# MADation: Face Morphing Attack Detection with Foundation Models

arXiv: https://arxiv.org/abs/2501.03800 · HTML: https://mlsanity.com/paper/2501.03800/

## Key facts

- Cited by 14 papers in the map (data through 14 Oct 2026).
- Builds on 32 of its 55 references that are in the map.
- First posted on arXiv 7 Jan 2025.

## Builds on (most cited first, 30 of 32)

- [Learning Transferable Visual Models From Natural Language Supervision](https://mlsanity.com/paper/2103.00020/) (2021)
- [Language Models are Few-Shot Learners](https://mlsanity.com/paper/2005.14165/) (2020)
- [An Image is Worth 16x16 Words: Transformers for Image Recognition at Scale](https://mlsanity.com/paper/2010.11929/) (2020)
- [LoRA: Low-Rank Adaptation of Large Language Models](https://mlsanity.com/paper/2106.09685/) (2021)
- [Segment Anything](https://mlsanity.com/paper/2304.02643/) (2023)
- [DINOv2: Learning Robust Visual Features without Supervision](https://mlsanity.com/paper/2304.07193/) (2023)
- [On the Opportunities and Risks of Foundation Models](https://mlsanity.com/paper/2108.07258/) (2021)
- [SAM 2: Segment Anything in Images and Videos](https://mlsanity.com/paper/2408.00714/) (2024)
- [Training Generative Adversarial Networks with Limited Data](https://mlsanity.com/paper/2006.06676/) (2020)
- [AdaptFormer: Adapting Vision Transformers for Scalable Visual Recognition](https://mlsanity.com/paper/2205.13535/) (2022)
- [Intrinsic Dimensionality Explains the Effectiveness of Language Model Fine-Tuning](https://mlsanity.com/paper/2012.13255/) (2020)
- [Vision Transformer Adapter for Dense Predictions](https://mlsanity.com/paper/2205.08534/) (2022)
- [Diffusion Autoencoders: Toward a Meaningful and Decodable Representation](https://mlsanity.com/paper/2111.15640/) (2021)
- [A Rank Stabilization Scaling Factor for Fine-Tuning with LoRA](https://mlsanity.com/paper/2312.03732/) (2023)
- [Fixing the train-test resolution discrepancy](https://mlsanity.com/paper/1906.06423/) (2019)
- [ElasticFace: Elastic Margin Loss for Deep Face Recognition](https://mlsanity.com/paper/2109.09416/) (2021)
- [Arc2Face: A Foundation Model for ID-Consistent Human Faces](https://mlsanity.com/paper/2403.11641/) (2024)
- [Privacy-friendly Synthetic Data for the Development of Face Morphing Attack Detectors](https://mlsanity.com/paper/2203.06691/) (2022)
- [Can GAN Generated Morphs Threaten Face Recognition Systems Equally as Landmark Based Morphs? -- Vulnerability and Detection](https://mlsanity.com/paper/2007.03621/) (2020)
- [MorDIFF: Recognition Vulnerability and Attack Detectability of Face Morphing Attacks Created by Diffusion Autoencoders](https://mlsanity.com/paper/2302.01843/) (2023)
- [Adaptive Transformers for Robust Few-shot Cross-domain Face Anti-spoofing](https://mlsanity.com/paper/2203.12175/) (2022)
- [Vulnerability Analysis of Face Morphing Attacks from Landmarks and Generative Adversarial Networks](https://mlsanity.com/paper/2012.05344/) (2020)
- [SYN-MAD 2022: Competition on Face Morphing Attack Detection Based on Privacy-aware Synthetic Training Data](https://mlsanity.com/paper/2208.07337/) (2022)
- [SAM Meets Robotic Surgery: An Empirical Study on Generalization, Robustness and Adaptation](https://mlsanity.com/paper/2308.07156/) (2023)
- [PW-MAD: Pixel-wise Supervision for Generalized Face Morphing Attack Detection](https://mlsanity.com/paper/2108.10291/) (2021)
- [FRoundation: Are Foundation Models Ready for Face Recognition?](https://mlsanity.com/paper/2410.23831/) (2024)
- [Unsupervised Face Morphing Attack Detection via Self-paced Anomaly Detection](https://mlsanity.com/paper/2208.05787/) (2022)
- [Face Morphing Attack Detection with Denoising Diffusion Probabilistic Models](https://mlsanity.com/paper/2306.15733/) (2023)
- [Unveiling the Two-Faced Truth: Disentangling Morphed Identities for Face Morphing Detection](https://mlsanity.com/paper/2306.03002/) (2023)
- [Iris-SAM: Iris Segmentation Using a Foundation Model](https://mlsanity.com/paper/2402.06497/) (2024)

## Built on by (most cited first, 14 of 14)

- [Towards Zero-Shot Differential Morphing Attack Detection with Multimodal Large Language Models](https://mlsanity.com/paper/2505.15332/) (2025)
- [MADPromptS: Unlocking Zero-Shot Morphing Attack Detection with Multiple Prompt Aggregation](https://mlsanity.com/paper/2508.08939/) (2025)
- [FD-MAD: Frequency-Domain Residual Analysis for Face Morphing Attack Detection](https://mlsanity.com/paper/2601.20656/) (2026)
- [LoRA-Enhanced Vision Transformer for Single Image based Morphing Attack Detection via Knowledge Distillation from EfficientNet](https://mlsanity.com/paper/2511.12602/) (2025)
- [Emergent Morphing Attack Detection in Open Multi-modal Large Language Models](https://mlsanity.com/paper/2602.15461/) (2026)
- [MorphGuard: Morph Specific Margin Loss for Enhancing Robustness to Face Morphing Attacks](https://mlsanity.com/paper/2505.10497/) (2025)
- [In-context Learning of Vision Language Models for Detection of Physical and Digital Attacks against Face Recognition Systems](https://mlsanity.com/paper/2507.15285/) (2025)
- [Trade-offs in Cross-Domain Generalization of Foundation Model Fine-Tuned for Biometric Applications](https://mlsanity.com/paper/2509.14921/) (2025)
- [SRL-MAD: Structured Residual Latents for One-Class Morphing Attack Detection](https://mlsanity.com/paper/2603.15050/) (2026)
- [R-FLoRA: Residual-Statistic-Gated Low-Rank Adaptation for Single-Image Face Morphing Attack Detection](https://mlsanity.com/paper/2604.17321/) (2026)
- [DifFoundMAD: Foundation Models meet Differential Morphing Attack Detection](https://mlsanity.com/paper/2604.17961/) (2026)
- [Enhancing Single-Image Facial Demorphing using Multimodal Large Language Models](https://mlsanity.com/paper/2605.25442/) (2026)
- [XSA-MAD: Cross-modal Semantic Alignment for Morphing Attack Detection](https://mlsanity.com/paper/2608.13861/) (2026)
- [Foundation and Multimodal Large Language Models for Face Presentation and Morph Attack Detection](https://mlsanity.com/paper/2608.29802/) (2026)

## Abstract (arXiv)

Despite the considerable performance improvements of face recognition algorithms in recent years, the same scientific advances responsible for this progress can also be used to create efficient ways to attack them, posing a threat to their secure deployment. Morphing attack detection (MAD) systems aim to detect a specific type of threat, morphing attacks, at an early stage, preventing them from being considered for verification in critical processes. Foundation models (FM) learn from extensive amounts of unlabelled data, achieving remarkable zero-shot generalization to unseen domains. Although this generalization capacity might be weak when dealing with domain-specific downstream tasks such as MAD, FMs can easily adapt to these settings while retaining the built-in knowledge acquired during pre-training. In this work, we recognize the potential of FMs to perform well in the MAD task when properly adapted to its specificities. To this end, we adapt FM CLIP architectures with LoRA weights while simultaneously training a classification header. The proposed framework, MADation surpasses our alternative FM and transformer-based frameworks and constitutes the first adaption of FMs to the MAD task. MADation presents competitive results with current MAD solutions in the literature and even surpasses them in several evaluation scenarios. To encourage reproducibility and facilitate further research in MAD, we publicly release the implementation of MADation at https://github.com/gurayozgur/MADation