# Evaluating the Effectiveness of Attack-Agnostic Features for Morphing Attack Detection

arXiv: https://arxiv.org/abs/2410.16802 · HTML: https://mlsanity.com/paper/2410.16802/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models.
- Builds on 17 of its 26 references that are in the map.
- First posted on arXiv 22 Oct 2024.

## Placed in

- Diffusion models / [Robustness, privacy and adversarial aspects](https://mlsanity.com/diffusion/robustness-privacy-and-adversarial-aspects/)

## Builds on (most cited first, 17 of 17)

- [Learning Transferable Visual Models From Natural Language Supervision](https://mlsanity.com/paper/2103.00020/) (2021)
- [PyTorch: An Imperative Style, High-Performance Deep Learning Library](https://mlsanity.com/paper/1912.01703/) (2019)
- [DINOv2: Learning Robust Visual Features without Supervision](https://mlsanity.com/paper/2304.07193/) (2023)
- [A Style-Based Generator Architecture for Generative Adversarial Networks](https://mlsanity.com/paper/1812.04948/) (2018)
- [Towards Universal Fake Image Detectors that Generalize Across Generative Models](https://mlsanity.com/paper/2302.10174/) (2023)
- [Raising the Bar of AI-generated Image Detection with CLIP](https://mlsanity.com/paper/2312.00195/) (2023)
- [Scalable Pre-training of Large Autoregressive Image Models](https://mlsanity.com/paper/2401.08541/) (2024)
- [Deepfake Network Architecture Attribution](https://mlsanity.com/paper/2202.13843/) (2022)
- [Privacy-friendly Synthetic Data for the Development of Face Morphing Attack Detectors](https://mlsanity.com/paper/2203.06691/) (2022)
- [Can GAN Generated Morphs Threaten Face Recognition Systems Equally as Landmark Based Morphs? -- Vulnerability and Detection](https://mlsanity.com/paper/2007.03621/) (2020)
- [MorDIFF: Recognition Vulnerability and Attack Detectability of Face Morphing Attacks Created by Diffusion Autoencoders](https://mlsanity.com/paper/2302.01843/) (2023)
- [Morphing Attack Detection -- Database, Evaluation Platform and Benchmarking](https://mlsanity.com/paper/2006.06458/) (2020)
- [Are GAN-based Morphs Threatening Face Recognition?](https://mlsanity.com/paper/2205.02496/) (2022)
- [Unsupervised Face Morphing Attack Detection via Self-paced Anomaly Detection](https://mlsanity.com/paper/2208.05787/) (2022)
- [Face Morphing Attack Detection with Denoising Diffusion Probabilistic Models](https://mlsanity.com/paper/2306.15733/) (2023)
- [On the detection of morphing attacks generated by GANs](https://mlsanity.com/paper/2209.00404/) (2022)
- [Face Feature Visualisation of Single Morphing Attack Detection](https://mlsanity.com/paper/2304.13021/) (2023)

## Built on by (most cited first, 2 of 2)

- [SRL-MAD: Structured Residual Latents for One-Class Morphing Attack Detection](https://mlsanity.com/paper/2603.15050/) (2026)
- [Foundation and Multimodal Large Language Models for Face Presentation and Morph Attack Detection](https://mlsanity.com/paper/2608.29802/) (2026)

## Abstract (arXiv)

Morphing attacks have diversified significantly over the past years, with new methods based on generative adversarial networks (GANs) and diffusion models posing substantial threats to face recognition systems. Recent research has demonstrated the effectiveness of features extracted from large vision models pretrained on bonafide data only (attack-agnostic features) for detecting deep generative images. Building on this, we investigate the potential of these image representations for morphing attack detection (MAD). We develop supervised detectors by training a simple binary linear SVM on the extracted features and one-class detectors by modeling the distribution of bonafide features with a Gaussian Mixture Model (GMM). Our method is evaluated across a comprehensive set of attacks and various scenarios, including generalization to unseen attacks, different source datasets, and print-scan data. Our results indicate that attack-agnostic features can effectively detect morphing attacks, outperforming traditional supervised and one-class detectors from the literature in most scenarios. Additionally, we provide insights into the strengths and limitations of each considered representation and discuss potential future research directions to further enhance the robustness and generalizability of our approach.