Face Morphing Attack Detection (MAD)

• Face Morphing Attack Detection (MAD) is a biometric security approach that identifies composite face images used for fraudulent identity verification.
• MAD methods include single-image and differential strategies that leverage deep learning, hand-crafted features, and spectral analysis to detect morphing attacks.
• Recent advances feature few-shot learning, self-supervised techniques, and fairness evaluations, addressing demographic biases and improving generalization to unseen morphing methods.

Face Morphing Attack Detection (MAD) denotes the set of biometric security methods that decide whether a face image, or a comparison involving a suspect and a trusted image, contains a morphing attack in which two or more identities are combined into a single facial image so that the result can be accepted as multiple people by a face recognition system. The problem is especially salient in passport issuance, electronic Machine Readable Travel Document verification, and automated border control, because a morphed enrollment photograph can create a faulty identity link and allow multiple individuals to authenticate against the same document. Recent work has expanded MAD beyond conventional binary classification toward few-shot learning, multiclass morphing attack fingerprinting, one-class anomaly detection, synthetic-data development, and zero-shot or foundation-model adaptation for unseen attack generators (Damer et al., 2021, Zhang et al., 2022, Ivanovska et al., 7 Apr 2025).

1. Threat model and operational settings

The canonical threat model assumes that an attacker submits a morphed face image that preserves sufficient similarity to more than one contributor. In document-centric deployments, this breaks the one-document-to-one-identity assumption and has been discussed in the context of illegal immigration, human trafficking, financial fraud, and broader identity-document abuse (Damer et al., 2021). Several studies also note that such morphs can deceive both automated face recognition systems and human observers, including border officers and experts, which makes automated detection a primary line of defense (Ramachandra et al., 2021, Godage et al., 2022).

Operationally, the literature distinguishes two principal settings. Single-image MAD (S-MAD) makes a decision from one image only and is therefore aligned with enrollment-time screening, forensic review, and passport-style document inspection when no trusted comparator is available. Differential MAD (D-MAD) uses two images, typically a suspicious or document image and a trusted reference or live capture, and is particularly natural in ePassport and Automated Border Control workflows (Ramachandra et al., 2023, Ramachandra et al., 2023). A further extension is morphing attack fingerprinting (MAF), in which each morphing pipeline is treated as its own class together with bona fide images, so the task becomes multiclass attribution rather than only bona fide-versus-morph discrimination (Zhang et al., 2022).

D-MAD has also been specialized to scenarios that differ materially from adult passport verification. One example is newborn morphing detection, where fewer stable identity features, strong variation due to pose and expression, and the societal risks associated with identity misuse motivate a dedicated reference-based pipeline (Ramachandra et al., 2023). Another example is multispectral D-MAD, where the trusted capture is collected in seven bands rather than only visible light, with the explicit aim of exposing spectral inconsistencies that a visible-only comparison may miss (Ramachandra et al., 2023).

2. Formal tasks, evaluation criteria, and fairness metrics

Most MAD work is still framed as binary classification, but recent formulations vary along two orthogonal axes: the number of classes and the amount of attack supervision. In few-shot MAD, only a few examples of a new morph type are provided at training time. In few-shot MAF, each morphing algorithm becomes a separate class, and the output is a morphing-process label rather than a simple attack flag (Zhang et al., 2022). This suggests a shift from merely rejecting suspicious images toward attributing them to a specific synthesis pipeline, analogous to camera-model fingerprinting or GAN fingerprinting.

Evaluation is dominated by ISO/IEC 30107-3 terminology. APCER is the proportion of attack presentations misclassified as bona fide; BPCER is the proportion of bona fide presentations misclassified as attacks; D-EER or EER is the operating point at which APCER equals BPCER; and ACER is the average of APCER and BPCER (Zhang et al., 2022, Ramachandra et al., 2023). Some S-MAD studies report BPCER at fixed APCER operating points such as $1\%$, $5\%$, $10\%$, or $20\%$, while multiclass fingerprinting studies additionally use confusion matrices (Damer et al., 2021, Zhang et al., 16 Jan 2025). In several FRGC-derived protocols, morphing attack classification error is denoted MACER rather than APCER, but the role is analogous: it quantifies the proportion of morphs classified as bona fide (Zhang et al., 16 Jan 2025).

Fairness-oriented evaluation introduces a different objective. The MEM study adapts the Fairness Discrepancy Rate (FDR) to MAD as

$FDR = 1 - (\alpha A(\tau) + (1 - \alpha)B(\tau)),$

where $A(\tau)$ and $B(\tau)$ are the maximum pairwise discrepancies in APCER and BPCER across demographic groups at threshold $\tau$ (Ramachandra et al., 2021). In that formulation, lower discrepancy implies higher fairness. The explicit use of operating-point-dependent demographic discrepancy is notable because it moves MAD assessment beyond aggregate error rates and toward deployment-relevant non-discrimination analysis.

3. Methodological families in single-image and differential MAD

Comparative MAD studies span hand-crafted features, morphing-noise or denoising methods, and deep-feature methods. In the MEM benchmark, Hybrid Features and Ensemble Features represent hand-crafted pipelines; Colour denoise and Residual Noise target morphing artifacts through denoising and residual analysis; and AlexNet and ResNet101 provide pretrained-CNN feature baselines classified with a linear SVM (Ramachandra et al., 2021). These families remain relevant because their failure modes under domain shift and demographic shift differ substantially.

One influential S-MAD direction replaces image-level supervision with dense supervision. PW-MAD uses a DenseNet-121 backbone simplified to two dense blocks and two transition blocks, inserts a $1 \times 1$ convolution to produce a $14 \times 14$ feature map for pixel-wise supervision, and optimizes

$5\%$0

with $5\%$1 (Damer et al., 2021). Its central claim is that pixel-wise supervision forces the model to focus on spatially localized morphing evidence rather than global dataset artifacts, and the reported cross-domain re-digitization results support that interpretation: at APCER $5\%$2, PW-MAD yields BPCER $5\%$3 in Train-D Test-PS and $5\%$4 in Train-PS Test-D, improving over the next best baselines in both cases (Damer et al., 2021).

Another S-MAD strategy is identity-authenticity coupling rather than plain binary discrimination. MorDeephy trains two parallel ResNet-50 backbones with separate identity classifiers, supervises morphs differently in the two streams, and uses the dot product

$5\%$5

as the morphing cue (Medvedev et al., 2022). Its loss combines two identity-classification terms with a binary cross-entropy morph-detection term, reflecting the premise that a morph is ambiguous with respect to identity and that this ambiguity should be made explicit during training rather than absorbed into a single image-level class.

Transformer-based S-MAD reformulates the same problem in token space. A ViT-based generalized S-MAD system crops faces with MTCNN, resizes them to $5\%$6, partitions them into $5\%$7 patches, processes $5\%$8 tokens with a pretrained ViT-L containing 24 encoder layers and 16 attention heads, and trains a linear SVM on the $5\%$9-dimensional classification token (Zhang et al., 16 Jan 2025). The reported advantage is improved inter-dataset generalization in digital-domain testing, which the authors attribute to ViT’s ability to integrate local and global morphing traces (Zhang et al., 16 Jan 2025). In a related but distinct direction, MADation adapts CLIP with rsLoRA applied only to query and value projections in multi-head self-attention and jointly trains a binary classification head, yielding competitive results and best-or-second-best performance in 33 out of 42 scenarios on MAD22 and MorDIFF (Caldeira et al., 7 Jan 2025).

Differential MAD methods often exploit richer comparison structure. The newborn D-MAD pipeline detects faces with MTCNN, converts them to YCbCr, applies Laplacian filtering, extracts channel-wise features with a two-layer Wavelet Scattering Network using $10\%$0 inputs, six wavelet rotations per layer, and 577 paths, computes unsigned feature differences, classifies them with SRKDA, and fuses scores by

$10\%$1

(Ramachandra et al., 2023). The best reported result is D-EER $10\%$2 at morphing factor $10\%$3, with an average gain of more than $10\%$4 detection accuracy over the cited deep-feature baseline (Ramachandra et al., 2023). Multispectral D-MAD extends the trusted capture to seven spectral bands—650, 710, 770, 830, 890, 950 nm, and WL—and fuses per-band scores as

$10\%$5

On MSMD, the multispectral framework improves over visible-only comparison in all reported cases, and Hierarchical Deep Residual SLERP attains $10\%$6 D-EER on MIPGAN-2 morphing in the multispectral protocol (Ramachandra et al., 2023).

4. Generalization to unseen attacks: few-shot, self-supervised, one-class, and frequency-domain MAD

A recurring theme across the literature is that discriminative MAD systems perform well on morphs generated by methods seen during training but degrade under unseen morphing pipelines, print-scan shifts, and source changes (Ivanovska et al., 2023, Ivanovska et al., 7 Apr 2025). Several recent methods therefore change the learning problem rather than only scaling model capacity.

Few-shot MAD and fingerprinting are one explicit response. The fusion-based FS-MAF framework combines two complementary forensic traces—PRNU and Noiseprint—by first estimating the PRNU residual

$10\%$7

then fusing PRNU and Noiseprint descriptors through factorized bilinear coding, and finally classifying the fused representation with adaptive posterior learning (Zhang et al., 2022). The benchmark spans five face datasets and eight morphing algorithms, with 6,869 bona fide faces and 15,764 morphed faces. Reported few-shot MAD performance is $10\%$8 accuracy, $10\%$9 D-EER, and $20\%$0 ACER in 1-shot mode, improving to $20\%$1 accuracy, $20\%$2 D-EER, and $20\%$3 ACER in 5-shot mode (Zhang et al., 2022). In the hybrid 9-class few-shot MAF protocol, the same method reaches $20\%$4 in 1-shot and $20\%$5 in 5-shot mode (Zhang et al., 2022). These results support the paper’s thesis that unseen morphing attacks can be treated as fingerprinting targets rather than merely unknown negatives.

Self-supervised and one-class methods remove direct dependence on attack labels. SelfMAD constructs proxy morph artifacts from bona fide images through staged augmentation, pixel-space blending, and frequency-artifact injection, then trains a binary self-supervised discriminator with BCE (Ivanovska et al., 7 Apr 2025). Its reported average EER is $20\%$6, with more than $20\%$7 relative EER reduction versus the strongest unsupervised competitor and more than $20\%$8 reduction versus the best discriminative MAD model in cross-morph testing (Ivanovska et al., 7 Apr 2025). SPL-MAD instead trains a convolutional autoencoder on unlabeled face recognition data and uses self-paced learning to suppress low-loss suspicious samples. Its average EER drops from $20\%$9 for a baseline CAE trained on CASIA-WebFace to $FDR = 1 - (\alpha A(\tau) + (1 - \alpha)B(\tau)),$0 with SPL on CASIA-WebFace, and to $FDR = 1 - (\alpha A(\tau) + (1 - \alpha)B(\tau)),$1 when trained on CASIA-WebFace plus SMDD contamination, outperforming the cited supervised baselines on average (Fang et al., 2022). MAD-DDPM moves one-class MAD into the diffusion regime by learning bona fide reconstruction in pixel and feature space; it reports average EER $FDR = 1 - (\alpha A(\tau) + (1 - \alpha)B(\tau)),$2, improving over SPL-MAD’s $FDR = 1 - (\alpha A(\tau) + (1 - \alpha)B(\tau)),$3 and the compared discriminative averages across FRLL-Morphs, FERET-Morphs, and FRGC-Morphs (Ivanovska et al., 2023).

A separate family treats morph evidence as a spectral anomaly. Quality-based unsupervised MAD shows that certain no-reference image-quality and face-image-utility scores are sufficiently separable to serve directly as attack scores, with MagFace and inverted CNNIQA yielding mean ACER $FDR = 1 - (\alpha A(\tau) + (1 - \alpha)B(\tau)),$4 and $FDR = 1 - (\alpha A(\tau) + (1 - \alpha)B(\tau)),$5, respectively, under inter-dataset transfer (Fu et al., 2022). SRL-MAD replaces reconstruction-error scoring with latent scoring on structured residual Fourier representations; trained only on bona fide SMDD images, it reports average EER $FDR = 1 - (\alpha A(\tau) + (1 - \alpha)B(\tau)),$6, compared with $FDR = 1 - (\alpha A(\tau) + (1 - \alpha)B(\tau)),$7 for SPL-MAD and $FDR = 1 - (\alpha A(\tau) + (1 - \alpha)B(\tau)),$8 for MAD-DDPM, while also surpassing the listed supervised baselines on average (Paulo et al., 16 Mar 2026). FD-MAD uses residual deviations from the natural power-law Fourier spectrum, extracts both global and region-wise frequency evidence, fuses local decisions with a pairwise Markov Random Field, and is trained exclusively on SMDD. Its reported average EER is $FDR = 1 - (\alpha A(\tau) + (1 - \alpha)B(\tau)),$9 on FRLL-Morph and $A(\tau)$0 on MAD22, with $A(\tau)$1 EER on several classical morph subsets and MorDIFF (Paulo et al., 28 Jan 2026). This suggests that structured spectral modeling can function as a lightweight alternative to heavier end-to-end S-MAD architectures.

5. Data resources, synthetic benchmarks, and reproducible evaluation

MAD research is unusually constrained by privacy, legal, and sharing barriers because biometric data are a special category of personal data under the GDPR. The SMDD paper makes this argument explicitly and presents the Synthetic Morphing Attack Detection Development dataset as a privacy-friendly development resource containing 30,000 attack and 50,000 bona fide samples (Damer et al., 2022). The dataset is generated from 500,000 synthetic StyleGAN2-ADA faces, filtered by CR-FIQA, split into attack and bona fide pools, and morphed with an OpenCV/dlib landmark-based pipeline. The same work shows that MAD backbones trained on SMDD generalize strongly to unknown FRLL morphs, including EERs below $A(\tau)$2 on OpenCV and FaceMorpher for SMDD-trained models (Damer et al., 2022).

Synthetic data have since expanded from S-MAD development to broader benchmarking. SynMorph is presented as a synthetic morphing dataset with 2450 identities and more than 100k morphs, designed specifically to support both S-MAD and D-MAD through the inclusion of mated samples, two morphing algorithms, and high-resolution $A(\tau)$3 StyleGAN2 images (Zhang et al., 2024). The paper reports that SynMorph improves over SMDD in several quality and vulnerability analyses and that mixed training with synthetic and non-synthetic data improves robustness relative to single-domain training, although domain gaps remain (Zhang et al., 2024). SYN-MAD 2022 operationalized the same privacy-aware premise at competition scale by restricting all teams to synthetic training data from SMDD and evaluating on the hidden MAD22 benchmark (Huber et al., 2022).

Several real-data benchmarks define the field’s generalization regimes. MAD22, derived from FRLL, contains 4483 morphed images generated by OpenCV, FaceMorpher, Webmorph, MIPGAN-I, and MIPGAN-II, plus 204 bona fide images (Huber et al., 2022). LMA-DRD introduced a public digital and re-digitized landmark-based morph dataset with identity-disjoint train, development, and test splits, thereby making print-scan generalization measurable rather than anecdotal (Damer et al., 2021). The FS-MAF benchmark aggregates FERET-Morphs, FRGC-Morphs, FRLL-Morphs, CelebA-Morphs, and Doppelgänger Morphs into a large cross-algorithm setting with more than 20,000 images (Zhang et al., 2022). The MEM dataset contributes 24,874 images from four ethnic groups for fairness analysis (Ramachandra et al., 2021). MSMD contributes 143 subjects captured with visible and multispectral cameras across multiple sessions for D-MAD (Ramachandra et al., 2023). HOMID-D and HOMID-S add dedicated human-observer evaluation sets with realistic morphs, ABC-gate captures, and both digital and print-scan conditions (Godage et al., 2022).

These benchmark designs share several recurring protocol features: subject-disjoint splits, explicit cross-dataset or cross-morph testing, and increasingly diverse attack families including landmark-based, GAN-based, diffusion-based, and print-scanned morphs. A plausible implication is that MAD has moved from narrow within-dataset optimization toward controlled evaluation of distribution shift.

6. Fairness, human observers, explainability, and open problems

The most explicit fairness study in MAD shows that current S-MAD systems are not algorithmically fair across ethnic groups. Using the MEM dataset and six representative S-MAD techniques, the study reports that intra-ethnicity performance is consistently better than inter-ethnicity performance, that deep-feature-based methods degrade the most under ethnic shift, and that all six methods exhibit fairness problems when assessed with FDR (Ramachandra et al., 2021). Residual Noise is often the most stable detector in raw detection terms, but the paper is explicit that better accuracy does not imply demographic parity (Ramachandra et al., 2021). This directly challenges the common practice of reporting only aggregate APCER, BPCER, or EER.

Human performance is also materially below ideal. In the HOMID study, the average accuracy is $A(\tau)$4 in D-MAD and $A(\tau)$5 in S-MAD, confirming that the absence of a reference image is a major difficulty factor (Godage et al., 2022). Face comparison experts are the strongest occupational group, with $A(\tau)$6 average accuracy in D-MAD and $A(\tau)$7 in S-MAD, but even they miss a sizable number of morphs (Godage et al., 2022). The same study finds no strong relation between training length and morph-detection accuracy in many comparisons, while repeated exposure during D-MAD improves average accuracy from $A(\tau)$8 to $A(\tau)$9 across four blocks of 100 image pairs (Godage et al., 2022). This suggests that morph-specific training and exposure matter more than generic document-checking experience.

Explainability has recently been revisited through zero-shot systems. One study uses GPT-4 Turbo with carefully designed prompts and compares it with zero-shot general vision models based on mean support embeddings from bona fide digital faces (Zhang et al., 13 Mar 2025). On a synthetic print-scan dataset with LMA-UBO, MIPGAN-II, and Morph-PIPE attacks, the best overall result is $B(\tau)$0 EER for a probability-style GPT prompt, while ResNet34 with cosine distance reaches $B(\tau)$1 EER (Zhang et al., 13 Mar 2025). The same work shows that multimodal prompts can return region-level explanations in forms such as $B(\tau)$2, but also stresses non-determinism and bias toward attack predictions under some prompts (Zhang et al., 13 Mar 2025). The evidence supports explainability as a useful operator-support mechanism rather than a replacement for calibrated MAD.

Open problems are stated directly across the recent literature. Future MAD systems are urged to test more novel morphing attacks, including adversarial, transformer-based, and 3D-reconstruction-based morphs, as well as print-scan scenarios (Zhang et al., 2022). Public datasets are also acknowledged to contain demographic biases and incomplete real-world diversity, which limits claims of universal robustness (Ivanovska et al., 7 Apr 2025). Taken together, these results indicate that MAD is no longer only a binary artifact-detection problem. It is increasingly a problem of open-set biometric forensics under demographic shift, acquisition shift, attack evolution, and operational accountability.