Can Tainted Pixels Expose Deepfake Videos?

Juan Hu; Shaojing Fan; Sanjay Saha; Marc Herrera; Terence Sim

cs.CRAug 26, 2026

Can Tainted Pixels Expose Deepfake Videos?

Authors: Juan Hu, Shaojing Fan, Sanjay Saha, Marc Herrera, Terence Sim

Organizations: National University of Singapore

Abstract

Publicly-acceesible face-manipulation tools have made deepfake creation accessible to non-expert users. Against these, existing defenses are mostly post-hoc, detecting only after forgery has occurred, and operating on still images rather than videos. Research is lacking in i) the proactive protection of published facial videos against black-box manipulation tools, and in (ii) understanding its perceptual effect on human viewers. We introduce TaintedPixels, a proactive video-protection method built around an asymmetric visibility trade-off: the embedded watermark should remain inconspicuous in the published video but become obvious once a downstream tool manipulates the video. TaintedPixels injects structured periodic perturbations into the blue channel of facial regions and refines them under stripe-visibility, color-cast, and video-level LPIPS budgets, with lightweight motion-adaptive deployment. We believe TaintedPixels is the first proactive defense designed specifically against black-box manipulation tools rather than image-level pipelines or specific surrogate generators. Across three publicly available off-the-shelf video manipulation tools and two off-the-shelf detectors, TaintedPixels attains the highest forgery fake rate while keeping perturbations small (LPIPS = 0.0042). Our non-expert human study, conducted on a diverse set of 300 video stimuli spanning different lighting conditions, backgrounds, and skin tones, shows that protected source videos draw a 3.26% suspicion rate, while forgeries from protected sources are identified as fake much more often than forgeries from unprotected sources (90.72% vs. 56.71%). This validates the effectiveness of TaintedPixels.

Figures & tables

Figure 1: Inspired by anti-copy patterns in passports, TaintedPixels embeds an invisible signal into a source video, protecting it. Visible artifacts appear if the video is manipulated.

Figure 2: Overview of our proposed visibility-budgeted facial video protection framework.

Tool	Detector	Metric	Clean	DFRAP	CMUA	FacePoison	FaceShield	TaintedPixels (ours)
Roop	D1 Fake	Fake Rate $\uparrow$	78.33	79.63	78.64	80.33	84.32	89.12
	D1 Fake	Fake Conf. $\uparrow$	75.67	78.72	76.87	73.95	80.32	86.58
	D2 Fake	Fake Rate $\uparrow$	82.43	84.51	83.02	83.93	86.71	90.27
	D2 Fake	Fake Conf. $\uparrow$	72.10	75.39	74.95	80.63	81.66	86.92
FaceFusion	D1 Fake	Fake Rate $\uparrow$	80.87	80.39	82.01	82.20	84.02	88.71
	D1 Fake	Fake Conf. $\uparrow$	73.43	76.74	75.43	74.93	79.34	89.14

Table 1: Comparison with SOTA methods (columns) under 3 manipulation tools (rows). D1 and D2 denote NPR and Deep-Fake-Detector-v2-Model, respectively. “Clean” denotes the unprotected setting, and the remaining columns correspond to forgeries generated from protected videos. The last three rows report the visual quality of the protected videos generated from each method.

Figure 3: Qualitative results. (R1 & R2): the unprotected (clean) and protected source videos, resp. (R3): fakes generated from clean. (R4): fakes from protected. (R5): zoom in of (R4). TaintedPixels creates obvious purple artifacts in every video frame, easily exposing the forgery to human eyes.

Periodic Prior	HF Mask	Face-aware	Visibility Budget	Motion Scaling	Video LPIPS	Avg. Fake Rate $\uparrow$	Video-LPIPS $\downarrow$
–	–	–	–	–	–	81.49	–
✓	–	–	–	–	–	86.10	0.1094
✓	✓	–	–	–	–	87.17	0.2036
✓	✓	✓	–	–	–	87.84	0.1895
✓	✓	✓	✓	–	–	88.35	0.0164
✓	✓	✓	✓	✓	–	89.62	0.0103

Table 2: Component ablation of TaintedPixels . We report average results over Roop, FaceFusion, and MuseTalk. A better method should achieve high fake rate while maintaining low source video-LPIPS.

Clean Source $\downarrow$	Protected Source $\downarrow$	Tool	Forged from Clean $\uparrow$	Forged from Protected $\uparrow$
0.80	3.26	Roop	54.23	89.42
		FaceFusion	51.80	94.51
		MuseTalk	64.11	88.24
		Average	56.71	90.72

Table 3: Human study results reported as the percentage of videos judged as fake. Lower values for source videos indicate better visual naturalness, while higher values for manipulated videos indicate that the forged outputs are easier for humans to recognize as fake.

Appendix figures & tables2 assets

Supplementary material from the paper’s appendix.

Appendix

Symbol / Term	Value / Definition	Description
$\alpha$	$3.5$	Amplitude of the structured blue-channel prior.
$r$	$0.8$	Fraction of high-frequency patches selected.
$p$	$2.0$	Period of the local periodic pattern.
$\epsilon$	$0.25$	Perturbation magnitude bound.
$\lambda_{\mathrm{d}}$	$3.0$	Weight for $\mathcal{L}_{\mathrm{d}}$ .
$\lambda_{\mathrm{s}}$	$1.0$	Weight for $\mathcal{L}_{\mathrm{s}}$ .

Appendix

Table 4: Summary of hyperparameters.

Term	Role
$C_{b}(x)$	Blue-difference chroma channel used to measure blue-channel color changes.
$\mathcal{B}_{\mathrm{vis}}(x)$	Content-adaptive stripe visibility budget estimated from clean-frame chroma statistics.
$W_{\mathrm{ws}}$	Combined soft white/skin-region mask for color-cast suppression.
$\mathcal{B}_{\mathrm{cast}}(x)$	Content-adaptive color-cast budget estimated from clean-frame white/skin chroma statistics.
$\mathrm{RowCoh}(\Delta C_{b})$	Measures row-wise coherent chroma drift, corresponding to visible stripe/banding artifacts.
$\mathrm{LocalChr}(\Delta C_{b})$	Measures local weighted blue-chroma deviation.

Appendix

Table 5: Definitions of auxiliary visibility-related quantities.

Robust Watermarking

Robust watermarking embeds or verifies ownership and provenance signals that survive editing, compression, model changes, and deliberate removal.

See all 208 papers

Deepfake Forensics Adapter: A Dual-Stream Network for Generalizable Deepfake Detection
Mar 2, 2026Jianfeng Liao, Yichen Wei, Raymond Chan Ching Bon +3Deepfake Detection Digital Image Forensics
Shenzhen Technology University, Guangdong, China · Singapore Institute of Technology, Singapore, Singapore · The University of Hong Kong, Hong Kong, China +1
Stop My Dancing! Understanding, Detecting and Attributing Motion-Aware Deepfake Videos
Oct 8, 2026Fazhong Liu, Yan Meng, Tian Dong +2Deepfake Detection Digital Forensics
Shanghai Jiao Tong University, Shanghai, China
Detecting Temporally Localized Manipulations in Authentic Video Streams
Jun 5, 2026Okan Umur, Ali Emre Güşlü, Ibrahim DelibasogluDeepfake Detection Temporal Video Forgery Localization
Department of Software Engineering Sakarya University Sakarya, Türkiye

Mar 2, 2026J/K move · Enter open · S save

Deepfake Forensics Adapter: A Dual-Stream Network for Generalizable Deepfake Detection

Jianfeng Liao, Yichen Wei, Raymond Chan Ching Bon, Shulan Wang+2

Shenzhen Technology University, Guangdong, China · Singapore Institute of Technology, Singapore, Singapore · The University of Hong Kong, Hong Kong, China+1

Deepfake Detection Digital Image Forensics VLM Adaptation

Open paper AskPDF arXiv

The rapid advancement of deepfake generation techniques poses significant threats to public safety and causes societal harm through the creation of highly realistic synthetic facial media. While existing detection methods demonstrate limitations in generalizing to emerging forgery patterns, this paper presents Deepfake Forensics Adapter (DFA), a novel dual-stream framework that synergizes vision-language foundation models with targeted forensics analysis. Our approach integrates a pre-trained CLIP model with three core components to achieve specialized deepfake detection by leveraging the powerful general capabilities of CLIP without changing CLIP parameters: 1) A Global Feature Adapter is used to identify global inconsistencies in image content that may indicate forgery, 2) A Local Anomaly Stream enhances the model's ability to perceive local facial forgery cues by explicitly leveraging facial structure priors, and 3) An Interactive Fusion Classifier promotes deep interaction and fusion between global and local features using a transformer encoder. Extensive evaluations of frame-level and video-level benchmarks demonstrate the superior generalization capabilities of DFA, particularly achieving state-of-the-art performance in the challenging DFDC dataset with frame-level AUC/EER of 0.816/0.256 and video-level AUC/EER of 0.836/0.251, representing a 4.8% video AUC improvement over previous methods. Our framework not only demonstrates state-of-the-art performance, but also points out a feasible and effective direction for developing a robust deepfake detection system with enhanced generalization capabilities against the evolving deepfake threats. Our code is available at https://github.com/Liao330/DFA.git

Abstract

Robust Watermarking

Explore similar work

Deepfake Forensics Adapter: A Dual-Stream Network for Generalizable Deepfake Detection

Stop My Dancing! Understanding, Detecting and Attributing Motion-Aware Deepfake Videos

Detecting Temporally Localized Manipulations in Authentic Video Streams