Data Diversity, Not Frequency Invariance: A Controlled and Self-Audited Study of Compression-Robust Deepfake Detection

Abbas Aliyev; Samir Rustamov

cs.CVAug 26, 2026

Data Diversity, Not Frequency Invariance: A Controlled and Self-Audited Study of Compression-Robust Deepfake Detection

Authors: Abbas Aliyev, Samir Rustamov

Organizations: ADA University, Baku, Azerbaijan · MegaSec AI Company, Baku, Azerbaijan

Abstract

Frequency features and compression-invariant representation learning are widely assumed to be key to deepfake detection that survives video compression. We test this with CAFRL - block-DCT and FFT-phase streams, compression-level-conditioned band attention, and adversarial (gradient-reversal) compression invariance - and report a controlled negative. Under a pre-registered protocol with capacity- and augmentation-matched controls, a plain EfficientNet-B0 on multi-quality data beat CAFRL as specified at every compression level on the FaceForensics++ test split, by 3.66 AUC points at CRF 40 (paired, single seed). A self-audit of our own negative found four defects biased against the frequency hypothesis, and pre-specified re-tests repairing all four showed the deficit to be a recipe artifact, not an architecture failure: the baseline recipe recovered 3.96 points over the matching shipped-recipe variant. The frequency path made no detectable difference: discriminative alone (standalone validation AUC 0.91-0.98 late in training) but of no marginal value under this fusion, at two feature widths of one 4.0 M trunk, every seed-pooled interval for the intra-dataset compression contrasts including zero; on the single held-out manipulation tested, the fair variants sat below the plain backbone. The adversarial branch, as specified, added nothing and degraded its own conditioning estimator; at the fair recipe it is untested. Robustness under single-pass H.264 re-encoding came instead from data diversity: real constant-rate-factor variants beat synthetic JPEG augmentation by 7.3 points (single runs, non-overlapping intervals). The evidence is FaceForensics++-family, GAN-era and single-codec. Match controls on training recipe as well as capacity, and buy compression robustness with codec diversity before architecture.

Figures & tables

Figure 1: CAFRL as specified. Solid arrows: forward data flow; dashed arrows: FiLM conditioning from the compression estimator’s embedding

q_{\mathrm{emb}}

. The discriminator sees only the frequency representation

z_{\mathrm{freq}}

(the spatial stream is excluded), so the adversarial gradient routes to the frequency path alone.

arm	architecture	params	recipe	seeds	reported in	released run id
SpatialBase	EfficientNet-B0; no frequency streams — the capacity-matched control	4.0 M	fair	3	Tables 2 , 3 , 4 , 6 , 8 – 11 ; Fig. 2 (a,b)	b7_effnet_b0_mq_fliponly (_s1, _s2)
CAFRL as specified	full CAFRL: block-DCT $+$ FFT-phase streams, conditioned band gate, CMAM fusion, GRL	11.97 M	shipped	3	Tables 2 , 4 , 9 , 10 ; Fig. 2 (a)	a0 , a1_grl_s1 , a1_grl_s2
CAFRL $-$ adv	CAFRL minus the adversarial branch	10.65 M	shipped	1	§ 5.3 , Tables 3 , 4 ; Fig. 2 (a)	a1_none_s42
spatial-residual	CAFRL’s narrow trunk with logit $=$ spatial $+\,\gamma\cdot$ frequency, $\gamma$ zero-initialized	10.29 M	shipped	1	§ 5.3 , Tables 3 , 4 ; Fig. 2 (a)	cafrl_spatres_s42
TrunkCtrl	CAFRL’s 320 $\rightarrow$ 256 spatial trunk alone; no frequency	3.68 M	fair	3	§ 7.1 , Tables 3 , 4 , 6 ; Fig. 2 (b)	trunk_recipe_s42/_s1/_s2
Fair-N	narrow trunk $+$ the full frequency stack, adversary off	10.65 M	fair	3	§ 7.1 , Tables 3 , 4 , 6 , 9 , 11 ; Fig. 2 (b)	f1_none_fair_s42/_s1/_s2

Table 1: Notation — every arm this paper compares, and the crosswalk to the release. Shipped is CAFRL’s as-specified recipe, fair the baseline recipe applied symmetrically (Sections 3 , 4 ); “seeds” counts the runs behind the reported cells (42, 1, 2). Parameter counts are the model as trained here, with the ImageNet 1000-way head replaced by a single logit — hence 4.0 M for EfficientNet-B0 rather than 5.3 M, 20.8 M for Xception rather than 22.9 M — and include every trained parameter, among them the 1.32 M discriminator CAFRL discards at inference (10.65 M deployed). The last column is the only name the artifact repository uses.

model	params	c23	c40	$\mathrm{AUC}_{\mathrm{comp}}$
SpatialBase	4.0 M	.9867	.9590	.9709
CAFRL as specified	11.97 M	.9738	.9224	.9477
Xception-mq	20.8 M	.9872	.9679	.9765

Table 2: The STOP-gate comparison (video-AUC, FF++ test). Every row is a single run at seed 42 — the arms exactly as the pre-registered gate adjudicated them.

Figure 2: Video-AUC across compression levels (FF++ test, 700 videos per level). (a) The shipped-recipe falsification at seed 42 — the arms as the STOP-gate adjudicated them, matching Tables 2 and 4 cell for cell; the annotated c40 gap is the adjudicated paired contrast

+0.0366

(the two further shipped-CAFRL seeds lie within 0.002 of the plotted curve at c40). (b) The fair-recipe re-tests, plotted as 3-seed means with 95%

t

-bands (

4.30\,s/\sqrt{3}

k{=}3

), so its SpatialBase point at c40 is the 3-seed mean 0.9565 rather than Table 4 ’s seed-42 value 0.9590. Appendix A prints the per-seed values at c40 and

\mathrm{AUC}_{\mathrm{comp}}

; panel (b)’s remaining levels are 3-seed means that appear in no printed cell and are in the release, the one place this paper departs from its rule that every plotted point is a printed one.

Figure 3: Campaign flow: frozen decision rules

\rightarrow

STOP-gate falsification

\rightarrow

adversarial self-audit

\rightarrow

fair re-tests

\rightarrow

seed confirmation. Every decision rule was frozen before the run it governed; the fired gate halted the planned ablation campaign (incl. a GRL-vs-HSIC [ 20 ] bake-off) on a falsified thesis.

Figure 4: The redundancy mechanism (Fair-W; all three seeds, seed 42 in the foreground). (a) The

\gamma

deadlock is broken: the residual weight grows to 0.146 by epoch 6 and decays to 0.031 by epoch 30, against the shipped-recipe probe (dashed), which falls from 0.135 to 0.003 across the curriculum shock at epochs 11–12. The vertical line is the selected checkpoint (seed 42, epoch 5,

\gamma=0.140

; seeds 1 and 2 select 6 and 7). (b) The standalone frequency head (3-seed mean; band

=

per-epoch min–max) plateaus at 0.91–0.98 validation AUC over the second half of training, from 0.71/0.81 (c40/c23) at epoch 1 and 0.85/0.97 at the selected checkpoint: its output is discriminative, including at c40, yet adds nothing over the trunk. What it exploits was not isolated to frequency — no matched pixel-domain control was trained.

contrast @ c40	$\Delta$	95% CI	rule	verdict
SpatialBase $-$ CAFRL as specified (s42)	$+0.0366$	[+0.020, +0.054]	pre-registered	significant — the gate fires
Fair-N $-$ CAFRL $-$ adv (s42)	$+0.0396$	[+0.0231, +0.0570]	pre-specified	significant — the deficit was recipe
Fair-N $-$ SpatialBase (s42)	$-0.0004$	[-0.0092, +0.0080]	pre-specified	no detectable difference
Fair-W $-$ SpatialBase (s42)	$+0.0056$	[-0.0022, +0.0134]	pre-specified	no detectable difference (lean, $P{=}0.93$ )
Fair-N pool $-$ SpatialBase pool (3v3)	$\mathbf{-0.0010}$	[-0.0066, +0.0045]	pre-specified	no detectable difference; equivalent within $\pm 1$ pt
Fair-W pool $-$ SpatialBase pool (3v3)	$\mathbf{+0.0022}$	[-0.0035, +0.0080]	pre-specified	no detectable difference; equivalent within $\pm 1$ pt unadjusted (does not survive adjustment over the confirmatory family; App. E )

Table 3: The adjudicated contrasts at c40 (10,000-replicate paired video bootstrap, 700 videos). All eight rows are confirmatory, at the grade of provenance the rule column names (Section 4 ). “s42” is that arm’s frozen seed-42 run; “pool” averages an arm’s per-video scores over its three seeds before the bootstrap, so pooled intervals are conditional on those seeds. “No detectable difference” is bounded by this design’s resolution (Section 4 ). The last two rows are deliberately asymmetric, as the trunk-recipe control’s pre-specified rule required; pooling SpatialBase’s seeds there moves the architecture-share estimate to about

+0.002

and changes no verdict. Appendix E re-runs every row with the seeds resampled and at four cluster-level units.

run (recipe)	c0	c18	c23	c28	c32	c36	c40	$\mathrm{AUC}_{\mathrm{comp}}$
SpatialBase (fair, s42)	.9919	.9892	.9867	.9810	.9758	.9678	.9590	.9709
Fair-W (fair, s42)	.9929	.9902	.9894	.9821	.9774	.9719	.9645	.9740
Fair-N (fair, s42)	.9941	.9901	.9881	.9798	.9770	.9702	.9586	.9714
TrunkCtrl (fair, 3-seed mean)	.9920	.9886	.9863	.9796	.9719	.9644	.9536	.9674
CAFRL as specified (shipped, s42)	.9843	.9791	.9738	.9659	.9572	.9451	.9224	.9477
CAFRL $-$ adv (shipped, s42)	.9923	.9818	.9697	.9590	.9484	.9311	.9190	.9394

Table 4: CRF sweep, all key arms (video-AUC, FF++ test). Every row is a single run at seed 42 except TrunkCtrl, which is the mean of its three seeds. Fig. 2 (a) plots the SpatialBase row and the three shipped-recipe rows as printed here; Fig. 2 (b) plots SpatialBase, Fair-N, Fair-W and TrunkCtrl as 3-seed means, so its curves sit slightly off the seed-42 rows below (per-seed values in Appendix A ). “fair”

=

the plain baseline recipe (flat curriculum, uniform lr

2{\times}10^{-4}

, flip-only, 30 epochs, zero invariance losses); “shipped”

=

CAFRL’s as-specified recipe. c18 is an eval-only level (never trained on).

work	data-matched? (and against which baseline)	capacity-matched?	plain backbone on the same diverse data?
Cao et al. [ 4 ]	no — against a single Xception trained at one compression level while the method trains on paired c23/c40 (Tab. 3, whose train/test compression columns show it)	no at training (two branches $+$ a discriminator; only the LQ branch runs at test, §3.1); no counts reported	never run (Tab. 3 rows 1–4 are all single-level)
Ma et al. [ 5 ]	yes against the single-model competitors FBCNN and QGAC (Tab. I column groups; §IV-A-1 matches the JPEG encoder)	no — 109.9 M vs FBCNN’s 71.9 M (Tab. III)	yes — Tab. V’s “Baseline” column (base encoder $+$ guided decoder only), same quality-factor pool
PLADA [ 6 ]	asserted for all nine (§4.1) — but Tabs. 1 and 3 mark six of the nine $\dagger$ , i.e. taken from prior work rather than retrained	no — “more optimization parameters than Ojha” (§4.2); no counts reported	partly — Fig. 7(a)’s ablation origin is a retrained CLIP linear probe, not a plain-trunk control
F3-Net [ 10 ]	yes within each quality level, against Xception ( $+$ ELA, $+$ PAFilters) (Tab. 1); no multi-quality training exists — §4.1 describes one level per run	no — two Xception branches $+$ cross-attention, no counts reported; fair only in the FAD-internal ablation (Tab. 3), where the gain falls to $+0.014$ AUC	not applicable — no diverse-data regime
SPSL [ 11 ]	yes within each quality level, against a reproduced Xception and ResNet-34/50 (Tab. 2, §4.2.1; Tab. 7); no multi-quality training exists	yes by construction — only Xception blocks 1–3 and 12 are retained (§4.1); no counts reported	not applicable — no diverse-data regime
Luo et al. [ 13 ]	yes but at one fixed quality — FF++ HQ throughout (§5.1), against an author-trained Xception and Face X-ray (Tabs. 4–5); no compression-diverse training exists	no — two Xception streams $+$ attention fusion vs one Xception; no counts reported	never run on diverse data — the plain-Xception row exists (Tab. 3) but only at fixed HQ

Table 5: Control audit of the published positives. “Data-matched” asks whether the baseline each work compares against — named in the same cell — saw the same compression-diverse training data as the proposed method; “capacity-matched” whether it had comparable size. Read from each work’s own experimental section, with the table or section each reading comes from named in the cell. Ma et al. is a JPEG artifact reduction method (PSNR/SSIM, not detection) and is included because its mechanism is the compression-sensitivity decoupling this literature borrows; it is also the only one of the six that runs the control this paper argues for, and the only one that reports parameter counts at all. DANet-ATP [ 17 ] , cited in Section 2 as the closest mechanism twin, is an audio detector (ASVspoof, EER, codec classes) and shares no benchmark, metric or modality with a video face-forgery control audit, so it is out of scope here.

Appendix figures & tables6 assets

Supplementary material from the paper’s appendix.

Appendix

arm	c40 per-seed (s42 / s1 / s2)	c40 seed-mean $\pm$ band	$\mathrm{AUC}_{\mathrm{comp}}$ seed-mean
SpatialBase	.9590 / .9614 / .9492	.9565 $\pm$ .0160	.9688
Fair-N	.9586 / .9567 / .9536	.9563 $\pm$ .0062	.9675
Fair-W	.9645 / .9602 / .9609	.9619 $\pm$ .0058	.9719
TrunkCtrl	.9491 / .9566 / .9551	.9536 $\pm$ .0098	.9674

Appendix

Table 6: Per-seed c40 video-AUC and 3-seed bands (

n{=}3

seeds per arm — 42, 1, 2; band

=4.30\,s/\sqrt{3}

, the 95%

t

-band for

k{=}3

). Descriptively, both fair CAFRL variants varied less across seeds than the plain backbone; with three seeds per arm that difference is not tested. Fair-W’s

+0.54

pt seed-mean lean is smaller than this design’s resolution and its pooled contrast includes zero. TrunkCtrl — CAFRL’s narrow trunk alone at the fair recipe — is listed for the architecture-share decomposition of Section 7.1 , which uses its 3-seed pool.

defect	why it mattered	repaired/resolved by
D1 — the L1 consistency loss ran 40–120 $\times$ the classification loss at the curriculum’s compressed-phase onset, in every arm (including CAFRL $-$ adv)	no arm ever trained its frequency features free of invariance pressure; the inference “not the GRL $\Rightarrow$ frequency itself” was void	Fair-N (zero invariance losses, flat curriculum). Confirmed as principal cause : $+3.96$ pt recovered at c40 (Fair-N vs. CAFRL $-$ adv, seed 42), significant
D2 — $\gamma\rightarrow 0$ in the residual probe was a curriculum-shock collapse locked in by a structural deadlock: at $\gamma{=}0$ the frequency path receives zero label gradient	the probe could not detect a useful frequency signal even if present; “the model freely discards frequency” was unfounded	Fair-W (auxiliary BCE gives the frequency path label gradient regardless of $\gamma$ ). Deadlock broken : $\gamma$ grows to 0.146, decaying to 0.031 by epoch 30 rather than collapsing
D3 — optimization never matched: baseline full fine-tune at $2{\times}10^{-4}$ from epoch 1 vs CAFRL’s 20 $\times$ lower backbone LR, 10-epoch freeze, heavy data deferred to the LR tail	part of the deficit was recipe, not architecture	TrunkCtrl $+$ Fair-N. Confirmed : the 0.0451 trunk gap splits ${\approx}88\%$ / ${\approx}12\%$ recipe/architecture as a point estimate (Section 7.1 ), and only the recipe share’s interval excludes zero; the fair recipe erases the model-level deficit
D4 — CAFRL’s spatial path taps an intermediate 320-channel map (256-d projection), discarding the backbone’s final 1280-d representation	every CAFRL-with-frequency variant carried a handicapped spatial trunk	TrunkCtrl $+$ Fair-W. Closed — no detectable width penalty : the adjudicated width contrast is $-0.0038$ , CI [-0.0116, +0.0039] (Table 3 ), and the frequency path on the full trunk still makes no detectable difference
D5 — split-BatchNorm evaluation forces the clean branch at eval (train/eval routing mismatch)	could have distorted compressed-level evaluation	eval-only routing probe. Retired — immaterial : oracle-routing c40 $\Delta\leq 0$ on both probed arms (the clean eval mildly flattered CAFRL)
D6 — the GRL silently degraded its own conditioning estimator: $\pm$ 1-bin accuracy $0.88\rightarrow{\approx}0.4$ under the adversary (healthy ${\approx}1.0$ without it)	the “compression-aware conditioning” mechanism was self-defeating as configured (“condition-then-remove”)	four-way control pattern across arms; estimator-health warning ( $\pm$ 1-bin $<0.7$ ) added to the training diagnostics

Appendix

Table 7: The D1–D8 audit ledger. “Repaired/resolved by” names the pre-specified re-test (or documentation fix) that closed each defect.

model	prot.	aug	params	c23	c28	c32	c36	c40	$\mathrm{AUC}_{\mathrm{comp}}$
Xception	lit	std	20.8 M	.9944	.9890	.9778	.9280	.8660	.9402
F3-Net	lit	std	21.0 M	.9917	.9835	.9654	.9210	.8599	.9325
FreqNet	lit	std	5.1 M	.9877	.9652	.9274	.8541	.7684	.8788
Xception-mq	mq	std	20.8 M	.9872	.9838	.9803	.9739	.9679	.9765
Xception-mq	mq	flip	20.8 M	.9869	.9820	.9772	.9691	.9631	.9728
F3-Net-mq	mq	std	21.0 M	.9885	.9831	.9766	.9683	.9551	.9708

Appendix

Table 8: Harmonized baseline benchmark (video-AUC, FF++ official test split, 700 videos per level, single runs at seed 42) — the object behind contribution C4. “lit”

=

the literature protocol (c23-trained), “mq”

=

multi-CRF training; “aug” is std , the standard policy described above, or flip , horizontal flip only. Parameter counts follow Table 1 ’s convention. All rows are descriptive and none enters the confirmatory family. c0 and c18 are omitted for space (every row is at or near ceiling there); the complete seven-level sweep with per-cell marginal intervals is released as evaluation/BENCHMARK.md .

3-seed mean $\pm$ 95% $t$ -band ( $k{=}3$ )
model	Celeb-DF v2	DFD-c23	DFD-c40
CAFRL as specified	0.705 $\pm$ 0.051	0.819 $\pm$ 0.040	0.635 $\pm$ 0.035
SpatialBase	0.686 $\pm$ 0.035	0.825 $\pm$ 0.054	0.650 $\pm$ 0.031
Fair-N	0.647 $\pm$ 0.170	0.792 $\pm$ 0.095	0.659 $\pm$ 0.073
Fair-W	0.681 $\pm$ 0.048	0.835 $\pm$ 0.057	0.664 $\pm$ 0.054
single run, seed 42 — not replicated

Appendix

Table 9: Out-of-distribution evaluation (video-AUC;

n{=}518

Celeb-DF v2,

n{=}3{,}431

DFD). Upper block: 3-seed mean

\pm

the 95%

t

-band (

4.30\,s/\sqrt{3}

k{=}3

). Lower block: Xception-mq, one seed. Per-cell marginal intervals (widths 0.02–0.05) and the seed-42 values are in the released summaries and claims map. These cells were stored as summary statistics without per-video scores, so no paired contrast is computable for any of them : unlike every FF++ contrast here they cannot be adjudicated, and are reported descriptively. TrunkCtrl was not evaluated out of distribution.

level	CAFRL as spec.	SpatialBase	paired $\Delta$	95% CI	$P(\Delta{>}0)$
c23	0.822	0.823	$-0.008$	[-0.041, +0.025]	0.30
c40	0.758	0.732	$+0.022$	[-0.021, +0.064]	0.84

Appendix

Table 10: FaceShifter (held out), shipped recipe, seed-pooled (3 seeds each arm; 10k paired video bootstrap).

FaceShifter, held out ( $n{=}280$ )
contrast @ c40	$\Delta$	95% CI (video)	95% CI (identity clusters)
SpatialBase $-$ CAFRL as specified (s42)	$+0.0366$	[+0.0205, +0.0538]	[+0.0182, +0.0569]
Fair-N $-$ CAFRL $-$ adv (s42)	$+0.0396$	[+0.0231, +0.0570]	[+0.0222, +0.0580]
Fair-N pool $-$ SpatialBase pool (3v3)	$-0.0010$	[-0.0066, +0.0045]	[-0.0064, +0.0046]
Fair-W pool $-$ SpatialBase pool (3v3)	$+0.0022$	[-0.0035, +0.0080]	[-0.0042, +0.0085]
TrunkCtrl pool $-$ spatial-residual (s42)	$+0.0490$	[+0.0294, +0.0705]	[+0.0296, +0.0715]

Appendix

Table 11: The contrasts whose clustered interval the text relies on, at two resampling units: the published one (each evaluated video an independent draw) and the source-identity cluster (140 clusters of five for FF++, 140 of two for FaceShifter, resampled whole). 10,000 paired replicates, percentile intervals, identical seeds. All twelve adjudicated contrasts were run at all five units — the video plus the four cluster definitions defined above — and behave the same way; every endpoint is in the released evaluation/analysis/ output. The target-identity and identity-pair definitions give intervals inside the span of the two shown; on the FaceShifter set the base-video definition degenerates to the video unit (280 singleton clusters), so it is not an independent unit there. No verdict changes under any of them.

Deepfake Detection

Deepfake detection identifies manipulated or AI-generated media to support trustworthy communication, identity verification, and forensic analysis.

See all 241 papers

Curvelet-Based Frequency-Aware Feature Enhancement for Deepfake Detection
Apr 13, 2026Salar Adel Sabri, Ramadhan J. MstafaDeepfake Detection Frequency-Domain Feature Learning
Department of Computer Science, College of Science, University of Zakho, Zakho, Kurdistan Region, Iraq. · PRIME Lab, Scientific Research Center, University of Zakho, Zakho, Kurdistan Region, Iraq.
Robust Deepfake Detection: Mitigating Spatial Attention Drift via Calibrated Complementary Ensembles
Apr 28, 2026Minh-Khoa Le-Phan, Minh-Hoang Le, Trong-Le Do +1Image Corruption Robustness Deep Ensembles
University of Science, VNU-HCM, Ho Chi Minh City, Vietnam · Vietnam National University, Ho Chi Minh City, Vietnam
Toward Calibrated, Fair, and accurate Deepfake Detection
Jun 3, 2026Ryan Brown, Chris RussellAlgorithmic Fairness Deepfake Detection
University of Oxford

Apr 13, 2026J/K move · Enter open · S save

Curvelet-Based Frequency-Aware Feature Enhancement for Deepfake Detection

Salar Adel Sabri, Ramadhan J. Mstafa

Department of Computer Science, College of Science, University of Zakho, Zakho, Kurdistan Region, Iraq. · PRIME Lab, Scientific Research Center, University of Zakho, Zakho, Kurdistan Region, Iraq.

Deepfake Detection Frequency-Domain Feature Learning

Open paper AskPDF arXiv

The proliferation of sophisticated generative models has significantly advanced the realism of synthetic facial content, known as deepfakes, raising serious concerns about digital trust. Although modern deep learning-based detectors perform well, many rely on spatial-domain features that degrade under compression. This limitation has prompted a shift toward integrating frequency-domain representations with deep learning to improve robustness. Prior research has explored frequency transforms such as Discrete Cosine Transform (DCT), Fast Fourier Transform (FFT), and Wavelet Transform, among others. However, to the best of our knowledge, the Curvelet Transform, despite its superior directional and multiscale properties, remains entirely unexplored in the context of deepfake detection. In this work, we introduce a novel Curvelet-based detection approach that enhances feature quality through wedge-level attention and scale-aware spatial masking, both trained to selectively emphasize discriminative frequency components. The refined frequency cues are reconstructed and passed to a modified pretrained Xception network for classification. Evaluated on two compression qualities in the challenging FaceForensics++ dataset, our method achieves 98.48% accuracy and 99.96% AUC on FF++ low compression, while maintaining strong performance under high compression, demonstrating the efficacy and interpretability of Curvelet-informed forgery detection.

Abstract

Deepfake Detection

Explore similar work

Curvelet-Based Frequency-Aware Feature Enhancement for Deepfake Detection

Robust Deepfake Detection: Mitigating Spatial Attention Drift via Calibrated Complementary Ensembles

Toward Calibrated, Fair, and accurate Deepfake Detection