Emergent Morphing Attack Detection in Open Multi-modal Large Language Models

2026-02-17

AI Summary

This work presents the first systematic evaluation of open-source multimodal large language models—such as LLaVA-1.6-Mistral-7B—for zero-shot detection of face synthesis attacks in single images without any fine-tuning. Traditional methods for face anti-spoofing rely on task-specific training and exhibit limited generalization. In contrast, the study demonstrates that these models can implicitly capture subtle facial inconsistencies indicative of synthetic manipulation. Under a standardized and reproducible evaluation protocol, the approach achieves an equal error rate at least 23% lower than the current state-of-the-art specialized methods, highlighting its remarkable generalization capability and discriminative power in detecting face synthesis attacks.

Technology Category

• Machine Learning: Large Multimodal Models (LMMs)
• Computer Vision: Large Vision Models
• Natural Language Processing: Fact-Checking / Misinformation Detection (NLP Focus)

Application Category

• Search and Retrieval-Augmented AI: Large language models for search
• Social Networks and Social Media: Generative AI / large language models and their impact on social systems
• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs

Abstract

Face morphing attacks threaten biometric verification, yet most morphing attack detection (MAD) systems require task-specific training and generalize poorly to unseen attack types. Meanwhile, open-source multimodal large language models (MLLMs) have demonstrated strong visual-linguistic reasoning, but their potential in biometric forensics remains underexplored. In this paper, we present the first systematic zero-shot evaluation of open-source MLLMs for single-image MAD, using publicly available weights and a standardized, reproducible protocol. Across diverse morphing techniques, many MLLMs show non-trivial discriminative ability without any fine-tuning or domain adaptation, and LLaVA1.6-Mistral-7B achieves state-of-the-art performance, surpassing highly competitive task-specific MAD baselines by at least 23% in terms of equal error rate (EER). The results indicate that multimodal pretraining can implicitly encode fine-grained facial inconsistencies indicative of morphing artifacts, enabling zero-shot forensic sensitivity. Our findings position open-source MLLMs as reproducible, interpretable, and competitive foundations for biometric security and forensic image analysis. This emergent capability also highlights new opportunities to develop state-of-the-art MAD systems through targeted fine-tuning or lightweight adaptation, further improving accuracy and efficiency while preserving interpretability. To support future research, all code and evaluation protocols will be released upon publication.

Problem

• morphing attack detection
• biometric verification
• zero-shot evaluation
• multimodal large language models
• face morphing attacks

Innovation

• zero-shot morphing attack detection
• multimodal large language models
• biometric forensics
• emergent capability
• LLaVA