Worst-Case Morphs Using Wasserstein ALI and Improved MIPGAN

Table 2

MMPMR values for landmark- and GAN-based morphs.

	Land-; mark	MIPGAN	Improved; MIPGAN; (Ours)	WALI (Ours) with optimisation using							Worst; Case	FNMR
				MFN	MFN &; El.Face	MFN &; Curr.Face	MFN &; ArcFace	MFN &; Inception	MFN &; PocketNet	MFN &; VGG16
MobileFaceNet	65.7	71.9	91.8	96.8	96.6	96.6	96.8	97.0	97.0	96.6	97.5	0.5
ElasticFace	56.9	18.9	83.0	14.0	81.8	60.4	25.7	20.8	18.7	18.1	98.8	0.0
CurricularFace	45.9	11.1	60.9	8.6	46.6	68.3	14.8	12.2	10.5	13.2	99.0	0.0
ArcFace	70.7	62.9	84.5	64.6	76.2	75.6	90.4	71.7	70.2	70.2	97.9	0.2
Inception	36.8	37.0	51.1	37.6	47.2	46.4	43.7	58.0	41.2	42.5	71.8	3.4
PocketNet	34.1	34.2	49.0	48.0	49.3	48.7	51.4	51.3	63.5	50.3	84.2	3.8
VGG16	36.4	32.7	42.1	35.4	39.4	40.1	40.1	41.1	38.5	56.2	92.0	7.6
Dlib	45.1	37.2	42.4	27.3	32.6	31.4	32.5	32.9	30.0	32.2	72.3	5.8
COTS	99.8	93.4	98.6	71.4	94.6	95.5	79.6	80.4	76.3	75.0	n/a	0.0

Note. The second-to-last column shows the theoretical worst case for each respective FR system. Underlined numbers indicate evaluation was under white-box assumptions, i.e., this FR system was used during optimisation. The more challenging the morphs, the higher the MMPMR. To show that there is a trade-off between FR performance and vulnerability to morphing attacks, we report the false non-match rate (FNMR) (%) at which the false match rate in the last column. The morphing methods highlighted in bold are closest to the worst case for almost all FR systems.