Environment-Invariant Subspace Learning for Generalizable Deepfake Detection

Shenghao Chen; Hao Jia; Chen Li; Chunjie Ma; Zan Gao; Shengyong Chen

cs.CVAug 18, 2026

Environment-Invariant Subspace Learning for Generalizable Deepfake Detection

Authors: Shenghao Chen, Hao Jia, Chen Li, Chunjie Ma, Zan Gao, Shengyong Chen

Organizations: Key Laboratory of Computer Vision and System, Ministry of Education, Tianjin University of Technology, Tianjin 300384, China · Shandong Artificial Intelligence Institute, Qilu University of Technology (Shandong Academy of Sciences), Jinan 250014, China

Abstract

Cross-distribution generalization remains a critical bottleneck in deepfake detection. While recent efforts leverage the semantic priors of large-scale visual foundation models (VFMs), a noteworthy yet underexplored challenge remains: the susceptibility of these semantic priors to environmental interference from factors such as lighting and style. Crucially, this interference establishes spurious correlations between forgery cues and environmental patterns that severely limit generalization. To address this fundamental challenge, we propose an innovative Environment-Invariant Subspace Learning (EISL) framework. The core contribution of EISL is that it aims to disentangle features into orthogonal forgery-relevant invariant factors and environment-related residual factors via a learnable low-rank projection. To facilitate robust feature disentanglement, we also design an Environmental Intervention module that generates diverse and challenging intervention pairs, simulating out-of-distribution environmental shifts to guide the model toward discovering truly invariant forgery representations. Experiments across cross-dataset, cross-generator, whole-face synthesis, and corruption settings show consistent gains and competitive or leading performance against strong detectors, demonstrating improved robustness to unseen forgery types and environmental variations. This work provides a new perspective and a valuable exploration for understanding and tackling the generalization barriers of VFMs in deepfake detection.

Figures & tables

Fig. 1: Motivation. A CLIP ViT-L/14 detector adapted with LoRA on FF++ and evaluated on the FF++ test split retains a frame-level AUC of 0.98 without intervention, but drops to 0.817 and 0.734 when only the facial region or only the background is intervened, although the forgery source and the real/fake label are unchanged.

Fig. 2: EISL framework. During training, EIM generates a label-preserving environmental intervention $I_{e}$ . Original and intervened images are encoded by a shared LoRA-adapted CLIP, and a frozen CLIP provides the semantic reference. The low-rank projector produces invariant features for classification and consistency learning; the complementary residual is separated from the reference semantics. At inference, only the adapted CLIP, projector, and classifier are used.

Method	Venue	CDF-v1	CDF-v2	DFDC	DFDCP	DFD	Avg.
Xception [ 27 ]	ICCV’19	0.779	0.737	0.708	0.737	0.816	0.755
EfficientB4 [ 29 ]	ICML’19	0.791	0.749	0.696	0.728	0.815	0.756
F3Net [ 15 ]	AAAI’20	0.777	0.735	0.702	0.735	0.798	0.749
X-ray [ 30 ]	CVPR’20	0.709	0.679	0.633	0.694	0.766	0.696
FFD [ 53 ]	CVPR’20	0.784	0.744	0.703	0.743	0.802	0.755
SPSL [ 13 ]	CVPR’21	0.815	0.765	0.704	0.741	0.812	0.767

TABLE I: Cross-dataset frame-level AUC. All methods are trained on FF++ and evaluated on unseen datasets. Best and second-best values are bold and underlined, respectively.

Method	Venue	CDF-v2	DFDC	DFDCP
RealForensics [ 58 ]	CVPR’22	0.869	0.759	–
TALL [ 59 ]	ICCV’23	0.908	0.768	–
AltFreezing [ 60 ]	CVPR’23	0.895	–	–
SeeABLE [ 61 ]	ICCV’23	0.873	0.759	0.863
IID [ 62 ]	CVPR’23	0.838	–	0.812
TALL++ [ 63 ]	IJCV’24	0.920	0.785	–

TABLE II: Cross-dataset video-level AUC. The upper block contains video-based methods and the lower block frame-based methods.

Method	UniFace	E4S	FaceDancer	FSGAN	InSwap	SimSwap	Avg.
RECCE [ 55 ]	84.2	65.2	78.3	88.4	79.5	73.0	78.1
SBI [ 10 ]	64.4	69.0	44.7	87.9	63.3	56.8	64.4
IID [ 62 ]	79.5	71.0	79.0	86.4	74.4	64.0	75.7
UCF [ 18 ]	78.7	69.2	80.0	88.1	76.8	64.9	77.5
LSDA [ 16 ]	85.4	68.4	75.9	83.2	81.0	72.7	77.8
CDFA [ 69 ]	76.5	67.4	75.4	84.8	72.0	76.1	75.9

TABLE III: Frame-level AUC (%) on six representative DF40 face-swapping methods. All models are trained on FF++.

Method	T2I	I2I	FS	FE
Xception [ 27 ]	62.43	56.83	85.97	58.64
F 3 -Net [ 15 ]	66.87	67.64	81.01	60.60
EfficientNet [ 29 ]	74.12	57.27	82.11	57.20
DIRE [ 70 ]	44.22	64.64	84.98	57.72
SBI [ 10 ]	80.20	80.40	85.08	68.79
FIA-USA [ 39 ]	86.05	84.95	89.42	72.73

TABLE IV: Frame-level AUC (%) on DiFF. All models are trained on FF++ and transferred without adaptation.

Ref.	Inv.	Orth.	CDF-v1			CDF-v2			DFDCP			Average
Ref.	Inv.	Orth.	AUC	AP	EER	AUC	AP	EER	AUC	AP	EER	AUC	AP	EER
$\times$	$\times$	$\times$	0.898	0.940	0.177	0.881	0.935	0.201	0.836	0.868	0.249	0.872	0.914	0.209
$\checkmark$	$\times$	$\times$	0.903	0.943	0.183	0.883	0.935	0.200	0.846	0.912	0.240	0.877	0.930	0.207
$\times$	$\checkmark$	$\times$	0.723	0.788	0.342	0.717	0.809	0.340	0.629	0.755	0.418	0.689	0.784	0.366
$\times$	$\times$	$\checkmark$	0.910	0.948	0.172	0.903	0.947	0.179	0.861	0.927	0.230	0.891	0.940	0.194
$\times$	$\checkmark$	$\checkmark$	0.933	0.961	0.145	0.906	0.948	0.178	0.870	0.930	0.217	0.903	0.943	0.180

TABLE V: Component ablation. Metrics are frame-level AUC/AP/EER on CDF-v1, CDF-v2, and DFDCP. Ref., Inv., and Orth. denote

\mathcal{L}_{\mathrm{ref}}

, EIM with

\mathcal{L}_{\mathrm{inv}}

, and the low-rank projector with

\mathcal{L}_{\mathrm{orth}}

, respectively.

Mapping	CDF-v1	CDF-v2	DFDCP
No projection ( $P=I_{D}$ )	0.907	0.891	0.866
Full-rank linear ( $D\times D$ )	0.899	0.891	0.885
Two linear layers	0.891	0.894	0.868
EISL projector ( $QQ^{\top}$ , $r=64$ )	0.920	0.911	0.894

TABLE VI: Projection structure. Frame-level AUC obtained by keeping all objectives fixed and replacing only the mapping applied to

F

Projector rank $r$ (backbone fixed to ViT-L/14)
Variant	CDF-v1			CDF-v2			DFDCP			Average
Variant	AUC	AP	EER	AUC	AP	EER	AUC	AP	EER	AUC	AP	EER
$r=32$	0.921	0.951	0.155	0.884	0.933	0.197	0.886	0.931	0.203	0.897	0.938	0.185
$r=64$ (default)	0.920	0.953	0.162	0.911	0.952	0.172	0.894	0.942	0.193	0.908	0.949	0.176
$r=128$	0.908	0.945	0.167	0.898	0.941	0.182	0.872	0.929	0.219	0.892	0.938	0.189
CLIP backbone (rank fixed to $r=64$ )

TABLE VII: Effect of the projector rank

r

and of the CLIP backbone (frame-level AUC/AP/EER). Each block varies one factor while holding the other at its default value, so the default configuration (

r=64

, ViT-L/14) is the same run in both blocks.

Mask	CDF-v1	CDF-v2	DFDCP
Background only, fixed	0.905	0.899	0.886
Foreground/background, fixed	0.910	0.907	0.895
Foreground/background, variable	0.920	0.911	0.894

TABLE VIII: Effect of mask target and shape (frame-level AUC).

Weight	Value	CDF-v1	CDF-v2	DFDCP	Avg.
$\lambda_{\mathrm{ref}}$	$1$	0.828	0.798	0.804	0.810
	$0.5$	0.874	0.882	0.871	0.876
	$0.2$	0.916	0.886	0.896	0.899
	$0.1$	0.920	0.911	0.894	0.908
$\lambda_{\mathrm{inv}}$	$1$	0.919	0.907	0.893	0.906
	$0.5$	0.910	0.896	0.886	0.897

TABLE IX: Sensitivity to the loss weights in Eq. ( 16 ). One coefficient is varied at a time, and the other two remain at their default values.

Perturbation	CDF-v1	CDF-v2	DFDCP	Avg.
None	0.898	0.881	0.836	0.872
Gaussian blur	0.857	0.848	0.803	0.836
Grayscale	0.879	0.853	0.771	0.834
Autocontrast	0.824	0.755	0.729	0.769

TABLE X: Environmental sensitivity of the CLIP-LoRA baseline. A single label-preserving perturbation is applied to the test images; the forgery source, identity, and label are unchanged. Frame-level AUC.

Feature	Inter. AUC	Drop	Shift
CLIP-LoRA	0.772	10.9 pt	1.99 $\times$
EISL, projected $\widetilde{F}$	0.866	4.5 pt	0.66 $\times$
EISL, residual $(I_{D}-P)F$	–	–	2.63 $\times$

TABLE XI: Intervention response on CDF-v2. Shift is the mean intervention-induced feature displacement, normalized by the distance between the original real and fake feature means.

Fig. 3: t-SNE visualization on CDF-v2 after environmental intervention. The CLIP-LoRA baseline is strongly entangled. EISL features before projection still contain intervention-sensitive variation, whereas the projected subspace provides clearer real/fake separation.

Fig. 4: Video-level AUC under five severity levels of six perturbations. EISL is compared with CLIP, IID [ 62 ] , LSDA [ 16 ] , and ForAda [ 45 ] .

Deepfake Detection

Deepfake detection identifies manipulated or AI-generated media to support trustworthy communication, identity verification, and forensic analysis.

See all 240 papers

Suppressing Forgery-Specific Shortcuts for Generalizable Deepfake Detection
Jun 1, 2026Yihui Wang, Yonghui Yang, Jilong Liu +3OOD Generalization Deepfake Detection
Hefei University of Technology China · National University of Singapore Singapore
Deepfake Forensics Adapter: A Dual-Stream Network for Generalizable Deepfake Detection
Mar 2, 2026Jianfeng Liao, Yichen Wei, Raymond Chan Ching Bon +3Deepfake Detection Digital Image Forensics
Shenzhen Technology University, Guangdong, China · Singapore Institute of Technology, Singapore, Singapore · The University of Hong Kong, Hong Kong, China +1
Cross-Domain Generalization Limits of Vision Foundation Models in Facial Deepfake Detection
May 24, 2026Ibrahim DelibasogluVision Foundation Models Cross-Domain Generalization
Department of Software Engineering, Faculty of Computer and Information Sciences, Sakarya University, Esentepe, Sakarya, 54050 Türkiye.

Jun 1, 2026J/K move · Enter open · S save

Suppressing Forgery-Specific Shortcuts for Generalizable Deepfake Detection

Yihui Wang, Yonghui Yang, Jilong Liu, Fengbin Zhu+2

Hefei University of Technology China · National University of Singapore Singapore

OOD Generalization Deepfake Detection Shortcut Learning

Open paper AskPDF arXiv

Deepfake detection suffers from poor generalization across forgery methods, as existing models tend to rely on spurious method-specific shortcuts that fail to transfer to unseen manipulations. While recent approaches attempt to improve generalization, they lack an explicit mechanism to identify and suppress such shortcuts in learned representations. In this work, we propose Shortcut Subspace Suppression (S^3) framework that explicitly characterizes and suppresses method-specific shortcuts via subspace modeling. Our key insight is that variations distinguishing different forgery methods capture method-specific artifacts and thus serve as an effective proxy for method-specific shortcuts. To this end, we train a lightweight linear probe for forgery method classification and perform Singular Value Decomposition (SVD) to extract the dominant shortcut subspace. Building on this formulation, we develop two complementary strategies to reduce shortcut reliance. During training, we softly suppress the shortcut subspace in feature representations, encouraging the model to rely on more generalizable cues for real/fake discrimination. At inference time, we introduce a training-free counterpart that attenuates neurons aligned with the identified shortcut directions, enabling plug-and-play generalization enhancement with improved interpretability. Extensive experiments on multiple benchmarks demonstrate that our method significantly improves cross-method generalization while maintaining strong in-domain performance. The code will be released upon acceptance of the submission.

Abstract

Deepfake Detection

Explore similar work

Suppressing Forgery-Specific Shortcuts for Generalizable Deepfake Detection

Deepfake Forensics Adapter: A Dual-Stream Network for Generalizable Deepfake Detection

Cross-Domain Generalization Limits of Vision Foundation Models in Facial Deepfake Detection