Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Evaluating the Effectiveness of Attack-Agnostic Features for Morphing Attack Detection

Laurent Colbois, Sébastien Marcel

Abstract

Morphing attacks have diversified significantly over the past years, with new methods based on generative adversarial networks (GANs) and diffusion models posing substantial threats to face recognition systems. Recent research has demonstrated the effectiveness of features extracted from large vision models pretrained on bonafide data only (attack-agnostic features) for detecting deep generative images. Building on this, we investigate the potential of these image representations for morphing attack detection (MAD). We develop supervised detectors by training a simple binary linear SVM on the extracted features and one-class detectors by modeling the distribution of bonafide features with a Gaussian Mixture Model (GMM). Our method is evaluated across a comprehensive set of attacks and various scenarios, including generalization to unseen attacks, different source datasets, and print-scan data. Our results indicate that attack-agnostic features can effectively detect morphing attacks, outperforming traditional supervised and one-class detectors from the literature in most scenarios. Additionally, we provide insights into the strengths and limitations of each considered representation and discuss potential future research directions to further enhance the robustness and generalizability of our approach.

Evaluating the Effectiveness of Attack-Agnostic Features for Morphing Attack Detection

Abstract

Morphing attacks have diversified significantly over the past years, with new methods based on generative adversarial networks (GANs) and diffusion models posing substantial threats to face recognition systems. Recent research has demonstrated the effectiveness of features extracted from large vision models pretrained on bonafide data only (attack-agnostic features) for detecting deep generative images. Building on this, we investigate the potential of these image representations for morphing attack detection (MAD). We develop supervised detectors by training a simple binary linear SVM on the extracted features and one-class detectors by modeling the distribution of bonafide features with a Gaussian Mixture Model (GMM). Our method is evaluated across a comprehensive set of attacks and various scenarios, including generalization to unseen attacks, different source datasets, and print-scan data. Our results indicate that attack-agnostic features can effectively detect morphing attacks, outperforming traditional supervised and one-class detectors from the literature in most scenarios. Additionally, we provide insights into the strengths and limitations of each considered representation and discuss potential future research directions to further enhance the robustness and generalizability of our approach.

Paper Structure

This paper contains 16 sections, 2 figures, 7 tables.

Table of Contents

  1. Introduction
  2. Related work
  3. Methodology
  4. Morph Datasets
  5. Evaluation Scenarios
  6. Models
  7. Probed Attack-Agnostic Models
  8. Reference MAD Models
  9. Results
  10. Baseline performance
  11. Generalization to unseen attacks
  12. Generalization to difference source datasets
  13. Generalization to print-scan data
  14. One-class detector
  15. Discussion
  16. ...and 1 more sections

Figures (2)

  • Figure 1: We tackle the problem of MAD using pretrained attack-agnostic extractors. Morph generation: we generate morphs using a variety of algorithms (landmark-based, GAN-based, and diffusion-based). Stage 1: the attack-agnostic extractor is a large vision model trained on real images for a pretext task. We reuse it to summarize any image by extracting an internal representation as the feature vector. Stage 2: features are extracted for bonafide images and face morphs. We train a supervised morphing attack detector as a linear SVM on top of this features space. We train a one-class detector by modeling the distribution of bonafide features with a GMM, then using the likelihood of incoming samples as the discriminative score.
  • Figure 2: Examples of generated morphs using as source dataset respectively FRGC (first row), FRLL (second row) and FFHQ (third row). The first and last column show the two real sources for which a morph must be created, and other columns show the results using each considered morphing algorithm.