cs.CVAug 26, 2026

Data Diversity, Not Frequency Invariance: A Controlled and Self-Audited Study of Compression-Robust Deepfake Detection

Authors: Abbas Aliyev, Samir Rustamov

Organizations: ADA University, Baku, Azerbaijan · MegaSec AI Company, Baku, Azerbaijan

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Frequency features and compression-invariant representation learning are widely assumed to be key to deepfake detection that survives video compression. We test this with CAFRL - block-DCT and FFT-phase streams, compression-level-conditioned band attention, and adversarial (gradient-reversal) compression invariance - and report a controlled negative. Under a pre-registered protocol with capacity- and augmentation-matched controls, a plain EfficientNet-B0 on multi-quality data beat CAFRL as specified at every compression level on the FaceForensics++ test split, by 3.66 AUC points at CRF 40 (paired, single seed). A self-audit of our own negative found four defects biased against the frequency hypothesis, and pre-specified re-tests repairing all four showed the deficit to be a recipe artifact, not an architecture failure: the baseline recipe recovered 3.96 points over the matching shipped-recipe variant. The frequency path made no detectable difference: discriminative alone (standalone validation AUC 0.91-0.98 late in training) but of no marginal value under this fusion, at two feature widths of one 4.0 M trunk, every seed-pooled interval for the intra-dataset compression contrasts including zero; on the single held-out manipulation tested, the fair variants sat below the plain backbone. The adversarial branch, as specified, added nothing and degraded its own conditioning estimator; at the fair recipe it is untested. Robustness under single-pass H.264 re-encoding came instead from data diversity: real constant-rate-factor variants beat synthetic JPEG augmentation by 7.3 points (single runs, non-overlapping intervals). The evidence is FaceForensics++-family, GAN-era and single-codec. Match controls on training recipe as well as capacity, and buy compression robustness with codec diversity before architecture.

Figures & tables

Figure 1: CAFRL as specified. Solid arrows: forward data flow; dashed arrows: FiLM conditioning from the compression estimator’s embedding qembq_{\mathrm{emb}} . The discriminator sees only the frequency representation zfreqz_{\mathrm{freq}} (the spatial stream is excluded), so the adversarial gradient routes to the frequency path alone.
armarchitectureparamsrecipeseedsreported inreleased run id
SpatialBaseEfficientNet-B0; no frequency streams — the capacity-matched control4.0 Mfair3Tables 2 , 3 , 4 , 6 , 8 – 11 ; Fig. 2 (a,b)b7_effnet_b0_mq_fliponly (_s1, _s2)
CAFRL as specifiedfull CAFRL: block-DCT ++ FFT-phase streams, conditioned band gate, CMAM fusion, GRL11.97 Mshipped3Tables 2 , 4 , 9 , 10 ; Fig. 2 (a)a0 , a1_grl_s1 , a1_grl_s2
CAFRL −- advCAFRL minus the adversarial branch10.65 Mshipped1§ 5.3 , Tables 3 , 4 ; Fig. 2 (a)a1_none_s42
spatial-residualCAFRL’s narrow trunk with logit == spatial + γ⋅+\,\gamma\cdot frequency, γ\gamma zero-initialized10.29 Mshipped1§ 5.3 , Tables 3 , 4 ; Fig. 2 (a)cafrl_spatres_s42
TrunkCtrlCAFRL’s 320 →\rightarrow 256 spatial trunk alone; no frequency3.68 Mfair3§ 7.1 , Tables 3 , 4 , 6 ; Fig. 2 (b)trunk_recipe_s42/_s1/_s2
Fair-Nnarrow trunk ++ the full frequency stack, adversary off10.65 Mfair3§ 7.1 , Tables 3 , 4 , 6 , 9 , 11 ; Fig. 2 (b)f1_none_fair_s42/_s1/_s2
Table 1: Notation — every arm this paper compares, and the crosswalk to the release. Shipped is CAFRL’s as-specified recipe, fair the baseline recipe applied symmetrically (Sections 3 , 4 ); “seeds” counts the runs behind the reported cells (42, 1, 2). Parameter counts are the model as trained here, with the ImageNet 1000-way head replaced by a single logit — hence 4.0 M for EfficientNet-B0 rather than 5.3 M, 20.8 M for Xception rather than 22.9 M — and include every trained parameter, among them the 1.32 M discriminator CAFRL discards at inference (10.65 M deployed). The last column is the only name the artifact repository uses.
modelparamsc23c40AUCcomp\mathrm{AUC}_{\mathrm{comp}}
SpatialBase4.0 M.9867.9590.9709
CAFRL as specified11.97 M.9738.9224.9477
Xception-mq20.8 M.9872.9679.9765
Table 2: The STOP-gate comparison (video-AUC, FF++ test). Every row is a single run at seed 42 — the arms exactly as the pre-registered gate adjudicated them.
Figure 2: Video-AUC across compression levels (FF++ test, 700 videos per level). (a) The shipped-recipe falsification at seed 42 — the arms as the STOP-gate adjudicated them, matching Tables 2 and 4 cell for cell; the annotated c40 gap is the adjudicated paired contrast +0.0366+0.0366 (the two further shipped-CAFRL seeds lie within 0.002 of the plotted curve at c40). (b) The fair-recipe re-tests, plotted as 3-seed means with 95% tt -bands ( 4.30 s/34.30\,s/\sqrt{3} , k=3k{=}3 ), so its SpatialBase point at c40 is the 3-seed mean 0.9565 rather than Table 4 ’s seed-42 value 0.9590. Appendix A prints the per-seed values at c40 and AUCcomp\mathrm{AUC}_{\mathrm{comp}} ; panel (b)’s remaining levels are 3-seed means that appear in no printed cell and are in the release, the one place this paper departs from its rule that every plotted point is a printed one.
Figure 3: Campaign flow: frozen decision rules →\rightarrow STOP-gate falsification →\rightarrow adversarial self-audit →\rightarrow fair re-tests →\rightarrow seed confirmation. Every decision rule was frozen before the run it governed; the fired gate halted the planned ablation campaign (incl. a GRL-vs-HSIC [ 20 ] bake-off) on a falsified thesis.
Figure 4: The redundancy mechanism (Fair-W; all three seeds, seed 42 in the foreground). (a) The γ\gamma deadlock is broken: the residual weight grows to 0.146 by epoch 6 and decays to 0.031 by epoch 30, against the shipped-recipe probe (dashed), which falls from 0.135 to 0.003 across the curriculum shock at epochs 11–12. The vertical line is the selected checkpoint (seed 42, epoch 5, γ=0.140\gamma=0.140 ; seeds 1 and 2 select 6 and 7). (b) The standalone frequency head (3-seed mean; band == per-epoch min–max) plateaus at 0.91–0.98 validation AUC over the second half of training, from 0.71/0.81 (c40/c23) at epoch 1 and 0.85/0.97 at the selected checkpoint: its output is discriminative, including at c40, yet adds nothing over the trunk. What it exploits was not isolated to frequency — no matched pixel-domain control was trained.
contrast @ c40Δ\Delta95% CIruleverdict
SpatialBase −- CAFRL as specified (s42)+0.0366+0.0366[+0.020, +0.054]pre-registeredsignificant — the gate fires
Fair-N −- CAFRL −- adv (s42)+0.0396+0.0396[+0.0231, +0.0570]pre-specifiedsignificant — the deficit was recipe
Fair-N −- SpatialBase (s42)−0.0004-0.0004[-0.0092, +0.0080]pre-specifiedno detectable difference
Fair-W −- SpatialBase (s42)+0.0056+0.0056[-0.0022, +0.0134]pre-specifiedno detectable difference (lean, P=0.93P{=}0.93 )
Fair-N pool −- SpatialBase pool (3v3)−0.0010\mathbf{-0.0010}[-0.0066, +0.0045]pre-specifiedno detectable difference; equivalent within ±1\pm 1 pt
Fair-W pool −- SpatialBase pool (3v3)+0.0022\mathbf{+0.0022}[-0.0035, +0.0080]pre-specifiedno detectable difference; equivalent within ±1\pm 1 pt unadjusted (does not survive adjustment over the confirmatory family; App. E )
Table 3: The adjudicated contrasts at c40 (10,000-replicate paired video bootstrap, 700 videos). All eight rows are confirmatory, at the grade of provenance the rule column names (Section 4 ). “s42” is that arm’s frozen seed-42 run; “pool” averages an arm’s per-video scores over its three seeds before the bootstrap, so pooled intervals are conditional on those seeds. “No detectable difference” is bounded by this design’s resolution (Section 4 ). The last two rows are deliberately asymmetric, as the trunk-recipe control’s pre-specified rule required; pooling SpatialBase’s seeds there moves the architecture-share estimate to about +0.002+0.002 and changes no verdict. Appendix E re-runs every row with the seeds resampled and at four cluster-level units.
run (recipe)c0c18c23c28c32c36c40AUCcomp\mathrm{AUC}_{\mathrm{comp}}
SpatialBase (fair, s42).9919.9892.9867.9810.9758.9678.9590.9709
Fair-W (fair, s42).9929.9902.9894.9821.9774.9719.9645.9740
Fair-N (fair, s42).9941.9901.9881.9798.9770.9702.9586.9714
TrunkCtrl (fair, 3-seed mean).9920.9886.9863.9796.9719.9644.9536.9674
CAFRL as specified (shipped, s42).9843.9791.9738.9659.9572.9451.9224.9477
CAFRL −- adv (shipped, s42).9923.9818.9697.9590.9484.9311.9190.9394
Table 4: CRF sweep, all key arms (video-AUC, FF++ test). Every row is a single run at seed 42 except TrunkCtrl, which is the mean of its three seeds. Fig. 2 (a) plots the SpatialBase row and the three shipped-recipe rows as printed here; Fig. 2 (b) plots SpatialBase, Fair-N, Fair-W and TrunkCtrl as 3-seed means, so its curves sit slightly off the seed-42 rows below (per-seed values in Appendix A ). “fair” == the plain baseline recipe (flat curriculum, uniform lr 2×10−42{\times}10^{-4} , flip-only, 30 epochs, zero invariance losses); “shipped” == CAFRL’s as-specified recipe. c18 is an eval-only level (never trained on).
workdata-matched? (and against which baseline)capacity-matched?plain backbone on the same diverse data?
Cao et al. [ 4 ]no — against a single Xception trained at one compression level while the method trains on paired c23/c40 (Tab. 3, whose train/test compression columns show it)no at training (two branches ++ a discriminator; only the LQ branch runs at test, §3.1); no counts reportednever run (Tab. 3 rows 1–4 are all single-level)
Ma et al. [ 5 ]yes against the single-model competitors FBCNN and QGAC (Tab. I column groups; §IV-A-1 matches the JPEG encoder)no — 109.9 M vs FBCNN’s 71.9 M (Tab. III)yes — Tab. V’s “Baseline” column (base encoder ++ guided decoder only), same quality-factor pool
PLADA [ 6 ]asserted for all nine (§4.1) — but Tabs. 1 and 3 mark six of the nine †\dagger , i.e. taken from prior work rather than retrainedno — “more optimization parameters than Ojha” (§4.2); no counts reportedpartly — Fig. 7(a)’s ablation origin is a retrained CLIP linear probe, not a plain-trunk control
F3-Net [ 10 ]yes within each quality level, against Xception ( ++ ELA, ++ PAFilters) (Tab. 1); no multi-quality training exists — §4.1 describes one level per runno — two Xception branches ++ cross-attention, no counts reported; fair only in the FAD-internal ablation (Tab. 3), where the gain falls to +0.014+0.014 AUCnot applicable — no diverse-data regime
SPSL [ 11 ]yes within each quality level, against a reproduced Xception and ResNet-34/50 (Tab. 2, §4.2.1; Tab. 7); no multi-quality training existsyes by construction — only Xception blocks 1–3 and 12 are retained (§4.1); no counts reportednot applicable — no diverse-data regime
Luo et al. [ 13 ]yes but at one fixed quality — FF++ HQ throughout (§5.1), against an author-trained Xception and Face X-ray (Tabs. 4–5); no compression-diverse training existsno — two Xception streams ++ attention fusion vs one Xception; no counts reportednever run on diverse data — the plain-Xception row exists (Tab. 3) but only at fixed HQ
Table 5: Control audit of the published positives. “Data-matched” asks whether the baseline each work compares against — named in the same cell — saw the same compression-diverse training data as the proposed method; “capacity-matched” whether it had comparable size. Read from each work’s own experimental section, with the table or section each reading comes from named in the cell. Ma et al. is a JPEG artifact reduction method (PSNR/SSIM, not detection) and is included because its mechanism is the compression-sensitivity decoupling this literature borrows; it is also the only one of the six that runs the control this paper argues for, and the only one that reports parameter counts at all. DANet-ATP [ 17 ] , cited in Section 2 as the closest mechanism twin, is an audio detector (ASVspoof, EER, codec classes) and shares no benchmark, metric or modality with a video face-forgery control audit, so it is out of scope here.
Appendix figures & tables6 assets

Supplementary material from the paper’s appendix.

Appendix

armc40 per-seed (s42 / s1 / s2)c40 seed-mean ±\pm bandAUCcomp\mathrm{AUC}_{\mathrm{comp}} seed-mean
SpatialBase.9590 / .9614 / .9492.9565 ±\pm .0160.9688
Fair-N.9586 / .9567 / .9536.9563 ±\pm .0062.9675
Fair-W.9645 / .9602 / .9609.9619 ±\pm .0058.9719
TrunkCtrl.9491 / .9566 / .9551.9536 ±\pm .0098.9674
Appendix
Table 6: Per-seed c40 video-AUC and 3-seed bands ( n=3n{=}3 seeds per arm — 42, 1, 2; band =4.30 s/3=4.30\,s/\sqrt{3} , the 95% tt -band for k=3k{=}3 ). Descriptively, both fair CAFRL variants varied less across seeds than the plain backbone; with three seeds per arm that difference is not tested. Fair-W’s +0.54+0.54 pt seed-mean lean is smaller than this design’s resolution and its pooled contrast includes zero. TrunkCtrl — CAFRL’s narrow trunk alone at the fair recipe — is listed for the architecture-share decomposition of Section 7.1 , which uses its 3-seed pool.
defectwhy it matteredrepaired/resolved by
D1 — the L1 consistency loss ran 40–120 ×\times the classification loss at the curriculum’s compressed-phase onset, in every arm (including CAFRL −- adv)no arm ever trained its frequency features free of invariance pressure; the inference “not the GRL ⇒\Rightarrow frequency itself” was voidFair-N (zero invariance losses, flat curriculum). Confirmed as principal cause : +3.96+3.96 pt recovered at c40 (Fair-N vs. CAFRL −- adv, seed 42), significant
D2 — γ→0\gamma\rightarrow 0 in the residual probe was a curriculum-shock collapse locked in by a structural deadlock: at γ=0\gamma{=}0 the frequency path receives zero label gradientthe probe could not detect a useful frequency signal even if present; “the model freely discards frequency” was unfoundedFair-W (auxiliary BCE gives the frequency path label gradient regardless of γ\gamma ). Deadlock broken : γ\gamma grows to 0.146, decaying to 0.031 by epoch 30 rather than collapsing
D3 — optimization never matched: baseline full fine-tune at 2×10−42{\times}10^{-4} from epoch 1 vs CAFRL’s 20 ×\times lower backbone LR, 10-epoch freeze, heavy data deferred to the LR tailpart of the deficit was recipe, not architectureTrunkCtrl ++ Fair-N. Confirmed : the 0.0451 trunk gap splits ≈88%{\approx}88\% / ≈12%{\approx}12\% recipe/architecture as a point estimate (Section 7.1 ), and only the recipe share’s interval excludes zero; the fair recipe erases the model-level deficit
D4 — CAFRL’s spatial path taps an intermediate 320-channel map (256-d projection), discarding the backbone’s final 1280-d representationevery CAFRL-with-frequency variant carried a handicapped spatial trunkTrunkCtrl ++ Fair-W. Closed — no detectable width penalty : the adjudicated width contrast is −0.0038-0.0038 , CI [-0.0116, +0.0039] (Table 3 ), and the frequency path on the full trunk still makes no detectable difference
D5 — split-BatchNorm evaluation forces the clean branch at eval (train/eval routing mismatch)could have distorted compressed-level evaluationeval-only routing probe. Retired — immaterial : oracle-routing c40 Δ≤0\Delta\leq 0 on both probed arms (the clean eval mildly flattered CAFRL)
D6 — the GRL silently degraded its own conditioning estimator: ±\pm 1-bin accuracy 0.88→≈0.40.88\rightarrow{\approx}0.4 under the adversary (healthy ≈1.0{\approx}1.0 without it)the “compression-aware conditioning” mechanism was self-defeating as configured (“condition-then-remove”)four-way control pattern across arms; estimator-health warning ( ±\pm 1-bin <0.7<0.7 ) added to the training diagnostics
Appendix
Table 7: The D1–D8 audit ledger. “Repaired/resolved by” names the pre-specified re-test (or documentation fix) that closed each defect.
modelprot.augparamsc23c28c32c36c40AUCcomp\mathrm{AUC}_{\mathrm{comp}}
Xceptionlitstd20.8 M.9944.9890.9778.9280.8660.9402
F3-Netlitstd21.0 M.9917.9835.9654.9210.8599.9325
FreqNetlitstd5.1 M.9877.9652.9274.8541.7684.8788
Xception-mqmqstd20.8 M.9872.9838.9803.9739.9679.9765
Xception-mqmqflip20.8 M.9869.9820.9772.9691.9631.9728
F3-Net-mqmqstd21.0 M.9885.9831.9766.9683.9551.9708
Appendix
Table 8: Harmonized baseline benchmark (video-AUC, FF++ official test split, 700 videos per level, single runs at seed 42) — the object behind contribution C4. “lit” == the literature protocol (c23-trained), “mq” == multi-CRF training; “aug” is std , the standard policy described above, or flip , horizontal flip only. Parameter counts follow Table 1 ’s convention. All rows are descriptive and none enters the confirmatory family. c0 and c18 are omitted for space (every row is at or near ceiling there); the complete seven-level sweep with per-cell marginal intervals is released as evaluation/BENCHMARK.md .
modelCeleb-DF v2DFD-c23DFD-c40
3-seed mean ±\pm 95% tt -band ( k=3k{=}3 )
CAFRL as specified0.705 ±\pm 0.0510.819 ±\pm 0.0400.635 ±\pm 0.035
SpatialBase0.686 ±\pm 0.0350.825 ±\pm 0.0540.650 ±\pm 0.031
Fair-N0.647 ±\pm 0.1700.792 ±\pm 0.0950.659 ±\pm 0.073
Fair-W0.681 ±\pm 0.0480.835 ±\pm 0.0570.664 ±\pm 0.054
single run, seed 42 — not replicated
Appendix
Table 9: Out-of-distribution evaluation (video-AUC; n=518n{=}518 Celeb-DF v2, n=3,431n{=}3{,}431 DFD). Upper block: 3-seed mean ±\pm the 95% tt -band ( 4.30 s/34.30\,s/\sqrt{3} , k=3k{=}3 ). Lower block: Xception-mq, one seed. Per-cell marginal intervals (widths 0.02–0.05) and the seed-42 values are in the released summaries and claims map. These cells were stored as summary statistics without per-video scores, so no paired contrast is computable for any of them : unlike every FF++ contrast here they cannot be adjudicated, and are reported descriptively. TrunkCtrl was not evaluated out of distribution.
levelCAFRL as spec.SpatialBasepaired Δ\Delta95% CIP(Δ>0)P(\Delta{>}0)
c230.8220.823−0.008-0.008[-0.041, +0.025]0.30
c400.7580.732+0.022+0.022[-0.021, +0.064]0.84
Appendix
Table 10: FaceShifter (held out), shipped recipe, seed-pooled (3 seeds each arm; 10k paired video bootstrap).
contrast @ c40Δ\Delta95% CI (video)95% CI (identity clusters)
SpatialBase −- CAFRL as specified (s42)+0.0366+0.0366[+0.0205, +0.0538][+0.0182, +0.0569]
Fair-N −- CAFRL −- adv (s42)+0.0396+0.0396[+0.0231, +0.0570][+0.0222, +0.0580]
Fair-N pool −- SpatialBase pool (3v3)−0.0010-0.0010[-0.0066, +0.0045][-0.0064, +0.0046]
Fair-W pool −- SpatialBase pool (3v3)+0.0022+0.0022[-0.0035, +0.0080][-0.0042, +0.0085]
TrunkCtrl pool −- spatial-residual (s42)+0.0490+0.0490[+0.0294, +0.0705][+0.0296, +0.0715]
FaceShifter, held out ( n=280n{=}280 )
Appendix
Table 11: The contrasts whose clustered interval the text relies on, at two resampling units: the published one (each evaluated video an independent draw) and the source-identity cluster (140 clusters of five for FF++, 140 of two for FaceShifter, resampled whole). 10,000 paired replicates, percentile intervals, identical seeds. All twelve adjudicated contrasts were run at all five units — the video plus the four cluster definitions defined above — and behave the same way; every endpoint is in the released evaluation/analysis/ output. The target-identity and identity-pair definitions give intervals inside the span of the two shown; on the FaceShifter set the base-video definition degenerates to the video unit (280 singleton clusters), so it is not an independent unit there. No verdict changes under any of them.
More in this topic

Deepfake Detection

Deepfake detection identifies manipulated or AI-generated media to support trustworthy communication, identity verification, and forensic analysis.

See all 241 papers

Explore similar work

CardsList
Apr 13, 2026

Curvelet-Based Frequency-Aware Feature Enhancement for Deepfake Detection

The proliferation of sophisticated generative models has significantly advanced the realism of synthetic facial content, known as deepfakes, raising serious concerns about digital trust. Although modern deep learning-based detectors perform well, many rely on spatial-domain features that degrade under compression. This limitation has prompted a shift toward integrating frequency-domain representations with deep learning to improve robustness. Prior research has explored frequency transforms such as Discrete Cosine Transform (DCT), Fast Fourier Transform (FFT), and Wavelet Transform, among others. However, to the best of our knowledge, the Curvelet Transform, despite its superior directional and multiscale properties, remains entirely unexplored in the context of deepfake detection. In this work, we introduce a novel Curvelet-based detection approach that enhances feature quality through wedge-level attention and scale-aware spatial masking, both trained to selectively emphasize discriminative frequency components. The refined frequency cues are reconstructed and passed to a modified pretrained Xception network for classification. Evaluated on two compression qualities in the challenging FaceForensics++ dataset, our method achieves 98.48% accuracy and 99.96% AUC on FF++ low compression, while maintaining strong performance under high compression, demonstrating the efficacy and interpretability of Curvelet-informed forgery detection.

Salar Adel Sabri, Ramadhan J. Mstafa

Department of Computer Science, College of Science, University of Zakho, Zakho, Kurdistan Region, Iraq. · PRIME Lab, Scientific Research Center, University of Zakho, Zakho, Kurdistan Region, Iraq.

Deepfake DetectionFrequency-Domain Feature Learning
AskPDF
Apr 28, 2026

Robust Deepfake Detection: Mitigating Spatial Attention Drift via Calibrated Complementary Ensembles

Current deepfake detection models achieve state-of-the-art performance on pristine academic datasets but suffer severe spatial attention drift under real-world compound degradations, such as blurring and severe lossy compression. To address this vulnerability, we propose a foundation-driven forensic framework that integrates an extreme compound degradation engine with a structurally constrained, multi-stream architecture. During training, our degradation pipeline systematically destroys high-frequency artifacts, optimizing the DINOv2-Giant backbone to extract invariant geometric and semantic priors. We then process images through three specialized pathways: a Global Texture stream, a Localized Facial stream, and a Hybrid Semantic Fusion stream incorporating CLIP. Through analyzing spatial attribution via Score-CAM and feature stability using Cosine Similarity, we quantitatively demonstrate that these streams extract non-redundant, complementary feature representations and stabilize attention entropy. By aggregating these predictions via a calibrated, discretized voting mechanism, our ensemble successfully suppresses background attention drift while acting as a robust geometric anchor. Our approach yields highly stable zero-shot generalization, achieving Fourth Place in the NTIRE 2026 Robust Deepfake Detection Challenge at CVPR. Code is available at https://github.com/khoalephanminh/ntire26-deepfake-challenge.

Minh-Khoa Le-Phan, Minh-Hoang Le, Trong-Le Do +1

University of Science, VNU-HCM, Ho Chi Minh City, Vietnam · Vietnam National University, Ho Chi Minh City, Vietnam

Image Corruption RobustnessDeep EnsemblesDeepfake Detection
AskPDF
Jun 3, 2026

Toward Calibrated, Fair, and accurate Deepfake Detection

Deepfake detectors show large performance gaps across demographic groups. Existing fairness approaches require demographic labels, retraining, or sacrifice accuracy. We introduce Face-Fairness (FF), a plug-and-play framework for bias mitigation. Our primary contribution, Face-Feature Tuning (FFT), is the first demographic label-free fairness method demonstrated for deepfake detection: a lightweight calibrator that performs a logit remapping conditioned on frozen face embeddings. We complement FFT with two variants: FF-Max, which maximizes worst-group accuracy when demographics are available, and FF-Discover, which does the same with embedding-discovered groups. Across in-domain and cross-dataset test settings, FF consistently reduces FPR/TPR gaps and improves minimum group accuracy while maintaining (often improving) overall accuracy. The approach is detector-agnostic, adds negligible runtime overhead, and requires no access to identity attributes.

Ryan Brown, Chris Russell

University of Oxford

Algorithmic FairnessDeepfake DetectionModel Calibration
AskPDF