Robust deepfake detection in the wild remains challenging due to the ever-growing variety of manipulation techniques and uncontrolled real-world degradations. Forensic cues for deepfake detection reside at two complementary levels: global-level anomalies in semantics and statistics that require holistic image understanding, and local-level forgery traces concentrated in manipulated regions that are easily diluted by global averaging. Since no single backbone or input scale can effectively cover both levels, we propose LOGER, a LOcal--Global Ensemble framework for Robust deepfake detection. The global branch employs heterogeneous vision foundation model backbones at multiple resolutions to capture holistic anomalies with diverse visual priors. The local branch performs patch-level modeling with a Multiple Instance Learning top-k aggregation strategy that selectively pools only the most suspicious regions, mitigating evidence dilution caused by the dominance of normal patches; dual-level supervision at both the aggregated image level and individual patch level keeps local responses discriminative. Because the two branches differ in both granularity and backbone, their errors are largely decorrelated, a property that logit-space fusion exploits for more robust prediction. LOGER achieves 2nd place in the NTIRE 2026 Robust Deepfake Detection Challenge, and further evaluation on multiple public benchmarks confirms its strong robustness and generalization across diverse manipulation methods and real-world degradation conditions.
Figures & tables
Figure 1: Overview of the proposed LOGER framework. Training data are sampled from a multi-source candidate pool with diverse degradation augmentation. The global branch performs full-image detection using DINOv3-H (M1, M2) and MetaCLIP2-H (M3) at multiple resolutions. The local branch employs DINOv3-L (M4, M5) with patch-level modeling and top-10% MIL pooling. All outputs are fused via logit-space averaging with test-time augmentation.
Method
AUC
Method
AUC
GPT-5.2
0.43
DDA [ 4 ]
0.49
Claude Sonnet 4.5
0.44
MIRROR [ 33 ]
0.59
Gemini 3 Pro
0.56
Effort [ 56 ]
0.65
CLIP-ViT-L [ 40 ]
0.66
Reality Defender [ 41 ]
0.70
Qwen3-VL-2B [ 1 ]
0.73
GenD [ 62 ]
0.74
ConvNeXt-L [ 34 ]
0.75
LOGER (Ours)
0.92
Table 4: Comparison with representative methods on the NTIRE 2026 validation set (image-level AUC).
Configuration
AUC
(a) DINOv3-H (Global)
Baseline (official data only)
0.5601
+ External data (ED)
0.7714
+ Focal Loss (FL)
0.7882
+ Degradation augmentation (DG)
0.8464
+ Flip TTA (M1)
0.8515
Table 5: Per-model ablation on the NTIRE 2026 competition validation set. Each group shows progressive training enhancements for one backbone.
Configuration
AUC
(a) Global branch
M1 (DINOv3-H, 256)
0.8674
M2 (DINOv3-H, 384)
0.8684
M3 (MetaCLIP2-H, 378)
0.8465
M1+M2+M3
0.8812
(b) Local branch
Table 6: Ablation study on ensemble composition and fusion strategy on the NTIRE 2026 public test set. All results are image-level AUC.
Method
ID
CM
CF
CD
Avg.
Small vision models
D 3 [ 61 ]
87.3
93.6
73.7
73.1
81.1
Effort [ 56 ]
94.7
82.8
88.0
67.1
82.2
Co-SPY [ 6 ]
86.3
93.5
87.3
74.7
84.7
MLLM-based detectors
SIDA-7B [ 22 ]
–
76.0
63.3
69.9
76.3
Table 7: Accuracy (%) on the HydraFake benchmark following the hierarchical evaluation protocol of Veritas [ 47 ] . All methods are trained on the HydraFake training set. ID: In-Domain, CM: Cross-Model, CF: Cross-Forgery, CD: Cross-Domain.
Figure 2: Robustness analysis under three degradation types: JPEG compression (left), spatial resizing (middle), and Gaussian blurring (right). AUC (%) is computed over 1,000 videos sampled from five cross-dataset benchmarks.
Figure 3: Representative failure cases on the NTIRE 2026 public test set. Top: false negatives (fake → real). Bottom: false positives (real → fake).