Organizations: CVI2, SnT, University of Luxembourg, Luxembourg · CRISTAL laboratory, ENSI, University of Manouba, Tunisia · SnT, University of Luxembourg, Luxembourg
In this paper, we propose Localized Artifact Attention X (LAA-X), a novel deepfake detection framework that is both robust to high-quality forgeries and capable of generalizing to unseen manipulations. Existing approaches typically rely on binary classifiers coupled with implicit attention mechanisms, which often fail to generalize beyond known manipulations. In contrast, LAA-X introduces an explicit attention strategy based on a multi-task learning framework combined with blending-based data synthesis. Auxiliary tasks are designed to guide the model toward localized, artifact-prone (i.e., vulnerable) regions. The proposed framework is compatible with both CNN and transformer backbones, resulting in two different versions, namely, LAA-Net and LAA-Former, respectively. Despite being trained only on real and pseudo-fake samples, LAA-X competes with state-of-the-art methods across multiple benchmarks. Code and pre-trained weights for LAA-Net\footnote{https://github.com/10Ring/LAA-Net} and LAA-Former\footnote{https://github.com/10Ring/LAA-Former} are publicly available.
Figures & tables
Fig. 1: Comparison of LAA-Net( \mathchoice{\mathbin{\vbox{\hbox{\scalebox{1.2}{\displaystyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\textstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptscriptstyle\bullet}}}}} ), LAA-Former( \mathchoice{\mathbin{\vbox{\hbox{\scalebox{1.2}{\displaystyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\textstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptscriptstyle\bullet}}}}} ), and LAA-Swin( \mathchoice{\mathbin{\vbox{\hbox{\scalebox{1.2}{\displaystyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\textstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptscriptstyle\bullet}}}}} ) with respect to existing methods, namely, Multi-attentional( \mathchoice{\mathbin{\vbox{\hbox{\scalebox{1.2}{\displaystyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\textstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptscriptstyle\bullet}}}}} ) [ 13 ] , SBI( \mathchoice{\mathbin{\vbox{\hbox{\scalebox{1.2}{\displaystyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\textstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptscriptstyle\bullet}}}}} ) [ 14 ] , Xception( \mathchoice{\mathbin{\vbox{\hbox{\scalebox{1.2}{\displaystyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\textstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptscriptstyle\bullet}}}}} ) [ 3 ] , RECCE( \mathchoice{\mathbin{\vbox{\hbox{\scalebox{1.2}{\displaystyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\textstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptscriptstyle\bullet}}}}} ) [ 15 ] , CADDM( \mathchoice{\mathbin{\vbox{\hbox{\scalebox{1.2}{\displaystyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\textstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptscriptstyle\bullet}}}}} ) [ 16 ] , FAViT( \mathchoice{\mathbin{\vbox{\hbox{\scalebox{1.2}{\displaystyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\textstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptscriptstyle\bullet}}}}} ) [ 17 ] , ForensicsAdapter( \mathchoice{\mathbin{\vbox{\hbox{\scalebox{1.2}{\displaystyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\textstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptscriptstyle\bullet}}}}} ) [ 18 ] using (a) the AUC performance with respect to different ranges of Mask-SSIM, and (b) its associated boxplots. *The results were obtained using the official source codes pretrained on FF+ [ 3 ] and testing on Celeb-DFv2 [ 19 ] . Figure best viewed in colors.
Fig. 2: Overview of the proposed LAA-X framework. LAA-X is a multi-task learning framework that incorporates an explicit attention mechanism to vulnerable regions through the integration of generic auxiliary tasks. This strategy enables LAA-X to adequately attend to fine-grained artifact-prone areas. Particularly, these additional tasks can be removed at inference, reducing computational cost at test time.
Fig. 3: Overview of the proposed LAA-Net approach. It is formed by two main components, namely, (1) an explicit attention mechanism based on a multi-task learning framework composed of three branches, i.e., the binary classification branch, the heatmap branch, and the self-consistency branch. The heatmap and self-consistency ground-truth data are generated based on the detected vulnerable points, and (2) an Enhanced Feature Pyramid Networks (E-FPN) that aggregates multi-scale features.
Figure 4
Fig. 6: Experiments to analyze the capability of transformer-based networks in deepfake detection. (a) Generalization performance comparison of baseline classifiers (ViT [ 29 ] +SBI [ 14 ] ( \mathchoice{\mathbin{\vbox{\hbox{\scalebox{1.2}{\displaystyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\textstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptscriptstyle\bullet}}}}} ), Swin [ 32 ] +SBI [ 14 ] ( \mathchoice{\mathbin{\vbox{\hbox{\scalebox{1.2}{\displaystyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\textstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptscriptstyle\bullet}}}}} )) with two specialized transformer-based (FAViT [ 17 ] ( \mathchoice{\mathbin{\vbox{\hbox{\scalebox{1.2}{\displaystyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\textstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptscriptstyle\bullet}}}}} ), ForensicsAdapter [ 18 ] ( \mathchoice{\mathbin{\vbox{\hbox{\scalebox{1.2}{\displaystyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\textstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptscriptstyle\bullet}}}}} )) and four CNN-based methods (LAA-Net [ 23 ] +SBI [ 14 ] ( \mathchoice{\mathbin{\vbox{\hbox{\scalebox{1.2}{\displaystyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\textstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptscriptstyle\bullet}}}}} ), CADDM [ 16 ] ( \mathchoice{\mathbin{\vbox{\hbox{\scalebox{1.2}{\displaystyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\textstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptscriptstyle\bullet}}}}} ), EfficientNet [ 25 ] +SBI [ 14 ] ( \mathchoice{\mathbin{\vbox{\hbox{\scalebox{1.2}{\displaystyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\textstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptscriptstyle\bullet}}}}} ), Xception [ 26 ] +SBI [ 14 ] ( \mathchoice{\mathbin{\vbox{\hbox{\scalebox{1.2}{\displaystyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\textstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptscriptstyle\bullet}}}}} )) across different ranges of Mask-SSIM [ 40 ] . All methods adopt FF++ [ 3 ] for the training and are tested cross-dataset on CDF2 [ 19 ] . More details are described in Section III-C1 . (b) Evolution of the training loss of ViT under different configurations (variation of input resolution and patch size), Xception and EfficientNet, across four types of deepfakes in FF++ [ 3 ] .
Fig. 7: Examples are randomly selected to illustrate four types of deepfakes in the common FF++ [ 3 ] dataset. It includes Deepfakes (DF) [ 80 ] , FaceSwap (FS) [ 81 ] , Face2Face (F2F) [ 82 ] , and NeuralTextures (NT) [ 83 ] .
Fig. 8: The proposed Transformer-based LAA-X method. (I) The overall LAA-Former framework, (II) the L2-Att module, and (III) the ground-truth generation of vulnerable patches.
Method
Venue
Training set
Test set
Real
Fake
FF++
CDF2
DFW
DFD
DFDCP
DFDC
AUC
AUC
AP
AUC
AP
AUC
AP
AUC
AP
AUC
AP
Xception ∗ [ 3 ]
ICCV’19
✓
✓
93.60
61.18
66.93
65.29
55.37
89.75
85.48
69.90
91.98
58.98
55.32
FaceXRay (w/ BI) [ 21 ]
CVPR’20
✓
✓
99.20
79.50
-
-
-
95.40
93.34
65.50
-
-
-
Multi-attentional ∗ [ 13 ]
CVPR’21
✓
✓
95.32
68.26
75.25
73.56
73.79
92.95
96.51
83.81
96.52
70.05
67.11
PCL+I2G [ 22 ]
ICCV’21
✓
×
99.11
90.03
-
-
-
99.07
-
74.27
-
67.52
-
TABLE I: In-dataset and Cross-dataset evaluation in terms of AUC (%) and AP (%) at the video-level on multiple deepfake datasets. Results for comparison are directly extracted from the original papers. ∗ indicates our reproduced results using official pre-trained weights. Bold and Underlined highlight the best and the second-best performance, respectively.
Method
Venue
Training set
Cross-dataset
Real
Fake
CDF
DFDCP
DiffSwap
SBI [ 14 ]
CVPR’22
✓
×
78.59
78.05
75.20
CADDM [ 16 ]
CVPR’23
✓
✓
73.16
65.19
75.58
LSDA [ 85 ]
CVPR’24
✓
✓
83.0
81.5
-
DiffusionFake (EFN-B4) [ 49 ]
NeurIPS’24
✓
✓
83.17
77.35
82.02
DiffusionFake (ViT-B) [ 49 ]
NeurIPS’24
✓
✓
80.46
80.95
86.98
TABLE II: Comparison in terms of AUC (%) at the frame-level with cross-dataset evaluation on CDF2 [ 19 ] , DFDCP [ 44 ] , and DiffSwap [ 47 ] .
Method
Venue
#Para.
Cross-manipulation
E4S
FOMM
BlendFace
FSGAN
MobileSwap
SBI ∗ [ 14 ]
CVPR’22
19M
52.80
79.56
86.50
85.36
86.64
FAViT ∗ [ 17 ]
TCSVT’24
128M
74.70
76.99
88.43
96.96
83.96
StA+VB [ 67 ]
CVPR’25
353M
-
-
90.6
96.4
94.6
LAA-Net [ 23 ]
CVPR’24
27M
81.70
88.29
91.28
97.52
97.15
LAA-Former-S
-
23M
88.89
82.34
91.07
95.45
93.40
TABLE III: Comparison in terms of numbers of parameters (#Para.) and AUC (%) at the video-level using cross-manipulation evaluation on five subsets of DF40 [ 46 ] . For the sake of clarity, we note that we report the (#Para.) for the entire model, including all auxiliary branches. These branches can be removed at the inference for more efficient computation as discussed in Section III .
Method
Training set
Perturbation set
Real
Fake
Saturation
Contrast
Block
Noise
Pixel
Avg.
Xception [ 26 ]
✓
✓
99.3
98.6
99.7
53.8
74.2
85.12
FaceXray [ 21 ]
✓
✓
97.6
88.5
99.1
49.8
88.6
84.72
CNN-aug [ 95 ]
✓
✓
99.3
99.1
95.2
54.7
91.2
87.90
LipForensics [ 96 ]
✓
✓
99.9
99.6
87.4
73.8
95.6
91.26
SBI [ 14 ]
✓
×
92.0
92.3
92.2
62.2
79.1
83.56
TABLE IV: Robustness to unseen perturbations.
Fig. 9: Visualization of saliency maps on different types of manipulation from FF++ [ 3 ] . LAA-Net and LAA-Former is compared to SBI [ 14 ] , Xception [ 3 ] , and MAT [ 13 ] .
EFN-B4
Test Set AUC (%)
E-FPN Integration
CDF2
DFD
DFW
DFDCP
F(6)
F(5)
F(4)
F(3)
F(2)
FPN
E-FPN
FPN
E-FPN
FPN
E-FPN
FPN
E-FPN
(a)
✓
91.56
98.27
73.02
78.35
(b)
✓
✓
93.42
91.79
98.59
97.12
73.78
71.39
78.40
75.80
(c)
✓
✓
✓
88.72
92.86
97.96
98.95
69.40
74.93
71.91
83.97
(d)
✓
✓
✓
✓
88.35
95.40
98.89
98.43
70.94
80.03
79.02
86.94
TABLE V: Traditional FPN versus E-FPN using the SBI data synthesis under the cross-dataset evaluation protocol. We report the results when integrating features F(i) from different layers.
Fig. 10: Visualization of saliency maps of different components in LAA-Net w/o E-FPN, w/o H, and w/o C refer to ablating E-FPN, heatmap branch, and self-consistency branch, respectively.
C
H
E-FPN
Test set AUC (%)
CDF2
DFD
DFDCP
DFW
Avg.
×
×
×
74.54
92.24
70.81
59.81
74.35
×
✓
×
80.89
94.53
77.93
67.12
80.12 ↑ (5.77)
×
×
✓
84.21
95.03
80.68
65.47
81.35 ↑ (7.00)
×
✓
✓
95.56
98.54
82.21
74.98
87.82 ↑ (13.47)
✓
×
✓
79.87
94.60
71.70
72.47
79.66 ↑ (5.31)
TABLE VI: Ablation study of LAA-Net’s components including the Consistency branch (C), Heatmap branch (H), and E-FPN.
λ1
λ2
Test Set AUC (%)
CDF2
DFDCP
DFW
Avg.
1
1
90.69
78.12
70.98
79.93
10
10
95.73
85.87
73.56
85.05
100
100
93.72
78.60
75.25
82.52
100
10
93.05
83.86
76.72
84.54
10
100
95.40
86.94
80.03
87.46
TABLE VII: Sensitivity analysis. The impact of the hyperparameters λ1 and λ2 using the cross-dataset protocol on three datasets in terms of AUC.
Fig. 11: Visualization of saliency maps using E-FPN and FPN with different integration of multi-scale layers. We can see that E-FPN can focus better on artifacts as compared to FPN. The setup details are provided in Table V .
Res. & Pat.
Test set AUC (%)
FF++
CDF2
DFD
DFW
DFDCP
DFDC
Avg.
112 P 16
81.83
85.26
73.56
76.87
93.28
72.53
80.56
112 P 8
97.67
94.45
96.12
81.74
96.30
78.91
90.87
224 P 8
99.93
96.84
99.54
82.11
96.99
79.01
92.40
TABLE VIII: Effect of input resolution and patch size.
Model
Lr
L2-Att
Test set AUC (%)
FF++
CDF2
DFD
DFDC
Avg.
ViT [ 29 ] (w/ SBI)
1×10−3
×
68.86
67.29
60.58
61.32
64.51
LAA-Former
✓
73.52
71.78
65.34
62.51
68.29 ( ↑ 3.78 )
ViT [ 29 ] (w/ SBI)
5×10−4
×
75.68
72.99
57.19
62.38
67.06
LAA-Former
✓
80.08
87.45
65.62
71.04
76.05 ( ↑ 8.99 )
ViT [ 29 ] (w/ SBI)
1×10−4
×
95.99
89.27
89.71
78.50
88.36
TABLE IX: Ablation study of LAA-Former’s components.
Model
Target
#Para.
FLOPs
Test set AUC(%)
CDF2
DFD
DFDC
Avg.
LAA-Former
V-Point
23.61M
9.4G
93.39
93.70
77.71
88.26
V-Patch
22.77M
8.9G
94.45
96.12
78.91
89.83( ↑ 1.67 )
LAA-Swin
V-Point
57.25M
8.1G
94.25
99.30
74.99
89.51
V-Patch
54.89M
6.5G
94.48
99.68
77.47
90.54( ↑ 1.03 )
TABLE X: Vulnerable Patches (V-Patch) vs. Vulnerable Points (V-Point).
f2
Test set AUC (%)
CDF2
DFD
DFW
DFDC
Avg.
mean
94.16
95.03
81.02
78.28
87.12
max
94.45
96.12
81.74
78.91
87.81( ↑ 0.69 )
TABLE XI: Selection of f2 .
λatt
Test set AUC (%)
CDF2
DFD
DFDC
Avg.
1
93.67
94.62
77.91
88.73
10
94.45
96.12
78.91
89.83
100
94.96
94.88
78.58
89.47
TABLE XII: Impact of loss balancing factor λatt (Eq. ( 15 ).
Figure 23Figure 24Figure 25Figure 26Figure 27
Appendix figures & tables5 assets
Supplementary material from the paper’s appendix.
Appendix
Fig. 12: In order to generate the consistency map prediction C^ as well as the associated ground truth C , we first randomly select a vulnerable point located at ps∈P . For computing C^ , we measure the similarity between the feature at ps (red block) and the features generated from every point. Namely, we use the similarity function in [ 22 ] . As for C , we measure the consistency values between the pixel at the ps and all pixels in B , as also described in Eq. ( 7 ) of the manuscript.
Fig. 13: The generation process of ground truth heatmaps by producing using an Unnormalized Gaussian Distribution given a selected vulnerable point.
Method
Venue
Training set
Test set
Real
Fake
FF++
CDF2
DFW
DFD
DFDCP
DFDC
AUC
AUC
AP
AR
mF1
AUC
AP
AR
mF1
AUC
AP
AR
mF1
AUC
AP
AR
mF1
AUC
AP
AR
mF1
Xception ∗ [ 3 ]
ICCV’19
✓
✓
93.60
61.18
66.93
52.40
58.78
65.29
55.37
57.99
56.65
89.75
85.48
79.34
82.29
69.90
91.98
67.07
77.57
58.98
55.32
55.84
55.58
FaceXRay+BI [ 21 ]
CVPR’20
✓
✓
99.20
79.50
-
-
-
-
-
-
-
95.40
93.34
-
-
65.50
-
-
-
-
-
-
-
Multi-attentional ∗ [ 13 ]
CVPR’21
✓
✓
95.32
68.26
75.25
52.40
61.78
73.56
73.79
63.38
68.19
92.95
96.51
60.76
74.57
83.81
96.52
77.68
86.08
70.05
67.11
63.53
65.27
PCL+I2G [ 22 ]
ICCV’21
✓
×
99.11
90.03
-
-
-
-
-
-
-
99.07
-
-
-
74.27
-
-
-
67.52
-
-
-
Appendix
TABLE XIII: In-dataset and Cross-dataset evaluation in terms of AUC (%), AP (%), AR (%), and mF1 (%) at the video-level on multiple deepfake datasets. Results for comparison are directly extracted from the original papers. ∗ indicates our reproduced results using official pre-trained weights. Bold and Underlined highlight the best and the second-best performance, respectively.
Method
Training Set
FF++ Test Set [ 3 ]
Real
Fake
ACC
AUC
AP
AR
mF1
Ours w/ BI [ 21 ]
✓
×
99.03
99.95
99.99
99.21
99.60
Ours w/ SBI [ 14 ]
✓
×
99.04
99.96
99.99
99.29
99.64
Appendix
TABLE XIV: In-dataset evaluation on FF++ [ 3 ] reported by ACC, AUC, AP, AR, and mF1.
Fig. 14: Detection of vulnerable points w/o and w/ Gaussian noise.
State-of-the-art deepfake detectors achieve near-perfect in-domain accuracy yet degrade under cross-generator shifts, heavy compression, and adversarial perturbations. The core limitation remains the decoupling of semantic artifact learning from physical invariants: optical-flow discontinuities, specular-reflection inconsistencies, and cardiac-modulated reflectance (rPPG) are treated either as post-hoc features or ignored. We introduce PhyLAA-X, a novel physics-conditioned extension of Localized Artifact Attention (LAA-X). PhyLAA-X injects three end-to-end differentiable physics-derived feature volumes - optical-flow curl, specular-reflectance skewness, and spatially-upsampled rPPG power spectra - directly into the LAA-X attention computation via cross-attention gating and a resonance consistency loss. This forces the network to learn manipulation boundaries where semantic inconsistencies and physical violations co-occur - regions inherently harder for generative models to replicate consistently. PhyLAA-X is embedded across an efficient spatiotemporal ensemble (EfficientNet-B4+BiLSTM, ResNeXt-101+Transformer, Xception+causal Conv1D) with uncertainty-aware adaptive weighting. On FaceForensics++ (c23), Aletheia reaches 97.2% accuracy / 0.992 AUC-ROC; on Celeb-DF v2, 94.9% / 0.981; on DFDC, 90.8% / 0.966 - outperforming the strongest published baseline (LAA-Net [1]) by 4.1-7.3% in cross-generator settings and maintaining 79.4% accuracy under epsilon = 0.02 PGD-10 attacks. Single-backbone ablations confirm PhyLAA-X alone delivers a 4.2% cross-dataset AUC gain. The full production system is open-sourced at https://github.com/devghori1264/Aletheia (v1.2, April 2026) with pretrained weights, the adversarial corpus (referred to as ADC-2026 in this work), and complete reproducibility artifacts.
The rapid advancement of deepfake generation techniques poses significant threats to public safety and causes societal harm through the creation of highly realistic synthetic facial media. While existing detection methods demonstrate limitations in generalizing to emerging forgery patterns, this paper presents Deepfake Forensics Adapter (DFA), a novel dual-stream framework that synergizes vision-language foundation models with targeted forensics analysis. Our approach integrates a pre-trained CLIP model with three core components to achieve specialized deepfake detection by leveraging the powerful general capabilities of CLIP without changing CLIP parameters: 1) A Global Feature Adapter is used to identify global inconsistencies in image content that may indicate forgery, 2) A Local Anomaly Stream enhances the model's ability to perceive local facial forgery cues by explicitly leveraging facial structure priors, and 3) An Interactive Fusion Classifier promotes deep interaction and fusion between global and local features using a transformer encoder. Extensive evaluations of frame-level and video-level benchmarks demonstrate the superior generalization capabilities of DFA, particularly achieving state-of-the-art performance in the challenging DFDC dataset with frame-level AUC/EER of 0.816/0.256 and video-level AUC/EER of 0.836/0.251, representing a 4.8% video AUC improvement over previous methods. Our framework not only demonstrates state-of-the-art performance, but also points out a feasible and effective direction for developing a robust deepfake detection system with enhanced generalization capabilities against the evolving deepfake threats. Our code is available at https://github.com/Liao330/DFA.git
Jianfeng Liao, Yichen Wei, Raymond Chan Ching Bon +3
Shenzhen Technology University, Guangdong, China · Singapore Institute of Technology, Singapore, Singapore · The University of Hong Kong, Hong Kong, China +1
Recent deepfake detection methods demonstrate improved cross-dataset generalization, yet the underlying mechanisms remain underexplored. We introduce the Alpha Blending Hypothesis, positing that state-of-the-art frame-based detectors primarily function as alpha blending searchers; rather than learning semantic anomalies or specific generative neural fingerprints, they localize low-level compositing artifacts introduced during the integration of manipulated faces into target frames. We experimentally validate the hypothesis, demonstrating that deepfake detectors exhibit high sensitivity to the so-called self-blended images (SBI) and non-generative manipulations. We propose the method BlenD that leverages a large-scale, diverse dataset of real-only facial images augmented with SBI. This approach achieves the best average cross-dataset generalization on 15 compositional deepfake datasets released between 2019 and 2025 without utilizing explicitly generated deepfakes during training. Furthermore, we show that predictions from explicit blending searchers and models resilient to blending shortcuts are highly complementary, yielding a state-of-the-art AUROC of 94.0% in an ensemble configuration. The code with experiments and the trained model will be publicly released.
Andrii Yermakov, Jan Cech, Mario Fritz +1
Czech Technical University in Prague · CISPA Helmholtz Center for Information Security