Researchers affiliated with the University of Ljubljana and the Jožef Stefan Institute have published findings indicating that open-source multimodal large language models (MLLMs) can detect face morphing attacks without task-specific training, and that lightweight fine-tuning can push detection accuracy significantly further. The paper was submitted to arXiv on February 17, 2026.
Face morphing attacks involve blending two distinct facial identities into a single composite image that can pass as a genuine document photo, posing a fraud risk in identity document issuance and biometric onboarding workflows. The research presents what it describes as the first systematic zero-shot evaluation of open MLLMs for single-image morphing attack detection (MAD) using a reproducible evaluation protocol.
The study finds that LLaVA1.6-Mistral-7B achieves state-of-the-art performance in zero-shot MAD, surpassing task-specific detection baselines by at least 23 percent in terms of equal error rate (EER). EER is a standard metric for biometric system evaluation at the operating point where false acceptance and false rejection rates are equal; a lower EER indicates better detection performance.
Related work summarized through a Master’s thesis at the Jožef Stefan Institute’s Department of Knowledge Technologies evaluated additional open-source models—including Gemma-3 27B, Qwen2.5-VL 32B, Llama-4 Scout 17B, and Mistral Small 3.1 24B—across landmark-based, GAN-based, and diffusion-based morphing methods. That research developed a structured forensic prompt guiding models through a six-step procedure designed to systematically surface blending artifacts, improving both detection accuracy and interpretability.
Applying LoRA fine-tuning to Gemma-3 12B using only 0.61 percent of trainable parameters reduced average EER by more than half compared to the zero-shot baseline, with the paper reporting near-perfect detection on landmark-based morphs. “We developed a structured forensic prompt, which guides the models through a systematic six-step procedure,” the Jožef Stefan Institute research noted.
The findings are relevant for identity document issuers and biometric system operators assessing how general-purpose AI models might complement or replace dedicated morphing detectors. Morphing attacks have drawn growing attention from standards bodies and national governments. Practical deployment responses have included live enrollment systems to counter passport morphing risk, while broader awareness of AI-generated threats has accelerated following warnings such as those from Europol about AI-generated fakes bypassing phone biometric security. Research groups such as Fraunhofer IGD have also been working to counter face-morphing threats through purpose-built detection systems.
The zero-shot capability is particularly notable from a deployment standpoint: it suggests that MLLMs could be evaluated against morphing detection benchmarks without the labeled training data that specialized systems require, potentially lowering barriers for organizations assessing morphing risk in their pipelines.
Sources: arXiv, Jožef Stefan Institute
–
By the ID Tech Editorial Team
