ML Security PapersArc2Morph: Identity-Preserving Facial Morphing with Arc2Face
Nicolò Di Domenico , Annalisa Franco , Matteo Ferrara , Davide Maltoni
Published on arXiv
2602.16569
Input Manipulation Attack
OWASP ML Top 10 — ML01
Key Finding
Arc2Morph achieves morphing attack potential comparable to landmark-based techniques — historically the hardest to detect — while clearly surpassing existing deep learning-based morphing approaches on sequestered evaluation datasets.
Arc2Morph
Novel technique introduced
Face morphing attacks are widely recognized as one of the most challenging threats to face recognition systems used in electronic identity documents. These attacks exploit a critical vulnerability in passport enrollment procedures adopted by many countries, where the facial image is often acquired without a supervised live capture process. In this paper, we propose a novel face morphing technique based on Arc2Face, an identity-conditioned face foundation model capable of synthesizing photorealistic facial images from compact identity representations. We demonstrate the effectiveness of the proposed approach by comparing the morphing attack potential metric on two large-scale sequestered face morphing attack detection datasets against several state-of-the-art morphing methods, as well as on two novel morphed face datasets derived from FEI and ONOT. Experimental results show that the proposed deep learning-based approach achieves a morphing attack potential comparable to that of landmark-based techniques, which have traditionally been regarded as the most challenging. These findings confirm the ability of the proposed method to effectively preserve and manage identity information during the morph generation process.
Key Contributions
- Novel face morphing method using Arc2Face (identity-conditioned diffusion model) that achieves attack potential comparable to landmark-based techniques while outperforming existing deep learning-based morphing methods
- Extensive evaluation on two large-scale sequestered face morphing attack detection datasets plus two newly created morphed datasets (FEI and ONOT)
- Public release of implementation and two new morphed face datasets to support reproducibility and benchmarking
🛡️ Threat Analysis
Face morphing creates crafted synthetic inputs designed to cause incorrect outputs from face recognition ML models at inference time — specifically causing the FRS to accept two distinct identities, the core input manipulation threat. While not gradient-based perturbation, the security contribution is fabricating inputs that systematically evade and fool deployed ML classifiers.