# Emergent Morphing Attack Detection in Open Multi-modal Large Language Models

arXiv: https://arxiv.org/abs/2602.15461 · HTML: https://mlsanity.com/paper/2602.15461/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Placed in MLLM jailbreaks and adversarial robustness, one of 16 directions in Multimodal LLMs / vision-language models.
- Builds on 24 of its 33 references that are in the map.
- First posted on arXiv 17 Feb 2026.

## Placed in

- Multimodal LLMs / vision-language models / [MLLM jailbreaks and adversarial robustness](https://mlsanity.com/mllm/mllm-jailbreaks-and-adversarial-robustness/)

## Builds on (most cited first, 24 of 24)

- [Learning Transferable Visual Models From Natural Language Supervision](https://mlsanity.com/paper/2103.00020/) (2021)
- [Visual Instruction Tuning](https://mlsanity.com/paper/2304.08485/) (2023)
- [Flamingo: a Visual Language Model for Few-Shot Learning](https://mlsanity.com/paper/2204.14198/) (2022)
- [InternVL: Scaling up Vision Foundation Models and Aligning for Generic Visual-Linguistic Tasks](https://mlsanity.com/paper/2312.14238/) (2023)
- [Qwen-VL: A Versatile Vision-Language Model for Understanding, Localization, Text Reading, and Beyond](https://mlsanity.com/paper/2308.12966/) (2023)
- [DeepSeek-VL2: Mixture-of-Experts Vision-Language Models for Advanced Multimodal Understanding](https://mlsanity.com/paper/2412.10302/) (2024)
- [Can ChatGPT Detect DeepFakes? A Study of Using Multimodal Large Language Models for Media Forensics](https://mlsanity.com/paper/2403.14077/) (2024)
- [MorDIFF: Recognition Vulnerability and Attack Detectability of Face Morphing Attacks Created by Diffusion Autoencoders](https://mlsanity.com/paper/2302.01843/) (2023)
- [SHIELD : An Evaluation Benchmark for Face Spoofing and Forgery Detection with Multimodal Large Language Models](https://mlsanity.com/paper/2402.04178/) (2024)
- [MixFaceNets: Extremely Efficient Face Recognition Networks](https://mlsanity.com/paper/2107.13046/) (2021)
- [SYN-MAD 2022: Competition on Face Morphing Attack Detection Based on Privacy-aware Synthetic Training Data](https://mlsanity.com/paper/2208.07337/) (2022)
- [PW-MAD: Pixel-wise Supervision for Generalized Face Morphing Attack Detection](https://mlsanity.com/paper/2108.10291/) (2021)
- [FaceXBench: Evaluating Multimodal LLMs on Face Understanding](https://mlsanity.com/paper/2501.10360/) (2025)
- [Unsupervised Face Morphing Attack Detection via Self-paced Anomaly Detection](https://mlsanity.com/paper/2208.05787/) (2022)
- [Attention Aware Wavelet-based Detection of Morphed Face Images](https://mlsanity.com/paper/2106.15686/) (2021)
- [MADation: Face Morphing Attack Detection with Foundation Models](https://mlsanity.com/paper/2501.03800/) (2025)
- [Generalized Single-Image-Based Morphing Attack Detection Using Deep Representations from Vision Transformer](https://mlsanity.com/paper/2501.09817/) (2025)
- [Can Multi-modal (reasoning) LLMs work as deepfake detectors?](https://mlsanity.com/paper/2503.20084/) (2025)
- [Benchmarking Foundation Models for Zero-Shot Biometric Tasks](https://mlsanity.com/paper/2505.24214/) (2025)
- [Face Morphing Attack Detection with Denoising Diffusion Probabilistic Models](https://mlsanity.com/paper/2306.15733/) (2023)
- [Greedy-DiM: Greedy Algorithms for Unreasonably Effective Face Morphs](https://mlsanity.com/paper/2404.06025/) (2024)
- [Face Morphing Attacks and Face Image Quality: The Effect of Morphing and the Unsupervised Attack Detection by Quality](https://mlsanity.com/paper/2208.05864/) (2022)
- [SelfMAD: Enhancing Generalization and Robustness in Morphing Attack Detection via Self-Supervised Learning](https://mlsanity.com/paper/2504.05504/) (2025)
- [Empowering Morphing Attack Detection using Interpretable Image-Text Foundation Model](https://mlsanity.com/paper/2508.10110/) (2025)

## Built on by (most cited first, 1 of 1)

- [Foundation and Multimodal Large Language Models for Face Presentation and Morph Attack Detection](https://mlsanity.com/paper/2608.29802/) (2026)

## Abstract (arXiv)

Face morphing attacks threaten biometric verification, yet most morphing attack detection (MAD) systems require task-specific training and generalize poorly to unseen attack types. Meanwhile, open-source multimodal large language models (MLLMs) have demonstrated strong visual-linguistic reasoning, but their potential in biometric forensics remains underexplored. In this paper, we present the first systematic zero-shot evaluation of open-source MLLMs for single-image MAD, using publicly available weights and a standardized, reproducible protocol. Across diverse morphing techniques, many MLLMs show non-trivial discriminative ability without any fine-tuning or domain adaptation, and LLaVA1.6-Mistral-7B achieves state-of-the-art performance, surpassing highly competitive task-specific MAD baselines by at least 23% in terms of equal error rate (EER). The results indicate that multimodal pretraining can implicitly encode fine-grained facial inconsistencies indicative of morphing artifacts, enabling zero-shot forensic sensitivity. Our findings position open-source MLLMs as reproducible, interpretable, and competitive foundations for biometric security and forensic image analysis. This emergent capability also highlights new opportunities to develop state-of-the-art MAD systems through targeted fine-tuning or lightweight adaptation, further improving accuracy and efficiency while preserving interpretability. To support future research, all code and evaluation protocols will be released upon publication.