Face morphing attacks, in which the biometric traits of two or more identities are blended into a single face image, pose a severe threat to identity document issuance and automated border control. Consequently, a large body of work has proposed Single-image Morphing Attack Detection (S-MAD) algorithms and benchmarked them on datasets such as SYN-MAD22. However, the majority of these benchmarks operate exclusively in the digital domain, which contrasts with the real-world passport issuance pipeline in some countries, which still requires an applicant-supplied photograph to be printed and subsequently re-scanned before it is embedded in the identity document or fed into an automated verification system. This print-scan step introduces halftoning, resampling, color-space, and sensor noise that are absent from digital pipelines, and may mask the high-frequency artifacts that S-MAD models rely on. In this work, we introduce a print-scan version of the SYN-MAD22 dataset, obtained by printing and re-scanning all bona fide and morphed images at 300 and 600 DPI, and we use it to evaluate eight state-of-the-art S-MAD models trained exclusively on digital data. We additionally repeat the acquisition with a second scanner to assess cross-device robustness. Our results show that detectors that achieve near state-of-the-art performance in the digital domain suffer a more than threefold increase in average equal error rate, with the same qualitative degradation observed across both scanning devices, exposing a critical, previously under-reported gap between digital-benchmark performance and robustness to print-scan degradation.
Figures & tables
Fig. 1: Visual comparison of the digital and print-scanned versions of a representative SYN-MAD22 image. Absolute difference maps reveal spatial changes in facial texture, edges, and color between the digital and print-scanned images, whereas the differences between the two scanning resolutions are comparatively small.
Related Works
Bona fide
Morphs
Morph types
Printers / scanners
MAD models
FR systems
P&S train
Public
Raghavendra et al. [ 29 ]
352
431
1
1 / 2
1
–
✓
–
NIST FRVT MORPH [ 24 ]
2,739
3,604
n/r
1 / 1
submitted
–
n/r
Seq.
SOTAMD [ 30 ]
1,096
3,703
multiple
multiple / multiple
submitted
–
n/r
Seq.
Tapia et al. [ 34 , 35 ]
984
3,856
4
n/r / 1
2
–
✓
✗
Zhang [ 37 ]
1,270
2,500
5
1 / 1
8
–
✓
✗
Patwardhan et al. [ 25 ]
n/r
n/r
5
2 / 1
4
–
✗
✗
TABLE I: Comparison with prior print-scan (P&S) MAD works. Bona fide/morph counts refer to P&S images. n/r = not reported; – = not studied; Seq. = sequestered (evaluation only via submission). P&S train = detectors trained or fine-tuned with real or simulated P&S data; ours is intentionally test-only, so results measure cross-domain generalization. Ours is the only open benchmark with a large panel of S-MAD models, two scanners and FR analysis.
Fig. 2: Print-scan acquisition and evaluation pipeline. Digital SYN-MAD22 [ 15 ] images (bona fide and morphed) are arranged in groups of four on A4 sheets and printed on a laser-jet printer. Each image is accompanied by a QR code containing the metadata required to associate the scanned image with its original digital sample. The sheets are re-scanned at 300 and 600 DPI using a multifunction scanner and subsequently automatically detected, cropped, and geometrically aligned to the original ICAO-compliant crop. The resulting images are used to evaluate eight S-MAD detectors, and their results are compared to the digital images as a reference condition.
Subset
Conditions
Bona fide
Morphs
Image instances
Digital
1
204
5,483
5,687
Print–scan
4
204
5,483
22,748
Total
5
–
–
28,435
TABLE II: Composition of MAD22-PS. The four physical print–scan conditions correspond to two scanners (C250i and C450i) at 300 and 600 DPI. Morphs span six generation algorithms: OpenCV, FaceMorpher, WebMorph, MIPGAN-I [ 38 ] , MIPGAN-II [ 38 ] and MorDIFF [ 4 ] .
S-MAD Detector
Acquisition
Image level morphing
Representation level morphing
Average
OpenCV
FaceMorpher
WebMorph
MIPGAN-I [ 38 ]
MIPGAN-II [ 38 ]
MorDIFF [ 4 ]
MixFaceNet-MAD [ 5 ]
Digital
8.33
4.60
18.20
16.70
20.62
8.50
12.83
PS600
15.04
6.82
26.96
43.14
44.04
84.97
36.83
PS300
15.20
6.86
28.92
28.43
31.37
76.49
31.21
Inception-MAD [ 5 ]
Digital
7.52
0.00
18.00
10.90
16.22
5.30
9.66
PS600
9.51
2.60
30.76
47.84
48.19
48.61
31.25
TABLE III: EER (%, ↓ ) of eight S-MAD models under digital and print–scan acquisition on SYN-MAD22 [ 15 ] using the Konica Minolta bizhub C250i. PS600 and PS300 denote print–scan acquisition at 600 and 300 dpi, respectively. Morphing algorithms are grouped according to whether morph generation operates at the image or representation level.
Digital
C250i
C450i
PS300
PS600
PS300
PS600
Average EER
11.00
41.72
41.85
39.78
38.96
TABLE IV: Cross-scanner comparison of S-MAD performance. Average EER (%, ↓ ) across eight detectors and six morphing algorithms. Results are reported for the original digital images and for print–scan acquisition using two scanners at 300 and 600 dpi.
FR system
Acquisition
Image level morphing
Representation level morphing
OpenCV
FaceMorpher
WebMorph
MIPGAN-I [ 38 ]
MIPGAN-II [ 38 ]
MorDIFF [ 4 ]
CurricularFace [ 14 ]
Digital
0.996/0.986
0.962/0.913
0.990/0.986
0.962/0.890
0.953/0.832
0.995/0.986
PS600
0.996/0.986
0.974/0.934
0.992/0.988
0.955/0.862
0.935/0.812
0.993/0.971
PS300
1.000/0.987
0.972/0.930
0.992/0.986
0.960/0.874
0.942/0.826
0.993/0.969
ElasticFace [ 2 ]
Digital
0.997/0.980
0.962/0.913
0.990/0.986
0.980/0.845
0.953/0.778
0.990/0.948
PS600
0.999/0.988
0.965/0.939
0.990/0.986
0.965/0.896
0.961/0.888
0.992/0.967
TABLE V: Morphing vulnerability of four face recognition (FR) systems under digital and print–scan acquisition using the Konica Minolta bizhub C250i. Each cell reports MMPMR100/MMPMR1000 ( ↑ ; higher means the morph is a more successful attack). PS600 and PS300 indicate print–scan acquisition at 600 and 300 dpi, respectively. Morphing algorithms are grouped according to whether morph generation operates at the image or representation level.
Face morphing attacks are widely recognized as one of the most challenging threats to face recognition systems used in electronic identity documents. These attacks exploit a critical vulnerability in passport enrollment procedures adopted by many countries, where the facial image is often acquired without a supervised live capture process. In this paper, we propose a novel face morphing technique based on Arc2Face, an identity-conditioned face foundation model capable of synthesizing photorealistic facial images from compact identity representations. We demonstrate the effectiveness of the proposed approach by comparing the morphing attack potential metric on two large-scale sequestered face morphing attack detection datasets against several state-of-the-art morphing methods, as well as on two novel morphed face datasets derived from FEI and ONOT. Experimental results show that the proposed deep learning-based approach achieves a morphing attack potential comparable to that of landmark-based techniques, which have traditionally been regarded as the most challenging. These findings confirm the ability of the proposed method to effectively preserve and manage identity information during the morph generation process.
Nicolò Di Domenico, Annalisa Franco, Matteo Ferrara +1
Department of Computer Science and Engineering, University of Bologna, Italy
Face morphing attacks compromise biometric security by creating document images that verify against multiple identities, posing significant risks from document issuance to border control. Differential Morphing Attack Detection (D-MAD) offers an effective countermeasure, particularly when employing face demorphing to disentangle identities blended in the morph. However, existing methods lack operational generalizability due to limited training data and the assumption that all document inputs are morphs. This paper presents SFDemorpher, a framework designed for the operational deployment of face demorphing for D-MAD that performs identity disentanglement within joint StyleGAN latent and high-dimensional feature spaces. We introduce a dual-pass training strategy handling both morphed and bona fide documents, leveraging a hybrid corpus with predominantly synthetic identities to enhance robustness against unseen distributions. Extensive evaluation confirms state-of-the-art generalizability across unseen identities, diverse capture conditions, and 13 morphing techniques, spanning both border verification and the challenging document enrollment stage. Our framework achieves superior D-MAD performance by widening the margin between the score distributions of bona fide and morphed samples while providing high-fidelity visual reconstructions facilitating explainability.
Raul Ismayilov, Luuk Spreeuwers
Data Management & Biometrics, University of Twente, Drienerlolaan 5, Enschede, 7512AD, Netherlands.
Face morphing attacks pose a substantial risk to the reliability of face recognition systems used in passport issuance, border control, and digital identity verification. Detecting morphing attacks from a single facial image remains challenging owing to the lack of a trusted reference and the diversity of attack generation methods. This paper presents a new Single-Image Face Morphing Attack Detection (S-MAD) framework that integrates high-frequency Laplacian residual statistics with representations from a frozen, foundation-scale vision transformer. The approach employs residual-statistic-gated low-rank adapters (R-FLoRA) and feature-wise residual fusion (Res-FiLM) to enhance sensitivity to local morphing artefacts while preserving the semantic context of the backbone. A novel residual-contrastive alignment loss further regularises the fused token space, improving discrimination under unseen morphing conditions. Comprehensive experiments on four ICAO-compliant datasets, encompassing seven morph generation techniques, demonstrate that the proposed method consistently surpasses nine recent state-of-the-art S-MAD algorithms in detection accuracy and cross-domain (or dataset) generalisation. With a frozen backbone and minimal trainable parameters, the model achieves real-time efficiency and interpretability, making it suitable for real-life scenarios in biometric verification systems.
Raghavendra Ramachandra
SAFE Center, Department of Information Security and Communication Technology, Norwegian University of Science and Technology (NTNU), Norway