Verification of Dynamic Holographic Behavior in Identity Documents

Source: arXiv:2607.06466 · Published 2026-07-07 · By Glen Pouliquen, Joseph Chazalon, Guillaume Chiron, Thierry Géraud, Ahmad Montaser Awal

TL;DR

This paper tackles the challenge of remotely verifying the authenticity of Optically Variable Devices (OVDs), commonly known as holograms, on identity documents. While holograms provide strong security for human visual inspection, their automated verification is difficult, especially against sophisticated dynamic frauds such as handcrafted holograms. Existing approaches mostly focus on static fraud detection or require training on known attacks, limiting their ability to generalize to new, unseen attack types. To bridge these gaps, the authors introduce three key contributions: (1) a new public dataset, MIDV-DynAttack, significantly extending the MIDV-Holo dataset with 1,200 new attack videos featuring both static and dynamic forgery scenarios to test model generalization; (2) a novel verification method leveraging background subtraction and a pseudo-label based frame-level classifier trained only on legitimate holograms, enabling detection of dynamic attacks without explicit training on them; and (3) a comprehensive benchmark demonstrating that prior methods struggle to detect dynamic attacks, whereas their approach achieves superior performance on both MIDV-Holo and MIDV-DynAttack datasets. This work advances state-of-the-art by focusing on validating the dynamic holographic appearance transitions crucial for strong OVD verification in realistic remote capture settings.

Key findings

• MIDV-DynAttack dataset triples the number of attack samples compared to MIDV-Holo, featuring 1,200 new videos including 750 static template attacks and 450 dynamic template attacks.
• Their proposed method (HoloVerif) achieves 95% F-score ±3 on MIDV-Holo and maintains 59% recall ±20 on static attacks and 61% recall ±13 on dynamic unseen attacks from MIDV-DynAttack, outperforming baselines.
• Background subtraction and HSV-based normalization enhance holographic signals, enabling the model to learn holographic features distinct from the photo or document background.
• Pseudo-labeling frames as Valid or Non-Valid hologram behavior enables supervised training without requiring dynamic attack samples, supporting generalization to unseen attack types.
• Ablation shows data augmentations improve recall on dynamic attacks from 29% to 61%, indicating augmentation is critical to capture hologram variability.
• Existing methods like MIDV-Holo [13] and weakly supervised learning (WSL) [18] show significant performance drops on dynamic attacks, with AUC falling from ~0.99 to as low as 0.46.
• Direct classifier relying on print artifact cues drops from 90% to 52% recall on challenging attacks, unlike HoloVerif, which explicitly targets hologram appearance and behavior.
• Two particularly difficult attack classes include photo replacement and document swap, underscoring the need for holistic document context verification.

Threat model

The adversary is a physical document forger trying to produce either static or dynamic forgeries of a holographic OVD on identity documents that can fool remote automated verification systems. The adversary can manipulate lighting, print static templates with dynamic illumination tricks, or create handcrafted dynamic holographic overlays. However, the adversary cannot perfectly replicate the rich dynamic appearance transitions of genuine holograms across changing capture angles and lighting. The verifier has only smartphone-captured video sequences, with no access to specialized capture hardware or original document manufacturing.

Methodology — deep read

1. Threat Model & Assumptions: The adversary attempts to forge identity documents by manipulating or replicating the holographic OVD elements, including dynamic hologram behavior. The verifier has access only to remotely captured smartphone video sequences of documents under varied lighting. Attackers may perform static copy attacks or more sophisticated dynamic attacks using handcrafted holographic overlays. Assumed adversary cannot perfectly replicate all hologram dynamic appearances and transitions.

2. Data: The authors extend the MIDV-Holo dataset with MIDV-DynAttack, adding 1,200 videos of diverse forged holograms under realistic capture conditions using common smartphones (iPhone 7, Redmi Note 8 Pro, Motorola G7). The dataset includes static template attacks (750 videos) using printed templates with lighting effects to simulate hologram dynamics, and dynamic template attacks (450 videos) featuring handcrafted holographic overlays attempting to mimic genuine OVD behavior. No genuine new hologram samples were added. The dataset is publicly released for testing only; models train only on MIDV-Holo training splits.

3. Algorithm & Architecture: The method inputs a rectified, cropped Region of Interest (ROI) video sequence containing the hologram. Preprocessing removes the static background (document template, photo) using per-pixel median frame background subtraction, producing frames highlighting only variable holographic effects. These frames are further filtered using an HSV-based normalization emphasizing bright, saturated pixel regions characteristic of holograms.

A convolutional neural network classifier is trained to label each frame as Valid (showing genuine holographic behavior) or Non-Valid (no/false hologram). Instead of manual annotation, frame-level pseudo-labels are generated automatically from luminance change thresholds on preprocessed frames, harnessing frame intensity and temporal change patterns to infer holographic activity.

The classifier is trained with image augmentations that differ by label to improve robustness. At inference, frame-level predictions are aggregated by thresholding the ratio of Valid frames in the sequence to produce a binary Legit vs Non-Legit verdict.

4. Training Regime: Models are trained on the legitimate class frames of the MIDV-Holo Vanilla training and validation split, excluding known attack types to test generalization. The pseudo-label generation requires no direct attack frame annotation and no dynamic attack training samples. Multiple random seeds and 5-fold grouped cross-validation are employed to avoid identity leakage and assess variability. Batch size, epochs, optimizer, and augmentation parameters are detailed in supplementary material but not fully disclosed in the main text.

5. Evaluation Protocol: Evaluation occurs on the held-out MIDV-Holo test split plus the newly collected MIDV-DynAttack test sequences containing unseen dynamic and static attack types. Metrics include recall on fraud-only subsets, F-score, and Area Under ROC Curve (AUC) computed on combined Legit and Fraud sets. Calibration of decision thresholds is performed on a validation set to maximize F-score. Comparative baselines include the original MIDV-Holo method [13], WSL [18], and a naive direct frame classifier.

6. Reproducibility: Both the MIDV-DynAttack dataset and code for preprocessing, training, and evaluation are publicly released at https://github.com/EPITAResearchLab/pouliquen.25.icdar for community use. The rectification and tracking methods used for video alignment are private but tracking info is included in the dataset for reproducibility.

Example end-to-end: A test video of a document's hologram is rectified and cropped to the ROI. Background subtraction yields frames with holographic dynamic regions emphasized. Each frame passes through the trained CNN frame classifier, outputting Valid or Non-Valid. Thresholding the fraction of Valid frames over the sequence yields a final binary authenticity verdict detecting even dynamic hologram forgeries not seen during training.

Technical innovations

• Creation of MIDV-DynAttack, a significantly larger public dataset with realistic and challenging dynamic hologram attacks enabling evaluation of generalization to unseen fraud types.
• A novel hologram verification method combining background subtraction and HSV-based normalization to isolate dynamic holographic signals distinct from document background.
• Use of automated pseudo-labeling of individual frames based on luminance change heuristics to generate supervised training data without explicit annotation or dynamic attack samples.
• Application of frame-level CNN classifier trained on pseudo-labels aggregated over video sequences to robustly detect genuine versus fake holographic behavior.
• A clear evaluation protocol focused on unseen attack generalization, with ablations demonstrating the critical role of augmentation and background subtraction.

Datasets

• MIDV-Holo — 700 videos — public
• MIDV-DynAttack — 1,200 videos — public, extension of MIDV-Holo

Baselines vs proposed

• MIDV-Holo method [13]: AUC on MIDV-Holo = 0.85 ± 0.03, drops to 0.46 ± 0.01 on MIDV-DynAttack dynamic attacks vs HoloVerif proposed: AUC 0.99 ± 0.01 on MIDV-Holo and 0.91 ± 0.03 on MIDV-DynAttack.
• Weakly Supervised Learning (WSL) [18]: Recall 92 ± 8% on MIDV-Holo static attacks vs HoloVerif recall 93 ± 5%; WSL falls to 14 ± 8% recall on dynamic attacks vs HoloVerif 61 ± 13%.
• Direct Classifier [18]: Recall 90 ± 4% on MIDV-Holo static attacks vs HoloVerif 95 ± 3%; falls to 52 ± 20% recall on MIDV-DynAttack dynamic attacks vs HoloVerif 61 ± 13%.
• Ablation for HoloVerif: Without augmentations recall drops from 61 ± 13% to 29 ± 10% on dynamic attacks, highlighting augmentation importance.

Figures from the paper

Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2607.06466.

Fig 1: Our proposed dataset MIDV-DynAttack extends the original MIDV-Holo

Fig 2 (page 2).

Fig 3 (page 2).

Fig 4 (page 2).

Fig 5 (page 2).

Fig 6 (page 2).

Fig 7 (page 2).

Fig 8 (page 2).

Limitations

• No new genuine hologram samples were created, so generalization to varied genuine hologram types is untested.
• Relies on high-quality video rectification and alignment, which is private and may be a potential bottleneck for real-world deployment.
• Evaluation excludes deepfake or screen-injection style attacks, focusing solely on physical hologram veracity.
• The pseudo-labeling approach depends on heuristics sensitive to lighting and capture conditions, possibly limiting robustness.
• Study lacks extensive adversarial evaluation against adaptive attackers aware of the verification approach.
• Photo replacement and document swap attacks remain challenging, indicating incomplete security coverage.

Open questions / follow-ons

• How would incorporation of diverse genuine hologram types impact the method's generalization and false positive rate?
• Can the pseudo-label generation mechanism be improved or combined with self-supervised approaches to reduce reliance on heuristic thresholds?
• What is the robustness of the method under varying camera qualities, lighting conditions, and in-the-wild scenarios beyond the dataset?
• How might end-to-end models incorporating document localization and rectification jointly improve hologram verification performance?

Why it matters for bot defense

For bot-defense and CAPTCHA practitioners, this paper highlights the complexity of verifying dynamic, optical security features remotely using commodity hardware like smartphones. Automated verification of holographic OVDs can provide a robust defense layer against physical document fraud, analogous to behavioral or visual challenges in CAPTCHA that require authentic interaction. The proposed dataset and benchmark reveal that naive or static feature detection approaches are insufficient for dynamic, adaptive attacks. Practitioners should consider dynamic temporal characteristics and explicit background suppression for robust multi-frame validation when designing secure document or user verification systems. The pseudolabel training paradigm also suggests promising directions for fraud detection systems that can generalize beyond known attack types without exhaustive attack example data. However, the work also underscores practical limitations, particularly the strong dependence on precise alignment and the difficulty of reproducing genuine hologram variability, which must be accounted for in system design and threat modeling.

Cite

@article{arxiv2607_06466,
  title={ Verification of Dynamic Holographic Behavior in Identity Documents },
  author={ Glen Pouliquen and Joseph Chazalon and Guillaume Chiron and Thierry Géraud and Ahmad Montaser Awal },
  journal={arXiv preprint arXiv:2607.06466},
  year={ 2026 },
  url={https://arxiv.org/abs/2607.06466}
}

Read the full paper

• arXiv:2607.06466 (abstract)
• arXiv:2607.06466 (PDF)