# Deep Composite Face Image Attacks: Generation, Vulnerability and Detection

arXiv: https://arxiv.org/abs/2211.11039 · HTML: https://mlsanity.com/paper/2211.11039/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- Builds on 17 of its 51 references that are in the map.
- First posted on arXiv 20 Nov 2022.

## Builds on (most cited first, 17 of 17)

- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [A Style-Based Generator Architecture for Generative Adversarial Networks](https://mlsanity.com/paper/1812.04948/) (2018)
- [Analyzing and Improving the Image Quality of StyleGAN](https://mlsanity.com/paper/1912.04958/) (2019)
- [Progressive Growing of GANs for Improved Quality, Stability, and Variation](https://mlsanity.com/paper/1710.10196/) (2017)
- [FaceNet: A Unified Embedding for Face Recognition and Clustering](https://mlsanity.com/paper/1503.03832/) (2015)
- [Unified Perceptual Parsing for Scene Understanding](https://mlsanity.com/paper/1807.10221/) (2018)
- [Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey](https://mlsanity.com/paper/1801.00553/) (2018)
- [InterFaceGAN: Interpreting the Disentangled Face Representation Learned by GANs](https://mlsanity.com/paper/2005.09635/) (2020)
- [Face Morphing Attack Generation & Detection: A Comprehensive Survey](https://mlsanity.com/paper/2011.02045/) (2020)
- [Using latent space regression to analyze and leverage compositionality in GANs](https://mlsanity.com/paper/2103.10426/) (2021)
- [Privacy-friendly Synthetic Data for the Development of Face Morphing Attack Detectors](https://mlsanity.com/paper/2203.06691/) (2022)
- [Can GAN Generated Morphs Threaten Face Recognition Systems Equally as Landmark Based Morphs? -- Vulnerability and Detection](https://mlsanity.com/paper/2007.03621/) (2020)
- [Vulnerability Analysis of Face Morphing Attacks from Landmarks and Generative Adversarial Networks](https://mlsanity.com/paper/2012.05344/) (2020)
- [ReGenMorph: Visibly Realistic GAN Generated Face Morphing Attacks by Attack Re-generation](https://mlsanity.com/paper/2108.09130/) (2021)
- [Morphing Attack Potential](https://mlsanity.com/paper/2204.13374/) (2022)
- [Analyzing Human Observer Ability in Morphing Attack Detection -- Where Do We Stand?](https://mlsanity.com/paper/2202.12426/) (2022)
- [On the Influence of Ageing on Face Morph Attacks: Vulnerability and Detection](https://mlsanity.com/paper/2007.02684/) (2020)

## Built on by (most cited first, 6 of 6)

- [MorCode: Face Morphing Attack Generation using Generative Codebooks](https://mlsanity.com/paper/2410.07625/) (2024)
- [Towards minimizing efforts for Morphing Attacks -- Deep embeddings for morphing pair selection and improved Morphing Attack Detection](https://mlsanity.com/paper/2305.18216/) (2023)
- [Differential Newborn Face Morphing Attack Detection using Wavelet Scatter Network](https://mlsanity.com/paper/2305.01294/) (2023)
- [Vulnerability of Face Morphing Attacks: A Case Study on Lookalike and Identical Twins](https://mlsanity.com/paper/2303.14004/) (2023)
- [3D Face Morphing Attack Generation using Non-Rigid Registration](https://mlsanity.com/paper/2404.15765/) (2024)
- [MLSD-GAN -- Generating Strong High Quality Face Morphing Attacks using Latent Semantic Disentanglement](https://mlsanity.com/paper/2404.12679/) (2024)

## Abstract (arXiv)

Face manipulation attacks have drawn the attention of biometric researchers because of their vulnerability to Face Recognition Systems (FRS). This paper proposes a novel scheme to generate Composite Face Image Attacks (CFIA) based on facial attributes using Generative Adversarial Networks (GANs). Given the face images corresponding to two unique data subjects, the proposed CFIA method will independently generate the segmented facial attributes, then blend them using transparent masks to generate the CFIA samples. We generate 526 unique CFIA combinations of facial attributes for each pair of contributory data subjects. Extensive experiments are carried out on our newly generated CFIA dataset consisting of 1000 unique identities with 2000 bona fide samples and 526000 CFIA samples, thus resulting in an overall 528000 face image samples. We present a sequence of experiments to benchmark the attack potential of CFIA samples using four different automatic FRS. We introduced a new metric named Generalized Morphing Attack Potential (G-MAP) to benchmark the vulnerability of generated attacks on FRS effectively. Additional experiments are performed on the representative subset of the CFIA dataset to benchmark both perceptual quality and human observer response. Finally, the CFIA detection performance is benchmarked using three different single image based face Morphing Attack Detection (MAD) algorithms. The source code of the proposed method together with CFIA dataset will be made publicly available: urlhttps://github.com/jagmohaniiit/LatentCompositionCode