Deepfake detection and prevention: what each layer can and cannot do

This page belongs to the deepfake detection hub and builds on the provenance versus detection page, which makes the two-way distinction; here the prevention side is split into its three layers and each layer gets its number.

01What does prevention mean for a deepfake?

Nothing stops a generator from producing a face. What can be prevented is the fake being accepted as a genuine capture, and that happens at three points: when a camera is supposed to be looking at a live person, when a file is created or edited, and when a platform decides what to show. Each point can leave or check a record, and a record is verified rather than guessed. The C2PA Explainer draws the line in the same place: Content Credentials are "not a cure-all for misinformation" but complement "digital forensics approaches such as deep-fake detection" by recording provenance "in a tamper-evident structure" (C2PA Explainer 2.2).

Detection has no record: a detector is shown pixels and asked whether a generator made them, and its quality is a curve on a test set. That is why this site reports detection with an AUC and a test set beside it, and prevention with the standard that tests it.

02Layer 1: capture integrity

A face verification system is attacked either by holding something up to the camera or by replacing the camera feed. The first is a presentation attack, and ISO/IEC 30107-3:2023 sets the "principles and methods for the performance assessment of presentation attack detection (PAD) mechanisms"; its scope line is explicit that "the attacks considered in this document take place at the biometric capture device during presentation" (ISO/IEC 30107-3:2023). Its error rates are APCER, the share of attacks accepted as genuine, and BPCER, the share of genuine presentations rejected, reported at a fixed point such as BPCER20, the BPCER when APCER is 5 percent.

The second attack bypasses the lens. ENISA's 2022 report on remote identity proofing records that "video injection is the most promising attack method, according to market players. It is not a presentation attack instrument", and that the industry "lacks a clear framework for the type of testing needed" for defences against it. CEN/TS 18099:2024, in force from 16 December 2024, supplies a test plan for injection attack detection and leaves presentation attacks to ISO/IEC 30107. The liveness and injection attacks page covers both standards and the datasets behind them.

03Layer 2: provenance at creation

C2PA, "an open technical standard for publishers, creators and consumers to establish the origin and edits of digital content", binds a set of signed assertions to a file as a manifest (c2pa.org). A camera manifest records a capture, a generator manifest records that a trained algorithm produced the asset, and validation checks the signatures and the signer's trust list. The specification is careful about what that proves: C2PA "DO NOT provide value judgements about whether a given set of provenance data is 'good' or 'bad'", and the Explainer adds that "provenance information alone cannot tell you whether the digital content is true, accurate or factual".

The layer's limit is coverage. The Explainer answers its own question, "Can the provenance metadata be removed? Yes it can", and notes that "if an asset is cropped using a non-Content Credentials aware tool, the provenance data may not be updated". It also states that the standard does not intend "to create a two-tier media ecosystem" in which files without credentials are distrusted by default. A missing manifest is therefore not evidence of a fake, which is the point at which detection becomes necessary. The content credentials (C2PA) page sets out what a valid manifest does prove.

04Layer 3: distribution and labels

Platforms act on records they can read. Meta announced in February 2024 that it would label images "when we can detect industry standard indicators that they are AI-generated", naming "the 'AI generated' information in the C2PA and IPTC technical standards", and conceded that "there are ways that people can strip out invisible markers". TikTok began reading Content Credentials in May 2024 and stated that a file "needs to have the Content Credentials metadata for us to identify and label it".

Watermarks are the attempt to make the record survive. The C2PA Explainer's durable Content Credentials pair "a hard binding (aka cryptographic hashing) with a soft binding (e.g., watermarking and fingerprinting)" so a stripped manifest can be found again. Google's SynthID-Image paper reports the mark applied to "over ten billion images and video frames" across the company's services and names the two attacker goals as removal, a false negative, and forgery, a false positive; its authors expect watermarking "to be deployed alongside a metadata-based standard like C2PA" (arXiv 2510.09263). The pages on AI video watermarks and on whether Content Credentials survive upload report what is known about survival through re-encoding.

05Layer 4: detection, and its published numbers

When no record reaches the viewer, inference is what remains. Its numbers are the subject of the rest of this site, and the two that matter here are the lab figure and the wild figure. In DeepfakeBench Table 3, where fifteen detectors are trained on FaceForensics++ c23 and tested on eight sets they never saw, the best cross-dataset average is 0.7875 frame-level AUC, held by the SPSL detector, and the Xception baseline scores 0.7718 (arXiv 2307.01426). On the Deepfake-Eval-2024 benchmark, built from fakes that circulated in 2024, the open-source video, audio and image models lost 50, 48 and 45 percent of their AUC against their original benchmarks, the best off-the-shelf open-source video model scored 0.63, and the best anonymised commercial models scored 0.79 for video, 0.93 for audio and 0.90 for images (arXiv 2503.02857). The authors' summary is that commercial and fine-tuned models "do not yet reach the accuracy of deepfake forensic analysts".

06Why does the order of the layers matter?

Each layer answers for a different failure. Capture integrity is the only layer that can keep a fake out of an identity check, and it is unavailable for a clip that arrives from the internet. Provenance is the only layer that can prove a genuine capture, and it is silent for any file whose manifest was stripped or never written. Labels depend on provenance. Detection applies everywhere and proves nothing: a score of 0.63 AUC on circulating fakes is weak evidence either way, which is why this site's benchmarks built from circulating fakes page puts a detector score after provenance, context and corroboration.

The reverse mistake is as common. A NIST face recognition result describes matching, not liveness, and the NIST report cards explained page shows that nothing on a card tests whether the face was live. The DFDC Preview paper made the matching point for detection in 2019: at the prevalence of deepfakes in real traffic, a detector's false positives dominate unless the operating point is fixed in advance. A layer's number means something only inside the layer's job.