{"id":"2afe9e19-7119-4b4c-b964-f306df65f18e","arxiv_id":"2501.09817","paper_version":1,"verdict":"REJECT","confidence":"HIGH","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":1,"one_line_summary":"A frozen ImageNet-pretrained Vision Transformer plus a linear classifier improves cross-algorithm morphing detection on digital face images, but not on print-scan images.","lead":"This paper tests whether a Vision Transformer can spot digitally morphed passport photos that it was not trained on. It reports modest gains on digital images but worse performance on printed and scanned ones.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The reported digital generalization advantage rests on a 1.15pp mean D-EER gap that includes duplicated Table 3 entries and no significance testing; the claim is not currently supported.","rationale":"We read the paper in good faith: a frozen ImageNet-pretrained ViT-L with linear SVM is a reasonable, principled S-MAD baseline, and the leave-one-morphing-algorithm-out protocol is a useful stress test. The t-SNE visualizations and the detailed per-condition tables are helpful. However, the central contribution—'notable improvement in generalizability of digital use cases'—cannot be accepted from the reported numbers. The most load-bearing defect is not the single-database protocol (external validity), but the internal reliability of the digital D-EER statistics: Table 3 appears to duplicate the Multi-level Deep Features column as Proposed Method, the headline 13.63% mean includes intra-dataset trials that are irrelevant to generalization, and no significance testing is provided for the small remaining gap. Each of these is independently correctable; together they make the conclusion unverifiable. We therefore agree with the reader's REJECT verdict, though we locate the decisive weakness differently. A correction of Table 3 and a paired significance test could potentially change this assessment in a revised manuscript.","tokens_in":19328,"tokens_out":6883,"duration_ms":64012,"concrete_test":"Obtain the true ViT-L digital D-EER values for the Landmarks-II training condition (Table 3). If any of the five 'Proposed Method' entries differ from Multi-level Deep Features, recompute the digital means in Tables 1 and 7 with the corrected values. Then run a paired two-sided Wilcoxon signed-rank test on the 20 inter-dataset digital D-EER pairs (Proposed Method vs. Multi-level Deep Features) and report the p-value. If the corrected proposed mean is no longer lowest, or if p≥0.05, the claimed 'notable improvement' in digital generalizability is not supported.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central claim—improved cross-algorithm generalizability of ViT features for digital S-MAD—rests on Table 1, where Proposed Method has mean D-EER 13.63% versus 14.78% for Multi-level Deep Features. This difference is not robustly established. First, the 13.63% mean is computed over all 25 digital cells, including 5 intra-dataset cases; the inter-dataset-only mean (Table 7) is 16.41% versus 17.79%, still a 1.38pp gap. Second, Table 3 (training condition Landmarks-II) has 'Proposed Method' D-EERs exactly equal to 'Multi-level Deep Features' D-EERs in every one of its 15 cells (e.g., digital: 14.92, 10.63, 22.64, 23.67, 29.67). In Tables 2, 4, 5, and 6, the two columns differ, so this is not a genuine algorithmic equivalence. If those Table 3 cells are not the actual ViT results, both Table 1 and Table 7 digital statistics for the proposed method are wrong. Third, no significance test is reported; with standard deviations of 11–14 D-EER across only 20 inter-dataset trials, a 1.4pp mean shift is well within sampling noise. The paper's own Limitations section acknowledges only leave-one-out training was tested and that intra-dataset results are 'less or equal' to baselines, leaving the small digital gap as the sole basis for the main conclusion.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a single-image morphing attack detection (S-MAD) method that extracts deep representations using a fixed, ImageNet-pretrained Vision Transformer (ViT-L) classification token and classifies them with a linear SVM. The method is evaluated in a leave-one-out protocol across five morphing algorithms (Landmark-I, Landmark-II, StyleGAN, MIPGAN-I, MIPGAN-II) on a database built from FRGC, under three processing types: digital, print-scan, and print-scan with compression. The authors benchmark against seven baselines and report that the proposed method achieves a lower mean D-EER on digital images than all baselines, concluding that ViT features improve generalizability of S-MAD for digital use cases.","tokens_in":19634,"tokens_out":7022,"duration_ms":68385,"significance":"If the reported results are correct, the paper would provide a useful empirical data point: a frozen ViT-L with a linear SVM can generalize across unseen morphing algorithms on digital face images. The experimental design is straightforward and largely reproducible, and the inclusion of multiple strong baselines is a positive feature. However, the current evidence is not sufficient to support the main claim. The apparent duplication of results in Table 3, the absence of significance testing, and the narrow scope of the evaluation mean that the paper's central conclusion is not reliably established. The method also performs markedly worse on print-scan and compressed images, so the practical contribution is limited to the digital modality.","major_comments":[{"comment":"The digital columns of Table 3 (training on Landmarks-II) show that every D-EER, BPCER@MACER=5%, and BPCER@MACER=10% value for the 'Proposed Method' is identical to the corresponding value for 'Multi-level Deep Features' in all five test-morphing blocks. For example, for test Landmarks-I the D-EER is exactly 14.92, BPCER@5 33.10, BPCER@10 22.64 for both rows; the same holds for the other four test morphs. Since two different feature extractors cannot produce identical results in all these cases, the digital entries for the Proposed Method in Table 3 are evidently erroneous, likely a copy-paste error. These entries are included in the mean D-EER statistics in Table 1 and Table 7, so the key quantitative claim (digital D-EER of 13.63% for the proposed method) is not reliable. The authors must recompute the missing results for this training condition and update all affected tables, statistics, and conclusions.","section":"Table 3"},{"comment":"The claimed advantage over the best baseline is a mean D-EER difference of 1.15 percentage points in Table 1 (13.63 vs 14.78) and 1.38 percentage points in Table 7 for inter-dataset-only (16.41 vs 17.79). No significance test is reported, and the standard deviations are 11–14 D-EER over only 20 inter-dataset trials per processing type. A difference of this size is well within the sampling noise of such a small, high-variance evaluation. The authors should perform paired statistical tests (e.g., Wilcoxon signed-rank test) on the 20 pairwise D-EER differences between the proposed method and each baseline, and report effect sizes or confidence intervals. Without this, the conclusion of a 'notable improvement' is not supported.","section":"Section 4, Tables 1 and 7"},{"comment":"The paper frames the problem as open-set and claims 'generalized' S-MAD, but the evaluation protocol varies only the morphing algorithm while holding the face database (FRGC, 140 subjects), acquisition pipeline, and image processing types fixed. The Limitation section acknowledges that only leave-one-out training was tested. As a result, the abstract's claim of handling 'unknown attacks in an open-set scenario' is an overstatement; the evidence supports only cross-morphing-algorithm generalization within a single database and fixed preprocessing. The claims should be qualified to state this clearly, or additional experiments on other databases are required to support the broader claim.","section":"Sections 5 and 6, Abstract"},{"comment":"The Conclusion states that 'overall detection accuracy gain' can be noted in cross-dataset testing, but Table 1 shows the proposed method has a substantially higher mean D-EER than the best baselines for print-scan (18.33% vs 7.63%) and print-scan with compression (19.09% vs 13.38%). The Limitation section also states intra-dataset accuracy is 'less or equal' to the other algorithms. The only domain where the method shows an advantage is digital inter-dataset testing. The wording of the conclusion should be restricted to that setting, otherwise it misrepresents the overall results.","section":"Section 6, Conclusion"}],"minor_comments":[{"comment":"The Conclusion says the method is 'benchmarked against two selected SOTA algorithms', but the paper clearly evaluates seven baselines. This appears to be a typo that should be corrected.","section":"Conclusion"},{"comment":"Reference [22] has a typo in the title: 'Morph deterction' should be 'Morph detection'. Also, references [10] and [11] are the same paper (same title, nearly the same author list) listed twice with different years; one should be removed or the citations harmonized.","section":"References"},{"comment":"There are several minor typographical issues: 'In this paper ,' in the abstract has an extra space before the comma, 'P .S. with Compression' in Table 7 uses an unusual abbreviation, and 'Motimodality' in the Conclusion should be 'Multi-modality'.","section":"Tables and text"},{"comment":"The paper does not specify the SVM regularization parameter C, the SVM implementation, or whether the classification token features are normalized before classification. Providing these implementation details would improve reproducibility.","section":"Section 2"}],"recommendation":"major_revision","confidential_remarks":"The Table 3 duplication is a serious integrity concern. I would strongly encourage the editor to ask the authors to provide the raw experimental logs or code to verify the digital results for the Landmarks-II training condition before any acceptance decision. The paper also contains a high number of self-citations and several of the baselines come from the same group, which is not a flaw in itself but reduces the independence of the 'unknown attack' evaluation. If the corrected results no longer show an improvement in the digital setting, the paper should be rejected."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: the paper is the first I know to use a frozen vanilla ViT as a feature extractor for single-image morphing attack detection, and it runs a careful benchmark. The idea is reasonable and the domain is security-relevant. But the central numbers are compromised by an apparent copy-paste error in Table 3, and the claimed improvement is small and untested for significance.\n\nWhat's actually new: ViT-L features plus linear SVM applied to S-MAD with leave-one-out morphing-algorithm evaluation. The paper compares against seven baselines across digital, print-scan, and compressed print-scan images, with sensible preprocessing. The T-SNE plots are a useful diagnostic. The qualitative finding that ViT helps on digital but degrades on print-scan is plausible, since the model was pretrained on digital images.\n\nThe soft spots are serious. In Table 3, for training on Landmarks-II, every digital D-EER and BPCER for the proposed method is identical to the Multi-level Deep Features baseline across all five test morphing algorithms. That is not possible for two different feature extractors. Because those cells are part of the summary statistics in Tables 1 and 7, the reported digital mean D-EER of 13.63% is not reliable. The authors also report no significance tests; with standard deviations of 11-14 points across only 20 inter-dataset trials, a 1.15-1.38 point gap is well within noise. The paper's own limitations admit that intra-dataset results are 'less or equal' and only leave-one-out training was tested.\n\nOne more caveat: 'cross-dataset' here means cross-algorithm, all within FRGC. The identity pool, sensor, illumination, and compression pipeline are fixed. So the generalizability claim is narrower than the abstract suggests.\n\nThe paper is honest about some limitations and the benchmark construction is solid. But the data integrity issue is load-bearing: the main conclusion rests on numbers that may not be the ViT's real performance.\n\nMy recommendation: send it to a referee who can verify the tables and request corrected results, but expect heavy revision. If the authors can fix Table 3 and add significance testing, there may be a modest useful result here. In the current form, I would not cite the headline numbers, and I would not accept the paper.","headline":"First ViT-for-S-MAD paper, but the key table is duplicated and the claimed gain is within noise; fixable but not acceptable as is.","tokens_in":20151,"tokens_out":4188,"would_cite":false,"duration_ms":41030,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims a frozen ImageNet-pretrained Vision Transformer feature extractor with a linear SVM improves open-set single-image morphing attack detection on digital face images.","keywords":["face morphing attack detection","single-image morphing attack detection","Vision Transformer","generalization","cross-dataset testing","biometrics security","deep feature extraction","linear SVM"],"falsifier":"Run the same ViT-SVM pipeline on morphs produced by a morphing algorithm not among the five used here, or on an independent face database with a different population and camera; if the mean cross-dataset D-EER on digital images is not lower than the best baseline, the paper's generalizability claim would be refuted.","tokens_in":19139,"feed_emoji":"🪪","tokens_out":11872,"duration_ms":112353,"temperature":0.7,"pith_summary":"The paper tackles a specific version of face-morphing defense: given one suspected face photo, detect whether it is a morphed image produced by an algorithm the detector has never seen. It argues that a frozen, ImageNet-pretrained Vision Transformer (ViT-L), whose 1024-dimensional classification token is classified by a linear SVM, generalizes across five morphing algorithms on digital images better than CNN-based transfer features, hand-crafted feature ensembles, and trained residual networks. In leave-one-out cross-dataset testing on an FRGC-based database, training on four morphing algorithms and testing on the fifth, the ViT pipeline achieves a mean detection equal-error rate (D-EER, the error at which missed attacks and false alarms balance; lower is better) of 13.63% on digital images, 1.15 percentage points lower than the best baseline (14.78%, Multi-level Deep Features). The paper reports that the same advantage does not hold for print-scan or print-scan-compressed images, where ViT representations degrade and several baselines perform better. A sympathetic reader should care because open-set generalization is the operational requirement for passport-control morphing attack detection: the next attack may come from a morphing algorithm not represented in training data.","feed_headline":"ViT beats CNN baselines at spotting unseen face morphs","feed_subtitle":"A frozen transformer plus linear SVM cuts cross-dataset morph-detection error to 13.63% D-EER.","key_machinery":"The machinery is the classification token of a frozen, ImageNet-pretrained Vision Transformer (ViT-L, with 32-by-32 input patches) used as a deep feature extractor, followed by a linear SVM for binary morph/bona-fide classification. A face image is cropped by MTCNN, resized to 384 by 384 pixels, split into 144 patches of 32 by 32 pixels, and each patch is projected to a linear embedding; a learnable classification token is prepended and 1-D sinusoidal positional embeddings are added, then 24 encoder blocks with 16-head self-attention process the sequence, and the final classification token (dimension 1024) serves as the image representation. The self-attention mechanism is the load-bearing part: unlike convolutions, it has no strong image-specific inductive bias and can integrate local and global information from low layers, which the paper argues matches the widely distributed traces of morphing. The linear SVM is chosen instead of fine-tuning a deep classifier to avoid overfitting on small-to-medium datasets.","core_discovery":"The central claim, as stated in the paper's conclusion, is that the pure self-attention representation from a vanilla ViT yields an improvement in the generalizability of S-MAD (single-image morphing attack detection) for digital use cases. The evidence is the statistical summary of leave-one-out cross-dataset tests within the digital image type: mean D-EER 13.63% with standard deviation 11.61, lower than all seven baselines, with Multi-level Deep Features the closest at 14.78%. The paper interprets morphing traces as widely distributed across the face region, so a model that integrates local and global information from early layers should capture them more robustly than architectures with strong image-specific inductive biases. It also shows, via t-SNE visualization, that bona fide features separate well from StyleGAN-IWBF, MIPGAN-I, and MIPGAN-II morphs, while Landmark-II morphs overlap with bona fide features, consistent with Landmark-II being the hardest attack to generalize. On print-scan and print-scan-compressed inputs the ViT pipeline underperforms several baselines, which the paper attributes to the model being pretrained only on digital images and to the lower resolution of those inputs.","pith_inferences":["The frozen-extractor recipe likely transfers to other forensic classification tasks where training data are scarce and the artifact is spatially distributed, because the pipeline makes no task-specific image assumptions beyond the pretraining domain.","A testable extension is to fine-tune the last ViT blocks or fuse ViT features with the Multi-modality approach; the paper itself mentions fusion as future work, and its results suggest this could close the print-scan gap.","Because the leave-one-out protocol varies only the morphing algorithm while keeping the FRGC identity pool, camera, and ICAO-style processing fixed, the reported digital advantage may not survive operational shifts in population or sensor; testing on an independent face database would settle that.","The paper's explanation for the print-scan degradation predicts that pretraining or adapting the ViT on print-scanned data should recover much of the lost performance, which is directly testable."],"forward_implications":["A frozen ImageNet-pretrained ViT can be used as a drop-in feature extractor for single-image morphing attack detection on digital face images, without task-specific pretraining or fine-tuning.","The detector should generalize across morphing algorithms of both landmark-based and GAN-based families on digital inputs, not just the algorithm it was trained on.","Landmark-II morphs are the hardest to separate from bona fide images, so any improvement on that attack type is the most meaningful for overall robustness.","For print-scan and print-scan-compression pipelines, the ViT representation alone is not sufficient; the paper's results show it underperforming the Multi-modality and Multi-level Deep Features baselines.","Using reconstructed bona fide images in the GAN-based training sets means the classifier is aimed at morphing artifacts rather than at generic GAN image statistics, which is what allows the generalization claim to be about morphing rather than image source."],"supporting_citations":[{"why":"Supplies the Vision Transformer architecture and pretraining configuration whose classification token is used as the deep representation.","marker":"[1]"},{"why":"Supplies the FRGC-V2 face database from which all bona fide and morphed images in the experiments are built.","marker":"[9]"},{"why":"Defines the Landmark-I landmark-based morphing algorithm used as one of the five attack types in cross-dataset training and testing.","marker":"[14]"},{"why":"Defines the Landmark-II landmark-based morphing algorithm, which the paper identifies as the most challenging attack type.","marker":"[3]"},{"why":"Provides the StyleGAN-IWBF GAN-based morphing algorithm used in the cross-dataset protocol.","marker":"[28]"},{"why":"Provides the MIPGAN-I and MIPGAN-II GAN-based morphing algorithms used in the cross-dataset protocol.","marker":"[30]"},{"why":"Represents the transferable deep-CNN-feature baseline that the ViT approach is directly compared against.","marker":"[15]"},{"why":"Is the Multi-level Deep Features baseline with the best mean cross-dataset D-EER (14.78%) among baselines on digital images, the number the proposed method must beat.","marker":"[26]"}],"fun_headline_variants":["Vision transformer spots unseen face morphs better than CNNs","ViT boosts single-image morph attack detection across datasets","Transformer beats CNN at detecting unknown face morphs","ViT cuts morph-detection error to 13.63% on new datasets","Self-attention improves generalization for face morphing detection"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The generalizability claim rests on the assumption that leave-one-out testing across five morphing algorithms on a single face database with fixed cropping and resizing is a valid proxy for the open-set conditions a passport-control detector will meet in operation, where population, camera, and post-processing can also change.","fun_headline_variants_meta":{"raw":{"variants":["Vision transformer spots unseen face morphs better than CNNs","ViT boosts single-image morph attack detection across datasets","Transformer beats CNN at detecting unknown face morphs","ViT cuts morph-detection error to 13.63% on new datasets","Self-attention improves generalization for face morphing detection"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000225,"raw_usage":{"total_tokens":1515,"prompt_tokens":1046,"completion_tokens":469,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":662,"completion_tokens_details":{"reasoning_tokens":387}},"tokens_in":662,"tokens_out":469,"duration_ms":4851,"temperature":1.0,"reasoning_tokens":387,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T19:38:34.447361+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the same ViT-SVM pipeline on morphs produced by a morphing algorithm not among the five used here, or on an independent face database with a different population and camera; if the mean cross-dataset D-EER on digital images is not lower than the best baseline, the paper's generalizability claim would be refuted.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the FRGC-V2 face database from which all bona fide and morphed images in the experiments are built."},{"cited_title":"Face morphing versus face averaging: Vulnerability and detection","cited_arxiv_id":null,"evidence_quote":"Defines the Landmark-I landmark-based morphing algorithm used as one of the five attack types in cross-dataset training and testing."},{"cited_title":"De- coupling texture blending and shape warping in face mor- phing","cited_arxiv_id":null,"evidence_quote":"Defines the Landmark-II landmark-based morphing algorithm, which the paper identifies as the most challenging attack type."},{"cited_title":"Can gan generated morphs threaten face recognition systems equally as landmark based morphs? - vulnerability and detection","cited_arxiv_id":null,"evidence_quote":"Provides the StyleGAN-IWBF GAN-based morphing algorithm used in the cross-dataset protocol."},{"cited_title":"Mip- gan—generating strong and high quality morphing attacks using identity prior driven gan","cited_arxiv_id":null,"evidence_quote":"Provides the MIPGAN-I and MIPGAN-II GAN-based morphing algorithms used in the cross-dataset protocol."},{"cited_title":"Raja, Sushma Venkatesh, and Christoph Busch","cited_arxiv_id":null,"evidence_quote":"Represents the transferable deep-CNN-feature baseline that the ViT approach is directly compared against."},{"cited_title":"Multilevel fusion of deep features for reliable single image based face morphing attack de- tection","cited_arxiv_id":null,"evidence_quote":"Is the Multi-level Deep Features baseline with the best mean cross-dataset D-EER (14.78%) among baselines on digital images, the number the proposed method must beat."}],"review_version":1}