On the Trustworthiness of Face Morphing Attack Detectors

Morphing attacks blend face images of multiple distinct identities into a single photo combining their facial characteristics. Since the morphed image can be verified to multiple identities, these attacks greatly threaten face recognition systems. Morphing Attack Detection (MAD), addresses this problem by determining if an image is a bona fide or morphed image. Previous works on MAD focused on the models’ decision to improve their performance and generalizability. However, it has not been investigated whether the estimated probabilities of such decisions accurately reflect the true confidence with which predictions are made. Since these models struggle with unseen attacks, it is important to determine the models’ decision confidence to decide to trust or distrust the decisions. In this work, we (a) demonstrate that state-of-the-art MAD models struggle with providing reliable confidence estimations, (b) propose two new metrics to categorize their confidence prediction behavior, and (c) demonstrate that a simple calibration method can make the model more trustworthy without changing general model performance. The experiments were conducted in cross-dataset evaluation settings across two different MAD models using three different preprocessing and five morphing generation techniques. We found that both models are not calibrated and therefore not trustworthy. Moreover, it is shown that a simple and effective adjustment of the prediction confidence is possible. This will make future presentation attack detection, and especially MAD, models more trustworthy.