DuckDuckGoose Morphing Attack Detection (MAD) for government identity document issuance: passports, national ID cards and driving licences. Unlike deepfake detection, which looks for AI generation artefacts, and liveness detection, which confirms physical presence, MAD detects composite face morphs at photo submission. Single-image MAD (S-MAD) analyses landmark geometry, texture consistency and frequency-domain artefacts; differential MAD (D-MAD) compares the submitted photo against a live capture. Explainable XAI reports, on-premise deployment, GDPR Article 9 biometric data handling, engineered to EU AI Act Articles 9 to 15 requirements.
The morphing attack:
two faces, one photo,
a genuine document.
A morphing attack blends a fraudster's face with a legitimate applicant's. Both verify against the issued document. After issuance, there is no fake left to find. The photo is the only place to stop it.
The morphed photo confesses four different ways
One submitted photograph. Four independent analyses, each with its own confidence band in the XAI report. This is what the engine sees. Output shown is illustrative; benchmark data is available under NDA.
› computing symmetry ratios
› 3 points deviate > 2.1σ
› jaw asymmetry outside natural variance
› signal logged to XAI report
DETECTED
Each signal carries an independent confidence band in the XAI output, the evidential basis for citizen appeals under national administrative law.
Where a face morph betrays itself
Four regions carry the evidence. None of them visible to the officer at the counter. Move through each marker to see what the human eye cannot.
Central fusion seam
Most morphing tools blend along the facial midline. The seam carries gradient discontinuities in skin texture invisible at print resolution but measurable at block level.
Periocular landmark drift
Eye-corner and iris-centre landmarks inherit positions from two different faces. The resulting spacing falls outside the natural variance envelope of a single individual.
Jawline geometry inconsistency
Jaw contours are notoriously hard to blend cleanly. Asymmetric curvature between left and right jaw segments is a high-weight detection signal, and it survives re-capture.
Hairline ghosting
Blended hairlines produce semi-transparent ghost contours and frequency-domain energy in bands where genuine photos carry none. Strongest on digital submissions.
After issuance, there is nothing left to detect
The card is real. The chip is real. The photo verifies two people. Border gates, banks, and notaries will trust it for ten years. Issuance is the last checkpoint that can say no.
Photo submission to MAD verdict in under 400ms
One API call inside the workflow you already run. No new hardware at the desk. Nothing changes for the citizen.
service pointt=0
quality gating~40ms
frequency · differential~250ms
appeal-ready evidence~50ms
Flag → human review<400ms total
Sovereignty is a deployment choice, not a promise
Three topologies. In all three, the biometric boundary is yours to draw. In two of them, biometric data never leaves your infrastructure.
Full on-premise
MAD runs entirely inside the issuing authority's own infrastructure. No biometric data crosses any external boundary. Updates delivered as signed, air-gappable releases.
Hybrid: inference local
Inference runs on-premise; model updates and monitoring flow from DDG's EU infrastructure. Biometric data never leaves the authority's boundary.
EU sovereign cloud
Fully managed API with contractual Dutch data residency, EU-only processing chain, and retention policies agreed at deployment. Fastest to pilot.
Every MAD decision defensible in an appeal
A flagged citizen has the right to ask why. The report answers in plain language: which signals fired, at what confidence, against which thresholds. Written for the reviewing officer and the appeal file, not the data science team.
Per-signal confidence bands: each of the four signal classes documented independently, never a single opaque score.
Human-readable rationale: written for a reviewing officer, not a data scientist. EU AI Act Article 13 transparency by design.
Immutable audit trail: every analysis logged with model version, thresholds, and reviewer actions for regulatory inspection.
3 of 68 landmarks deviate >2.1σ from single-identity variance. Jaw asymmetry detected.
Gradient discontinuity along facial midline consistent with blend seam. 11 of 80 blocks affected.
Mid-band DCT energy +38% versus genuine baseline. Signature consistent with morphing toolchains.
Geometric divergence 0.31 exceeds ageing-adjusted threshold 0.12. Identity inconsistency probable.
Routed to human review per workflow policy. All four signal classes exceed flag thresholds independently.
Built by the team that detects what humans cannot
DuckDuckGoose is a Delft-based detection company. Our engines analyse manipulated and synthetic imagery for banks, identity verification providers, and forensic institutes. MAD extends the same forensic pipeline to a threat most of the market has not caught up with yet.
In production with a single identity verification client, at a false rejection rate below 0.5%.
Peer-reviewed studies show untrained examiners accept 50/50 morphs as genuine at this rate. Machines must do what officers cannot.
A passport application in Germany made with a morphed photo prompted authorities to reconsider self-submitted photographs. The attack is not theoretical.
Our detection engines are trusted by bunq, Banco Daycoval, and the Netherlands Forensic Institute. The same forensic standards now apply to morphing attack detection.
The questions evaluators ask first
Short answers here. Full technical documentation in the procurement package.
Every claim on this page is documented
RFI and RFP packages, accuracy benchmarks, government reference clients, and confirmed SME eligibility under Directive 2014/24/EU. Request the file and check it.
Request the MAD capability overview
for your procurement file
Written for procurement files, technical evaluators, and programme managers. Not a sales deck.