Pith. sign in

REVIEW 5 major objections 7 minor 41 references

MorphUNet: Alpha-Controlled Biometric Transport for Diffusion-Based Face Morphing Attacks

T0 review · 5 major / 7 minor · reviewed 2026-07-31 · grok-4.5

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read MorphUNet keeps two face identities separate inside a diffusion U-Net, then mixes them with alpha, producing morphs that fool more recognition systems while looking more real.

desk verdict Solid systems paper with a real architecture idea, but the “best on both datasets” headline is oversold once you notice FRLL is in-domain for them and FEI is a statistical tie with MorDIFF. read the letter →

arxiv 2607.25092 v1 pith:LD37TV72 submitted 2026-07-27 cs.CV

Taimoor Rizwan , Sara Atito , Zhenhua Feng , Muhammad Awais , Josef Kittler This is my paper
classification cs.CV
keywords facemorphingattacksdiffusionmodelsbiometricsecurityrecognitionattackdetectionidentity-preservinggenerationTransportLayer
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Face morphing attacks aim to make one photo that border and ID systems accept as two different people. Prior methods often blend parents too early, so one identity collapses and the attack fails against several matchers at once. MorphUNet treats morphing as alpha-controlled biometric transport: each parent is split into appearance (CLIP) and identity (ArcFace) evidence, aligned into separate token banks, and fed through trainable parent-separated dual cross-attention inside the denoising U-Net before alpha mixes the residuals. Against StableMorph, MIPGAN-II, and MorDIFF on FEI and FRLL with six face recognizers, it reports the best Morphing Attack Potential when at least three systems must be fooled (0.919 and 0.886), the best FID on both sets, and high cross-dataset detector miss rates. A sympathetic reader cares because the paper argues that delaying fusion until after parent-specific attention is what preserves the weaker contributor and makes multi-system attacks practical.

What carries the argument

Biometric Transport Layer: a trainable U-Net attention block that attends to two parent-specific identity-aware token banks (CLIP appearance plus ArcFace identity mapped into CLIP token space) separately, then mixes the biometric residuals with alpha; coupled with DDIM-inverted latent interpolation and weaker-parent-guided candidate selection.

What would settle it

Regenerate the FEI/FRLL benchmark without weaker-parent selection (fixed alpha, single sample) and score MAP at c=3 plus minimum parent similarity with face matchers never used in training or selection; if MorphUNet no longer leads StableMorph, MIPGAN-II, and MorDIFF, the central claim fails.

Watch

Extended reading notes

Core claim

The paper claims that diffusion face morphing becomes a stronger multi-system attack when the two parents remain separately accessible inside the denoising U-Net via a Biometric Transport Layer—parent-specific dual cross-attention whose residuals are mixed only afterward by alpha—rather than by averaging identities or latents before denoising. On FEI and FRLL this yields the best MAP at c=3 and the best FID versus three strong baselines, with morphs that also remain hard for detectors under cross-dataset transfer.

Load-bearing premise

Training alphas and final morph picks both lean on recognition similarity scores of the same kind used to judge success, so the reported balance and attack gains may shrink if selection is fixed or scored by held-out systems.

Editorial extensions

If this is right

  • Morph evaluation should report multi-matcher MAP (e.g. c=3), weaker-parent similarity, MAD, and FID together rather than single-matcher success or visuals alone.
  • Diffusion morphers should keep two parent conditioning paths separate until late residual fusion instead of pre-averaging embeddings or latents.
  • Cross-dataset detector transfer can leave high-MAP diffusion morphs largely undetected even when same-dataset detectors catch more of them.
  • Unseen-identity and low parent-similarity pairs remain the hard regime; alpha-parametrised transport is offered as a reusable trajectory model without per-pair fine-tuning.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If delayed parent-specific attention is the real lever, similar dual-bank transport could transfer to other two-identity biometric forgeries (e.g. iris or voice morphs) with modality-appropriate encoders.
  • Operational passport pipelines that only gate on one commercial matcher plus a same-domain MAD model may systematically under-estimate risk from this class of attack.
  • Decoupling candidate selection from the evaluation matchers is the cleanest next experiment to separate architectural gain from scorer-aligned picking.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 7 minor

Summary. The paper introduces MorphUNet, a diffusion-based face-morphing framework in which each parent is decomposed into CLIP appearance and ArcFace identity features, the latter aligned into a CLIP-compatible token space (Biometric Token Alignment), and the two parents are kept as separate token banks attended to by trainable, parent-specific cross-attention paths inside a frozen Stable-Diffusion-style U-Net (Biometric Transport Layer), with residuals fused by the morphing coefficient α, which also controls slerp interpolation of DDIM-inverted parent latents. Training uses FRLL triplets with dynamic α labels derived from ArcFace parent similarities (Eq. 8); inference adds weaker-parent-guided candidate selection. The authors evaluate against StableMorph, MIPGAN-II, and MorDIFF on FEI and FRLL under a six-FRS protocol (MAP at c=1/3/6, per-FRS MMPMR, identity-balance metrics, FID/KID/CMMD/LPIPS), ensemble MAD at several BPCER operating points, gender/similarity stress tests, and a MorphUNet-only CFD unseen-identity study, plus conditioning ablations in the supplement. Claimed results: best MAP at c=3 on FEI (0.919) and FRLL (0.886), best FID on both datasets, and high cross-dataset MAD APCER.

Significance. If the results hold, the contribution is meaningful for the morphing-attack literature: a reusable two-parent conditioning mechanism with explicit identity-balance control, evaluated with an unusually broad protocol — six matchers, three MAP criteria, per-FRS MMPMR, identity-balance distributions, four image-quality metrics, MAD at four BPCER operating points in same- and cross-dataset settings, demographic/similarity stress tests, and conditioning ablations in the supplement. The honesty of the limitations section (§6.1) is also a strength. However, the significance of the headline comparative claim currently rests on an asymmetric training protocol and noise-level margins on the one symmetric dataset, and no code release is stated, which limits reproducibility. The architectural idea is valuable independently of the leaderboard claim, and the evaluation protocol itself is a useful contribution.

major comments (5)
  1. [§5.2, Table 2] Table 2 and §5.2: the headline claim 'best MAP at c=3 on both datasets' is not supported under a symmetric protocol. MorphUNet is trained primarily on FRLL (§3.3.1), so the FRLL c=3 gap (0.886 vs 0.818 MorDIFF) compares an in-domain model with zero-shot baselines. FEI is the only comparison where all four methods are equally out-of-domain, and there the margin over MorDIFF is 0.006 (0.919 vs 0.913, N=676) — within binomial sampling noise (SE ≈ 0.011 per method) — while MorDIFF leads at c=6 (0.41 vs 0.37) and ties min-similarity (0.59 vs 0.59). Please report confidence intervals and a paired test (e.g., McNemar or bootstrap over morph pairs), reframe the FEI result as a tie, and ideally add an FRLL-free training variant or FRLL-adapted baselines to make the decisive comparison symmetric.
  2. [§3.3.2, §3.5.3, §4.2.1–4.2.2] Evaluator coupling through ArcFace: ArcFace embeddings drive (i) dynamic alpha supervision (Eq. 8), (ii) the identity tokens in Biometric Token Alignment (Eq. 10), (iii) inference-time weaker-parent-guided candidate selection (§3.5.3), and (iv) the min-similarity/imbalance metrics (Eq. 25) — while ArcFace is also one of the six evaluation matchers (§4.2.1). The reported identity-balance gains (Fig. 6) and part of the MAP advantage may therefore be partially tautological. Please add a control: select candidates using a held-out matcher (e.g., MagFace), recompute min-sim/imbalance in a non-ArcFace space, and report MAP with ArcFace excluded from the matcher set. §6.1 acknowledges the selection-dependence but the experiments do not quantify it.
  3. [§3.5.3, §4.2.2] The weaker-parent-guided selection procedure is under-specified: the number of candidate morphs generated per pair, the α grid over which candidates are sampled, and the exact selection rule ('favours candidates that improve the weaker parent') are not formalized. Because selection directly optimises an evaluation-adjacent quantity, comparability requires stating whether StableMorph, MIPGAN-II, and MorDIFF outputs underwent an equivalent candidate-selection budget, or reporting selection-free (single-sample) results alongside. As written, part of the Table 2 gap could be a selection-budget effect rather than an architecture effect.
  4. [Appendix B, Table 7] Ablation protocol inconsistency (Table 7, §B.1): the ablation benchmark uses up to MAP@8 ('strictest criterion'), implying 8 matchers, whereas the main protocol uses 6; the 8 matchers are never identified. Further, ablation FRLL MAP@3 for the full MorphUNet is 94.98% vs 0.886–0.89 for the same model and dataset in Table 2, with no explanation of the discrepancy ('merged benchmark package' is undefined). The ablation is also FRLL-only. Since these ablations are the evidence that the parent-separated transport layer (the central architectural claim) is responsible for the gains, the protocols must be reconciled and the matcher sets listed.
  5. [§4.2.2, §5.6] The CFD unseen-identity study is MorphUNet-only, justified by the claim that 'several competing morphing pipelines require identity-specific optimisation' (§4.2.2). That applies to MIPGAN-II but not obviously to MorDIFF or StableMorph, which are zero-shot pipelines and could be run on CFD directly. Either run at least MorDIFF on the CFD categories, or correct the justification and remove any comparative implication from §5.6 (e.g., 'remains successful across many CFD families' is fine; implying this is a differentiating strength is not currently evidenced).
minor comments (7)
  1. [Abstract, Table 3] Abstract/Table 3 inconsistency: the abstract reports cross-dataset APCER@5% of 0.996 (FEI) and 0.946 (FRLL), but Table 3 shows 1.00 and 0.95 for those cells. Please align the numbers.
  2. [Abstract, §5.3, Table 3] The abstract states MorphUNet 'gives the highest APCER at the main 5% BPCER operating point in the same-dataset setting.' Technically true, but on FRLL that value is 0.041 — the detector rejects ~96% of MorphUNet morphs in-domain. The abstract should present the same-dataset FRLL detectability alongside the cross-dataset headline to avoid overstatement.
  3. [Table 2] Table 2: MIPGAN-II on FRLL has N=1266 morphs versus 1096 for all other methods. Please explain the unequal probe count and confirm MAP comparisons are unaffected.
  4. [§4.2.2, Eq. (25)] Eq. 25: the face-recognition feature space used for s_A and s_B is not named. Given Major Comment 2, this must be specified (presumably ArcFace).
  5. [§3.4.4, §3.5] Reproducibility: γ_ℓ is described as 'learned or configured' (§3.4.4) without saying which; token bank size m, width d, number and placement of transport layers, optimiser, learning rate, and training steps are not reported, and no code release is mentioned. Please add an implementation-details section.
  6. [§5.2, Tables 5 and 7] Figure ordering: §5.2 cites Figure 4 (MAP curves) before Figure 3 (heatmap) appears; also Table 5 and Table 7 format sample counts as '21.00'/'1096.00'. Minor presentational cleanup.
  7. [§2.5, Abstract] The 'first trainable parent-separated dual cross-attention' claim (§2.5) is plausibly distinct from single-reference decoupled cross-attention (IP-Adapter, InstantID), but given the pace of diffusion-morphing work the 'to the best of our knowledge' hedge should be retained in the abstract as well, not only the body.

Circularity Check

2 steps flagged · score 3.0 of 10

Partial selection–metric coupling on identity balance; central MAP/FID claims are not by-construction tautologies.

  1. fitted input called prediction [§3.5.3 Training and Inference Procedure; also Abstract / §4.2.2]
    "When multiple generated candidates are available for a parent pair, the final morph is selected using parent-wise verification scores rather than visual quality alone. The selection favours candidates that improve the weaker parent while avoiding collapse toward the stronger parent... weaker-parent-guided candidate selection favours morphs that maximise the lower of the two parent-similarity scores"

    Final reported morphs are chosen by maximising the weaker parent-similarity (min-sim). The paper then treats elevated minimum parent similarity and low identity imbalance (§5.2.2, Table 2: Min Sim., Imbal.) as empirical support for Biometric Transport. For those metrics, the selection step directly optimises the reported quantity, so the balance improvement is partly by construction of the candidate picker rather than an independent out-of-sample prediction of balance.

  2. fitted input called prediction [§3.3.2 Alpha Supervision and Dynamic Alpha Sampling, Eq. (8)]
    "MorphUNet therefore constructs a dynamic training alpha from the target morph’s ArcFace similarities to both parents. Let sAB_A and sAB_B be the ArcFace similarities between the target morph xAB and parents xA and xB. For nominal midpoint examples, the training alpha is assigned to one of two near-midpoint values according to which parent is stronger in the target: α_train = 0.4 if sAB_A ≥ sAB_B, else 0.6."

    Training α is labelled from ArcFace parent similarities of the supervised target, ArcFace also supplies identity tokens for conditioning, and ArcFace is one of the six MAP matchers plus a natural scorer for parent-similarity metrics. This does not make MAP@c=3 equal to the training labels by definition, but it couples the same biometric scorer into supervision, conditioning, and part of the evaluation stack, so ArcFace-linked identity-balance and ArcFace MMPMR are not fully independent of the fitted/labelled ArcFace signal.

full rationale

MorphUNet is an empirical systems paper, not a first-principles derivation. Its load-bearing claims (best MAP at c=3 vs StableMorph/MIPGAN-II/MorDIFF, best FID, cross-dataset MAD APCER) are measured on held-out parent pairs with external baselines and multiple independent matchers/detectors; those results are not algebraically forced by the method’s definitions. The one clear circularity pattern is inference-time weaker-parent-guided candidate selection, which explicitly maximises the lower parent-similarity and then reports min-similarity / imbalance as evidence of identity balance—so those particular balance metrics are partly optimised rather than purely predicted. Dynamic α labels (Eq. 8) and Biometric Token Alignment also use ArcFace, and ArcFace is one of the six evaluation FRS, which is evaluator-stack overlap but not a self-definitional reduction of MAP. There is no self-citation uniqueness theorem, no ansatz smuggled in as a theorem, and no renaming of a known closed-form result. In-domain FRLL training vs zero-shot baselines is an evaluation-symmetry concern, not circularity under this rubric. Overall: minor partial circularity on secondary identity-balance evidence; score 3.

Assumptions & free parameters 6 free parameters · 6 assumptions · 5 invented entities

Load-bearing structure is empirical systems work on a frozen latent-diffusion prior plus learned two-parent conditioning. Claims rest on standard diffusion/DDIM math, frozen CLIP/ArcFace geometry, supervised intermediate morph targets, α as a shared structure/identity coordinate, and evaluation conventions (MAP@c, MMPMR, ISO PAD rates). Free knobs include token counts, loss weights, transport scales, dynamic α discretization, and recognition-guided selection. Invented entities are named modules (transport layer, token alignment, coupled α control), not new physical objects; their evidence is ablation and benchmark performance inside this paper.

free parameters (6)
  • Dynamic training alpha near-midpoint values {0.4, 0.6} = 0.4 if sA≥sB else 0.6; endpoints softened to {0,0.1}/{0.9,1.0}
    Nominal 0.5 targets are reassigned by which parent is stronger in ArcFace space (§3.3.2); hand-chosen bins shape the learned trajectory.
  • Biometric Token Alignment loss weights λ_cos, λ_tok, λ_mse, λ_nce = 1.0, 0.5, 0.25, 0.1
    Pretraining objective weights on CelebA are defaults chosen by authors (§3.5.1), not derived.
  • Token bank size m and width d; transport scale γ_ℓ
    Dimensionality of appearance/identity tokens and per-layer residual scales control how much parent evidence enters the U-Net; implementation choices not uniquely determined.
  • DDIM inversion/denoising step count = 50
    Benchmark uses 50 inversion and denoising steps (§3.5.3); quality/attack trade-off depends on this budget.
  • Weaker-parent-guided candidate selection rule
    Final morph among candidates maximizes lower parent similarity / avoids collapse; selection policy is a free inference hyper-procedure affecting reported MAP and balance.
  • MAD operating points and ensemble soft-vote = BPCER ∈ {1%,5%,10%,20%}; main 5%
    APCER reported at fixed BPCER (main 5%); detector is mean of ResNet-18 + ViT-B/16 + ViT-L/32 scores—thresholding and ensemble design affect detectability claims.
assumptions (6)
  • standard math Standard latent diffusion noise-prediction objective and DDIM deterministic inversion/sampling correctly anchor parent structure in z_T.
    Preliminaries §3.2 adopt Ho/Rombach/Song formulations; morphing quality assumes inversion fidelity.
  • domain assumption CLIP appearance and ArcFace identity are complementary and jointly necessary for biometric morphs; ArcFace can be projected into CLIP-compatible tokens without destroying verification geometry.
    §3.4.2–3.4.3 decomposition and alignment pretraining; central to token banks.
  • ad hoc to paper Keeping parents as separate cross-attention paths until α-mixed residuals preserves weaker-parent evidence better than early fusion.
    Core design hypothesis of Biometric Transport Layer (§3.4.4); tested via ablations, not a prior theorem.
  • domain assumption Supervised intermediate morph targets x_AB on FRLL define a meaningful identity trajectory the denoiser should learn; inference without targets still follows that trajectory.
    Triplet construction §3.3.1; attack morphs are not copies of targets but depend on this supervision.
  • domain assumption Six academic FRS embeddings and controlled FEI/FRLL imagery are adequate proxies for morphing attack potential relevant to border/document settings.
    Evaluation setup §4; limitations §6.1 note operational imagery and commercial systems remain future work.
  • domain assumption MAP(c) with both-parent acceptance per matcher is the right primary success criterion; c=3 is the main comparison point.
    §4.2.1 protocol; narrative prioritizes c=3 even when c=6 differs (FEI MorDIFF).
invented entities (5)
  • Biometric Transport Layer (parent-separated dual cross-attention + α residual mix)
    purpose: Inject two parent token banks into frozen U-Net hidden states without early identity collapse.
    Named main architectural contribution (§3.4.4); evidence is internal ablations and MAP/balance metrics, not external theory.
  • Biometric Token Alignment (ArcFace→CLIP token bank with appearance-queries-identity attention)
    purpose: Make recognition embeddings usable as diffusion conditioning tokens.
    §3.4.3–3.5.1 module + CelebA pretrain; validated by conditioning ablations.
  • Coupled alpha control (same α for slerp of inverted latents and biometric residuals)
    purpose: Align structural start point with identity mixture along one morph coordinate.
    §3.4.5 design choice; not independently measured outside this pipeline.
  • Weaker-parent-guided candidate selection
    purpose: Reduce one-parent collapse at inference by maximizing min parent similarity.
    §3.5.3 / abstract; directly shapes reported identity-balance and attack scores.
  • CFD-based unseen-identity morph stress protocol (gender/ethnicity/similarity strata)
    purpose: Probe generalization beyond FEI/FRLL benchmark identities.
    §4.2.2, §5.6; MorphUNet-only, so comparative independent evidence is limited.

how reviews work

0 comments
Cite this review

Pith. "Pith review of MorphUNet: Alpha-Controlled Biometric Transport for Diffusion-Based Face Morphing Attacks." pith.science (2026). https://pith.science/paper/LD37TV72

@misc{pith2026260725092,
  author       = {Pith},
  title        = {Pith review of: MorphUNet: Alpha-Controlled Biometric Transport for Diffusion-Based Face Morphing Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/LD37TV72}},
  note         = {Machine review of arXiv:2607.25092}
}
read the original abstract

Face morphing attacks create synthetic images verifiable against multiple identities, threatening border control and identity verification systems. We introduce MorphUNet, a diffusion morphing framework formulating two-parent generation as alpha-controlled biometric transport: each parent is decomposed into CLIP appearance and ArcFace identity evidence, aligned into a CLIP-compatible token space, with the two contributors preserved as separate identity-aware token banks. To our knowledge, MorphUNet is the first diffusion-based morphing framework using trainable parent-separated dual cross-attention inside the denoising U-Net: a Biometric Transport Layer carrying parent-specific identity evidence through denoising, attending to each parent separately before combining residuals via the morphing parameter alpha. DDIM-inverted latent interpolation gives a coherent denoising start, while weaker-parent-guided selection favours morphs maximising the lower parent-similarity score, reducing collapse toward one contributor. We evaluate MorphUNet against three state-of-the-art baselines (StableMorph, MIPGAN-II, and MorDIFF) on FEI and FRLL using six recognition systems, and propose CFD-based unseen-identity stress testing across gender and ethnicity pairing, demographic shifts, and parent-similarity extremes. MorphUNet achieves the best Morphing Attack Potential (MAP) when at least three of six systems are fooled by one morph, reaching 0.919 on FEI and 0.886 on FRLL, and obtains the best FID on both datasets (35.19 FEI, 44.86 FRLL). It also gives the highest APCER at 5% BPCER in the same-dataset setting, and remains highly difficult to detect under cross-dataset transfer, with APCER 0.996 on FEI and 0.946 on FRLL. The full evaluation analyses MAP, MAD, per-system vulnerability, identity balance, image quality, top/bottom-similarity stress tests, and CFD unseen-identity robustness.

Figures

Figures reproduced from arXiv: 2607.25092 by the authors.

Figure 1
Figure 1. Overview of the MorphUNet architecture: Two parent images are encoded using frozen CLIP and ArcFace [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗
Figure 2
Figure 2. Qualitative FEI and FRLL examples. Each grid shows the two parents and the generated morphs for [PITH_FULL_IMAGE:figures/full_fig_p013_2.png] view at source ↗
Figure 3
Figure 3. Method-by-dataset heatmap for the principal MAP criterion. [PITH_FULL_IMAGE:figures/full_fig_p014_3.png] view at source ↗
Figures from the paper (20 more)
Figure 4
Figure 4. Figure 4: MAP comparison: attack success as the cross-FRS criterion increases from [PITH_FULL_IMAGE:figures/full_fig_p015_4.png]
Figure 5
Figure 5. Figure 5: Per-FRS vulnerability. The heatmap reports MMPMR for each method, dataset, and recognition system, [PITH_FULL_IMAGE:figures/full_fig_p015_5.png]
Figure 6
Figure 6. Figure 6: Identity preservation and balance. Top: scatter plot relating weaker-parent similarity to parent imbalance. [PITH_FULL_IMAGE:figures/full_fig_p016_6.png]
Figure 7
Figure 7. Figure 7: Attack success versus detectability. Left: FEI same-dataset detector setting. Right: FRLL same-dataset [PITH_FULL_IMAGE:figures/full_fig_p017_7.png]
Figure 8
Figure 8. Figure 8: Image quality versus attack strength. The plot compares distributional realism against MAP at [PITH_FULL_IMAGE:figures/full_fig_p018_8.png]
Figure 9
Figure 9. Figure 9: Gender and similarity stress-test heatmap on FEI and FRLL. The figure reports MAP under gender-pair [PITH_FULL_IMAGE:figures/full_fig_p018_9.png]
Figure 10
Figure 10. Figure 10: CFD unseen-identity robustness for MorphUNet grouped by demographic relation and parent-pair difficulty. [PITH_FULL_IMAGE:figures/full_fig_p019_10.png]
Figure 11
Figure 11. Figure 11: Qualitative CFD stress examples for MorphUNet. The grids show unseen-identity morphs under same-gender [PITH_FULL_IMAGE:figures/full_fig_p020_11.png]
Figure 12
Figure 12. Figure 12: Robustness drop from fooling one FRS to fooling all six FRS systems. The plot summarises how much each [PITH_FULL_IMAGE:figures/full_fig_p025_12.png]
Figure 13
Figure 13. Figure 13: Additional gender and parent-similarity stress-test views. Left: method behaviour across the top- and [PITH_FULL_IMAGE:figures/full_fig_p026_13.png]
Figure 14
Figure 14. Figure 14: Top- and bottom-similarity stress-test summary on FEI and FRLL. The bars compare MAP across gender-pair [PITH_FULL_IMAGE:figures/full_fig_p026_14.png]
Figure 15
Figure 15. Figure 15: Identity-imbalance distribution on FEI and FRLL. Lower values indicate that a generated morph represents [PITH_FULL_IMAGE:figures/full_fig_p027_15.png]
Figure 16
Figure 16. Figure 16: Qualitative gender and similarity stress-test examples for MorphUNet. The FRLL and FEI examples show [PITH_FULL_IMAGE:figures/full_fig_p029_16.png]
Figure 17
Figure 17. Figure 17: Additional CFD variant robustness grids. The panels show how MAP changes across same-ethnicity [PITH_FULL_IMAGE:figures/full_fig_p031_17.png]
Figure 18
Figure 18. Figure 18: CFD qualitative examples for same-ethnicity and same-gender parent-pair settings. The first grid shows [PITH_FULL_IMAGE:figures/full_fig_p032_18.png]
Figure 19
Figure 19. Figure 19: CFD qualitative examples for same-gender different-ethnicity parent pairs. These examples show how [PITH_FULL_IMAGE:figures/full_fig_p033_19.png]
Figure 20
Figure 20. Figure 20: MAP-versus-c curves for the FRLL conditioning ablations. The full MorphUNet configuration remains among the strongest variants across progressively stricter multi-FRS acceptance criteria. B.2 Quality and Attack Trade-Off [PITH_FULL_IMAGE:figures/full_fig_p035_20.png]
Figure 21
Figure 21. Figure 21: Attack-strength/CMMD trade-off for the FRLL conditioning ablations. The plot shows how simplified [PITH_FULL_IMAGE:figures/full_fig_p036_21.png]
Figure 22
Figure 22. Figure 22: Attack-strength/FID trade-off for the FRLL conditioning ablations. The final MorphUNet model combines [PITH_FULL_IMAGE:figures/full_fig_p036_22.png]
Figure 23
Figure 23. Figure 23: Qualitative alpha-trajectory ablations for FEI and FRLL. Each row shows how the generated morph evolves [PITH_FULL_IMAGE:figures/full_fig_p037_23.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

41 extracted references · 8 linked inside Pith

  1. [1]

    The magic passport

    Matteo Ferrara, Annalisa Franco, and Davide Maltoni. The magic passport. In2014 IEEE International Joint Conference on Biometrics, pages 1–7. IEEE, 2014

    2014

  2. [2]

    Robertson, Robin S

    David J. Robertson, Robin S. S. Kramer, and A. Mike Burton. Face morphing attacks: Investigating detection with humans and computers.Cognitive Research: Principles and Implications, 4(1):1–12, 2019

    2019

  3. [3]

    Automatic generation and detection of visually faultless facial morphs

    Andrey Makrushin, Tom Neubert, and Jana Dittmann. Automatic generation and detection of visually faultless facial morphs. InProceedings of the 12th International Joint Conference on Computer Vision, Imaging and Computer Graphics Theory and Applications, pages 39–50, 2017

    2017

  4. [4]

    Face recognition systems under morphing attacks: A survey.IEEE Access, 7:23012–23026, 2019

    Ulrich Scherhag, Christian Rathgeb, Johannes Merkle, Ralph Breithaupt, and Christoph Busch. Face recognition systems under morphing attacks: A survey.IEEE Access, 7:23012–23026, 2019

    2019

  5. [5]

    Mipgan–generating strong and high quality morphing attacks using identity prior driven gan.IEEE Transactions on Biometrics, Behavior , and Identity Science, 3(3):365–383, 2021

    Haoyu Zhang, Sushma Venkatesh, Raghavendra Ramachandra, Kiran Raja, Naser Damer, and Christoph Busch. Mipgan–generating strong and high quality morphing attacks using identity prior driven gan.IEEE Transactions on Biometrics, Behavior , and Identity Science, 3(3):365–383, 2021

    2021

  6. [6]

    Regenmorph: Visibly realistic gan generated face morphing attacks by attack re-generation.arXiv preprint arXiv:2108.09130, 2021

    Naser Damer, Kiran Raja, Marius Süßmilch, Sushma Venkatesh, Fadi Boutros, Meiling Fang, Florian Kirchbuchner, Raghavendra Ramachandra, and Arjan Kuijper. Regenmorph: Visibly realistic gan generated face morphing attacks by attack re-generation.arXiv preprint arXiv:2108.09130, 2021

    arXiv 2021

  7. [7]

    Denoising diffusion probabilistic models

    Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. InAdvances in Neural Information Processing Systems, volume 33, pages 6840–6851, 2020

    2020

  8. [8]

    High-resolution image synthesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High-resolution image synthesis with latent diffusion models. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 10684–10695, 2022

    2022

Show all 41 references
  1. [9]

    Stablemorph: High-quality face morph generation with stable diffusion

    Wassim Kabbani, Kiran Raja, Raghavendra Ramachandra, and Christoph Busch. Stablemorph: High-quality face morph generation with stable diffusion. In2025 IEEE International Joint Conference on Biometrics (IJCB), 2025

    2025

  2. [10]

    Mordiff: Recog- nition vulnerability and attack detectability of face morphing attacks created by diffusion autoencoders

    Naser Damer, Meiling Fang, Patrick Siebke, Jan Niklas Kolf, Marco Huber, and Fadi Boutros. Mordiff: Recog- nition vulnerability and attack detectability of face morphing attacks created by diffusion autoencoders. In International Workshop on Biometrics and F orensics, 2023

    2023

  3. [11]

    A style-based generator architecture for generative adversarial networks

    Tero Karras, Samuli Laine, and Timo Aila. A style-based generator architecture for generative adversarial networks. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 4401–4410, 2019

    2019

  4. [12]

    Analyzing and improving the image quality of stylegan

    Tero Karras, Samuli Laine, Miika Aittala, Janne Hellsten, Jaakko Lehtinen, and Timo Aila. Analyzing and improving the image quality of stylegan. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 8110–8119, 2020

    2020

  5. [13]

    Vulnera- bility analysis of face morphing attacks from landmarks and generative adversarial networks.arXiv preprint arXiv:2012.05344, 2020

    Sushma Venkatesh, Haoyu Zhang, Kiran Raja, Raghavendra Ramachandra, and Christoph Busch. Vulnera- bility analysis of face morphing attacks from landmarks and generative adversarial networks.arXiv preprint arXiv:2012.05344, 2020

    2012 arXiv

  6. [14]

    Kingma and Max Welling

    Diederik P. Kingma and Max Welling. Auto-encoding variational bayes. InInternational Conference on Learning Representations, 2014

    2014

  7. [15]

    Diffusion autoen- coders: Toward a meaningful and decodable representation

    Konpat Preechakul, Nattanat Chatthee, Suttisak Wizadwongsa, and Supasorn Suwajanakorn. Diffusion autoen- coders: Toward a meaningful and decodable representation. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 10619–10629, 2022

    2022

  8. [16]

    Denoising diffusion implicit models

    Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. InInternational Conference on Learning Representations, 2021

    2021

  9. [17]

    Ladimo: Face morph generation through biometric template inversion with latent diffusion.arXiv preprint arXiv:2410.07988, 2024

    Matthias Grimmer, Fadi Boutros, Meiling Fang, and Naser Damer. Ladimo: Face morph generation through biometric template inversion with latent diffusion.arXiv preprint arXiv:2410.07988, 2024. 22 MorphUNet: Alpha-Controlled Biometric Transport for Diffusion-Based Face Morphing Attacks

    2024 arXiv

  10. [18]

    Facenet: A unified embedding for face recognition and clustering

    Florian Schroff, Dmitry Kalenichenko, and James Philbin. Facenet: A unified embedding for face recognition and clustering. InProceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 815–823, 2015

    2015

  11. [19]

    Arcface: Additive angular margin loss for deep face recognition

    Jiankang Deng, Jia Guo, Niannan Xue, and Stefanos Zafeiriou. Arcface: Additive angular margin loss for deep face recognition. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 4690–4699, 2019

    2019

  12. [20]

    Magface: A universal representation for face recognition and quality assessment

    Qiang Meng, Shichao Zhao, Zhida Huang, and Feng Zhou. Magface: A universal representation for face recognition and quality assessment. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 14225–14234, 2021

    2021

  13. [21]

    Jain, and Xiaoming Liu

    Minchul Kim, Anil K. Jain, and Xiaoming Liu. Adaface: Quality adaptive margin for face recognition. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 18750–18759, 2022

    2022

  14. [22]

    Learning transferable visual models from natural language supervision

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Gretchen Krueger, and Ilya Sutskever. Learning transferable visual models from natural language supervision. InProceedings of the...

    2021

  15. [23]

    Ip-adapter: Text compatible image prompt adapter for text-to-image diffusion models.arXiv preprint arXiv:2308.06721, 2023

    Hu Ye, Jun Zhang, Sibo Liu, Xiao Han, and Wei Yang. Ip-adapter: Text compatible image prompt adapter for text-to-image diffusion models.arXiv preprint arXiv:2308.06721, 2023

    2023 arXiv

  16. [24]

    Instantid: Zero-shot identity-preserving generation in seconds.arXiv preprint arXiv:2401.07519, 2024

    Qixun Wang, Xu Bai, Haofan Wang, Zekui Qin, and Anthony Chen. Instantid: Zero-shot identity-preserving generation in seconds.arXiv preprint arXiv:2401.07519, 2024

    2024 arXiv

  17. [25]

    Bermano, Gal Chechik, and Daniel Cohen-Or

    Rinon Gal, Yuval Alaluf, Yuval Atzmon, Or Patashnik, Amit H. Bermano, Gal Chechik, and Daniel Cohen-Or. An image is worth one word: Personalizing text-to-image generation using textual inversion. InInternational Conference on Learning Representations, 2023

    2023

  18. [26]

    Dreambooth: Fine tuning text-to-image diffusion models for subject-driven generation

    Nataniel Ruiz, Yuanzhen Li, Varun Jampani, Yael Pritch, Michael Rubinstein, and Kfir Aberman. Dreambooth: Fine tuning text-to-image diffusion models for subject-driven generation. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 22500–...

    2023

  19. [27]

    Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen

    Edward J. Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. Lora: Low-rank adaptation of large language models.arXiv preprint arXiv:2106.09685, 2021

    2021 arXiv

  20. [28]

    Diffmorpher: Unleashing the capability of diffusion models for image morphing.arXiv preprint arXiv:2312.07409, 2023

    Kaiwen Zhang, Yifan Zhou, Xudong Xu, Xingang Pan, and Bo Dai. Diffmorpher: Unleashing the capability of diffusion models for image morphing.arXiv preprint arXiv:2312.07409, 2023

    2023 arXiv

  21. [29]

    Face research lab london set, 2017

    Lisa DeBruine and Benedict Jones. Face research lab london set, 2017

    2017

  22. [30]

    Thomaz and Gilson A

    Carlos E. Thomaz and Gilson A. Giraldi. A new ranking method for principal components analysis and its application to face image analysis.Image and Vision Computing, 28(6):902–913, 2010

    2010

  23. [31]

    Deep learning face attributes in the wild

    Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. InProceedings of the IEEE International Conference on Computer Vision, pages 3730–3738, 2015

    2015

  24. [32]

    Ma, Joshua Correll, and Bernd Wittenbrink

    Debbie S. Ma, Joshua Correll, and Bernd Wittenbrink. The chicago face database: A free stimulus set of faces and norming data.Behavior Research Methods, 47(4):1122–1135, 2015

    2015

  25. [33]

    Parkhi, Andrea Vedaldi, and Andrew Zisserman

    Omkar M. Parkhi, Andrea Vedaldi, and Andrew Zisserman. Deep face recognition. InBritish Machine Vision Conference, 2015

    2015

  26. [34]

    Nasrabadi

    Hossein Kashiani, Shoaib Meraj Sami, Sobhan Soleymani, and Nasser M. Nasrabadi. Robust ensemble morph detection with domain generalization. In2022 IEEE International Joint Conference on Biometrics, 2022

    2022

  27. [35]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 770–778, 2016

    2016

  28. [36]

    An image is worth 16x16 words: Transformers for image recognition at scale

    Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x16 words: Transformers for image recognition at...

    2021

  29. [37]

    Information technology – biometric presentation attack detection – part 3: Testing and reporting

    International Organization for Standardization. Information technology – biometric presentation attack detection – part 3: Testing and reporting. ISO/IEC 30107-3:2017, 2017

    2017

  30. [38]

    Gans trained by a two time-scale update rule converge to a local nash equilibrium

    Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by a two time-scale update rule converge to a local nash equilibrium. InAdvances in Neural Information Processing Systems, volume 30, 2017. 23 MorphUNet: Alpha-Controlled Bi...

    2017

  31. [39]

    Sutherland, Michael Arbel, and Arthur Gretton

    Mikołaj Bi ´nkowski, Danica J. Sutherland, Michael Arbel, and Arthur Gretton. Demystifying mmd gans. In International Conference on Learning Representations, 2018

    2018

  32. [40]

    Rethinking fid: Towards a better evaluation metric for image generation.arXiv preprint arXiv:2401.09603, 2024

    Sadeep Jayasumana, Srikumar Ramalingam, Andreas Veit, Daniel Glasner, Ayan Chakrabarti, and Sanjiv Kumar. Rethinking fid: Towards a better evaluation metric for image generation.arXiv preprint arXiv:2401.09603, 2024

    2024 arXiv

  33. [41]

    Efros, Eli Shechtman, and Oliver Wang

    Richard Zhang, Phillip Isola, Alexei A. Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness of deep features as a perceptual metric. InProceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 586–595, 2018. 24 MorphUNet: Alpha-Cont...

    2018

Pith tools

Reviewed July 31, 2026 · model on record in the stance chip above.