Pith. sign in

REVIEW 3 major objections 5 minor 1 cited by

MADation: Face Morphing Attack Detection with Foundation Models

T0 review · 3 major / 5 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Adapting a pre-trained CLIP model with low-rank LoRA weights and a trained classifier yields a face morphing attack detector that outperforms from-scratch ViTs and is competitive with specialised MAD systems.

desk verdict CLIP+LoRA works for morphing detection and the paper is worth engaging with, but a Table 2 mislabel and an undertrained baseline need fixing. read the letter →

arxiv 2501.03800 v3 pith:YCITYSXG submitted 2025-01-07 cs.CV cs.CR

Eduarda Caldeira , Guray Ozgur , Tahar Chettaoui , Marija Ivanovska , Peter Peer , Fadi Boutros , Vitomir Struc , Naser Damer This is my paper · ORCID
classification cs.CVcs.CR
keywords facemorphingattackdetectionfoundationmodelsCLIPLoRAlow-rankadaptationvisiontransformersynthetictrainingdatabiometrics
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that a face morphing attack detector built by adapting a pre-trained CLIP image encoder with low-rank LoRA weights, while training a small binary classifier on top, outperforms the same transformer architectures trained from scratch as well as a frozen-feature baseline, and is competitive with recent specialised MAD systems. The result matters because morphing attacks let several people verify against the same passport photo, and detectors usually need large labelled training sets; MADation instead trains only a small set of LoRA matrices and a classification layer on a synthetic dataset. The evidence is a set of controlled comparisons: zero-shot CLIP performs poorly, frozen-feature CLIP helps, and LoRA-adapted CLIP gives the best average EER across the MAD22, MorDIFF, and FRLL-Morphs benchmarks.

What carries the argument

The central mechanism is Low-Rank Adaptation (LoRA) applied to a frozen CLIP image encoder, with a rank-stabilized scaling factor: for each adapted attention layer the update is $W = W_0 + \gamma_r BA$ with $B \in \mathbb{R}^{d\times r}$, $A \in \mathbb{R}^{r\times k}$, and $\gamma_r = \alpha/\sqrt{r}$ (rsLoRA), applied only to the query and value projection matrices. Alongside these trainable matrices, a two-neuron fully connected header with softmax is trained with binary cross-entropy, producing the bona-fide-versus-morph decision. Because the pre-trained weights stay frozen and only the low-rank matrices and header are updated, the method adapts the embedding space to the MAD task while preserving CLIP's pre-trained knowledge.

What would settle it

Run the same LoRA-plus-classifier training on SMDD from randomly initialized CLIP weights (no pre-training) for the same 40 epochs and compare average EER on MAD22 and MorDIFF: if the random-init model approaches MADation's roughly 11.9% average EER, the advantage over from-scratch ViTs is a product of the LoRA training procedure, not of CLIP's pre-trained knowledge.

Watch

Extended reading notes

Core claim

On its own terms, the paper's discovery is that a foundation model's pre-trained feature space can be aligned to the face-morphing-attack detection task by rank-stabilized low-rank adaptation, producing a detector that outperforms transformer baselines and prior MAD methods in several scenarios. Concretely, for a CLIP ViT-L backbone, MADation reduces the average detection equal error rate by 16.93 percentage points relative to training the same ViT from scratch and by 8.10 points relative to using the frozen CLIP encoder with only a classifier; the ViT-B variant shows the same ordering with gains of 10.24 and 9.56 points, respectively. The paper positions MADation as the first application of foundation models to MAD, and reports near-perfect detection on some morphing techniques, such as zero EER for FaceMorph with ViT-B, while remaining competitive on harder GAN-based and diffusion-based morphs.

Load-bearing premise

The load-bearing premise is that the from-scratch ViT baseline was trained well enough to represent what a non-foundation-model transformer can do, since it got only 40 epochs on a small synthetic dataset.

Editorial extensions

If this is right

  • MADation is best or second-best in 23/42 (ViT-B) and 21/42 (ViT-L) of the MAD22/MorDIFF scenarios against prior solutions, and 12/20 and 9/20 on FRLL-Morphs.
  • Adapting the FM with LoRA improves over both the frozen-feature extractor and the from-scratch ViT, indicating that pre-trained knowledge and task-specific fine-tuning combine productively for MAD.
  • The detector generalizes across unseen morphing techniques, including GAN-based MIPGAN, diffusion-based MorDIFF, and landmark-based methods, despite training only on OpenCV-morphed synthetic images.
  • Because only LoRA matrices and a classification header are trained, the approach adds minimal trainable parameters and no inference overhead, making it a computationally inexpensive MAD solution.
  • The publicly released implementation allows other groups to reproduce and extend the method.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: if the from-scratch ViT baseline were trained until convergence rather than for a fixed 40 epochs, part of the gap might shrink; the paper's cleanest claim is that LoRA adaptation of a frozen FM is an efficient way to reach competitive MAD performance, not that pre-training is strictly necessary.
  • Editorial inference: the same LoRA-plus-header recipe could plausibly transfer to other low-data biometric sub-tasks, such as presentation attack detection or deepfake detection, where a domain-specific shift must be learned from small datasets.
  • Editorial inference: the zero-shot results show CLIP's text-image prompting is weak for morph detection except on some GAN attacks with ViT-L, suggesting that a text-guided prompt-tuning variant, rather than only LoRA on the image encoder, is a natural next experiment.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes MADation, a face morphing attack detection (MAD) framework obtained by adapting CLIP vision encoders with rank-stabilized LoRA (rsLoRA) and a trainable binary classification header. The models are trained on the synthetic SMDD dataset and evaluated on MAD22, MorDIFF, and FRLL-Morphs. The central empirical claim is that LoRA-adapted CLIP (ViT-B and ViT-L) outperforms the paper's own transformer/FM baselines (zero-shot text-image, frozen feature extractor, and from-scratch ViT) and is competitive with or better than recent MAD methods, with reported average EER reductions of 16.93 pp over ViT-FS and 8.10 pp over FE for ViT-L. The implementation is publicly released.

Significance. If the central claims hold, the paper would be a useful demonstration that foundation-model representations can be adapted to the domain-specific MAD task with parameter-efficient fine-tuning, and it would be among the first works to apply FM adaptation to face morphing detection. The paper has several strengths: it provides public code, trains on a separate synthetic dataset rather than tuning on the test benchmarks, evaluates across three common MAD benchmarks, and includes ablations that separate the contributions of frozen features and LoRA adaptation. However, the strength of the headline claims is weakened by a concrete inconsistency in Table 2 and by a from-scratch ViT baseline that appears undertrained; these issues need to be resolved before the reported advantages can be taken as established.

major comments (3)
  1. [§5, Table 2] In Table 2, the ViT-L MADation rows after MIPGAN II are shifted relative to Table 1. Specifically, the row labeled OpenCV in Table 2 contains the values that Table 1 reports for MorDIFF (EER 19.26), the row labeled WebMorph contains Table 1's OpenCV values (EER 2.23), and the row labeled MorDIFF contains Table 1's WebMorph values (EER 20.40). The text in Section 5 states that "ViT-L consistently outperforms the remaining techniques in FaceMorph, MIPGAN II and WebMorph," but that WebMorph claim rests on the mislabeled row; Table 1 gives WebMorph EER 20.40 for ViT-L MADation, not 2.23. This shift also affects the reported counts of best/second-best results. The table and the associated comparative claims must be corrected.
  2. [§3.3 and §4 (Implementation Details)] The claim that FM pre-training is the source of MADation's advantage over ViT-FS is not well supported because the ViT-FS baseline is trained from scratch for only 40 epochs with no reported learning-rate schedule or convergence criterion. For ViT-L with roughly 300 million parameters, a batch size of 256, and about 40k SMDD training images, 40 epochs is only about 6,300 optimization steps, which is very likely insufficient to train a ViT of this size from random initialization. The reported 16.93 pp average EER gap over ViT-FS may therefore reflect an difference in effective optimization budget rather than the value of CLIP's pre-trained knowledge. The authors should either train ViT-FS to convergence with a comparable budget and schedule, or substantially temper the attribution claim.
  3. [§5, Table 1] All results are reported as single point estimates with no error bars, multiple seeds, or statistical significance tests. Given that some comparisons are close (e.g., ViT-B FE average EER 21.45 vs. ViT-FS 22.13, and several per-dataset differences of 1-2 pp), the claims that MADation "surpasses" baselines and is "competitive" with prior work would be more convincing with variance estimates or a reproducibility study over at least a few seeds.
minor comments (5)
  1. [§4 (Image Pre-Processing)] The text refers to "Alexey et al. [2]" for the tokenization/preprocessing of ViT; the reference is to Dosovitskiy et al., which should be cited correctly, and the misspelling "non-overleaping" should be corrected to "non-overlapping."
  2. [§4 (Model Architecture)] The notation "ViT-B and ViT-L" is clear, but the model sizes (86M and 0.3 billion parameters) are given in inconsistent units; the paper should state both values in a uniform way.
  3. [Table 3] Table 3 has formatting issues that affect readability: values are concatenated with dataset names (e.g., "FRLL-Style-GAN216.64" and "FRLL-Style-GAN211.37"), and the column header "EER (%)BPCER (%) @ APCER (%)" is missing a separator. These should be cleaned up in the final version.
  4. [Table 2] The D-FW-CDCN row in Table 2 appears malformed, with the FaceMorph entry reading "FaceMorph0.00 44.10MIPGANI" and subsequent values running together; this makes the row difficult to interpret and should be fixed.
  5. [Throughout] The paper alternates between "adaption" and "adaptation"; the authors should choose one spelling and apply it consistently.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: MADation's evaluation is empirical against external benchmarks with a disjoint synthetic training set; the self-citations are motivational or design choices, not load-bearing reductions.

full rationale

The paper's derivation chain is empirical and self-contained. MADation (CLIP + LoRA + classification header) is trained on the synthetic SMDD dataset and evaluated on external benchmarks (MAD22, MorDIFF, FRLL-Morphs) that are disjoint from training. The central comparisons — against ViT-FS (same architecture trained from scratch) and FE (frozen CLIP features plus a trained header) — are ablations that isolate the contribution of pre-trained knowledge and LoRA adaptation; the reported EER values are measured, not fitted, and no test labels enter the training procedure. The choice of CLIP and LoRA hyperparameters is motivated by prior work, including the authors' own [11], but that citation is used as a design starting point, not as a uniqueness theorem or as the source of the reported performance. No equation reduces to its own input: the LoRA update W = W0 + gamma*B*A is a parameterization, and the classification head is trained with standard cross-entropy. The paper does not rename a known result; it applies an established adaptation technique to a new task and benchmarks it. One noted issue in Table 2 involves a row-label shift for the ViT-L MADation results on OpenCV/WebMorph/MorDIFF, which is a reporting or transcription inconsistency that affects the textual comparison but is not a circularity. Similarly, the concern that ViT-FS may be undertrained after 40 epochs is a training-budget confound, not a circular derivation, because the comparison with ViT-FS is an external empirical baseline rather than a fitted quantity. Overall, no load-bearing step reduces to its own input, and the score is therefore 0.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

No new physical or conceptual entities are introduced. The free parameters are standard training hyperparameters, and the axioms are domain assumptions about transferability and baseline fairness.

free parameters (5)
  • LoRA rank r = 2
    Chosen for both ViT-B and ViT-L; no ablation or validation-based selection is reported.
  • LoRA alpha = 4 (ViT-B), 8 (ViT-L)
    Set differently per architecture; affects the adaptation scale and is not justified by a validation procedure.
  • LoRA dropout = 0.4 (ViT-B), 0.2 (ViT-L)
    Hand-chosen per model with no reported sensitivity analysis.
  • Model and header learning rates = 1e-5 and 1e-4 (MADation); 1e-2 header (FE); 1e-5/5e-5 or 1e-4/1e-4 (ViT-FS)
    Learning rates differ across methods, which complicates the comparison between MADation, FE and ViT-FS.
  • Training epochs and batch size = 40 epochs, batch 256
    Fixed across methods; no early stopping or repeated-seed variation is described.
assumptions (4)
  • domain assumption CLIP's pre-trained visual features contain useful information for face morphing detection after LoRA adaptation.
    The whole method relies on CLIP's feature space being adaptable to MAD with limited data; invoked throughout Section 3.
  • domain assumption SMDD synthetic training data is representative enough to generalize to morphing attacks from FRLL-based benchmarks.
    All models are trained only on SMDD and evaluated on MAD22, MorDIFF and FRLL-Morphs; the transfer is assumed rather than proven.
  • ad hoc to paper Training a ViT from scratch for 40 epochs is a fair baseline for measuring the value of foundation-model pre-training.
    The ViT-FS baseline uses random initialization and the same 40-epoch budget; large ViTs typically need more data and epochs, so the comparison may favor MADation.
  • domain assumption rsLoRA scaling prevents gradient collapse and is appropriate at low rank r=2.
    Adopted from the cited rsLoRA paper without validation on this task.

how reviews work

0 comments
Cite this review

Pith. "Pith review of MADation: Face Morphing Attack Detection with Foundation Models." pith.science (2026). https://pith.science/paper/YCITYSXG

@misc{pith2026250103800,
  author       = {Pith},
  title        = {Pith review of: MADation: Face Morphing Attack Detection with Foundation Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/YCITYSXG}},
  note         = {Machine review of arXiv:2501.03800}
}
read the original abstract

Despite the considerable performance improvements of face recognition algorithms in recent years, the same scientific advances responsible for this progress can also be used to create efficient ways to attack them, posing a threat to their secure deployment. Morphing attack detection (MAD) systems aim to detect a specific type of threat, morphing attacks, at an early stage, preventing them from being considered for verification in critical processes. Foundation models (FM) learn from extensive amounts of unlabelled data, achieving remarkable zero-shot generalization to unseen domains. Although this generalization capacity might be weak when dealing with domain-specific downstream tasks such as MAD, FMs can easily adapt to these settings while retaining the built-in knowledge acquired during pre-training. In this work, we recognize the potential of FMs to perform well in the MAD task when properly adapted to its specificities. To this end, we adapt FM CLIP architectures with LoRA weights while simultaneously training a classification header. The proposed framework, MADation surpasses our alternative FM and transformer-based frameworks and constitutes the first adaption of FMs to the MAD task. MADation presents competitive results with current MAD solutions in the literature and even surpasses them in several evaluation scenarios. To encourage reproducibility and facilitate further research in MAD, we publicly release the implementation of MADation at https://github.com/gurayozgur/MADation

Figures

Figures reproduced from arXiv: 2501.03800 by the authors.

Figure 1
Figure 1. Morphing attack generation and MADation’s pipeline. The left side of the figure depicts a morphing sample and the two bona [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. In-context Learning of Vision Language Models for Detection of Physical and Digital Attacks against Face Recognition Systems

    cs.CV 2025-07 conditional novelty 6.0 of 10

    An in-context learning framework with open-source vision-language models detects face presentation and morphing attacks without training, beating CLIP-based zero-shot baselines on PAD but with performance highly sensi...

Reference graph

Works this paper leans on

56 extracted references · 39 canonical work pages · cited by 1 Pith paper

  1. [1]

    In- trinsic dimensionality explains the effectiveness of language model fine-tuning

    Armen Aghajanyan, Luke Zettlemoyer, and Sonal Gupta. In- trinsic dimensionality explains the effectiveness of language model fine-tuning. arXiv preprint arXiv:2012.13255, 2020. 4

    arXiv 2012

  2. [2]

    An image is worth 16x16 words: Trans- formers for image recognition at scale

    Dosovitskiy Alexey. An image is worth 16x16 words: Trans- formers for image recognition at scale. arXiv preprint arXiv: 2010.11929, 2020. 5

    arXiv 2010

  3. [3]

    Morphed face detection with wavelet- based co-occurrence matrices

    Ismail Avcibas. Morphed face detection with wavelet- based co-occurrence matrices. IEEE Signal Process. Lett. , 31:1344–1348, 2024. 8

    work page 2024

  4. [4]

    Hudson, Ehsan Adeli, Russ B

    Rishi Bommasani, Drew A. Hudson, Ehsan Adeli, Russ B. Altman, Simran Arora, Sydney von Arx, Michael S. Bern- stein, Jeannette Bohg, Antoine Bosselut, Emma Brun- skill, Erik Brynjolfsson, Shyamal Buch, Dallas Card, Ro- drigo Castellon, Niladri S. Chatterji, Annie S. Chen, Kath- leen Creel, Jared Quincy Davis, Dorottya Demszky, Chris Donahue, Moussa Doumbou...

    arXiv 2021

  5. [5]

    Elasticface: Elastic margin loss for deep face recognition

    Fadi Boutros, Naser Damer, Florian Kirchbuchner, and Ar- jan Kuijper. Elasticface: Elastic margin loss for deep face recognition. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 1578–1587,

    work page

  6. [6]

    Tom B. Brown, Benjamin Mann, Nick Ryder, Melanie Sub- biah, Jared Kaplan, Prafulla Dhariwal, Arvind Neelakan- tan, Pranav Shyam, Girish Sastry, Amanda Askell, Sand- hini Agarwal, Ariel Herbert-V oss, Gretchen Krueger, Tom Henighan, Rewon Child, Aditya Ramesh, Daniel M. Ziegler, Jeffrey Wu, Clemens Winter, Christopher Hesse, Mark Chen, Eric Sigler, Mateusz...

    work page 2020

  7. [7]

    Unveiling the two-faced truth: Disentangling morphed identities for face morphing detection

    Eduarda Caldeira, Pedro C Neto, Tiago Gonc ¸alves, Naser Damer, Ana F Sequeira, and Jaime S Cardoso. Unveiling the two-faced truth: Disentangling morphed identities for face morphing detection. In 2023 31st European Signal Process- ing Conference (EUSIPCO), pages 955–959. IEEE, 2023. 1, 2, 5, 8

    work page 2023

  8. [8]

    Adapting vision foundation models for plant pheno- typing

    Feng Chen, Mario Valerio Giuffrida, and Sotirios A Tsaf- taris. Adapting vision foundation models for plant pheno- typing. In Proceedings of the IEEE/CVF International Con- ference on Computer Vision, pages 604–613, 2023. 3, 7

    work page 2023

Show all 56 references
  1. [9]

    Adaptformer: Adapting vision transformers for scalable visual recogni- tion

    Shoufa Chen, Chongjian Ge, Zhan Tong, Jiangliu Wang, Yibing Song, Jue Wang, and Ping Luo. Adaptformer: Adapting vision transformers for scalable visual recogni- tion. Advances in Neural Information Processing Systems , 35:16664–16678, 2022. 2, 4

    2022

  2. [10]

    Vision transformer adapter for dense predictions

    Zhe Chen, Yuchen Duan, Wenhai Wang, Junjun He, Tong Lu, Jifeng Dai, and Yu Qiao. Vision transformer adapter for dense predictions. arXiv preprint arXiv:2205.08534, 2022. 2, 4

    2022 arXiv

  3. [11]

    Froun- dation: Are foundation models ready for face recognition? arXiv preprint arXiv:2410.23831, 2024

    Tahar Chettaoui, Naser Damer, and Fadi Boutros. Froun- dation: Are foundation models ready for face recognition? arXiv preprint arXiv:2410.23831, 2024. 1, 2, 3, 4, 5, 6, 7

    2024 arXiv

  4. [12]

    Detect- ing face morphing attacks by analyzing the directed distances of facial landmarks shifts

    Naser Damer, Viola Boller, Yaza Wainakh, Fadi Boutros, Philipp Terh¨orst, Andreas Braun, and Arjan Kuijper. Detect- ing face morphing attacks by analyzing the directed distances of facial landmarks shifts. In Pattern Recognition: 40th Ger- man Conference, GCPR 2018, Stuttgart,...

    2018

  5. [13]

    Mordiff: Recognition vul- nerability and attack detectability of face morphing attacks created by diffusion autoencoders

    Naser Damer, Meiling Fang, Patrick Siebke, Jan Niklas Kolf, Marco Huber, and Fadi Boutros. Mordiff: Recognition vul- nerability and attack detectability of face morphing attacks created by diffusion autoencoders. In 2023 11th Interna- tional Workshop on Biometrics and Forensic...

    2023

  6. [14]

    Privacy-friendly synthetic data for the development of face morphing attack detectors

    Naser Damer, C ´esar Augusto Fontanillo L ´opez, Meiling Fang, No ´emie Spiller, Minh Vu Pham, and Fadi Boutros. Privacy-friendly synthetic data for the development of face morphing attack detectors. In CVPR Workshops , pages 1605–1616. IEEE, 2022. 5, 7, 8

    2022

  7. [15]

    Morgan: Recognition vulnerability and attack detectability of face morphing attacks created by gen- erative adversarial network

    Naser Damer, Alexandra Mosegui Saladie, Andreas Braun, and Arjan Kuijper. Morgan: Recognition vulnerability and attack detectability of face morphing attacks created by gen- erative adversarial network. In 2018 IEEE 9th international conference on biometrics theory, applicatio...

    2018

  8. [16]

    To detect or not to detect: The right faces to morph

    Naser Damer, Alexandra Mosegui Saladie, Steffen Zienert, Yaza Wainakh, Philipp Terh¨orst, Florian Kirchbuchner, and Arjan Kuijper. To detect or not to detect: The right faces to morph. In 2019 International Conference on Biometrics, ICB 2019, Crete, Greece, June 4-7, 2019, pag...

    2019

  9. [17]

    Pw-mad: Pixel- wise supervision for generalized face morphing attack detec- tion

    Naser Damer, No ´emie Spiller, Meiling Fang, Fadi Boutros, Florian Kirchbuchner, and Arjan Kuijper. Pw-mad: Pixel- wise supervision for generalized face morphing attack detec- tion. In Advances in Visual Computing: 16th International Symposium, ISVC 2021, Virtual Event, Octobe...

    2021

  10. [18]

    debruine/webmorph: Beta release 2

    Lisa DeBruine. debruine/webmorph: Beta release 2. Zenodo https://doi. org/10, 5281, 2018. 5

    2018

  11. [19]

    Face Research Lab Lon- don Set

    Lisa DeBruine and Benedict Jones. Face Research Lab Lon- don Set. 5 2017. 5

    2017

  12. [20]

    Arcface: Additive angular margin loss for deep face recognition

    Jiankang Deng, Jia Guo, Niannan Xue, and Stefanos Zafeiriou. Arcface: Additive angular margin loss for deep face recognition. In Proceedings of the IEEE/CVF con- ference on computer vision and pattern recognition , pages 4690–4699, 2019. 1

    2019

  13. [21]

    Unsuper- vised face morphing attack detection via self-paced anomaly detection

    Meiling Fang, Fadi Boutros, and Naser Damer. Unsuper- vised face morphing attack detection via self-paced anomaly detection. In 2022 IEEE International Joint Conference on Biometrics (IJCB), pages 1–11. IEEE, 2022. 1, 2

    2022

  14. [22]

    Iris-sam: Iris seg- mentation using a foundational model

    Parisa Farmanifard and Arun Ross. Iris-sam: Iris seg- mentation using a foundational model. arXiv preprint arXiv:2402.06497, 2024. 1, 2, 3

    2024 arXiv

  15. [23]

    The magic passport

    Matteo Ferrara, Annalisa Franco, and Davide Maltoni. The magic passport. In IJCB, pages 1–7. IEEE, 2014. 1

    2014

  16. [24]

    On the effects of image alterations on face recognition accuracy

    Matteo Ferrara, Annalisa Franco, and Davide Maltoni. On the effects of image alterations on face recognition accuracy. Face recognition across the imaging spectrum , pages 195– 222, 2016. 2

    2016

  17. [25]

    Lora: Low-rank adaptation of large language models

    Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen- Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. Lora: Low-rank adaptation of large language models. arXiv preprint arXiv:2106.09685, 2021. 2, 3, 4

    2021 arXiv

  18. [26]

    Adaptive transformers for robust few-shot cross-domain face anti-spoofing

    Hsin-Ping Huang, Deqing Sun, Yaojie Liu, Wen-Sheng Chu, Taihong Xiao, Jinwei Yuan, Hartwig Adam, and Ming- Hsuan Yang. Adaptive transformers for robust few-shot cross-domain face anti-spoofing. In ECCV (13) , volume 13673 of Lecture Notes in Computer Science , pages 37–54. Spr...

    2022

  19. [27]

    Syn-mad 2022: Competition on face morphing attack detec- tion based on privacy-aware synthetic training data

    Marco Huber, Fadi Boutros, Anh Thi Luu, Kiran Raja, Raghavendra Ramachandra, Naser Damer, Pedro C Neto, Tiago Gonc ¸alves, Ana F Sequeira, Jaime S Cardoso, et al. Syn-mad 2022: Competition on face morphing attack detec- tion based on privacy-aware synthetic training data. In 2...

    2022

  20. [28]

    ISO/IEC DIS 30107-3:2016: Information Technology – Biometric presen- tation attack detection – P

    International Organization for Standardization. ISO/IEC DIS 30107-3:2016: Information Technology – Biometric presen- tation attack detection – P. 3: Testing and reporting, 2017. 6

    2016

  21. [29]

    ISO/IEC DIS 20059: Information technology — Methodologies to evalu- ate the resistance of biometric recognition systems to mor- phing attacks, 2023

    International Organization for Standardization. ISO/IEC DIS 20059: Information technology — Methodologies to evalu- ate the resistance of biometric recognition systems to mor- phing attacks, 2023. 3, 6

    2023

  22. [30]

    Face morphing attack detection using privacy-aware training data

    Marija Ivanovska, Andrej Kronovsek, Peter Peer, Vitomir Struc, and Borut Batagelj. Face morphing attack detection using privacy-aware training data. CoRR, abs/2207.00899,

    arXiv

  23. [31]

    Face morphing attack detection with denoising diffusion probabilistic models

    Marija Ivanovska and Vitomir Struc. Face morphing attack detection with denoising diffusion probabilistic models. In 11th International Workshop on Biometrics and Forensics, IWBF 2023, Barcelona, Spain, April 19-20, 2023 , pages 1–

    2023

  24. [32]

    A rank stabilization scaling factor for fine-tuning with lora

    Damjan Kalajdzievski. A rank stabilization scaling factor for fine-tuning with lora. arXiv preprint arXiv:2312.03732,

    arXiv

  25. [33]

    Training generative adver- sarial networks with limited data

    Tero Karras, Miika Aittala, Janne Hellsten, Samuli Laine, Jaakko Lehtinen, and Timo Aila. Training generative adver- sarial networks with limited data. In NeurIPS, 2020. 5

    2020

  26. [34]

    Segment any- thing

    Alexander Kirillov, Eric Mintun, Nikhila Ravi, Hanzi Mao, Chloe Rolland, Laura Gustafson, Tete Xiao, Spencer White- head, Alexander C Berg, Wan-Yen Lo, et al. Segment any- thing. In Proceedings of the IEEE/CVF International Con- ference on Computer Vision, pages 4015–4026, 202...

    2023

  27. [35]

    Decoupled weight de- cay regularization

    Ilya Loshchilov and Frank Hutter. Decoupled weight de- cay regularization. In International Conference on Learning Representations, 2019. 6

    2019

  28. [36]

    Au- tomatic generation and detection of visually faultless fa- cial morphs

    Andrey Makrushin, Tom Neubert, and Jana Dittmann. Au- tomatic generation and detection of visually faultless fa- cial morphs. In VISIGRAPP (6: VISAPP) , pages 39–50. SciTePress, 2017. 1

    2017

  29. [37]

    Face morph using opencv — c++ / python

    Satya Mallick. Face morph using opencv — c++ / python. LearnOpenCV, 1(1), 2016. 5

    2016

  30. [38]

    Orthomad: Morph- ing attack detection through orthogonal identity disentangle- ment

    Pedro C Neto, Tiago Gonc ¸alves, Marco Huber, Naser Damer, Ana F Sequeira, and Jaime S Cardoso. Orthomad: Morph- ing attack detection through orthogonal identity disentangle- ment. In 2022 International Conference of the Biometrics Special Interest Group (BIOSIG), pages 1–5. I...

    2022

  31. [39]

    Extended stirtrace bench- marking of biometric and forensic qualities of morphed face images

    Tom Neubert, Andrey Makrushin, Mario Hildebrandt, Chris- tian Kraetzer, and Jana Dittmann. Extended stirtrace bench- marking of biometric and forensic qualities of morphed face images. IET Biometrics, 7(4):325–332, 2018. 5

    2018

  32. [40]

    Dinov2: Learning robust visual features without supervision

    Maxime Oquab, Timoth ´ee Darcet, Th ´eo Moutakanni, Huy V o, Marc Szafraniec, Vasil Khalidov, Pierre Fernandez, Daniel Haziza, Francisco Massa, Alaaeldin El-Nouby, et al. Dinov2: Learning robust visual features without supervision. arXiv preprint arXiv:2304.07193, 2023. 1, 2, 3

    2023 arXiv

  33. [41]

    Arc2face: A foundation model for id-consistent human faces

    Foivos Paraperas Papantoniou, Alexandros Lattas, Stylianos Moschoglou, Jiankang Deng, Bernhard Kainz, and Stefanos Zafeiriou. Arc2face: A foundation model for id-consistent human faces. In Proceedings of the European Conference on Computer Vision (ECCV), 2024. 1, 2, 3

    2024

  34. [42]

    Diffusion autoen- coders: Toward a meaningful and decodable representation

    Konpat Preechakul, Nattanat Chatthee, Suttisak Wizad- wongsa, and Supasorn Suwajanakorn. Diffusion autoen- coders: Toward a meaningful and decodable representation. In CVPR. IEEE, 2022. 5

    2022

  35. [43]

    Facemorpher, 2019

    Alyssa Quek. Facemorpher, 2019. 5

    2019

  36. [44]

    Depth-guided robust face morphing attack detection

    Harsh Rachalwar, Meiling Fang, Naser Damer, and Abhijit Das. Depth-guided robust face morphing attack detection. In IJCB, pages 1–9. IEEE, 2023. 7, 8

    2023

  37. [45]

    Learning transferable visual models from natural language supervi- sion

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervi- sion. In International conference on machine learning, ...

    2021

  38. [46]

    Detecting face morphing attacks with collaborative representation of steerable features

    Raghavendra Ramachandra, Sushma Venkatesh, Kiran Raja, and Christoph Busch. Detecting face morphing attacks with collaborative representation of steerable features. In Pro- ceedings of 3rd International Conference on Computer Vi- sion and Image Processing: CVIP 2018, Volume 1 ...

    2018

  39. [47]

    Sam 2: Segment anything in images and videos

    Nikhila Ravi, Valentin Gabeur, Yuan-Ting Hu, Ronghang Hu, Chaitanya Ryali, Tengyu Ma, Haitham Khedr, Roman R¨adle, Chloe Rolland, Laura Gustafson, et al. Sam 2: Segment anything in images and videos. arXiv preprint arXiv:2408.00714, 2024. 1

    2024 arXiv

  40. [48]

    Vulnerability analysis of face morphing attacks from landmarks and generative adversarial networks

    Eklavya Sarkar, Pavel Korshunov, Laurent Colbois, and S´ebastien Marcel. Vulnerability analysis of face morphing attacks from landmarks and generative adversarial networks. CoRR, abs/2012.05344, 2020. 5, 8

    2012 arXiv

  41. [49]

    On the vulnerability of face recognition systems to- wards morphed face attacks

    Ulrich Scherhag, Ramachandra Raghavendra, Kiran B Raja, Marta Gomez-Barrero, Christian Rathgeb, and Christoph Busch. On the vulnerability of face recognition systems to- wards morphed face attacks. In 2017 5th international work- shop on biometrics and forensics (IWBF), pages ...

    2017

  42. [50]

    Accurate and robust neural networks for face mor- phing attack detection

    Clemens Seibold, Wojciech Samek, Anna Hilsmann, and Pe- ter Eisert. Accurate and robust neural networks for face mor- phing attack detection. J. Inf. Secur. Appl., 53:102526, 2020. 5

    2020

  43. [51]

    Fixing the train-test resolution discrepancy.Advances in neural information processing systems, 32, 2019

    Hugo Touvron, Andrea Vedaldi, Matthijs Douze, and Herv ´e J´egou. Fixing the train-test resolution discrepancy.Advances in neural information processing systems, 32, 2019. 5

    2019

  44. [52]

    Raja, Naser Damer, and Christoph Busch

    Sushma Venkatesh, Haoyu Zhang, Raghavendra Ramachan- dra, Kiran B. Raja, Naser Damer, and Christoph Busch. Can GAN generated morphs threaten face recognition systems equally as landmark based morphs? - vulnerability and de- tection. In IWBF, pages 1–6. IEEE, 2020. 5

    2020

  45. [53]

    SAM meets robotic surgery: An empirical study on generalization, robustness and adaptation

    An Wang, Mobarakol Islam, Mengya Xu, Yang Zhang, and Hongliang Ren. SAM meets robotic surgery: An empirical study on generalization, robustness and adaptation. CoRR, abs/2308.07156, 2023. 2

    2023 arXiv

  46. [54]

    Learning to adapt foundation model dinov2 for capsule en- doscopy diagnosis

    Bowen Zhang, Ying Chen, Long Bai, Yan Zhao, Yuxiang Sun, Yixuan Yuan, Jianhua Zhang, and Hongliang Ren. Learning to adapt foundation model dinov2 for capsule en- doscopy diagnosis. arXiv preprint arXiv:2406.10508, 2024. 3, 7

    2024 arXiv

  47. [55]

    Generalized single-image-based morph- ing attack detection using deep representations from vision transformer

    Haoyu Zhang, Raghavendra Ramachandra, Kiran Raja, and Christoph Busch. Generalized single-image-based morph- ing attack detection using deep representations from vision transformer. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) Wor...

    2024

  48. [56]

    MIPGAN - generating strong and high quality mor- phing attacks using identity prior driven GAN

    Haoyu Zhang, Sushma Venkatesh, Raghavendra Ramachan- dra, Kiran Bylappa Raja, Naser Damer, and Christoph Busch. MIPGAN - generating strong and high quality mor- phing attacks using identity prior driven GAN. IEEE Trans. Biom. Behav. Identity Sci., 3(3):365–383, 2021. 1, 5

    2021

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.