ML Security PapersSFDemorpher: Generalizable Face Demorphing for Operational Morphing Attack Detection
Raul Ismayilov , Luuk Spreeuwers
Published on arXiv
2603.28322
Input Manipulation Attack
OWASP ML Top 10 — ML01
Key Finding
Achieves state-of-the-art D-MAD performance across 13 unseen morphing techniques by widening the margin between bona fide and morphed sample score distributions
SFDemorpher
Novel technique introduced
Face morphing attacks compromise biometric security by creating document images that verify against multiple identities, posing significant risks from document issuance to border control. Differential Morphing Attack Detection (D-MAD) offers an effective countermeasure, particularly when employing face demorphing to disentangle identities blended in the morph. However, existing methods lack operational generalizability due to limited training data and the assumption that all document inputs are morphs. This paper presents SFDemorpher, a framework designed for the operational deployment of face demorphing for D-MAD that performs identity disentanglement within joint StyleGAN latent and high-dimensional feature spaces. We introduce a dual-pass training strategy handling both morphed and bona fide documents, leveraging a hybrid corpus with predominantly synthetic identities to enhance robustness against unseen distributions. Extensive evaluation confirms state-of-the-art generalizability across unseen identities, diverse capture conditions, and 13 morphing techniques, spanning both border verification and the challenging document enrollment stage. Our framework achieves superior D-MAD performance by widening the margin between the score distributions of bona fide and morphed samples while providing high-fidelity visual reconstructions facilitating explainability.
Key Contributions
- Joint StyleGAN latent and feature space demorphing for improved identity preservation in morphed biometric documents
- Dual-pass training strategy handling both morphed and bona fide documents to improve differential morphing attack detection (D-MAD)
- First face demorphing approach trained predominantly (80%) on synthetic identities, demonstrating generalization to real-world scenarios
🛡️ Threat Analysis
Face morphing attacks are adversarial manipulations of biometric inputs at inference time (border control verification). The paper proposes a defense (demorphing) against these evasion attacks that cause biometric systems to incorrectly verify multiple identities. The morphed face image is an adversarial input designed to fool face recognition systems.