Deepfake detection glossary: 40 terms, one sentence each, with sources
The Face Benchmark editorsPublishedFigures checked
This deepfake detection glossary defines forty terms in one sentence each and names, in the same row, the paper or standard that defines the term. The metric terms follow DeepfakeBench (NeurIPS 2023), whose results table reports frame-level AUC for detectors trained on FaceForensics++ c23; the biometric terms follow ISO/IEC 30107-3:2023 and NIST FRTE as read on 9 November 2026.
The glossary serves the deepfake detection hub and the face recognition section. For the metrics as formulas and worked examples, the scoring metrics for deepfake detectors page goes deeper; this page is the lookup table.
01How to use this glossary
Each row has three parts: the term, a one-sentence definition, and the source that defines it or whose usage this site follows. Where a term carries a number, such as the H.264 quantisation parameters behind c23 and c40, the number is the one printed in the named source. Ordinary words that any statistics text defines the same way, such as threshold or accuracy, carry no citation beyond the benchmark that reports them.
02The forty terms
| # | Term | Definition | Where it is defined |
|---|---|---|---|
| 1 | AUC | The area under the ROC curve: the probability that a detector scores a random fake above a random real; 0.5 is chance, 1.0 perfect. | Fawcett, An introduction to ROC analysis (2006); reported per frame in DeepfakeBench |
| 2 | ROC curve | The curve of true positive rate against false positive rate as the decision threshold sweeps from strict to lenient. | Fawcett (2006) |
| 3 | Accuracy (ACC) | The share of test items classified correctly at one fixed threshold, so it depends on that threshold and on the real-to-fake mix. | DeepfakeBench metric list (arXiv 2307.01426) |
| 4 | Equal error rate (EER) | The error rate at the threshold where false positive and false negative rates are equal; primary metric of the ASVspoof 2021 deepfake task, best system 15.64 percent. | ASVspoof 2021 summary paper (arXiv 2210.02437) |
| 5 | False positive rate | The share of real items wrongly classified as fake: false positives divided by all real items. | Fawcett (2006), section 2 |
| 6 | False negative rate | The share of fake items wrongly classified as real: false negatives divided by all fakes. | Deepfake-Eval-2024 (arXiv 2503.02857) |
| 7 | Average precision (AP) | A threshold-free summary of the precision-recall curve, used by Wang et al. (CVPR 2020) across 11 generators, with chance at 50 on a 100 scale. | Wang et al. (arXiv 1912.11035), section 3 |
| 8 | Log loss | The penalty on a probabilistic prediction that grows as a confident answer is wrong; the Deepfake Detection Challenge ranked by it, winner 0.4279 on the private set. | DFDC dataset paper (arXiv 2006.07397), Table 2 |
| 9 | Frame-level AUC | AUC over individual sampled frames rather than whole clips; DeepfakeBench "currently adopts the frame level evaluation". | DeepfakeBench (arXiv 2307.01426) |
| 10 | Video-level AUC | AUC computed after a clip's frame scores are combined into one score per video; a separate DeepfakeBench metric. | DeepfakeBench README metric list |
| 11 | Threshold | The score above which an item is called fake; fixed in training, it stops fitting when test images are compressed or from another generator. | Corvi et al. (arXiv 2211.00680), section 4 |
| 12 | t-DCF | The tandem detection cost function: scores a spoofing countermeasure by its effect on a speaker verification system; primary for ASVspoof 2021 LA and PA. | ASVspoof 2021 summary paper (arXiv 2210.02437) |
| 13 | Within-domain evaluation | Testing on data from the same source as the training data; DeepfakeBench uses six such sets for detectors trained on FaceForensics++ c23. | DeepfakeBench, section 4.2 |
| 14 | Cross-dataset evaluation | Testing on datasets the detector was not trained on; DeepfakeBench Table 3: "All detectors are trained on FF-c23 and evaluated on other data", eight sets. | DeepfakeBench, Table 3 |
| 15 | Cross-generator classification | Training an image detector on one generator's outputs and testing it on others; one of GenImage's two tasks. | GenImage (arXiv 2306.08571) |
| 16 | Degraded image classification | Testing a detector on low-resolution, blurred and compressed copies of the test images; GenImage's second task. | GenImage (arXiv 2306.08571) |
| 17 | In-the-wild benchmark | A test set collected from circulating media, so the generator is unknown; Deepfake-Eval-2024 holds 45 hours of video, 56.5 hours of audio and 1,975 images from 2024. | Deepfake-Eval-2024 (arXiv 2503.02857) |
| 18 | c23 and c40 | The FaceForensics++ release names for H.264 compression at constant rate quantisation parameter 23 (high quality) and 40 (low quality). | FaceForensics++ paper (arXiv 1901.08971) |
| 19 | Hidden test set | Test items whose labels are withheld and scored by the organisers; FaceForensics++ runs an automated benchmark of 1,000 images this way. | FaceForensics++ paper and repository README |
| 20 | Perturbation | A deliberate change applied to test clips to imitate real-world damage; the Deepfake Detection Challenge set lists 19 perturbation types. | DeepfakeBench README dataset table |
| 21 | Fine-tuning on the test distribution | Retraining a detector on part of a benchmark and testing on the rest; Deepfake-Eval-2024 tunes on 60 percent, tests on 40, and reports it apart from off-the-shelf scores. | Deepfake-Eval-2024, Table 4 |
| 22 | Saturation | The point at which a benchmark no longer separates systems because the best score near its ceiling, as LFW did at 99.83 percent. | ArcFace paper (arXiv 1801.07698), LFW table |
| 23 | Face swap | A manipulation that replaces the face's identity while keeping the scene; FaceSwap (graphics-based) and DeepFakes (two autoencoders, shared encoder) in FaceForensics++. | FaceForensics++ paper, section 3 |
| 24 | Reenactment | A manipulation that transfers expressions onto a face while keeping its identity, as Face2Face does in FaceForensics++. | FaceForensics++ paper, section 3 |
| 25 | Fully generated face | A face produced from a random vector or a prompt with no source photograph, such as the StyleGAN2 faces of the PNAS 2022 perception study. | StyleGAN2 paper (arXiv 1912.04958); Nightingale and Farid (PNAS 2022) |
| 26 | Diffusion model | A generator that builds an image by reversing a gradual noising process; seven of GenImage's eight generators are diffusion models. | GenImage (arXiv 2306.08571) |
| 27 | Blending boundary | The seam where an altered face region is blended into the frame; the cue that Face X-ray learns, from blended real images alone. | Face X-ray (arXiv 1912.13458) |
| 28 | Frequency artefact | A regular pattern in the spectrum of a generated image, caused by upsampling operations found in GAN architectures. | Frank et al. (arXiv 2003.08685) |
| 29 | Naive, spatial and frequency detectors | DeepfakeBench's three detector types: a plain classifier; a method reading spatial cues such as blending; a method reading the spectrum or noise residual. | DeepfakeBench, Table 1 |
| 30 | Backbone | The pretrained network a detector builds on; eight of the fifteen detectors in DeepfakeBench's Table 3 use an Xception backbone. | DeepfakeBench, Table 3 |
| 31 | Presentation attack | An attempt to fool a biometric sensor with an artefact such as a printed photo, replayed video or mask, as tested under ISO/IEC 30107-3. | ISO/IEC 30107-3:2023, Biometric presentation attack detection, Part 3 |
| 32 | APCER | The attack presentation classification error rate: the proportion of attack presentations incorrectly classified as bona fide. | ISO/IEC 30107-3:2023 |
| 33 | BPCER | The bona fide presentation classification error rate: the proportion of bona fide presentations incorrectly classified as attacks. | ISO/IEC 30107-3:2023 |
| 34 | FMR and FNMR | In one-to-one verification, false match rate is the share of impostor comparisons at or above the threshold; false non-match rate the share of mated comparisons below it. | NIST FRTE 1:1 report page |
| 35 | FPIR and FNIR | In one-to-many search, FPIR is the share of non-mated searches returning a candidate above threshold; FNIR the share of mated searches that miss; NIST fixes FPIR at 0.003. | NIST FRTE 1:N report page |
| 36 | TAR at FAR | True accept rate at a fixed false accept rate, the figure quoted on IJB-B and IJB-C; ArcFace reports 95.6 percent on IJB-C at FAR one in ten thousand. | ArcFace paper (arXiv 1801.07698) |
| 37 | Content Credentials | The C2PA name for a signed record of a file's origin and edits, carried with the file; the specification is at version 2.5. | C2PA specification (spec.c2pa.org) |
| 38 | Provenance | Evidence of where a file came from and what was done to it, recorded by a standard such as C2PA, as opposed to evidence from the pixels. | C2PA (c2pa.org) |
| 39 | Countermeasure (CM) | The ASVspoof name for a spoofing or deepfake detector deciding whether speech is bona fide or spoofed; scored by CM EER when no verification system is in the loop. | ASVspoof 2021 summary paper (arXiv 2210.02437) |
| 40 | LA, PA and DF tasks | The three ASVspoof 2021 tasks: logical access (spoofed speech under encoding and transmission effects), physical access (replay attacks in real spaces) and deepfake (manipulated, compressed speech posted online, with no verification system). | ASVspoof 2021 summary paper (arXiv 2210.02437) |
03Which terms come from a standard rather than a paper?
Seven rows cite a standard or a national test programme rather than a research paper. Presentation attack, APCER and BPCER come from ISO/IEC 30107-3:2023, the second edition of the presentation attack detection testing standard; FMR, FNMR, FPIR and FNIR from the NIST Face Recognition Technology Evaluation report pages; Content Credentials and provenance from the C2PA specification. Where this site applies them, as on the liveness detection and injection attacks page, the definitions are used as the standard words them.
Everything else is defined by the paper that introduced the benchmark or the method, so cross-dataset evaluation means what DeepfakeBench's Table 3 does and cross-generator classification means what GenImage's Table 2 does. The same words in another paper may describe a different protocol.
04Why do AUC, accuracy and average precision need separate rows?
They answer different questions about the same detector and can move in opposite directions. AUC ranks; accuracy counts at one threshold; average precision summarises precision against recall. Corvi et al. (2022) found a detector that kept 90.8 AUC after images were resized and compressed while its accuracy fell to 61.5 percent, and GenImage reports accuracy where Wang et al. (2020) reported average precision, so the two benchmarks cannot be compared cell by cell. The AI image detection explainer walks through this with the published tables, and the generated-image benchmarks page lists which metric each benchmark reports.
05Where do the recognition terms fit in a detection glossary?
Face recognition and deepfake detection share a pipeline and a benchmark culture, and FMR, FNMR, TAR at FAR and saturation are recognition terms a reader meets as soon as a detection paper cites IJB-C or LFW. The saturation row points at the clearest case: the LFW dataset stopped separating systems as published verification accuracies ran from 99.15 percent in 2014 to 99.83 percent in 2019, and GenImage's same-generator accuracies above 98.5 percent are the detection field's version of the same ceiling.
SRCSources
- S1DeepfakeBench: A Comprehensive Benchmark of Deepfake Detection(external)Yan et al. NeurIPS 2023 Datasets and BenchmarksChecked
- S2FaceForensics++: Learning to Detect Manipulated Facial Images(external)Rössler et al. ICCV 2019Checked
- S3ASVspoof 2021: Towards Spoofed and Deepfake Speech Detection in the Wild(external)Liu et al. 2022Checked
- S4GenImage: A Million-Scale Benchmark for Detecting AI-Generated Image(external)Zhu et al. 2023Checked
- S5Deepfake-Eval-2024: A Multi-Modal In-the-Wild Benchmark of Deepfakes Circulated in 2024(external)Chandra et al. 2025Checked
FAQQuestions
What is the difference between frame-level and video-level AUC?
Frame-level AUC scores every sampled frame as its own item; video-level AUC first combines a clip's frame scores into one score per video. DeepfakeBench reports frame-level AUC in its main table and lists video-level AUC as a separate metric, so the two are not interchangeable.
What do c23 and c40 mean in FaceForensics++?
They are the release names for the two H.264 compressed versions of the videos, at constant rate quantisation parameter 23 (high quality) and 40 (low quality). The same Xception detector scored an accuracy of 99.26 percent on raw video, 95.73 percent at c23 and 81.00 percent at c40 in the FaceForensics++ paper.
What are APCER and BPCER?
APCER is the proportion of attack presentations wrongly accepted as genuine, and BPCER the proportion of genuine presentations wrongly rejected as attacks, as defined in ISO/IEC 30107-3:2023. They are the presentation attack detection equivalents of the false negative and false positive rates.
Why is equal error rate used for audio but AUC for video?
Convention, set by the benchmarks. ASVspoof made CM EER the primary metric of its 2021 deepfake task because no speaker verification system sits in that task's loop, while DeepfakeBench made frame-level AUC the standard for face video. Both describe the same ROC curve from different points.
What does cross-dataset mean in a results table?
A detector trained on one dataset and tested on another. In DeepfakeBench every detector is trained on FaceForensics++ c23 and tested on eight other sets, so a cross-dataset AUC is a score on fakes made by methods the detector never saw in training.