A test set for the injected faces your identity checks are meant to reject.
Passport and ID Face-Injection v1 pairs a real reference with identity-preserving synthetic attacks of the same person, produced by two frontier editors (Qwen-Image-Edit and HiDream-O1), across twelve demographic cells. It labels every item with the attack behind it. The rest of this page is the case for those choices, and how to pull the data through the API.
Deliberate choices that make it a measurement instrument, not a pile of faces.
Read top to bottom. Each row is one deliberate choice, the reason for it, and how it surfaces in the API you actually call.
- 01Two generators
Two independent editors, to test whether detection generalizes across generators.
Detectors are trained on a narrow set of generators and tend to overfit to those generators' artifacts. Every reference is attacked by both Qwen-Image-Edit and HiDream-O1, so scoring each independently shows whether your detector generalizes across generators or only catches the ones it was trained on. More editors are on the roadmap.
generator = qwen_image_edit · hidream_o1
QWEN
HIDREAMsame identity · two editors - 02Face, not backdrop
Does it detect the face, or the background behind it?Coming soon
We hold the synthesized face pixel-for-pixel constant and swap only the background behind it. A detector that reads the face returns the same verdict across every background; one that has quietly learned to spot backdrops swings. The spread across a matched set is the number, and it tells you whether the model is doing what you think it is.
face held constant · background varied · per matched set
same face · background varied · variance across the set = the metric - 03Capture emulation
The camera path a real passport photo goes through.Coming soon
Generator output is pristine; a genuine capture is not. We model the camera pipeline the synthesis skipped, sensor noise, demosaicing, lens vignette and blur, and the device-specific JPEG quantization tables that act as a documented forensic fingerprint, so a detector cannot lean on the too-clean look of an unedited render.
condition = sensor · demosaic · device_jpegsensor noise + demosaicComing soonlens vignette + blurComing soondevice-specific JPEG tablesComing soon - 04Document channel
Print, scan, and photocopy, the way an ID actually arrives.Coming soon
A verification service rarely sees a clean color file. It sees grayscale and black-and-white conversions, printed-then-scanned copies with halftone and double compression, and images downscaled to ID resolution. Each is modeled from the imaging literature, not a toy filter.
condition = grayscale · print_scan · downscalegrayscale / black and whiteComing soonprint halftone + rescanComing soonrecompression + downscale to IDComing soon - 05Devices + recapture
Named devices, and recapture as a presentation attack.Coming soon
Not a generic camera, the specific rigs people use: the passport-booth kiosk and the consumer phones that dominate remote onboarding. Plus recapture, photographing a screen or a print of the ID, which are the canonical presentation-attack instruments (ISO/IEC 30107) an IDV or liveness system has to catch.
condition = booth · phone · recapturepassport-booth kioskComing sooniPhone / Galaxy A captureComing soonscreen recapture (moire)Coming soonprint recaptureComing soon - 06No shortcuts
Every background and condition is applied to the real faces too.
If a condition or a background only ever appeared on the synthetic side, a detector could pass by spotting the condition instead of the attack. Every variant is applied identically to the bona-fide reals, so the only thing separating the two classes is authenticity.
symmetric on kind=real and kind=fakeREALsame variant appliedFAKEthe condition is never the tell - 07TTP annotation
Every failure is debuggable, because every item names its attack.
A pass or fail count does not tell you what to fix. Each item carries a Tactic, Technique, and Procedure tag: impersonation, by an identity-preserving edit, with the specific editor named. When your check is fooled, you group the misses by TTP and target the fix.
TTactic, the goal (impersonation)TTechnique, the method (identity-preserving edit)PProcedure, the specific editorGroup your misses by any row - 08Provenance
Real faces licensed for commercial use. Synthetic edited in house.
Every real reference is licensed from commercial stock-media providers, cleared for building and evaluating detection systems, and delivered under the Margen data license. The attacks are identity-preserving edits of those same licensed individuals, generated in house, so the editor behind every item is disclosed.
source_real_id · generator · ttp per itemLicense summary- Commercial evaluation and product use
- Redistribution restricted
- No re-identification
- Provenance metadata preserved
Two frontier editors, the same identity preserved.
Each attack is an identity-preserving edit of a real reference: the same person, re-rendered into a frontal, passport-style portrait. We run two independent editors so a detector cannot overfit to a single generator's fingerprint. Buyers ask about the generator first, so we lead with it.
What the generators produce, and what you pull.
Real per-cell composition
Twelve cells, six skin-tone bins by two genders. Counts are paired, so per cell the real references, Qwen attacks, and HiDream attacks are equal. A snapshot is below; live counts under any filter come from GET /v1/benchmarks/passport-pad-v1.
| Skin tone | Female refs | Male refs |
|---|---|---|
| very_light | 43 | 33 |
| light | 116 | 113 |
| intermediate | 52 | 63 |
| tan | 109 | 93 |
| brown | 114 | 135 |
| dark | 59 | 68 |
| Total | 552 | 446 |
Reals per class total 998; each has one attack per generator, so 1,996 attacks in all. Cell counts range 33 to 135; report per cell and weight accordingly. Skin tone and gender are provided for stratified fairness analysis, not as biometric ground truth.
Two variants per item
Every item ships in both forms; each metadata row carries a path to each, so you pull the one your evaluation needs.
Both classes re-encoded to JPEG q95, longest side 768px. Removes the format, quality, and resolution shortcuts so a measured number reflects the synthesis itself. Recommended baseline.
Raw files at native resolution, for running your own preprocessing.
Native resolutions differ by group. At the 768 normalization, reals and Qwen are minimally resized while HiDream is downscaled from 2048, so HiDream may carry a mild downscale signature the others do not. Report per generator.
Pairing and splits
- A real reference plus its two attacks form an identity-locked triplet, linked by source_real_id.
- Each attack carries arcface_cosine, its identity match to the reference, so you can filter a fidelity floor.
- If you build dev or holdout subsets, split on identity_cluster_id, never on image, so a real and its attacks stay on the same side and identity never leaks across the split.
A single record, with the fields the API returns.
{
"benchmark": "passport-pad-v1",
"kind": "fake",
"cell_skin_tone": "brown",
"cell_gender": "male",
"generator_model": "qwen_image_edit",
"condition": "clean",
"source_real_id": "b_00375",
"ttp_tactic": "impersonation",
"ttp_technique": "identity_preserving_edit"
}Query the corpus the way you would query a database.
Every dimension is a filter. Compose them, get a live .total, then pull only what you need.
GET /v1/items ?benchmark=passport-pad-v1 &kind=fake &skin_tone=brown &gender=male &generator=qwen_image_edit
What this dataset does not do yet.
If any of these matter for your threat model, tell us and we will point you to the right benchmark or start scoping one.
- 01Pristine cohort today.The clean baseline isolates the synthesis. Background swaps and the capture and document conditions (camera, grayscale, print and scan, recapture) are on the roadmap.
- 02Two generators.v1 covers two identity-preserving editors; it is not a census of the attack surface. More are on the roadmap.
- 03Frontal, passport-style framing.Head-and-shoulders frontal portraits. No liveness video and no other document layouts in v1.
- 04Perceptual demographic labels.Skin-tone and gender bins are perceptual labels, not biometric ground truth. Report per cell, weight accordingly.
Want this run against your own corpus?
We bring the same attack tooling into your environment and run it against your private corpus and your identity check. Your data never leaves your environment, so you can test on the faces you cannot share.