  A morph is a combination of two separate facial images and contains identity
information of two different people. When used in an identity document, both
people can be authenticated by a biometric Face Recognition (FR) system. Morphs
can be generated using either a landmark-based approach or approaches based on
deep learning such as Generative Adversarial Networks (GAN). In a recent paper,
we introduced a \emph{worst-case} upper bound on how challenging morphing
attacks can be for an FR system. The closer morphs are to this upper bound, the
bigger the challenge they pose to FR. We introduced an approach with which it
was possible to generate morphs that approximate this upper bound for a known
FR system (white box), but not for unknown (black box) FR systems.
  In this paper, we introduce a morph generation method that can approximate
worst-case morphs even when the FR system is not known. A key contribution is
that we include the goal of generating difficult morphs \emph{during} training.
Our method is based on Adversarially Learned Inference (ALI) and uses concepts
from Wasserstein GANs trained with Gradient Penalty, which were introduced to
stabilise the training of GANs. We include these concepts to achieve similar
improvement in training stability and call the resulting method Wasserstein ALI
(WALI). We finetune WALI using loss functions designed specifically to improve
the ability to manipulate identity information in facial images and show how it
can generate morphs that are more challenging for FR systems than landmark- or
GAN-based morphs. We also show how our findings can be used to improve MIPGAN,
an existing StyleGAN-based morph generator.
