{"id":"9731d696-11cb-48f7-9403-59d59b0c801e","arxiv_id":"2412.14623","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":1,"one_line_summary":"FRIDAY trains a deepfake detector with an extra loss that orthogonalizes its features against a frozen face recognizer, reducing reliance on facial identity and improving cross-domain accuracy.","lead":"A new training method for deepfake detectors uses a face recognizer to push the detector's feature embeddings away from identity-related features. The approach modestly improves accuracy on both in-domain and cross-domain face forgery datasets.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Eq. 6's Facial Identity Attenuating loss imposes only one orthogonality constraint per sample, but facial identity is a high-dimensional manifold; no evidence shows the single frozen recognizer direction removes identity for unseen subjects, so the claimed mechanism is not established.","rationale":"The reader's weakest assumption already identifies the same load-bearing point: the method relies on a single frozen face recognizer direction to remove identity for arbitrary unseen identities. I sharpen this into a quantitative concern about Eq. 6: absolute cosine similarity is a one-dimensional constraint, whereas face identity occupies a high-dimensional subspace of the embedding, so satisfying L_fia does not guarantee identity attenuation. This is the most load-bearing issue because it attacks the causal mechanism behind the central claim, not just the experimental setup. The paper deserves credit for proposing a simple, plausible regularizer and for reporting consistent gains across datasets, but those gains could in principle arise from generic feature decorrelation rather than from the intended identity removal. The proposed test directly settles this by measuring identity retention on unseen subjects using the paper's own probe. Since the reader already issued a CONDITIONAL verdict, this concern reinforces the need for the stated condition rather than changing the verdict; hence I recommend UNCHANGED.","tokens_in":5327,"tokens_out":6068,"duration_ms":60019,"concrete_test":"Use the paper's own 'unintentional identity learning check' (Fig. 2a) on the released FRIDAY checkpoint: freeze the detector, replace its classifier with a face classifier, and train it on identities disjoint from the 720 FF++ identities, e.g., real subjects from Celeb-DF or a held-out face dataset. Compare convergence speed and top-1 accuracy against the same probe trained on an identical detector trained with λ=0 (no L_fia) under the same protocol. If the FRIDAY probe converges at the same rate or higher, then L_fia did not attenuate identity for unseen subjects, and the cross-domain gains must be attributed to another mechanism. As a secondary check, report the residual |cos(z_f,z_d)| on a held-out identity set to show the constraint actually transfers.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that minimizing the absolute cosine similarity between the detector embedding z_d and the frozen recognizer embedding z_f (Eq. 6, L_fia) attenuates facial identity. This requires two assumptions: (i) a single recognizer output direction is a sufficient statistic for identity, and (ii) that direction transfers to identities not in the 720-subject training set. Face identity is not encoded as one linear direction; it lives in a high-dimensional subspace of the embedding. Minimizing |cos(z_f,z_d)| only forces z_d into the orthogonal complement of one vector z_f(x) per sample. Identity information can persist in the orthogonal complement, so the detector can continue to rely on identity while satisfying the loss. Moreover, the recognizer was trained only on FF++ real frames; for fake inputs and for unseen identities in Celeb-DF/DFD its embedding is out-of-distribution, so the direction being orthogonalized may not correspond to identity at all. The paper's own check (Fig. 2a/4c) measures identity content but reports no quantitative result for unseen identities, and Table I contains no same-backbone/no-L_fia ablation. Consequently, the observed accuracy/AUC gains are not shown to be caused by identity attenuation; they could be a generic regularizer effect. This is load-bearing because if the mechanism fails, the method's motivation and novelty are unsupported even if the numbers are reproducible.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes FRIDAY, a two-phase training method for deepfake detectors. In Phase 1, a face recognizer with the same backbone (EfficientNet-B3) is trained on 720 FF++ identities using cross-entropy. In Phase 2, the recognizer is frozen and the detector is trained with the usual binary cross-entropy plus a Facial Identity Attenuating loss, L_fia = |cos(z_f, z_d)| (Eq. 6), which encourages the detector embedding to be orthogonal to the recognizer embedding. The authors claim this reduces the detector's reliance on facial identity and improves in-domain and cross-domain performance. Experiments on FF++, Celeb-DF v1/v2, and DFD (Table I) report gains over CapsuleNet, Xception, CViT, and UIA-ViT, with FF++ ACC 95.18% and average cross-domain AUC 84.37%. The paper includes an analysis of the loss weight lambda (Fig. 4) and a qualitative convergence check for identity content (Fig. 2).","tokens_in":5632,"tokens_out":3552,"duration_ms":28357,"significance":"If the central claim is validated, FRIDAY offers a simple and potentially general training regularizer that could be attached to many deepfake detectors, and it directly targets a known generalization problem. The proposed loss is new, the method is straightforward to implement, and the reported numbers are internally consistent. However, the current evidence does not yet establish the claimed mechanism: the identity-reduction effect is measured with the same convergence check used to motivate the problem, the loss weight is tuned on the evaluation sets, and no same-backbone ablation is provided. These gaps currently limit the significance of the contribution.","major_comments":[{"comment":"The optimal lambda is selected by measuring ACC and AUC on the in-domain FF++ test set, and the same test set is then used to report the in-domain results in Table I. This makes the reported FF++ numbers optimistic and does not allow a fair comparison with baselines whose hyperparameters are not tuned on this split. The authors should specify a validation split and report results for a lambda chosen from that split, or at least report the sensitivity of all datasets to lambda over a small grid.","section":"Section III-D, Fig. 4"},{"comment":"There is no ablation of the proposed method with the same EfficientNet-B3 backbone and lambda = 0. All baseline models use different architectures or training schemes, so the observed gains over Xception, CViT, and UIA-ViT could be due to backbone capacity, augmentation, or other training details rather than the Facial Identity Attenuating loss. A same-backbone baseline with and without L_fia is necessary to attribute the improvement to the proposed loss.","section":"Table I"},{"comment":"L_fia imposes only a single orthogonality constraint (one per sample) between the detector embedding and the frozen recognizer embedding. Facial identity is generally believed to span a high-dimensional subspace, and the paper does not demonstrate that the single recognizer output direction is a sufficient statistic for identity, nor that this direction remains meaningful for unseen identities or for fake images outside the recognizer's training distribution. The identity check in Fig. 2a/4c reports convergence on the datasets used rather than a quantitative identity-leakage measurement on unseen identities. The claimed mechanism therefore is not established; the accuracy gains could come from a generic regularizing effect. Please provide quantitative identity-reduction measurements on unseen identities and compare L_fia against a control orthogonality constraint to an unrelated auxiliary embedding.","section":"Section II-C, Eq. (6)"},{"comment":"The paper's motivation is explicitly based on Dong et al., 'Implicit Identity Leakage' [13], which directly addresses identity leakage in deepfake detectors, but no comparison with that method or its follow-up works is included in Table I. Since this is the most relevant prior method, omitting it leaves the claimed superiority incomplete. A comparison should be added, or the omission should be justified.","section":"Section III-C and References [13]"},{"comment":"All results are reported from a single training run with no error bars, multiple seeds, or statistical tests. Given that the reported cross-domain differences are around 1-2% AUC, and the model uses stochastic augmentation and optimization, it is not clear that the improvements are statistically reliable. Please report mean and standard deviation over at least three random seeds.","section":"Section III-A and Table I"}],"minor_comments":[{"comment":"The sentence 'we concluded that λ = 10is the optimal value' is missing a space; it should read 'λ = 10 is the optimal value'.","section":"Section III-D"},{"comment":"The text refers to 'as depicted in Fig. 2a' when describing the identity-content check across lambda values, but Fig. 2a is a schematic of the check method; the actual identity-content results appear in Fig. 4c. Please correct the cross-reference.","section":"Section III-D, Fig. 4 caption"},{"comment":"The face recognizer architecture is not fully specified: the text mentions a backbone and an MLP classifier, but does not give the hidden layer sizes, embedding dimension, or whether batch normalization is used. This information is needed for reproducibility.","section":"Section III-B"},{"comment":"The recognizer is trained on N = 720 identities 'based on the FF++ dataset', but it is not stated how these are split from the FF++ training set and whether the same identities appear in the detector training set or in the identity check. Please clarify the identity split.","section":"Section II-B"},{"comment":"The claim that this is 'the first time' a face recognizer is used in deepfake detector training is stronger than the evidence provided, given the prior identity-based methods cited in [13] and [14]. Consider softening the novelty claim.","section":"Abstract and Section I"},{"comment":"Fig. 2b is labeled 'Epoch Loss' but does not state which loss is plotted, on which dataset, or over how many epochs. Without this context, the convergence plot is hard to interpret.","section":"Section II-A, Fig. 2"}],"recommendation":"major_revision","confidential_remarks":"The paper addresses an important problem and the proposed loss is simple, but the evaluation is currently too weak to support the central claim. The lack of a same-backbone ablation, the tuning of lambda on the test set, and the omission of the most relevant prior method are all addressable within the manuscript's scope. I do not see a fundamental error in the formulation; the main risk is that the observed gains may be a generic regularization effect rather than identity attenuation. The authors should be asked to add the missing experiments and to report uncertainty estimates."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"FRIDAY is a simple training-time addition: freeze a face recognizer trained on the same backbone, and add a term that pushes the detector embedding's absolute cosine similarity toward zero. The combination is genuinely new to me, and the paper is easy to read. The reported gains on FF++ and cross-domain sets are modest but consistent, and the lambda sweep actually shows that the identity check (Fig. 4c) tracks performance, which is an attempt to close the loop.\n\nThe soft spots are in the mechanism claim, not in the basic reproducibility. The biggest missing experiment is a same-backbone detector trained without L_fia. Without that ablation, the 1-2 point gains could come from any regularizer. The comparison table omits the most relevant prior work—Dong et al.'s implicit identity leakage paper [13]—so we don't know whether this is better than an established way of attacking the same problem. There are no error bars, and lambda is selected on the test sets, which inflates the headline numbers. No code is released, which makes the single-run results harder to trust. The stress-test note makes a fair additional point: L_fia imposes one orthogonality constraint per sample, while identity lives in a high-dimensional subspace, and the recognizer was trained only on 720 FF++ identities. The paper does not show that identities unseen in that training set are actually neutralized. That is a real gap, but it weakens the explanation, not necessarily the empirical result. The gains might come from a useful regularizer and the identity story be partly wrong; the method can still work.\n\nThis paper is for anyone working on deepfake detector generalization. It is a short, readable paper that deserves a serious referee. I would send it out with a request for the missing ablation, error bars, and a comparison against [13]. Those are addressable and the core idea is worth testing.\n\nRecommendation: accept for review.","headline":"A plausible training-time trick that makes a modest empirical dent, but the identity-attenuation claim is not actually pinned down by the experiments.","tokens_in":6112,"tokens_out":2485,"would_cite":false,"duration_ms":17350,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that freeing a deepfake detector's embedding from the direction a frozen face recognizer learns removes unintended identity shortcuts and improves detection on both seen and unseen forgery domains.","keywords":["deepfake detection","facial identity attenuation","face recognition","cross-domain generalization","cosine similarity loss","identity leakage","forensic embedding orthogonalization"],"falsifier":"Train the Phase-1 recognizer on a strict subset of identities, then evaluate FRIDAY on fake videos of held-out identities; if cross-domain AUC does not change or the face-identification probe still converges quickly on those held-out identities, the single recognizer direction was not actually erasing identity information and the reported gains must come from a different mechanism such as general regularization.","tokens_in":1601,"feed_emoji":"🎭","tokens_out":4846,"duration_ms":73610,"temperature":0.7,"pith_summary":"The paper tries to establish that deepfake detectors often learn who a face is rather than whether it was manipulated, and that this hidden identity shortcut is a major reason they fail on new forgery methods. FRIDAY is a training method that removes this shortcut by pairing the detector with a frozen face recognizer during training. The two networks see the same image, and the loss drives their feature embeddings to be orthogonal, so the detector cannot rely on the identity direction the recognizer has learned. The authors report that this improves accuracy on the training domain and raises cross-domain performance over the compared baselines. If true, it offers a reusable regularizer for making forensic detectors generalize beyond the artifacts they were trained on.","feed_headline":"One loss strips facial identity from deepfake detectors","feed_subtitle":"A frozen face recognizer is the reference; forcing detector embeddings orthogonal to it lifts average cross-domain AUC to 84.37%.","key_machinery":"The key object is the Facial Identity Attenuating loss, the absolute cosine similarity between the frozen face recognizer's embedding and the deepfake detector's embedding. The recognizer, trained on real faces only, acts as a stable reference direction for facial identity, and driving the detector's embedding orthogonal to that direction is intended to strip identity information while leaving artifact features intact. The full machinery is the two-phase training scheme: first train the recognizer with cross-entropy over 720 FF++ identities, then freeze it and train the detector with a total loss comprising the classification loss plus a weighting factor times the identity-attenuating loss, with the weighting factor set to 10 after a sweep.","core_discovery":"The central claim is that unintentional facial identity learning is a removable cause of cross-domain generalization failure. In Phase 1 the authors train a face recognizer with the same backbone as the detector, using a closed-set cross-entropy loss over 720 real identities. In Phase 2 they freeze that recognizer and add the Facial Identity Attenuating loss, defined as the absolute value of the cosine similarity between the two embeddings, to the binary cross-entropy classification loss. Minimizing this term makes the detector's embedding orthogonal to the recognizer's identity-oriented embedding, attenuating identity features while still training the detector to classify real versus fake. The paper demonstrates the reduction in identity content with a probe that retrains the detector's classifier for face identification, and reports that FRIDAY improves both in-domain FF++ accuracy and cross-domain AUC on Celeb-DF v1, Celeb-DF v2, and DFD.","pith_inferences":["The paper constrains the detector against a single recognizer vector, but facial identity is likely a subspace; a natural extension the paper leaves implicit is projecting out multiple identity directions or the top-k recognizer directions, which may preserve artifact features more cleanly.","The same two-phase recipe could transfer to other shortcut-prone forensic tasks, such as synthetic text or synthetic audio detection, where a content recognizer supplies the direction to erase.","The lambda sweep suggests a tradeoff between identity removal and artifact preservation, so the optimal strength likely varies with the diversity of identities in the target domain; per-dataset tuning is a plausible next step.","If orthogonality to the recognizer genuinely removes identity information, per-identity accuracy should become more uniform, which is a checkable side prediction the paper does not report."],"forward_implications":["In-domain detection on FF++ reaches 95.18% ACC and 99.18% AUC with FRIDAY, exceeding the compared baseline models in Table I.","Cross-domain average AUC reaches 84.37% across Celeb-DF v1, Celeb-DF v2, and DFD, with DFD ACC at 90.12%.","The identity-attenuation effect is measurable: after FRIDAY training, a face-identification probe converges less, indicating reduced facial identity content in the detector's embedding.","Because the recognizer and detector use the same backbone, the method can be applied to other deepfake detector architectures by adding the frozen recognizer and the identity-attenuating loss."],"supporting_citations":[{"why":"Supplies the premise that deepfake detectors implicitly learn facial identity and that this identity leakage hurts cross-domain generalization.","marker":"[13]"},{"why":"Provides the FaceForensics++ dataset used for training and in-domain evaluation, including the 720 identities for recognizer training.","marker":"[5]"},{"why":"UIA-ViT is the strongest cross-domain baseline compared in Table I, and FRIDAY's gains are measured against it.","marker":"[9]"},{"why":"CViT is a compared baseline in Table I representing convolutional vision transformer detectors.","marker":"[15]"},{"why":"Celeb-DF v1 and v2 are the cross-domain evaluation datasets used to measure generalization.","marker":"[16]"},{"why":"The DeepfakeDetection (DFD) dataset is used as the additional cross-domain test set in Table I.","marker":"[17]"},{"why":"CapsuleNet is a baseline in Table I whose in-domain and cross-domain numbers frame the comparison.","marker":"[7]"}],"fun_headline_variants":["FRIDAY: A frozen face recognizer strips identity from deepfake detectors","New loss makes deepfake detector embeddings orthogonal to facial identity","FRIDAY boosts cross-domain deepfake AUC to 84.37% by attenuating identity","Face recognizer guides deepfake detectors to ignore who's in the frame"],"cache_read_input_tokens":8320,"weakest_assumption_plain":"The method assumes that a face recognizer trained on 720 identities from the training set captures an identity direction general enough that making the detector's embedding orthogonal to it removes identity information for unseen faces, without removing the artifact features the detector needs.","fun_headline_variants_meta":{"raw":{"variants":["FRIDAY: A frozen face recognizer strips identity from deepfake detectors","New loss makes deepfake detector embeddings orthogonal to facial identity","FRIDAY boosts cross-domain deepfake AUC to 84.37% by attenuating identity","Face recognizer guides deepfake detectors to ignore who's in the frame"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00061,"raw_usage":{"total_tokens":2818,"prompt_tokens":905,"completion_tokens":1913,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":521,"completion_tokens_details":{"reasoning_tokens":1831}},"tokens_in":521,"tokens_out":1913,"duration_ms":10313,"temperature":1.0,"reasoning_tokens":1831,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T12:03:03.103270+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train the Phase-1 recognizer on a strict subset of identities, then evaluate FRIDAY on fake videos of held-out identities; if cross-domain AUC does not change or the face-identification probe still converges quickly on those held-out identities, the single recognizer direction was not actually erasing identity information and the reported gains must come from a different mechanism such as general regularization.","supporting_citations":[{"cited_title":"Implicit identity leakage: The stumbling block to improving deepfake detection gener- alization,","cited_arxiv_id":null,"evidence_quote":"Supplies the premise that deepfake detectors implicitly learn facial identity and that this identity leakage hurts cross-domain generalization."},{"cited_title":"Deepfakes detection dataset by google & jigsaw,","cited_arxiv_id":null,"evidence_quote":"The DeepfakeDetection (DFD) dataset is used as the additional cross-domain test set in Table I."}],"review_version":1}