# Worst-Case Morphs using Wasserstein ALI and Improved MIPGAN

arXiv: https://arxiv.org/abs/2310.08371 · HTML: https://mlsanity.com/paper/2310.08371/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 30 of its 53 references that are in the map.
- First posted on arXiv 12 Oct 2023.

## Builds on (most cited first, 30 of 30)

- [Adam: A Method for Stochastic Optimization](https://mlsanity.com/paper/1412.6980/) (2014)
- [PyTorch: An Imperative Style, High-Performance Deep Learning Library](https://mlsanity.com/paper/1912.01703/) (2019)
- [A Style-Based Generator Architecture for Generative Adversarial Networks](https://mlsanity.com/paper/1812.04948/) (2018)
- [FaceNet: A Unified Embedding for Face Recognition and Clustering](https://mlsanity.com/paper/1503.03832/) (2015)
- [Improved Training of Wasserstein GANs](https://mlsanity.com/paper/1704.00028/) (2017)
- [Wasserstein GAN](https://mlsanity.com/paper/1701.07875/) (2017)
- [Designing an Encoder for StyleGAN Image Manipulation](https://mlsanity.com/paper/2102.02766/) (2021)
- [GAN Inversion: A Survey](https://mlsanity.com/paper/2101.05278/) (2021)
- [Adversarial Feature Learning](https://mlsanity.com/paper/1605.09782/) (2016)
- [CurricularFace: Adaptive Curriculum Learning Loss for Deep Face Recognition](https://mlsanity.com/paper/2004.00288/) (2020)
- [Adversarially Learned Inference](https://mlsanity.com/paper/1606.00704/) (2016)
- [Focal Frequency Loss for Image Reconstruction and Synthesis](https://mlsanity.com/paper/2012.12821/) (2020)
- [VEEGAN: Reducing Mode Collapse in GANs using Implicit Variational Learning](https://mlsanity.com/paper/1705.07761/) (2017)
- [MobileFaceNets: Efficient CNNs for Accurate Real-Time Face Verification on Mobile Devices](https://mlsanity.com/paper/1804.07573/) (2018)
- [ElasticFace: Elastic Margin Loss for Deep Face Recognition](https://mlsanity.com/paper/2109.09416/) (2021)
- [Deep Face Representations for Differential Morphing Attack Detection](https://mlsanity.com/paper/2001.01202/) (2020)
- [MorDIFF: Recognition Vulnerability and Attack Detectability of Face Morphing Attacks Created by Diffusion Autoencoders](https://mlsanity.com/paper/2302.01843/) (2023)
- [Morphing Attack Detection -- Database, Evaluation Platform and Benchmarking](https://mlsanity.com/paper/2006.06458/) (2020)
- [Vulnerability Analysis of Face Morphing Attacks from Landmarks and Generative Adversarial Networks](https://mlsanity.com/paper/2012.05344/) (2020)
- [PocketNet: Extreme Lightweight Face Recognition Network using Neural Architecture Search and Multi-Step Knowledge Distillation](https://mlsanity.com/paper/2108.10710/) (2021)
- [ALICE: Towards Understanding Adversarial Learning for Joint Distribution Matching](https://mlsanity.com/paper/1709.01215/) (2017)
- [Are GAN-based Morphs Threatening Face Recognition?](https://mlsanity.com/paper/2205.02496/) (2022)
- [Face morphing detection in the presence of printing/scanning and heterogeneous image sources](https://mlsanity.com/paper/1901.08811/) (2019)
- [ReGenMorph: Visibly Realistic GAN Generated Face Morphing Attacks by Attack Re-generation](https://mlsanity.com/paper/2108.09130/) (2021)
- [Morphing Attack Potential](https://mlsanity.com/paper/2204.13374/) (2022)
- [Leveraging Diffusion For Strong and High Quality Face Morphing Attacks](https://mlsanity.com/paper/2301.04218/) (2023)
- [On the Influence of Ageing on Face Morph Attacks: Vulnerability and Detection](https://mlsanity.com/paper/2007.02684/) (2020)
- [On the detection of morphing attacks generated by GANs](https://mlsanity.com/paper/2209.00404/) (2022)
- [Style Your Face Morph and Improve Your Face Morphing Attack Detector](https://mlsanity.com/paper/2004.11435/) (2020)
- [Worst-Case Morphs: a Theoretical and a Practical Approach](https://mlsanity.com/paper/2111.15416/) (2021)

## Built on by (most cited first, 2 of 2)

- [Greedy-DiM: Greedy Algorithms for Unreasonably Effective Face Morphs](https://mlsanity.com/paper/2404.06025/) (2024)
- [Find the Differences: Differential Morphing Attack Detection vs Face Recognition](https://mlsanity.com/paper/2604.14734/) (2026)

## Abstract (arXiv)

A morph is a combination of two separate facial images and contains identity information of two different people. When used in an identity document, both people can be authenticated by a biometric Face Recognition (FR) system. Morphs can be generated using either a landmark-based approach or approaches based on deep learning such as Generative Adversarial Networks (GAN). In a recent paper, we introduced a worst-case upper bound on how challenging morphing attacks can be for an FR system. The closer morphs are to this upper bound, the bigger the challenge they pose to FR. We introduced an approach with which it was possible to generate morphs that approximate this upper bound for a known FR system (white box), but not for unknown (black box) FR systems. In this paper, we introduce a morph generation method that can approximate worst-case morphs even when the FR system is not known. A key contribution is that we include the goal of generating difficult morphs during training. Our method is based on Adversarially Learned Inference (ALI) and uses concepts from Wasserstein GANs trained with Gradient Penalty, which were introduced to stabilise the training of GANs. We include these concepts to achieve similar improvement in training stability and call the resulting method Wasserstein ALI (WALI). We finetune WALI using loss functions designed specifically to improve the ability to manipulate identity information in facial images and show how it can generate morphs that are more challenging for FR systems than landmark- or GAN-based morphs. We also show how our findings can be used to improve MIPGAN, an existing StyleGAN-based morph generator.