z = \lambda Z_1 + (1-\lambda) Z_2,
\qquad
Z_2 = \frac{Z-\lambda Z_1}{1-\lambda}.
$$
The former avoids explicit morph-parameter inversion; the latter makes the unmixing step analytically simple but retains the reference requirement [1811.07665] [2302.09404].

**Reference-free demorphing** removes the auxiliary image and is therefore more generally deployable, but substantially more ill-posed. The evaluation paper on reference-free demorphing emphasizes that infinitely many decompositions can explain one morph, that outputs are unordered, and that morphs are intrinsically similar to both sources, which makes naïve biometric-only evaluation unreliable [2501.12319].

The same evaluation paper also identifies three train/test scenarios. In **Scenario 1**, $\mathcal{Y}_{test}\subseteq\mathcal{Y}_{train}$; in **Scenario 2**, $\mathcal{Y}_{test}\cap\mathcal{Y}_{train}\neq \phi$; and in **Scenario 3**, train and test identities are disjoint. Scenario 3 is described as the most realistic and challenging [2501.12319]. This distinction has become central because several high-performing demorphers were initially reported in Scenario 1, whereas later work emphasizes identity-disjoint and technique-disjoint generalization.

## 3. Methodological development

The field has progressed from explicit or semi-explicit inversion with references toward increasingly general reference-free generative priors. The major lines of development can be summarized as follows.

| Approach | Setting | Central mechanism |
|---|---|---|
| FD-GAN | Reference-based | Symmetric dual network with identity encoder, identity separation, facial restoration, and two levels of restoration losses [1811.07665] |
| MorphGANFormer | Reference-based | Transformer generator with latent-space morphing and demorphing as latent unmixing using the same generator [2302.09404] |
| Facial De-morphing | Reference-free | U-Net generator, decomposition critic, two Markovian discriminators, and cross-road reconstruction and biometric losses [2209.02933] |
| SDeMorph | Reference-free | DDPM-based method that reconstructs identities using a branched-UNet [2308.11442] |
| Identity Preserving Image Decomposition | Reference-free | Decomposer into multiple identity-suppressing components and merger with dual decoder heads [2408.10993] |
| diffDeMorph | Reference-free | Coupled diffusion with 6-channel joint output and RGB conditioning at every denoising step [2505.14527] |
| SFDemorpher | D-MAD / reference-based operational setting | Joint StyleGAN latent and feature-space disentanglement with dual-pass training on morphs and bona fides [2603.28322] |

Early reference-based learning concentrated on identity separation with explicit auxiliary evidence. FD-GAN introduced a symmetric dual network architecture in which one path restores the accomplice from the morph and the known criminal image, and the reverse path restores the criminal from the morph and the accomplice. The architecture comprises an identity encoder, an identity separation module, a facial restoration decoder, and a pairwise discriminator; pixel-level, feature-level, adversarial, and symmetry constraints jointly regularize the restoration [1811.07665]. MorphGANFormer retained the reference-based assumption but moved the problem into the latent space of a transformer-based generator, interpreting demorphing as latent unmixing rather than direct RGB reconstruction [2302.09404].

The 2022 single-image method marked a turning point by proposing, to the authors’ knowledge, the first single-image, reference-free demorpher that simultaneously recovers both component identities with no prior knowledge of the morphing process. Its generator is a U-Net; training uses a decomposition critic, two PatchGAN-style Markovian discriminators, and a biometric comparator implemented with ArcFace via DeepFace. Its key innovation is the use of order-agnostic “cross-road” losses, which take the minimum over the two possible assignments between outputs and ground-truth identities:
$$
\mathcal{L}_R(\mathcal{G})
=
\min \left[
\| \mathcal{I}_1-\mathcal{O}_1 \|_1 + \| \mathcal{I}_2-\mathcal{O}_2 \|_1,
\;
\| \mathcal{I}_1-\mathcal{O}_2 \|_1 + \| \mathcal{I}_2-\mathcal{O}_1 \|_1
\right],
$$
with an analogous cross-road biometric loss based on ArcFace cosine distance [2209.02933].

Subsequent reference-free methods diversified the underlying prior. SDeMorph described a reference-free DDPM approach that destroys the morphed signal and reconstructs it with a branched-UNet, targeting higher-quality outputs than earlier GAN-based single-image demorphers [2308.11442]. Identity Preserving Image Decomposition reformulated demorphing as an ill-posed decomposition problem: a decomposer produces $k$ identity-suppressing components, and a merger learns to recombine them into one or two outputs. Its training objective combines cross-road supervision with penalties that make components dissimilar from the input and mutually dissimilar, thereby discouraging direct identity reconstruction from any single component [2408.10993].

Later work increasingly emphasized domain robustness. diffDeMorph trains solely on synthetic morphs and tests on real morphs, while conditioning every denoising step directly on the morph in RGB space. It represents the two recovered identities jointly as a 6-channel sample and minimizes a conditional diffusion loss
$$
L_{diff}
=
\mathbb{E}_{x,i\sim p(i|x),\epsilon,t}
\left[
\| \epsilon - \epsilon_\theta((i_t,x),t) \|_2^2
\right],
$$
without adding explicit identity-embedding or separation losses [2505.14527]. The 2025 latent conditional GAN instead moves reference-free demorphing into the latent space of the Stable Diffusion VAE, uses a conditional adversarial objective on morph–constituent triplets, and adds a kurtosis regularizer to suppress morph replication [2507.18566]. The 2026 MLLM-guided framework extends coupled RGB diffusion with conditioning from intermediate hidden states of Qwen3-VL-8B and LLaVA-1.6-mistral-7B, arguing that hidden states provide identity-relevant semantic structure without the lossy detour of text generation and re-encoding [2605.25442].

This sequence suggests a methodological shift away from morph-specific inversion assumptions and toward coupled generative priors that are designed to survive technique shift, style shift, and identity-disjoint evaluation.

## 4. Datasets, protocols, and evaluation methodology

Demorphing research relies on both synthetic and real morph datasets, and the choice of protocol has become nearly as important as the model family. Landmark-based morph benchmarks include AMSL and several FRLL-derived sets produced with OpenCV/dlib, FaceMorpher, and WebMorph. Generative morph datasets include E-MorGAN, ReGenMorph, MorDIFF, StyleGAN-based FRLL morphs, and SMDD. Additional datasets enter specialized settings: CASIA-WebFace is used for decomposition pretraining in Identity Preserving Image Decomposition; DemorphDB, FLUXSynID, FRLL-Morphs-UTW, HNU-FM, and FEI Morph V2 are used in operational D-MAD studies [2209.02933] [2408.10993] [2505.14527] [2603.28322].

A recurring protocol distinction concerns whether training and testing share identities, morph generators, or image styles. Recent generalization-oriented work explicitly trains on synthetic faces and evaluates on real FRLL-based morphs produced by multiple unseen techniques, thereby reducing privacy concerns and limiting train/test leakage [2505.14527]. Operational D-MAD work goes further by mixing predominantly synthetic identities with smaller real corpora and by alternating training passes over morphs and bona fide documents, precisely because deployment cannot assume that every input document is a morph [2603.28322].

Evaluation remains contested. The following metrics recur most often.

| Metric | Intended role | Limitation or strength |
|---|---|---|
| TMR@FMR / TAR@FAR | Biometric recovery under calibrated operating points | A trivial morph-replication solution can achieve 100% TMR@10% FMR on all six datasets analyzed in the metric study [2501.12319] |
| RA | Fixed-threshold biometric restoration score | Also vulnerable to trivial solutions and depends on ground-truth pairing [2501.12319] |
| PSNR / SSIM | Pixel or structural fidelity | Identity-agnostic and sensitive to nuisance factors [2501.12319] |
| BW(SSIM), BW(PSNR) | Cross-weight biometric similarity and IQA | Proposed to jointly capture identity fidelity and image quality [2501.12319] |
| d-prime | Separation between morph and non-morph score distributions | Used to quantify output-to-input distance separability [2209.02933] |
| BMS | 1-Wasserstein margin between bona fide and morph D-MAD score distributions | Measures operational separability in demorphing-based D-MAD [2603.28322] |

The proposed biometrically cross-weighted IQA metric is
$$
BW(iqa)
=
\mathbb{E}_{x \in \mathcal{X}}
\max \left(
\sum_{i\in\{1,2\}} \mathcal{B}(o_i,i_i)\cdot iqa(o_i,i_i),
\;
\sum_{\substack{i\in\{1,2\}\\j=i\%2+1}} \mathcal{B}(o_i,i_j)\cdot iqa(o_i,i_j)
\right),
$$
where the maximization resolves the output permutation and the biometric score multiplicatively weights IQA. The motivation is explicit: TMR and RA can be gamed by outputting the input morph twice, whereas PSNR and SSIM can favor cross-identity similarities that are visually or biometrically incorrect [2501.12319].

## 5. Empirical behavior, robustness, and known failure modes

Reported results show both rapid progress and sharp dependence on the evaluation regime. In the 2022 single-image reference-free study, separation between morphed and non-morphed output-to-input average-distance distributions reached d-prime values of 4.25 on AMSL, 0.60 on E-MorGAN, and 4.07 on ReGenMorph. On morphed test sets, True Match Rate at False Match Rate 10% was 62.5% and 78.6% for the two subjects on AMSL, 53.0% and 51.0% on E-MorGAN, and 90.7% and 90.3% on ReGenMorph [2209.02933]. These numbers already indicate a pattern that remained visible later: structured landmark-based or GAN-regenerated morphs tend to be easier to demorph than unconstrained GAN-only morphs.

Identity Preserving Image Decomposition reported strong Scenario 1 restoration accuracy and explicitly compared itself to SDeMorph. On SMDD, Subject 1 restoration accuracy was 97.80% versus 96.57% for SDeMorph, and Subject 2 was 99.93% versus 99.37%; on AMSL, Subject 1 was 99.84% versus 97.70%, and Subject 2 was 99.56% versus 97.24%. The same work also probed identity leakage in its components: when only one component replicated $k$ times was passed to the merger, identity was recoverable in 0.0% for component 1, 16.43–18.46% for component 2, and 0.0% for component 3 on CASIA [2408.10993].

The strongest generalization claims appear in diffusion-based assumption-free protocols. diffDeMorph, trained on synthetic morphs and tested on six real datasets, reported TMR@10% FMR of 99.49% on AMSL, 100.00% on OpenCV, 100.00% on FaceMorpher, 99.84% on WebMorph, 99.81% on MorDIFF, and 99.32% on StyleGAN, and stated gains of at least 59.46% in Restoration Accuracy over the closest competitor under a common training protocol [2505.14527]. By contrast, the latent conditional GAN, although also trained on synthetic morphs and tested on real morphs from unseen techniques, still identified StyleGAN morphs as the hardest case, with RA@1%FMR of 12.57% using ArcFace and 20.75% using AdaFace [2507.18566]. The MLLM-guided coupled diffusion model preserved this pattern: at 0.1% FMR, its Qwen3-VL middle-layer configuration reached 98.65% RA on OpenCV and 94.63% on MorDiff with ArcFace, but only 9.13% on StyleGAN [2605.25442].

These results clarify several persistent failure modes. **Morph replication** remains a central pathology: without identity-aware or coupling constraints, models may output two near-duplicates of the input morph. The 2022 method explicitly observed that removing the biometric loss caused the two outputs to become near-duplicates [2209.02933]. **Style and technique dependence** also remains decisive. Generative morphs from unconstrained sources, especially StyleGAN-based ones, repeatedly underperform landmark-based and diffusion-regenerated morphs [2507.18566] [2605.25442]. **Protocol inflation** is another recognized issue: strong scores in Scenario 1 do not necessarily imply identity-disjoint generalization [2408.10993] [2501.12319]. **Task asymmetry** appears in operational D-MAD: accomplice restoration is more tractable than criminal restoration because splicing-based morphs may omit the criminal’s outer-face region, rendering criminal recovery ill-posed [2603.28322].

A plausible synthesis is that current performance numbers are best interpreted jointly with the morph generator, identity split, and operational threshold. Demorphing accuracy is not a single scalar property of a model family; it is a function of how much constituent identity survives in the morph, how much style shift separates training and test data, and whether the evaluation penalizes trivial solutions.

## 6. Operational use, broader scope, and open problems

Demorphing is increasingly treated as a component in end-to-end biometric security rather than as a standalone image-generation task. The operational pattern proposed in several studies is to use dedicated MAD or D-MAD front ends to flag suspicious inputs and then invoke demorphing to recover candidate contributor identities for watchlist search, attribution, or human review. The 2022 reference-free study explicitly proposed using output-to-input ArcFace distances and their d-prime separation as a mechanism to help distinguish morphs from non-morphs while simultaneously recovering identities [2209.02933]. SFDemorpher generalized this to an operational D-MAD framework with dual-pass training on bona fide and morphed documents, achieving EER values of 0.08% on FRLL-Morphs-UTW accomplice restoration, 0.27% on HNU-FM, 0.25% on FEI Morph V2 accomplice restoration, and 5.33% on FEI Morph V2 criminal restoration, while also widening the bona fide–morph margin measured by BMS [2603.28322].

The concept has also begun to appear outside facial biometrics. In AudioMorphix, audio mixing is conceptualized as morphing on a latent manifold and audio removal is explicitly framed as demorphing: a reference sound is separated from a mixture by optimization in noisy latent space and energy-guided diffusion over masked spectrogram regions [2505.16076]. This use is not biometric, but it shows that “demorphing” can denote a broader decomposition paradigm in which a deliberately blended signal is separated back into constituent components.

Open problems are consistently identified across the literature. These include more robust handling of generative morphs from unconstrained sources, extension beyond two contributors, explicit forward-morph consistency or morph-parameter estimation, attention-guided demorphing, stronger domain-shift robustness across demographics and capture conditions, calibrated confidence estimates, and possibly certified guarantees for forensic use [2209.02933]. Additional priorities include evaluation in Scenario 2 and Scenario 3 rather than only Scenario 1, integration with broader D-MAD pipelines, and reduction of inference cost for high-resolution or iterative diffusion systems [2408.10993] [2505.14527] [2603.28322] [2605.25442].

Demorphing has therefore evolved from a narrowly constrained reversal of landmark blending into a broader research area concerned with identity disentanglement under adversarial image synthesis. Its central scientific difficulty remains unchanged: recovering multiple plausible, identity-faithful constituents from a single composite without permitting the model to collapse into replication, overfit to a morph generator, or lose operational relevance.

Source: https://www.emergentmind.com/topics/demorphing