PaperlayerView exact revision on arXiv

Source-linked AI summary

Printed and Scanned: Exposing the Fragility of Single-Image Morphing Attack Detectors under Print-Scan Degradation

Diogo J. Paulo, Hugo Proença, João C. Neves

arXiv:2610.35682v1cs.CV

TL;DR

Digital-only benchmarks leave limited evidence about S-MAD performance on print-scanned photographs, despite such acquisition in some document-application workflows. The paper creates a paired print-scan SYN-MAD22 dataset and evaluates digitally trained detectors; average EER rises more than threefold, with degradation also observed using a second scanner.

  • Problem

    Most S-MAD benchmarks evaluate digital images, leaving print-scan acquisition conditions unaccounted for in workflows where submitted photographs are printed and scanned.

    Source: §I · pp. 1–2

  • Method

    The paper constructs MAD22-PS by printing and scanning SYN-MAD22 images at 300 and 600 DPI, then evaluates eight digitally trained S-MAD detectors and repeats acquisition with a second scanner.

    Source: §I · p. 2, B. S-MAD Models · p. 5

  • Results

    Average EER across eight detectors rises from 11.00% on digital images to 41.85% after print-scanning, with the overall degradation pattern validated using a second scanner.

    Source: §I · p. 2

  • Takeaways & Limitations

    Digital-benchmark performance does not transfer reliably to print-scanned images, and print-scanned morphs remain highly effective against the evaluated face-recognition systems.

    Source: §VI · p. 8, §VII · p. 8

    The study uses one printer, and its test-only protocol measures digitally trained detectors rather than performance after print-scan-aware adaptation.

    Source: §VI · p. 8

Abstract

from arXiv · show

Face morphing attacks, in which the biometric traits of two or more identities are blended into a single face image, pose a severe threat to identity document issuance and automated border control. Consequently, a large body of work has proposed Single-image Morphing Attack Detection (S-MAD) algorithms and benchmarked them on datasets such as SYN-MAD22. However, the majority of these benchmarks operate exclusively in the digital domain, which contrasts with the real-world passport issuance pipeline in some countries, which still requires an applicant-supplied photograph to be printed and subsequently re-scanned before it is embedded in the identity document or fed into an automated verification system. This print-scan step introduces halftoning, resampling, color-space, and sensor noise that are absent from digital pipelines, and may mask the high-frequency artifacts that S-MAD models rely on. In this work, we introduce a print-scan version of the SYN-MAD22 dataset, obtained by printing and re-scanning all bona fide and morphed images at 300 and 600 DPI, and we use it to evaluate eight state-of-the-art S-MAD models trained exclusively on digital data. We additionally repeat the acquisition with a second scanner to assess cross-device robustness. Our results show that detectors that achieve near state-of-the-art performance in the digital domain suffer a more than threefold increase in average equal error rate, with the same qualitative degradation observed across both scanning devices, exposing a critical, previously under-reported gap between digital-benchmark performance and robustness to print-scan degradation.

I. INTRODUCTION

Digital-only S-MAD benchmarks do not capture print-scan acquisition, which alters image statistics that detectors may rely on. The paper introduces a paired SYN-MAD22 print-scan benchmark and finds substantial degradation across detectors, with effects varying by morphing algorithm.

I. INTRODUCTION

  • S-MAD is relevant at document application, where the submitted photograph may need assessment before a trusted live reference is available.A morphed document photograph may be used by a contributing accomplice to cross automated border control.Source: §I · p. 1
  • Print-scan acquisition introduces halftoning, paper scatter, resampling, and sensor noise that alter image statistics on which S-MAD systems may rely.The reported spatial changes between digital and print-scanned images are larger than differences between the 300 and 600 DPI scans.Source: Figure 1 · p. 1, §I · p. 2
  • The study builds a paired print-scan counterpart of SYN-MAD22 [16], printing and scanning bona fide and morphed images at 300 and 600 DPI.The dataset is designed as a test-only benchmark for reproducible evaluation across six morph-generation algorithms without training or fine-tuning on it.Source: §I · p. 2
  • Average EER across eight S-MAD detectors rises from 11.00% on digital images to 41.85% after print-scanning.FD-MAD increases from 5.10% to 77.51% EER.Source: §I · p. 2
  • Degradation depends strongly on the morph-generation algorithm, while changing resolution from 300 to 600 DPI has little effect on average performance.The overall degradation pattern is also observed with a second scanner; print-scanned morphs remain highly effective against four face-recognition systems.Source: §I · p. 2

II. RELATED WORK

Prior work spans diverse morph generators and single-image detectors, while print-scan studies include both vulnerability evaluations and mitigation approaches. This paper extends that literature with an open, test-only benchmark and a broader detector, scanner, and face-recognition evaluation.

II. RELATED WORK

  • Morphs span landmark-based methods, GAN approaches, [38], and diffusion models [5], [2], whose differing artifacts matter because detectors may generalize poorly across algorithms.Broader biometric work also documents accuracy degradation under acquisition conditions such as occlusions and sunglasses [20],.Source: §II · pp. 2–3
  • Prior S-MAD work ranges from handcrafted texture descriptors and deep networks to identity-disentanglement, foundation-model, self-supervised, and frequency-domain approaches.SYN-MAD 2022 [16] provided a standardized benchmark with bona fide images and morphs from varied algorithms.Source: §II · p. 2
  • Print-scan MAD research has examined detection and face-recognition vulnerability, while later work has also explored simulated-data training and ViT- and CLIP-based detectors.NIST FRVT MORPH reported high false-detection rates on print-scanned bona fide images for most submitted algorithms.Source: §II · pp. 2–3
  • MAD22-PS extends prior print-scan studies by evaluating eight off-the-shelf S-MAD detectors across two scanners, two resolutions, six morph generators, and four face-recognition systems.It preserves SYN-MAD22 subjects, morph pairs, and protocol [16], and is described as the only publicly released resource among those compared.Source: §II · p. 3

III. PRINT-SCANNED SYN-MAD22 DATASET

MAD22-PS is a physical print-scan extension of SYN-MAD22 [16] that preserves its underlying samples and morph-generation methods while adding controlled acquisition conditions.

III. PRINT-SCANNED SYN-MAD22 DATASET

  • MAD22-PS contains 5,687 images: 204 bona fide and 5,483 morphed samples.The morphed images use OpenCV, FaceMorpher, WebMorph, MIPGAN-I, MIPGAN-II [38], and MorDIFF [5].Source: §III · p. 3
  • The dataset pairs original digital images with corresponding physical print-scanned versions acquired at 300 and 600 DPI.It preserves SYN-MAD22 [16] subjects, bona fide samples, and morph-generation methods while introducing controlled physical acquisition conditions.Source: §III · p. 3
  • MAD22-PS satisfies ICAO passport-photo compliance constraints and includes images generated using six listed morphing methods.The methods are OpenCV, FaceMorpher, WebMorph, MIPGAN-I, MIPGAN-II [38], and MorDIFF [5].Source: §III · p. 3

A. Print-Scan Acquisition Protocol

The acquisition protocol physically prints SYN-MAD22 images, scans them at two resolutions, and processes the resulting images for paired detector evaluation. A second scanner is used to assess cross-device robustness.

A. Print-Scan Acquisition Protocol

  • Every selected SYN-MAD22 image is physically printed and re-scanned following a fixed acquisition pipeline.The pipeline arranges four images per A4 sheet, associates QR metadata, and scans at 300 and 600 DPI before detection, cropping, and alignment.Source: A. Print-Scan Acquisition Protocol · p. 3, Figure 2 · p. 4
  • Four photographs are printed per A4 sheet on 180 g/m2 glossy photo paper at 70×100 mm using a Xerox PrimeLink C9065.QR codes encode source-image filename, extension, and morph-generation algorithm, but are excluded from evaluation crops.Source: A. Print-Scan Acquisition Protocol · p. 3
  • The sheets are scanned at 300 and 600 DPI in 24-bit RGB, with the acquisition repeated at both resolutions on a second scanner.The main-paper analyses use the C250i acquisition unless otherwise stated; the C450i acquisition serves as a cross-scanner check.Source: A. Print-Scan Acquisition Protocol · pp. 3–4
  • Recovered photographs are matched to their digital originals, rotation-corrected, and cropped identically for S-MAD evaluation without denoising or enhancement.The crop protocol follows [6], preserving photometric characteristics introduced by print-scan processing.Source: A. Print-Scan Acquisition Protocol · p. 4

B. Resulting Dataset Statistics

MAD22-PS preserves the same source-image composition across its digital and four physical print-scan conditions, covering two scanners and two resolutions.

B. Resulting Dataset Statistics

  • Each of the five acquisition conditions contains the same 204 bona fide and 5,483 morphed samples, for 28,435 image instances overall.Source: B. Resulting Dataset Statistics · p. 4
  • The dataset represents 5,687 source images across the original digital condition and four print-scan conditions.Source: B. Resulting Dataset Statistics · p. 4
  • The four physical conditions use two scanners, C250I and C450I, at 300 and 600 DPI, and include morphs from six generation algorithms.Source: Table II · p. 4

C. Availability and Licensing

MAD22-PS re-digitizes existing images without adding identities and is intended to support evaluation of print-scan effects on detection and attack performance.

C. Availability and Licensing

A. Research Questions

  • The evaluation asks how print-scanning affects detector accuracy, whether resolution or morph-generation algorithm changes that degradation, and whether detection changes correspond to attack effectiveness against face recognition.Source: A. Research Questions · p. 5

B. S-MAD Models

The study tests eight digitally trained S-MAD detectors without adaptation on print-scanned data, reporting detection and face-recognition attack metrics across acquisition conditions.

B. S-MAD Models

  • Eight representative S-MAD detectors spanning lightweight CNNs, identity disentanglement, PCA, foundation models, Fourier features, and self-supervised methods are evaluated using digital-only training.The fixed protocol prohibits training, fine-tuning, or threshold selection on MAD22-PS, preserving an out-of-domain evaluation.Source: B. S-MAD Models · p. 5

C. Evaluation Protocol and Metrics

V. RESULTS

  • The results address overall detector degradation, resolution differences, and morph-algorithm effects, then report EER for eight S-MAD models and MMPMR for four face-recognition models.Source: §V · p. 5

A. RQ1: Overall Impact of Print-Scanning

Across eight detectors and six morphing algorithms, print-scanning sharply raises EER relative to digital evaluation, with detector sensitivity varying substantially.

A. RQ1: Overall Impact of Print-Scanning

  • Every detector's EER increases after print-scanning; FD-MAD rises from 5.10% digitally to 77.51% at PS600 and 75.58% at PS300.The authors relate FD-MAD's sensitivity to halftoning, resampling, and anti-aliasing perturbing the mid-to-high spatial frequencies used by its residual Fourier features.Source: A. RQ1: Overall Impact of Print-Scanning · pp. 5–6
  • SelfMAD++ has the smallest reported degradation, with EER rising from 1.06% digitally to 7.27% at PS600 and 8.41% at PS300.Source: A. RQ1: Overall Impact of Print-Scanning · p. 5
  • 41.85% at 600 DPI and 41.72% at 300 DPI, versus 11.00% digitally, are the average EERs across eight detectors and six morphing algorithms.These increases are +280% and +279%, respectively; Table III reports detector EERs across the digital, PS600, and PS300 conditions.Source: A. RQ1: Overall Impact of Print-Scanning · p. 5, Table III · p. 6

B. RQ2: Effect of Scanning Resolution

Across RQ2 and RQ3, print-scan degradation persists across scanners and DPI settings, while its magnitude varies substantially by morph-generation algorithm.

B. RQ2: Effect of Scanning Resolution

  • 0.13 percentage points separated panel-averaged EER at 600 DPI (41.85%) and 300 DPI (41.72%), and four of eight detectors were marginally more accurate at 300 DPI.MixFaceNet-MAD recorded 36.83% at PS600 versus 31.21% at PS300.Source: B. RQ2: Effect of Scanning Resolution · p. 6
  • Across both scanners and both resolutions, average EER rises relative to digital acquisition, so the degradation is not specific to one scanner or DPI.The precise EER values vary between devices.Source: B. RQ2: Effect of Scanning Resolution · p. 7

C. RQ3: Effect of the Morphing Algorithm

  • FaceMorpher’s average EER rose from 0.70% digitally to 25.90% at PS600 and 24.12% at PS300, a more than 30-fold increase.Source: C. RQ3: Effect of the Morphing Algorithm · p. 7
  • MorDIFF [5] rose from 5.78% digital EER to 60.73% at PS600 and 61.29% at PS300, the highest average print-scan EER among evaluated algorithms.Source: C. RQ3: Effect of the Morphing Algorithm · p. 7
  • Print-scanning modifies residual texture and frequency information; image-level and landmark-based morphs remain comparatively more detectable, yet still degrade across every detector.The passage attributes the effect for GAN-based morphs to their reduced low-level blending artifacts and print-scan transformations.Source: C. RQ3: Effect of the Morphing Algorithm · p. 7

D. Attack Success vs. Detection Failure

Print-scanned morphs remain effective against face-recognition systems even as S-MAD detection degrades. The reported MMPMR results cover four recognition models and two FMR operating points.

VI. DISCUSSION

The discussion concludes that digital-benchmark performance does not transfer to MAD22-PS conditions, while print-scanning makes attacks harder to detect without reducing their effectiveness against face recognition. It outlines evaluation and detector-development directions and identifies limits in hardware coverage and adaptation.

VI. DISCUSSION

  • The authors recommend reporting print-scanned test performance alongside digital results; increased DPI alone is ineffective, and degradation occurred with both scanners.Source: §VI · p. 8
  • Print-scanning degrades S-MAD performance while preserving morph effectiveness against downstream face-recognition systems under the MAD22-PS conditions.Source: §VI · p. 8
  • The proposed research directions are print-scan-aware data augmentation and detectors or simulation modules invariant to halftoning and resampling while retaining sensitivity to morph artifacts.Source: §VI · p. 8
  • The study uses one printer and excludes training or fine-tuning on MAD22-PS, so it measures digitally trained detectors’ generalization rather than print-scan-aware adaptation.Different hardware or paper stocks could produce different degradation profiles.Source: §VI · p. 8

VII. CONCLUSION

  • Average EER increased from 11.00% digitally to approximately 42.00% after print-scanning, showing that digital-only benchmarks can overestimate operational robustness.Source: §VII · p. 8

Related papers

Loading 2610.35682v1…