SFDemorpher: Generalizable Face Demorphing for Operational Morphing Attack Detection

Raul Ismayilov; Luuk Spreeuwers

cs.CVMar 30, 2026

SFDemorpher: Generalizable Face Demorphing for Operational Morphing Attack Detection

Authors: Raul Ismayilov, Luuk Spreeuwers

Organizations: Data Management & Biometrics, University of Twente, Drienerlolaan 5, Enschede, 7512AD, Netherlands.

Abstract

Face morphing attacks compromise biometric security by creating document images that verify against multiple identities, posing significant risks from document issuance to border control. Differential Morphing Attack Detection (D-MAD) offers an effective countermeasure, particularly when employing face demorphing to disentangle identities blended in the morph. However, existing methods lack operational generalizability due to limited training data and the assumption that all document inputs are morphs. This paper presents SFDemorpher, a framework designed for the operational deployment of face demorphing for D-MAD that performs identity disentanglement within joint StyleGAN latent and high-dimensional feature spaces. We introduce a dual-pass training strategy handling both morphed and bona fide documents, leveraging a hybrid corpus with predominantly synthetic identities to enhance robustness against unseen distributions. Extensive evaluation confirms state-of-the-art generalizability across unseen identities, diverse capture conditions, and 13 morphing techniques, spanning both border verification and the challenging document enrollment stage. Our framework achieves superior D-MAD performance by widening the margin between the score distributions of bona fide and morphed samples while providing high-fidelity visual reconstructions facilitating explainability.

Figures & tables

Panel of Figure 1 — Figure 1: Visualization of the three primary operational face demorphing scenarios. In each case, face demorphing algorithm processes a suspected document image $I_{\text{doc}}$ and a trusted reference $I_{\text{ref}}$ to estimate a ground truth $I_{\text{GT}}$ . The specific restoration goal $I_{\text{out}}$ is determined by the scenario: (a) fraudulent enrollment with a morphed document, (b) border crossing with a morphed document, and (c) standard travel with a bona fide document.

Figure 2: The training pipeline of the SFDemorpher framework utilizing a dual-pass strategy. The bona fide pass processes the input pair $(I_{\text{doc}},I_{\text{ref}})=(I_{B},I_{B^{\prime}})$ to reconstruct the ground truth $I_{\text{GT}}=I_{B}$ , yielding output $I_{\text{out}}=I_{\hat{B}}$ . The morphed pass trains on the accomplice restoration scenario using inputs $(I_{\text{doc}},I_{\text{ref}})=(I_{AC},I_{C^{\prime}})$ to disentangle identities, targeting the original accomplice $I_{\text{GT}}=I_{A}$ to reconstruct $I_{\text{out}}=I_{\hat{A}}$ . During inference, the framework operates identically without the ground truth $I_{\text{GT}}$ .

Coefficient	Bona Fide Pass	Morphed Pass
$\lambda_{\text{id}}$	0.1	1.0
$\lambda_{\text{L2}}$	0.1	1.0
$\lambda_{\text{lpips}}$	0.08	0.8
$\lambda_{\text{ms-ssim}}$	0.04	0.4
$\lambda_{\text{feat}}$	0.01	0.1
$\lambda_{\text{inv-id}}$	0.0	0.6

Table 1: Loss coefficients (

\lambda

) for the dual-pass training strategy. Note that

\mathcal{L}_{\text{inv-id}}

is only active during the morphed pass.

Figure 3: Overview of the proposed D-MAD pipeline. The SFDemorpher framework reconstructs an output image $I_{\text{out}}$ from the document $I_{\text{doc}}$ and trusted reference $I_{\text{ref}}$ . Next, an FRS computes the similarity score $s$ between the reconstruction and the reference to classify the document as either bona fide or morphed.

Figure 4: Qualitative results of accomplice identity restoration on morphed images from the FRLL-Morphs-UTW Sarkar et al. (2020) ; Sarkar et al. (2022) ; Ismayilov et al. (2025) dataset. Green scores (bottom right) denote the identity similarity to the ground truth accomplice, while red scores (top left) denote similarity to the non-target criminal identity in the trusted reference. Effective demorphing yields high green scores and low red scores, indicating successful target reconstruction and non-target removal.

Figure 5: Qualitative results on the FEI Morph V2 Di Domenico et al. (2023) ; MI@BioLab () dataset on splicing-based Makrushin et al. (2017) morphs. The visualization follows the same convention as Fig. 4 . This dataset enables evaluation of both accomplice and criminal restoration scenarios.

Figure 6: Qualitative results of bona fide identity restoration. The figure displays document-reference pairs from the FRLL-Morphs-UTW Sarkar et al. (2020) ; Sarkar et al. (2022) ; Ismayilov et al. (2025) , HNU-FM Zhang et al. (2021) , and FEI Morph V2 Di Domenico et al. (2023) ; MI@BioLab () . Green scores (bottom right) indicate the identity similarity to the bona fide document, where higher values signify superior identity preservation.

Dataset	Demorphing	DTI $(A)\uparrow$	DNTI $(A)\downarrow$
Dataset	Method	DTI $(A)\uparrow$	DNTI $(A)\downarrow$
HNU-FM	No Demorphing	0.228	0.182
	FaDe	0.311	-0.004
	SD-U	0.170	-0.125
	SD-S	0.190	-0.227
	SFD (ours)	0.335	-0.221

Table 2: Comparison of Deviation of Target (DTI) and Non-Target (DNTI) Identity for accomplice

(A)

restoration on the HNU-FM Zhang et al. (2021) and FRLL-Morphs-UTW Sarkar et al. (2020) ; Sarkar et al. (2022) ; Ismayilov et al. (2025) datasets. Higher DTI

(A)

and lower DNTI

(A)

values indicate superior face demorphing performance.

Dataset	Demorphing	DTI $(A)\uparrow$	DNTI $(A)\downarrow$	DTI $(C)\uparrow$	DNTI $(C)\downarrow$
Dataset	Method	DTI $(A)\uparrow$	DNTI $(A)\downarrow$	DTI $(C)\uparrow$	DNTI $(C)\downarrow$
FEI Morph V2 C02 Morphs	No Demorphing	0.431	0.119	0.171	0.353
	FaDe	0.449	-0.036	0.200	0.198
	SD-U	0.276	-0.131	0.088	0.048
	SD-S	0.241	-0.206	0.090	-0.030
	SFD (ours)	0.432	-0.212	0.207	0.052

Table 3: Comparison of Deviation of Target Identity (DTI) and Non-Target Identity (DNTI) for accomplice

(A)

and criminal

(C)

restoration scenarios on the FEI Morph V2 Di Domenico et al. (2023) ; MI@BioLab () dataset.

Dataset	Demorphing	DTI $(B)\uparrow$
Dataset	Method	DTI $(B)\uparrow$
FRLL-Morphs- UTW	No Demorphing	0.569
	FaDe	0.597
	SD-U	0.327
	SD-S	0.308
	SFD (ours)	0.553

Table 4: Comparison of bona fide Deviation of Target Identity, DTI

(B)

, across face demorphing methods. Higher DTI

(B)

values indicate better preservation of the original identity in demorphed bona fide documents.

Dataset	D-MAD Method	EER (%)	BSCER @ MACER (%)
Dataset	D-MAD Method	EER (%)	10%	5%	1%
FRLL-Morphs-UTW	AdaFace	0.08	0.00	0.00	0.00
	Siamese	7.84	7.84	7.84	7.84
	CIFAA	10.30	11.77	27.45	71.57
	ACIdA	0.98	0.98	0.98	0.98
	FaDe	0.08	0.00	0.00	0.00

Table 5: Comprehensive comparison of Differential Morphing Attack Detection (D-MAD) performance. The table reports Equal Error Rate (EER) and Bona fide Sample Presentation Classification Error Rate (BSCER) at fixed Morphing Attack Classification Error Rate (MACER) operating points ISO/IEC FDIS 20059 (2025) .

Panel of Figure 7 — Figure 7: Detection Error Trade-off (DET) curves showing D-MAD performance across evaluation datasets. For our proposed approach (SFD), the shaded region represents the $\pm 1$ standard deviation interval.

Dataset	Demorphing	BMS $\uparrow$
Dataset	Method	BMS $\uparrow$
FRLL-Morphs-UTW	No Demorphing	0.453
	FaDe	0.551
	SD-U	0.427
	SD-S	0.489
	SFD (ours)	0.735

Table 6: Comparison of Bona Fide-Morph Separability (BMS) scores. Higher BMS values indicate a larger margin between the score distributions of bona fide and morphed samples

Panel of Figure 8 — Figure 8: Identity similarity score histograms of different evaluation datasets. Green ( $\mathcal{D}_{\text{B}}$ ) and purple ( $\mathcal{D}_{\text{M}}$ ) distributions represent bona fide and morphed score sets (Eq. ( 22 )). The blue distribution $\mathcal{D}_{\text{D}}$ (Eq. ( 24 )) represents the similarity between the demorphed output and the ground truth target identity. The red dotted line denotes the FRS decision threshold $\tau$ . Ideally, a robust method preserves $\mathcal{D}_{\text{B}}$ near the AdaFace baseline, shifts $\mathcal{D}_{\text{M}}$ left of $\tau$ for non-target removal, and positions $\mathcal{D}_{\text{D}}$ right of $\tau$ for target recovery.

Panel of Figure 9 — Figure 9: Ablation studies on the FEI Morph V2 Di Domenico et al. (2023) ; MI@BioLab () dataset (criminal restoration scenario) presented as Detection Error Trade-off (DET) curves. (a) Impact of removing key training components (e.g., Feature Demorphing Module (FDM)). (b) Effect of varying the ratio of synthetic training data. (c) Robustness analysis against common image corruptions. (d) CurricularFace Huang et al. (2020) and (e) ArcFace Deng et al. (2022) Face Recognition Systems (FRS) employed for the D-MAD decision-making of face demorphing methods.

Appendix figures & tables4 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 10: Structure of the ResNet-IR Deng et al. (2022) layer.

Figure 11: Architecture of the Feature Demorphing Module ( $\mathcal{M}_{\text{FDM}}$ ).

Figure 12: Architecture of the Feature Fusion Module ( $\mathcal{M}_{\text{FFM}}$ ).

Dataset	Morphing Method	# of FRSs ( $c$ )
		1	2	3
FRLL-Morphs-UTW	UTW	76.8%	57.6%	20.2%
	UTW-StyleGAN	81.7%	63.4%	41.6%
	OpenCV	95.9%	90.1%	66.3%
	FaceMorpher	94.4%	87.6%	61.8%
	WebMorph	96.2%	89.9%	65.1%

Appendix

Table 7: Morphing Attack Potential (MAP) Ferrara et al. (2022) scores for each morphing method across evaluation datasets. Values represent the percentage of morphs successfully verifying against both contributing subjects on at least

c

FRSs (with

r=1

). Higher values indicate greater attack potential.

Image Forgery Detection

Image Forgery Detection studies how to identify manipulated or synthetic images and locate the visual evidence of tampering.

See all 126 papers

DCMorph: Face Morphing via Dual-Stream Cross-Attention Diffusion
Apr 23, 2026Tahar Chettaoui, Eduarda Caldeira, Guray Ozgur +3Identity-Preserving Image Generation Conditional Diffusion Models
Fraunhofer Institute for Computer Graphics Research IGD, Germany · TU Darmstadt, Germany · Norwegian University of Science and Technology (NTNU), Norway
Arc2Morph: Identity-Preserving Facial Morphing with Arc2Face
Feb 18, 2026Nicolò Di Domenico, Annalisa Franco, Matteo Ferrara +1Identity-Preserving Image Generation Face Recognition
Department of Computer Science and Engineering, University of Bologna, Italy
Enhancing Single-Image Facial Demorphing using Multimodal Large Language Models
May 25, 2026Nitish Shukla, Arun RossImage Reconstruction

Apr 23, 2026J/K move · Enter open · S save

DCMorph: Face Morphing via Dual-Stream Cross-Attention Diffusion

Tahar Chettaoui, Eduarda Caldeira, Guray Ozgur, Raghavendra Ramachandra+2

Fraunhofer Institute for Computer Graphics Research IGD, Germany · TU Darmstadt, Germany · Norwegian University of Science and Technology (NTNU), Norway

Identity-Preserving Image Generation Conditional Diffusion Models

Open paper AskPDF arXiv

Advancing face morphing attack techniques is crucial to anticipate evolving threats and develop robust defensive mechanisms for identity verification systems. This work introduces DCMorph, a dual-stream diffusion-based morphing framework that simultaneously operates at both identity conditioning and latent space levels. Unlike image-level methods suffering from blending artifacts or GAN-based approaches with limited reconstruction fidelity, DCMorph leverages identity-conditioned latent diffusion models through two mechanisms: (1) decoupled cross-attention interpolation that injects identity-specific features from both source faces into the denoising process, enabling explicit dual-identity conditioning absent in existing diffusion-based methods, and (2) DDIM inversion with spherical interpolation between inverted latent representations from both source faces, providing geometrically consistent initial latent representation that preserves structural attributes. Vulnerability analyses across four state-of-the-art face recognition systems demonstrate that DCMorph achieves the highest attack success rates compared to existing methods at both operational thresholds, while remaining challenging to detect by current morphing attack detection solutions.

Abstract

Image Forgery Detection

Explore similar work

DCMorph: Face Morphing via Dual-Stream Cross-Attention Diffusion

Arc2Morph: Identity-Preserving Facial Morphing with Arc2Face

Enhancing Single-Image Facial Demorphing using Multimodal Large Language Models