When Morphs Look Better: Face Image Quality as a Training-Free Signal for Morphing Attack Detection

AI summary

Overview

Research area: Computer vision and biometrics — specifically face morphing attack detection (MAD) and face image quality assessment (FIQA), with an emphasis on presentation-attack security for face recognition.

Technical level: Intermediate. Readers should know roughly what face recognition embeddings and error-rate metrics are, but the paper's core argument (score direction matters) is explained in plain terms and is accessible without deep background.

Scope (one sentence): The paper benchmarks 17 pretrained face image quality methods as training-free morphing attack detectors across 20 attack sets from two datasets, using a fixed score direction per method, and shows that a strong quality gap between bona fide and morph images does not imply good detection.

What This Paper Is About

A face morph is an image built from two or more people's faces so that it can pass verification against each of them, letting one person travel on another person's document. Detecting these images normally requires training a classifier on known morph examples, which generalizes poorly to new morphing techniques. This paper asks whether an off-the-shelf face image quality model — trained only to predict how useful an image is for recognition, never shown a morph — can be used directly as a morph detector, and what happens when morphs actually score higher in quality than genuine images.

Key Contributions

1. A unified training-free evaluation. 17 FIQA methods spanning all four FIQA categories (supervised, unsupervised non-FR-model, unsupervised FR-probing, and self-supervised/FR-integrated) are evaluated as single-image MAD scores under one protocol, on 20 morphing attack sets from two datasets, including five diffusion-based attack sets that prior quality-based MAD work did not cover.

2. A fixed-direction protocol with a signed separation measure. Instead of inverting a quality score whenever that lowers error (as prior work did), each method's direction is fixed in advance from its published definition, and a signed separation S is reported. Negative S (morphs scoring higher quality than bona fide images) is thereby made visible rather than hidden.

3. Evidence that separation ≠ detection. The authors show that a large magnitude of separation can coexist with, and even characterize, the worst detection results — most clearly on diffusion-based attacks.

4. An analysis of the approach's limits: FIQA performance only moderately predicts MAD performance, detection varies strongly between datasets, and a threshold calibrated on one dataset's bona fide images does not transfer to the other.

Main Findings

• Best result on FRLL: DifFIQA(R) achieves a mean D-EER of 11.42% (95% confidence interval [9.0, 14.0]) and a mean MACER of 10.75% at the fixed BSCER ≈ 20% operating point. CLIB-FIQA (16.99% D-EER / 20.03% MACER) and eDifFIQA(L) (24.34% / 30.47%) follow; these three clearly outperform all other FIQA methods on that dataset.

• The fourth-ranked method collapses on the operating point: GraFIQs(L) has a mean D-EER of 33.85% but a mean MACER of 55.66%, showing that ranking by threshold-free and threshold-based metrics can diverge sharply.

• Reversals are common on diffusion-based attacks: On DCMorph, MorDIFF, and Arc2Morph, 11, 10, and 8 of the 17 methods respectively assign higher mean quality to morphs than to bona fide samples. On FEI, 10 of 17 reverse on both Arc2Morph and StableMorph, compared with at most 5 on any landmark-based FEI set. The GAN-based MIPGAN attacks show only 2 reversals each, so the "no blending artifacts" explanation alone does not account for the pattern.

• The biggest reversed separation coincides with the worst detector: On DCMorph, FROQ reaches S = −2.29 (and −2.14 on Arc2Morph) yet produces a DCMorph D-EER of 94.90%. Had the direction been flipped per attack, its DCMorph D-EER would have been 5.10% — better than the best fixed-direction result for that attack (9.20%, GraFIQs(L)). The authors argue this is exactly the kind of result that per-attack direction selection would misreport as success.

• Per-attack specialization is strong and hidden by averages: GraFIQs(L) is the best detector of DCMorph (9.20%) and Arc2Morph (5.66%) on FRLL, but performs poorly on the landmark-based and GAN-based attacks (D-EERs of 37.70%–61.20%). On FEI, ViTNT-FIQA — last on FRLL and 16th of 17 on FEI — is the best detector of Arc2Morph (10.0%) and StableMorph (20.9%), while DifFIQA(R) reverses on both (88.4% and 70.9%).

• Direction is not even consistent across datasets: DifFIQA(R) detects FRLL Arc2Morph at 6.36% D-EER but reverses on FEI Arc2Morph, although the authors note the two sets may differ in generation settings.

• FEI is much harder: The lowest mean D-EER on FEI is 39.75% and the lowest mean MACER is 58.96%, both from ViT-FIQA(T), whose D-EER confidence interval [37.3, 42.6] overlaps the next four methods. Separation on landmark-based FEI sets is weak, with |S| never exceeding 1.03. DifFIQA(R), the FRLL winner, reaches 44.25% mean D-EER on FEI.

• Thresholds do not transfer: Set at BSCER = 20% on FRLL, the thresholds of DifFIQA(R) and CLIB-FIQA yield a BSCER of 100% on FEI. Set on FEI, they yield a BSCER of 0% on FRLL with mean MACERs of 90.9% and 98.1%. For DifFIQA(R), the mean bona fide score is 0.86 on FEI versus 0.93 on FRLL.

• FIQA quality does not reliably predict MAD quality: Using the authors' own FIQA evaluation of 14 of the methods, the FIQA ranking correlates only moderately with the mean-D-EER ranking (Spearman ρ = 0.54, p = 0.047 on FRLL; ρ = 0.55, p = 0.043 on FEI). A leave-one-out analysis makes the correlation non-significant for 8 (FRLL) and 9 (FEI) of the 14 methods, and individual methods move by up to eight positions between the two rankings.

• Recent methods are not automatically better detectors: ViTNT-FIQA and FROQ rank last on FRLL, behind the oldest method, FaceQnet; PreFIQs, which reports state-of-the-art FIQA performance, ranks eighth of seventeen on FRLL and fourteenth on FEI.

• Reference point from a trained detector: SelfMAD++, listed for reference only and applied to 112×112 inputs upsampled to its 512×512 input, reaches a mean D-EER of 13.05% and mean MACER of 14.92% on FRLL, and 29.56% / 35.57% on FEI; it also has its highest FRLL D-EERs on DCMorph (48.60%) and Arc2Morph (35.25%), and exceeds 50% on FEI Arc2Morph (91.9%).

Methodology in Plain English

The idea is simple: take a quality model that was trained to say "how useful is this face image for recognizing someone," feed it a suspected image, and treat a low quality score as suspicious. No morph images are used for training; only a threshold is needed.

The crucial design choice is about direction. Most quality scores go up when an image is better, but a few — like an uncertainty estimate (PFE), a gradient magnitude (GraFIQs), or an embedding change under pruning (PreFIQs) — go up when an image is worse. The authors assign each of the 17 methods a fixed direction (+1 or −1) from its original publication, so 14 are used as-is and 3 are inverted, and they never change that choice per attack. This matters because earlier work flipped a score whenever flipping reduced the error, which requires knowing the attack in advance and can dress up a method that actually prefers morphs as a good detector.

To see the direction of the quality shift, they compute a Fisher-style separation between the bona fide and morph score distributions and attach a sign to it (S). Positive S means morphs score lower quality, as desired; negative S means morphs score higher, a reversal that is only visible with a fixed direction.

They then measure detection with standard ISO/IEC 20059 metrics: D-EER (the equal-error point, threshold-free) and MACER at a threshold set so that 20% of bona fide images are falsely rejected — the operating point used by the SYN-MAD 2022 benchmark. Since all attacks in a dataset share one bona fide set, that single threshold applies to every attack in it. Confidence intervals come from 1,000 bootstrap replicates that resample identities rather than images. They also cross-apply thresholds between datasets to test transferability.

Data: FRLL (204 bona fide images of 102 subjects, with FaceMorpher, OpenCV, WebMorph, MIPGAN-I, MIPGAN-II, plus DCMorph, MorDIFF, and Arc2Morph) and FEI-Morph V3 (200 bona fide images of 200 subjects and 12 morphing techniques, four of them generative), for 19,482 attacks total. All faces are aligned to 112×112 with MTCNN, and no morph-specific preprocessing or tuning is applied.

Why This Matters

Impact on research. The paper is a methodological correction as much as a benchmark. It shows that the common practice of picking the score direction that minimizes error can invert the meaning of a result, and it supplies a signed metric that keeps the failure mode visible. It also extends quality-based MAD to diffusion-generated morphs for the first time (to the authors' knowledge) and demonstrates that the "quality responds to morphing" argument is much weaker than a raw separation number suggests.

Real-world applications:

• Border control and e-passport issuance: flagging suspect enrolment or travel document photos without deploying a morph-specific classifier that may not cover a newly released generative model.
• Remote identity verification (eKYC): reusing an existing quality-assessment pipeline, already present in many face recognition stacks, as an additional liveness/document-integrity signal at no extra training cost.
• Triage in manual document inspection: ranking images so that human examiners look first at those whose quality scores are anomalous for the population.
• Security auditing of deployed face recognition: checking whether a vendor's own quality module systematically over-scores synthetic or morphed inputs.

Industry relevance. The main practical message is cautionary: a quality model's score shift is not a drop-in detector, the direction of the shift must be validated per method and per domain, and a threshold calibrated on one capture population will not transfer to another. For vendors and integrators this argues for in-domain calibration on held-out bona fide images and against assuming that newer or higher-ranked quality models make better morph detectors — in this study the oldest method, FaceQnet, outranked two of the newest on FRLL.

Future Directions

• Threshold calibration within a domain: test whether a threshold set on held-out bona fide images from the target domain generalizes to new images from that same domain — the cross-dataset failure here leaves this open.
• Explaining the direction of the response: determine which properties of a FIQA method cause it to score morphs higher rather than lower, so that methods can be chosen a priori instead of by trial on attack-labelled data.
• Method selection without attack labels: the paper identifies DifFIQA(R) as best on FRLL only by using the evaluation's attack labels; how a deployer would pick a method without attack data is explicitly left open.
• Combining quality filtering with trained detectors: since FIQA usually precedes MAD to reject low-quality samples, evaluate trained MAD detectors with and without such rejection on the retained samples.

Target Audience

Biometrics and face-recognition researchers working on morphing attack detection or presentation-attack security; practitioners who build or audit identity-verification pipelines and already run a FIQA module; and benchmark designers interested in evaluation protocol — particularly the argument that score direction must be fixed in advance and that signed separation should accompany error rates. Graduate students entering the field will find the FIQA taxonomy (four categories, 17 methods) and the ISO/IEC 20059 metric definitions a useful orientation, though the paper assumes some familiarity with D-EER-style metrics and face recognition embeddings.

Authors’ abstract

Face image quality assessment (FIQA) estimates the utility of a face image for automated face recognition and has been proposed as a morphing attack detection (MAD) signal that requires no morph-specific training. We evaluate 17 FIQA methods from all current FIQA categories on 20 morphing attack sets from two datasets, FRLL and FEI, including five diffusion-based attack sets. Each quality score is used directly as a MAD decision score. Unlike prior work, which inverted a quality measure when this lowered its error, we fix the score direction of each method in advance from its definition, so that cases in which morphs receive higher quality than bona fide samples remain visible. On FRLL, DifFIQA(R) achieves a mean D-EER of 11.42%, and together with CLIB-FIQA and eDifFIQA(L) clearly outperforms all other FIQA methods. A strong separation of bona fide and morph scores does not imply good detection performance: on the diffusion-based attacks, up to 11 of 17 methods assign higher quality to morphs than to bona fide samples, and the largest reversed separation in the study coincides with the worst detection result of the study. Performance also depends strongly on the attack: GraFIQs(L), the best detector of DCMorph and Arc2Morph on FRLL, performs poorly on the landmark-based and GAN-based attacks. On FEI, the lowest mean D-EER is 39.75%, and a threshold set on the bona fide data of one dataset does not transfer to the other.