Deepfake detection papers: 25 primary papers in reading order
The Face Benchmark editorsPublishedFigures checked
Twenty-five primary papers, read in this order, cover face deepfake detection from FaceForensics++ (ICCV 2019), whose XceptionNet baseline scored 99.26 percent binary accuracy on uncompressed video and 81.00 percent on heavily compressed video, to Deepfake-Eval-2024 (arXiv 2025), where open-source detectors lost about half their AUC on fakes that circulated in 2024. Each row below gives the venue, the dataset the paper rests on, and one result with its conditions.
This page belongs to the deepfake detection hub and is the reading companion to the published results table, which carries the DeepfakeBench rows quoted below with their full conditions. The numbers on this page come from the papers themselves or from the DeepfakeBench reproduction, as each row states.
01How the order was chosen
The list is ordered for reading, not by date: dataset papers first, because every detector result is a statement about a dataset; then the detectors in the order their ideas build on each other; then the benchmark that re-ran them; then two generator papers, two papers on fully generated images, two human studies, and the 2024 and 2025 papers that measured how far detectors had fallen behind the fakes. Twenty-three of the 25 are linked to their arXiv abstract pages; the two PNAS papers are linked by DOI.
Where a result is a frame-level AUC from DeepfakeBench Table 3, the detector was trained on FaceForensics++ c23 and evaluated frame by frame, as DeepfakeBench states. Where it is the paper's own figure, the row names the test set and metric. The frame-level versus video-level AUC page explains why one detector carries two numbers in two of these papers.
02The 25 papers
| # | Year | Paper | Venue | What it introduced | One result worth quoting, with its conditions |
|---|---|---|---|---|---|
| 1 | 2019 | FaceForensics++ (Rössler et al.) | ICCV 2019 | 1,000 YouTube source videos manipulated with four methods at three compression levels; XceptionNet as the baseline detector | XceptionNet trained on all four methods: 99.26 percent binary accuracy raw, 95.73 percent at c23, 81.00 percent at c40 (Table 1) |
| 2 | 2020 | Celeb-DF (Li, Yang, Sun, Qi, Lyu) | CVPR 2020 | 5,639 higher quality DeepFake videos of 59 public figures from 590 YouTube originals, built because earlier sets "do not resemble DeepFake videos circulated on the Internet" | Xception trained on FaceForensics++ c23 scores 0.7365 frame-level AUC on Celeb-DF v2 against 0.9637 on its own test split (DeepfakeBench Table 3) |
| 3 | 2020 | DFDC (Dolhansky et al.) | arXiv 2020 | Over 100,000 clips from 3,426 paid actors who consented to having their likenesses modified; a public Kaggle contest | Winning model: 0.4279 log loss on the private test set of 10,000 clips, half of them organic internet content (Table 2) |
| 4 | 2020 | DeeperForensics-1.0 (Jiang, Li, Wu, Qian, Loy) | CVPR 2020 | 60,000 videos and 17.6 million frames from a new end-to-end swapping framework, with real-world perturbations and a hidden test set | 50,000 real and 10,000 fake videos of 100 subjects with 7 perturbation types, as tabulated in the DeepfakeBench README |
| 5 | 2020 | WildDeepfake (Zi, Chang, Chen, Ma, Jiang) | ACM Multimedia 2020 | 707 deepfake videos found on video sites, cut into 7,314 face sequences and 1,180,099 face images | Image-level detectors scoring 90 to 99 percent accuracy on FaceForensics++ or DF-TIMIT fall below 70 percent on WildDeepfake; the authors' ADDNet-2D reaches 76.25 percent |
| 6 | 2021 | ForgeryNet (He et al.) | CVPR 2021 | 99,630 real and 121,617 fake clips, 15 manipulation methods in 4 categories, 36 perturbation types | 1,438,201 real and 1,457,861 fake still images and 9,393,574 annotations, with splits of about 7:1:2 (dataset comparison table) |
| 7 | 2018 | MesoNet (Afchar, Nozick, Yamagishi, Echizen) | WIFS 2018 | Two shallow networks aimed at mesoscopic image properties | Detection rate "more than 98% for Deepfake and 95% for Face2Face" on the authors' own data; Meso4 scores 0.6077 frame-level AUC on FaceForensics++ c23 in DeepfakeBench |
| 8 | 2020 | Face X-ray (Li et al.) | CVPR 2020 | A greyscale map of the blending boundary, trained on blended real images without any manipulation method | Trained on blended images only: 74.76 percent AUC on Celeb-DF, against 36.19 percent for Xception trained on FaceForensics++ (Table 2) |
| 9 | 2020 | F3Net (Qian et al.) | ECCV 2020 | Two streams over DCT frequency components and local frequency statistics | 0.9449 within-domain and 0.7645 cross-domain average frame-level AUC, trained on FaceForensics++ c23 (DeepfakeBench Table 3) |
| 10 | 2021 | SPSL (Liu et al.) | CVPR 2021 | Phase spectrum input to catch up-sampling artifacts, with a shallower network | Best cross-domain average in DeepfakeBench Table 3 at 0.7875, and best on Celeb-DF v2 at 0.7650 frame-level AUC |
| 11 | 2021 | SRM (Luo, Zhang, Yan, Liu) | CVPR 2021 | High-frequency noise residuals at several scales with residual-guided attention | 0.9359 within-domain and 0.7760 cross-domain average frame-level AUC (DeepfakeBench Table 3) |
| 12 | 2022 | SBI (Shiohara, Yamasaki) | CVPR 2022 oral | Self-blended images: training fakes made from a single pristine image | Beats its baseline by 4.90 and 11.78 points in cross-dataset evaluation on DFDC and DFDCP (abstract) |
| 13 | 2023 | UCF (Yan, Zhang, Yuan, Lyu, Wu) | ICCV 2023 | Disentangles forgery-irrelevant, method-specific and common forgery features and keeps only the common ones | Best within-domain row in DeepfakeBench Table 3: 0.9705 on FaceForensics++ c23 and 0.9527 average, with 0.7801 cross-domain |
| 14 | 2021 | FTCN (Zheng et al.) | ICCV 2021 | Spatial convolution kernels reduced to 1 so the network learns temporal incoherence, then a temporal transformer | Video-level AUC trained on FaceForensics++: 86.9 percent on Celeb-DF v2 and 89.6 percent averaged over four unseen sets (Table 4) |
| 15 | 2021 | LipForensics (Haliassos, Vougioukas, Petridis, Pantic) | CVPR 2021 | A lipreading network fine-tuned to spot unnatural mouth motion | Video-level AUC trained on FaceForensics++: 82.4 percent on Celeb-DF v2, 73.5 on DFDC, 97.1 on FaceShifter, 97.6 on DeeperForensics (Table 2) |
| 16 | 2023 | GenConViT (Deressa et al.) | arXiv 2023 | ConvNeXt and Swin Transformer features with an autoencoder and a variational autoencoder | Average accuracy 95.8 percent and AUC 99.3 percent on its own test splits; 0.63 AUC on Deepfake-Eval-2024 against 0.96 on its original data |
| 17 | 2023 | DeepfakeBench (Yan, Zhang, Yuan, Lyu, Wu) | NeurIPS 2023 Datasets and Benchmarks | One codebase, one preprocessing pipeline and one protocol for 15 detectors on 9 datasets | Frame-level AUC, all detectors trained on FaceForensics++ c23: UCF best within-domain at 0.9705, SPSL best cross-domain average at 0.7875 (Table 3) |
| 18 | 2020 | FaceShifter (Li, Bao, Yang, Chen, Wen) | CVPR 2020 | Two-stage swapping: attribute encoder with Adaptive Attentional Denormalization, then HEAR-Net for occlusions | Identity retrieval 97.38 percent with posture error 2.96 on FaceForensics++ pairs, as measured in the SimSwap paper's Table 1 |
| 19 | 2020 | SimSwap (Chen, Chen, Ni, Ge) | ACM Multimedia 2020 | An ID Injection Module so one model swaps arbitrary identities, with a weak feature matching loss | Identity retrieval 92.83 percent with posture error 1.53 on FaceForensics++ pairs, against DeepFakes at 77.65 percent and 4.59 (Table 1) |
| 20 | 2020 | Wang et al. (Wang, Wang, Zhang, Owens, Efros) | CVPR 2020 | A classifier trained on one GAN generalises to others with careful augmentation | Trained on ProGAN only: mean average precision 92.6 across 11 CNN generators with blur and JPEG augmentation (Table 2) |
| 21 | 2020 | Frank et al. (Frank et al.) | ICML 2020 | Frequency-domain analysis of GAN images | GAN images "exhibit severe artifacts" in frequency space "caused by upsampling operations found in all current GAN architectures" (abstract) |
| 22 | 2022 | Nightingale and Farid | PNAS 2022 | Human classification of StyleGAN2 faces against matched real faces | 315 participants, 128 faces each: 48.2 percent accuracy against 50 percent chance; 59.0 percent with training and feedback |
| 23 | 2022 | Groh, Epstein, Firestone, Picard | PNAS 2022 | Human crowds against the leading DFDC model on the same videos | Recruited participants 66 percent, crowd mean 74 percent, leading model 80 percent on 50 holdout videos; 15,016 participants in all |
| 24 | 2024 | DF40 (Yan et al.) | NeurIPS 2024 Datasets and Benchmarks | 40 generation techniques in four families, four protocols, eight detectors, over 2,000 evaluations | Finding-2: "Existing well-designed (SoTA) detectors may not have obvious advantages over the baseline" |
| 25 | 2025 | Deepfake-Eval-2024 (Chandra et al.) | arXiv 2025 | 45 hours of video, 56.5 hours of audio and 1,975 images collected from 88 websites in 2024 | Open-source detectors' AUC fell by 50 percent for video, 48 for audio and 45 for images; the best off-the-shelf video model scored 0.63 |
03Which papers should a newcomer read first?
Rows 1, 17 and 25, in that order. FaceForensics++ defines the task as the field still practises it: per-frame binary classification on a face crop, with compression as the main nuisance and a 99.26 to 81.00 percent accuracy fall between raw and c40 video for the same XceptionNet (Rössler et al.). DeepfakeBench re-runs 15 detectors under one protocol and finds that naive CNN classifiers "register high AUC values that are comparable to more sophisticated algorithms" (Yan et al.). Deepfake-Eval-2024 then shows how much of a laboratory score survives 2024 fakes: about half (Chandra et al.). The dataset rows 2 to 6 come next; the public deepfake datasets table carries their counts, splits and licence terms side by side.
04Why are two generator papers on a detection list?
Because a detector result is only as current as the fakes it was tested on. FaceShifter and SimSwap are the swapping methods dataset builders adopted after the original DeepFakes autoencoder, and the SimSwap paper's own measurement shows why: on FaceForensics++ video pairs, identity retrieval is 97.38 percent for FaceShifter and 92.83 percent for SimSwap against 77.65 percent for DeepFakes (Chen et al.). A detector trained on DeepFakes-era swaps is tested, in Celeb-DF and the FaceShifter split of FaceForensics++, on faces that match their target far better. DF40 extends the point to 40 techniques and finds that forgery type and data domain together shape what a detector learns (Yan et al., 2024).
05What do the two human studies add?
A baseline. Nightingale and Farid report that 315 people classifying StyleGAN2 faces scored 48.2 percent, below chance, and that training with feedback lifted a second group only to 59.0 percent (PNAS 2022). Groh and colleagues report that on 50 DFDC holdout videos the leading model scored 80 percent, recruited participants 66 percent and the recruited crowd mean 74 percent, the two making "different kinds of mistakes" (PNAS 2022). Deepfake-Eval-2024's authors make the comparison the other way: commercial and fine-tuned models "do not yet reach the accuracy of deepfake forensic analysts".
06How should the results column be read?
Three cautions. A frame-level AUC and a video-level AUC are not the same measurement even on the same set: rows 14 and 15 are video-level because their authors averaged predictions over each clip, while rows 9 to 13 and 17 are DeepfakeBench's frame-level numbers. "Trained on FaceForensics++" hides a compression level; DeepfakeBench trains on c23 only. And a paper's own cross-dataset number and a benchmark's reproduction of it can differ for reasons unrelated to the method, which is why DeepfakeBench's authors note that gaps "could be a product of these additional factors rather than the intrinsic superiority of the method".
The same discipline applies beyond detection. The EU AI Act's Article 50 labelling duties are written around the gap these papers measure, and face recognition saturated its own benchmark a decade earlier, told on the MegaFace retirement page. No single benchmark score predicts how a detector performs on unseen manipulations; the rows above are evidence for that sentence, not exceptions to it.
SRCSources
- S1FaceForensics++: Learning to Detect Manipulated Facial Images(external)Rössler, Cozzolino, Verdoliva, Riess, Thies, Nießner. ICCV 2019Checked
- S2DeepfakeBench: A Comprehensive Benchmark of Deepfake Detection(external)Yan, Zhang, Yuan, Lyu, Wu. NeurIPS 2023 Datasets and BenchmarksChecked
- S3Lips Don't Lie: A Generalisable and Robust Approach to Face Forgery Detection(external)Haliassos, Vougioukas, Petridis, Pantic. CVPR 2021Checked
- S4Exploring Temporal Coherence for More General Video Face Forgery Detection(external)Zheng, Bao, Chen, Zeng, Wen. ICCV 2021Checked
- S5Deepfake-Eval-2024: A Multi-Modal In-the-Wild Benchmark of Deepfakes Circulated in 2024(external)Chandra et al. 2025Checked
FAQQuestions
What is the most cited deepfake detection paper to start with?
FaceForensics++ (Rössler et al., ICCV 2019). It defines the dataset most detectors are still trained on, 1,000 source videos manipulated four ways at three compression levels, and reports the XceptionNet baseline at 99.26 percent accuracy on raw video and 81.00 percent on c40 video.
Which paper compares deepfake detectors fairly?
DeepfakeBench (Yan et al., NeurIPS 2023 Datasets and Benchmarks). It re-implements 15 detectors in one codebase with one preprocessing pipeline, trains them all on FaceForensics++ c23 and reports frame-level AUC on 14 test sets; UCF leads within-domain at 0.9705 and SPSL leads the cross-domain average at 0.7875.
Which paper shows detectors failing on real deepfakes?
Deepfake-Eval-2024 (Chandra et al., 2025). On fakes collected from 88 websites in 2024, open-source detectors' AUC fell by 50 percent for video, 48 percent for audio and 45 percent for images against their original benchmarks, and the best off-the-shelf open-source video model scored 0.63.
Are the results in the table comparable with each other?
Only within a row's stated conditions. DeepfakeBench rows are frame-level AUC with training on FaceForensics++ c23; the FTCN and LipForensics rows are video-level AUC averaged over each clip; FaceForensics++ reports binary accuracy at three compression levels. A number moved out of its row loses its meaning.
Why are MesoNet and FaceForensics++ out of date order?
The list is in reading order. MesoNet (2018) is the earliest paper here, but it reads better after the dataset papers because its reported detection rates, above 98 percent for Deepfake on the authors' own data, only make sense next to its 0.6077 frame-level AUC on FaceForensics++ c23 in DeepfakeBench.