MorphGuard: Morph Specific Margin Loss for Enhancing Robustness to Face Morphing Attacks

TL;DR

MorphGuard reframes face recognition training to address morphing attacks by introducing a dual-branch classifier and a morph-specific margin loss that assigns two ground-truth labels to morph samples. The method enforces distinct feature regions for morphs and bona fide images, with the morph margin $m_{MG}$ configurable as positive or negative to balance separation and convergence, and demonstrated to improve robustness on MorFacing benchmarks. Through extensive experiments, including a data-curation pipeline inspired by MorDeephy and a two-stage pretrained-model adaptation, the approach yields tighter morph distributions and enhanced MMPMR/RMMR metrics, while maintaining or improving standard verification performance. The framework is designed to be universal and integrable into existing ArcFace-style pipelines, offering a practical defense against morphing attacks in real-world deployments.

Abstract

Face recognition has evolved significantly with the advancement of deep learning techniques, enabling its widespread adoption in various applications requiring secure authentication. However, this progress has also increased its exposure to presentation attacks, including face morphing, which poses a serious security threat by allowing one identity to impersonate another. Therefore, modern face recognition systems must be robust against such attacks. In this work, we propose a novel approach for training deep networks for face recognition with enhanced robustness to face morphing attacks. Our method modifies the classification task by introducing a dual-branch classification strategy that effectively handles the ambiguity in the labeling of face morphs. This adaptation allows the model to incorporate morph images into the training process, improving its ability to distinguish them from bona fide samples. Our strategy has been validated on public benchmarks, demonstrating its effectiveness in enhancing robustness against face morphing attacks. Furthermore, our approach is universally applicable and can be integrated into existing face recognition training pipelines to improve classification-based recognition methods.

Figures (9)

• Figure 1: Schematic of the proposed training method. For simplicity of visualization batch contains a single image. In case of Morph sample Loss Function for Class Layers 1 and 2 is computed with different margin for $\dot{y}$ and $\ddot{y}$ classes. In case of Bona Fide Sample the $\dot{y}$ and $\ddot{y}$ are equal and ground truth, thus margins are not applied for their respective classes. Labels $\dot{y}$ and $\ddot{y}$ are indicated by names (the real setup utilizes their numerical index value, which is encoded to one-hot vector).
• Figure 2: Desired feature distribution of proposed method. $m_{M}$ and $m_{BF}$ indicate the margin between the classes for Morphs and Bona Fides.
• Figure 3: ROC curves for the 1-1 verification performance on LFW (a) and 1-1 MorFacing protocol(b)
• Figure 4: MMPMR for different models and protocols as a dependency from FNMR. For convenience vertical axis is plotted as 1-MMPMR (higher values → better robustness). a - LDM Raw Protocol, b - LDM protocol; c - DiffAE Protocol, d - STG Protocol, e - NIM S. Mix Protocol, f - NIM DiffAE Protocol.
• Figure 5: RMMR for different models and protocols as a dependency from similarity threshold. a - LDM Raw Protocol, b - LDM protocol; c - DiffAE Protocol, d - STG Protocol, e - NIM S. Mix Protocol, f - NIM DiffAE Protocol.