Deepfake detection algorithms: 20 named methods, their cues, backbones and benchmark scores

This glossary is part of the deepfake detection hub. It gives each method one line; the plain definition of deepfake detection explains what the score means, and the DeepfakeBench codebase is where fifteen of the twenty were run under one protocol.

01What counts as a deepfake detection algorithm?

In the papers, a detection algorithm has three parts: a cue, a backbone and a training recipe. The cue is what the model is pushed to look at, such as a blending boundary, a phase spectrum or a temporal break. The backbone is the network that turns pixels into features, and in this field it is very often Xception, the depthwise separable convolution network Chollet published in 2016 (arXiv 1610.02357). The recipe is the data, the augmentation and the loss.

The DeepfakeBench paper (Yan et al., NeurIPS 2023) is the only source that ran a large set of these algorithms under one preprocessing, one training set and one metric, so it supplies the backbone and venue columns for its fifteen detectors and the only comparable score (arXiv 2307.01426). The five further methods come from the benchmark's version 2 README, which lists 36 detectors in all but has not yet published their table.

02Twenty methods in one table

Every row names the paper's method, the family DeepfakeBench assigns it, the backbone from Table 1 of that paper or from the method's own abstract, the venue, and the cross-dataset average frame-level AUC from Table 3, where all detectors were trained on FaceForensics++ c23 and tested on eight other sets. Rows without a Table 3 figure were added to the benchmark after the paper.

The per-dataset numbers behind the last column, including the FaceForensics++ in-dataset scores, are on the results table by test set, and the cross-dataset ordering of the fifteen is the subject of the ranked detectors page.

03How are the methods grouped by cue family?

DeepfakeBench divides detection into three categories. A naive detector "employs CNNs to directly distinguish deepfake content from authentic data"; MesoNet and Xception are its examples. A spatial detector looks for a specific representation such as forgery region location, a capsule network, disentanglement learning or image reconstruction. A frequency detector works in the frequency domain, and the paper names SPSL and SRM as examples that use "phase spectrum analysis and high-frequency noises, respectively".

The version 2 README keeps those labels and adds a video group. It files SBI, SLADD, LSDA and Effort among its 20 spatial detectors and FTCN among its 8 video detectors, which is why the figure on this page shows 5 naive, 11 spatial, 3 frequency and 1 video method. The labels describe the training signal, not the architecture: SBI and Face X-ray both target blending, but one learns from self-made fakes and the other from a boundary map.

04Why do most of them share the Xception backbone?

Eight of the fifteen Table 1 detectors run on Xception, including every frequency method and four of the seven spatial ones. The reason is historical. FaceForensics++ cast detection as "a per-frame binary classification problem" and found that "the classification based on XceptionNet outperforms all other variants in detecting fakes" (arXiv 1901.08971), so later methods kept the backbone and changed the input or the loss.

The benchmark's own ablation supports the choice. In section 4.3 of the DeepfakeBench paper, "Xception and EfficientNet-B4 consistently outperform ResNet34, despite having a similar number of parameters". The two exceptions in the table are Face X-ray, which uses HRNet because it predicts a map rather than a label, and RECCE, whose authors built their own encoder and decoder with bipartite graphs between them.

05Which methods have no DeepfakeBench score, and why?

Five rows carry no cross-dataset figure. SBI, SLADD, LSDA, Effort and FTCN were added in DeepfakeBench version 2, and the README states that the results table "will update the below table soon" while still showing the paper's fifteen rows. Until that table appears, the only comparable numbers for those five are the ones in their own papers, which were produced under their own preprocessing and frame counts and are not placed next to the Table 3 column here.

Those papers do state what they changed. SBI reports that its self-blended training data "outperforms the baseline by 4.90% and 11.78% points in the cross-dataset evaluation" on DFDC and DFDCP (arXiv 2204.08376). FTCN reduces "the spatial convolution kernel size to 1, while maintaining the temporal convolution kernel size unchanged" (arXiv 2108.06693). Effort uses singular value decomposition "to decompose the original feature space into two orthogonal subspaces" of a pre-trained vision model (arXiv 2411.15633). Each is a claim from the authors, measured on their own terms.

06How should the cross-dataset column be read?

The column is one number per detector: the mean of eight frame-level AUCs on Celeb-DF v1 and v2, DeeperForensics-1.0, DFD, DFDC, DFDC Preview, FaceShifter and UADFV, after training on FaceForensics++ c23 only. The spread is narrow. Thirteen of the fifteen sit between 0.70 and 0.79, and the paper itself notes that naive detectors "register high AUC values that are comparable to more sophisticated algorithms". A gap of 0.01 in this column is smaller than the roughly 2 percent change the paper reports from removing all augmentations in its ablations.

No single benchmark average predicts how a detector performs on a manipulation it has not seen. Xception, re-run by the DF40 authors on nine unknown-domain sets built with newer generators, averaged 0.546 AUC in 2024, which the catalogue of generation methods covers. Read the column as a ranking under one protocol in 2023, not as a property of the algorithm.