# Unsupervised Face Morphing Attack Detection via Self-paced Anomaly Detection

arXiv: https://arxiv.org/abs/2208.05787 · HTML: https://mlsanity.com/paper/2208.05787/

## Key facts

- Cited by 16 papers in the map (data through 14 Oct 2026).
- Builds on 22 of its 55 references that are in the map.
- First posted on arXiv 11 Aug 2022.

## Builds on (most cited first, 22 of 22)

- [PyTorch: An Imperative Style, High-Performance Deep Learning Library](https://mlsanity.com/paper/1912.01703/) (2019)
- [Deep Learning Face Attributes in the Wild](https://mlsanity.com/paper/1411.7766/) (2014)
- [Training Generative Adversarial Networks with Limited Data](https://mlsanity.com/paper/2006.06676/) (2020)
- [VGGFace2: A dataset for recognising faces across pose and age](https://mlsanity.com/paper/1710.08092/) (2017)
- [Joint Face Detection and Alignment using Multi-task Cascaded Convolutional Networks](https://mlsanity.com/paper/1604.02878/) (2016)
- [Learning Face Representation from Scratch](https://mlsanity.com/paper/1411.7923/) (2014)
- [Learning Temporal Regularity in Video Sequences](https://mlsanity.com/paper/1604.04574/) (2016)
- [Learning From Multiple Experts: Self-paced Knowledge Distillation for Long-tailed Classification](https://mlsanity.com/paper/2001.01536/) (2020)
- [ElasticFace: Elastic Margin Loss for Deep Face Recognition](https://mlsanity.com/paper/2109.09416/) (2021)
- [CelebA-Spoof: Large-Scale Face Anti-Spoofing Dataset with Rich Annotations](https://mlsanity.com/paper/2007.12342/) (2020)
- [Privacy-friendly Synthetic Data for the Development of Face Morphing Attack Detectors](https://mlsanity.com/paper/2203.06691/) (2022)
- [Can GAN Generated Morphs Threaten Face Recognition Systems Equally as Landmark Based Morphs? -- Vulnerability and Detection](https://mlsanity.com/paper/2007.03621/) (2020)
- [Vulnerability Analysis of Face Morphing Attacks from Landmarks and Generative Adversarial Networks](https://mlsanity.com/paper/2012.05344/) (2020)
- [MixFaceNets: Extremely Efficient Face Recognition Networks](https://mlsanity.com/paper/2107.13046/) (2021)
- [PW-MAD: Pixel-wise Supervision for Generalized Face Morphing Attack Detection](https://mlsanity.com/paper/2108.10291/) (2021)
- [Face morphing detection in the presence of printing/scanning and heterogeneous image sources](https://mlsanity.com/paper/1901.08811/) (2019)
- [Self-Paced Learning: an Implicit Regularization Perspective](https://mlsanity.com/paper/1606.00128/) (2016)
- [ReGenMorph: Visibly Realistic GAN Generated Face Morphing Attacks by Attack Re-generation](https://mlsanity.com/paper/2108.09130/) (2021)
- [Real Masks and Spoof Faces: On the Masked Face Presentation Attack Detection](https://mlsanity.com/paper/2103.01546/) (2021)
- [Detection of Face Recognition Adversarial Attacks](https://mlsanity.com/paper/1912.02918/) (2019)
- [Mutual Information Maximization on Disentangled Representations for Differential Morph Detection](https://mlsanity.com/paper/2012.01542/) (2020)
- [Differential Anomaly Detection for Facial Images](https://mlsanity.com/paper/2110.03464/) (2021)

## Built on by (most cited first, 16 of 16)

- [SynthASpoof: Developing Face Presentation Attack Detection Based on Privacy-friendly Synthetic Data](https://mlsanity.com/paper/2303.02660/) (2023)
- [MADation: Face Morphing Attack Detection with Foundation Models](https://mlsanity.com/paper/2501.03800/) (2025)
- [Face Morphing Attack Detection with Denoising Diffusion Probabilistic Models](https://mlsanity.com/paper/2306.15733/) (2023)
- [Unveiling the Two-Faced Truth: Disentangling Morphed Identities for Face Morphing Detection](https://mlsanity.com/paper/2306.03002/) (2023)
- [SelfMAD: Enhancing Generalization and Robustness in Morphing Attack Detection via Self-Supervised Learning](https://mlsanity.com/paper/2504.05504/) (2025)
- [IDNet: A Novel Dataset for Identity Document Analysis and Fraud Detection](https://mlsanity.com/paper/2408.01690/) (2024)
- [SynFacePAD 2023: Competition on Face Presentation Attack Detection Based on Privacy-aware Synthetic Training Data](https://mlsanity.com/paper/2311.05336/) (2023)
- [Evaluating the Effectiveness of Attack-Agnostic Features for Morphing Attack Detection](https://mlsanity.com/paper/2410.16802/) (2024)
- [FD-MAD: Frequency-Domain Residual Analysis for Face Morphing Attack Detection](https://mlsanity.com/paper/2601.20656/) (2026)
- [Emergent Morphing Attack Detection in Open Multi-modal Large Language Models](https://mlsanity.com/paper/2602.15461/) (2026)
- [DCMorph: Face Morphing via Dual-Stream Cross-Attention Diffusion](https://mlsanity.com/paper/2604.21627/) (2026)
- [Towards Generalizable Morph Attack Detection with Consistency Regularization](https://mlsanity.com/paper/2308.10392/) (2023)
- [SRL-MAD: Structured Residual Latents for One-Class Morphing Attack Detection](https://mlsanity.com/paper/2603.15050/) (2026)
- [R-FLoRA: Residual-Statistic-Gated Low-Rank Adaptation for Single-Image Face Morphing Attack Detection](https://mlsanity.com/paper/2604.17321/) (2026)
- [On the Impact of Face Segmentation-Based Background Removal on Recognition and Morphing Attack Detection](https://mlsanity.com/paper/2604.20585/) (2026)
- [Enhancing Single-Image Facial Demorphing using Multimodal Large Language Models](https://mlsanity.com/paper/2605.25442/) (2026)

## Abstract (arXiv)

The supervised-learning-based morphing attack detection (MAD) solutions achieve outstanding success in dealing with attacks from known morphing techniques and known data sources. However, given variations in the morphing attacks, the performance of supervised MAD solutions drops significantly due to the insufficient diversity and quantity of the existing MAD datasets. To address this concern, we propose a completely unsupervised MAD solution via self-paced anomaly detection (SPL-MAD) by leveraging the existing large-scale face recognition (FR) datasets and the unsupervised nature of convolutional autoencoders. Using general FR datasets that might contain unintentionally and unlabeled manipulated samples to train an autoencoder can lead to a diverse reconstruction behavior of attack and bona fide samples. We analyze this behavior empirically to provide a solid theoretical ground for designing our unsupervised MAD solution. This also results in proposing to integrate our adapted modified self-paced learning paradigm to enhance the reconstruction error separability between the bona fide and attack samples in a completely unsupervised manner. Our experimental results on a diverse set of MAD evaluation datasets show that the proposed unsupervised SPL-MAD solution outperforms the overall performance of a wide range of supervised MAD solutions and provides higher generalizability on unknown attacks.