cs.CVApr 5, 2026

LAA-X: Unified Localized Artifact Attention for Quality-Agnostic and Generalizable Face Forgery Detection

Authors: Dat Nguyen, Enjie Ghorbel, Anis Kacem, Marcella Astrid, Djamila Aouada

Organizations: CVI2, SnT, University of Luxembourg, Luxembourg · CRISTAL laboratory, ENSI, University of Manouba, Tunisia · SnT, University of Luxembourg, Luxembourg

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

In this paper, we propose Localized Artifact Attention X (LAA-X), a novel deepfake detection framework that is both robust to high-quality forgeries and capable of generalizing to unseen manipulations. Existing approaches typically rely on binary classifiers coupled with implicit attention mechanisms, which often fail to generalize beyond known manipulations. In contrast, LAA-X introduces an explicit attention strategy based on a multi-task learning framework combined with blending-based data synthesis. Auxiliary tasks are designed to guide the model toward localized, artifact-prone (i.e., vulnerable) regions. The proposed framework is compatible with both CNN and transformer backbones, resulting in two different versions, namely, LAA-Net and LAA-Former, respectively. Despite being trained only on real and pseudo-fake samples, LAA-X competes with state-of-the-art methods across multiple benchmarks. Code and pre-trained weights for LAA-Net\footnote{https://github.com/10Ring/LAA-Net} and LAA-Former\footnote{https://github.com/10Ring/LAA-Former} are publicly available.

Figures & tables

Fig. 1: Comparison of LAA-Net( \mathchoice{\mathbin{\vbox{\hbox{\scalebox{1.2}{\displaystyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\textstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptscriptstyle\bullet}}}}} ), LAA-Former( \mathchoice{\mathbin{\vbox{\hbox{\scalebox{1.2}{\displaystyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\textstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptscriptstyle\bullet}}}}} ), and LAA-Swin( \mathchoice{\mathbin{\vbox{\hbox{\scalebox{1.2}{\displaystyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\textstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptscriptstyle\bullet}}}}} ) with respect to existing methods, namely, Multi-attentional( \mathchoice{\mathbin{\vbox{\hbox{\scalebox{1.2}{\displaystyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\textstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptscriptstyle\bullet}}}}} ) [ 13 ] , SBI( \mathchoice{\mathbin{\vbox{\hbox{\scalebox{1.2}{\displaystyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\textstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptscriptstyle\bullet}}}}} ) [ 14 ] , Xception( \mathchoice{\mathbin{\vbox{\hbox{\scalebox{1.2}{\displaystyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\textstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptscriptstyle\bullet}}}}} ) [ 3 ] , RECCE( \mathchoice{\mathbin{\vbox{\hbox{\scalebox{1.2}{\displaystyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\textstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptscriptstyle\bullet}}}}} ) [ 15 ] , CADDM( \mathchoice{\mathbin{\vbox{\hbox{\scalebox{1.2}{\displaystyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\textstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptscriptstyle\bullet}}}}} ) [ 16 ] , FAViT( \mathchoice{\mathbin{\vbox{\hbox{\scalebox{1.2}{\displaystyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\textstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptscriptstyle\bullet}}}}} ) [ 17 ] , ForensicsAdapter( \mathchoice{\mathbin{\vbox{\hbox{\scalebox{1.2}{\displaystyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\textstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptscriptstyle\bullet}}}}} ) [ 18 ] using (a) the AUC performance with respect to different ranges of Mask-SSIM, and (b) its associated boxplots. *The results were obtained using the official source codes pretrained on FF+ [ 3 ] and testing on Celeb-DFv2 [ 19 ] . Figure best viewed in colors.
Fig. 2: Overview of the proposed LAA-X framework. LAA-X is a multi-task learning framework that incorporates an explicit attention mechanism to vulnerable regions through the integration of generic auxiliary tasks. This strategy enables LAA-X to adequately attend to fine-grained artifact-prone areas. Particularly, these additional tasks can be removed at inference, reducing computational cost at test time.
Fig. 3: Overview of the proposed LAA-Net approach. It is formed by two main components, namely, (1) an explicit attention mechanism based on a multi-task learning framework composed of three branches, i.e., the binary classification branch, the heatmap branch, and the self-consistency branch. The heatmap and self-consistency ground-truth data are generated based on the detected vulnerable points, and (2) an Enhanced Feature Pyramid Networks (E-FPN) that aggregates multi-scale features.
Figure 4
Fig. 6: Experiments to analyze the capability of transformer-based networks in deepfake detection. (a) Generalization performance comparison of baseline classifiers (ViT [ 29 ] +SBI [ 14 ] ( \mathchoice{\mathbin{\vbox{\hbox{\scalebox{1.2}{\displaystyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\textstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptscriptstyle\bullet}}}}} ), Swin [ 32 ] +SBI [ 14 ] ( \mathchoice{\mathbin{\vbox{\hbox{\scalebox{1.2}{\displaystyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\textstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptscriptstyle\bullet}}}}} )) with two specialized transformer-based (FAViT [ 17 ] ( \mathchoice{\mathbin{\vbox{\hbox{\scalebox{1.2}{\displaystyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\textstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptscriptstyle\bullet}}}}} ), ForensicsAdapter [ 18 ] ( \mathchoice{\mathbin{\vbox{\hbox{\scalebox{1.2}{\displaystyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\textstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptscriptstyle\bullet}}}}} )) and four CNN-based methods (LAA-Net [ 23 ] +SBI [ 14 ] ( \mathchoice{\mathbin{\vbox{\hbox{\scalebox{1.2}{\displaystyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\textstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptscriptstyle\bullet}}}}} ), CADDM [ 16 ] ( \mathchoice{\mathbin{\vbox{\hbox{\scalebox{1.2}{\displaystyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\textstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptscriptstyle\bullet}}}}} ), EfficientNet [ 25 ] +SBI [ 14 ] ( \mathchoice{\mathbin{\vbox{\hbox{\scalebox{1.2}{\displaystyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\textstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptscriptstyle\bullet}}}}} ), Xception [ 26 ] +SBI [ 14 ] ( \mathchoice{\mathbin{\vbox{\hbox{\scalebox{1.2}{\displaystyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\textstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptstyle\bullet}}}}}{\mathbin{\vbox{\hbox{\scalebox{1.2}{\scriptscriptstyle\bullet}}}}} )) across different ranges of Mask-SSIM [ 40 ] . All methods adopt FF++ [ 3 ] for the training and are tested cross-dataset on CDF2 [ 19 ] . More details are described in Section III-C1 . (b) Evolution of the training loss of ViT under different configurations (variation of input resolution and patch size), Xception and EfficientNet, across four types of deepfakes in FF++ [ 3 ] .
Fig. 7: Examples are randomly selected to illustrate four types of deepfakes in the common FF++ [ 3 ] dataset. It includes Deepfakes (DF) [ 80 ] , FaceSwap (FS) [ 81 ] , Face2Face (F2F) [ 82 ] , and NeuralTextures (NT) [ 83 ] .
Fig. 8: The proposed Transformer-based LAA-X method. (I) The overall LAA-Former framework, (II) the L2-Att module, and (III) the ground-truth generation of vulnerable patches.
MethodVenueTraining setTest set
RealFakeFF++ CDF2DFWDFDDFDCPDFDC
AUC AUCAPAUCAPAUCAPAUCAPAUCAP
Xception ∗ [ 3 ]ICCV’19✓\checkmark✓\checkmark93.60 61.1866.9365.2955.3789.7585.4869.9091.9858.9855.32
FaceXRay (w/ BI) [ 21 ]CVPR’20✓\checkmark✓\checkmark99.20 79.50---95.4093.3465.50---
Multi-attentional ∗ [ 13 ]CVPR’21✓\checkmark✓\checkmark95.32 68.2675.2573.5673.7992.9596.5183.8196.5270.0567.11
PCL+I2G [ 22 ]ICCV’21✓\checkmark×\times99.11 90.03---99.07-74.27-67.52-
TABLE I: In-dataset and Cross-dataset evaluation in terms of AUC (%) and AP (%) at the video-level on multiple deepfake datasets. Results for comparison are directly extracted from the original papers. ∗\ast indicates our reproduced results using official pre-trained weights. Bold and Underlined highlight the best and the second-best performance, respectively.
MethodVenueTraining setCross-dataset
RealFakeCDFDFDCPDiffSwap
SBI [ 14 ]CVPR’22✓×\times78.5978.0575.20
CADDM [ 16 ]CVPR’23✓✓73.1665.1975.58
LSDA [ 85 ]CVPR’24✓✓83.081.5-
DiffusionFake (EFN-B4) [ 49 ]NeurIPS’24✓✓83.1777.3582.02
DiffusionFake (ViT-B) [ 49 ]NeurIPS’24✓✓80.4680.9586.98
TABLE II: Comparison in terms of AUC (%) at the frame-level with cross-dataset evaluation on CDF2 [ 19 ] , DFDCP [ 44 ] , and DiffSwap [ 47 ] .
MethodVenue#Para.Cross-manipulation
E4SFOMMBlendFaceFSGANMobileSwap
SBI ∗ [ 14 ]CVPR’2219M52.8079.5686.5085.3686.64
FAViT ∗ [ 17 ]TCSVT’24128M74.7076.9988.4396.9683.96
StA+VB [ 67 ]CVPR’25353M--90.696.494.6
LAA-Net [ 23 ]CVPR’2427M81.7088.2991.2897.5297.15
LAA-Former-S-23M88.8982.3491.0795.4593.40
TABLE III: Comparison in terms of numbers of parameters (#Para.) and AUC (%) at the video-level using cross-manipulation evaluation on five subsets of DF40 [ 46 ] . For the sake of clarity, we note that we report the (#Para.) for the entire model, including all auxiliary branches. These branches can be removed at the inference for more efficient computation as discussed in Section III .
MethodTraining setPerturbation set
RealFakeSaturationContrastBlockNoisePixelAvg.
Xception [ 26 ]✓\checkmark✓99.398.699.753.874.285.12
FaceXray [ 21 ]✓\checkmark✓97.688.599.149.888.684.72
CNN-aug [ 95 ]✓\checkmark✓99.399.195.254.791.287.90
LipForensics [ 96 ]✓\checkmark✓99.999.687.473.895.691.26
SBI [ 14 ]✓\checkmark×\times92.092.392.262.279.183.56
TABLE IV: Robustness to unseen perturbations.
Fig. 9: Visualization of saliency maps on different types of manipulation from FF++ [ 3 ] . LAA-Net and LAA-Former is compared to SBI [ 14 ] , Xception [ 3 ] , and MAT [ 13 ] .
 EFN-B4Test Set AUC (%)
 E-FPN Integration CDF2DFDDFWDFDCP
 F(6)\mathbf{F}^{(6)}F(5)\mathbf{F}^{(5)}F(4)\mathbf{F}^{(4)}F(3)\mathbf{F}^{(3)}F(2)\mathbf{F}^{(2)} FPNE-FPNFPNE-FPNFPNE-FPNFPNE-FPN
(a)✓     91.5698.2773.0278.35
(b)✓✓    93.4291.7998.5997.1273.7871.3978.4075.80
(c)✓✓✓   88.7292.8697.9698.9569.4074.9371.9183.97
(d)✓✓✓✓  88.3595.4098.8998.4370.9480.0379.0286.94
TABLE V: Traditional FPN versus E-FPN using the SBI data synthesis under the cross-dataset evaluation protocol. We report the results when integrating features F(i)\mathbf{F}^{(i)} from different layers.
Fig. 10: Visualization of saliency maps of different components in LAA-Net w/o E-FPN, w/o H, and w/o C refer to ablating E-FPN, heatmap branch, and self-consistency branch, respectively.
CHE-FPNTest set AUC (%) 
 CDF2DFDDFDCPDFWAvg.
×\times×\times×\times 74.5492.2470.8159.8174.35
×\times✓\checkmark×\times 80.8994.5377.9367.1280.12 ↑\uparrow (5.77)
×\times×\times✓\checkmark 84.2195.0380.6865.4781.35 ↑\uparrow (7.00)
×\times✓\checkmark✓\checkmark 95.5698.5482.2174.9887.82 ↑\uparrow (13.47)
✓\checkmark×\times✓\checkmark 79.8794.6071.7072.4779.66 ↑\uparrow (5.31)
TABLE VI: Ablation study of LAA-Net’s components including the Consistency branch (C), Heatmap branch (H), and E-FPN.
λ1\lambda_{1}λ2\lambda_{2}Test Set AUC (%)
 CDF2DFDCPDFWAvg.
11 90.6978.1270.9879.93
1010 95.7385.8773.5685.05
100100 93.7278.6075.2582.52
10010 93.0583.8676.7284.54
10100 95.4086.9480.0387.46
TABLE VII: Sensitivity analysis. The impact of the hyperparameters λ1\lambda_{1} and λ2\lambda_{2} using the cross-dataset protocol on three datasets in terms of AUC.
Fig. 11: Visualization of saliency maps using E-FPN and FPN with different integration of multi-scale layers. We can see that E-FPN can focus better on artifacts as compared to FPN. The setup details are provided in Table V .
Res. & Pat.Test set AUC (%) 
FF++CDF2DFDDFWDFDCPDFDCAvg.
112112 P 161681.8385.2673.5676.8793.2872.5380.56
112112 P 8897.6794.4596.1281.7496.3078.9190.87
224224 P 8899.9396.8499.5482.1196.9979.0192.40
TABLE VIII: Effect of input resolution and patch size.
ModelLrL2-AttTest set AUC (%)
FF++ CDF2DFDDFDCAvg.
ViT [ 29 ] (w/ SBI)1×10−31\times 10^{-3}×\times 68.86  67.29 60.58 61.3264.51
LAA-Former✓\checkmark 73.52  71.78 65.34 62.5168.29 ( ↑\uparrow 3.78 )
ViT [ 29 ] (w/ SBI)5×10−45\times 10^{-4}×\times 75.68  72.99 57.19 62.3867.06
LAA-Former✓\checkmark 80.08  87.45 65.62 71.0476.05 ( ↑\uparrow 8.99 )
ViT [ 29 ] (w/ SBI)1×10−41\times 10^{-4}×\times 95.99  89.27 89.71 78.5088.36
TABLE IX: Ablation study of LAA-Former’s components.
ModelTarget#Para.FLOPsTest set AUC(%) 
 CDF2DFDDFDCAvg.
LAA-FormerV-Point23.61M9.4G 93.3993.7077.7188.26
V-Patch22.77M8.9G 94.4596.1278.9189.83( ↑\uparrow 1.67 )
LAA-SwinV-Point57.25M8.1G 94.2599.3074.9989.51
V-Patch54.89M6.5G 94.4899.6877.4790.54( ↑\uparrow 1.03 )
TABLE X: Vulnerable Patches (V-Patch) vs. Vulnerable Points (V-Point).
f2f_{2}Test set AUC (%) 
 CDF2DFDDFWDFDCAvg.
mean 94.1695.0381.0278.2887.12
max 94.4596.1281.7478.9187.81( ↑\uparrow 0.69 )
TABLE XI: Selection of f2f_{2} .
λatt\lambda_{att}Test set AUC (%) 
 CDF2DFDDFDCAvg.
1 93.6794.6277.9188.73
10 94.4596.1278.9189.83
100 94.9694.8878.5889.47
TABLE XII: Impact of loss balancing factor λatt\lambda_{att} (Eq. ( 15 ).
Figure 23
Figure 24
Figure 25
Figure 26
Figure 27
Appendix figures & tables5 assets

Supplementary material from the paper’s appendix.

Appendix

Fig. 12: In order to generate the consistency map prediction C^\hat{\mathbf{C}} as well as the associated ground truth C\mathbf{C} , we first randomly select a vulnerable point located at ps∈P\mathbf{p}^{s}\in\mathcal{P} . For computing C^\hat{\mathbf{C}} , we measure the similarity between the feature at ps\mathbf{p}^{s} (red block) and the features generated from every point. Namely, we use the similarity function in [ 22 ] . As for C\mathbf{C} , we measure the consistency values between the pixel at the ps\mathbf{p}^{s} and all pixels in B\mathbf{B} , as also described in Eq. ( 7 ) of the manuscript.
Fig. 13: The generation process of ground truth heatmaps by producing using an Unnormalized Gaussian Distribution given a selected vulnerable point.
MethodVenueTraining setTest set
RealFakeFF++ CDF2DFWDFDDFDCPDFDC
AUC AUCAPARmF1AUCAPARmF1AUCAPARmF1AUCAPARmF1AUCAPARmF1
Xception ∗ [ 3 ]ICCV’19✓\checkmark✓\checkmark93.60 61.1866.9352.4058.7865.2955.3757.9956.6589.7585.4879.3482.2969.9091.9867.0777.5758.9855.3255.8455.58
FaceXRay+BI [ 21 ]CVPR’20✓\checkmark✓\checkmark99.20 79.50-------95.4093.34--65.50-------
Multi-attentional ∗ [ 13 ]CVPR’21✓\checkmark✓\checkmark95.32 68.2675.2552.4061.7873.5673.7963.3868.1992.9596.5160.7674.5783.8196.5277.6886.0870.0567.1163.5365.27
PCL+I2G [ 22 ]ICCV’21✓\checkmark×\times99.11 90.03-------99.07---74.27---67.52---
Appendix
TABLE XIII: In-dataset and Cross-dataset evaluation in terms of AUC (%), AP (%), AR (%), and mF1 (%) at the video-level on multiple deepfake datasets. Results for comparison are directly extracted from the original papers. ∗\ast indicates our reproduced results using official pre-trained weights. Bold and Underlined highlight the best and the second-best performance, respectively.
MethodTraining SetFF++ Test Set [ 3 ]
RealFakeACCAUCAPARmF1
Ours w/ BI [ 21 ]✓×\times99.0399.9599.9999.2199.60
Ours w/ SBI [ 14 ]✓×\times99.0499.9699.9999.2999.64
Appendix
TABLE XIV: In-dataset evaluation on FF++ [ 3 ] reported by ACC, AUC, AP, AR, and mF1.
Fig. 14: Detection of vulnerable points w/o and w/ Gaussian noise.
More in this topic

Deepfake Detection

Deepfake detection identifies manipulated or AI-generated media to support trustworthy communication, identity verification, and forensic analysis.

See all 241 papers

Explore similar work

CardsList

  1. Aletheia: Physics-Conditioned Localized Artifact Attention (PhyLAA-X) for End-to-End Generalizable and Robust Deepfake Video Detection

    Apr 13, 2026Devendra GhoriDeepfake Detection

    Researcher, Aletheia Project

  2. Deepfake Forensics Adapter: A Dual-Stream Network for Generalizable Deepfake Detection

    Mar 2, 2026Jianfeng Liao, Yichen Wei, Raymond Chan Ching Bon +3Deepfake DetectionDigital Image Forensics

    Shenzhen Technology University, Guangdong, China · Singapore Institute of Technology, Singapore, Singapore · The University of Hong Kong, Hong Kong, China +1

  3. The Alpha Blending Hypothesis: Compositing Shortcut in Deepfake Detection

    May 11, 2026Andrii Yermakov, Jan Cech, Mario Fritz +1Image Forgery DetectionDeepfake Detection

    Czech Technical University in Prague · CISPA Helmholtz Center for Information Security