---
title: Face Generation Attacks Overview
url: https://www.emergentmind.com/topics/face-generation-attacks
type: topic
---

# Face Generation Attacks Overview

Face generation attacks are attacks on biometric and adjacent vision systems in which the adversary synthesizes, reconstructs, or otherwise generates facial inputs so that downstream pipelines make erroneous decisions. In current literature, the label covers several distinct mechanisms: universal synthetic probes such as **master faces** that match many enrolled identities; **morphing attacks** that blend two contributors into a single enrolment image; **targeted impersonation** methods that generate a face recognized as a chosen victim; **physically realizable** appearance-generation attacks based on makeup, accessories, or controllable semantic synthesis; and, in backdoored detector work, **Face Generation Attacks** that cause a detector to output a false face where no real face exists [2006.08376; 2011.02045; 2508.00620].

## 1. Scope, task definitions, and attack taxonomy

The field is organized around the decision rules of face verification rather than closed-set recognition alone. In generalized face-verification formulations, a face \(A\) impersonates \(B\) when \(Dist(FM(A),FM(B)) \le th\), and the attack surface expands once one distinguishes identities to be matched from identities to be avoided. The **DodgePersonation** formulation makes this explicit through disjoint \(\mathcal{M}\text{atchSet}\) and \(\mathcal{D}\text{odgeSet}\), thereby subsuming dodging, targeted impersonation, generalized impersonation, and master-face attacks within one optimization view [2309.05879].

A separate black-box line of work studies **break-in**, **impersonation**, **partial evasion**, and **full evasion** under score feedback only. There, the attacker does not perturb arbitrary pixels, but searches a constrained semantic synthesis space comprising facial hair, marks, expression, and eyeglasses, with realism enforced by bounded parameter ranges [2210.08178]. Other practical attack models restrict the attack surface to semantically meaningful regions, such as the orbital region in adversarial makeup, or embed identity attack objectives directly into portrait generation. This broadens the meaning of face generation attacks from “generate a fake face” to “generate a face that is operationally useful against a specific decision pipeline” [2105.03162; 2503.08269].

This literature therefore contains two overlapping but non-identical notions of “generation.” One is **biometric sample generation**, in which the output is a face image or 3D model intended to pass verification. The other is **pipeline-output generation**, in which a compromised detector is induced to generate a false face detection. The shared feature is that the attack manipulates not merely classification labels, but the structure of the facial evidence presented to the system.

## 2. Universal probes: master faces, wolf attacks, and generalized coverage attacks

The master-face line begins from the biometric notion of a **wolf sample**: a single probe that falsely matches many enrolled templates. In face verification, the attacker seeks a synthetic face \(F\) whose similarity to many enrolled identities exceeds threshold. The seminal StyleGAN-based formulation uses a fixed pretrained generator, a surrogate recognizer, a surrogate enrolment population, and CMA-ES in latent space. Its optimization objective is

\[
\max_{z} \; \frac{1}{|E|}\sum_{j=1}^{|E|}\text{FaceMatching}(G(z), E_j),
\]

with success measured by thresholded false matches at an EER-selected operating point. In a limited-resource setting using public pretrained models and a CPU-only PC, latent variable evolution ran for 1000 iterations in less than 24 hours per database, reaching about **35% FMR** on LFW Fold 1 and about **30% FMR** on MOBIO during optimization; the strongest in-domain case matched roughly **30–35%** of enrolled faces [2006.08376].

Subsequent work expanded this analysis across multiple databases and recognizers and argued that strong master faces arise from **dense regions in embedding space**. In that study, simulated presentation attacks generally preserved the false-matching ability of the original digital master faces, and **19 of 24** print/screen recapture conditions remained successful. The same work also reported that generated master faces were often male and sometimes child- or senior-like, tying attackability to embedding density and demographic imbalance [2109.03398].

The coverage view was later generalized formally. **One Face to Rule Them All** casts master-face generation as a special case of DodgePersonation, solves a clusterwise embedding search with K-Means and LM-MA-ES, and then realizes the embedding targets by gradient-based image optimization from a chosen source face. On the standard LFW master-face benchmark, **9 images** covered **57.27% to 58.5%** of identities, versus **43.82%** for the cited prior benchmark, while the generated attack faces still appeared identical to a casual observer [2309.05879].

A distinct 2025 development removes iterative online optimization altogether. **Non-Adaptive Adversarial Face Generation** posits that faces sharing a non-dominant attribute occupy an attributed subsphere inside the recognition embedding sphere, estimates that subsphere with PCA, queries a commercial API once with **100** basis faces, and reconstructs an adversarial face by closed-form projection plus inversion. Against AWS CompareFaces at its default threshold, the method reports **over 93%** ASR with a single non-adaptive query batch, while also allowing attacker-chosen high-level attributes such as male, female, White, Black, and Asian [2507.12107].

Taken together, these results replace victim-specific spoofing with **coverage attacks**: instead of targeting one subject, the adversary searches for regions of recognition space from which one synthetic probe can unlock many identities. This suggests that global representation geometry, not only local decision boundaries, is a primary vulnerability.

## 3. Morphing attacks: from landmark blending to latent-space and direct 3D generation

Morphing attacks target the **enrolment** stage of identity systems such as passports, eMRTDs, and automatic border control. Two contributors submit a single morphed face image; if enrolment succeeds, both may later verify against that shared reference. Survey work organizes morph generation into **landmark-based** pipelines and **deep learning-based** pipelines, and evaluates them with metrics such as **MMPMR**, **FMMPMR**, and **AMPMR** [2011.02045].

Among GAN-based morphing methods, **MIPGAN** marks a key step because it explicitly optimizes both realism and identity preservation. Starting from predicted StyleGAN or StyleGAN2 latents \(L_1'\) and \(L_2'\), it initializes

\[
L'_M = \frac{w_1 * L_1' + w_2 * L_2'}{2},
\]

then optimizes a weighted sum of perceptual, identity, identity-difference, and MS-SSIM losses. At **FMR = 0.1%**, it substantially strengthens earlier GAN morphs. On ArcFace, digital **MIPGAN-I** reaches **94.45% MMPMR** and **85.94% FMMPMR**, while **MIPGAN-II** reaches **94.21%** and **86.94%**; both remain strong after print-scan and compression [2009.01729].

**ReGenMorph** takes the opposite design decision. It first creates a conventional landmark-based morph, then feeds that morph through a fine-tuned StyleGAN encoder-generator reconstruction path. The method is explicitly designed to eliminate the shadowing and blending artifacts of image-level landmark morphing and the synthetic striping artifacts of latent-space interpolation. Its outputs are visually more realistic, but it sacrifices attack strength: on ArcFace it reports **33.98% MMPMR** and **14.05% FMMPMR**, and on the tested COTS system **42.24%** and **34.47%** [2108.09130].

The morphing literature then extends decisively into 3D. One 2022 pipeline begins with two 3D face point clouds, projects them into a common canonical view as color maps and depth maps, morphs both domains with shared landmarks, back-projects the morphed maps into a 3D colored point cloud, and fills holes with a multi-view inpainting-and-registration procedure. On FaceScape, the resulting 3D morphs achieved **100% MMPMR** against both ArcFace and the tested COTS 2D system, **88.8%** against LED3D, and **95.4%** against PointNet++ [2201.03454].

A later 3D method removes the intermediate 3D\(\rightarrow\)2D\(\rightarrow\)3D detour. It registers two textured point clouds directly with **Bayesian Coherent Point Drift (BCPD)** and then averages geometry and color in point-cloud space:

\[
P_m=\alpha \times Pst_1+(1-\alpha)\times Ps_2,\qquad
C_m=\alpha \times Cs_1+(1-\alpha)\times Cs_2.
\]

Using **388** morphing point clouds generated from **200** bona fide subjects, the method reports **97.93% G-MAP** across multiple 3D FRS and **100%** on the tested 2D systems at **FAR = 0.1\%** [2404.15765].

Latent-space morphing also continues to evolve. **MLSD-GAN** inverts both source faces into StyleGAN \(\mathbb{W}^+\), treats the first **7** latent vectors as identity-related and the remaining **11** as attribute-related, introduces a landmark-driven identity transfer direction, and uses spherical interpolation. At **FMR = 1%**, it achieves combined G-MAP values of **93.22** on ArcFace and **92.03** on MagFace, outperforming earlier StyleGAN and MIPGAN variants in the reported tables while remaining below **Landmarks-I** [2404.12679].

Morphing attacks thus span a spectrum. At one end are classical landmark warps with strong identity blending but visible artifacts; at the other are high-resolution GAN and 3D point-cloud pipelines that reduce artifact signatures while maintaining or exceeding operational vulnerability. The recurrent tension is unchanged: a useful morph must preserve both contributors strongly enough for verification while also remaining visually plausible enough to survive issuance and inspection.

## 4. Targeted impersonation and physically realizable generation

A different branch of face generation attacks does not seek multi-identity enrolment, but **targeted impersonation**. Early work such as **A\(^3\)GN** uses a conditional VAE-GAN with attention and treats the attacked face recognition network as a third player. Given a source face \(x\) and a target face \(y\), the generator synthesizes \(\hat{x}\) so that the recognizer embedding of \(\hat{x}\) approaches that of \(y\) while remaining visually close to \(x\). In white-box experiments against ArcFace on LFW, the best ablation reports **99.59%** fake accuracy in the \(A \to A\) condition and **98.92%** in the harder \(A \to A'\) condition [1811.12026].

**Adv-Makeup** moves this objective into a practical black-box setting. It restricts the perturbation to the orbital region, synthesizes natural-looking eye shadow with a GAN generator, and improves transferability through fine-grained meta-learning across multiple surrogate recognizers. On LFW, black-box impersonation ASR reaches **7.59%** on IR152, **17.16%** on IRSE50, **5.98%** on FaceNet, and **22.03%** on MobileFace; on a makeup dataset the corresponding ASRs rise to **23.25%**, **59.06%**, **33.17%**, and **63.74%** [2105.03162].

Other work emphasizes **semantic realism** rather than localized perturbation. A score-based black-box attack trains a per-attacker MMDA synthesizer over realizable attributes such as beard or mustache, scars or marks, facial expression, and eyeglasses, then uses Nelder–Mead to optimize those parameters against a face recognition system. Across three attackers and three FRS, approximately **21.8%** of combined break-in and impersonation attacks were successful, while evasion was not successful [2210.08178].

Physical realization is addressed directly by **FaceAdv**, which generates three facial stickers of learned shape and content, places them on saliency-selected facial regions, and uses a differentiable 3D face-aware transformer to simulate real capture conditions. Against ArcFace, CosFace, and FaceNet, FaceAdv achieves physical dodging success of **75.00%**, **100.00%**, and **100.00%**, and physical targeted impersonation success of **4.17%**, **29.17%**, and **54.17%**, outperforming the AGNs baseline in physical settings [2011.13526].

The most recent diffusion-based work integrates face generation and adversarial attack into **customized portrait generation** itself. **Adv-CPG** uses SDXL, a lightweight local ID encryptor, an encryption enhancer, and a multimodal image customizer so that a portrait conditioned on a source face and text prompt is simultaneously personalized and adversarially aligned toward a target identity. In black-box verification, it reports average ASR **79.65**, compared with **51.58** for the strongest compared noise-based baseline and **76.79** for the strongest compared unconstrained baseline; against commercial APIs it reports average confidence scores of approximately **77.5** on Face++ and **63.0** on Aliyun [2503.08269].

Across these works, the transition is from pixel perturbation to **semantic synthesis**. The attack no longer merely alters a static image; it generates a facial appearance that is machine-effective, socially plausible, and sometimes physically deployable.

## 5. Detector-level “Face Generation Attacks” in backdoored pipelines

In the backdoor literature, **Face Generation Attack (FGA)** means something different. It does not denote a synthesized photorealistic face image; it denotes a poisoned **face detector** that hallucinates a face detection on non-face content when a trigger is present. This is an adaptation of object-generation attacks to face detection, and it targets the structured outputs of a detector: bounding boxes, confidence, and landmarks [2508.00620].

The detector backdoor is trained by inserting a trigger into training images and appending a fake face annotation whose box covers the trigger region and whose landmarks are set in a regular configuration. At test time, the trigger causes the detector to output a new face instance where no face exists. Because the rest of the pipeline trusts detector output, the generated crop can then pass through alignment, antispoofing, feature extraction, and matching. The system-level survivability study formalizes this as

\[
\mathrm{SR} = \mathrm{AP} \times \mathrm{FAR} \times \mathrm{FMR},
\]

where AP measures trigger survival through detection, FAR through antispoofing, and FMR through matching [2507.01607].

Empirically, these attacks are strong. In isolation, detector benign performance remains about **98.5%** while FGA ASR reaches up to **99.3%** for BadNets-style patch triggers and **96.7%** or **98.5%**-range values for diffuse SIG-style triggers, depending on the backbone and summary view. At the full-pipeline level, diffuse SIG triggers produce average survivability **74.8%**, versus **19.4%** for patch triggers, and detector backdoors yield the best All-to-One attack vector in **16 out of 20** evaluated FRS configurations [2507.01607].

The companion face-detection study extends this view with **Landmark Shift Attack (LSA)**, a backdoor on the detector’s landmark regression head. Here the detector still localizes a real face but rotates or otherwise corrupts its landmarks, which then poisons downstream alignment. The work reports FGA best-model ASRs such as **95.5%** to **96.7%** with benign AP around **98.4–98.6%**, and LSA best-model ASRs up to **99.0%** with benign AP around **98.5–98.6%** [2508.00620].

These papers reframe the attack surface. A face recognition system can be compromised before recognition begins, merely by making the detector define the wrong facial evidence.

## 6. Evaluation regimes, defenses, and unresolved issues

Evaluation in this area is heterogeneous because the underlying attack goals differ. Master-face work reports **FMR**, coverage, and transferability; morphing work reports **MMPMR**, **FMMPMR**, **AMPMR**, and **G-MAP**; adversarial impersonation work reports **ASR**, **Rank-1/Rank-5 targeted ASR**, **AQ/MQ**, or API confidence scores [2011.02045; 2404.15765; 2503.08269]. This metric diversity reflects a deeper fact: face generation attacks span enrolment fraud, online verification fraud, presentation attacks, privacy-preserving adversarial portrait generation, and pipeline backdoors.

Defensive work repeatedly encounters a generalization problem. In morphing, survey results and competition experience show that detection performance depends strongly on the generation method and on whether attacks are digital or print-scan [2011.02045]. In recognition-focused attack work, suggested countermeasures include improving face-recognition robustness itself, deploying presentation-attack detectors, and using detectors for computer-generated or manipulated images, but cross-dataset generalization remains a major challenge [2006.08376].

Several papers tie vulnerability to representation geometry and system feedback. The master-face literature links strong attacks to dense embedding regions and demographic imbalance, motivating more balanced training data and embedding objectives that are closer to uniformity [2109.03398]. The non-adaptive attributed-subsphere attack shows that returned similarity scores and loose thresholds are themselves part of the attack surface, and therefore proposes mitigations such as removing scores, adding noise to returned scores, or increasing effective thresholds, albeit with usability costs [2507.12107].

Defenses for backdoored detection pipelines are correspondingly earlier-stage. The system-level detector-backdoor study recommends cleaning training data with ensembles of off-the-shelf detectors to identify inconsistent annotations [2507.01607]. The face-detection backdoor paper recommends object-detection backdoor defenses such as **ODSCAN** and **Django** for FGA, auxiliary face detectors for redundancy, and geometric consistency checks on predicted landmarks for LSA [2508.00620].

A further difficulty is that the defense stack can itself be attacked. Decision-based black-box attacks on face forgery detection achieve **100% ASR** on several academic detectors and, on Tencent’s industrial API, **66.00%** ASR at \(\epsilon=0.062\) and **75.00%** at \(\epsilon=0.125\), while preserving high image quality and enough identity information to remain useful for face recognition [2310.12017]. This suggests that forgery detection alone is not a stable endpoint defense.

The unresolved issues are therefore structural rather than merely algorithmic. Transferability is often real but inconsistent; physically realizable attacks are operationally significant but usually harder than digital ones; and unknown-attack generalization remains poor for many detectors. This suggests that face generation attacks are best understood not as isolated image manipulations but as a family of attacks on **representation geometry, enrolment trust, and pipeline composition** across modern face-based systems.

Source: https://www.emergentmind.com/topics/face-generation-attacks