NewThe detectors that scored perfect collapsed the hardest under attack.
Data cardpassport-pad-v1 · v2026.2Build in progress · sample release

Passport and ID
Face-Injection

Does your detector still catch an AI-generated face after it has travelled a real submission path, phone camera, print, scan, photocopy, rather than arriving as a clean studio render?

2,316
Real references
4,632
Synthetic attacks
628
Identities
23
Conditions
12
Demographic cells
Qwen-Image-Edit·HiDream-O1
Generators
Generatedlight · female
A synthetic attack face after a phone-capture submission path, light female cell
ModalityStill images, single frontal face per image
Demographic axis6 skin tones x 2 genders = 12 cells
ClassesSynthetic attack faces plus matched bona-fide references
Capture conditionsClean baseline plus emulated capture and document chains
LabelingPerceptual demographic labels by multi-model consensus, not biometric ground truth
Format.jpg, per-item demographic and condition labels
01 / The gap

Clean-render accuracy is not field accuracy.

Detectors that score well on clean synthetic faces often degrade sharply once an image has been through a phone camera or a document reproduction step. This benchmark isolates that gap.

02 / Coverage

Every item is labeled on a two-part axis. The full benchmark targets balanced counts across all twelve cells; this sample spans a representative subset.

Twelve cells, read as a grid.

Skin tone
female
male
very_light
very_light · femaleITA greater than 55
very_light · maleITA greater than 55
light
light · femaleITA 41 to 55
light · maleITA 41 to 55
intermediate
intermediate · femaleITA 28 to 41
intermediate · maleITA 28 to 41
tan
tan · femaleITA 10 to 28
tan · maleITA 10 to 28
brown
brown · femaleITA -30 to 10
brown · maleITA -30 to 10
dark
dark · femaleITA less than -30
dark · maleITA less than -30

Skin tone uses a 6-band ordinal scale reconciled against Individual Typology Angle, so cells stay comparable across items. Swatches are indicative of the band, not a measured value.

03 / Conditions

Each condition emulates a real submission path.

Applied on top of the generated face. The set is extensible; additional capture and document chains are added as the build progresses.

00 · baselinecleanNo capture or document processing.
01 · capturechain_phone_colorA phone-camera capture with color processing.
02 · documentphotocopyA photocopied reproduction.
03 · documentprint_scanA printed and scanned photo.
04 · chainchain_print_scanA multi-step print then scan pipeline.
04 / Method

How the corpus is built and labeled.

01Generated in houseIdentity capped
02Consensus labelingMulti-annotator consensus
03Emulated submissionDesigned to match real world conditions
ProvenanceReal reference faces are licensed from commercial stock-media providers; synthetic faces are generated in house. Each delivered item is licensed for your evaluation use.
05 / Annotation

Every item names its attack with a TTP tag.

A pass or fail count does not tell you what to fix. Each item carries a Tactic, Technique, and Procedure tag: the tactic is impersonation, the technique is an identity-preserving edit, and the procedure is the specific editor. Group misses by any of the three to target a fix.

TTactic, the goal (impersonation)TTechnique, the method (identity-preserving edit)PProcedure, the specific editor
Group misses by any row
06 / Use and limits

What it is for today, and what it is not yet.

Use it for
  • Detector evaluation and robustness testing
  • Locating where a detector breaks, by cell and by condition
  • Training and fine-tuning as the corpus grows, the same set serves the red team measuring a gap and the detection team closing it
Honest limits
  • This is a sample release from an in-progress build
  • Per-cell counts and condition coverage expand in the full benchmark
  • Demographic labels are perceptual consensus review, not biometric ground truth
07 / Samples

Synthetic attack faces, as they arrive.

QWEN synthetic attack face, phone capture, dark · maleQWEN
phone capturedark · male
HIDREAM synthetic attack face, phone capture, tan · maleHIDREAM
phone capturetan · male
QWEN synthetic attack face, phone capture, light · maleQWEN
phone capturelight · male
HIDREAM synthetic attack face, photocopy, dark · femaleHIDREAM
photocopydark · female
QWEN synthetic attack face, phone capture, very_light · femaleQWEN
phone capturevery_light · female
HIDREAM synthetic attack face, phone B/W copy, brown · maleHIDREAM
phone B/W copybrown · male
QWEN synthetic attack face, print + scan, brown · maleQWEN
print + scanbrown · male
HIDREAM synthetic attack face, flatbed grayscale, brown · maleHIDREAM
flatbed grayscalebrown · male
QWEN synthetic attack face, print + scan, dark · femaleQWEN
print + scandark · female
HIDREAM synthetic attack face, print + scan chain, very_light · maleHIDREAM
print + scan chainvery_light · male
QWEN synthetic attack face, print + scan, tan · femaleQWEN
print + scantan · female
HIDREAM synthetic attack face, print + scan, very_light · maleHIDREAM
print + scanvery_light · male
QWEN synthetic attack face, print + scan chain, dark · femaleQWEN
print + scan chaindark · female
HIDREAM synthetic attack face, grayscale, tan · maleHIDREAM
grayscaletan · male
QWEN synthetic attack face, print + scan chain, brown · femaleQWEN
print + scan chainbrown · female
HIDREAM synthetic attack face, downscale to ID, very_light · maleHIDREAM
downscale to IDvery_light · male
QWEN synthetic attack face, print + scan chain, tan · femaleQWEN
print + scan chaintan · female
QWEN synthetic attack face, photocopy, brown · femaleQWEN
photocopybrown · female
QWEN synthetic attack face, photocopy, tan · femaleQWEN
photocopytan · female
QWEN synthetic attack face, phone capture, dark · maleQWEN
phone capturedark · male
HIDREAM synthetic attack face, phone capture, tan · maleHIDREAM
phone capturetan · male
QWEN synthetic attack face, phone capture, light · maleQWEN
phone capturelight · male
HIDREAM synthetic attack face, photocopy, dark · femaleHIDREAM
photocopydark · female
QWEN synthetic attack face, phone capture, very_light · femaleQWEN
phone capturevery_light · female
HIDREAM synthetic attack face, phone B/W copy, brown · maleHIDREAM
phone B/W copybrown · male
QWEN synthetic attack face, print + scan, brown · maleQWEN
print + scanbrown · male
HIDREAM synthetic attack face, flatbed grayscale, brown · maleHIDREAM
flatbed grayscalebrown · male
QWEN synthetic attack face, print + scan, dark · femaleQWEN
print + scandark · female
HIDREAM synthetic attack face, print + scan chain, very_light · maleHIDREAM
print + scan chainvery_light · male
QWEN synthetic attack face, print + scan, tan · femaleQWEN
print + scantan · female
HIDREAM synthetic attack face, print + scan, very_light · maleHIDREAM
print + scanvery_light · male
QWEN synthetic attack face, print + scan chain, dark · femaleQWEN
print + scan chaindark · female
HIDREAM synthetic attack face, grayscale, tan · maleHIDREAM
grayscaletan · male
QWEN synthetic attack face, print + scan chain, brown · femaleQWEN
print + scan chainbrown · female
HIDREAM synthetic attack face, downscale to ID, very_light · maleHIDREAM
downscale to IDvery_light · male
QWEN synthetic attack face, print + scan chain, tan · femaleQWEN
print + scan chaintan · female
QWEN synthetic attack face, photocopy, brown · femaleQWEN
photocopybrown · female
QWEN synthetic attack face, photocopy, tan · femaleQWEN
photocopytan · female
QWEN synthetic attack face, phone capture, dark · maleQWEN
phone capturedark · male
HIDREAM synthetic attack face, phone capture, tan · maleHIDREAM
phone capturetan · male
QWEN synthetic attack face, phone capture, light · maleQWEN
phone capturelight · male
HIDREAM synthetic attack face, photocopy, dark · femaleHIDREAM
photocopydark · female
QWEN synthetic attack face, phone capture, very_light · femaleQWEN
phone capturevery_light · female
HIDREAM synthetic attack face, phone B/W copy, brown · maleHIDREAM
phone B/W copybrown · male
QWEN synthetic attack face, print + scan, brown · maleQWEN
print + scanbrown · male
HIDREAM synthetic attack face, flatbed grayscale, brown · maleHIDREAM
flatbed grayscalebrown · male
QWEN synthetic attack face, print + scan, dark · femaleQWEN
print + scandark · female
HIDREAM synthetic attack face, print + scan chain, very_light · maleHIDREAM
print + scan chainvery_light · male
QWEN synthetic attack face, print + scan, tan · femaleQWEN
print + scantan · female
HIDREAM synthetic attack face, print + scan, very_light · maleHIDREAM
print + scanvery_light · male
QWEN synthetic attack face, print + scan chain, dark · femaleQWEN
print + scan chaindark · female
HIDREAM synthetic attack face, grayscale, tan · maleHIDREAM
grayscaletan · male
QWEN synthetic attack face, print + scan chain, brown · femaleQWEN
print + scan chainbrown · female
HIDREAM synthetic attack face, downscale to ID, very_light · maleHIDREAM
downscale to IDvery_light · male
QWEN synthetic attack face, print + scan chain, tan · femaleQWEN
print + scan chaintan · female
QWEN synthetic attack face, photocopy, brown · femaleQWEN
photocopybrown · female
QWEN synthetic attack face, photocopy, tan · femaleQWEN
photocopytan · female
08 / Query

Query the corpus the way you would query a database.

Every dimension is a filter. Compose them, read a live .total, then pull only what you need.

kind
fakereal
skin_tone × gender
very_lightlightbrown · maletanintermediatedark
condition
cleanchain_phone_colorprint_scanphotocopy
generator
qwen_image_edithidream_o1
Live count
.total
returned for your exact filter
request
GET /v1/items
  ?benchmark=passport-pad-v1
  &kind=fake
  &skin_tone=brown
  &gender=male
  &generator=qwen_image_edit
Built forRed teams at banks and financial institutionsDeepfake-detection companiesIdentity-verification and KYC providers

Pull it and score your detector.

Access is via the Margen platform. Generate an API key, then follow the API docs to pull the catalog and measure per cell and per condition.

Currently held out. This benchmark is being run through an active evaluation, so only a test set of 10% of its identities is available to pull. The remaining held-out set is measured through a managed evaluation, not delivered as raw data, so nobody scored against it has trained on it.

Get an API keyAPI docs