AI that never forgets: new method trains morphing attack detectors without storing your face

Every time a traveler passes through an automated border control gate at a major international airport, a face verification system compares the live camera image against the photograph stored in the electronic passport chip. That photograph is supposed to belong to exactly one person. But a deceptively simple image processing trick known as face morphing can blend two different identities into a single seamless portrait, allowing a criminal and an accomplice to share one legal travel document. When the morphed image passes automated face verification, the criminal can board a flight under the accomplice’s identity, and neither border officers nor traditional vision systems may notice anything wrong. The threat has grown more serious with the arrival of generative adversarial networks that produce high-quality morphs, and with retouching tools that erase the visible artifacts detectors once relied upon.

The obvious defense is a strong morphing attack detection system, or MAD, trained on large and varied collections of morphed faces. Yet this is precisely where privacy law becomes the bottleneck. Facial images are personal data, and regulations severely restrict their acquisition, storage, and sharing across institutions. Research laboratories are often forced to develop MAD solutions using only internally sourced data, which is limited in quantity and diversity. The result is a familiar pattern in modern machine learning: deep learning-based detectors perform well on their own private data but generalize poorly to new, unseen morphing techniques and image qualities. Public benchmarking platforms such as NIST FRVT MORPH and FVC-onGoing help by testing algorithms on sequestered datasets, but they evaluate finished models rather than strengthen the training procedure itself.

A team of Italian researchers at the University of Bologna and the University of Modena and Reggio Emilia, led by Lorenzo Pellegrini, Guido Borghi, Annalisa Franco, and Davide Maltoni, has now proposed a way out of this impasse. Writing in the journal Frontiers in Imaging, they introduce Adaptive-LwF, a continual learning algorithm that allows a single MAD model to be trained incrementally across multiple sites without any personal data ever being transferred. The core idea is elegant: instead of moving data to the model, the model moves from site to site, updating its weights each time a new chunk of data becomes available, then deleting or leaving behind the data it just learned from. A model trained this way can accumulate knowledge from airport gates, where images are available only temporarily, and from private laboratory datasets, without violating privacy constraints.

Continual learning, sometimes called lifelong learning, is the machine learning paradigm designed for exactly this kind of sequential training. Its central enemy is catastrophic forgetting, the tendency of a neural network to abruptly overwrite previous knowledge when it is updated on new data. The Bologna team’s detector follows a state-of-the-art differential MAD pipeline: a ResNet backbone trained with the ArcFace loss extracts two 512-dimensional identity embeddings, one from the trusted live acquisition and one from the possibly morphed document photo. The embeddings are combined by subtraction and fed into a multi-layer perceptron classifier that outputs the probability that the pair represents a morphing attack. The classifier is a deep network rather than the traditional support vector machine, which makes it compatible with continual learning algorithms.

In a preliminary comparison of replay-free continual learning methods, the team evaluated Synaptic Intelligence, Elastic Weight Consolidation, Deep Streaming Linear Discriminant Analysis, and Learning without Forgetting, or LwF, under scenarios where the size of each incoming data chunk varies. LwF emerged as the clear winner, achieving the lowest error relative to the ideal joint training upper bound in both small-chunk and large-chunk settings. LwF works through knowledge distillation: an old model, which embodies everything learned so far, acts as a teacher for a current model learning from new samples. Crucially, LwF requires no replay memory, meaning no past data is stored, which is what makes it suitable for privacy-critical biometric applications where replay-based methods are excluded by regulation.

But LwF has a hidden weakness that most continual learning research ignores: its performance depends critically on a single hyperparameter, the weight of the distillation loss, usually denoted lambda. Higher values of lambda make the model conservative, preserving past knowledge at the expense of slower adaptation to new data. Lower values allow faster learning but risk overwriting essential features. The team showed experimentally that choosing the wrong lambda can degrade detection performance by roughly five percentage points in equal error rate and up to fifteen points in the stringent BPCER at APCER 0.001, the operating point typical of real-world border control systems. Worse, the optimal lambda varies with the size of the incoming data chunk, and in practical deployments nobody can predict in advance how many new samples will arrive.

The breakthrough of Adaptive-LwF is a mathematical formula that eliminates this tuning problem entirely. By fitting a regression over experimentally observed optimal lambda values across different chunk sizes, the researchers derived an exponential scaling law: lambda equals a times x to the power of negative b, where a is 17,403, b is 0.636, and x is the input chunk size. The pattern behind the formula is intuitive: smaller chunks of new data deserve a larger distillation weight, so the model leans harder on its old knowledge when there is little new evidence to learn from, while larger chunks justify a lighter touch. Using this formula, the distillation loss is set automatically for every learning experience, removing the need for repeated grid searches or manual hyperparameter selection that would multiply computational costs, especially when chunk sizes are unpredictable.

To validate the approach, the team designed five novel benchmarks simulating realistic data arrival patterns: fixed-size chunks, the traditional continual learning setting; variable chunks corresponding to whole new datasets; and three scenarios where chunk sizes are drawn from uniform or Zipf-like distributions, favoring either small or large arrivals. Training data came from public morphing collections built with OpenCV, FaceMorpher, and StyleGAN algorithms, while the fixed test set was MorphDB, a challenging collection of manually retouched, high-quality morphs. Performance was averaged over all 24 possible orderings of the four training datasets, and new metrics, including a Temporal Area Under the Curve and a Borda Ranking over Time, were introduced to assess how methods perform across the entire incremental training process rather than at a single snapshot.

The results confirm that Adaptive-LwF consistently outperforms both naive incremental training and LwF with any fixed lambda value, whether small or large. In the preliminary investigation, the naive approach left a consistent gap behind the joint training upper bound, particularly in equal error rate and BPCER at the strictest operating point, because it lacks any forgetting-contrasting mechanism. Adaptive-LwF closes much of that gap, achieving a final error closer to, and in some cases better than, the joint method, while respecting privacy by design. The authors are candid about limitations: performance may still fall short of traditional batch learning on the full dataset, the exponential scaling function’s generalization to other scenarios requires further assessment, and the approach depends on the quality of pre-trained ResNet embeddings. Robustness to heavily imbalanced or noisy data streams also remains untested.

The implications reach beyond morphing attack detection. The continual learning paradigm proves valuable wherever data cannot be transferred between sites due to privacy concerns, enabling model transfer instead of data transfer. For border security agencies, it points toward MAD systems that continuously improve as new images are acquired at automated gates, learning to detect novel morphing techniques without forgetting previous ones and without storing a single face. For the continual learning community, the work delivers one of the first systematic investigations of how the distillation loss parameter in LwF should relate to the size of incoming training data, a question the literature had left largely unaddressed. As face morphing attacks grow easier to create and harder to spot, detectors that can learn everywhere and forget nothing may become the indispensable tool that keeps automated border controls one step ahead.

Subject of Research: Adaptive-LwF: continual training of morphing attack detector without forgetting

Article Title: Adaptive-LwF: continual training of morphing attack detector without forgetting

Article References: Pellegrini, L., Borghi, G., Franco, A., & Maltoni, D. (2026). Adaptive-LwF: continual training of morphing attack detector without forgetting. Frontiers in Imaging, 5, Article 1817515. https://doi.org/10.3389/fimag.2026.1817515

Image Credits: AI Generated

DOI: 10.3389/fimag.2026.1817515

Keywords: continual learning, face recognition, morphing attack, morphing attack detection, catastrophic forgetting, biometrics, privacy, machine learning, security, artificial intelligence, Adaptive-LwF, continual