{"id":"a1d6a768-c69f-45e0-be58-5aba65543ef9","arxiv_id":"2505.20675","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"high","formal_verification":"none","parameter_count":4,"one_line_summary":"CDN mixes feature statistics of genuine face images and reconstructs them to reduce false alarms in cross-domain deepfake detection, but the supporting theory is flawed and the artifacts are missing.","lead":"A face forgery detector called CDN trains on real face images by mixing style statistics across domains and then reconstructing the originals, aiming to spot fakes made by unseen forgery methods. The paper reports strong false-positive reductions on standard benchmarks, but its claimed theoretical guarantee of domain invariance rests on an invalid proof.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Theorem 2's proof that Eq. (12) implements Eq. (4) is invalid: it conflates Pθ and Pφ, assumes unproved density dominance, and uses log-density negativity that fails for densities >1; the central theoretical guarantee is unsupported.","rationale":"I agree with the reader's identification of Theorem 2 as the load-bearing assumption. My independent re-reading confirms that the proof is invalid for three reasons: the Pθ/Pφ subscript mismatch in Eqs. (27)-(29); the false claim that a continuous density is <1 so its logarithm is negative; and the fact that an upper-bound inequality, even if valid, would not imply that minimizing the bound minimizes the target. The manuscript's own heuristic in Eq. (30) is not a proof, and its dimensional comparison is questionable. I also checked the rest of the paper for independent support: no code release, no formal verification, and the empirical tables cannot be reproduced from the text; the missing boundary loss in Eq. (31) and missing appendix sections further weaken verifiability. These are secondary, but they reinforce the decision. The reader's REJECT verdict is appropriate; I recommend UNCHANGED.","tokens_in":20878,"tokens_out":9743,"duration_ms":97661,"concrete_test":"Re-derive the proof chain (25)-(29) with consistent notation q(z)=Pθ(z|iA,dB), p(z)=Pθ(z|iA,dA), and r(z)=Pφ(iA,dA|z); verify whether -E_q log r(z) ≥ DKL(q||p) follows from the stated assumptions. Then instantiate q=p=N(0,0.01) and r as the isotropic Gaussian in Eq. (16) with σφ²=1: the density at 0 is ≈3.99>1, so the inequality (b) step is violated, and the reconstruction objective is not ordered above the KL as the theorem requires. If the chain fails on this scalar case, Theorem 2 cannot ground Eq. (12).","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim depends on Theorem 2, which is supposed to show that the implemented loss Ld in Eq. (12) minimizes the desensitization objective Eq. (4), thereby yielding a representation satisfying Definition 1. The proof of Theorem 2 does not establish this. First, the notation is inconsistent: Eqs. (27) and (28) bound terms involving Pφ(z|iA,dA) and Pφ(z|iA,dB), while the KL divergence in Eq. (29) is between Pθ(z|iA,dB) and Pθ(z|iA,dA). The stated dominance assumption concerns Pθ(z|iA,dA) versus Pφ(iA,dA|z), so it does not justify inequality (a) at all. Second, inequality (b) requires log Pφ(z|iA,dB) < 0, i.e., Pφ(z|iA,dB) < 1 everywhere; continuous densities can exceed 1 (for example, N(0,0.01) has density about 3.99 at 0), so the added term can be positive and the inequality can reverse. Third, even if both inequalities held, the argument would only show that the negative reconstruction log-likelihood is an upper bound of the KL term; it would not show that minimizing Eq. (12) minimizes Eq. (4), since the slack between the two quantities is uncontrolled. The heuristic defense of the dominance assumption in Eq. (30) compares an m-dimensional latent density with an n-dimensional data density and is not a valid density comparison. The advertised formal guarantee is therefore unsupported; the empirical tables cannot fill that gap without released code or data.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes Contrastive Desensitization Network (CDN), a cross-domain face forgery detection method that learns a representation from genuine face images by mixing low-level feature statistics across domains (Eq. 8) and then reconstructing the source image through desensitization, intrinsic, and domain-alignment losses (Eqs. 9-12), together with a domain-boundary contrastive loss (Eq. 18). The central claim is that minimizing the desensitization objective Eq. (4) guarantees a domain-invariant representation satisfying Z ⊥⊥ D | I (Definition 1, Theorem 1), and that the implemented reconstruction loss Eq. (12) is an upper-bound surrogate for Eq. (4) (Theorem 2). Experiments on FF++, Celeb-DF, WildDeepfake, and DFDC report improved AUC/ACC and lower false-positive rates at fixed true-positive rates, with ablations and visualizations.","tokens_in":21279,"tokens_out":7863,"duration_ms":71688,"significance":"If the theoretical guarantee were valid, the work would offer a principled genuine-face-only representation stage for zero-shot cross-domain deepfake detection. The empirical results are extensive and directionally consistent: Tables 1-4 place CDN at or near the top on most intra-dataset, cross-dataset, cross-manipulation, and multi-source settings, and Figure 5 reports a large FPR reduction relative to RECCE and Xception. However, the central theoretical claim is not established: the proof of Theorem 2 contains invalid substitutions between P_phi and P_theta and a false assertion about log-densities, and Theorem 1 is largely definitional. Without the theory, the paper is an empirical study with several reporting gaps, including garbled tables and no released code or data. The significance as a theoretical contribution is therefore currently unsupported.","major_comments":[{"comment":"The proof of Theorem 2 does not establish the claimed bound. In Eq. (27) the quantity log(1/P_phi(z|i_A,d_A)) is introduced, but the KL divergence in Eq. (29) requires log(P_theta(z|i_A,d_B)/P_theta(z|i_A,d_A)). The added term in Eq. (28) is E log P_phi(z|i_A,d_B), which is not the term appearing in the KL between the P_theta conditionals. The assumed dominance P_theta(z|i_A,d_A) >= P_phi(i_A,d_A|z) does not justify Eq. (27), both because it does not relate P_phi(i_A,d_A|z) to P_phi(z|i_A,d_A) and because it gives no control on P_theta(z|i_A,d_A). Consequently the chain (25)-(29) is invalid, and Theorem 2, which is the central bridge between the implemented loss Eq. (12) and the desensitization objective Eq. (4), is unsupported.","section":"Theoretical Justification, Theorem 2"},{"comment":"The assumed dominance condition is not meaningful as stated because P_theta(z|i_A,d_A) is a density on the latent space while P_phi(i_A,d_A|z) is a density on the data space; comparing their pointwise values depends on a choice of reference measure. The Gaussian heuristic in Eq. (30) compares log-densities of different dimensionalities and concludes the variance term is positive whenever sigma_phi^2 > sigma_theta^2, which ignores the normalization constants and allows the bias term to be negative. The separate assertion used for inequality (b), that P_phi(z|i_A,d_B) < 1 so its logarithm is negative, is false for continuous densities: a Gaussian N(0, 0.01) has density about 3.99 at the origin. Removing either assertion collapses the proof, so the theoretical guarantee advertised in the abstract and in the section 'Theoretical Justification for the Proposed Method' is not justified.","section":"Theoretical Justification, Eq. (30)"},{"comment":"Even if the inequalities in the proof were repaired, the result would be a one-sided upper bound with uncontrolled slack; it would not show that minimizing Eq. (12) minimizes Eq. (4). The actual training loss in Eq. (31) is L_cls + lambda_1 L_d + lambda_2 L_i + lambda_3 L_s and contains no KL term, no bound, and no domain-boundary term L_b from Eq. (18), despite the paper's extensive ablations of the Domain Boundary Constraint. The connection between the theoretical objective and the optimized loss is therefore not established.","section":"Learning to Desensitize; Eq. (31)"},{"comment":"Theorem 1 is largely definitional. The objective Eq. (4) directly penalizes the KL divergence between P_theta(z|i_A,d_B) and P_theta(z|i_A,d_A); at the optimum these two conditionals coincide for all d_A,d_B, which is essentially the conditional independence Z ⊥⊥ D | I stated in Definition 1. The 'redundancy elimination' step in the proof assumes the conditional independence it is meant to derive: the assertion that P_theta*(z|i_A,d_A,d_B)=P_theta*(z|i_A,d_A) is exactly the claim that, given i_A, the additional domain variable d_B is irrelevant. This circularity undermines the claim of a formal guarantee.","section":"Theorem 1"},{"comment":"The experimental reporting is not verifiable in its current form. Table 2 prints CDN results as '70.73±0.634.66±1.871.26±2.135.20±4.370.21±2.735.08±5.8', which is unparsable and does not allow comparison with baselines. Table 11 contains the identical hyperparameter row (lambda_1=0.1, lambda_2=0.1, lambda_3=0.1) twice with different reported AUC/ACC (92.50/84.82 and 91.46/84.12). The real-world evaluation in Table 5 and the DBC ablations in Tables 7-9 lack dataset construction details, standard deviations, and, for Table 5, any description of the manipulation protocols. No code or data are released, so the consistency of the empirical tables cannot be checked.","section":"Experiments, Tables 2 and 11"}],"minor_comments":[{"comment":"There are several language errors, including 'an Contrastive', 'with regard to the its robustness', and 'Constrastive' in the introduction; these should be corrected.","section":"Abstract and Introduction"},{"comment":"References to 'Section a', 'Appendix a', and 'eq.a' point to non-existent sections; the appendix is not included, and these cross-references should either be resolved or removed.","section":"Implementation Details"},{"comment":"The paragraph discussing ROC curves appears to mislabel the subfigures: the text refers to 'Figure 4(a)' and 'Figure 4(b)' in a way that does not match the described intra-evaluation and cross-manipulation results.","section":"Intra-dataset Evaluation, Figure 4"},{"comment":"The domain transformation is described only for z_A, but the symmetric use for z_B is not defined; the formula should state how the two samples are treated and what happens when the batch contains more than two domains.","section":"Eq. (8)"},{"comment":"The function Dis(x,y) is used in Eq. (18) before it is defined in Eq. (19); the definition should be introduced before first use.","section":"Eq. (18)"},{"comment":"Several entries in Table 1 are missing separators (e.g., '99.29±0.491.54±0.7'), making the table difficult to read; the formatting should be corrected.","section":"Table 1"},{"comment":"The assumption that domain features have clear boundaries in latent space and that intrinsic features overlap sufficiently is stated only in the conclusion; because this assumption is load-bearing for the desensitization mechanism, it should be stated and discussed earlier, ideally with a test or diagnostic.","section":"Conclusion"}],"recommendation":"reject","confidential_remarks":"The paper's empirical direction may be worth pursuing, but the theoretical core is invalid and the experimental tables as printed are not reliable. I would encourage the authors to release code and data and to resubmit with a corrected or substantially weakened theoretical claim, since the current version does not support the advertised formal guarantee."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Here's the take. The method is a sensible empirical package: AdaIN-style mixing of feature statistics, denoising reconstruction, a contrastive boundary term, trained on real faces only for the representation stage. The experiments are broad — four benchmarks, cross-manipulation, multi-source, a self-built real-world set — and the reported FPR reductions are consistent. At 0.14% FPR at 85% TPR on FF++(c23) the method would be genuinely useful if the numbers hold. I trust the ablation logic; the DBC trade-off between FNR and FPR is stated honestly.\n\nThe problem is the theory. Theorem 2 is the advertised formal guarantee that the loss in Eq. (12) minimizes the desensitization objective in Eq. (4), and the proof does not work. In Eq. (28) the argument silently swaps Pφ(z|iA,dB) for Pθ(z|iA,dB) when passing to the KL divergence in Eq. (29). Inequality (a) relies on an unproved density dominance assumption that is argued heuristically by comparing dimensions; that is not a valid density comparison. Inequality (b) requires log Pφ(z|iA,dB) < 0, i.e. Pφ < 1 everywhere, which is false for continuous densities that can exceed 1. And even if both inequalities held, an upper bound with uncontrolled slack does not show that minimizing the reconstruction loss minimizes the KL objective. The proof is not a minor gap; it is the load-bearing connection between the stated objective and the implemented loss.\n\nThere are also presentation issues: the boundary loss Lb in Eq. (18) is described and ablated but omitted from the total loss in Eq. (31); several references to 'Section a' and 'Appendix a' point to content that is not in the arXiv submission. No code or data is released, so the empirical tables are not independently checkable.\n\nWho this is for: someone working on cross-domain deepfake detection who wants a concrete recipe for low-FPR training. That reader gets value from the experimental section even after discounting the theory. But the paper as written overclaims: the central theoretical justification is unsupported. I'd send it to review rather than desk-reject, because the empirical contribution is substantial and the theory can be repaired or dropped. The current form, though, should not be accepted.","headline":"Solid empirical package for low-FPR cross-domain deepfake detection, but the central theoretical guarantee is unproved and the proof is not a minor gap.","tokens_in":21756,"tokens_out":1959,"would_cite":false,"duration_ms":20271,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Training on genuine faces alone can detect forged faces on unseen domains, with a 0.14% false positive rate at 85% true positive rate.","keywords":["face forgery detection","deepfake detection","domain generalization","contrastive learning","desensitization","domain-invariant representation","false positive rate","reconstruction learning"],"falsifier":"On a trained CDN, compute $\\Delta = \\log P_\\theta(z|i_A,d_A) - \\log P_\\phi(i_A,d_A|z)$ over held-out genuine faces; any sample with $\\Delta < 0$ violates the density-dominance assumption and removes the proof that the reconstruction loss upper-bounds the KL objective of Eq. (4).","tokens_in":20633,"feed_emoji":"🎭","tokens_out":16274,"duration_ms":140276,"temperature":0.7,"pith_summary":"This paper claims that cross-domain face forgery detection can be made robust to unseen forgery methods by learning a representation of genuine faces from real images only, without ever seeing a fake image during the representation-learning stage. The proposal is a conditional-independence criterion ($Z \\perp D \\mid I$) and a desensitization objective that minimizes the KL divergence between the representation of a face dressed in two different domain styles; the authors argue that its optimum satisfies the criterion. The practical method, a Contrastive Desensitization Network, implements this objective by mixing the feature statistics of two real faces and reconstructing the original image, and the paper's Theorem 2 asserts that this reconstruction loss is an upper bound on the KL objective. If the claim is right, a system can achieve a low false positive rate on unseen domains without needing examples of future forgery techniques; on FaceForensics++(c23) the reported false positive rate is 0.14% at 85% true positive rate, compared with 0.84% for Xception and 0.53% for RECCE.","feed_headline":"Real-face-only training detects deepfakes at a 0.14% false alarm rate","feed_subtitle":"The method keeps false alarms low on unseen forgery types while preserving detection accuracy.","key_machinery":"The load-bearing object is the desensitization objective together with the reconstruction loss that upper-bounds it. The encoder maps an image to latent statistics $D=(\\mu(z),\\sigma(z))$ and normalized content $I=(z-\\mu(z))/\\sigma(z)$ (Eq. (3)); the objective in Eq. (4) is $D_{KL}[P_\\theta(z|i_A,d_B)\\,\\|\\,P_\\theta(z|i_A,d_A)]$, the gap between representations of the same intrinsic content under two domain styles. The domain transformation (Eq. (8)) is adaptive-instance-normalization-style mixing, $z_{\\mathrm{out}} = \\sigma_B (z_A-\\mu_A)/\\sigma_A + \\mu_B$, which wraps sample A's content in sample B's style. The denoising reconstruction loss (Eq. (12)), $\\|\\phi(z_{\\mathrm{out}})-x_A\\|_2^2$, then forces the decoder to remove the injected style. Theorem 2 is the bridge: it asserts that maximizing the reconstruction likelihood is equivalent to minimizing an upper bound of the KL objective, so the practical loss carries the theoretical guarantee.","core_discovery":"The central claim is that desensitization is a sufficient inductive bias for cross-domain deepfake detection. Decomposing a real face into intrinsic content $I$ and domain-specific statistics $D$, and then training an encoder so that the distribution of its representation $Z$ does not change when $D$ is swapped, yields a representation that is invariant to both known and unseen domains (Definition 1). The paper proves (Theorem 1) that the optimum of the KL objective in Eq. (4) achieves $Z \\perp D \\mid I$, and proves (Theorem 2) that maximizing the likelihood of the denoising reconstruction in Eq. (12) is equivalent to minimizing an upper bound of that KL objective, under a density-dominance assumption. The implemented CDN mixes the statistics of a source feature with those of a target feature to create the perturbed sample, then reconstructs the source image through a decoder; only genuine images participate in this stage. The learned encoder representation is passed to a downstream classifier, and the experiments report lower false positive rates and improved AUC on FF++, Celeb-DF, WildDeepfake, and DFDC relative to the compared methods.","pith_inferences":["The recipe of splitting content from domain statistics, mixing statistics across genuine samples, and reconstructing could transfer to other open-ended spoof-detection settings, such as audio deepfakes or document forgery, where genuine samples are abundant but attack types are unbounded; the paper evaluates faces only, so this is an extrapolation.","Theorem 2's bound is testable: on a trained model, estimate $\\Delta = \\log P_\\theta(z|i_A,d_A) - \\log P_\\phi(i_A,d_A|z)$ from Eq. (30); if $\\Delta$ is negative for a non-negligible fraction of held-out genuine faces, the theoretical guarantee is not doing the work and the low FPR would be an empirical property of the trained architecture.","The domain-boundary constraint ablation shows a direct trade-off between false negatives and false positives; replacing that contrastive term with a one-class constraint on the real-face manifold would test whether the whole detector can remain entirely fake-free while keeping both rates low."],"forward_implications":["On FaceForensics++(c23) at an 85% true positive rate, the method's false positive rate is 0.14%, versus 0.84% for Xception and 0.53% for RECCE, showing the low-alarm behavior that makes the system usable.","Because the representation stage uses only genuine images, generalization to new forgery methods no longer depends on collecting fake examples of those methods; fake data enter only through an optional domain-boundary constraint and the downstream classifier.","In cross-dataset tests with a model trained on FF++(c40) and tested on Celeb-DF, WildDeepfake, and DFDC, the reported AUC/EER improve over the compared methods, indicating the representation transfers to entirely unseen data sources.","In cross-manipulation tests within FF++, the AUC advantage persists when the manipulation type at test time differs from training; for example, a Face2Face-trained model reaches 85.86 AUC on DeepFakes test data, versus 78.07 for the best compared method.","The extra machinery adds modest cost: 1.14 G FLOPs versus RECCE's 2.27 G with similar parameter count, so the low-false-alarm behavior does not require a heavier detector."],"supporting_citations":[{"why":"Defines domain-style information through feature statistics, grounding the decomposition of samples into intrinsic and domain-specific parts used in Eq. (3).","marker":"Hoffman (2013)"},{"why":"Supplies the statistics-mixing operation (adaptive instance normalization) on which the domain transformation in Eq. (8) is built.","marker":"Huang and Belongie (2017)"},{"why":"Source of the content loss in Eq. (9) that keeps the transformed feature structurally close to the original.","marker":"Ulyanov et al. (2016, 2017)"},{"why":"Supplies the style-alignment formulation used in the domain alignment losses of Eqs. (10)-(11).","marker":"Li et al. (2017)"},{"why":"Earlier interpretation of statistics mixing as feature augmentation, which the paper reinterprets as desensitization.","marker":"Zhou et al. (2023)"},{"why":"The reconstruction-classification baseline whose high false-positive rate motivates this work and whose datasets and protocols are reused.","marker":"Cao et al. (2022)"},{"why":"Provides the Xception backbone and a standard comparison baseline for forgery detection.","marker":"Chollet (2017)"},{"why":"FaceForensics++ dataset used for intra-dataset, cross-manipulation, and multi-source evaluations.","marker":"Rossler et al. (2019)"},{"why":"Celeb-DF dataset used for cross-dataset and intra-dataset evaluations.","marker":"Li et al. (2020b)"},{"why":"DFDC dataset used to test cross-dataset generalization at scale.","marker":"Dolhansky et al. (2019)"}],"fun_headline_variants":["Cross-domain deepfake detection at 0.14% false alarms","Desensitization learning cuts false alarms on unseen forgeries","Contrastive desensitization achieves domain-invariant deepfake detection","0.14% false alarm rate on unseen deepfakes via desensitization"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that in the trained model, the encoder's probability density in latent space is never smaller than the decoder's probability density in image space for the same sample, and that the decoder's density is always below 1 so a key logarithm is negative; continuous probability densities are not guaranteed to behave this way, so the proof's bound collapses if the premise fails.","fun_headline_variants_meta":{"raw":{"variants":["Cross-domain deepfake detection at 0.14% false alarms","Desensitization learning cuts false alarms on unseen forgeries","Contrastive desensitization achieves domain-invariant deepfake detection","0.14% false alarm rate on unseen deepfakes via desensitization"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000952,"raw_usage":{"total_tokens":4049,"prompt_tokens":925,"completion_tokens":3124,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":541,"completion_tokens_details":{"reasoning_tokens":3048}},"tokens_in":541,"tokens_out":3124,"duration_ms":20857,"temperature":1.0,"reasoning_tokens":3048,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T13:49:06.408213+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"On a trained CDN, compute $\\Delta = \\log P_\\theta(z|i_A,d_A) - \\log P_\\phi(i_A,d_A|z)$ over held-out genuine faces; any sample with $\\Delta < 0$ violates the density-dominance assumption and removes the proof that the reconstruction loss upper-bounds the KL objective of Eq. (4).","supporting_citations":[{"cited_title":", year 2013","cited_arxiv_id":null,"evidence_quote":"Defines domain-style information through feature statistics, grounding the decomposition of samples into intrinsic and domain-specific parts used in Eq. (3)."},{"cited_title":", author Belongie, S","cited_arxiv_id":null,"evidence_quote":"Supplies the statistics-mixing operation (adaptive instance normalization) on which the domain transformation in Eq. (8) is built."},{"cited_title":", author Yang, Y","cited_arxiv_id":null,"evidence_quote":"Earlier interpretation of statistics mixing as feature augmentation, which the paper reinterprets as desensitization."},{"cited_title":", author Ma, C","cited_arxiv_id":null,"evidence_quote":"The reconstruction-classification baseline whose high false-positive rate motivates this work and whose datasets and protocols are reused."},{"cited_title":", year 2017","cited_arxiv_id":null,"evidence_quote":"Provides the Xception backbone and a standard comparison baseline for forgery detection."},{"cited_title":", author Cozzolino, D","cited_arxiv_id":null,"evidence_quote":"FaceForensics++ dataset used for intra-dataset, cross-manipulation, and multi-source evaluations."}],"review_version":1}