ML Security PapersDifFoundMAD: Foundation Models meet Differential Morphing Attack Detection
Lazaro J. Gonzalez-Soler , André Dörsch , Christian Rathgeb , Christoph Busch
Published on arXiv
2604.17961
Input Manipulation Attack
OWASP ML Top 10 — ML01
Key Finding
Reduces error rates from 6.16% to 2.17% at high-security thresholds, outperforming state-of-the-art differential morphing attack detection systems
DifFoundMAD
Novel technique introduced
In this work, we introduce DifFoundMAD, a parameter-efficient D-MAD framework that exploits the generalisation capabilities of vision foundation models (FM) to capture discrepancies between suspected morphs and live capture images. In contrast to conventional D-MAD systems that rely on face recognition embeddings or handcrafted feature differences, DifFoundMAD follows the standard differential paradigm while replacing the underlying representation space with embeddings extracted from FMs. By combining lightweight finetuning with class-balanced optimisation, the proposed method updates only a small subset of parameters while preserving the rich representational priors of the underlying FMs. Extensive cross-database evaluations on standard D-MAD benchmarks demonstrate that DifFoundMAD achieves consistent improvements over state-of-the-art systems, particularly at the strict security levels required in operational deployments such as border control: The error rates reported in the current state-of-the-art were reduced from 6.16% to 2.17% for high-security levels using DifFoundMAD.
Key Contributions
- DifFoundMAD framework that leverages vision foundation models for differential morphing attack detection instead of face recognition embeddings
- Parameter-efficient adaptation using LoRA to finetune only a small subset of FM parameters while preserving pretrained representations
- Reduces error rates from 6.16% to 2.17% at high-security operational thresholds on cross-database evaluations
🛡️ Threat Analysis
Facial morphing attacks are adversarial inputs crafted to cause misclassification in face recognition systems at inference time. The paper proposes a defense (differential morphing attack detection) that compares live captures against suspected morphs to detect these evasion attacks. While the defense mechanism is differential (comparing two images), the underlying threat is ML01: adversarial manipulation of inputs to evade biometric authentication.