Pith. sign in

REVIEW 3 major objections 5 minor 51 references

Where the Devil Hides: Deepfake Detectors Can No Longer Be Trusted

T0 review · 3 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Deepfake detectors can be silently backdoored by poisoned third-party training data, and a new trigger generator makes the backdoor passcode-protected, adaptive, and invisible.

desk verdict A well-executed backdoor attack on deepfake detectors with a genuinely new passcode-control idea, but the central claim about irreproducible triggers rests on an unablated auxiliary set. read the letter →

arxiv 2505.08255 v1 pith:67IM3CRW submitted 2025-05-13 cs.CR cs.CV

Shuaiwei Yuan , Junyu Dong , Yuezun Li This is my paper · ORCID
classification cs.CRcs.CV
keywords deepfakedetectionbackdoorattackdatapoisoningclean-labeltriggergenerationpasscodecontrolthird-partydatasetrepresentationsuppression
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that the standard practice of training deepfake detectors on third-party face datasets carries a hidden security risk: if the data provider quietly poisons even a small fraction of the data, the resulting detector is permanently backdoored. The authors build a trigger generator that stamps face images with invisible, sample-adaptive patterns derived from a secret passcode, and show that detectors trained on these poisoned sets classify any trigger-bearing face as the attacker's chosen label while behaving normally on clean faces. They demonstrate both dirty-label and clean-label poisoning across four base networks and four dedicated detectors, reporting attack success rates near 90-100% with benign accuracy nearly unchanged. The implications for the forensics community are direct: dataset provenance becomes a first-class security concern.

What carries the argument

The load-bearing mechanism is a U-Net encoder-decoder trigger generator trained with three objectives: a distance loss ($\ell_2$ and LPIPS) to keep the trigger invisible, a recovery loss that requires a small decoder to recover the passcode string from the poisoned image (this makes the trigger usable only with the correct passcode), and, for the clean-label scenario, a suppression loss that uses a pre-trained surrogate deepfake detector to force poisoned samples to be classified as the opposite label. Auxiliary samples with random passcodes are added to the poisoned set so the detector learns to associate only the correct passcode with the target label. This machinery turns a generic backdoor into a secret, sample-specific, keyed trigger.

What would settle it

Train the same detectors on the same poisoned dataset after running a standard poison filter such as activation clustering or spectral signature; if the attack success rate falls to near chance, the central claim that ordinary training on contaminated third-party data installs the backdoor collapses.

Watch

Extended reading notes

Core claim

The central claim is that deepfake detectors, despite their accuracy, are vulnerable to a training-phase backdoor attack that does not require any access to the detector's architecture, weights, or training procedure. By injecting a small poisoned set into a third-party dataset, an attacker can install a trigger that forces misclassification to a target label. The paper's specific contribution is a trigger generator that makes the injected pattern passcode-controlled (the trigger only activates when the correct binary passcode is embedded), adaptive (each image gets its own subtle pattern), invisible to the eye, and, in the clean-label setting, representation-suppressing—using a surrogate detector to push poisoned faces toward the opposite class so that the association between trigger and target label becomes learnable even when the label is unchanged. Experiments across four base models and four published detectors show high attack success while original accuracy is preserved, and the trigger survives standard backdoor defenses.

Load-bearing premise

The attack assumes the victim trains on the poisoned dataset with standard configurations and no data sanitization, and that the surrogate detector used to suppress representations transfers to the unknown victim detector.

Editorial extensions

If this is right

  • If third-party data is the training source, a malicious provider can install a permanent backdoor that survives standard training and even some fine-tuning and pruning defenses.
  • Passcode control means that even if the trigger generator is leaked, attackers without the passcode cannot reproduce a working trigger, so defensive random trigger probing fails.
  • The attack works in both dirty-label and clean-label forms; clean-label is more dangerous because the labels are consistent with the image content, making human inspection of the training set useless.
  • Because the trigger is adaptive and invisible, existing visual sanity checks and quality metrics (PSNR, SSIM, FID) do not reliably flag poisoned training samples.
  • The backdoor generalizes across datasets: a trigger generator trained on FaceForensics++ works on Celeb-DF and DFDC.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A cheap and possibly effective defense is suggested by the paper's own robustness data: applying mild Gaussian blur (radius around 11) before classification destroys the trigger's effect while degrading image quality little, so pre-processing could neutralize this attack class.
  • The representation-suppression trick may transfer to other binary forensic classifiers (e.g., image provenance or synthetic-text detection) that rely on third-party data, widening the attack surface beyond faces.
  • The reliance on a surrogate detector implies a testable bound: if the victim's internal representation cannot be suppressed by the chosen surrogate (e.g., an adversarially trained or self-supervised encoder), attack success should drop; measuring transfer across more diverse architectures would map the true threat scope.
  • If this attack model becomes accepted, dataset marketplaces will need to ship signed data or provide cryptographic provenance, since the trigger is invisible and survives defenses.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes a backdoor attack against deepfake detectors. The attacker is a third-party data provider who poisons training data with a trigger generator that produces invisible, sample-adaptive, passcode-controlled triggers. The authors consider dirty-label and clean-label poisoning scenarios, and claim high attack success rate with the correct passcode, near-zero success with wrong or similar passcodes, preserved benign accuracy, generalizability across datasets and architectures, and resistance to several backdoor defenses. Experiments are performed on FF++, Celeb-DF, and DFDC with four base networks (ResNet50, EfficientNet-b4, DenseNet, MobileNet) and four deepfake detectors (F3Net, SRM, NPR, FG), comparing against six backdoor attack baselines.

Significance. If the passcode-control property holds, the paper is a meaningful advance over PFF: it is the first to make trigger reproduction contingent on a secret even if the generator is exposed. The threat model is realistic and the experimental scope is broad, covering multiple datasets, architectures, and defense baselines. The paper also honestly discloses a limitation (blur fragility). However, the central claim is not yet fully supported because the passcode-control behavior is not tested without the auxiliary set Daux, leaving the novelty insufficiently isolated.

major comments (3)
  1. [§3.3, Sec. 4.2, Fig. 6] The passcode-controlled behavior is demonstrated only with Daux=50% (or other nonzero values in Fig. 6). No Daux=0 ablation is provided, so it is unclear whether the near-zero ASR for wrong passcodes in Tables 1-2 is intrinsic to the generator or learned by the victim from the 50% auxiliary-triggered samples. The text in §3.3 says Daux is included to 'better associate the triggers with the passcode,' which suggests the property is not intrinsic. This is load-bearing for the abstract and §3.2 claim that 'valid triggers cannot be produced without knowing the specific passcode.' Additionally, the reported poison rate counts only Ds (10% of one class), while 50% of the same class is altered with auxiliary triggers, so the true fraction of altered training data is 60% of that class; the low-prevalence goal in §3.1(d) is therefore not measured as claimed.
  2. [§4.2, Tables 1-8, Fig. 8] All experiments are reported as single numbers with no standard deviations across seeds. Since the paper's central claim is empirical superiority over baselines, the absence of variance estimates makes it impossible to assess whether differences such as Ours 96.62% vs. Blended 95.81% in Table 5 are significant. Please report mean±std over at least three independent training runs, or justify why the observed differences are robust.
  3. [§4.3, Fig. 7] The trigger's ASR falls to near zero under Gaussian blur with radius 11. The paper dismisses blur as unlikely in practice, but blur is a standard image operation and a simple defense. This conflicts with the 'Trigger sustainability' goal in §3.1 and the 'practicality' claim in the conclusion. Please provide a more quantitative discussion of the operational scenarios where blur would or would not be applied, or soften the sustainability claim.
minor comments (5)
  1. [Sec. 4.1] Sec. 4.1 states 'The poison rate is set to 5%' with a footnote that 10% of one class is poisoned in the main experiment. This is contradictory; clarify the exact poison rate used in each experiment.
  2. [Sec. 4.1 and Sec. 4.2] Sec. 4.1 says the input passcode is a 100-bit binary string, but Sec. 4.2 uses examples like '123' and '124'. Explain how string passcodes are encoded into the 100-bit representation.
  3. [References] References [36] and [37] are the same paper (Qian et al., 'Thinking in frequency'); merge them.
  4. [Availability] No code or trained models are released, which limits reproducibility of the attack. Please consider releasing code or a detailed pseudocode of the trigger generator and poisoning pipeline.
  5. [Table 5] In Table 5, the average row is computed over four detectors (ResNet, EfficientNet, F3Net, SRM), but the paper also evaluates MobileNet, DenseNet, NPR, FG elsewhere. Clarify why only four are used for comparison with baselines.

Circularity Check

1 steps flagged · score 6.0 of 10

Passcode-control is partly trained in: the low p'_α ASR is measured on D_aux samples that were included in victim training with true labels, not on an independent prediction.

  1. fitted input called prediction [Sec. 3.3, Sec. 4.2, Table 1/2 captions, and Fig. 6 (D_aux construction and p'_α evaluation)]
    "p′ α indicates a randomly selected passcode in Daux. ... The inclusion of Daux allows Deepfake detectors to better associate the triggers with the passcode. ... Specifically, 10% of real images are poisoned as Ds and assigned with fake labels. 50% of the real images are set as Daux. ... During the testing phase, we also used 10 different p′ α ... The results show that the ASR is high when using the correct passcode, but if the passcode is incorrect—even if similar to the correct one—the backdoor cannot be activated."

    The p'_α results are not an independent test of passcode-control: D_aux is explicitly constructed by adding triggers with random passcodes (excluding p) while keeping true labels, and D_aux is inserted into D'_train (Fig. 3). The victim detector is therefore trained to output the true label for exactly those p'_α-triggered samples, so near-zero p'_α ASR is the training objective itself, not an emergent property of the trigger generator's passcode binding. The paper presents this near-zero ASR as evidence of 'resistance to reproduction' / passcode control, but it is built into the training set. No D_aux=0 ablation is reported (Fig. 6 varies D_aux from 20% to 70%), so the generator's independent contribution to passcode-control is unmeasured.

full rationale

The paper is otherwise an empirical attack with clean train/test separation: the trigger generator is trained with L_dis/L_rec/L_sup, the victim detector is trained on D'_train, and the main p-ASR is measured on triggered samples not used to train the victim detector, while BA is measured on benign samples. Those results are not circular. The one significant circular element is the passcode-controlled claim. The p'_α column in Tables 1-2 evaluates triggers that were deliberately placed in D'_train with true labels, so the low attack success for those passcodes is partly trained in rather than predicted; the paper's own Sec. 3.3 says D_aux is what allows the detector to 'better associate the triggers with the passcode.' Because D_aux is never ablated to 0, the claim that the generator alone prevents trigger reproduction is not independently established. Self-citations (e.g., Celeb-DF, ISSBA) appear as datasets/baselines and are not load-bearing for the central derivation. Overall, the attack effectiveness and benign-accuracy results are self-contained, but a central advertised property (passcode control) partially reduces by construction, giving a score of 6.

Assumptions & free parameters 6 free parameters · 4 assumptions · 0 invented entities

The attack introduces no new physical or ontological entities. The 'trigger' is a perturbation bounded by distance losses, and the 'passcode' is a binary string embedded and recovered by a decoder. All other dependencies are standard learning assumptions or manually chosen hyperparameters.

free parameters (6)
  • lambda_dis = 2
    Weight for distance loss in trigger generation, chosen manually (Sec. 4.1).
  • lambda_rec = 1.5
    Weight for passcode recovery loss, chosen manually (Sec. 4.1).
  • lambda_sup = 1
    Weight for representation-suppression objective, chosen manually (Sec. 4.1).
  • Poison rate = 10% D_s as 5% of training set in main experiments
    Portion of training data poisoned; authors test 0-20% and select 5% as effective.
  • Daux scale = 50%
    Portion of samples with auxiliary passcodes, chosen after ablating 20-70% (Sec. 4.3).
  • Surrogate detector F = ResNet
    Chosen after comparing ResNet and EfficientNet transferability (Table 7).
assumptions (4)
  • domain assumption Deep neural networks trained on poisoned datasets can learn hidden backdoor associations that survive standard training.
    This is the basis of the entire attack, established by prior backdoor literature and assumed rather than re-derived here (Sec. 1).
  • domain assumption Third-party data providers can modify training data without being detected.
    Threat model in Sec. 3.1, required for the poisoning scenario to be realistic.
  • domain assumption The victim detector is trained with standard configurations and does not perform explicit data sanitization.
    The attack only works if poisoned samples are retained; the paper tests some defenses but not robust training that filters outliers.
  • domain assumption A surrogate deepfake detector F provides a transferable proxy for victim detectors' decision boundaries in representation suppression.
    The clean-label trigger generation relies on F to push poisoned images toward the opposite label, and transferability is shown only empirically (Table 7).

how reviews work

0 comments
Cite this review

Pith. "Pith review of Where the Devil Hides: Deepfake Detectors Can No Longer Be Trusted." pith.science (2026). https://pith.science/paper/67IM3CRW

@misc{pith2026250508255,
  author       = {Pith},
  title        = {Pith review of: Where the Devil Hides: Deepfake Detectors Can No Longer Be Trusted},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/67IM3CRW}},
  note         = {Machine review of arXiv:2505.08255}
}
read the original abstract

With the advancement of AI generative techniques, Deepfake faces have become incredibly realistic and nearly indistinguishable to the human eye. To counter this, Deepfake detectors have been developed as reliable tools for assessing face authenticity. These detectors are typically developed on Deep Neural Networks (DNNs) and trained using third-party datasets. However, this protocol raises a new security risk that can seriously undermine the trustfulness of Deepfake detectors: Once the third-party data providers insert poisoned (corrupted) data maliciously, Deepfake detectors trained on these datasets will be injected ``backdoors'' that cause abnormal behavior when presented with samples containing specific triggers. This is a practical concern, as third-party providers may distribute or sell these triggers to malicious users, allowing them to manipulate detector performance and escape accountability. This paper investigates this risk in depth and describes a solution to stealthily infect Deepfake detectors. Specifically, we develop a trigger generator, that can synthesize passcode-controlled, semantic-suppression, adaptive, and invisible trigger patterns, ensuring both the stealthiness and effectiveness of these triggers. Then we discuss two poisoning scenarios, dirty-label poisoning and clean-label poisoning, to accomplish the injection of backdoors. Extensive experiments demonstrate the effectiveness, stealthiness, and practicality of our method compared to several baselines.

Figures

Figures reproduced from arXiv: 2505.08255 by the authors.

Figure 1
Figure 1. Overview of the security risk: Deepfake detectors face [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Overview of the training of trigger generator. Note that [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Illustration of passcode-controlled dirty-label poisoning and passcode-controlled clean-label poisoning. [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: Visual comparison with visible trigger methods. [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 7
Figure 7. Figure 7: ASR under varying degrees of Gaussian blur, Gaussian [PITH_FULL_IMAGE:figures/full_fig_p007_7.png]
Figure 6
Figure 6. Figure 6: Various Scale of Daux. ResNet as our F in the main experiments. Various Scale of Daux. To accomplish the passcode￾controlled attack, we require a set of Daux together with the poisoned set Dp. This part studies whether the scale of Daux affects the performance of our m…
Figure 8
Figure 8. Figure 8: Performance under different poisoning ratios in the clean-label scenario. [PITH_FULL_IMAGE:figures/full_fig_p008_8.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

51 extracted references · 36 canonical work pages

  1. [1]

    Samer Hussain Al-Khazraji, Hassan Hadi Saleh, Adil Ibrahim KHALID, and Israa Adnan MISHKHAL. Impact of deepfake technology on social media: Detection, misinformation and societal implications.The Eurasia Proceedings of Science Technology Engineering and Mathematics, 23:429–441, 2023. 2

    work page 2023

  2. [2]

    A new backdoor attack in cnns by training set corruption without label poisoning

    Mauro Barni, Kassem Kallas, and Benedetta Tondi. A new backdoor attack in cnns by training set corruption without label poisoning. In2019 IEEE International Conference on Image Processing (ICIP), pages 101–105. IEEE, 2019. 2, 5, 6

    work page 2019

  3. [3]

    Evading deepfake-image detectors with white-and black-box attacks

    Nicholas Carlini and Hany Farid. Evading deepfake-image detectors with white-and black-box attacks. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition workshops, pages 658–659, 2020. 2

    work page 2020

  4. [4]

    Targeted backdoor attacks on deep learning systems using data poisoning.arXiv preprint arXiv:1712.05526,

    Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning.arXiv preprint arXiv:1712.05526,

    arXiv

  5. [5]

    Deepfakes and the new disinformation war: The coming age of post-truth geopoli- tics.Foreign Aff., 98:147, 2019

    Robert Chesney and Danielle Citron. Deepfakes and the new disinformation war: The coming age of post-truth geopoli- tics.Foreign Aff., 98:147, 2019. 1

    work page 2019

  6. [6]

    Five pitfalls when assessing synthetic med- ical images with reference metrics

    Melanie Dohmen, Tuan Truong, Ivo M Baltruschat, and Matthias Lenga. Five pitfalls when assessing synthetic med- ical images with reference metrics. InMICCAI Workshop on Deep Generative Models, pages 150–159. Springer, 2024. 6

    work page 2024

  7. [7]

    The deepfake detection challenge (dfdc) dataset.arXiv preprint arXiv:2006.07397, 2020

    Brian Dolhansky, Joanna Bitton, Ben Pflaum, Jikuo Lu, Russ Howes, Menglin Wang, and Cristian Canton Ferrer. The deepfake detection challenge (dfdc) dataset.arXiv preprint arXiv:2006.07397, 2020. 2, 4

    arXiv 2006

  8. [8]

    Leveraging fre- quency analysis for deep fake image recognition

    Joel Frank, Thorsten Eisenhofer, Lea Sch ¨onherr, Asja Fis- cher, Dorothea Kolossa, and Thorsten Holz. Leveraging fre- quency analysis for deep fake image recognition. InInter- national conference on machine learning, pages 3247–3258. PMLR, 2020. 2

    work page 2020

Show all 51 references
  1. [9]

    Are deepfakes concerning? analyzing conversations of deepfakes on reddit and exploring societal implications

    Dilrukshi Gamage, Piyush Ghasiya, Vamshi Bonagiri, Mark E Whiting, and Kazutoshi Sasahara. Are deepfakes concerning? analyzing conversations of deepfakes on reddit and exploring societal implications. InProceedings of the 2022 CHI Conference on Human Factors in Computing Sys- ...

    2022

  2. [10]

    Privacy and security concerns in generative ai: A compre- hensive survey.IEEE Access, 2024

    Abenezer Golda, Kidus Mekonen, Amit Pandey, Anushka Singh, Vikas Hassija, Vinay Chamola, and Biplab Sikdar. Privacy and security concerns in generative ai: A compre- hensive survey.IEEE Access, 2024. 1

    2024

  3. [11]

    Explaining and harnessing adversarial examples.arXiv preprint arXiv:1412.6572, 2014

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples.arXiv preprint arXiv:1412.6572, 2014. 2

    2014 arXiv

  4. [12]

    Bad- nets: Identifying vulnerabilities in the machine learning model supply chain.arXiv preprint arXiv:1708.06733, 2017

    Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. Bad- nets: Identifying vulnerabilities in the machine learning model supply chain.arXiv preprint arXiv:1708.06733, 2017. 2, 5, 6

    2017 arXiv

  5. [13]

    Controllable guide-space for generalizable face forgery detection

    Ying Guo, Cheng Zhen, and Pengfei Yan. Controllable guide-space for generalizable face forgery detection. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 20818–20827, 2023. 1, 2

    2023

  6. [14]

    The social im- pact of deepfakes, 2021

    Jeffrey T Hancock and Jeremy N Bailenson. The social im- pact of deepfakes, 2021. 2

    2021

  7. [15]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. InProceed- ings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016. 2, 4, 5, 6, 7

    2016

  8. [16]

    Evading deepfake detectors via adversarial statistical consistency

    Yang Hou, Qing Guo, Yihao Huang, Xiaofei Xie, Lei Ma, and Jianjun Zhao. Evading deepfake detectors via adversarial statistical consistency. InProceedings of the IEEE/CVF Con- ference on Computer Vision and Pattern Recognition, pages 12271–12280, 2023. 2

    2023

  9. [17]

    Mobilenets: Efficient convolutional neu- ral networks for mobile vision applications.arXiv preprint arXiv:1704.04861, 2017

    Andrew G Howard. Mobilenets: Efficient convolutional neu- ral networks for mobile vision applications.arXiv preprint arXiv:1704.04861, 2017. 2, 4, 5, 6, 7

    2017 arXiv

  10. [18]

    Densely connected convolutional net- works

    Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kil- ian Q Weinberger. Densely connected convolutional net- works. InProceedings of the IEEE conference on computer vision and pattern recognition, pages 4700–4708, 2017. 2, 4, 5, 6, 7

    2017

  11. [19]

    Fakeretouch: Evading deepfakes detection via the guidance of deliberate noise.arXiv preprint arXiv:2009.09213, 1(2), 2020

    Yihao Huang, Felix Juefei-Xu, Qing Guo, Xiaofei Xie, Lei Ma, Weikai Miao, Yang Liu, and Geguang Pu. Fakeretouch: Evading deepfakes detection via the guidance of deliberate noise.arXiv preprint arXiv:2009.09213, 1(2), 2020. 2

    2009 arXiv

  12. [20]

    Deepvi- sion: Deepfakes detection using human eye blinking pattern

    Tackhyun Jung, Sangwon Kim, and Keecheon Kim. Deepvi- sion: Deepfakes detection using human eye blinking pattern. IEEE Access, 8:83144–83154, 2020. 2

    2020

  13. [21]

    Deepfakes in fi- nance: Unraveling the threat landscape and detection chal- lenges

    Rizwan Khan, Mohd Taqi, and Atif Afzal. Deepfakes in fi- nance: Unraveling the threat landscape and detection chal- lenges. InNavigating the World of Deepfake Technology, pages 91–120. IGI Global, 2024. 1

    2024

  14. [22]

    Overcoming catastrophic forgetting in neu- ral networks.Proceedings of the national academy of sci- ences, 114(13):3521–3526, 2017

    James Kirkpatrick, Razvan Pascanu, Neil Rabinowitz, Joel Veness, Guillaume Desjardins, Andrei A Rusu, Kieran Milan, John Quan, Tiago Ramalho, Agnieszka Grabska- Barwinska, et al. Overcoming catastrophic forgetting in neu- ral networks.Proceedings of the national academy of sci...

    2017

  15. [23]

    Face x-ray for more gen- eral face forgery detection

    Lingzhi Li, Jianmin Bao, Ting Zhang, Hao Yang, Dong Chen, Fang Wen, and Baining Guo. Face x-ray for more gen- eral face forgery detection. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition (CVPR), pages 5001–5010, 2020. 2

    2020

  16. [24]

    Exposing deepfake videos by detecting face warping artifacts

    Yuezun Li and Siwei Lyu. Exposing deepfake videos by detecting face warping artifacts. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) Workshops, 2019. 1, 2

    2019

  17. [25]

    Celeb-df: A large-scale challenging dataset for deep- fake forensics

    Yuezun Li, Xin Yang, Pu Sun, Honggang Qi, and Siwei Lyu. Celeb-df: A large-scale challenging dataset for deep- fake forensics. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 3207– 3216, 2020. 1, 2, 4

    2020

  18. [26]

    Invisible backdoor attack with sample- specific triggers

    Yuezun Li, Yiming Li, Baoyuan Wu, Longkang Li, Ran He, and Siwei Lyu. Invisible backdoor attack with sample- specific triggers. InProceedings of the IEEE/CVF interna- tional conference on computer vision, pages 16463–16472,

  19. [27]

    Anti-backdoor learning: Training clean models on poisoned data.Advances in Neural Information Processing Systems, 34:14900–14912, 2021

    Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Anti-backdoor learning: Training clean models on poisoned data.Advances in Neural Information Processing Systems, 34:14900–14912, 2021. 7, 8

    2021

  20. [28]

    Neural attention distillation: Erasing backdoor triggers from deep neural networks.arXiv preprint arXiv:2101.05930, 2021

    Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Neural attention distillation: Erasing backdoor triggers from deep neural networks.arXiv preprint arXiv:2101.05930, 2021. 7, 8

    2021 arXiv

  21. [29]

    Poisoned forgery face: Towards backdoor attacks on face forgery detection.arXiv preprint arXiv:2402.11473, 2024

    Jiawei Liang, Siyuan Liang, Aishan Liu, Xiaojun Jia, Junhao Kuang, and Xiaochun Cao. Poisoned forgery face: Towards backdoor attacks on face forgery detection.arXiv preprint arXiv:2402.11473, 2024. 2, 5, 6

    2024 arXiv

  22. [30]

    Preserving fairness generalization in deepfake detection

    Li Lin, Xinan He, Yan Ju, Xin Wang, Feng Ding, and Shu Hu. Preserving fairness generalization in deepfake detection. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 16815–16825, 2024. 4, 5, 6

    2024

  23. [31]

    Forgery-aware adaptive transformer for generalizable synthetic image detection

    Huan Liu, Zichang Tan, Chuangchuang Tan, Yunchao Wei, Jingdong Wang, and Yao Zhao. Forgery-aware adaptive transformer for generalizable synthetic image detection. In Proceedings of the IEEE/CVF Conference on Computer Vi- sion and Pattern Recognition, pages 10770–10780, 2024. 1, 2

    2024

  24. [32]

    Fine- pruning: Defending against backdooring attacks on deep neural networks

    Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Fine- pruning: Defending against backdooring attacks on deep neural networks. InInternational symposium on research in attacks, intrusions, and defenses, pages 273–294. Springer,

  25. [33]

    Gener- alizing face forgery detection with high-frequency features

    Yuchen Luo, Yong Zhang, Junchi Yan, and Wei Liu. Gener- alizing face forgery detection with high-frequency features. InProceedings of the IEEE/CVF conference on computer vi- sion and pattern recognition, pages 16317–16326, 2021. 4, 5, 6

    2021

  26. [34]

    Pytorch: An im- perative style, high-performance deep learning library.Ad- vances in neural information processing systems, 2019

    Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, et al. Pytorch: An im- perative style, high-performance deep learning library.Ad- vances in neural information processing systems, 2019. 4

    2019

  27. [35]

    Deeprhythm: Ex- posing deepfakes with attentional visual heartbeat rhythms

    Hua Qi, Qing Guo, Felix Juefei-Xu, Xiaofei Xie, Lei Ma, Wei Feng, Yang Liu, and Jianjun Zhao. Deeprhythm: Ex- posing deepfakes with attentional visual heartbeat rhythms. InProceedings of the 28th ACM international conference on multimedia, pages 4318–4327, 2020. 1, 2

    2020

  28. [36]

    Thinking in frequency: Face forgery detection by min- ing frequency-aware clues

    Yuyang Qian, Guojun Yin, Lu Sheng, Zixuan Chen, and Jing Shao. Thinking in frequency: Face forgery detection by min- ing frequency-aware clues. InEuropean conference on com- puter vision, pages 86–103. Springer, 2020. 4, 5, 6

    2020

  29. [37]

    Thinking in frequency: Face forgery detection by min- ing frequency-aware clues

    Yuyang Qian, Guojun Yin, Lu Sheng, Zixuan Chen, and Jing Shao. Thinking in frequency: Face forgery detection by min- ing frequency-aware clues. InEuropean conference on com- puter vision, pages 86–103. Springer, 2020. 2

    2020

  30. [38]

    U- net: Convolutional networks for biomedical image segmen- tation

    Olaf Ronneberger, Philipp Fischer, and Thomas Brox. U- net: Convolutional networks for biomedical image segmen- tation. InMedical image computing and computer-assisted intervention–MICCAI 2015: 18th international conference, Munich, Germany, October 5-9, 2015, proceedings, par...

    2015

  31. [39]

    Faceforen- sics++: Learning to detect manipulated facial images

    Andreas Rossler, Davide Cozzolino, Luisa Verdoliva, Chris- tian Riess, Justus Thies, and Matthias Nießner. Faceforen- sics++: Learning to detect manipulated facial images. In Proceedings of the IEEE/CVF international conference on computer vision, pages 1–11, 2019. 1, 2, 4

    2019

  32. [40]

    Detecting deep- fakes with self-blended images

    Kaede Shiohara and Toshihiko Yamasaki. Detecting deep- fakes with self-blended images. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 18720–18729, 2022. 1, 2

    2022

  33. [41]

    Intriguing properties of neural networks.arXiv preprint arXiv:1312.6199, 2013

    C Szegedy. Intriguing properties of neural networks.arXiv preprint arXiv:1312.6199, 2013. 2

    2013 arXiv

  34. [42]

    Rethinking the up-sampling op- erations in cnn-based generative network for generalizable deepfake detection

    Chuangchuang Tan, Yao Zhao, Shikui Wei, Guanghua Gu, Ping Liu, and Yunchao Wei. Rethinking the up-sampling op- erations in cnn-based generative network for generalizable deepfake detection. InProceedings of the IEEE/CVF Con- ference on Computer Vision and Pattern Recognition, ...

    2024

  35. [43]

    Efficientnet: Rethinking model scaling for convolutional neural networks

    Mingxing Tan and Quoc Le. Efficientnet: Rethinking model scaling for convolutional neural networks. InInternational conference on machine learning, pages 6105–6114. PMLR,

  36. [44]

    Stegastamp: Invisible hyperlinks in physical photographs

    Matthew Tancik, Ben Mildenhall, and Ren Ng. Stegastamp: Invisible hyperlinks in physical photographs. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 2117–2126, 2020. 3

    2020

  37. [45]

    Label-consistent backdoor attacks.arXiv preprint arXiv:1912.02771, 2019

    Alexander Turner, Dimitris Tsipras, and Aleksander Madry. Label-consistent backdoor attacks.arXiv preprint arXiv:1912.02771, 2019. 2, 5, 6

    1912 arXiv

  38. [46]

    Deepfake detection: A comprehensive sur- vey from the reliability perspective.ACM Comput

    Tianyi Wang, Xin Liao, Kam Pui Chow, Xiaodong Lin, and Yinglong Wang. Deepfake detection: A comprehensive sur- vey from the reliability perspective.ACM Comput. Surv., 57 (3), 2024. 2

    2024

  39. [47]

    Backdoor- bench: A comprehensive benchmark of backdoor learning

    Baoyuan Wu, Hongrui Chen, Mingda Zhang, Zihao Zhu, Shaokui Wei, Danni Yuan, and Chao Shen. Backdoor- bench: A comprehensive benchmark of backdoor learning. Advances in Neural Information Processing Systems, 35: 10546–10559, 2022. 8

    2022

  40. [48]

    Transcending forgery specificity with latent space augmentation for generalizable deepfake detection

    Zhiyuan Yan, Yuhao Luo, Siwei Lyu, Qingshan Liu, and Baoyuan Wu. Transcending forgery specificity with latent space augmentation for generalizable deepfake detection. In Proceedings of the IEEE/CVF Conference on Computer Vi- sion and Pattern Recognition, pages 8984–8994, 2024. 1, 2

    2024

  41. [49]

    Exposing deep fakes using inconsistent head poses

    Xin Yang, Yuezun Li, and Siwei Lyu. Exposing deep fakes using inconsistent head poses. InICASSP 2019-2019 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 8261–8265. IEEE, 2019. 2

    2019

  42. [50]

    The unreasonable effectiveness of deep features as a perceptual metric

    Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shecht- man, and Oliver Wang. The unreasonable effectiveness of deep features as a perceptual metric. InProceedings of the IEEE conference on computer vision and pattern recogni- tion, pages 586–595, 2018. 3

    2018

  43. [51]

    Learning self-consistency for deepfake detection

    Tianchen Zhao, Xiang Xu, Mingze Xu, Hui Ding, Yuanjun Xiong, and Wei Xia. Learning self-consistency for deepfake detection. InProceedings of the IEEE/CVF international conference on computer vision (ICCV), pages 15023–15033,

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.