# 3D Face Morphing Attacks: Generation, Vulnerability and Detection

arXiv: https://arxiv.org/abs/2201.03454 · HTML: https://mlsanity.com/paper/2201.03454/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- Builds on 15 of its 76 references that are in the map.
- First posted on arXiv 10 Jan 2022.

## Builds on (most cited first, 15 of 15)

- [PointNet: Deep Learning on Point Sets for 3D Classification and Segmentation](https://mlsanity.com/paper/1612.00593/) (2016)
- [PointNet++: Deep Hierarchical Feature Learning on Point Sets in a Metric Space](https://mlsanity.com/paper/1706.02413/) (2017)
- [FaceNet: A Unified Embedding for Face Recognition and Clustering](https://mlsanity.com/paper/1503.03832/) (2015)
- [Dynamic Graph CNN for Learning on Point Clouds](https://mlsanity.com/paper/1801.07829/) (2018)
- [3D Morphable Face Models -- Past, Present and Future](https://mlsanity.com/paper/1909.01815/) (2019)
- [FaceScape: a Large-scale High Quality 3D Face Dataset and Detailed Riggable 3D Face Prediction](https://mlsanity.com/paper/2003.13989/) (2020)
- [Revisiting Point Cloud Shape Classification with a Simple and Effective Baseline](https://mlsanity.com/paper/2106.05304/) (2021)
- [Face Morphing Attack Generation & Detection: A Comprehensive Survey](https://mlsanity.com/paper/2011.02045/) (2020)
- [Shape registration in the time of transformers](https://mlsanity.com/paper/2106.13679/) (2021)
- [No-Reference Quality Assessment for 3D Colored Point Cloud and Mesh Models](https://mlsanity.com/paper/2107.02041/) (2021)
- [CorrNet3D: Unsupervised End-to-end Learning of Dense Correspondence for 3D Point Clouds](https://mlsanity.com/paper/2012.15638/) (2020)
- [Can GAN Generated Morphs Threaten Face Recognition Systems Equally as Landmark Based Morphs? -- Vulnerability and Detection](https://mlsanity.com/paper/2007.03621/) (2020)
- [3D ShapeNets: A Deep Representation for Volumetric Shapes](https://mlsanity.com/paper/1406.5670/) (2014)
- [Quasi-Newton Solver for Robust Non-Rigid Registration](https://mlsanity.com/paper/2004.04322/) (2020)
- [Topology-Aware Non-Rigid Point Cloud Registration](https://mlsanity.com/paper/1811.07014/) (2018)

## Built on by (most cited first, 5 of 5)

- [MorCode: Face Morphing Attack Generation using Generative Codebooks](https://mlsanity.com/paper/2410.07625/) (2024)
- [Empowering Morphing Attack Detection using Interpretable Image-Text Foundation Model](https://mlsanity.com/paper/2508.10110/) (2025)
- [FLOWING: Implicit Neural Flows for Structure-Preserving Morphing](https://mlsanity.com/paper/2510.09537/) (2025)
- [3D Face Morphing Attack Generation using Non-Rigid Registration](https://mlsanity.com/paper/2404.15765/) (2024)
- [DCMorph: Face Morphing via Dual-Stream Cross-Attention Diffusion](https://mlsanity.com/paper/2604.21627/) (2026)

## Abstract (arXiv)

Face Recognition systems (FRS) have been found to be vulnerable to morphing attacks, where the morphed face image is generated by blending the face images from contributory data subjects. This work presents a novel direction for generating face-morphing attacks in 3D. To this extent, we introduced a novel approach based on blending 3D face point clouds corresponding to contributory data subjects. The proposed method generates 3D face morphing by projecting the input 3D face point clouds onto depth maps and 2D color images, followed by image blending and wrapping operations performed independently on the color images and depth maps. We then back-projected the 2D morphing color map and the depth map to the point cloud using the canonical (fixed) view. Given that the generated 3D face morphing models will result in holes owing to a single canonical view, we have proposed a new algorithm for hole filling that will result in a high-quality 3D face morphing model. Extensive experiments were conducted on the newly generated 3D face dataset comprising 675 3D scans corresponding to 41 unique data subjects and a publicly available database (Facescape) with 100 data subjects. Experiments were performed to benchmark the vulnerability of the {proposed 3D morph-generation scheme against} automatic 2D, 3D FRS, and human observer analysis. We also presented a quantitative assessment of the quality of the generated 3D face-morphing models using eight different quality metrics. Finally, we propose three different 3D face Morphing Attack Detection (3D-MAD) algorithms to benchmark the performance of 3D face morphing attack detection techniques.