# Leveraging Diffusion For Strong and High Quality Face Morphing Attacks

arXiv: https://arxiv.org/abs/2301.04218 · HTML: https://mlsanity.com/paper/2301.04218/

## Key facts

- Cited by 14 papers in the map (data through 14 Oct 2026).
- Builds on 26 of its 59 references that are in the map.
- First posted on arXiv 10 Jan 2023.

## Builds on (most cited first, 26 of 26)

- [Denoising Diffusion Probabilistic Models](https://mlsanity.com/paper/2006.11239/) (2020)
- [U-Net: Convolutional Networks for Biomedical Image Segmentation](https://mlsanity.com/paper/1505.04597/) (2015)
- [Denoising Diffusion Implicit Models](https://mlsanity.com/paper/2010.02502/) (2020)
- [Diffusion Models Beat GANs on Image Synthesis](https://mlsanity.com/paper/2105.05233/) (2021)
- [A Style-Based Generator Architecture for Generative Adversarial Networks](https://mlsanity.com/paper/1812.04948/) (2018)
- [Squeeze-and-Excitation Networks](https://mlsanity.com/paper/1709.01507/) (2017)
- [Analyzing and Improving the Image Quality of StyleGAN](https://mlsanity.com/paper/1912.04958/) (2019)
- [FaceNet: A Unified Embedding for Face Recognition and Clustering](https://mlsanity.com/paper/1503.03832/) (2015)
- [Large Scale GAN Training for High Fidelity Natural Image Synthesis](https://mlsanity.com/paper/1809.11096/) (2018)
- [Aggregated Residual Transformations for Deep Neural Networks](https://mlsanity.com/paper/1611.05431/) (2016)
- [Alias-Free Generative Adversarial Networks](https://mlsanity.com/paper/2106.12423/) (2021)
- [VGGFace2: A dataset for recognising faces across pose and age](https://mlsanity.com/paper/1710.08092/) (2017)
- [Joint Face Detection and Alignment using Multi-task Cascaded Convolutional Networks](https://mlsanity.com/paper/1604.02878/) (2016)
- [Diffusion Autoencoders: Toward a Meaningful and Decodable Representation](https://mlsanity.com/paper/2111.15640/) (2021)
- [Pivotal Tuning for Latent-based Editing of Real Images](https://mlsanity.com/paper/2106.05744/) (2021)
- [Are GANs Created Equal? A Large-Scale Study](https://mlsanity.com/paper/1711.10337/) (2017)
- [Partial FC: Training 10 Million Identities on a Single Machine](https://mlsanity.com/paper/2010.05222/) (2020)
- [Face Morphing Attack Generation & Detection: A Comprehensive Survey](https://mlsanity.com/paper/2011.02045/) (2020)
- [Improved Residual Networks for Image and Video Recognition](https://mlsanity.com/paper/2004.04989/) (2020)
- [Deep Face Representations for Differential Morphing Attack Detection](https://mlsanity.com/paper/2001.01202/) (2020)
- [Can GAN Generated Morphs Threaten Face Recognition Systems Equally as Landmark Based Morphs? -- Vulnerability and Detection](https://mlsanity.com/paper/2007.03621/) (2020)
- [Vulnerability Analysis of Face Morphing Attacks from Landmarks and Generative Adversarial Networks](https://mlsanity.com/paper/2012.05344/) (2020)
- [Are GAN-based Morphs Threatening Face Recognition?](https://mlsanity.com/paper/2205.02496/) (2022)
- [On the detection of morphing attacks generated by GANs](https://mlsanity.com/paper/2209.00404/) (2022)
- [Adversarially Perturbed Wavelet-based Morphed Face Generation](https://mlsanity.com/paper/2111.01965/) (2021)
- [Multiple-Identity Image Attacks Against Face-based Identity Verification](https://mlsanity.com/paper/1906.08507/) (2019)

## Built on by (most cited first, 14 of 14)

- [Greedy-DiM: Greedy Algorithms for Unreasonably Effective Face Morphs](https://mlsanity.com/paper/2404.06025/) (2024)
- [LADIMO: Face Morph Generation through Biometric Template Inversion with Latent Diffusion](https://mlsanity.com/paper/2410.07988/) (2024)
- [AdjointDEIS: Efficient Gradients for Diffusion Models](https://mlsanity.com/paper/2405.15020/) (2024)
- [SelfMAD: Enhancing Generalization and Robustness in Morphing Attack Detection via Self-Supervised Learning](https://mlsanity.com/paper/2504.05504/) (2025)
- [Fast-DiM: Towards Fast Diffusion Morphs](https://mlsanity.com/paper/2310.09484/) (2023)
- [MorCode: Face Morphing Attack Generation using Generative Codebooks](https://mlsanity.com/paper/2410.07625/) (2024)
- [Worst-Case Morphs using Wasserstein ALI and Improved MIPGAN](https://mlsanity.com/paper/2310.08371/) (2023)
- [Approximating Optimal Morphing Attacks using Template Inversion](https://mlsanity.com/paper/2402.00695/) (2024)
- [The Impact of Print-Scanning in Heterogeneous Morph Evaluation Scenarios](https://mlsanity.com/paper/2404.06559/) (2024)
- [FD-MAD: Frequency-Domain Residual Analysis for Face Morphing Attack Detection](https://mlsanity.com/paper/2601.20656/) (2026)
- [DCMorph: Face Morphing via Dual-Stream Cross-Attention Diffusion](https://mlsanity.com/paper/2604.21627/) (2026)
- [Revisiting Diffusion Autoencoder Training for Image Reconstruction Quality](https://mlsanity.com/paper/2504.21368/) (2025)
- [WaFusion: A Wavelet-Enhanced Diffusion Framework for Face Morph Generation](https://mlsanity.com/paper/2507.12493/) (2025)
- [DifFoundMAD: Foundation Models meet Differential Morphing Attack Detection](https://mlsanity.com/paper/2604.17961/) (2026)

## Abstract (arXiv)

Face morphing attacks seek to deceive a Face Recognition (FR) system by presenting a morphed image consisting of the biometric qualities from two different identities with the aim of triggering a false acceptance with one of the two identities, thereby presenting a significant threat to biometric systems. The success of a morphing attack is dependent on the ability of the morphed image to represent the biometric characteristics of both identities that were used to create the image. We present a novel morphing attack that uses a Diffusion-based architecture to improve the visual fidelity of the image and the ability of the morphing attack to represent characteristics from both identities. We demonstrate the effectiveness of the proposed attack by evaluating its visual fidelity via the Frechet Inception Distance (FID). Also, extensive experiments are conducted to measure the vulnerability of FR systems to the proposed attack. The ability of a morphing attack detector to detect the proposed attack is measured and compared against two state-of-the-art GAN-based morphing attacks along with two Landmark-based attacks. Additionally, a novel metric to measure the relative strength between different morphing attacks is introduced and evaluated.