Face Generation Attacks Overview

• Face Generation Attacks are techniques that synthesize facial images or manipulate detector outputs to mislead biometric systems by exploiting vulnerabilities in embedding geometry and decision thresholds.
• They encompass diverse methods, including universal synthetic probes, morphing attacks, and targeted impersonation, each crafted to compromise enrollment and verification processes.
• These attacks highlight critical security challenges, as adversaries exploit both digital manipulation and physical realization to deceive end-to-end face recognition pipelines.

Face generation attacks are attacks on biometric and adjacent vision systems in which the adversary synthesizes, reconstructs, or otherwise generates facial inputs so that downstream pipelines make erroneous decisions. In current literature, the label covers several distinct mechanisms: universal synthetic probes such as master faces that match many enrolled identities; morphing attacks that blend two contributors into a single enrolment image; targeted impersonation methods that generate a face recognized as a chosen victim; physically realizable appearance-generation attacks based on makeup, accessories, or controllable semantic synthesis; and, in backdoored detector work, Face Generation Attacks that cause a detector to output a false face where no real face exists (Nguyen et al., 2020, Venkatesh et al., 2020, Roux et al., 1 Aug 2025).

1. Scope, task definitions, and attack taxonomy

The field is organized around the decision rules of face verification rather than closed-set recognition alone. In generalized face-verification formulations, a face $A$ impersonates $B$ when $Dist(FM(A),FM(B)) \le th$, and the attack surface expands once one distinguishes identities to be matched from identities to be avoided. The DodgePersonation formulation makes this explicit through disjoint $\mathcal{M}\text{atchSet}$ and $\mathcal{D}\text{odgeSet}$, thereby subsuming dodging, targeted impersonation, generalized impersonation, and master-face attacks within one optimization view (Nazari et al., 2023).

A separate black-box line of work studies break-in, impersonation, partial evasion, and full evasion under score feedback only. There, the attacker does not perturb arbitrary pixels, but searches a constrained semantic synthesis space comprising facial hair, marks, expression, and eyeglasses, with realism enforced by bounded parameter ranges (Saha et al., 2022). Other practical attack models restrict the attack surface to semantically meaningful regions, such as the orbital region in adversarial makeup, or embed identity attack objectives directly into portrait generation. This broadens the meaning of face generation attacks from “generate a fake face” to “generate a face that is operationally useful against a specific decision pipeline” (Yin et al., 2021, Wang et al., 11 Mar 2025).

This literature therefore contains two overlapping but non-identical notions of “generation.” One is biometric sample generation, in which the output is a face image or 3D model intended to pass verification. The other is pipeline-output generation, in which a compromised detector is induced to generate a false face detection. The shared feature is that the attack manipulates not merely classification labels, but the structure of the facial evidence presented to the system.

2. Universal probes: master faces, wolf attacks, and generalized coverage attacks

The master-face line begins from the biometric notion of a wolf sample: a single probe that falsely matches many enrolled templates. In face verification, the attacker seeks a synthetic face $F$ whose similarity to many enrolled identities exceeds threshold. The seminal StyleGAN-based formulation uses a fixed pretrained generator, a surrogate recognizer, a surrogate enrolment population, and CMA-ES in latent space. Its optimization objective is

$$\max_{z} \; \frac{1}{|E|}\sum_{j=1}^{|E|}\text{FaceMatching}(G(z), E_j),$$

with success measured by thresholded false matches at an EER-selected operating point. In a limited-resource setting using public pretrained models and a CPU-only PC, latent variable evolution ran for 1000 iterations in less than 24 hours per database, reaching about 35% FMR on LFW Fold 1 and about 30% FMR on MOBIO during optimization; the strongest in-domain case matched roughly 30–35% of enrolled faces (Nguyen et al., 2020).

Subsequent work expanded this analysis across multiple databases and recognizers and argued that strong master faces arise from dense regions in embedding space. In that study, simulated presentation attacks generally preserved the false-matching ability of the original digital master faces, and 19 of 24 print/screen recapture conditions remained successful. The same work also reported that generated master faces were often male and sometimes child- or senior-like, tying attackability to embedding density and demographic imbalance (Nguyen et al., 2021).

The coverage view was later generalized formally. One Face to Rule Them All casts master-face generation as a special case of DodgePersonation, solves a clusterwise embedding search with K-Means and LM-MA-ES, and then realizes the embedding targets by gradient-based image optimization from a chosen source face. On the standard LFW master-face benchmark, 9 images covered 57.27% to 58.5% of identities, versus 43.82% for the cited prior benchmark, while the generated attack faces still appeared identical to a casual observer (Nazari et al., 2023).

A distinct 2025 development removes iterative online optimization altogether. Non-Adaptive Adversarial Face Generation posits that faces sharing a non-dominant attribute occupy an attributed subsphere inside the recognition embedding sphere, estimates that subsphere with PCA, queries a commercial API once with 100 basis faces, and reconstructs an adversarial face by closed-form projection plus inversion. Against AWS CompareFaces at its default threshold, the method reports over 93% ASR with a single non-adaptive query batch, while also allowing attacker-chosen high-level attributes such as male, female, White, Black, and Asian (Kim et al., 16 Jul 2025).

Taken together, these results replace victim-specific spoofing with coverage attacks: instead of targeting one subject, the adversary searches for regions of recognition space from which one synthetic probe can unlock many identities. This suggests that global representation geometry, not only local decision boundaries, is a primary vulnerability.

3. Morphing attacks: from landmark blending to latent-space and direct 3D generation

Morphing attacks target the enrolment stage of identity systems such as passports, eMRTDs, and automatic border control. Two contributors submit a single morphed face image; if enrolment succeeds, both may later verify against that shared reference. Survey work organizes morph generation into landmark-based pipelines and deep learning-based pipelines, and evaluates them with metrics such as MMPMR, FMMPMR, and AMPMR (Venkatesh et al., 2020).

Among GAN-based morphing methods, MIPGAN marks a key step because it explicitly optimizes both realism and identity preservation. Starting from predicted StyleGAN or StyleGAN2 latents $L_1'$ and $L_2'$, it initializes

$L'_M = \frac{w_1 * L_1' + w_2 * L_2'}{2},$

then optimizes a weighted sum of perceptual, identity, identity-difference, and MS-SSIM losses. At FMR = 0.1%, it substantially strengthens earlier GAN morphs. On ArcFace, digital MIPGAN-I reaches 94.45% MMPMR and 85.94% FMMPMR, while MIPGAN-II reaches 94.21% and 86.94%; both remain strong after print-scan and compression (Zhang et al., 2020).

ReGenMorph takes the opposite design decision. It first creates a conventional landmark-based morph, then feeds that morph through a fine-tuned StyleGAN encoder-generator reconstruction path. The method is explicitly designed to eliminate the shadowing and blending artifacts of image-level landmark morphing and the synthetic striping artifacts of latent-space interpolation. Its outputs are visually more realistic, but it sacrifices attack strength: on ArcFace it reports 33.98% MMPMR and 14.05% FMMPMR, and on the tested COTS system 42.24% and 34.47% (Damer et al., 2021).

The morphing literature then extends decisively into 3D. One 2022 pipeline begins with two 3D face point clouds, projects them into a common canonical view as color maps and depth maps, morphs both domains with shared landmarks, back-projects the morphed maps into a 3D colored point cloud, and fills holes with a multi-view inpainting-and-registration procedure. On FaceScape, the resulting 3D morphs achieved 100% MMPMR against both ArcFace and the tested COTS 2D system, 88.8% against LED3D, and 95.4% against PointNet++ (Singh et al., 2022).

A later 3D method removes the intermediate 3D$B$02D$B$13D detour. It registers two textured point clouds directly with Bayesian Coherent Point Drift (BCPD) and then averages geometry and color in point-cloud space:

$B$2

Using 388 morphing point clouds generated from 200 bona fide subjects, the method reports 97.93% G-MAP across multiple 3D FRS and 100% on the tested 2D systems at FAR = 0.1\% (Singh et al., 2024).

Latent-space morphing also continues to evolve. MLSD-GAN inverts both source faces into StyleGAN $B$3, treats the first 7 latent vectors as identity-related and the remaining 11 as attribute-related, introduces a landmark-driven identity transfer direction, and uses spherical interpolation. At FMR = 1%, it achieves combined G-MAP values of 93.22 on ArcFace and 92.03 on MagFace, outperforming earlier StyleGAN and MIPGAN variants in the reported tables while remaining below Landmarks-I (PN et al., 2024).

Morphing attacks thus span a spectrum. At one end are classical landmark warps with strong identity blending but visible artifacts; at the other are high-resolution GAN and 3D point-cloud pipelines that reduce artifact signatures while maintaining or exceeding operational vulnerability. The recurrent tension is unchanged: a useful morph must preserve both contributors strongly enough for verification while also remaining visually plausible enough to survive issuance and inspection.

4. Targeted impersonation and physically realizable generation

A different branch of face generation attacks does not seek multi-identity enrolment, but targeted impersonation. Early work such as A$B$4GN uses a conditional VAE-GAN with attention and treats the attacked face recognition network as a third player. Given a source face $B$5 and a target face $B$6, the generator synthesizes $B$7 so that the recognizer embedding of $B$8 approaches that of $B$9 while remaining visually close to $Dist(FM(A),FM(B)) \le th$0. In white-box experiments against ArcFace on LFW, the best ablation reports 99.59% fake accuracy in the $Dist(FM(A),FM(B)) \le th$1 condition and 98.92% in the harder $Dist(FM(A),FM(B)) \le th$2 condition (Song et al., 2018).

Adv-Makeup moves this objective into a practical black-box setting. It restricts the perturbation to the orbital region, synthesizes natural-looking eye shadow with a GAN generator, and improves transferability through fine-grained meta-learning across multiple surrogate recognizers. On LFW, black-box impersonation ASR reaches 7.59% on IR152, 17.16% on IRSE50, 5.98% on FaceNet, and 22.03% on MobileFace; on a makeup dataset the corresponding ASRs rise to 23.25%, 59.06%, 33.17%, and 63.74% (Yin et al., 2021).

Other work emphasizes semantic realism rather than localized perturbation. A score-based black-box attack trains a per-attacker MMDA synthesizer over realizable attributes such as beard or mustache, scars or marks, facial expression, and eyeglasses, then uses Nelder–Mead to optimize those parameters against a face recognition system. Across three attackers and three FRS, approximately 21.8% of combined break-in and impersonation attacks were successful, while evasion was not successful (Saha et al., 2022).

Physical realization is addressed directly by FaceAdv, which generates three facial stickers of learned shape and content, places them on saliency-selected facial regions, and uses a differentiable 3D face-aware transformer to simulate real capture conditions. Against ArcFace, CosFace, and FaceNet, FaceAdv achieves physical dodging success of 75.00%, 100.00%, and 100.00%, and physical targeted impersonation success of 4.17%, 29.17%, and 54.17%, outperforming the AGNs baseline in physical settings (Shen et al., 2020).

The most recent diffusion-based work integrates face generation and adversarial attack into customized portrait generation itself. Adv-CPG uses SDXL, a lightweight local ID encryptor, an encryption enhancer, and a multimodal image customizer so that a portrait conditioned on a source face and text prompt is simultaneously personalized and adversarially aligned toward a target identity. In black-box verification, it reports average ASR 79.65, compared with 51.58 for the strongest compared noise-based baseline and 76.79 for the strongest compared unconstrained baseline; against commercial APIs it reports average confidence scores of approximately 77.5 on Face++ and 63.0 on Aliyun (Wang et al., 11 Mar 2025).

Across these works, the transition is from pixel perturbation to semantic synthesis. The attack no longer merely alters a static image; it generates a facial appearance that is machine-effective, socially plausible, and sometimes physically deployable.

5. Detector-level “Face Generation Attacks” in backdoored pipelines

In the backdoor literature, Face Generation Attack (FGA) means something different. It does not denote a synthesized photorealistic face image; it denotes a poisoned face detector that hallucinates a face detection on non-face content when a trigger is present. This is an adaptation of object-generation attacks to face detection, and it targets the structured outputs of a detector: bounding boxes, confidence, and landmarks (Roux et al., 1 Aug 2025).

The detector backdoor is trained by inserting a trigger into training images and appending a fake face annotation whose box covers the trigger region and whose landmarks are set in a regular configuration. At test time, the trigger causes the detector to output a new face instance where no face exists. Because the rest of the pipeline trusts detector output, the generated crop can then pass through alignment, antispoofing, feature extraction, and matching. The system-level survivability study formalizes this as

$Dist(FM(A),FM(B)) \le th$3

where AP measures trigger survival through detection, FAR through antispoofing, and FMR through matching (Roux et al., 2 Jul 2025).

Empirically, these attacks are strong. In isolation, detector benign performance remains about 98.5% while FGA ASR reaches up to 99.3% for BadNets-style patch triggers and 96.7% or 98.5%-range values for diffuse SIG-style triggers, depending on the backbone and summary view. At the full-pipeline level, diffuse SIG triggers produce average survivability 74.8%, versus 19.4% for patch triggers, and detector backdoors yield the best All-to-One attack vector in 16 out of 20 evaluated FRS configurations (Roux et al., 2 Jul 2025).

The companion face-detection study extends this view with Landmark Shift Attack (LSA), a backdoor on the detector’s landmark regression head. Here the detector still localizes a real face but rotates or otherwise corrupts its landmarks, which then poisons downstream alignment. The work reports FGA best-model ASRs such as 95.5% to 96.7% with benign AP around 98.4–98.6%, and LSA best-model ASRs up to 99.0% with benign AP around 98.5–98.6% (Roux et al., 1 Aug 2025).

These papers reframe the attack surface. A face recognition system can be compromised before recognition begins, merely by making the detector define the wrong facial evidence.

6. Evaluation regimes, defenses, and unresolved issues

Evaluation in this area is heterogeneous because the underlying attack goals differ. Master-face work reports FMR, coverage, and transferability; morphing work reports MMPMR, FMMPMR, AMPMR, and G-MAP; adversarial impersonation work reports ASR, Rank-1/Rank-5 targeted ASR, AQ/MQ, or API confidence scores (Venkatesh et al., 2020, Singh et al., 2024, Wang et al., 11 Mar 2025). This metric diversity reflects a deeper fact: face generation attacks span enrolment fraud, online verification fraud, presentation attacks, privacy-preserving adversarial portrait generation, and pipeline backdoors.

Defensive work repeatedly encounters a generalization problem. In morphing, survey results and competition experience show that detection performance depends strongly on the generation method and on whether attacks are digital or print-scan (Venkatesh et al., 2020). In recognition-focused attack work, suggested countermeasures include improving face-recognition robustness itself, deploying presentation-attack detectors, and using detectors for computer-generated or manipulated images, but cross-dataset generalization remains a major challenge (Nguyen et al., 2020).

Several papers tie vulnerability to representation geometry and system feedback. The master-face literature links strong attacks to dense embedding regions and demographic imbalance, motivating more balanced training data and embedding objectives that are closer to uniformity (Nguyen et al., 2021). The non-adaptive attributed-subsphere attack shows that returned similarity scores and loose thresholds are themselves part of the attack surface, and therefore proposes mitigations such as removing scores, adding noise to returned scores, or increasing effective thresholds, albeit with usability costs (Kim et al., 16 Jul 2025).

Defenses for backdoored detection pipelines are correspondingly earlier-stage. The system-level detector-backdoor study recommends cleaning training data with ensembles of off-the-shelf detectors to identify inconsistent annotations (Roux et al., 2 Jul 2025). The face-detection backdoor paper recommends object-detection backdoor defenses such as ODSCAN and Django for FGA, auxiliary face detectors for redundancy, and geometric consistency checks on predicted landmarks for LSA (Roux et al., 1 Aug 2025).

A further difficulty is that the defense stack can itself be attacked. Decision-based black-box attacks on face forgery detection achieve 100% ASR on several academic detectors and, on Tencent’s industrial API, 66.00% ASR at $Dist(FM(A),FM(B)) \le th$4 and 75.00% at $Dist(FM(A),FM(B)) \le th$5, while preserving high image quality and enough identity information to remain useful for face recognition (Chen et al., 2023). This suggests that forgery detection alone is not a stable endpoint defense.

The unresolved issues are therefore structural rather than merely algorithmic. Transferability is often real but inconsistent; physically realizable attacks are operationally significant but usually harder than digital ones; and unknown-attack generalization remains poor for many detectors. This suggests that face generation attacks are best understood not as isolated image manipulations but as a family of attacks on representation geometry, enrolment trust, and pipeline composition across modern face-based systems.