# Face Morphing Attack Detection with Denoising Diffusion Probabilistic Models

arXiv: https://arxiv.org/abs/2306.15733 · HTML: https://mlsanity.com/paper/2306.15733/

## Key facts

- Cited by 12 papers in the map (data through 14 Oct 2026).
- Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models.
- Builds on 25 of its 45 references that are in the map.
- First posted on arXiv 27 Jun 2023.

## Placed in

- Diffusion models / [Robustness, privacy and adversarial aspects](https://mlsanity.com/diffusion/robustness-privacy-and-adversarial-aspects/)

## Builds on (most cited first, 25 of 25)

- [Denoising Diffusion Probabilistic Models](https://mlsanity.com/paper/2006.11239/) (2020)
- [High-Resolution Image Synthesis with Latent Diffusion Models](https://mlsanity.com/paper/2112.10752/) (2021)
- [Denoising Diffusion Implicit Models](https://mlsanity.com/paper/2010.02502/) (2020)
- [Diffusion Models Beat GANs on Image Synthesis](https://mlsanity.com/paper/2105.05233/) (2021)
- [Improved Denoising Diffusion Probabilistic Models](https://mlsanity.com/paper/2102.09672/) (2021)
- [Wide Residual Networks](https://mlsanity.com/paper/1605.07146/) (2016)
- [Elucidating the Design Space of Diffusion-Based Generative Models](https://mlsanity.com/paper/2206.00364/) (2022)
- [DPM-Solver: A Fast ODE Solver for Diffusion Probabilistic Model Sampling in Around 10 Steps](https://mlsanity.com/paper/2206.00927/) (2022)
- [Palette: Image-to-Image Diffusion Models](https://mlsanity.com/paper/2111.05826/) (2021)
- [Diffusion Models in Vision: A Survey](https://mlsanity.com/paper/2209.04747/) (2022)
- [Learning Face Representation from Scratch](https://mlsanity.com/paper/1411.7923/) (2014)
- [PixelCNN++: Improving the PixelCNN with Discretized Logistic Mixture Likelihood and Other Modifications](https://mlsanity.com/paper/1701.05517/) (2017)
- [GANomaly: Semi-Supervised Anomaly Detection via Adversarial Training](https://mlsanity.com/paper/1805.06725/) (2018)
- [Diffusion Models for Medical Anomaly Detection](https://mlsanity.com/paper/2203.04306/) (2022)
- [Fast Unsupervised Brain Anomaly Detection and Segmentation with Diffusion Models](https://mlsanity.com/paper/2206.03461/) (2022)
- [Privacy-friendly Synthetic Data for the Development of Face Morphing Attack Detectors](https://mlsanity.com/paper/2203.06691/) (2022)
- [Vulnerability Analysis of Face Morphing Attacks from Landmarks and Generative Adversarial Networks](https://mlsanity.com/paper/2012.05344/) (2020)
- [MixFaceNets: Extremely Efficient Face Recognition Networks](https://mlsanity.com/paper/2107.13046/) (2021)
- [SYN-MAD 2022: Competition on Face Morphing Attack Detection Based on Privacy-aware Synthetic Training Data](https://mlsanity.com/paper/2208.07337/) (2022)
- [PW-MAD: Pixel-wise Supervision for Generalized Face Morphing Attack Detection](https://mlsanity.com/paper/2108.10291/) (2021)
- [Strengths and Weaknesses of Deep Learning Models for Face Recognition Against Image Degradations](https://mlsanity.com/paper/1710.01494/) (2017)
- [T2V-DDPM: Thermal to Visible Face Translation using Denoising Diffusion Probabilistic Models](https://mlsanity.com/paper/2209.08814/) (2022)
- [Unsupervised Face Morphing Attack Detection via Self-paced Anomaly Detection](https://mlsanity.com/paper/2208.05787/) (2022)
- [Reflection Analysis for Face Morphing Attack Detection](https://mlsanity.com/paper/1807.02030/) (2018)
- [Differential Anomaly Detection for Facial Images](https://mlsanity.com/paper/2110.03464/) (2021)

## Built on by (most cited first, 12 of 12)

- [MADation: Face Morphing Attack Detection with Foundation Models](https://mlsanity.com/paper/2501.03800/) (2025)
- [SelfMAD: Enhancing Generalization and Robustness in Morphing Attack Detection via Self-Supervised Learning](https://mlsanity.com/paper/2504.05504/) (2025)
- [On the Vulnerability of DeepFake Detectors to Attacks Generated by Denoising Diffusion Models](https://mlsanity.com/paper/2307.05397/) (2023)
- [Evaluating the Effectiveness of Attack-Agnostic Features for Morphing Attack Detection](https://mlsanity.com/paper/2410.16802/) (2024)
- [Metric for Evaluating Performance of Reference-Free Demorphing Methods](https://mlsanity.com/paper/2501.12319/) (2025)
- [LoRA-Enhanced Vision Transformer for Single Image based Morphing Attack Detection via Knowledge Distillation from EfficientNet](https://mlsanity.com/paper/2511.12602/) (2025)
- [Emergent Morphing Attack Detection in Open Multi-modal Large Language Models](https://mlsanity.com/paper/2602.15461/) (2026)
- [WaFusion: A Wavelet-Enhanced Diffusion Framework for Face Morph Generation](https://mlsanity.com/paper/2507.12493/) (2025)
- [SRL-MAD: Structured Residual Latents for One-Class Morphing Attack Detection](https://mlsanity.com/paper/2603.15050/) (2026)
- [R-FLoRA: Residual-Statistic-Gated Low-Rank Adaptation for Single-Image Face Morphing Attack Detection](https://mlsanity.com/paper/2604.17321/) (2026)
- [Enhancing Single-Image Facial Demorphing using Multimodal Large Language Models](https://mlsanity.com/paper/2605.25442/) (2026)
- [Position: AI/ML Deepfake Research is Misaligned with AI-Generated Non-Consensual Intimate Imagery (AIG-NCII)](https://mlsanity.com/paper/2607.18263/) (2026)

## Abstract (arXiv)

Morphed face images have recently become a growing concern for existing face verification systems, as they are relatively easy to generate and can be used to impersonate someone's identity for various malicious purposes. Efficient Morphing Attack Detection (MAD) that generalizes well across different morphing techniques is, therefore, of paramount importance. Existing MAD techniques predominantly rely on discriminative models that learn from examples of bona fide and morphed images and, as a result, often exhibit sub-optimal generalization performance when confronted with unknown types of morphing attacks. To address this problem, we propose a novel, diffusion-based MAD method in this paper that learns only from the characteristics of bona fide images. Various forms of morphing attacks are then detected by our model as out-of-distribution samples. We perform rigorous experiments over four different datasets (CASIA-WebFace, FRLL-Morphs, FERET-Morphs and FRGC-Morphs) and compare the proposed solution to both discriminatively-trained and once-class MAD models. The experimental results show that our MAD model achieves highly competitive results on all considered datasets.