Chapter 4 of 1214 min read

Deep Learning and Multimodal Approaches to Deepfake Detection

What detectors actually learn, why benchmark scores do not survive contact with unfamiliar content, and the arithmetic that decides whether a good detector is useful to you.

The model that won did not win

The Deepfake Detection Challenge, run on a purpose-built dataset published by Dolhansky and colleagues in 2020, is the most useful experiment the detection field has produced, and not for the reason it was designed. Entrants were scored on a public validation set and then on a private black-box set of organic videos they had never seen. The best public score was an average precision of 82.56 per cent. The best black-box score was 65.18 per cent, achieved by a model that had ranked fourth on the public set. C4.02 Established

Read that twice. The public leaderboard did not merely overstate performance. It put the models in the wrong order. A practitioner choosing a detector on published benchmark numbers would have chosen a worse one, and would have had no way to know.

This chapter is a technical account of how these systems work, written to explain that result rather than to explain it away. Detection is a real research field with real progress in it, and the previous three chapters have argued that institutions over-rely on it. Both things are true, and the reason they are both true becomes clear once you look at what the signal a detector exploits is actually a signal of.

Learning objectives

Describe the main families of deepfake detector and identify the signal each one exploits.
Explain why in-distribution accuracy and cross-generator accuracy diverge, in terms of what the model has fitted.
Order detector families along the distance between their signal and a specific generator, and state the trade-off this creates.
Compute the precision of a detector at a realistic prevalence, and explain why published accuracy figures are insufficient for a deployment decision.
Specify what to require from a detection vendor instead of a benchmark score.
Identify the conditions under which detection is genuinely the right control.

What a detector is fitted to

Nearly all published visual detectors are binary classifiers over cropped faces or short face-tracked clips. The architecture varies; the learning problem usually does not. A model is shown authentic and manipulated examples and learns whatever feature best separates them in that collection. The question that decides operational value is therefore not how accurate the model is, but what the separating feature turns out to be.

The reference training collection for most of the field is FaceForensics++, published by Rössler and colleagues at ICCV 2019: 1,000 authentic videos from YouTube and 4,000 manipulated versions produced by four methods, two of which change identity, by face swapping, and two of which change expression, by reenactment. C4.01 Established It is a good dataset and it was an enormous contribution. It is also four synthesis pipelines, and a model trained on it can reach high accuracy by learning the characteristic residue of those four pipelines rather than anything about forgery as such.

That distinction is the whole chapter. A feature that identifies this generator is cheap to learn, scores extremely well on a test split drawn from the same generators, and has no reason whatever to survive a generator it has not seen. A feature that identifies a property of the synthesis process, or an inconsistency that any synthesis would have to produce, is harder to learn, scores lower in-distribution, and transfers better. The field’s history is largely a migration from the first kind of feature to the second.

Figure 4.1 — Detector families ordered by how far their signal sits from a particular generator. Moving right buys transfer and costs peak accuracy. Benchmarks reward the left-hand end; deployments need the right-hand end. The two trend lines indicate direction, not measured values. Source: author’s arrangement of the cited methods.

Close to the generator

The earliest effective detectors were ordinary image classifiers, often XceptionNet, applied to aligned face crops, and frequency-domain methods that examined the spectral signature left by the upsampling operations in a generator’s decoder. Both work well and both are, in effect, generator fingerprinting. Retrain the generator, change its upsampling, compress the video differently, and the fingerprint moves.

Away from the generator

Three later families deliberately avoid generator-specific residue. Blending-boundary methods target the composite seam that any face-swap pipeline has to produce when it inserts one region into another image, which is a property of the process rather than of a particular model. Temporal-semantic methods target motion that real speech constrains: LipForensics, published by Haliassos and colleagues at CVPR 2021, pretrains a spatio-temporal network on lipreading, then fine-tunes on fixed mouth embeddings, explicitly so that the classifier attaches to high-level mouth dynamics rather than to low-level manipulation artefacts. C4.04 Established Cross-modal methods go furthest, asking whether the audio and the visible articulation agree, which no single-modality generator is obliged to get right.

The direction of travel is sound and the reasoning behind it is correct. It is also, read honestly, an admission: the field moved away from its best-scoring features because those features were measuring the wrong thing.

The transfer gap, in numbers

Experiment	Familiar condition	Unfamiliar condition	What changed
DFDC Dolhansky et al., 2020	82.56% average precision, public validation set	65.18% average precision, private black-box set	Organic unseen videos. The black-box leader had placed fourth publicly.
Celeb-DF Li et al., CVPR 2020	82.3% mean frame-level AUC on the FaceForensics++ DeepFakes subset	56.9% mean frame-level AUC on Celeb-DF C4.03	A harder, higher-quality synthesis set, across the detection methods the paper evaluated.
LipForensics Haliassos et al., CVPR 2021	Reported as outperforming the compared methods on unseen manipulations and under distortion, by design, through a signal chosen to be generator-independent		Method design rather than a single headline figure; no number is asserted here.

Table 4.1 — Only published figures from the primary sources are reproduced, with the comparison each paper itself makes. No current state-of-the-art number is given; see limitations for why. Sources: claims C4.01 to C4.04.

The arithmetic nobody runs before purchase

Suppose you obtain a detector that is genuinely good on your content: 90 per cent sensitivity and 90 per cent specificity, which is better than the DFDC black-box result. Now deploy it where synthetic items are rare, which is the normal case for an institutional content pipeline. The quantity you care about is not accuracy; it is precision, the share of flagged items that are actually synthetic.

Precision at a given prevalence

precision = (sensitivity × p) ÷ [ (sensitivity × p) + ((1 − specificity) × (1 − p)) ]

At 90 per cent sensitivity and 90 per cent specificity: when one item in a hundred is synthetic, 8 per cent of flags are correct. When one in a thousand is, 0.9 per cent are. When one in ten thousand is, 0.09 per cent are, meaning 1,110 false accusations for every true one. Analysis C4.05

Figure 4.2 — Precision collapses with rarity, and an extra nine of specificity buys exactly one decade of prevalence. This is arithmetic, not measurement: it holds for any detector with these operating characteristics. It is also why a detector that is excellent in a laboratory can be unusable in a newsroom and valuable in a fraud funnel where attacks are concentrated. Source: author’s computation.

The false positive is not a neutral error

In most classification problems the two error types trade off against each other and the cost is a matter of taste. Here they are not symmetric. A false negative lets one forgery through. A false positive produces an institutional statement that authentic material is fabricated, which is the liar’s dividend from Chapter 2 manufactured by your own equipment and carrying your own name. An organisation that deploys a detector at scale without computing Figure 4.2 for its own prevalence is building a machine for discrediting real evidence.

Case study: the Deepfake Detection Challenge as a natural experiment

Case study 4.1 · documented, primary source

Design: A purpose-built dataset with a public validation set and a private black-box set of organic videos, so that entrants could be scored on both familiar and unfamiliar material
Headline result: Best public average precision 82.56%; best black-box average precision 65.18%
The finding that matters: The black-box leader had ranked fourth on the public set, so the public ranking was not merely optimistic but incorrectly ordered
Evidence status: Established primary challenge paper

Why no later benchmark has replaced it as evidence. Subsequent datasets are larger and harder, and published scores on them are higher. But very few experiments since have held back a genuinely unseen set and published the rank correlation between the two conditions. That second element is the contribution. Any benchmark can tell you a model is accurate on itself; this one told the field that its selection procedure was broken.

What it does not establish. It is one challenge, on one dataset, at one moment in the development of synthesis. The specific figures should not be quoted as current detector performance, and nothing here implies that detection has failed to improve since 2020. The durable finding is structural, not numerical: when the test distribution is drawn from the training generators, the leaderboard measures familiarity rather than capability.

Where detection genuinely is the right control

Three conditions, and detection earns its place when they hold together.

You control or can observe the generator set. A closed funnel, such as an identity-verification pipeline, concentrates attacks into a narrow set of techniques you can retrain against.
Prevalence is high enough for precision to be tolerable. Read it off Figure 4.2 before, not after, procurement.
The output feeds a process, not a verdict. Triage into human review is a sound use. Publishing the score as an adjudication is not.

Note that these are the conditions in a fraud-prevention funnel, and that they are almost exactly inverted in a newsroom or a courtroom.

Practical scenario

Illustrative scenario · not a documented incident

A newsroom receives roughly 2,000 pieces of user-submitted video a month. Historically about one a month has turned out to be synthetic. A vendor offers a detector independently measured at 92 per cent sensitivity and 97 per cent specificity on content resembling yours, which is a genuinely good result. The editor proposes that any flagged item be held and labelled “possible AI-generated content” pending review.

Compute: how many items the detector flags each month, how many of those are the one real synthetic submission, and therefore what the label would be attached to in the overwhelming majority of cases. Then decide what the detector should be allowed to do instead.

Executive implications

Never accept a benchmark score as a procurement input. Ask for results on generators held back from training, the rank order across both conditions, and the operating threshold with its calibration. A vendor who reports only AUC is reporting the one number DFDC showed to be misleading.
Compute your own prevalence first. Figure 4.2 is arithmetic and takes five minutes. It frequently ends the procurement.
Price the false positive explicitly. In this domain it is not a nuisance; it is self-inflicted reputational damage to authentic material.
Use detection as triage, never as adjudication. A score routes an item to a human. It does not settle anything, and it must never be quoted externally as a finding.
Expect to retrain, and budget for it. A detector is a perishable control whose shelf life is set by somebody else’s release schedule.

Common misconceptions

Misconception 1 · “A high benchmark score predicts field performance”

DFDC falsifies the stronger version of this directly. Not only did scores fall from 82.56 to 65.18 per cent average precision between the familiar and unfamiliar conditions, the ordering changed, so the benchmark could not even be relied on to identify the better model. Published accuracy describes the relationship between a model and a dataset, not a capability.

Misconception 2 · “Multimodal detection solves generalisation”

It improves transfer for a sound reason: cross-modal agreement is a constraint no single-modality generator is obliged to satisfy. But it is a trade rather than a solution. Moving the signal away from the generator lowers peak accuracy, and these methods require both modalities to exist, synchronised, with a visible speaking face. A great deal of hostile content is a still image, a voice-only call, or text, and no audio-visual method applies to any of it.

Misconception 3 · “99 per cent accurate means almost always right”

Only where synthetic items are common. At one in a thousand prevalence, a detector with 90 per cent sensitivity and 99 per cent specificity is wrong about more than nine flags in ten. Accuracy is a property of the model; usefulness is a property of the model and the base rate together, and only one of those appears in the marketing.

Limitations and open questions

No current state of the art is asserted. Leaderboards move faster than a book can, and the durable finding is the structure of the transfer gap rather than any peak figure. Quoting a 2026 number here would date the chapter and would also repeat the error it describes.
Benchmarks remain narrow. The standard datasets are face-centric, mostly derived from a small number of synthesis pipelines, and weighted toward video of talking people. Detection of synthetic documents, satellite imagery, scientific figures and screen recordings is comparatively unstudied.
Operational degradation is under-reported. Published evaluations use curated clips. Real submissions are recompressed, cropped, re-encoded, screen-recorded and passed through platforms that alter them. Robustness to that chain is rarely the headline measurement.
Calibration is almost never published. Without it, a threshold chosen on one distribution means something different on another, which makes the false-positive cost in Figure 4.2 unknowable in advance for most commercial systems.
Evasion is the subject of Chapter 7. Everything in this chapter assumes an attacker who is not specifically targeting your detector. That assumption is generous and is withdrawn later.

Teaching materials

Discussion questions

The DFDC black-box winner ranked fourth publicly. What does that imply about every published detector comparison that reports one test condition?
Why does moving the exploited signal away from the generator reduce peak accuracy? Is that reduction avoidable in principle?
At what prevalence would you accept a detector’s output as a reason to withhold publication? Defend the number.
Cross-modal detection needs a synchronised speaking face. What fraction of the content your organisation handles meets that condition?
If a detector is a perishable control, what does that imply for how it should be procured and budgeted?

Assessment questions

Derive precision from sensitivity, specificity and prevalence, and plot it for one detector at four prevalences. (10 marks)
Explain the transfer gap in terms of what the classifier has fitted, using FaceForensics++ as the example. (15 marks)
Write the detection section of a procurement specification. State what must be reported and why each item is necessary. (20 marks)

Practical exercise

Estimate the prevalence of synthetic items in one real content pipeline in your organisation. Most teams cannot do this, and discovering that you cannot is the finding: it means any detector you deploy there has an unknown precision.

Research assignment

Find a published detector evaluation that reports results on generators held back from training and gives the rank order across conditions. Report how many papers you had to read to find one.

Seminar topic

“Detection benchmarks have harmed the field by optimising for a metric that does not transfer.” Argue either side.

Chapter synthesis

Detection is a legitimate research field that has made real progress, and this chapter has tried to represent it accurately rather than convenient. Its central technical story is a migration: from features that identify a particular generator, which score superbly and transfer badly, toward features grounded in properties any synthesis must exhibit, which score less well and transfer better. That migration is the correct response to the problem, and it has a ceiling, because the further a signal sits from the generator the less of it there is to measure.

Two independent failures stand between a published score and an operational control. The first is distributional: DFDC showed not only that performance drops on unfamiliar material but that the ranking inverts, so the benchmark cannot even be trusted to choose between models. The second is arithmetical and has nothing to do with machine learning at all: at institutional prevalences, precision collapses, and the errors it produces are false accusations against authentic material, which is the specific harm Chapter 2 identified as the one detection cannot fix.

Against Figure 0.1 this settles the status of Layer 2. Detection is not a filter the other layers sit behind; it is an instrument with a narrow operating envelope, defined by whether you can observe the generator set, whether prevalence is high enough, and whether the output feeds a process rather than a verdict. Inside that envelope it is valuable, and Chapter 5 examines the audio case where the envelope is tighter still. Outside it, deploying detection does not reduce risk. It relocates it.