# Dealing with Subject Similarity in
Differential Morphing Attack Detection

Nicolò Di Domenico, Guido Borghi, Annalisa Franco, Davide Maltoni
Department of Computer Science and Engineering
University of Bologna
<EMAIL_ADDRESS>

###### Abstract

The advent of morphing attacks has posed significant security concerns for
automated Face Recognition systems, raising the pressing need for robust and
effective Morphing Attack Detection (MAD) methods able to effectively address
this issue. In this paper, we focus on Differential MAD (D-MAD), where a
trusted live capture, usually representing the criminal, is compared with the
document image to classify it as morphed or bona fide. We show these
approaches based on identity features are effective when the morphed image and
the live one are sufficiently diverse; unfortunately, the effectiveness is
significantly reduced when the same approaches are applied to look-alike
subjects or in all those cases when the similarity between the two compared
images is high (e.g. comparison between the morphed image and the accomplice).
Therefore, in this paper, we propose ACIdA, a modular D-MAD system, consisting
of a module for the attempt type classification, and two modules for the
identity and artifacts analysis on input images. Successfully addressing this
task would allow broadening the D-MAD applications including, for instance,
the document enrollment stage, which currently relies entirely on human
evaluation, thus limiting the possibility of releasing ID documents with
manipulated images, as well as the automated gates to detect both accomplices
and criminals. An extensive cross-dataset experimental evaluation conducted on
the introduced scenario shows that ACIdA achieves state-of-the-art results,
outperforming literature competitors, while maintaining good performance in
traditional D-MAD benchmarks.

##  1 Introduction

The recently introduced Morphing Attack [1] poses a significant security
threat in face verification-based applications, systems usually exploited for
instance in the Automatic Border Control (ABC) gates in international airports
[2]. Indeed, through this attack, it is possible to obtain a regular and legal
document that presents a morphed photo, i.e. a hybrid face image that hosts
two different identities, and that can be shared between two subjects. In this
way, a criminal can bypass official controls using the identity of an
accomplice without any criminal record.

In this context, the development of effective Morphing Attack Detection (MAD)
systems [3], i.e. methods able to automatically detect the presence of the
morphing procedure on input images, is strongly demanded by private and public
institutions. Generally, two families of MAD detectors are investigated in the
literature [4]: Single-Image MAD (S-MAD) methods, which usually rely on the
detection of the presence of visible or invisible morphing-related artifacts
in the single input image, and Differential MAD methods (D-MAD), in which
recent SoA methods [5, 6, 7] commonly compare the identity of the two facial
images – the document and the trusted live acquisition image – received as
input.

A successful morphing attack requires fooling the human examiner at the
document enrollment stage, typically presenting a morphed photo very similar
to the document applicant, and fooling with the same morphed image the
automatic face verification system, e.g. to pass the security check at ABC
gates. Therefore, the morphed image is often created with a stronger presence
of the accomplice, so that the human examiner is less inclined to notice
noticeable differences. Usually, this critical aspect is controlled through
the morphing factor parameter, typically set to $0.3$ [8], thus conferring a
preference for the resemblance of the morphed image to that of the accomplice.

We observe that, unfortunately, most of the D-MAD approaches available in the
literature have been developed thinking of a practical application at the
verification stage, i.e. when the criminal subject tries to use the passport
for instance at ABC gates. Therefore, the large majority of existing
benchmarks only consider the comparison between the document image and the
criminal or the bona fide subject.

Figure 1: In traditional D-MAD benchmarks, usually the document image is
compared only with bona fide and criminal live photos. Therefore, in this
paper, we introduce a new challenging scenario in which the document image is
compared with both the criminal and the accomplice. From a practical point of
view, this scenario broadens the applications of D-MAD systems.

Differently, in this paper, we consider a new scenario in which D-MAD is
applied to both criminal and accomplice verification attempts, as shown in
Figure 1. We observe that successfully tackling this benchmark would broaden
the applicative context of D-MAD methods, that can be exploited also at the
enrollment stage in order to avoid a morphed image being included in the
document. Besides, this scenario would allow the use of MAD methods in ABC
gate to identify not only the criminal but also the accomplice, who has
stained themselves with a criminal and punishable action during the document
issuing procedure. It is also worth considering that, since in the morphing
attack the accomplice applies for a valid passport, he will have to use that
passport for several years if he needs to travel, thus making of interest the
detection of the accomplice’s attempt too. Although the use of the morphed
image by an accomplice is maybe less pressing, the development of such D-MAD
technologies could still be of interest in the future, even as a mere
precautionary measure. We also note that current identity-based D-MAD methods
are negatively influenced by the high similarity between the document image
and the accomplice, as detailed and experimentally analyzed in Section 1.1,
and then this scenario represents an interesting and challenging research
field, that needs to be addressed in future MAD-related work.

Therefore, we propose ACIdA, a D-MAD method that specifically tackles this
challenging novel scenario, based on three modules that focus on different
aspects of the problem: the Attempt Classification (AC) module, responsible
for the classification of the identity verification attempt in three different
classes (i.e. criminal, accomplice or bona fide attempt); the Identity-
Aritfact module (IdA), based on a combination of artifacts detection and
identity analysis; the Identity module (Id) based only on identity comparison.

The new scenario considered in this paper has been first introduced in [9]
where we showed that combining identity features and artifact analysis can
help to better deal with high subject similarity. This paper further extends
that initial work, including the following original contributions:

Figure 2: Performance of literature D-MAD methods across different identity
similarity scores (x-axis) between input subjects. Values close to $1$
indicate a high similarity. MAD performance is expressed as the weighted
average of the error-based metrics commonly used in the MAD task, and here
referred to as WAE (see Sect. 3.7). As reported, all methods are negatively
influenced by the increasing identity similarity, which corresponds to the
increase in the accomplice’s presence in input images instead of the criminal.
The criminal-accomplice ratio is computed as the number of pairs with the
criminal and the accomplice over the total. Both percentages are represented
with dotted lines. The analyzed D-MAD methods are as follows: ArcFace [5]
(circle), MagFace [6] (triangle), Demorphing [10] (rhombus), and Siamese [7]
(square).

  * •

We investigate a D-MAD scenario in which document images are compared with
both accomplice and criminal contributing subjects and the morphing process in
not necessarily symmetric (i.e. it does not include an equal contribution of
the two subjects). From a practical standpoint, this approach broadens the
scope of application of current D-MAD methods to scenarios, such as the
enrollment one, that have been relatively unexplored until now. We also
highlight, from a quantitative point of view, the lack in terms of accuracy of
identity-based D-MAD methods currently available in the literature.

  * •

We propose ACIdA, a deep learning-based D-MAD method expressively conceived
for the new scenario. Specifically, with respect to [9], we introduce a new
module to provide the attempt classification, and the other two modules focus
on identity and artifact features. All these modules cooperate together to
output the final score through a weighted prediction. For the sake of
reproducibility, we publicly release the code, the list of subject pairs used
for morphing generation for training and testing sets, and the implementation
details of the proposed method111https://github.com/ndido98/acida.

  * •

We perform an extensive and cross-dataset evaluation, highlighting several
experimental aspects of the proposed method. Moreover, we show the
generalization capability of the proposed method in a different D-MAD scenario
through the FVC-onGoing [11] platform.

###  1.1 Issues with existing D-MAD methods

Differential Morping Attack Detection (D-MAD) methods, also known as two-
image- or pair-based methods, involve the utilization of a pair of face images
as input. The aim of these methods is to determine whether the document image
has been morphed or not. The second image, which is a trusted live capture,
can serve as a helpful reference during the task, such as for analyzing
identity, texture, or color inconsistencies when compared with the first one.

In practice, these two images can be obtained during passport issuance, where
the first image is the provided photo and the second image is captured in
real-time. Similarly, during controls at ABC gates, the live image is acquired
through automated face verification procedures, while the probe image is
retrieved from the electronic Machine Readable Travel Document (eMRTD).

Analyzing the results obtained on two important sequestered datasets, i.e.
NIST FATE MORPH [12] and FVC-onGoing [13], it can be noted that the most
promising D-MAD algorithms are based on the comparison of the subject identity
through pre-trained deep learning architectures. We observe that these
approaches can be limited in accuracy with look-alike subjects and, in
particular, when morphed images are compared with the accomplice. These
hypotheses are preliminarily confirmed in our experiments, the results of
which are reported in Figure 2. In particular, we test the performance of
various literature D-MAD systems across several image pairs with increasing
similarity between the subjects, i.e. the document image and the live
acquisition. Identity similarity is obtained by computing the cosine
similarity of identity features extracted through the method described in
[14]. For a comprehensive analysis, we also computed the percentage of
criminal and accomplice pairs over the total number of attempts as a function
of similarity. In order to summarize the MAD performance, results are reported
through the WAE metric (detailed in Sect. 3.7), i.e. the average of error-
based metrics commonly used in the MAD task. As shown, all reported methods
suffer the increasing similarity (values close to $1$ on x-axis), which
corresponds to an increasing number of verification attempts involving the
accomplice subject instead of the criminal one (represented with dotted
lines). The trend of the method [7] differs from other algorithms because,
despite slightly lower performance for low similarity values, it exhibits
greater robustness as the similarity value increases. One possible explanation
derives from the fact that this method utilizes both identity-related features
and features associated with the presence of artifacts to compute the final
morphing score (see Sect. 2 for more details).

Furthermore, an additional limitation of current D-MAD methods lies in the
robustness of pre-trained networks on large and diverse datasets for the face
recognition task, which makes these methods potentially insensitive to clearly
visible artifacts in morphed images. An example of this is depicted in Figure
3, in which the SoA D-MAD method described in [5] wrongly predicts these
images as bona fide, even though visible artifacts are present. Hence, and
also taking into account also the previous considerations, the intuition to
exploit also artifact detection in our D-MAD method, as detailed in Section
3.2.

##  2 Related Work

A variety of D-MAD methods based on hand-crafted features, such as BSIF [15],
LBP [16], and HOG [17], and Machine Learning classifiers have been proposed in
the literature, achieving partially satisfactory results [11, 12]. In
particular, the method described in [18] proposes to compute a histogram of
LBP for both images and to combine them via subtraction. Then, the resulting
$256$-dimensional feature vector is finally used as input to train a Support
Vector Machine (SVM), that is ultimately responsible for emitting the morphing
score. A small portion of methods relies on comparisons between specific
elements of the face, such as the work described in [19] that is based on the
Euclidean and angle distance between the facial landmarks of the probe and
live images. However, the final performance is strongly limited by the
abilities of the facial landmark predictor, and then this category of methods
is excluded from our analysis.

However, one of the most effective and accurate D-MAD approaches is presented
in the recent work of Scherhag et al. [5], in which authors propose a
Convolutional Neural Network (CNN) architecture, specifically a ResNet50 [20],
trained with an angular margin loss referred to as ArcFace [21], originally
designed for the Face Recognition task. This architecture is utilized to
extract feature embeddings from the input images. According to the authors,
the network is pretrained and no additional training procedures are performed
specifically for the morphing detection task: this ensures that the deep
learning model does not suffer from overfitting with training datasets limited
in size and variety. Finally, the extracted features are then subtracted and
fed into an SVM for the final classification process. A recent evolution of
this system has been proposed in [6], in which the backbone is a ResNet
trained through the MagFace [14] loss function, an adaptive mechanism to learn
a well-structured within-class feature distribution relying on the magnitude
of vectors that have achieved SoA performance on the Face Recognition task.

A similar approach is described in [10], where the reverse morphing procedure
(referred to as “demorphing”) is applied to the input images in order to
reveal the real identity hidden in the morphed image. This method works in
combination with Commercial-On-The-Shelf (COTS) face verification systems and
is interesting since it does not require any training procedure. In this case,
the main issue is represented by the fact that the morphing process rarely is
a simple linear combination as assumed by the authors. Moreover, the entire
process is based on the accuracy of the estimation of the position of facial
landmarks and even small localization errors could negatively influence the
effectiveness of the whole pipeline. Similar approaches based on the
Generative Adversarial Network (GAN) paradigms have been proposed [22] in
order to restore the accomplice’s facial image hidden in the morphed one,
unfortunately with limited generalization capabilities.

Figure 3: Sample of morphed images that successfully fool the identity-based
D-MAD system [5] but that exhibit visible artifacts related to the morphing
procedure. Hence, the intuition to exploit also artifact detection techniques
to improve the performance in the D-MAD task, as described in Section 1.1.

In [23], the authors propose to exploit the undecimated 2D Discrete Wavelet
Transform information to feed a Siamese neural network, that accentuates the
disparity between real and morphed images. The results reported in the
original paper are interesting, even though the lack of implementation details
(at the time of writing, the method is under patenting) limits the
reproducibility.

The work described in [7], proposes another deep learning-based Siamese
network in order to focus not only on features related to the identity of
input subjects but also on the presence of artifacts left by the morphing
procedure. Two different branches process the same input image and their
output is finally combined through a fully connected layer to obtain the final
morphing score.

Recently, various works have tackled the D-MAD task, using a variety of
different techniques, such as the fusion of the output of different backbones
[24, 25] or the feature-wise supervision on fine-grained classification [26].
The work of Singh et al. [27] describes a method based on the fusion of
several deep features computed from six different CNNs, trained on the
ImageNet dataset, and merged through a spherical interpolation, referred as
SLERP. Differently from ours, this method is not based on identity features,
and it is specifically conceived for the on-the-fly D-MAD task with different
camera resolutions and acquisition distances.

##  3 Proposed Method

The underlying idea of the development of our method is to process every
possible attempt – criminal, accomplice, and bona fide – with a specific
approach based on different features. Our insight is that for criminal and
bona fide verification attempts, identity-related features are very effective,
as confirmed by the good results achieved by [5]. Differently, for accomplice
verification attempts, due to the greater similarity between subjects, the
discriminative power of identity features is reduced (see Fig. 2) and we
believe the combination with artifact analysis can improve the MAD
performance. To accomplish this paradigm, an initial selector of the attempt
type is needed: then, we build a classifier that outputs the probability of
the attempt type used in the final MAD score computation. The effectiveness of
the use of different modules is experimentally confirmed by the ablation study
reported in Section 3.9.

A general overview of the proposed method is depicted in Figure 4. As shown,
the framework is divided into three main modules: the Attempt Classification
(AC) module, assigned to the classification of the pair attempt provided in
input, the Identity-Artifact (IdA) block, specialized in the detection of
morphed images combining identity and artifact information, and the Identity
block (Id), that relies only on identity analysis to detect morphing attacks.

The final output score is obtained through a weighted sum, formally defined
as:

$S=p_{A}\cdot S_{IdA}+p_{B}\cdot S_{Id}+p_{C}\cdot S_{Id}$ (1)

where $p_{A},p_{B},p_{C}$ are the probabilities that the document image is
compared with the accomplice, bona fide, and criminal subjects, respectively;
these values are output by the SVM classifiers of the AC module.
$S_{IdA},S_{Id}$ are the outputs produced by the classifiers of the IdA and Id
modules. With this procedure, the final output is a weighted sum of all
contributions produced by the different modules, described in the following.

Figure 4: General overview of the proposed system, named ACIdA. As shown, the
method is composed of three different modules: the Attempt Classification (AC)
module, responsible to determine if the document image is compared with the
criminal or the accomplice trust live image (see Sect. 3.1); the Identity (Id)
module, an identity comparison-based MAD system (see Sect. 3.3) and the
Identity-Artifact (IdA) module, that integrates both information about
identity and artifact detection (see Sect. 3.2). Finally, the score of these
two MAD modules is combined through a weighted sum to produce the final output
of the system, i.e. predicting if the input document image is morphed or bona
fide.

###  3.1 Attempt Classification module

The Attempt Classification module is responsible for preparing the input for
all the other modules and for the pair typology classification itself, i.e.
the prediction if the subject depicted in the live acquisition (attempt) is
the criminal or the accomplice (in case of morphed document image), or the
same subject (bona fide). The input is represented by the probe image, i.e.
the one contained in the document, and the trusted live acquisition. Firstly,
these images are fed into the MTCNN face detector [28] that, as the name
suggests, crops the face excluding the large part of the background, preparing
the input images for the feature extraction procedure. The resulting crops are
then used as input to extract features through a backbone that outputs two
feature embeddings of size $512$. We employ a frozen iResNet [29] architecture
as backbone, trained using the magnitude and angular MagFace loss [14],
originally conceived for the face recognition task. This training process has
been conducted on vast-scale datasets, namely MS-Celeb-1M [30] and VGG-Face2
[31], which consist of trillions of face pairs. The two produced embeddings
are combined through the cosine similarity and are finally used as input for
an SVM classifier that outputs $3$ possible different classes: “bona fide”,
“accomplice” and “criminal” along with their probabilities used for the final
classification, as previously detailed.

###  3.2 Identity-Artifact (IdA) module

As the name suggests, the idea behind this module is to combine information
belonging to two different tasks, i.e. face recognition and artifact
detection, following the considerations reported in Section 1.1.

This module receives as input the extracted feature embeddings and the
document images crops. The feature embeddings are then combined in two
different ways: in the first, a subtraction followed by a min-max
normalization (that rescales each component in the range $[0,1]$) is
exploited, while in the second the cosine similarity is used. Since these
embeddings are produced starting from a backbone trained for the Face
Recognition task, we assume they contain information about the subjects’
identities.

The document image crops are fed into an Inception-ResNet V1 [32]
architecture, starting from the weights obtained with the VGG-Face2 [31]
datasets. An additional fine-tuning procedure is conducted on ICAO-compliant
and JPEG-compressed images. A $512$-dimensional feature embedding is obtained
removing the final last fully connected layer of the adopted architecture.

These three outputs are finally combined through a concatenation, obtaining a
$1025$-dimensional feature vector, used as input to a Multi-Layer Perceptron
(MLP) architecture exploited as a classifier that produces in output a score
in the range $\left[0,1\right]$.

###  3.3 Identity (Id) module

For the identity module, we draw inspiration from the solution presented in
[5], which can be considered the current state-of-the-art D-MAD method, as
evidenced by the results published on the FVC-onGoing platform [13].

We employ an iResNet [29] network that has been trained for the purpose of
face recognition using the MagFace loss [14]. As the input consists of two
images, this module generates two distinct feature embeddings of size $512$.
These embeddings are then combined through subtraction, resulting in a single
final feature vector of the same size that is fed into an SVM classifier,
trained to output a probability in the $\left[0,1\right]$ range that
represents whether the probe image is the result of a morphing process. The
authors demonstrate that the MagFace loss function yields robust embeddings by
maximizing the geodesic distance between different identities. Consequently,
the produced embeddings exclusively contain information pertaining to the
input face identity.

###  3.4 Proposed Scenario

As previously mentioned, in the proposed scenario the document images are
compared with bona fide, criminal, and accomplice subjects. In particular, for
the sake of clarity, the experimental results are categorized into three
distinct sub-benchmarks based on the trusted live image’s identity.

These benchmarks include:

  * •

Accomplice: this benchmark is built with morphed attempts where the live image
is from the accomplice as well as bona fide attempt. An example of the input
pair of this benchmark consists in Figure 5(a) and 5(b).

  * •

Criminal: conversely, this scenario encompasses authentic and morphed attempts
where the live image belongs to the criminal subject (e.g. Figure 5(c) and
5(b)). This is the common case usually investigated in the MAD literature.

  * •

Both: in this case, this scenario is obtained through a union of the previous
ones. This scenario is useful to understand the generalization capabilities of
the MAD method, which is not aware of the pair type received in input.

In the subsequent analysis, particular emphasis is placed on the performance
achieved in the “accomplice” scenario. As previously mentioned and
experimentally validated (see Fig. 2), due to the greater resemblance between
the subjects depicted in both images, this scenario is generally regarded as
more challenging for D-MAD methods based on identity analysis.

Finally, it is important to note that the “criminal” case represents the
traditional benchmark for testing D-MAD methods, so these results can be used
as a reference for previous work.

(a) Subject 1

(b) Morphed

(c) Subject 2

Figure 5: In a D-MAD approach, the morphed image (Fig. 5(b)) can be compared
with the criminal (Fig. 5(c)) or with the accomplice (Fig. 5(a)), or both, as
in the introduced scenario.

###  3.5 Datasets

Progressive Morphing Database (PMDB) [10]: a total of $1108$ morphed images
are obtained by utilizing three commonly used datasets in the MAD field,
namely AR [33], FRGC [34], and Color Feret [35]. These images have been
generated using a publicly available morphing algorithm outlined in a previous
study [10]. The morphing process involved a cohort of $280$ individuals,
consisting of $134$ males and $146$ females. It is noteworthy that these
morphed images have not been subjected to manual retouching procedures to
enhance their visual quality, thus potentially exhibiting artifacts such as
blurred areas or ghost effects. However, it is important to mention that the
background replacement performed by the morphing is artifact-free.

Idiap Morph [36] is a collection of multiple datasets publicly accessible,
comprising five subsets generated using different morphing algorithms. In our
analysis, we focus on OpenCV [37], FaceMorpher [38], and StyleGAN [39]. These
algorithms utilize face images from the Feret, FRGC, and Face Research Lab
London Set [40] datasets as input data. The overall visual quality of the
morphed images created with OpenCV and FaceMorpher is negatively affected by
the presence of various artifacts present in both the background and the
foreground of the images. Differently, morphed faces generated through
StyleGAN exhibit fewer visible visual artifacts, but common textures
associated with GANs are still discernible.

MorphDB [10]. This dataset is constructed using images sourced from the Color
Feret [35] and FRGC [34] datasets. It comprises 100 morphed images generated
through the Sqirlz Morph 2.1 algorithm. This dataset offers valuable material
as all morphed images have undergone manual retouching, resulting in good
final visual quality.

FEI Morph. This dataset in question is produced using images sourced from the
FEI Face Database [41], which consists of $200$ subjects evenly divided
between males and females. The faces within the database predominantly
represent individuals aged between $19$ and $40$ years old, showcasing
distinct appearances, hairstyles, and accessories. This dataset comprises a
total of $6000$ morphed images, generated through the utilization of three
different morphing algorithms: FaceFusion [42], UTW [3], and NTNU [3]. These
algorithms employ two varying morphing factors, specifically $0.3$ and $0.5$.
The need to introduce this new dataset arises from the necessity to faithfully
replicate the new scenario introduced, in which, specifically, the morphed
image appears particularly similar to the accomplice and the goal is to detect
morphing even when the live acquisition comes from the most similar subject.

###  3.6 Experimental Protocol

In all our experiments, we conduct a cross-dataset evaluation to assess the
effectiveness of our method. The training and validation of the proposed
approach are performed on PMDB, MorphDB, and Idiap Morph datasets, while the
proposed MAD method is tested on the FEI Morph dataset. We observe that the
testing FEI Morph dataset is completely disjoint from the training ones: it
has no common elements with the training datasets, neither in terms of
contributing subjects (for the morphing generation) nor in terms of the
morphing algorithms. It is important to note that the test on the FEI Morph
dataset is fully reproducible for future comparisons since the FEI Face
Database [41] used to select the input images is publicly available as well as
the morphing algorithms used to generate the morphed images; in addition, the
list of image pairs used for morphing generation and the index of test
attempts will be released. A cross-dataset evaluation procedure is relevant
due to the scarcity of publicly available datasets with diverse samples for
each subject and morphing algorithms. Besides, privacy issues play a crucial
role in hindering the public release of such datasets.

###  3.7 Metrics

In the evaluation and comparison of MAD systems, various metrics are typically
employed to assess their performance [3]. Two commonly used metrics are
referred to as Bona Fide Presentation Classification Error Rate (BPCER) and
the Attack Presentation Classification Error Rate (APCER). The BPCER measures
the proportion of bona fide images that are incorrectly classified while the
APCER represents the proportion of morphed images that are erroneously labeled
as bona fide.

The formulations of these metrics are as follows:

$\textnormal{BPCER}(\tau)=\frac{1}{N}\sum_{i=1}^{N}H(b_{i}-\tau)$ (2)
$\textnormal{APCER}(\tau)=1-\left[\frac{1}{M}\sum_{i=1}^{M}H(m_{i}-\tau)\right]$
(3)

In both definitions, $\tau$ represents the score threshold at which the
detection scores for bona fide and morphed images ($b_{i},m_{i}$) are
compared. The function $H(x)$ is defined as a step function, which returns $1$
if $x$ is greater than $0$ and $0$ otherwise. The BPCER is typically evaluated
with respect to a specified APCER value, here referred to as B0.05 and B0.01.
These values correspond to the lowest BPCER achievable while maintaining an
APCER of $10\%$ and $5\%$, respectively. In an ideal scenario, a MAD algorithm
deployed in a real-world setting would aim to achieve a low APCER (allowing
only a minimal number of criminals to bypass detection) of around $0.1\%$,
while simultaneously maintaining an acceptable BPCER (generating few false
positives) of approximately $5\%$ [43].

Method | Year | Accomplice | Criminal | Both
---|---|---|---|---
| EER | B0.05 | B0.01 | EER | B0.05 | B0.01 | EER | B0.05 | B0.01
Demorphing [10] | 2017 | .160 | .377 | .618 | .027 | .015 | .050 | .111 | .235 | .522
SVM+LBP [18] | 2018 | .200 | .327 | .623 | .185 | .335 | .697 | .192 | .330 | .628
DFR [5] | 2020 | .178 | .482 | .770 | .068 | .090 | .295 | .128 | .347 | .690
Siamese [7] | 2021 | .153 | .347 | .563 | .061 | .095 | .370 | .115 | .257 | .515
MagFace [6] | 2023 | .112 | .230 | .465 | .028 | .013 | .052 | .083 | .135 | .393
ACIdA (Ours) | 2023 | .102 | .192 | .333 | .023 | .010 | .027 | .070 | .105 | .280
Table 1: Morphing detection scores obtained on the FEI Morph test dataset
across different Differential MAD (D-MAD) competitors presented in the
literature. Results are reported in terms of Equal Error Rate (EER), the
lowest BPCER related to APCER $\leq 1\%$ and $\leq 5\%$, respectively (see
Sect. 3.7). As reported, the proposed method achieves the best accuracy across
all the competitors both in the “accomplice” and in the “criminal” benchmarks.
The generalization capabilities are confirmed in the “both” case, in which our
model effectively handles different attempt typologies. Figure 6: Detection
Error Trade-off (DET) curves computed on the FEI Morph dataset considering
several literature competitors. Competitor reported: ACIdA in orange, [14] in
blue, [21] in red, [7] in dark green, [18] in light green and [10] in purple.
[Better in color.]

The Equal Error Rate (EER) is a commonly reported metric, representing the
error rate at which the BPCER and APCER are equal. It is typically presented
as a single value, providing a summary measure of the system’s performance.
Besides, APCER and BPCER metrics can be condensed in the Detection Error
Trade-off (DET) curve, reported as well to improve the understanding and the
comparison of the experimental analysis.

In this paper, we introduce and exploit also the metric Weighted Average Error
Metric (WAE) in order to summarize all the performance indicators in a single
value (as done in Figure 2). This metric is formally defined as:

$\text{WAE}=w_{E}E^{T}$ (4)

where $E$ is the set of error-based metric values $E=$[ EER, B0.1, B0.05,
B0.01] and $w_{E}=[0.3,\,0.1,\,0.2,\,0.4]$. These weights are chosen by
assigning the majority of the weight to the most common real-world operating
point (i.e. B0.01), followed by the EER, as it is useful for evaluating the
performance of the system at a glance, and finally the other two chosen
operating points (i.e. B0.05 and B0.1).

###  3.8 Training procedure

In the IdA module, the MLP has an architecture composed of $3$ hidden layers
of size $250$, $125$, and $64$, with ReLU activation and a single output
neuron with a sigmoid function. For the training, we adopt the Adam [44]
optimizer with an initial learning rate of $10^{-5}$. For the training of the
Inception-ResNet, we adopt the SGD optimizer with a learning rate of $10^{-3}$
and an early-stopping procedure (patience of 5 epochs with a minimum
improvement of $10^{-4}$). No momentum decay is exploited.

In the other modules, SVM classifiers share the same details: they implement
the Radial Basis Function (RBF) kernel, and are trained with the
regularization parameter $C=1.0$, and the kernel coefficient $\gamma=10^{-3}$.

Feat. Embed. | Accomplice | Criminal | Both
---|---|---|---
EER | B0.05 | B0.01 | EER | B0.05 | B0.01 | EER | B0.05 | B0.01
ArcFace [21] | .115 | .255 | .507 | .056 | .063 | .115 | .093 | .142 | .385
DLib [45] | .176 | .375 | .587 | .103 | .155 | .240 | .148 | .255 | .517
SFace [46] | .213 | .480 | .640 | .102 | .167 | .327 | .166 | .363 | .585
Facenet [47] | .129 | .308 | .510 | .061 | .075 | .142 | .097 | .175 | .435
MagFace [14] | .102 | .192 | .333 | .023 | .010 | .027 | .070 | .105 | .280
Table 2: Morphing detection scores obtained by the proposed system on the FEI Morph dataset using different feature embeddings originally developed for the Face Recognition task. In bold the best results, underlined the second ones. Module | Accomplice | Criminal | Both
---|---|---|---
IdA | Id | EER | B0.05 | B0.01 | EER | B0.05 | B0.01 | EER | B0.05 | B0.01
✓ | ✓ | .102 | .192 | .333 | .023 | .010 | .027 | .070 | .105 | .280
✓ |  | .120 | .207 | .455 | .117 | .195 | .415 | .120 | .203 | .440
✓∗ |  | .125 | .230 | .480 | .125 | .230 | .480 | .125 | .230 | .480
| ✓ | .112 | .230 | .465 | .028 | .013 | .052 | .083 | .135 | .393
∗ Only the Inception-ResNet architecture of IdA module is tested (see Fig. 4).
Table 3: Ablation analysis results obtained on the FEI Morph dataset. As
reported, the single modules of the proposed system – IdA (Sect. 3.2) and Id
(Sect. 3.3) – are separately tested. In addition, we compute the results
obtained using only the Inception-ResNet architecture of the IdA module.

###  3.9 Results

The results of the proposed MAD method compared with the literature are
reported in Table 1, while the DET curve is reported in Figure 6. As shown,
our method is able to overcome the competitors in all the investigated
benchmarks. In particular, our method not only achieves better performance in
comparison with D-MAD based only on identity comparison [5, 6, 10] but also
with methods that include the analysis of artifacts introduced by the morphing
procedure on input images [7, 18]. We note also that, in all cases, the error
rates obtained in the accomplice scenario are higher, confirming that the
proposed scenario introduces specific challenges and requires specific
investigations in future D-MAD works. It is important to note that our method
achieves great accuracy in the “criminal” benchmarks, confirming its
effectiveness also in a more traditional D-MAD working scenario. Finally, the
results of the “both” case, suggest that the inclusion of an Attempt
classification module, i.e. a mechanism that gives the possibility to apply
different solutions with criminals and accomplices, is a key element in
improving overall performance, as also investigated in the following.

Classifier | Accuracy | F1-score
---|---|---
SVM | 0.650 | 0.634
Random forest | 0.575 | 0.554
AdaBoost | 0.603 | 0.580
KNN (K=5) | 0.575 | 0.545
Decision Tree | 0.572 | 0.554
MLP | 0.639 | 0.634
Table 4: Comparison of several classifiers of the Attempt Classification (AC) module, using as input feature embeddings extracted using the method described in [14]. Classification Attempt (CA) |  | Morphing Attack Detection (IdA - Id)
---|---|---
Classifier | Accuracy | BF to | Accomplice | Criminal | Both
EER | B0.05 | B0.01 | EER | B0.05 | B0.01 | EER | B0.05 | B0.01
Oracle | 100% | IdA | .120 | .207 | .455 | .208 | .522 | .625 | .146 | .480 | .598
Id | .006 | .002 | .005 | .028 | .013 | .052 | .018 | .005 | .040
SVM | 66.9% | IdA | .171 | .495 | .560 | .046 | .027 | .555 | .118 | .445 | .555
Id | .102 | .192 | .333 | .023 | .010 | .027 | .070 | .105 | .280
Table 5: Classification performance and morphing detection scores obtained on
the FEI Morph dataset. In particular, we highlight the impact of the attempt
classification accuracy on the whole proposed system, with respect to the
performance of an “oracle” classifier reported on the top lines.

In the second part of our analysis, we test how the performance of the
proposed system is influenced when two different score fusion techniques are
employed to create the final MAD score, namely “weighted” and “selection”: the
former produces the final morphing score by summing the ones produced by the
different modules, each weighted by the probabilities returned by the Attempt
Classification module, as described in Equation 1 and depicted in Figure 4;
the latter directly returns the score produced by the module whose associated
probability computed by the Attempt Classification module is the highest, as
shown in Equation 5, where $p_{max}=\max\left(p_{A},p_{B},p_{C}\right)$.

$S=\begin{cases}S_{Id}&\text{if }p_{B}=p_{max}\wedge p_{C}=p_{max}\\\
S_{IdA}&\text{if }p_{C}=p_{max}\\\ \end{cases}$ (5)

Experimental results show that the weighted strategy is overall more effective
than employing the selection fusion technique, respectively totaling on the
global test set $\text{EER}=0.070$ versus $0.076$, $\text{B}_{0.05}=0.105$
versus $0.125$, and $\text{B}_{0.01}=0.280$ versus $0.385$. Therefore, the
weighted sum fusion strategy is adopted in our framework.

In Table 2, we include an analysis of the feature embedding source: indeed,
several works on the Face Recognition task have been recently introduced in
the literature [47, 21, 14, 46], constantly improving the accuracy, and can be
exploited in our proposed MAD pipeline. In particular, we focus our analysis
on recent and state-of-the-art methods. According to the analysis provided by
the Deepface framework 222https://github.com/serengil/deepface, we select
best-performing algorithms on the Labeled Faces in the Wild [48] dataset. In
addition, we include in our analysis also the recently introduced and
promising MagFace [14] approach. It is important to note that one of the top-
performing methods, ArcFace [21], has already been effectively utilized in the
field of D-MAD [5]. As reported, MagFace achieves the best performance,
confirming that superior accuracy in the Face Recognition task leads to better
performance also in the MAD task, especially if based on the identity
comparison.

In Table 3, the ablation study of the proposed method is reported. In
particular, we test the performance of the system using only the IdA or the Id
module and exploiting the previously determined best feature (i.e. MagFace
[14]). In addition, we report the results exploiting only the Inception-Resnet
architecture, which computes the morphing score relying only on the document
image, in a S-MAD fashion. Experimental results confirm that the adoption of
both modules is essential to obtain good performance, and that, as expected,
the second module, i.e. Id, is particularly able to detect the morphed images
in the “criminal” benchmark, while the IdA module obtains interesting results,
in terms of BPCERs (B0.05, B0.01), in the accomplice one.

In conclusion of our experimental analysis, we focus our investigation on the
Attempt Classification (AC) module.

In the first experiment, reported in Table 4, we test a variety of different
classifiers. Interestingly, experimental results reveal that the SVM is the
best choice, also with respect to deep learning-based solutions (i.e. MLP).

In addition, we analyze the impact of the classification accuracy of the
adopted SVM classifier on the whole MAD pipeline. Indeed, in order to have an
upper bound result, we replace in the AC module, the SVM classifier with an
oracle, i.e. a classifier able to perfectly predict the classes – criminal
accomplice and bona fide – of the input attempts. In addition, we analyze how
the overall performance of the system is affected when the morphing score of
bona fide pairs is computed using $S_{IdA}$ instead of $S_{Id}$ (see Eq. 1).

Results are reported in Table 5.

Firstly, the accuracy of the SVM classifier with respect to the oracle reveals
that there is a margin for improvement in the attempt classification task.
Closing this gap can significantly enhance the overall performance, as
demonstrated by the impressive MAD results reported in the oracle case, with
an $\text{EER}=0.006$.

Secondly, it is possible to note that a substantial improvement in the overall
MAD performance is achieved by properly selecting the module used in the
weighted average score computation for bona fide images. Specifically, the use
of the Id module with bona fide images represents the best solution, since
analyzing artifacts produced by the morphing procedure is not useful – bona
fide images are free of visible or not visible artifacts – and it could even
be counterproductive. Indeed, in the MAD literature, the S-MAD task, and
specifically the artifact detection task, is more challenging with respect to
the D-MAD one [3].

Finally, we test the proposed system on the FVC-onGoing platform. It is worth
noting that publicly available platforms [12, 11] do not provide an effective
test bed for the scenario described in this paper, since typically the
accomplice attempts are not considered when the presence in the morphed image
is unbalanced in favor of the accomplice. Results are reported in Table 6: we
observe that the proposed method is able to achieve good accuracy in any case,
in particular with respect to the previous work [9]. In this criminal-based
scenario, DFR [5] remains the preferable option to use to achieve good
performance, since it is based on highly effective identity features when the
comparison involves only the criminal or the morphed images equally represents
the two contributing subjects (i.e. the morphing factor is $0.5$).

Algorithm | EER | B0.1 | B0.05 | B0.01
---|---|---|---|---
DFR [5] | 4.54 | 2.00 | 3.93 | 18.87
Demorphing [10] | 14.17 | 17.20 | 22.77 | 65.57
Siamese [7] | 23.37 | 35.03 | 48.97 | 93.60
MBLBP [49] | 33.47 | 52.80 | 59.93 | 74.80
WL [50] | 37.13 | 71.67 | 83.27 | 95.67
BSIF [15] | 45.93 | 78.30 | 84.13 | 93.83
DN [51] | 52.03 | 89.70 | 94.70 | 98.57
Laplace [52] | 55.13 | 96.70 | 98.67 | 99.87
R-DMAD [9] | 10.23 | 10.33 | 19.67 | 47.47
ACIdA | 7.84 | 7.57 | 12.60 | 26.23
Table 6: Comparison of the results on the sequestered DMAD-SOTAMD_D-1.0
benchmark through the FVConGoing platform [11]. As shown, the proposed method
is able to generalize on a different scenario, obtaining a good accuracy
w.r.t. the other D-MAD methods available in the literature.

##  4 Conclusion

ACIdA, a novel modular D-MAD method was proposed, and extensive experimental
validation demonstrated its ability to achieve state-of-the-art results,
surpassing competing methods in the proposed scenario. These results suggest
that an analysis of possible morphing artifacts in combination with the use of
identity features can increase the robustness of D-MAD approaches when dealing
with a high subject similarity. Furthermore, a new scenario was introduced,
expanding the scope of application of current MAD systems based on two input
images (D-MAD), by comparing trusted live acquisition images with both
criminal and accomplice subjects. Our preliminary analysis indicates that this
new scenario is challenging and raises new interesting research aspects in the
D-MAD field, especially for identity-based systems. The findings of this study
contribute to the advancement of MAD systems, enhancing the security and
reliability of FRS in the face of morphing attacks. Further research can build
upon these results to develop even more robust and efficient MAD systems in
the future. In particular, new experimentation and research are needed to
improve the classification accuracy of the attempt that, as shown, is a key
element for the final performance of the proposed system. Finally, we suggest
the possibility of integrating the proposed novel scenario in the two main web
platforms with sequestered datasets for the MAD task, i.e. NIST FATE MORPH and
FVC-onGoing, that, at the time of writing, offers D-MAD tests with only the
criminal comparison.

## References

  * [1] Ferrara Matteo, Franco Annalisa, and Maltoni Davide.  The magic passport.  In IEEE International Joint Conference on Biometrics (IJCB’14), pages 1–7, 2014.
  * [2] Ulrich Scherhag, Andreas Nautsch, Christian Rathgeb, Marta Gomez-Barrero, Raymond NJ Veldhuis, Luuk Spreeuwers, Maikel Schils, Davide Maltoni, Patrick Grother, Sebastien Marcel, et al.  Biometric systems under morphing attacks: Assessment of morphing techniques and vulnerability reporting.  In 2017 International Conference of the Biometrics Special Interest Group (BIOSIG), pages 1–7. IEEE, 2017.
  * [3] Kiran Raja, Matteo Ferrara, Annalisa Franco, Luuk Spreeuwers, Ilias Batskos, Florens de Wit, Marta Gomez-Barrero, Ulrich Scherhag, Daniel Fischer, Sushma Krupa Venkatesh, et al.  Morphing attack detection-database, evaluation platform, and benchmarking.  IEEE transactions on information forensics and security, 16:4336–4351, 2020.
  * [4] Guido Borghi, Gabriele Graffieti, Annalisa Franco, and Davide Maltoni.  Incremental training of face morphing detectors.  In 2022 26th International Conference on Pattern Recognition (ICPR), pages 914–921. IEEE, 2022.
  * [5] Ulrich Scherhag, Christian Rathgeb, Johannes Merkle, and Christoph Busch.  Deep face representations for differential morphing attack detection.  IEEE transactions on information forensics and security, 15:3625–3639, 2020.
  * [6] Roman Kessler, Kiran Raja, Juan Tapia, and Christoph Busch.  Towards minimizing efforts for morphing attacks–deep embeddings for morphing pair selection and improved morphing attack detection.  arXiv preprint arXiv:2305.18216, 2023.
  * [7] Guido Borghi, Emanuele Pancisi, Matteo Ferrara, and Davide Maltoni.  A double siamese framework for differential morphing attack detection.  Sensors, 21(10):3466, 2021.
  * [8] Matteo Ferrara, Annalisa Franco, and Davide Maltoni.  Decoupling texture blending and shape warping in face morphing.  In 2019 international conference of the biometrics special interest group (BIOSIG), pages 1–5. IEEE, 2019.
  * [9] Nicolò Di Domenico, Guido Borghi, Annalisa Franco, and Davide Maltoni.  Combining identity features and artifact analysis for differential morphing attack detection.  In International Conference on Image Analysis and Processing, pages 100–111. Springer, 2023.
  * [10] Matteo Ferrara, Annalisa Franco, and Davide Maltoni.  Face demorphing.  IEEE Transactions on Information Forensics and Security, 13(4):1008–1017, 2017.
  * [11] Biolab.  FVC-onGoing.  https://biolab.csr.unibo.it/fvcongoing/.  Accessed: 2022-11-30.
  * [12] National Institute of Standards and Technology.  NIST FRVT Morph.
  * [13] Bernadette Dorizzi, Raffaele Cappelli, Matteo Ferrara, Dario Maio, Davide Maltoni, Nesma Houmani, Sonia Garcia-Salicetti, and Aurélien Mayoue.  Fingerprint and on-line signature verification competitions at icb 2009.  In Advances in Biometrics: Third International Conference, ICB 2009, Alghero, Italy, June 2-5, 2009. Proceedings 3, pages 725–732. Springer, 2009.
  * [14] Qiang Meng, Shichao Zhao, Zhida Huang, and Feng Zhou.  Magface: A universal representation for face recognition and quality assessment.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 14225–14234, 2021.
  * [15] Juho Kannala and Esa Rahtu.  Bsif: Binarized statistical image features.  In Proceedings of the 21st international conference on pattern recognition (ICPR2012), pages 1363–1366. IEEE, 2012.
  * [16] Timo Ojala, Matti Pietikainen, and David Harwood.  Performance evaluation of texture measures with classification based on kullback discrimination of distributions.  In Proceedings of 12th international conference on pattern recognition, volume 1, pages 582–585. IEEE, 1994.
  * [17] Navneet Dalal and Bill Triggs.  Histograms of oriented gradients for human detection.  In 2005 IEEE computer society conference on computer vision and pattern recognition (CVPR’05), volume 1, pages 886–893. Ieee, 2005.
  * [18] Ulrich Scherhag, Christian Rathgeb, and Christoph Busch.  Towards detection of morphed face images in electronic travel documents.  In 2018 13th IAPR International Workshop on Document Analysis Systems (DAS), pages 187–192. IEEE, 2018.
  * [19] Ulrich Scherhag, Dhanesh Budhrani, Marta Gomez-Barrero, and Christoph Busch.  Detecting morphed face images using facial landmarks.  In Image and Signal Processing: 8th International Conference, ICISP 2018, Cherbourg, France, July 2-4, 2018, Proceedings 8, pages 444–452. Springer, 2018.
  * [20] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun.  Deep residual learning for image recognition.  In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016.
  * [21] Jiankang Deng, Jia Guo, Niannan Xue, and Stefanos Zafeiriou.  Arcface: Additive angular margin loss for deep face recognition.  In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 4690–4699, 2019.
  * [22] Fei Peng, Le-Bing Zhang, and Min Long.  Fd-gan: Face de-morphing generative adversarial network for restoring accomplice’s facial image.  IEEE Access, 7:75122–75131, 2019.
  * [23] Baaria Chaudhary, Poorya Aghdaie, Sobhan Soleymani, Jeremy Dawson, and Nasser M Nasrabadi.  Differential morph face detection using discriminative wavelet sub-bands.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 1425–1434, 2021.
  * [24] Iurii Medvedev, Joana Pimenta, and Nuno Gonçalves.  Fused classification for differential face morphing detection.  arXiv preprint arXiv:2309.00665, 2023.
  * [25] Elidona Shiqerukaj, Christian Rathgeb, Johannes Merkle, Pawel Drozdowski, and Benjamin Tams.  Fusion of face demorphing and deep face representations for differential morphing attack detection.  In 2022 International Conference of the Biometrics Special Interest Group (BIOSIG), pages 1–5. IEEE, 2022.
  * [26] Le Qin, Fei Peng, and Min Long.  Face morphing attack detection and localization based on feature-wise supervision.  IEEE Transactions on Information Forensics and Security, 17:3649–3662, 2022.
  * [27] Jag Mohan Singh and Raghavendra Ramachandra.  Reliable face morphing attack detection in on-the-fly border control scenario with variation in image resolution and capture distance.  In 2022 IEEE International Joint Conference on Biometrics (IJCB), pages 1–10. IEEE, 2022.
  * [28] Kaipeng Zhang, Zhanpeng Zhang, Zhifeng Li, and Yu Qiao.  Joint face detection and alignment using multitask cascaded convolutional networks.  IEEE signal processing letters, 23(10):1499–1503, 2016.
  * [29] Ionut Cosmin Duta, Li Liu, Fan Zhu, and Ling Shao.  Improved residual networks for image and video recognition.  In 2020 25th International Conference on Pattern Recognition (ICPR), pages 9415–9422. IEEE, 2021.
  * [30] Yandong Guo, Lei Zhang, Yuxiao Hu, Xiaodong He, and Jianfeng Gao.  Ms-celeb-1m: A dataset and benchmark for large-scale face recognition.  In Computer Vision–ECCV 2016: 14th European Conference, Amsterdam, The Netherlands, October 11-14, 2016, Proceedings, Part III 14, pages 87–102. Springer, 2016.
  * [31] Qiong Cao, Li Shen, Weidi Xie, Omkar M Parkhi, and Andrew Zisserman.  Vggface2: A dataset for recognising faces across pose and age.  In 2018 13th IEEE international conference on automatic face & gesture recognition (FG 2018), pages 67–74. IEEE, 2018.
  * [32] Christian Szegedy, Wei Liu, Yangqing Jia, Pierre Sermanet, Scott Reed, Dragomir Anguelov, Dumitru Erhan, Vincent Vanhoucke, and Andrew Rabinovich.  Going deeper with convolutions.  In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 1–9, 2015.
  * [33] Aleix Martinez and Robert Benavente.  The ar face database: Cvc technical report, 24.  1998\.
  * [34] P Jonathon Phillips, Patrick J Flynn, Todd Scruggs, Kevin W Bowyer, Jin Chang, Kevin Hoffman, Joe Marques, Jaesik Min, and William Worek.  Overview of the face recognition grand challenge.  In 2005 IEEE computer society conference on computer vision and pattern recognition (CVPR’05), volume 1, pages 947–954. IEEE, 2005.
  * [35] P Jonathon Phillips, Harry Wechsler, Jeffery Huang, and Patrick J Rauss.  The feret database and evaluation procedure for face-recognition algorithms.  Image and vision computing, 16(5):295–306, 1998.
  * [36] Eklavya Sarkar, Pavel Korshunov, Laurent Colbois, and Sébastien Marcel.  Are gan-based morphs threatening face recognition?  In ICASSP 2022-2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 2959–2963. IEEE, 2022.
  * [37] Satya Mallick.  “Face morph using opencv — c++ / python.  https://learnopencv.com/face-morph-using-opencv-cpp-python/.  Accessed: 2022-11-30.
  * [38] Alyssa Quek.  FaceMorpher morphing algorithm.  https://github.com/alyssaq/face_morpher.  Accessed: 2022-11-30.
  * [39] Tero Karras, Samuli Laine, Miika Aittala, Janne Hellsten, Jaakko Lehtinen, and Timo Aila.  Analyzing and improving the image quality of stylegan.  In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 8110–8119, 2020.
  * [40] Lisa DeBruine and Benedict Jones.  Face research lab london set.  Psychol. Methodol. Des. Anal, 2017.
  * [41] Carlos Eduardo Thomaz and Gilson Antonio Giraldi.  A new ranking method for principal components analysis and its application to face image analysis.  Image and vision computing, 28(6):902–913, 2010.
  * [42] FaceFusion.  Facefusion.  http://www.wearemoment.com/FaceFusion/.  Accessed: 2022-11-30.
  * [43] Matteo Ferrara and Annalisa Franco.  Morph creation and vulnerability of face recognition systems to morphing.  In Handbook of Digital Face Manipulation and Detection: From DeepFakes to Morphing Attacks, pages 117–137. Springer International Publishing Cham, 2022.
  * [44] Diederik P Kingma and Jimmy Ba.  Adam: A method for stochastic optimization.  arXiv preprint arXiv:1412.6980, 2014.
  * [45] Davis E King.  Dlib-ml: A machine learning toolkit.  The Journal of Machine Learning Research, 10:1755–1758, 2009.
  * [46] Yaoyao Zhong, Weihong Deng, Jiani Hu, Dongyue Zhao, Xian Li, and Dongchao Wen.  Sface: Sigmoid-constrained hypersphere loss for robust face recognition.  IEEE Transactions on Image Processing, 30:2587–2598, 2021.
  * [47] Florian Schroff, Dmitry Kalenichenko, and James Philbin.  Facenet: A unified embedding for face recognition and clustering.  In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 815–823, 2015.
  * [48] Gary B Huang, Marwan Mattar, Tamara Berg, and Eric Learned-Miller.  Labeled faces in the wild: A database forstudying face recognition in unconstrained environments.  In Workshop on faces in’Real-Life’Images: detection, alignment, and recognition, 2008.
  * [49] Ulrich Scherhag, R Ramachandra, KB Raja, Marta Gomez-Barrero, C Rathgeb, and C Busch.  On the vulnerability and detection of digital morphed and scanned face images.  In Proc. Int. Workshop on Biometrics and Forensics (IWBF), 2017.
  * [50] Naser Damer, Viola Boller, Yaza Wainakh, Fadi Boutros, Philipp Terhörst, Andreas Braun, and Arjan Kuijper.  Detecting face morphing attacks by analyzing the directed distances of facial landmarks shifts.  In Pattern Recognition: 40th German Conference, GCPR 2018, Stuttgart, Germany, October 9-12, 2018, Proceedings 40, pages 518–534. Springer, 2019.
  * [51] Jag Mohan Singh, Raghavendra Ramachandra, Kiran B Raja, and Christoph Busch.  Robust morph-detection at automated border control gate using deep decomposed 3d shape & diffuse reflectance.  In 2019 15th International Conference on Signal-Image Technology & Internet-Based Systems (SITIS), pages 106–112. IEEE, 2019.
  * [52] Christian Kraetzer, Andrey Makrushin, Tom Neubert, Mario Hildebrandt, and Jana Dittmann.  Modeling attacks on photo-id documents and applying media forensics for the detection of facial morphing.  In Proceedings of the 5th ACM workshop on information hiding and multimedia security, pages 21–32, 2017.


# Lattice Size in Higher Dimension

Abdulrahman Alajmi  Department of Mathematical Sciences
Kent State University
800 E. Summit st., Kent, OH 44242, USA<EMAIL_ADDRESS>,  Sayok Chakravarty
Department of Mathematics, Statistics, and Computer Science
University of Illinois Chicago
851 S. Morgan Street
Chicago, IL 60607-7045<EMAIL_ADDRESS>,  Zachary Kaplan  New Jersey
Department of Environmental Protection
516 East State Street, Trenton, NJ, 08609<EMAIL_ADDRESS>and
Jenya Soprunova  Department of Mathematical Sciences
Kent State University
800 E. Summit st., Kent, OH 44242, USA<EMAIL_ADDRESS>http://www.math.kent.edu/ soprunova/

###### Abstract.

The lattice size of a lattice polytope is a geometric invariant which was
formally introduced in the context of simplification of the defining equation
of an algebraic curve, but appeared implicitly earlier in geometric
combinatorics. Previous work on the lattice size was devoted to studying the
lattice size in dimension 2 and 3. In this paper we establish explicit
formulas for the lattice size of a family of lattice simplices in arbitrary
dimension.

###### Key words and phrases:

Lattice size, lattice width, lattice polytopes

###### 2010 Mathematics Subject Classification:

11H06, 52B20, 52C07

Work of Chakravarty, Kaplan, and Soprunova was partially supported by NSF
Grant DMS-1653002

††copyright: ©:

##  1\. Introduction

This paper is devoted to computing explicitly the lattice size for a family of
lattice simplices in $\mathbb{R}^{d+1}$. We start with recalling some basic
definitions related to lattice polytopes.

We say that a point $p\in\mathbb{R}^{d}$ is a lattice point if all of its
coordinates are integers. A lattice polytope $P\subset\mathbb{R}^{d}$ is the
convex hull of finitely many lattice points in $\mathbb{Z}^{d}$. A lattice
segment is a segment that connects two lattice points. Such a segment is
primitive if its only lattice points are its endpoints. The lattice length of
a lattice segment is one less than the number of lattice points it contains
(so that a primitive segment has lattice length one). A lattice polytope is
empty if its only lattice points are its vertices.

We say that matrix $A$ of size $d$ with integer entries is unimodular if
$\det(A)=\pm 1$. The set of such matrices is denoted by ${\rm
GL}(d,\mathbb{Z})$. We say that a map $L\colon\mathbb{R}^{d}\to\mathbb{R}^{d}$
is an affine unimodular map if it is a composition of multiplication by a
unimodular matrix and a translation by an integer vector. Such maps preserve
the integer lattice $\mathbb{Z}^{d}\subset\mathbb{R}^{d}$. We say that two
lattice polytopes in $\mathbb{R}^{d}$ are lattice-equivalent if one is the
image of another under an affine unimodular map.

Let $h$ be an integer vector in $\mathbb{R}^{d}$. For a lattice polytope
$P\subset\mathbb{R}^{d}$, we define the lattice width of $P$ in the direction
of $h$ by

$\operatorname{w}_{h}(P)=\max\limits_{x\in P}\langle
h,x\rangle-\min\limits_{x\in P}\langle h,x\rangle,$

where $\langle h,x\rangle$ is the standard inner product in $\mathbb{R}^{d}$.
Then the lattice width $\operatorname{w}(P)$ of $P$ is the minimum of
$\operatorname{w}_{h}(P)$ over nonzero integer vectors $h\in\mathbb{Z}^{d}$.

The lattice size of a lattice polytope is an important geometric invariant of
a lattice polytope that was formally introduced in [6], but appeared
implicitly earlier in [2, 4, 5, 11, 14]. It was further studied in [1, 8, 9,
15].

We next reproduce the definition of the lattice size from [6]. Let
$0\in\mathbb{R}^{d}$ be the origin and let $(e_{1},\dots,e_{d})$ be the
standard basis of $\mathbb{R}^{d}$. The standard simplex
$\Delta\subset\mathbb{R}^{d}$ is defined by
$\Delta=\operatorname{conv}\\{0,e_{1},\dots,e_{d}\\}$, where
$\operatorname{conv}$ denotes the convex hull operator.

######  Definition 1.1.

Let $P\subset\mathbb{R}^{d}$ be a lattice polytope. The lattice size
$\operatorname{ls_{\Delta}}(P)$ of $P$ with respect to the standard simplex
$\Delta$ is the smallest $l$ such that $L(P)$ is contained in the $l$-dilate
of $\Delta$ for some affine unimodular map
$L\colon\mathbb{R}^{d}\to\mathbb{R}^{d}$.

Equivalently, if we let

(1.1) $\displaystyle l_{1}(P)=\max\limits_{(x_{1},\dots,x_{d})\in
P}(x_{1}+\cdots+x_{d})-\min\limits_{(x_{1},\dots,x_{d})\in
P}x_{1}-\cdots-\min\limits_{(x_{1},\dots,x_{d})\in P}x_{d},$

then $\operatorname{ls_{\Delta}}(P)$ is the minimum of $l_{1}(L(P))$ over
affine unimodular maps $L\colon\mathbb{R}^{d}\to\mathbb{R}^{d}$.

If in the above definition the standard simplex $\Delta$ is replaced with the
unit cube $\square=[0,1]^{d}$, we obtain the definition of the lattice size
$\operatorname{ls_{\square}}(P)$ with respect to the unit cube. Note that the
lattice width $\operatorname{w}(P)$ can be viewed as the lattice size with
respect to the strip $\mathbb{R}^{d-1}\times[0,1]$.

It was shown in [8, 9] that in dimension 2 both
$\operatorname{ls_{\Delta}}(P)$ and $\operatorname{ls_{\square}}(P)$ can be
computed using basis reduction (see [8, 9] for definitions and details). It is
further explained in [8] that basis reduction also computes the lattice size
$\operatorname{ls_{\square}}(P)$ in dimension 3. This leads to fast algorithms
for computing the lattice size in these cases. A counterexample in [8]
demonstrates that a reduced basis does not necessarily compute
$\operatorname{ls_{\Delta}}(P)$ in dimension 3.

A well-known classification result by White [16] asserts that up to lattice
equivalence empty lattice tetrahedra in $\mathbb{R}^{3}$ are of the form

$T_{pq}=\begin{bmatrix}1&0&0&p\\\ 0&1&0&q\\\ 0&0&1&1\end{bmatrix},$

where $p$ and $q$ are nonnegative relatively prime integers. (Note that in
this notation $T_{pq}$ is the convex hull of the column vectors of the
matrix.) It was further shown in [13] that any empty lattice polytope in
$\mathbb{R}^{3}$ has lattice width one.

While it is not true that a reduced basis computes
$\operatorname{ls_{\Delta}}(P)$ for $P\subset\mathbb{R}^{3}$, it was shown in
[1] that this is the case for 3-dimensional empty lattice polytopes. A
counterexample was provided in [1] demonstrating that the conclusion does not
generalize to all lattice width one polytopes $P\subset\mathbb{R}^{3}$.

All the results discussed above concern the lattice size of lattice polytopes
in $\mathbb{R}^{2}$ and $\mathbb{R}^{3}$. In this paper, we consider a family
of lattice simplices $P$ in $\mathbb{R}^{d+1}$ for arbitrary $d$ and
explicitly compute both $\operatorname{ls_{\Delta}}(P)$ and
$\operatorname{ls_{\square}}(P)$ under some assumptions on the parameters of
the family. We work with simplices of the form

$T_{p_{1}\dots p_{d}}=\begin{bmatrix}1&0&\dots&0&0&p_{1}\\\
0&1&\dots&0&0&p_{2}\\\ \vdots&&\ddots&\vdots&\vdots&\vdots\\\
0&0&\dots&1&0&p_{d}\\\ 0&0&\dots&0&1&1\end{bmatrix},$

where $p_{1},\dots,p_{d}$ are nonnegative integers. These simplices are a
natural $(d+1)$-dimensional generalization of the tetrahedra
$T_{pq}\subset\mathbb{R}^{3}$. Each such $T_{p_{1}\dots p_{d}}$ has lattice
width one. Also, it is empty if and only if $\gcd(p_{1},\dots,p_{d})=1$,
although we will not be making this assumption. Note that starting with
dimension 4 it is no longer true that every empty lattice simplex has lattice
width one, see [7].

Our main results are formulated in Theorems 3.4 and 3.5, where we provide
explicit formulas for both $\operatorname{ls_{\Delta}}(T_{p_{1}\dots p_{d}})$
and $\operatorname{ls_{\square}}(T_{p_{1}\dots p_{d}})$ in terms of
$p_{1},\dots,p_{d}$ under some restrictions on these parameters. Our methods
are elementary and different from the ones used in earlier work in dimension 2
and 3.

##  2\. First Lemmas

Here we provide the $d$-dimensional version of the introductory statements
about the lattice size, which were formulated in [1] for the case $d=3$.

Let $P\subset\mathbb{R}^{d}$ be a lattice polytope and $A\in{\rm
GL}(d,\mathbb{Z})$. Denote the rows of $A$ by $h_{1},\dots,h_{d}$. Recall the
definition of $l_{1}(P)$ in (1.1).

######  Lemma 2.1.

  * (1)

For any $h\in\mathbb{Z}^{d}$ we have
$\operatorname{w}_{h}(AP)=\operatorname{w}_{A^{T}h}(P)$.

  * (2)

For $i=1,\dots,d$ we have
$\operatorname{w}_{e_{i}}(AP)=\operatorname{w}_{h_{i}}(P)$.

  * (3)

Let $(e_{1},\dots,e_{d})$ be the standard basis of $\mathbb{R}^{d}$. Then
$\operatorname{w}_{e_{i}}(P)\leq l_{1}(P)$ for $i=1,\dots,d$.

  * (4)

For $i=1,\dots,d$ we have $\operatorname{w}_{h_{i}}(P)\leq l_{1}(AP)$.

  * (5)

Let $e\in\\{0,1\\}^{d}$ be any 0-1 vector. Then $\operatorname{w}_{e}(P)\leq
l_{1}(P)$.

  * (6)

Let $h$ be the sum of any non-empty collection of rows of $A$. Then
$\operatorname{w}_{h}(P)\leq l_{1}(AP)$.

###### Proof.

For (1) we have

$\operatorname{w}_{h}(AP)=\max\limits_{x\in P}\langle
h,Ax\rangle-\min\limits_{x\in P}\langle h,Ax\rangle=\max\limits_{x\in
P}\langle A^{T}h,x\rangle-\min\limits_{x\in P}\langle
A^{T}h,x\rangle=\operatorname{w}_{A^{T}h}(P),$

and (2) is a particular case of (1).

To check (3), denote $l_{1}:=l_{1}(P)$. Then $P\subset l_{1}\Delta$ and hence

$\operatorname{w}_{e_{i}}(P)\leq\operatorname{w}_{e_{i}}(l_{1}\Delta)=l_{1}=l_{1}(P).$

Then (4) follows as
$\operatorname{w}_{h_{i}}(P)=\operatorname{w}_{e_{i}}(AP)\leq l_{1}(AP).$

Next we check (5), which is similar to (3):
$\operatorname{w}_{e}(P)\leq\operatorname{w}_{e}(l_{1}\Delta)=l_{1}=l_{1}(P).$

For (6) let $e$ be the sum of the corresponding standard basis vectors. Then
by (1) and (5)

$\operatorname{w}_{h}(P)=\operatorname{w}_{e}(AP)\leq l_{1}(AP).$

∎

######  Lemma 2.2.

We have

  * (1)

$l_{1}(AP)=\max_{x\in P}\langle h_{1}+\cdots+h_{d},x\rangle-\min_{x\in
P}\langle h_{1},x\rangle-\cdots-\min_{x\in P}\langle h_{d},x\rangle$;

  * (2)

$l_{1}(AP)$ does not depend on the order of rows in $A$;

  * (3)

$l_{1}(AP)=l_{1}(BP)$, where $B=\left(\begin{matrix}h_{1}\\\ \vdots\\\
h_{d-1}\\\ -\sum_{i=1}^{d}h_{i}\end{matrix}\right).$

###### Proof.

(1) and (2) are clear. Let’s check (3) using (1):

$\displaystyle l_{1}\left(BP\right)$ $\displaystyle=\max\limits_{x\in
P}\langle-h_{d},x\rangle-\sum_{i=1}^{d-1}\min\limits_{x\in P}\langle
h_{i},x\rangle-\min\limits_{x\in P}\langle(-h_{1}-\cdots-
h_{d}),x\rangle=l_{1}(AP).$

∎

##  3\. Lattice size computation

Recall that $T_{p_{1}\dots
p_{d}}=\operatorname{conv}\\{e_{1},\dots,e_{d+1},(p_{1},\dots,p_{d},1)\\}\subset\mathbb{R}^{d+1},$
where $p_{i}\in\mathbb{Z}_{\geq 0}$. Define $\alpha=p_{1}+\cdots+p_{d-1}$.
Assume that $p_{d}\geq 2$ and let $k=\lfloor\frac{p_{d}-2}{\alpha+1}\rfloor$.

######  Proposition 3.1.

With $p_{i}$, $\alpha$, and $k$ defined as above, suppose that
$p_{d}\geq\alpha^{2}-\alpha$. Then $\operatorname{ls_{\Delta}}(T_{p_{1}\dots
p_{d}})\leq k+3$.

###### Proof.

Consider the unimodular matrix

$A=\left(\begin{matrix}1&0&\dots&0&0&0\\\ 0&1&\dots&0&0&0\\\
\vdots&\vdots&\ddots&\vdots&\vdots&\vdots\\\ 0&0&\dots&1&0&0\\\
0&0&\dots&0&0&1\\\
k+1&k+1&\dots&k+1&-1&p_{d}-\alpha(k+1)-1\end{matrix}\right).$

Then

$AT_{p_{1}\dots p_{d}}=\begin{bmatrix}1&0&\dots&0&0&p_{1}\\\
0&1&\dots&0&0&p_{2}\\\ \vdots&\vdots&\ddots&\vdots&\vdots&\vdots\\\
0&0&\dots&1&0&p_{d-1}\\\ 0&0&\dots&0&1&1\\\
k+1&k+1&\dots&k+1&p_{d}-\alpha(k+1)-1&-1\end{bmatrix},$

and hence

$l_{1}(AT_{p_{1}\dots
p_{d}})=\max\\{k+2,p_{d}-\alpha(k+1),\alpha\\}-\min\\{-1,p_{d}-\alpha(k+1)-1\\}.$

Since $k=\lfloor\frac{p_{d}-2}{\alpha+1}\rfloor$, we have
$k+1>\frac{p_{d}-2}{\alpha+1}$, which implies $p_{d}-\alpha(k+1)<k+3$ and,
since $p_{d},k$ and $\alpha$ are integers, we conclude $p_{d}-\alpha(k+1)\leq
k+2$. We also have

$k+2>\frac{p_{d}-2}{\alpha+1}+1=\frac{p_{d}+\alpha-1}{\alpha+1}\geq\frac{\alpha^{2}-\alpha+\alpha-1}{\alpha+1}=\alpha-1,$

where we used the assumption $p_{d}\geq\alpha^{2}-\alpha$. We have checked
that $\max\\{k+2,p_{d}-\alpha(k+1),\alpha\\}=k+2$.

Next note that since $\frac{p_{d}-2}{\alpha+1}\geq k$ we get

$p_{d}-1-\alpha(k+1)\geq
p_{d}-1-\alpha\left(\frac{p_{d}-2}{\alpha+1}+1\right)=\frac{-\alpha^{2}-1+p_{d}}{\alpha+1}\geq\frac{-\alpha^{2}-1+\alpha^{2}-\alpha}{\alpha+1}=-1.$

Hence $\min\\{-1,p_{d}-\alpha(k+1)-1\\}=-1$ and $l_{1}(AT_{p_{1}\dots
p_{d}})=k+3$, which implies $\operatorname{ls_{\Delta}}(T_{p_{1}\dots
p_{d}})\leq k+3$. ∎

Our next goal is to show that under our assumptions we have
$\operatorname{ls_{\Delta}}(T_{p_{1}\dots p_{d}})=k+3$. For this, we first
prove two lemmas.

######  Lemma 3.2.

Let $h=(a_{1},\dots,a_{d+1})\in\mathbb{R}^{d+1}$ be a primitive vector with
$\operatorname{w}_{h}(T_{p_{1}\dots p_{d}})\leq k+2$. Then
$a_{d}\in\\{0,1,-1\\}$.

###### Proof.

We can assume $a_{d}\geq 0$. Suppose that $a_{d}\geq 2$. We have

$\max\\{a_{1},\dots,a_{d+1},a_{1}p_{1}+\cdots+a_{d}p_{d}+a_{d+1}\\}-\min\\{a_{1},\dots,a_{d+1},a_{1}p_{1}+\cdots+a_{d}p_{d}+a_{d+1}\\}\leq
k+2,$

which implies $a_{1}p_{1}+\cdots+a_{d}p_{d}\leq k+2$ and $a_{d}-a_{i}\leq k+2$
for $i=1,\dots,d-1$. Since $a_{d}\geq 2$, the first inequality implies

$a_{1}p_{1}+\cdots+a_{d-1}p_{d-1}\leq k+2-2p_{d}.$

The second inequality implies $a_{i}\geq-k$ for $i=1,\dots,d-1$ and hence

$a_{1}p_{1}+\cdots+a_{d-1}p_{d-1}\geq-k(p_{1}+\cdots+p_{d})=-k\alpha.$

Combining this with what we got from the first inequality, we get
$k+2-2p_{d}\geq-k\alpha.$ Hence, using the definition of $k$, we get

$2p_{d}\leq k+2+k\alpha=k(\alpha+1)+2\leq p_{d},$

which contradicts the assumption $p_{d}>0$. ∎

######  Lemma 3.3.

Let $h=(a_{1},\dots,a_{d+1})\in\mathbb{R}^{d+1}$ be a primitive vector with
$a_{d}=\pm 1$ and $\operatorname{w}_{h}(T_{p_{1}\dots p_{d}})\leq k+2$. Then
$\operatorname{w}_{h}(T_{p_{1}\dots p_{d}})=k+2$.

###### Proof.

We can assume that $a_{d}=1$. Suppose that

$\displaystyle\max\\{a_{1},\dots,a_{d-1},1,a_{d+1},a_{1}p_{1}+\cdots+a_{d-1}p_{d-1}+p_{d}+a_{d+1}\\}$
$\displaystyle-\min\\{a_{1},\dots,a_{d-1},1,a_{d+1},a_{1}p_{1}+\cdots+a_{d-1}p_{d-1}+p_{d}+a_{d+1}\\}\leq
k+1.$

This implies $a_{1}p_{1}+\cdots+a_{d-1}p_{d-1}+p_{d}\leq k+1$ and $1-a_{i}\leq
k+1$ for $i=1,\dots,d-1$. Hence for such $i$ we have $a_{i}\geq-k$ and

$-k\alpha+p_{d}\leq a_{1}p_{1}+\cdots+a_{d-1}p_{d-1}+p_{d}\leq k+1,$

which implies $-k\alpha+p_{d}\leq k+1$. Hence $p_{d}\leq
k\alpha+k+1=k(\alpha+1)+1\leq p_{d}-1$, and this is impossible. ∎

######  Theorem 3.4.

Let $\alpha=p_{1}+\cdots+p_{d-1}$, where all $p_{i}$ are positive and
$p_{d}\geq 2$. Define $k=\lfloor\frac{p_{d}-2}{\alpha+1}\rfloor$. Suppose that
$p_{d}\geq\alpha^{2}-\alpha$. Then $\operatorname{ls_{\Delta}}(T_{p_{1}\dots
p_{d}})=k+3$.

###### Proof.

Suppose that there exists a unimodular map $L$ that maps $T_{p_{1}\dots
p_{d}}$ inside $(k+2)\Delta$ and let $A$ be the corresponding unimodular
matrix. Then by Lemma 2.1 for each of its rows $h$ we have
$\operatorname{w}_{h}(T_{p_{1}\dots p_{d}})\leq k+2$. We also have the same
inequality for the sum of any nonempty collection of rows of $A$. By Lemma 3.2
each of the entries in the $d$th column of $A$ is 0, 1, or $-1$, and the same
applies to the sum of any collection of entries in the $d$th column of $A$.
Hence, up to permutation of rows, the $d$th column of $A$ is $(0,0,\dots,0,\pm
1)^{T}$ or $(0,0,\dots,0,1,-1)^{T}$ and by Lemma 2.2 we can assume that it is
the former. Then by Lemma 3.3 we have
$\operatorname{w}_{e_{d+1}}(L(T_{p_{1}\dots p_{d}}))=k+2$. Since
$L(T_{p_{1}\dots p_{d}})\subset(k+2)\Delta$ we conclude that

$(0,\dots,k+2)\in L(T_{p_{1}\dots p_{d}}).$

Similarly, we have $\operatorname{w}_{e_{1}+\cdots+e_{d+1}}(L(T_{p_{1}\dots
p_{d}}))=k+2$ and, together with $L(T_{p_{1}\dots p_{d}})\subset(k+2)\Delta$,
this implies that $L(T_{p_{1}\dots p_{d}})$ contains the origin. Hence
$L(T_{p_{1}\dots p_{d}})$ and, therefore, $T_{p_{1}\dots p_{d}}$ contains an
edge of lattice length $k+2$. All the edges of $T_{p_{1}\dots p_{d}}$ are
primitive, except, possibly, for the one connecting points $(0,\dots,1)$ and
$(p_{1},\dots,p_{d},1)$, whose lattice length is $\gcd(p_{1},\dots,p_{d})$.
Hence we conclude that $\gcd(p_{1},\dots,p_{d})=k+2$. Using the assumption
$p_{d}\geq\alpha^{2}-\alpha$ we get

$k+2=\gcd(p_{1},\dots,p_{d})\leq
p_{1}+\dots+p_{d-1}=\alpha\leq\frac{p_{d}-2}{\alpha+1}+2<k+3.$

Note that since all the $p_{i}$ are positive, we have
$\gcd(p_{1},\dots,p_{d})<p_{1}+\dots+p_{d-1}$ unless $d=2$ and $p_{2}$ is a
multiple of of $p_{1}$. When the inequality is strict we arrive at a
contradiction since then integer $p_{1}+\dots+p_{d-1}$ is strictly between the
consecutive integers $k+2$ and $k+3$.

It remains to consider the case when $d=2$, $p_{2}$ is a multiple of $p_{1}$,
and $k+2=\alpha=p_{1}$. We have
$\lfloor\frac{p_{2}-2}{p_{1}+1}\rfloor=k=p_{1}-2$ and hence

$p_{2}-2=(p_{1}+1)(p_{1}-2)+r,$

where $0\leq r\leq p_{1}$. We get $p_{2}=p_{1}^{2}-p_{1}+r$ and, since $p_{2}$
is a multiple of $p_{1}$, there are two options: $p_{2}=p_{1}^{2}$ and
$p_{2}=p_{1}^{2}-p_{1}$.

Suppose first $p_{2}=p_{1}^{2}$ and let $h=(a_{1},a_{2},a_{3})$ be a direction
with $\operatorname{w}_{h}(T_{p_{1}p_{2}})\leq k+2=p_{1}$. By Lemma 3.2 we
have $a_{2}=0,\pm 1$. For $a_{2}=-1$ we get

$\max\\{a_{1},-1,a_{3},a_{1}p_{1}-p_{1}^{2}+a_{3}\\}-\min\\{a_{1},-1,a_{3},a_{1}p_{1}-p_{1}^{2}+a_{3}\\}\leq
p_{1},$

which implies $a_{1}+1\leq p_{1}$ and $-a_{1}p_{1}+p_{1}^{2}\leq p_{1}$, so we
conclude that $a_{1}=p_{1}-1$. Plugging in this value for $a_{1}$ we get

$\max\\{p_{1}-1,-1,a_{3},a_{3}-p_{1}\\}-\min\\{p_{1}-1,-1,a_{3},a_{3}-p_{1}\\}\leq
p_{1},$

which implies $a_{3}+1\leq p_{1}$ and $p_{1}-1-(a_{3}-p_{1})\leq p_{1}$, so
$a_{3}=p_{1}-1$. We conclude that for $a_{2}=-1$ the only $h$ with
$\operatorname{w}_{h}(T_{p_{1}p_{2}})\leq p_{1}$ is $h=(p_{1}-1,-1,p_{1}-1)$
and for such $h$ we get $\operatorname{w}_{h}(T_{p_{1}p_{2}})=k+2$. Similarly,
for $a=1$ such direction is $h=(1-p_{1},1,1-p_{1})$.

Hence in this case we can assume that the second column of $A$ is $(0,0,\pm
1)^{T}$, and the third row is $\pm(p-1,-1,p-1)$. Then the sum of the third row
with any of the first two rows will also have to be of the same form as the
third row, which would imply $\det A=0$.

We next consider the last case $p_{2}=p_{1}^{2}-p_{1}$. Recall that we have
$k+2=p_{1}$. By Lemma 3.2 and Lemma 3.3 if
$\operatorname{w}_{h}(T_{p_{1}p_{2}})\leq p_{1}$ for $h=(a_{1},a_{2},a_{3})$
then $a_{2}=0,\pm 1$ and if $a_{2}=\pm 1$ we have
$\operatorname{w}_{h}(T_{p_{1}p_{2}})=p_{1}$. Let’s further investigate the
case $a_{2}=0$. We have

$\max\\{a_{1},0,a_{3},a_{1}p_{1}+a_{3}\\}-\min\\{a_{1},0,a_{3},a_{1}p_{1}+a_{3}\\}\leq
p_{1},$

where we can assume $a_{1}\geq 0$. Hence $a_{1}p_{1}\leq p_{1}$, which implies
$a_{1}=0$ or $1$ and in the latter case the width is $p_{1}$. We conclude that
the only direction $h$ with $\operatorname{w}_{h}(T_{p_{1}p_{2}})<p_{1}$ is
$(0,0,\pm 1)$.

As before, we can assume that the second column in matrix $A$ is
$(0,0,1)^{T}$. Denote the rows of $A$ by $h_{1},h_{2}$, and $h_{3}$. Then out
of the widths of $T_{p_{1}p_{2}}$ in the direction of $h_{1}$ and $h_{2}$ only
one can be strictly less than $p$. We can assume that this happens in the
direction of $h_{1}$. We also know that the width of $T_{p_{1}p_{2}}$ in the
direction of $h_{3}$ and $h_{1}+h_{2}+h_{3}$ is $p_{1}$. We can now conclude
that $L(T_{p_{1}p_{2}})$ contains the triangle

$\operatorname{conv}\\{(0,0,0),(0,p_{1},0),(0,0,p_{1})\\}.$

Note that we assumed that $p_{d}\geq 2$, which implies
$p_{1}^{2}-p_{1}=p_{2}\geq 2$ and hence $p_{1}\geq 2$. Hence our conclusion
implies that $T_{p_{1}p_{2}}$ contains a lattice triangle with three non-
primitive sides, and this contradiction completes the argument. ∎

We next use the above work to compute
$\operatorname{ls_{\square}}(T_{p_{1},\dots,p_{d}})$.

######  Theorem 3.5.

Let $\alpha=p_{1}+\cdots+p_{d-1}$, where all $p_{i}$ are positive and
$p_{d}\geq 2$. Define $k=\lfloor\frac{p_{d}-2}{\alpha+1}\rfloor$. Suppose that
$p_{d}\geq\alpha^{2}-\alpha$. Then $\operatorname{ls_{\square}}(T_{p_{1}\dots
p_{d}})=k+2$.

###### Proof.

Let $A$ be the matrix from Proposition 3.1. Then
$\operatorname{w}_{e_{d}}(AT_{p_{1}\dots p_{d}})=1$,
$\operatorname{w}_{e_{i}}(AT_{p_{1}\dots p_{d}})=p_{i}$ for $i=1,\dots,d-1$,
and

$\operatorname{w}_{e_{d+1}}(AT_{p_{1}\dots
p_{d}})=\max\\{k+1,p_{d}-\alpha(k+1)-1\\}-\min\\{-1,p_{d}-\alpha(k+1)-1\\}=k+2,$

as shown in the proof of Proposition 3.1. It is also checked there that
$\alpha\leq k+2$, and hence after a translation by the vector
$v=(0,\dots,0,1)^{T}$ we get $AT_{p_{1}\dots p_{d}}+v\subset[0,k+2]^{d+1}$,
which implies that $\operatorname{ls_{\square}}(P)\leq k+2$.

Suppose next that there exists a unimodular map
$L\colon\mathbb{R}^{d}\to\mathbb{R}^{d}$ such that $L(T_{p_{1}\dots
p_{d}})\subset[0,k+1]^{d+1}$. Then the width of $T_{p_{1}\dots p_{d}}$ in the
direction of each of the rows of the corresponding matrix $A$ is at most
$k+1$, but by Lemmas 3.2 and 3.3 this implies that the $d$th entry of each row
of $A$ is zero, so $\det A=0$.

∎

Note that we have checked in Theorems 3.4 and 3.5 that there exists matrix $A$
that computes both $\operatorname{ls_{\Delta}}(T_{p_{1}\dots p_{d}})$ and
$\operatorname{ls_{\square}}(T_{p_{1}\dots p_{d}})$. While it was shown in [8,
9] that this is always the case when $P\subset\mathbb{R}^{2}$, a
counterexample for $P\subset\mathbb{R}^{3}$ was provided in [8].

### Acknowledgments

We are grateful to the Kent State REU program for the hospitality.

## References

  * [1] A. Alajmi and J. Soprunova, Lattice Size of Width One Lattice Polytopes in $\mathbb{R}^{3}$, arXiv:2207.13124.
  * [2] V. Arnold, Statistics of integral convex polygons, Functional Analysis and Its Applications 14(2) (1980), pp. 1-3.
  * [3] A. Barvinok, Integer Points in Polyhedra, Zurich Lectures in Advanced Mathematics, ISBN: 9783037190524, 2008.
  * [4] I. Bárány and J. Pach, On the number of convex lattice polygons, Combinatorics, Probability and Computing 1, Issue 4 (1992), pp. 295-302.
  * [5] G. Brown and A. Kasprzyk, Small polygons and toric codes, Journal of Symbolic Computation, 51 (2013), pp. 55-62.
  * [6] W. Castryck and F. Cools, The lattice size of a lattice polygon, Journal of Combinatorial Theory Series A 136, Issue C (2015), pp. 64-95.
  * [7] C. Haase and G. Ziegler, On the Maximal Width of Empty Lattice Simplices, Europ. J. Combinatorics (2000) , 21, 111-119.
  * [8] A. Harrison and J. Soprunova, Lattice Size and Generalized Basis Reduction in Dimension 3, Discrete Comput Geom (2022), 67, Issue 1, 287-310.
  * [9] A. Harrison, J. Soprunova, and P. Tierney, Lattice Size of Plane Convex Bodies, SIAM J. Discrete Math., 36, No 1 (2022), 92-102.
  * [10] M. Kaib and C. Schnorr, The Generalized Gauss Reduction Algorithm, Journal of Algorithms 21(3), (1996), 565-578.
  * [11] J. Lagarias and G. Ziegler, Bounds for lattice polytopes containing a fixed number of interior points in a sublattice, Canadian Journal of Mathematics 43(5) (1991), 1022-1035.
  * [12] L. Lovász and H. Scarf, The Generalized Basis Reduction Algorithm, Mathematics of Operations Research 17, Issue 3 (1992), 751-764.
  * [13] H. E. Scarf, Integral polyhedra in three space, Mathematics of Operations Research 10, no. 3, (1985), 403-438 .
  * [14] J. Schicho, Simplification of surface parametrizations – a lattice polygon approach, Journal of Symbolic Computation 36 (3-4) (2003), 535-554.
  * [15] J. Soprunova, Bounds on Area Involving Lattice Size, arXiv:2112.15134.
  * [16] G. White, Lattice Tetrahedra, Canadian J. Math. 16 (1964), 389-396.