When Morphs Look Better: Face Image Quality as a Training-Free Signal for Morphing Attack Detection

When Morphs Look Better. Face Image Quality as a Training-Free Signal for Morphing Attack Detection. By Hao Peng and three others, from the Technical University of Darmstadt and the Fraunhofer Institute for Computer Graphics Research. Published on the fifteenth of October.

Face image quality assessment, or FIQA, estimates how useful a face image is for automated face recognition. It has been proposed as a signal for morphing attack detection, or MAD, with an attraction that is easy to see: it needs no training specific to morphs. This study puts that idea to a careful test, and its central claim cuts against the intuition behind it. Morphs do not reliably look worse. On some attacks, most quality methods rate the morph as better than the genuine image, and a strong separation between genuine and morph scores is no guarantee of good detection.

The evaluation covers seventeen FIQA methods, drawn from every current FIQA category, run against twenty morphing attack sets from two datasets, FRLL and FEI. Five of those sets are diffusion-based attacks. Each quality score is used directly as the detection score. The important design choice is the direction of that score. Prior work inverted a quality measure whenever doing so lowered its error. Here, each method's score direction is fixed in advance from its definition, so cases where morphs receive higher quality than bona fide samples stay visible instead of being quietly flipped.

On FRLL, DifFIQA R reaches a mean D-EER of eleven point four two percent. Together with CLIB-FIQA and eDifFIQA L, it clearly outperforms every other FIQA method. The diffusion-based attacks tell the other story. On those, up to eleven of the seventeen methods assign higher quality to morphs than to bona fide samples. The largest reversed separation anywhere in the study coincides with its worst detection result. A score that pulls the two groups far apart, but in the wrong direction, is exactly what a fixed score direction exposes.

The results are strongly attack-dependent. GraFIQs L is the best detector of DCMorph and Arc2Morph on FRLL, yet it performs poorly on the landmark-based and GAN-based attacks. So a method that wins on one family of morphs cannot be assumed to win on another. The second dataset is harder still. On FEI, the lowest mean D-EER of any method is thirty-nine point seven five percent. And a decision threshold set on the bona fide data of one dataset does not transfer to the other, which limits how far any single calibration can be carried.

Quality as a free detection signal works for some methods on some attacks, and the best of them do well on FRLL. But the study's central point is about method. By refusing to flip a score after seeing which way helps, it shows that diffusion-based morphs can look better than the real thing to quality measures, and that how far apart the scores sit says nothing on its own about which side the morphs land on.