# MorDIFF: Recognition Vulnerability and Attack Detectability of Face Morphing Attacks Created by Diffusion Autoencoders

arXiv: https://arxiv.org/abs/2302.01843 · HTML: https://mlsanity.com/paper/2302.01843/

## Key facts

- Cited by 44 papers in the map (data through 14 Oct 2026).
- Builds on 20 of its 43 references that are in the map.
- First posted on arXiv 3 Feb 2023.

## Builds on (most cited first, 20 of 20)

- [Denoising Diffusion Probabilistic Models](https://mlsanity.com/paper/2006.11239/) (2020)
- [Denoising Diffusion Implicit Models](https://mlsanity.com/paper/2010.02502/) (2020)
- [Deep Unsupervised Learning using Nonequilibrium Thermodynamics](https://mlsanity.com/paper/1503.03585/) (2015)
- [A Style-Based Generator Architecture for Generative Adversarial Networks](https://mlsanity.com/paper/1812.04948/) (2018)
- [Rethinking the Inception Architecture for Computer Vision](https://mlsanity.com/paper/1512.00567/) (2015)
- [Deep Learning Face Attributes in the Wild](https://mlsanity.com/paper/1411.7766/) (2014)
- [Training Generative Adversarial Networks with Limited Data](https://mlsanity.com/paper/2006.06676/) (2020)
- [VGGFace2: A dataset for recognising faces across pose and age](https://mlsanity.com/paper/1710.08092/) (2017)
- [Diffusion Autoencoders: Toward a Meaningful and Decodable Representation](https://mlsanity.com/paper/2111.15640/) (2021)
- [CurricularFace: Adaptive Curriculum Learning Loss for Deep Face Recognition](https://mlsanity.com/paper/2004.00288/) (2020)
- [ElasticFace: Elastic Margin Loss for Deep Face Recognition](https://mlsanity.com/paper/2109.09416/) (2021)
- [Privacy-friendly Synthetic Data for the Development of Face Morphing Attack Detectors](https://mlsanity.com/paper/2203.06691/) (2022)
- [Can GAN Generated Morphs Threaten Face Recognition Systems Equally as Landmark Based Morphs? -- Vulnerability and Detection](https://mlsanity.com/paper/2007.03621/) (2020)
- [MixFaceNets: Extremely Efficient Face Recognition Networks](https://mlsanity.com/paper/2107.13046/) (2021)
- [PocketNet: Extreme Lightweight Face Recognition Network using Neural Architecture Search and Multi-Step Knowledge Distillation](https://mlsanity.com/paper/2108.10710/) (2021)
- [SYN-MAD 2022: Competition on Face Morphing Attack Detection Based on Privacy-aware Synthetic Training Data](https://mlsanity.com/paper/2208.07337/) (2022)
- [PW-MAD: Pixel-wise Supervision for Generalized Face Morphing Attack Detection](https://mlsanity.com/paper/2108.10291/) (2021)
- [ReGenMorph: Visibly Realistic GAN Generated Face Morphing Attacks by Attack Re-generation](https://mlsanity.com/paper/2108.09130/) (2021)
- [Analyzing Human Observer Ability in Morphing Attack Detection -- Where Do We Stand?](https://mlsanity.com/paper/2202.12426/) (2022)
- [Face Morphing Attacks and Face Image Quality: The Effect of Morphing and the Unsupervised Attack Detection by Quality](https://mlsanity.com/paper/2208.05864/) (2022)

## Built on by (most cited first, 30 of 44)

- [Synthetic Data for Face Recognition: Current State and Future Prospects](https://mlsanity.com/paper/2305.01021/) (2023)
- [MADation: Face Morphing Attack Detection with Foundation Models](https://mlsanity.com/paper/2501.03800/) (2025)
- [Benchmarking Foundation Models for Zero-Shot Biometric Tasks](https://mlsanity.com/paper/2505.24214/) (2025)
- [Unveiling the Two-Faced Truth: Disentangling Morphed Identities for Face Morphing Detection](https://mlsanity.com/paper/2306.03002/) (2023)
- [Neural Implicit Morphing of Face Images](https://mlsanity.com/paper/2308.13888/) (2023)
- [LADIMO: Face Morph Generation through Biometric Template Inversion with Latent Diffusion](https://mlsanity.com/paper/2410.07988/) (2024)
- [Facial Demorphing via Identity Preserving Image Decomposition](https://mlsanity.com/paper/2408.10993/) (2024)
- [SelfMAD: Enhancing Generalization and Robustness in Morphing Attack Detection via Self-Supervised Learning](https://mlsanity.com/paper/2504.05504/) (2025)
- [On the Vulnerability of DeepFake Detectors to Attacks Generated by Denoising Diffusion Models](https://mlsanity.com/paper/2307.05397/) (2023)
- [SDeMorph: Towards Better Facial De-morphing from Single Morph](https://mlsanity.com/paper/2308.11442/) (2023)
- [MorCode: Face Morphing Attack Generation using Generative Codebooks](https://mlsanity.com/paper/2410.07625/) (2024)
- [dc-GAN: Dual-Conditioned GAN for Face Demorphing From a Single Morph](https://mlsanity.com/paper/2411.14494/) (2024)
- [SynFacePAD 2023: Competition on Face Presentation Attack Detection Based on Privacy-aware Synthetic Training Data](https://mlsanity.com/paper/2311.05336/) (2023)
- [Empowering Morphing Attack Detection using Interpretable Image-Text Foundation Model](https://mlsanity.com/paper/2508.10110/) (2025)
- [Beyond Spatial Explanations: Explainable Face Recognition in the Frequency Domain](https://mlsanity.com/paper/2407.11941/) (2024)
- [Worst-Case Morphs using Wasserstein ALI and Improved MIPGAN](https://mlsanity.com/paper/2310.08371/) (2023)
- [Modeling Spoof Noise by De-spoofing Diffusion and its Application in Face Anti-spoofing](https://mlsanity.com/paper/2401.08275/) (2024)
- [TetraLoss: Improving the Robustness of Face Recognition against Morphing Attacks](https://mlsanity.com/paper/2401.11598/) (2024)
- [Evaluating the Effectiveness of Attack-Agnostic Features for Morphing Attack Detection](https://mlsanity.com/paper/2410.16802/) (2024)
- [Metric for Evaluating Performance of Reference-Free Demorphing Methods](https://mlsanity.com/paper/2501.12319/) (2025)
- [StableMorph: High-Quality Face Morph Generation with Stable Diffusion](https://mlsanity.com/paper/2511.08090/) (2025)
- [FD-MAD: Frequency-Domain Residual Analysis for Face Morphing Attack Detection](https://mlsanity.com/paper/2601.20656/) (2026)
- [Fused Classification For Differential Face Morphing Detection](https://mlsanity.com/paper/2309.00665/) (2023)
- [Quadruplet Loss For Improving the Robustness to Face Morphing Attacks](https://mlsanity.com/paper/2402.14665/) (2024)
- [diffDemorph: Extending Reference-Free Demorphing to Unseen Faces](https://mlsanity.com/paper/2505.14527/) (2025)
- [Facial Demorphing from a Single Morph Using a Latent Conditional GAN](https://mlsanity.com/paper/2507.18566/) (2025)
- [LoRA-Enhanced Vision Transformer for Single Image based Morphing Attack Detection via Knowledge Distillation from EfficientNet](https://mlsanity.com/paper/2511.12602/) (2025)
- [Emergent Morphing Attack Detection in Open Multi-modal Large Language Models](https://mlsanity.com/paper/2602.15461/) (2026)
- [DCMorph: Face Morphing via Dual-Stream Cross-Attention Diffusion](https://mlsanity.com/paper/2604.21627/) (2026)
- [Impact of Image Context for Single Deep Learning Face Morphing Attack Detection](https://mlsanity.com/paper/2309.00549/) (2023)

## Abstract (arXiv)

Investigating new methods of creating face morphing attacks is essential to foresee novel attacks and help mitigate them. Creating morphing attacks is commonly either performed on the image-level or on the representation-level. The representation-level morphing has been performed so far based on generative adversarial networks (GAN) where the encoded images are interpolated in the latent space to produce a morphed image based on the interpolated vector. Such a process was constrained by the limited reconstruction fidelity of GAN architectures. Recent advances in the diffusion autoencoder models have overcome the GAN limitations, leading to high reconstruction fidelity. This theoretically makes them a perfect candidate to perform representation-level face morphing. This work investigates using diffusion autoencoders to create face morphing attacks by comparing them to a wide range of image-level and representation-level morphs. Our vulnerability analyses on four state-of-the-art face recognition models have shown that such models are highly vulnerable to the created attacks, the MorDIFF, especially when compared to existing representation-level morphs. Detailed detectability analyses are also performed on the MorDIFF, showing that they are as challenging to detect as other morphing attacks created on the image- or representation-level. Data and morphing script are made public: https://github.com/naserdamer/MorDIFF.