Pith. sign in

REVIEW 3 major objections 4 minor 56 references

Practical Manipulation Model for Robust Deepfake Detection

T0 review · 3 major / 4 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A training-data recipe keeps deepfake detectors accurate on degraded images, lifting AUC by up to 6.21\% on hard benchmarks.

desk verdict Genuinely useful data-augmentation recipe for robust deepfake detection, but the headline DFDCP gain is selected on that test set; DFDC and the robustness results carry the paper. read the letter →

arxiv 2506.05119 v1 pith:DV3CV3DT submitted 2025-06-05 cs.CV

Benedikt Hopf , Radu Timofte This is my paper
classification cs.CV
keywords deepfakedetectionself-blendedimagesimagedegradationrobustnessdataaugmentationpseudo-fakegenerationPoissonblendinggeneratorartifactscross-datasetgeneralization
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Deepfake detectors trained on clean, whole-face swaps collapse when the image is noisy, blurry, or compressed, which is precisely the condition a malicious faker would manufacture. This paper argues that the fix is in the training data: it proposes PMM, a recipe for generating pseudo-fakes that covers far more of the real-world forgery space by mixing degradations, Poisson blending, partial-face masks, distractors, and artifacts from real generators. Trained on these images, the LAA detector gains 3.51\% AUC on DFDC and 6.21\% AUC on DFDCP over the same architecture trained the standard way, and keeps detecting fakes at noise and blur levels that drop the baseline to chance. The cost is a measured drop on the high-quality Celeb-DF-v2 set, a trade the paper presents as deliberate: robustness to low-quality media in exchange for some high-quality specialization.

What carries the argument

The carrying object is the Practical Manipulation Model (PMM), a data-generation pipeline that modifies the self-blended images (SBI) recipe, the pseudo-fakes built by blending a transformed copy of a face back onto itself as $I = M\cdot S + (1-M)\cdot T$ for source $S$, target $T$, and mask $M$, at every stage. Four additions carry the argument: (1) a random-order degradation model covering blur, resize, correlated and uncorrelated Gaussian noise, speckle or Poisson noise, JPEG compression, and brightness or contrast changes, applied with probability $p$ so clean and damaged images are both seen; (2) a blending step that can choose Poisson blending instead of $\alpha$ blending and semantic part masks instead of whole-face masks; (3) distractors, random text and image patches that mimic real overlays found in datasets like DFDC; and (4) cached generator artifacts, where Stable Diffusion img2img at strength 0.01 and StyleFeatureEditor at strength 0 rewrite each training image once, injecting the fingerprints of real generators into pseudo-fakes that normally have none. The load-bearing idea is to treat degradations and generator artifacts as part of the fake generation space rather than as test-time nuisances.

What would settle it

Train the PMM pipeline twice, once with and once without the generator-artifact branch, and compare on a clean-image benchmark whose fakes come from a generator never used in training; if the two detectors score the same, the claim that cached low-strength artifacts generalize to unseen generators is falsified. A complementary check is a frequency-domain or feature-space distance between the cached artifact images and actual test-set fakes, since the paper provides no independent measure that the two artifact distributions match.

Watch

Extended reading notes

Core claim

On the paper's own terms, a detector that learns from self-blended images has a blind spot: its pseudo-fakes are whole-face, clean, and free of generator fingerprints, so at test time it relies on cues that real-world manipulation and simple degradation destroy. PMM closes this blind spot by widening every stage of the pseudo-fake pipeline: the blend can be $\alpha$ or Poisson, the mask can cover a whole face or one semantic region such as jaw, cheek, nose, or eye, overlays and text can sit on the image, and the source or target can carry artifacts from Stable Diffusion img2img at denoising strength 0.01 or from the StyleFeatureEditor GAN at edit strength 0. A degradation model then damages the finished pseudo-fake with blur, resize, three kinds of Gaussian noise, speckle or Poisson noise, JPEG compression, and brightness or contrast shifts, applied in random order with probability 50\% and strength 0.5, so clean and degraded images appear in the same batch. The paper's central results are that this recipe keeps the LAA detector above 0.86 AUC at Gaussian noise $\sigma = 15$ where the baseline falls to 0.49, and that it generalizes even to degradation types absent from training, such as motion blur. The claim is that a single data-side change achieves both robustness and better cross-dataset benchmarks, requiring no architectural modification.

Load-bearing premise

The load-bearing premise is that low-strength artifacts from Stable Diffusion img2img and StyleFeatureEditor, cached once per training image, stand in for the artifacts of the unseen face generators in DFDC, DFDCP, and CDFv2; if those artifact distributions do not actually match, the generator-artifact gains in the ablations would not transfer to the test sets, and the benchmark improvements would rest on the blending and degradation changes alone.

Editorial extensions

If this is right

  • Training on PMM pseudo-fakes makes the LAA detector robust: at Gaussian noise $\sigma = 15$ the baseline drops to 0.49 AUC while LAA+PMM stays above 0.86, and at $\sigma = 60$ the PMM models still exceed 0.76 AUC where baselines are at chance.
  • Benchmark gains follow without touching the architecture: +3.51\% AUC on DFDC and +6.21\% AUC on DFDCP over the LAA backbone, with similar gains on EfficientNet-B4 (+6.36\% on DFDC) and Xception (+2.11\% average).
  • The robustness transfers to degradation types never seen during training: motion blur, which is absent from the training degradation list, still yields +6.8\% AUC over LAA at kernel size 60, and leave-one-out variants beat the baseline on held-out degradations.
  • The added robustness comes at a measured cost on the high-quality Celeb-DF-v2 set (0.9153 versus 0.9540 AUC for LAA), a trade-off the paper attributes to model capacity spent on low-quality cues.
  • Because PMM changes only the data preparation, it can be attached to any deepfake detector backbone without modifying the model itself.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The cached-artifact design, one rewrite per training image, is the main self-imposed limit; generating fresh, variable-strength artifacts at training time would likely strengthen the effect, since the paper already shows artifacts generalize across unseen generators despite the one-shot cache.
  • The supplementary recognizability metric, where a face-identity model keeps about 67\% accuracy under PMM degradations, suggests the degradation budget is calibrated to stay human-parseable; pushing strength past that boundary would reveal whether robustness is bought at the price of detecting images humans can no longer verify.
  • The paper lists adversarial attacks as an uncovered threat; since PMM is purely a data-side change, it could in principle be stacked with adversarial training to address both degradation-based and attack-based evasion, an extension the paper does not explore.
  • The large robustness gaps on noise and blur imply that standard cross-dataset benchmarks under-report failure risk, so a robust-evaluation protocol that includes degradations would be a natural follow-on standard for the field.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes Practical Manipulation Model (PMM), a training-data generation strategy for face forgery detectors. It extends self-blended images (SBI) by adding a random-order degradation model (Gaussian/non-Gaussian noise, blur, resize, JPEG compression, enhancement, and distractors), additional semantic masks, Poisson blending, and cached generator artifacts produced by Stable Diffusion img2img and StyleFeatureEditor. Using LAA, EfficientNet-B4, and Xception backbones trained on FaceForensics++, the authors report improved cross-dataset AUC on DFDCP and DFDC, substantially improved robustness to degradations in in-dataset FF++ tests, and a modest loss on Celeb-DF-v2, which they acknowledge as a limitation.

Significance. The data-generation contribution is practical and timely: it is applicable to several backbones, is described in sufficient detail to be reproduced, and the paper explicitly provides code. The robustness experiments are a genuine strength, especially the leave-one-out degradation training and the motion-blur generalization test, which go beyond the exact augmentations used at training time. If the benchmark numbers hold after a proper evaluation protocol, the method would be a useful drop-in augmentation for pseudo-fake-based detectors. However, the headline DFDCP result is currently confounded by model selection on that same dataset, so the +6.21% claim is not yet an unbiased held-out estimate; the DFDC result is the cleaner evidence for cross-dataset gains.

major comments (3)
  1. [4.3/Table 2 vs 4.2/Table 1] The DFDCP benchmark result is not a held-out estimate because the final model is selected on DFDCP. Section 4.3 states that Variant 6 is chosen as the final model based on the average of Plain and Low-Quality AUC on DFDCP (0.9258 vs 0.9212), and Section 4.2 then reports the same DFDCP Plain value, 0.9315, as a cross-dataset improvement of +6.21% over LAA. This number is effectively the best of six variants on the dataset used to advertise the gain, so selection bias inflates it; no confidence intervals, multiple seeds, or an outer validation split are provided. The DFDC result (+3.51%) is cleaner because DFDC is explicitly reserved as an unseen test set in Section 4.1. Please re-estimate the DFDCP gain under a nested selection protocol, or present the claim primarily on DFDC and treat DFDCP as a validation-set result.
  2. [Tables 1 and 2] The LAA baseline used for the claimed DFDCP gain is inconsistent between the two tables. Table 2, Variant 1 reports LAA at 0.8413 AUC on Plain DFDCP, while Table 1 reports LAA at 0.8694 on DFDCP. The +6.21% improvement in Table 1 is computed against 0.8694 (0.9315 - 0.8694 = 0.0621), whereas the ablation comparison in Table 2 uses 0.8413 as the baseline. Since the Table 1 DFDCP value is not marked as an own-run result, while the Table 2 value is an own-run baseline, the two comparisons use different protocols. Please state which values are official numbers versus own runs and recompute all claimed gains against a single consistent own-run baseline.
  3. [3.2] The generator-artifact component is presented as a key contribution, but the proxy assumption behind it is not independently validated. Section 3.2 caches artifacts from Stable Diffusion img2img at denoising strength 0.01 and from StyleFeatureEditor with edit strength 0, treating them as representative of artifacts of the generators in the test datasets (DFDC, DFDCP, CDFv2). No evidence is given that these cached artifacts resemble the test-set generators' artifacts; the only support is the end-task AUC improvement, which is the very claim the component is introduced to explain. Please add a control experiment or an artifact-similarity measurement, e.g., replacing the two cached generators with different ones and checking whether the ablation gain persists, so the contribution does not rest solely on the benchmark numbers.
minor comments (4)
  1. [Table 1] The rows with missing entries in Table 1 have an 'Average' column computed over different test-set subsets; the caption should explicitly state that these averages are not directly comparable across methods.
  2. [3.1] The Gaussian noise paragraph says the noise is applied either with l1=2, l2=100 or l1=80, l2=100, but then states both cases are independently applied with probability p/2. The word 'either' is misleading and should be rephrased to describe two independent sampling regimes.
  3. [3.2 and Supplementary D] The per-generator probability p_g=25% is defined only in the supplementary material; the main text should state that each of the two generators is used in 25% of images, because 'with probability p_g' is ambiguous about whether p_g is per-generator or joint.
  4. [4.2] The statement that the average improves by approximately 2% AUC should specify whether this is a simple average or a weighted average over the three benchmark datasets, since the datasets have different sizes and difficulty.

Circularity Check

1 steps flagged · score 6.0 of 10

DFDCP headline gain is selected in-sample: variant 6 is chosen on DFDCP and the same DFDCP AUC is then reported as the benchmark improvement.

  1. fitted input called prediction [Section 4.3 (Ablation study), Table 2; Section 4.2 (Comparison to the state-of-the-art), Table 1; Section 4.1 (Experimental settings)]
    "Balancing between Plain and Low-Quality settings, we choose variant 6 as our final model. It achieves the best average AUC of 0.9258, compared to 0.9212 of variant 4."

    The final model is not a held-out configuration for DFDCP. Table 2 is explicitly an ablation on DFDCP, and the authors select variant 6 by balancing Plain and Low-Quality AUC on that dataset; variant 6's Plain DFDCP AUC is 0.9315. In Table 1, the same 0.9315 appears as the LAA+PMM DFDCP benchmark, and Section 4.2 advertises a +6.21% gain over LAA. Thus the headline DFDCP number is the selection criterion used to pick the model, i.e., an in-sample maximum over six variants rather than an independent estimate; expected-maximum inflation makes the stated gain optimistic. The DFDC +3.51% result is genuinely held out, but the DFDCP half of the central claim reduces to selection on the reporting dataset. Additionally, the two tables use different LAA baselines (0.8413 in Table 2 vs.

full rationale

The methodological core of the paper is an empirical data-generation pipeline, not a derivation that algebraically reduces to its inputs. The DFDC benchmark is explicitly reserved as an unseen test set, and the robustness analysis includes leave-one-out training and motion blur, which were not in the training degradation set; these parts have independent content. The main circular element is the DFDCP evaluation protocol: the final model variant is chosen on DFDCP, and the same DFDCP AUC is then reported as a headline cross-dataset gain. That is a fitted-input-called-prediction pattern for the DFDCP number, making the +6.21% claim in-sample and optimistic. The paper's only relevant self-citation, Zhang et al. [46] (which includes an author of this paper), is not load-bearing: it is used as an external degradation model, and the paper explicitly reports that direct use of [46] gives poor results on DFDCP. No uniqueness theorem, ansatz, or definitional equivalence is smuggled in. Because one of the two headline predictions reduces to selection on the reporting dataset while the other remains genuinely held out, the appropriate finding is partial circularity rather than full circularity.

Assumptions & free parameters 5 free parameters · 3 assumptions · 0 invented entities

The method adds five tunable hyperparameters and three domain assumptions to the SBI baseline. No new entities are postulated. The assumptions are standard for data-augmentation-based deepfake detection but are not independently established.

free parameters (5)
  • degradation probability p = 0.5
    Probability of applying each degradation during training; chosen by testing, stated in Supplementary Sec. D.
  • degradation strength s = 0.5
    Scales blur/noise levels; chosen by testing, stated in Supplementary Sec. D.
  • Poisson blending probability p_p = 0.5
    Probability of using Poisson blending instead of alpha blending; stated in Supplementary Sec. D.
  • distractor probability p_d = 0.2
    Probability of adding a distractor (text or image overlay); stated in Supplementary Sec. C.2.
  • generator artifact probability p_g = 0.25
    Probability per generator (Stable Diffusion, StyleFeatureEditor GAN) of using cached artifacts; stated in Supplementary Sec. D.
assumptions (3)
  • domain assumption Self-blended images created from unmanipulated real images are a sufficient proxy for real deepfakes for detector training.
    Inherited from SBI [36]; the paper extends this framework without re-validating the core proxy assumption. Central to the method.
  • domain assumption Training with random-order strong degradations improves robustness to unseen degradations without making the detection task impossible.
    The paper's main mechanism; they provide empirical evidence (recognizability metric, motion blur generalization) but the principle is assumed.
  • ad hoc to paper Cached generator artifacts from Stable Diffusion and StyleFeatureEditor at very low editing strengths approximate artifacts of the test-set generators.
    Introduced in Sec. 3.2; the paper argues for cross-generator generalization based on the DFDCP/DFDC results, but the proxy validity is not directly verified.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Practical Manipulation Model for Robust Deepfake Detection." pith.science (2026). https://pith.science/paper/DV3CV3DT

@misc{pith2026250605119,
  author       = {Pith},
  title        = {Pith review of: Practical Manipulation Model for Robust Deepfake Detection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/DV3CV3DT}},
  note         = {Machine review of arXiv:2506.05119}
}
abstract

Modern deepfake detection models have achieved strong performance even on the challenging cross-dataset task. However, detection performance under non-ideal conditions remains very unstable, limiting success on some benchmark datasets and making it easy to circumvent detection. Inspired by the move to a more real-world degradation model in the area of image super-resolution, we have developed a Practical Manipulation Model (PMM) that covers a larger set of possible forgeries. We extend the space of pseudo-fakes by using Poisson blending, more diverse masks, generator artifacts, and distractors. Additionally, we improve the detectors' generality and robustness by adding strong degradations to the training images. We demonstrate that these changes not only significantly enhance the model's robustness to common image degradations but also improve performance on standard benchmark datasets. Specifically, we show clear increases of $3.51\%$ and $6.21\%$ AUC on the DFDC and DFDCP datasets, respectively, over the s-o-t-a LAA backbone. Furthermore, we highlight the lack of robustness in previous detectors and our improvements in this regard. Code can be found at https://github.com/BenediktHopf/PMM

Figures

Figures reproduced from arXiv: 2506.05119 by the authors.

Figure 1
Figure 1. Our method performs robustly on ‘in the wild’ im￾ages: A real image [28] from the assassination attempt on Donald Trump and a corresponding altered / fake image [13] with faked smiles. Note that the fake image has not been altered by us but is available online like this. Our method works well whereas the s-o-t-a LAA [29] method fails to detect the deepfake. two types of deepfakes: (i) non-deceiving deepfakes, often … view at source ↗
Figure 2
Figure 2. Examples of our training images compared to the ones from LAA [29]. Our images are much harder to detect due to their strong augmentations. The original images are taken from the FaceForensics++ dataset [33]. on an image for some unrelated reason. However, this prop￾erty of deepfake detectors could also be used maliciously to circumvent detection. Adding a little bit of noise might have a similar effect to an advers… view at source ↗
Figure 3
Figure 3. Overview of our proposed Practical Manipulation Model (PMM). Our model extends the self-blending from [36] by consid￾ering generator artifacts, Poisson blending, additional masks, and degradations, all denoted as purple elements and underlined. Random choices can take any path. Dashed lines indicate paths not taken in the example. randomly sampled from Uniform(0, 30·s), and the an￾gle from Uniform(0, π). 2. The f sp… view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Robustness to image degradations of s-o-t-a deep￾fake detectors LAA [29] and SBI (EfficientNet and Xception back￾bones) [36] vs. ours, tested on the test-split of FF++ [33]. Note that for the low-quality settings, our methods consistently out￾perform the s-o-t-a. In pa…
Figure 5
Figure 5. Figure 5: Donald Trump’s face swapped onto Boris Johnson [ [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

56 extracted references · 40 canonical work pages

  1. [1]

    Mesonet: a compact facial video forgery detection network.2018 IEEE International Workshop on Information Forensics and Security (WIFS), pages 1–7, 2018

    Darius Afchar, Vincent Nozick, Junichi Yamagishi, and Isao Echizen. Mesonet: a compact facial video forgery detection network.2018 IEEE International Workshop on Information Forensics and Security (WIFS), pages 1–7, 2018. 1

    work page 2018

  2. [2]

    Who inadvertently shares deepfakes? an- alyzing the role of political interest, cognitive ability, and social network size.Telematics and Informatics, 57:101508,

    Saifuddin Ahmed. Who inadvertently shares deepfakes? an- alyzing the role of political interest, cognitive ability, and social network size.Telematics and Informatics, 57:101508,

    work page

  3. [3]

    The devil is in the details: Stylefeatureeditor for detail-rich stylegan inversion and high quality image editing,

    Denis Bobkov, Vadim Titov, Aibek Alanov, and Dmitry Vetrov. The devil is in the details: Stylefeatureeditor for detail-rich stylegan inversion and high quality image editing,

  4. [4]

    G. Bradski. The OpenCV Library.Dr. Dobb’s Journal of Software Tools, 2000. 4

    2000

  5. [5]

    End-to-end reconstruction- classification learning for face forgery detection

    Junyi Cao, Chao Ma, Taiping Yao, Shen Chen, Shouhong Ding, and Xiaokang Yang. End-to-end reconstruction- classification learning for face forgery detection. InProceed- ings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 4113–4122, 2022. 2, 3, 5, 6, 15

    work page 2022

  6. [6]

    Xception: Deep learning with depthwise separable convolutions.2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 1800–1807,

    Franc ¸ois Chollet. Xception: Deep learning with depthwise separable convolutions.2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 1800–1807,

    work page 2017

  7. [7]

    Pillow (pil fork) documentation, 2015

    Alex Clark. Pillow (pil fork) documentation, 2015. 4

    2015

  8. [8]

    Forensictrans- fer: Weakly-supervised domain adaptation for forgery detec- tion.ArXiv, abs/1812.02510, 2018

    Davide Cozzolino, Justus Thies, Andreas R ¨ossler, Christian Riess, Matthias Nießner, and Luisa Verdoliva. Forensictrans- fer: Weakly-supervised domain adaptation for forgery detec- tion.ArXiv, abs/1812.02510, 2018. 1

    arXiv 2018

Show all 56 references
  1. [9]

    deepfakes faceswap.https://github

    Deepfakes. deepfakes faceswap.https://github. com/deepfakes/faceswap, 2019. 5, 13

    2019

  2. [10]

    The deepfake detection chal- lenge (dfdc) preview dataset.ArXiv, abs/1910.08854, 2019

    Brian Dolhansky, Russ Howes, Ben Pflaum, Nicole Baram, and Cristian Canton-Ferrer. The deepfake detection chal- lenge (dfdc) preview dataset.ArXiv, abs/1910.08854, 2019. 2, 3, 5, 6, 7

    1910 arXiv

  3. [11]

    The deepfake detection challenge dataset.ArXiv, abs/2006.07397, 2020

    Brian Dolhansky, Joanna Bitton, Ben Pflaum, Jikuo Lu, Russ Howes, Menglin Wang, and Cristian Canton- Ferrer. The deepfake detection challenge dataset.ArXiv, abs/2006.07397, 2020. 2, 3, 4, 5, 6

    2006 arXiv

  4. [12]

    Donald trump with boris johnson’s haircut

    faceman. Donald trump with boris johnson’s haircut. https://faceswaponline.com/donald-trump- with- boris- johnsons- haircut, 2020. date ac- cessed: 2024-11-07. 8

    2020

  5. [13]

    How ai tools fueled online conspiracy theo- ries after trump assassination attempt.https://dfrlab

    Beatriz Farrugia. How ai tools fueled online conspiracy theo- ries after trump assassination attempt.https://dfrlab. org / 2024 / 08 / 23 / how - ai - tools - fueled - online- conspiracy- theories- after- trump- assassination - attempt/, 2024. date accessed: 2024-11-07. 1, 11

    2024

  6. [14]

    Controllable guide-space for generalizable face forgery detection.2023 IEEE/CVF International Conference on Computer Vision (ICCV), pages 20761–20770, 2023

    Yingjie Guo, Cheng Zhen, and Pengfei Yan. Controllable guide-space for generalizable face forgery detection.2023 IEEE/CVF International Conference on Computer Vision (ICCV), pages 20761–20770, 2023. 2, 5, 6

    2023

  7. [15]

    The social im- pact of deepfakes, 2021

    Jeffrey T Hancock and Jeremy N Bailenson. The social im- pact of deepfakes, 2021. 1

    2021

  8. [16]

    Fsbi: Deepfakes detection with frequency en- hanced self-blended images.ArXiv, abs/2406.08625, 2024

    Ahmed Abul Hasanaath, Hamzah Luqman, Raed Katib, and Saeed Anwar. Fsbi: Deepfakes detection with frequency en- hanced self-blended images.ArXiv, abs/2406.08625, 2024. 2

    2024 arXiv

  9. [17]

    Beyond the spectrum: Detecting deepfakes via re-synthesis.ArXiv, abs/2105.14376, 2021

    Yang He, Ning Yu, Margret Keuper, and Mario Fritz. Beyond the spectrum: Detecting deepfakes via re-synthesis.ArXiv, abs/2105.14376, 2021. 2

    2021 arXiv

  10. [18]

    Deepvi- sion: Deepfakes detection using human eye blinking pattern

    Tack hyun Jung, Sangwon Kim, and Keecheon Kim. Deepvi- sion: Deepfakes detection using human eye blinking pattern. IEEE Access, 8:83144–83154, 2020. 1

    2020

  11. [19]

    Faceswap.https://github.com/ MarekKowalski/FaceSwap, 2018

    Marek Kowalski. Faceswap.https://github.com/ MarekKowalski/FaceSwap, 2018. 5, 13

    2018

  12. [20]

    Seeable: Soft discrepancies and bounded contrastive learning for exposing deepfakes.2023 IEEE/CVF International Conference on Computer Vision (ICCV), pages 20954–20964, 2022

    Nicolas Larue, Ngoc-Son Vu, Vitomir Struc, Peter Peer, and Vassilis Christophides. Seeable: Soft discrepancies and bounded contrastive learning for exposing deepfakes.2023 IEEE/CVF International Conference on Computer Vision (ICCV), pages 20954–20964, 2022. 2, 5, 6

    2023

  13. [21]

    Face x-ray for more general face forgery detection.2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 5000–5009, 2019

    Lingzhi Li, Jianmin Bao, Ting Zhang, Hao Yang, Dong Chen, Fang Wen, and Baining Guo. Face x-ray for more general face forgery detection.2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 5000–5009, 2019. 1, 2, 5, 6

    2020

  14. [22]

    Celeb-df: A large-scale challenging dataset for deep- fake forensics.2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 3204–3213,

    Yuezun Li, Xin Yang, Pu Sun, Honggang Qi, and Siwei Lyu. Celeb-df: A large-scale challenging dataset for deep- fake forensics.2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 3204–3213,

    2020

  15. [23]

    Honggu Liu, Xiaodan Li, Wenbo Zhou, Yuefeng Chen, Yuan He, Hui Xue, Weiming Zhang, and Nenghai Yu. Spatial- phase shallow learning: Rethinking face forgery detection in frequency domain.2021 IEEE/CVF Conference on Com- puter Vision and Pattern Recognition (CVPR), pages 772– 78...

    2021

  16. [24]

    A new approach to im- prove learning-based deepfake detection in realistic condi- tions, 2022

    Yuhang Lu and Touradj Ebrahimi. A new approach to im- prove learning-based deepfake detection in realistic condi- tions, 2022. 2, 3, 4

    2022

  17. [25]

    Assessment frame- work for deepfake detection in real-world situations.ArXiv, abs/2304.06125, 2023

    Yuhang Lu and Touradj Ebrahimi. Assessment frame- work for deepfake detection in real-world situations.ArXiv, abs/2304.06125, 2023. 2, 3, 4

    2023 arXiv

  18. [26]

    Gener- alizing face forgery detection with high-frequency features

    Yucheng Luo, Yong Zhang, Junchi Yan, and Wei Liu. Gener- alizing face forgery detection with high-frequency features. 2021 IEEE/CVF Conference on Computer Vision and Pat- tern Recognition (CVPR), pages 16312–16321, 2021. 2

    2021

  19. [27]

    Two- branch recurrent network for isolating deepfakes in videos

    Iacopo Masi, Aditya Killekar, Royston Marian Mascaren- has, Shenoy Pratik Gurudatt, and Wael AbdAlmageed. Two- branch recurrent network for isolating deepfakes in videos. ArXiv, abs/2008.03412, 2020. 2

    2008 arXiv

  20. [28]

    Fbi names shooter after trump as- sassination attempt.https://www.moreechampion

    moreechampion.com.au. Fbi names shooter after trump as- sassination attempt.https://www.moreechampion. com.au/story/8694792/fbi- names- shooter- after- trump- assassination- attempt/, 2024. date accessed: 2024-11-07. 1, 11

    2024

  21. [29]

    Laa-net: Localized artifact attention network for quality-agnostic and generalizable deepfake de- tection

    Dat Nguyen, Nesryne Mejri, Inder Pal Singh, Polina Kuleshova, Marcella Astrid, Anis Kacem, Enjie Ghorbel, and Djamila Aouada. Laa-net: Localized artifact attention network for quality-agnostic and generalizable deepfake de- tection. InProceedings of the IEEE/CVF Conference on ...

    2024

  22. [30]

    Poisson image editing.ACM SIGGRAPH 2003 Papers, 2003

    Patrick P ´erez, Michel Gangnet, and Andrew Blake. Poisson image editing.ACM SIGGRAPH 2003 Papers, 2003. 5

    2003

  23. [31]

    Thinking in frequency: Face forgery detection by min- ing frequency-aware clues.ArXiv, abs/2007.09355, 2020

    Yuyang Qian, Guojun Yin, Lu Sheng, Zixuan Chen, and Jing Shao. Thinking in frequency: Face forgery detection by min- ing frequency-aware clues.ArXiv, abs/2007.09355, 2020. 2

    2007 arXiv

  24. [32]

    High-resolution image syn- thesis with latent diffusion models, 2021

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bj¨orn Ommer. High-resolution image syn- thesis with latent diffusion models, 2021. 5

    2021

  25. [33]

    FaceForen- sics++: Learning to detect manipulated facial images

    Andreas R ¨ossler, Davide Cozzolino, Luisa Verdoliva, Chris- tian Riess, Justus Thies, and Matthias Nießner. FaceForen- sics++: Learning to detect manipulated facial images. In International Conference on Computer Vision (ICCV), 2019. 1, 2, 3, 5, 6, 7, 11, 12, 13, 14, 15

    2019

  26. [34]

    Natarajan

    Ekraam Sabir, Jiaxin Cheng, Ayush Jaiswal, Wael AbdAl- mageed, Iacopo Masi, and P. Natarajan. Recurrent convolu- tional strategies for face manipulation detection in videos. In CVPR Workshops, 2019. 1

    2019

  27. [35]

    Selvaraju, Abhishek Das, Ramakrishna Vedantam, Michael Cogswell, Devi Parikh, and Dhruv Ba- tra

    Ramprasaath R. Selvaraju, Abhishek Das, Ramakrishna Vedantam, Michael Cogswell, Devi Parikh, and Dhruv Ba- tra. Grad-cam: Visual explanations from deep networks via gradient-based localization.International Journal of Com- puter Vision, 128:336 – 359, 2016. 5, 11, 15

    2016

  28. [36]

    Yamasaki

    Kaede Shiohara and T. Yamasaki. Detecting deepfakes with self-blended images.2022 IEEE/CVF Conference on Com- puter Vision and Pattern Recognition (CVPR), pages 18699– 18708, 2022. 1, 2, 3, 4, 5, 6, 7, 12, 13, 14, 15

    2022

  29. [37]

    Erhan, Ian J

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, D. Erhan, Ian J. Goodfellow, and Rob Fergus. Intrigu- ing properties of neural networks.CoRR, abs/1312.6199,

    arXiv

  30. [38]

    Mingxing Tan and Quoc V . Le. Efficientnet: Rethinking model scaling for convolutional neural networks.ArXiv, abs/1905.11946, 2019. 3, 5, 6, 7, 13, 14, 15

    1905 arXiv

  31. [39]

    Face2face: Real-time face capture and reenactment of rgb videos.2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 2387–2395, 2016

    Justus Thies, Michael Zollh ¨ofer, Marc Stamminger, Chris- tian Theobalt, and Matthias Nießner. Face2face: Real-time face capture and reenactment of rgb videos.2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 2387–2395, 2016. 5, 13

    2016

  32. [40]

    De- ferred neural rendering.ACM Transactions on Graphics (TOG), 38:1 – 12, 2019

    Justus Thies, Michael Zollh ¨ofer, and Matthias Nießner. De- ferred neural rendering.ACM Transactions on Graphics (TOG), 38:1 – 12, 2019. 5, 13

    2019

  33. [41]

    Sheng-Yu Wang, Oliver Wang, Richard Zhang, Andrew Owens, and Alexei A. Efros. Cnn-generated images are sur- prisingly easy to spot. . . for now.2020 IEEE/CVF Confer- ence on Computer Vision and Pattern Recognition (CVPR), pages 8692–8701, 2019. 2

    2020

  34. [42]

    Transcending forgery specificity with latent space augmentation for generalizable deepfake detection

    Zhiyuan Yan, Yuhao Luo, Siwei Lyu, Qingshan Liu, and Baoyuan Wu. Transcending forgery specificity with latent space augmentation for generalizable deepfake detection. 2024 IEEE/CVF Conference on Computer Vision and Pat- tern Recognition (CVPR), pages 8984–8994, 2023. 2, 3, 5, 6, 15

    2024

  35. [43]

    Ucf: Uncovering common features for generalizable deep- fake detection.2023 IEEE/CVF International Conference on Computer Vision (ICCV), pages 22355–22366, 2023

    Zhiyuan Yan, Yong Zhang, Yanbo Fan, and Baoyuan Wu. Ucf: Uncovering common features for generalizable deep- fake detection.2023 IEEE/CVF International Conference on Computer Vision (ICCV), pages 22355–22366, 2023. 2, 5, 6

    2023

  36. [44]

    Deepfakebench: A comprehensive benchmark of deepfake detection.ArXiv, abs/2307.01426, 2023

    Zhi Yan, Yong Zhang, Xinhang Yuan, Siwei Lyu, and Baoyuan Wu. Deepfakebench: A comprehensive benchmark of deepfake detection.ArXiv, abs/2307.01426, 2023. 2, 3, 5, 6

    2023 arXiv

  37. [45]

    Df40: Toward next-generation deepfake detection.arXiv preprint arXiv:2406.13495, 2024

    Zhiyuan Yan, Taiping Yao, Shen Chen, Yandan Zhao, Xinghe Fu, Junwei Zhu, Donghao Luo, Li Yuan, Chengjie Wang, Shouhong Ding, et al. Df40: Toward next-generation deepfake detection.arXiv preprint arXiv:2406.13495, 2024. 6, 8, 15

    2024 arXiv

  38. [46]

    Zhang, Jingyun Liang, Luc Van Gool, and Radu Timofte

    K. Zhang, Jingyun Liang, Luc Van Gool, and Radu Timofte. Designing a practical degradation model for deep blind im- age super-resolution.2021 IEEE/CVF International Confer- ence on Computer Vision (ICCV), pages 4771–4780, 2021. 2, 3, 4, 6, 7

    2021

  39. [47]

    Learning self-consistency for deep- fake detection.2021 IEEE/CVF International Conference on Computer Vision (ICCV), pages 15003–15013, 2020

    Tianchen Zhao, Xiang Xu, Mingze Xu, Hui Ding, Yuanjun Xiong, and Wei Xia. Learning self-consistency for deep- fake detection.2021 IEEE/CVF International Conference on Computer Vision (ICCV), pages 15003–15013, 2020. 2

    2021

  40. [48]

    Uia-vit: Unsupervised inconsistency-aware method based on vision transformer for face forgery detection.ArXiv, abs/2210.12752, 2022

    Wanyi Zhuang, Qi Chu, Zhentao Tan, Qiankun Liu, Hao- jie Yuan, Changtao Miao, Zixiang Luo, and Nenghai Yu. Uia-vit: Unsupervised inconsistency-aware method based on vision transformer for face forgery detection.ArXiv, abs/2210.12752, 2022. 2, 5, 6 10 Practical Manipulation Mod...

    arXiv

  41. [49]

    The text itself is a concatenation ofn∼Uniform(0,10) randomly selected characters, chosen from the list of all printable characters

  42. [50]

    Positions outside of the image region result in the text being partially visible

    The text is placed at position (lower left cor- ner)x∼Uniform(−100,WIDTH)andy∼ Uniform(0, HEIGHT+ 100). Positions outside of the image region result in the text being partially visible

  43. [51]

    Font face is uniformly chosen from{0, ...,7}

  44. [52]

    Font scale is chosen fromUniform(0,8)

  45. [53]

    Color is uniformly chosen from{0, ...,255} 3

  46. [54]

    Line thickness is uniformly chosen from{1,2, ...,8}

  47. [55]

    Line type is uniformly chosen from{0,1,2}. D. Details on the ablation study Table A shows examples of the types of images our model sees while training each of the ablation study variants. The images are selected to show the change of each variant (where possible), so the dist...

  48. [56]

    All images are taken from the Celeb- DF-v2 dataset [22]

    and our model. All images are taken from the Celeb- DF-v2 dataset [22]. Figure Ca shows a failure case for LAA. Despite the image being sourced from the high-quality Celeb-DF-v2 dataset, the image is slightly blurry. LAA fails to recognize the image as fake, whereas ours can r...

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.