Detection of Face Morphing Attacks Based on PRNU Analysis

Recent research found that attacks based on morphed face images, i.e., morphing attacks, pose a severe security risk to face recognition systems. A reliable morphing attack detection from a single face image remains a research challenge since cameras and morphing techniques used by an attacker are unknown at the time of classification. These issues are commonly overseen while many researchers report encouraging detection performance for training and testing morphing attack detection schemes on images obtained from a single face database employing a single morphing algorithm. In this work, a morphing attack detection system based on the analysis of Photo Response Non-Uniformity (PRNU) is presented. More specifically, spatial and spectral features extracted from PRNU patterns across image cells are analyzed. Differences of these features for bona fide and morphed images are estimated during a threshold-selection stage using the Dresden image database which is specifically built for PRNU analysis in digital image forensics. Cross-database evaluations are then conducted employing an ICAO compliant subset of the FRGCv2 database and a Print-Scan database which is a printed and scanned version of said FRGCv2 subset. Bona fide and morphed face images are automatically generated employing four different morphing algorithms. The proposed PRNU-based morphing attack detector is shown to robustly distinguish bona fide and morphed face images achieving an average D-EER of 11.2% in the best configuration. In scenarios where image sources and morphing techniques are unknown, it is shown to significantly outperform other previously established morphing attack detectors. Finally, the limitations and potential of the approach are demonstrated on a dataset of printed and scanned bona fide and morphed face images.


INTRODUCTION
F ACE recognition systems have recently been exposed to be vulnerable against attacks based on morphed face images [1], [2]. Image morphing has been an active field of image processing research since the 1980s [3], [4] with a variety of application scenarios, especially in the film industry. Morphing techniques can be used to create artificial biometric samples that resemble the biometric information of two (or more) individuals in the image and feature domain. An example of a morphed face image is shown in Fig. 1. The morphed face image is successfully verified against probe samples of both subjects involved using stateof-the-art face recognition systems. This means that if a morphed face image is somehow stored as a reference in the database of a face recognition system, both individuals involved are successfully verified against this manipulated reference. Morphed face images thus pose a serious threat to face recognition systems, as the basic principle of biometrics, the unique link between the biometric reference data and the subject, is violated.
In many countries, the face image used for the ePassport application process is provided by the applicant either in analogue or digital form. In the scenario of a face morphing attack, a wanted criminal could morph his facial image with one of a lookalike accomplice. If the accomplice applies for an ePassport with the morphed face image, he will receive a valid ePassport equipped with corresponding document security features. It is important to note that morphed face images can be realistic enough to fool human examiners [6], [7] as well as commercial face recognition systems. Both the criminal and the accomplice could then be successfully verified against the morphed image stored in the ePassport. This means that the criminal can use the ePassport issued to the accomplice to pass through Automated Border Control (ABC) gates (or even human inspections at border crossings). The risk of this attack, called face morphing attack, is amplified by the fact that realistic face morphs can be generated by non-experts using user-friendly face morphing software that is either freely available or can be purchased at a reasonable price.
In 2014 Ferrara et al. [1] were the first to thoroughly investigate the vulnerability of commercial face recognition systems to attacks based on morphed face images. So far, a considerable amount of morphing attack detection approaches has been published, see Sect. 2. For a comprehensive survey the reader is referred to [2]. Proposed ap-proaches can be categorized with respect to the considered morphing attack detection scenario: • No-reference morphing attack detection: the detector processes a single image, e.g. the analysis of a printed image that is presented and scanned in a passport application procedure and subsequently stored in an electronic travel document or at any later point in time an off-line authenticity check of said document by police investigators (this scenario is also referred to as single image morphing attack detection or forensic morphing attack detection); • Differential morphing attack detection: a trusted live capture from an authentication attempt serves as additional source of information for the morph detector, e.g. during authentication at an ABC gate (this scenario is also referred to as image pair-based morphing attack detection). Note that all information extracted by noreference morph detectors might as well be leveraged within this scenario [8].
Obviously, the no-reference scenario turns out to be more challenging compared to the differential one. While the majority of no-reference approaches reports practical detection error rates, these are commonly evaluated on a dataset of bona fide and morphed face images which are extracted from a single (in-house) face database. In such an experimental setup the use of machine learning-based feature extractors or/and classifier increases the risk of overfitting, i.e. the robustness of morph detection algorithms may not be retained with regard to images stemming from other sources as shown in [9]. This work represents a significant extension of the preliminary studies towards PRNU-based morphing attack detection previously published in [5], [10]. The proposed system has been complemented by a more thorough investigation of different features and aggregation strategies, more specifically spatial features have been investigated in addition to spectral ones from previous work. Complementary to those efforts cross-database experiments on morphed face images generated by four different morphing algorithms have been conducted. The generalizability of the PRNUbased morphing attack detection across a wide range of distinct cameras of various makers is further investigated on a database specifically built for PRNU analysis in digital image forensics and it is shown that said database is suitable to determine the decision threshold for the proposed system. In addition, a database of printed and scanned face images is employed in evaluations. Moreover, in experiments the proposed system is benchmarked against state-of-the-art morphing attack detectors. Also, vulnerability analysis of the proposed concept with respect to potential attacks to circumvent the detection system is given.
The remainder of this work is organized as follows: related works are discussed in Sect. 2. Fundamentals of PRNU extraction are explained in Sect. 3. The proposed morph detection method is described in detail in Sect. 4. Experimental results are reported in Sect. 5. Finally, conclusions are summarized in Sect. 6.

RELATED WORK
In recent years, numerous no-reference face morphing attack detection schemes have been proposed. Published methods and their properties are summarized in Table 1 which has been derived from [2]. In some papers more than one system was presented, in such cases approaches that showed the best performance in detecting morphing attacks are listed. It is important to note that the generalizability/robustness of the published approaches could not be demonstrated. So far, there are no publicly accessible large databases of bona fide and morphed facial images and hardly any publicly available morph recognition algorithms which allow comprehensive experimental evaluations. The vast majority of published methods were trained and tested on various sequestered databases, which hampers reproducibility of results 1 . In addition, morph detection methods are usually trained and tested on a single database with a single morph generation algorithm. Based on these facts, a comparison of published approaches with respect to reported detection performance would be potentially misleading and is deliberately avoided in this work. However, it is expected that planned benchmark tests, e.g. by the National Institute of Standards and Technology (NIST) [40], will enable a meaningful quantitative comparison of published approaches in the near future.
Several researchers have suggested the use of generalpurpose image descriptors, such as Local Binary Patterns (LBP) [41] or Binarized Statistical Image Features (BSIF) [42], which are widely used for biometric recognition. Ramachandra et al. [11] proposed a system based on a Support Vector Machine (SVM) trained on extracted BSIF features. For the training and evaluation of the SVMs, an internal database with morphed facial images was created. In a derivative version of the same database, Scherhag et al. [12] examined the accuracy of morphing detection on printed and scanned images using the proposed algorithm. Furthermore, Ramachandra et al. [13] proposed a Probabilistic Collaborative Representation Classifier (Pro-CRC) [43] trained on LBP features extracted from the color channels. The database used was an internal database derived from FRGCv2 [14]. The authors concentrate on the differences between morphed and averaged images in the evaluation.
A more complex method for morphing attack detection is proposed in [16], [17], where a Vietoris-Rips complex is formed from the reactions of uniform LBP extractors on the image. In [38] a high detection performance was shown by Wandzik et al. for a linear SVM trained on high-dimensional LBP features [44] extracted from the FEI database [45]. In [46] Ramachandra et al. proposed an LBP extraction of Laplacian pyramids build on different color channels. Agarwal et al. [15] suggest training an SVM with Weighted Local Magnitude Pattern. Similar to LBP, the proposed descriptor encodes the differences between a central pixel and its neighbors. However, instead of binarizing them, it assigns weights inversely proportional to the difference to 1. Also the morphed images used in this work can not be published due to licensing conditions as these are generated based on subsets of available image database collected by different institutions. However, efforts are currently made by different research laboratories to acquire new datasets of bona fide and morphed face images that shall serve future open benchmarks.

TABLE 1
Overview of most relevant no-reference face morphing attack detection algorithms.
During the morphing process, not only the texture but the entire signal of the image is manipulated. A further recognition approach is therefore the analysis of the changes in the sensor noise pattern, e.g. PRNU [5]. Therefore, the PRNU pattern, which originates from imperfections within the camera's sensor, not only differing for each model, but also for each individual camera, is extracted from a facial image and the discrete Fourier variables are calculated.
The mean value and variance are then derived from the resulting histogram. Recently, Debiasi et al. [10] proposed an improved version of this scheme based on PRNU variance analysis across image blocks. A similar approach has been proposed by Zhang et al. [27] confirming the usefulness of morph detection based on sensor noise pattern analysis.
Both PRNU-based morph detection approaches analyse the Fourier Spectrum of the PRNU and quantify spectral differences between bona fide and morphed images using statistical measures. The main difference between both approaches lies within the processing pipeline, block-based analysis in the spatial [5], [10] vs. spectral domain [27], and final classification. The morph detector proposed in [5] and [10] does not need any training data, since it solely relies on a simple thresholding for the final decision, while the one in [27] utilises a linear SVM, which needs to be trained with bona fide and morphed images and makes the latter approach potentially more vulnerable against unknown morphing attacks. Furthermore, different PRNU extraction and enhancement techniques are used for both approaches. In contrast to [5], [10], the authors of [27] did not consider image post-processings. Also, no crossdatabase performance evaluations were performed.
Morphing attack detection methods based on continuous image degradation were proposed in [20], [51], [52]. The basic idea behind these methods is to continuously deteriorate the image quality, e.g. by JPEG compression, in order to generate several artificial self-references of a facial image. The distances between these references and the original image are then analyzed for morph detection. Ramachandra et al. [31] suggests the analysis of high frequencies. In their approach images are converted to grayscale and a controllable pyramid is built and a Collaborative Representation Classifier (CRC) is trained on the high frequencies. The database used was printed and scanned. An alternative to handcrafted feature extractors is the use of statistical machine learning on the unprocessed image to distinguish between morphed and bona fide images. Ramachandra et al. [32] suggested adapting two convolutional neural networks (CNNs) (VGG19 [53] and AlexNet [54]) by transfer learning and combining the intermediate features to train a CRC. In [55] three CNNs, namely VGG19, AlexNet and GoogLeNet [56], are assessed as pre-trained and non-pre-trained models with respect to their morph detection abilities. Also with these methods there is a potential problem of over-fitting. In particular, the resulting classifiers may prefer image sites where artefacts, such as shadows around the iris region, may occur due to an imperfect automated morphing process. In order to avoid over-fitting, Seibold et al. [33] trained a VGG19 network on a series of different images with two different databases, morphing algorithms and postprocessings (motion blur, Gaussian blur, salt and pepper noise, Gaussian noise). Since the CNN has been trained on all types of databases, morphing algorithms, and postprocessing, it is difficult to assess the resulting robustness of the classifier. Wandzik et al. [38] suggested to use pre-trained facial recognition networks, e.g. VGG-Face [57] or FaceNet [58], to detect morphing attacks. The high-level features generated by the networks are classified with a linear SVM.
Different approaches based on media forensics were presented, too. In several papers the detection of JPEG double compression artefacts for the purpose of morph detection was proposed [18], [29]. However, the presence of such artefacts implies a strong assumption of the image format of facial images used for morphing and the resulting morphed facial image. ICAO proposes to store facial image data in accordance with the specifications of the International Standard ISO/IEC 19794-5 [59]. More specifically, ICAO requires facial images to be stored in electronic travel documents with an average compressed size of 15kB to 20kB in JPEG or JPEG 2000 format [60], [61]. However, JPEG 2000 is the de-facto standard for electronic travel documents as it maintains a higher quality when compressing facial images to 15kB. Therefore, depending on the image size and the compression algorithm used, JPEG double compression artefacts may not be detected. A morph detection method based on reflection analysis in facial images is introduced by Seibold et al. [30]. The flash direction is estimated based on reflections detected in the eyes of a potentially morphed image. Reflections from the nose of the face are then analyzed. However, the ISO/IEC standard requires the absence of hot spots and reflections in facial images used in electronic travel documents. In particular, diffuse lighting, multiple symmetrical sources or other lighting methods should be used, i.e. a single bright "point" light source such as a camera-internal flash is not acceptable for imaging [59].
Apart from no-reference approaches differential morphing attack detection schemes have been presented, too. Most notably, face de-morphing [62], [63] and facial landmarkbased approaches have been introduced [64], [65]. Additionally, some no-reference approaches, e.g. general-purpose image descriptors, can be extended to a differential scenario by estimating differences between feature vectors extracted from trusted live captures and potential morphs [8].

PRNU-BASED IMAGE FORENSICS
The photo response non-uniformity (PRNU), also known as sensor noise, has previously been utilised as a reliable tool to perform various forensic tasks such as device identification, device linking, recovery of processing history and the detection of digital forgeries. The PRNU origins from slight variations among individual pixels during the photoelectric conversion in digital image sensors. All digital image sensors cast this weak noise-like signal into all acquired images. Thus, the PRNU can be considered as an intrinsic property of all digital imaging sensors and an inherent part of their output.

PRNU extraction and analysis
In this work, we make use of the PRNU to detect morphed face images. This systemic and individual pattern can be seen as an unintentional stochastic spread-spectrum watermark that survives processing, such as lossy compression or filtering. The extraction of the PRNU noise residual from an image can be performed by applying Fridrich's approach [66]. For each image I the noise residual W I is estimated as described in Eq. (1), where F is a denoising function which filters out the sensor pattern noise. The extraction is performed using the denoising filter proposed by Mihcak et al. [67]. For further details on the denoising filter, we refer to [67]. Fig. 2 presents the extracted PRNU for an exemplary image. Further visualizations of PRNU signals extracted from face images can be found in [5], [10].
Since the PRNU extraction is relying on a denoising of the image, the resulting pattern might be contaminated with different signals, such as other high frequency image components, e.g. edges, or different types of non-unique artefacts (NUAs) [?]. Many alternative PRNU extraction schemes [69], [70], [71], [72], [73], [74], [75] and PRNU enhancements [76], [77], [78], [79], [80] have been proposed in literature to attenuate different types of PRNU contaminations and improve the quality of the extracted PRNU in source camera identification scenarios. However, to the best of our knowledge, their impact on the general properties of the PRNU signal has not yet been extensively investigated. Therefore, we decided to rely on Mihcak et al.'s [67] denoising filter for the PRNU extraction.
The following essential properties, based on the characteristics of the PRNU described by Fridrich et al. in [81], make the PRNU well suited for a face morph detection scenario: 1) Dimensionality: The sensor fingerprint is stochastic in nature and has a large information content, which makes it unique to each sensor. 2) Unavoidability: All imaging sensors exhibit PRNU. 3) Universality: The sensor fingerprint is present in every picture independently of the camera optics, camera settings, or scene content, with the exception of completely dark images. 4) Permanence: It is stable in time and under a wide range of environmental conditions (temperature, humidity, etc.). 5) Robustness: it survives lossy compression, filtering, gamma correction, and many other typical processing procedures. It is even reported to survive high quality printing and scanning [82]. Due to the criteria described above, the PRNU offers significant advantages over analysing other high-frequency image components to detect morphed face images.
According to Fridrich [66], the spectral characteristics of the PRNU reveal whether an image has been subject to further processing, e.g. non-geometrical operations have an influence on the strength of the embedded PRNU signal. Since the face morphing process involves non-linear warping and averaging operations, the distribution of the PRNU values is expected to change after these processing operations. Fig. 3 illustrates the PRNU and Fig. 4 the Discrete Fourier Transform (DFT) magnitude spectra obtained by averaging the extracted PRNU of 500 bona fide and 500 morphed face images from the FRGCv2 dataset, which is described in more detail in Sect. 5.
These effects on the distribution of the PRNU values in the spatial domain can be observed in Fig. 3(c), where the distribution of morphed images is squashed compared to bona fide ones, i.e. the values around the mean of the distribution become more frequent and the values around the tails of the distribution become less frequent which leads to a steeper slope. Furthermore, some undesired components of the PRNU, e.g. edges in the image content, are emphasised in the morphed images, as it can be observed in Fig. 3(b). These effects are caused by the averaging operations applied during the morphing process.
The magnitude spectra of bona fide and morphed face images in Fig 4, representing the frequency domain of the PRNU, show a clearly visible discrepancy among each other, where the most obvious differences can be observed in the reduction of high-frequency components within the morphed images' DFT magnitude spectrum as compared to the bona fide ones. Furthermore, the DFT spectrum of the morphed face images appears more compressed, i.e. the area covered by the large magnitudes is smaller compared to bona fide images.
These effects are caused by the previously mentioned operations involved in the face morphing process, which lead to changes in the distribution of the PRNU values. The approach presented in this work aims at exploiting these effects in order to perform a blind no-reference face morph detection.

Potential attacks and PRNU robustness
PRNU-based forensics and counter forensics can be considered as a cat-and-mouse game, since attacks and counter attacks are presented on a regular basis in the related literature. While attackers try to bypass various forensic approaches and conceal their counter-forensic approaches, techniques are developed to reveal such attacks.
The counter-forensic techniques proposed to overcome PRNU-based forensics can be divided into the following categories: • Destroying the image identity: This class of counter forensic techniques tries to conceal the identity of an image and therefore prevents an identification of the image source or camera, respectively. Some examples are: removing the PRNU [83], [84], [85], [86], seam carving [87], [88], adaptive PRNU denoising [89]. Applying these techniques to morphed face images poses a lower threat to a PRNU-based morph detection system, since the aim is not to detect the image source, but to analyse the general properties of the PRNU signal. When the PRNU is destroyed, it can be assumed that its general properties are also not preserved. • Forging the image identity: The goal of this class of counter forensic techniques is to fake the identity of an image, i.e. changing the identity of the image or concealing traces of its modification. Some examples for this are: Insertion of a differing PRNU signal [84], [86], fingerprint copy attacks [90], [91], [92], hiding of post-processing operations [84]. When applied to morphed face images, these type of counter forensic techniques can most likely be considered as a threat for a PRNU-based morph detection system, because their aim is to spoof an authentic image source, which usually contains similar characteristics to the PRNU of unaltered images. A potential attack on the PRNUbased morph detection system could involve extracting the PRNU from an authentic image and inserting it into a morphed image. This would restore the original properties of the PRNU when it is extracted again for the detection and therefore conceal the morphing operations.
Different approaches are proposed in literature to detect such intentional counter forensic attacks, e.g. the "Triangle Test" [93] and more recently Sameer et al. [94] proposed a deep learning based CNN model for the detection of counter forensic images. In biometrics, forging of the image identity has only been investigated for iris sensor data by Banerjee, Mirjalili and Ross in [95] and Uhl and Höller in [96], where the detection of such attacks is furthermore evaluated in the latter.
Another type of attacks on the PRNU are unintentional ones, such as recompression, geometric transformations (cropping, scaling, rotation), photometric transformations and post-processing of the images. These attacks might occur unintentionally, i.e. when images are simply processed to enhance the appearance of a subject within the image, like it is often done for portrait photos. The PRNU has been shown to be resilient to photometric transformations [97] to a certain degree. While geometric transformations heavily affect the image source identification because they destroy the alignment of the PRNU signal, they are expected to not affect the general properties of the PRNU. However, post-processing of images, such as sharpening, blurring or contrast enhancement, can severely affect the PRNU. In previous work we showed that different post-processing techniques might even completely prevent a PRNU-based detection of morphed face images [5], [10]. Furthermore, recompression [98] is reported to alter the PRNU pattern after several passes in a way that source identification performance is affected. However, its influence on the general properties of the PRNU has not been investigated.
We consider intentional attacks on the PRNU to be less likely compared to unintentional ones, because the former require profound knowledge about the PRNU and its properties as well as an attacker with experience in the field. As the robustness of PRNU-based morph detection against simple post-processings has been already investigated in previous works [5], [10], an evaluation of four morphing algorithms has been included in order to provide a more comprehensive performance analysis in Sect. 5.2. The four morphing algorithms picture a more realistic attack scenario, since they use different combinations of the simple post-processings. To address the question whether a PRNUbased approach can be applied for a wide range of distinct cameras, in Sect. 5.3 we evaluated the generalizability of the proposed morph detection approach on the Dresden Image Database [99] containing images from 63 different cameras from multiple manufacturers.

PROPOSED SYSTEM
Based on the observed effects of the face warping procedure on the spatial and spectral characteristics of the PRNU, in this work we propose a PRNU-based morph detection system which is able to discriminate between bona fide and morphed images. Therefore, we analyse the spatial and spectral characteristics of the PRNU in a no-reference manner, thus there is no need for a trusted bona fide reference image of one of the morphed subjects.
The proposed system relies on a divide and conquer principle and its processing steps are illustrated in Fig. 5. In the remainder of this section, we will discuss the various processing steps in more detail.

Preprocessing and PRNU extraction
The first step of the system consists in extracting the facial region from a face image, which is normalised and then cropped to the facial area (320⇥320 pixels) before being converted to grayscale. This process is described in more detail in Sec. 5.1.
Following, the PRNU is extracted from the preprocessed image, as described in Sect. 3, using the wavelet-based denoising filter by Mihcak et al. [67] in conjunction with the filtering distortion removal (FDR) enhancement proposed in [80]. The extracted PRNU is then split into multiple equally sized cells. The proposed system is able to work with arbitrary splits from 1 cell (whole image) to N cells. In this work, only a cell size of 10⇥10 cells is investigated, because it yields the best performance according to previous work [5], [10]. In general, a larger number of cells is expected to further expose the non-linear transformations of the PRNU during the morphing process by putting stronger emphasis on local variations within an image. Eventually, we obtain N different cells C 1 , . . . , C N . Fig. 5 shows an example of how the face image is preprocessed and the PRNU is extracted and split into 10⇥10 equisized cells.

Feature extraction
The feature extraction is performed individually for each cell. In previous work [5], [10], only spectral features based on the DFT magnitude histogram and magnitude energy have been investigated. In this work, two different feature types are investigated: spectral features based on the PRNU's DFT magnitudes and new spatial features based on the PRNU values, since the PRNU values are affected by the morphing procedures and post-processings in the spatial domain as well the spectral one.
Both feature types are described in more detail in the following.

Spatial Features
The newly proposed spatial features aim at analysing the distribution of the PRNU values, which is observed to differ between bona fide and morphed images according to Fig. 3(a) and Fig. 3(b).
For the first spatial feature, P var , the histogram of the PRNU values is computed, which is constrained to a range of [ 5,5] and divided into 100 bins. These values have been selected by analysing the DFT spectra of extracted PRNUs of bona fide and morphed images. Due to the different slope of bona fide and morphed image's PRNU value distributions that can be observed in Fig. 3(c), we decided to compute the variance of the histogram bin frequencies P var , which we defined as where B is the number of bins in the PRNU cell's histogram H P .H P represents the mean frequency of the histogram bins.
As second spatial feature, we consider the energy of the PRNU values, P en , which is defined as where x is a value within all PRNU values V of a cell. As the Eqs. 2 and 3 show, both spatial features yield a simple scalar value SV for each PRNU cell.

Spectral Features
In order to compute the spectral features, the first step consists in obtaining the frequency spectrum of the PRNU in each cell, which is done by means of the DFT. The resulting magnitude spectrum, which is illustrated in Fig. 4(a) and 4(b) respectively, reveals the alterations of the PRNU signal caused by the morphing process.
These effects are quantified, on one hand, by calculating the DFT magnitude histogram to represent the magnitude distribution within the spectrum. As described in Sect. 3, a shift of the magnitude distribution can be observed for morphed images. The DFT magnitude histograms are constrained to the same universal range of [0, 8] and are divided into 100 bins. These values have again been estimated by analysing the DFT spectra of extracted PRNUs of bona fide and morphed images. Based on the observations in Sect. 3, we select the variance of the histogram D var as being suited for the discrimination between bona fide and morphed images. We obtain D var in a similar manner as the previously described P var : where B is the number of bins in a cell's DFT magnitude histogram H M , withH M being the mean frequency of the histogram bins.
On the other hand, we propose to compute the energy of the PRNU's DFT magnitudes D en , as defined in Eq. 5, where M are the DFT magnitudes within a cell and x their respective values.
As for the spatial features, both spectral features yield a simple scalar value SV for each PRNU cell when considering Eqs. 4 and 5.

Feature aggregation
After obtaining the scalar values SV for all cells C n , the values are aggregated to obtain a global aggregation score A for the image. We investigated various strategies, where we present the two best performing ones. The aggregation strategies used in this work are: where N is the number of total cells and SV n is the feature (scalar value) obtained for the cell C n , as described in the previous processing step.
A min yields the minimum score among the individual cells, while A max characterizes maximum score among all cells. As already mentioned, we obtain a single scalar value A for each image using one of the Eqs. 6 or 7.

Decision
The final decision, whether a face image has been created through morphing of multiple images or not, is taken by a simple thresholding.
Previous work [5] showed that a one dimensional decision was not able to reliably detect some of the postprocessed morphed images for some spectral features. Hence, we introduce an additional decision step and derive a mean valueB from bona fide images, where the characteristics of the PRNU are well known. With this property, we can calculate the distance D of an investigated image to bona fide images as where A is the cell aggregation result,B is the mean variation of the N B bona fide images. It has to be noted, that this distance calculation is only applied for the two spatial and spectral energybased features P en and D en , while it is not calculated for the histogram-based features P var and D var , due to the histogram-based features yielding more consistent scores among different post-processings which can be classified with a one dimensional threshold.
If the distance calculation is applied, the final decision for a presented face image is taken by thresholding the calculated distance D. Otherwise, the final decision simply relies on thresholding of the value A, which is obtained directly from the cell aggregation.

EXPERIMENTS
In the following subsection the experimental setup, i.e. used databases, morphing algorithms, baseline systems and performance metrics, are described. Subsequently, the detection performance of the proposed systems and the baseline systems is reported and discussed. Further, the generalizability of the proposed PRNU-based morph detection approach with respect to utilized cameras and printed and scanned face images is investigated.

Experimental setup
Performance evaluations are conducted based on a subset of 1,948 images selected from the FRGCv2 [14] face image database. Face images have been manually filtered to meet ICAO requirements for electronic travel documents [60], e.g. frontal pose, neutral expression, homogeneous background and sufficient resolution (at least 90 pixels between left and right eye center). Images of this database have been developed using a Fujifilm Frontier 5700R Minlab and scanned using a Epson DS-50000 Scanner at 300dpi to obtain the Print-Scan database of equal size. In addition, a subset of 1,058 images from the FERET [22] face image database which exhibit the same properties are used for training purposes of baseline morph detection algorithms. Note that the latter database is not used for evaluation of the proposed PRNU-based morph detection scheme since it has been acquired using an analog camera. PRNU is primary caused by Pixel Uniformity Noise related to the sensor which are non-existent if images are acquired with a film camera, i.e. only the PRNU signal of the sensor inside the scanner used to digitize the images might be present in this case. Instead, the Dresden Image Database [99] is used for training the PRNU-based morph detection schemes to underline the claim that the proposed PRNU-based morph detector is not dependent of a specific camera unit, since it contains images from 63 distinct cameras from various models and manufacturers. More details on how the bona fide and morphed images have been generated using the Dresden Image Database are given in Sect. 5.3.
In a pre-processing step the face of a subject is segmented and normalized according to eye coordinates detected by the dlib landmark detector [100]. Subsequently, the normalized region is cropped to 320⇥320 pixels to ensure that the morph detection algorithm is only applied to the facial region. Finally, the cropped face part is converted to a grayscale image. Examples of original face images (cropped to portrait format) and pre-processed face images of the FRGCv2 and Print-Scan database are depicted in Fig. 6.
The subsets are split into images used for morph creation and images used as bona fide references. The resulting database constellation is listed in Table 2. In order to generate a great variation of morphs, four morphing algorithms were employed: 1) OpenCV/dlib, a self-scripted morphing algorithm based on th "Face Morph Using OpenCV" tutorial 2 using the dlib landmark detector [100]. In order to be able to conduct comparable experiments, the same combination of morphed face images was created for each of the listed algorithms. All algorithms detect corresponding landmarks in two face images to be morphed which are averaged. Subsequently, both face images are warped accordingly. Finally, alpha-blending is performed to create the morphed face image. All morphs were created in a way such that both used images tend to contribute equally to the inner facial region. Note that FaceFusion and UBO morphing algorithms are closed-source and might apply certain image post-processing methods to enhance the quality of resulting morphs. Examples of cropped facial regions of morphed face images generated all four morphing algorithms are shown in Fig. 7.
The vulnerability of a COTS facial recognition system to attacks based on the generated morphed face images is assessed by using the metrics specified in [101], in particular the Mated Morph Presentation Match Rate (MMPMR). This measure is an adaptation of the general Impostor Attack Presentation Match Rate (IAPMR) introduced in ISO/IEC 30107-3 [102] and is defined as the proportion of attack presentations using the same type of presentation attack instruments in which the target reference matches. In the adaptation, however, the MMPMR covers the fact that not one target subject (contained in the morphed reference) is matched -but for a successful face morphing attack, both data subjects that previously contributed to the morphed image are expected to match.
Using the default decision threshold of the COTS facial recognition system, an MMPMR of 1 is obtained across all used face image databases and morphing techniques. This means that all facial images of individuals contributing to   [103], Binarized Statistical Image Features (BSIF) [42], FaceNet features [58] and the FS-SPN analysis of [27] are applied. At feature extraction for LBP and BSIF the pre-processed face image is optionally divided into 4⇥4 cells to retain local information. That is, feature extractors are applied pixel-wise storing feature value in histograms for each texture cell. The final feature vector is formed as a concatenation of histograms extracted from each cell. While LBP simply processes neighboring pixel values of each pixel, BSIF utilizes specific filters learned from a set of images. For details on these texture descriptors the reader is referred to [42], [103]. The use of these well-established general purpose texture descriptors has shown to be successful in diverse texture classification problems. As the process of image morphing is expected to cause changes in textual properties between bona fide and morphed face images said texture descriptors have been shown to reveal competitive morphing attack detection performance [8], [11], [12], [21]. Minimum filter sizes of 3⇥3 pixels which have been reported to reveal best detection performance in [8] are used for both texture descriptors. In the training stage feature vectors are extracted for each baseline system and SVMs with Radial Basis Function (RBF) kernels are trained to distinguish between bona fide and morphed face images. Similarly, an SVM is trained with deep facial features extracted from cropped face image using the FaceNet recognition system. This approach resembles the schemes proposed in [31], [33]. The SVM-based classifiers of these morph detection schemes are trained on the subset of the FERET image database. Eventually, the pre-trained open-source implementation 5 of [27] is directly applied for morph detection. The major advantage of the proposed PRNU-based morph detection over the baseline algorithms is that it does not need any training. Only for some of the proposed features, a pre-computed decision threshold has to be computed. In such cases, the threshold has been estimated on the Dresden image database [99]. The performance of the detection algorithms is reported according to metrics defined in ISO/IEC 30107-3 [102]. The Attack Presentation Classification Error Rate (APCER) is defined as the proportion of attack presentations using the same presentation attack instrument species incorrectly classified as bona fide presentations in a specific scenario. The Bona Fide Presentation Classification Error Rate (BPCER) is defined as the proportion of bona fide presentations incorrectly classified as presentation attacks in a specific scenario. The D-EER, i.e. the operation point where APCER = BPCER, is used as general operation point and reported for the different morphing methods. Table 3 lists the D-EERs for different configurations of the baseline systems. It can be observed that morphs created using OpenCV with dlib are generally harder to detect, in contrast to the images created by other morphing algorithms. However, FS-SPN performs best detecting morphs created with OpenCV and dlib, but the detection rate drops when detecting morphs created by FaceFusion or the UBO algorithm. In contrast, BSIF 4⇥4 shows improved performance for detecting FaceFusion morphs, but lacks detecting morphs created by OpenCV. The DET curves for the baseline systems in presence of all morphing attacks are shown in Fig. 8. In summary, it appears that a heterogeneous training and test database as well as the utilization of different morphing algorithms significantly deteriorate the detection performance of the baseline systems leading to significantly worse results to what has been reported in previous works.

Performance evaluation
Performance results for the proposed PRNU-based morphing attack detection scheme for best performing feature extractors and cell aggregation techniques are summarized in Table 4. DET plots for the best performing proposed approaches across all post-processings are shown in Fig. 9. In addition, Fig. 10 compares the average D-EERs and their variances of all proposed morphing attack detection schemes to the baseline systems. In contrast to the baseline systems, the PRNU-based approaches yield low error rates detecting morphs created using OpenCV and dlib, but struggle detecting FaceFusion morphs. However, compared to the baseline systems average D-EER are observably lower and exhibit smaller standard deviations. Additionally, smaller variance in detection performance across different datasets and morphing algorithms are obtained, which is vital for an application of any morphing attack detection algorithm in real world scenarios where said parameters are unknown.
Compared to the baseline systems, significantly improved results are achieved for the newly proposed spatial features, i.e. P var followed by P en , which significantly outperform the baseline systems. The spectral D en feature, proposed in previous work, also obtains very competitive results on this new dataset. Another aspect to note is that the energy-based features D en and P en , whose mean bona fide thresholdB has been determined on the Dresden image database, underlines the generalisability of the approach in regard to cameras from different models and manufacturers.
At this point, it is important to note that morphing attack detection algorithms analyze cropped faces only. Thereby higher generalizability is achieved since outer facial parts can be created in different ways during morph creation. Many morph generators copy the outer facial image part of one subject contributing to the morph, e.g. in [29], [62]. In such cases, the PRNU signal of the outer part of the morph is expected to remain almost unaltered. That is, if the proposed PRNU-based morphing attack detection schemes are extended to analyze the entire face image, a variancebased cell aggregation is expected to reveal improved results for detecting morphs created in the aforementioned way.
Overall, some of the proposed PRNU-based morphing attack detection configurations reveal promising results considering the challenging experimental setup. In contrast to trained morphing attack detection schemes, e.g. [32], [55], TABLE 4 Performance results in terms of D-EER (in %) for different configurations of the proposed PRNU-based morphing attack detection systems. Best performing systems are marked bold. µ is the mean error and 2 the variance over all morphing methods.    the proposed schemes do not rely on the presence of distinct artefacts, e.g. ghost artefacts, which might occur due to imperfect morph creation. Hence, similar results are to be expected if advanced morphing algorithms are developed which allow for an automated creation of morphs comprising less or no artefacts.

Generalizability across cameras
As mentioned in Sect. 3, the proposed PRNU-based morph detection system relies on changes in the distribution of the PRNU values. Since the PRNU differs for each camera, it might contain camera (model) specific contaminations (non-unique artefacts) that might affect the PRNU values' distribution.
In order to investigate the generalizability of the proposed morph detection approach and due to a lack of suitable face image datasets acquired with different cameras, we decided to fall back to the Dresden image database [99], which offers images from multiple cameras and even multiple instances of the same camera model. More specifically, we selected the flatfield dataset, since it contains images beneficial for PRNU extraction, i.e. bright images of an evenly illuminated surface, which do not contain any contaminations from the image content like edges or other highfrequency patterns. The flatfield dataset contains images from 63 distinct digital cameras from 20 different camera models across many camera manufacturers. For some camera models, images from up to 5 instances are available in the dataset.
To generate the bona fide and morphed images, we first selected 315 images from the Dresden image database [99], consisting of 5 random images for every one of the 63 cameras. For the generation of the morphed image samples, we used the same morphing parameters as they would occur in a face morphing attack. In this experiment, they were obtained from applying the OpenCV with dlib approach on the FRGCv2 database, as described in Sect 5.1. With these parameters, we generated a total of 53,362 morphed images from bona fide image pairs of different cameras. Finally, a patch of 320⇥320 pixels is cropped from the center of all bona fide and morphed images.
The results of applying the proposed PRNU-based face morphing system on these bona fide and morphed images are presented in Table 5. Looking at the overall results for all cameras at the bottom of the table, we obtain a D-EER of 13.65% with P var |A min aggregation. For most cameras the detection error rate is very low. However, some cameras exhibit higher error rates of around 15-20% and cameras of a specific model (Practica DCZ59) even of up to 41.56%. We assume that this degradation might be caused by cameraspecific non-unique artefacts, since the degradation mostly occurs for all cameras of the same model, as the mentioned Practica DCZ59 or FujiFilm FinePixJ50 and Panasonic DM-CFZ50. Though, it has to be noted that the degradation does not persist among all investigated features, where a fusion of multiple features might yield improved performance and more consistent results. The other proposed features D en , P var and P en also achieve respectable overall results between 14.5 and 28.6% D-EER. The histogram-based feature P var , which is independent of any training data, show a better generalizability over the various cameras compared to the energy-based features D en and P en .
These results demonstrate that PRNU-based features in general are able to generalize well over a large number of different cameras and show promising results for a face morph detection scenario.

Printed and scanned images
In this last experiment, we look at the performance of the PRNU-based morph detection approach when applied to the Print-Scan dataset described in Sect. 5.1. This scenario is very challenging for a PRNU-based approach, since the scanning process of the images embeds the scanner's PRNU within all scanned images, which might prevent the detection of the morphed images. The D-EER results are presented in Table 6. We can observe, that the detection performance significantly drops for all proposed feature-aggregation combinations, where the best result is obtained with P var |A min with a D-EER of 30.52%. Fig. 11 illustrates the DET plots for all proposed morph detection algorithms on the printed and scanned images, where all morphing algorithms, i.e. OpenCV/dlib, FaceMorpher, FaceFusion and UBO, have been included. These results show that the scanners PRNU leads to a detection performance degradation for the proposed PRNU-based approach, however P var |A min is still able to discriminate bona fide and morphed images to some degree in this print and scan scenario.

CONCLUSIONS
Face morphing attacks pose a serious security risk to face recognition systems. In this work, the potential PRNU analysis has been thoroughly analyzed for the challenging task of no-reference face morph detection. In comprehensive crossdatabase experiments for which different face morphing and image post-processing techniques have been applied, the proposed PRNU-based morphing attack detection system has been shown to outperform other state-of-the-art methods. Moreover, the feasibility of detecting morphed face images from printed and scanned image data has been investigated. Since the proposed system is based on a simple and minimal approach, further detection performance improvements can be expected by fusing multiple PRNU features and by a more sophisticated classification approach based on machine learning techniques.
In contrast to differential morphing attack detection schemes, e.g. [62], which additionally process a trusted live capture of a subject's face the proposed approach is particularly useful in cases where only a single potentially morphed face image is presented, e.g. digital transmission of a face image for issuance of an electronic travel document which turns out to be relevant in some countries. In other scenarios, e.g. facial recognition at ABC gates, the presented PRNU-based morphing attack detection scheme could be fused with other (differential) approaches to further improve the detection performance.