Investigating new methods of creating face morphing attacks is essential to foresee novel attacks and help mitigate them. Creating morphing attacks is commonly either performed on the image-level or on the representation-level. The representation-level morphing has been performed so far based on generative adversarial networks (GAN) where the encoded images are interpolated in the latent space to produce a morphed image based on the interpolated vector. Such a process was constrained by the limited reconstruction fidelity of GAN architectures. Recent advances in the diffusion autoencoder models have overcome the GAN limitations, leading to high reconstruction fidelity. This theoretically makes them a perfect candidate to perform representation-level face morphing. This work investigates using diffusion autoencoders to create face morphing attacks by comparing them to a wide range of image-level and representation-level morphs. Our vulnerability analyses on four state-of-the-art face recognition models have shown that such models are highly vulnerable to the created attacks, the MorDIFF, especially when compared to existing representation-level morphs. Detailed detectability analyses are also performed on the MorDIFF, showing that they are as challenging to detect as other morphing attacks created on the image- or representation-level. Data and morphing script are made public.

翻译：研究面部变形攻击的新生成方法对于预见新型攻击并协助缓解其影响至关重要。变形攻击的生成通常基于图像层面或表征层面。目前，表征层面的变形主要依赖生成对抗网络（GAN），通过对编码图像在潜在空间中进行插值处理，基于插值向量生成变形图像。然而，此类过程受限于GAN架构有限的重建保真度。扩散自编码器模型的最新进展突破了GAN的局限性，实现了高重建保真度，理论上使其成为执行表征层面面部变形的理想候选方案。本研究通过将扩散自编码器生成的变形攻击与涵盖图像层面和表征层面的多种变形方法进行对比，系统探究了其应用效果。基于四种最新面部识别模型的脆弱性分析表明，此类模型对扩散自编码器生成的MorDIFF攻击（尤其是相较于现有表征层面变形）表现出高度脆弱性。此外，针对MorDIFF的详细可检测性分析显示，其检测难度与基于图像或表征层面生成的其他变形攻击相当。相关数据集及变形脚本已公开。