Real-time video call deepfakes: what has been measured

This page sits in the deepfake detection hub beside the liveness and injection attacks page, which covers the verification side. Here the question is narrower: what has actually been measured about live swaps in calls, and what the official case records say.

01What is a real-time video call deepfake?

The GOTCHA authors define real-time deepfakes as systems that "replace an imposter's face with their victim in live video interactions" (arXiv 2210.06186). The swap runs frame by frame on the caller's own machine, and the output is handed to the meeting software as if it were a camera. That hand-off is the injection step: the European Union Agency for Cybersecurity's 2022 remote identity proofing report states that "video injection is the most promising attack method, according to market players", because it bypasses the camera entirely.

The attack therefore has two parts that are measured separately. The generation part is a face swap or reenactment model fast enough to keep up with a call. The delivery part is a virtual camera or device emulator, which NIST SP 800-63A asks identity services to detect, warning that a biometric comparison on the captured image does not by itself prevent these attacks. The delivery part, and the test specification written for it, are covered on the injection attacks page listed under related reading below.

02How fast does a live face swap run?

The GOTCHA paper is the one peer-reviewed source this site has found that prints frame rates for a live swap. Its Table 1 gives DeepFaceLab inference at 1.2 frames per second on an 8-core CPU, 23.5 frames per second once an RTX 3070 GPU with 8 GB is added, 21.1 with a WiFi camera feeding that GPU, and 20.2 with an LTE phone camera. The paper colours anything below 15 frames per second as failing the real-time threshold, so a single consumer GPU is enough and a CPU alone is not.

The same paper records the cost that the frame rate hides. A target-specific DeepFaceLab model needs about 4,000 diverse face images of the target and training that can take "up to a week", while target-agnostic methods such as FSGAN and the Latent Image Animator work from a pretrained model but produce more fragile results. The three pipelines the authors tested, LIA, FSGAN and DeepFaceLab, are the ones this page means when it says "a live swap".

03What does the Hong Kong record say?

The written reply by the Secretary for Security to the Legislative Council on 26 June 2024 is the primary record for the cases most often cited. It states that "up to May 31, 2024, the Police have received three cases relating to deepfake technology, which occurred in August 2023, January 2024 and May 2024 respectively" (info.gov.hk, LCQ9). The documented deepfake scams page carries the wider official record; the three cases are summarised here because two of them were video conferences.

Two details matter for anyone citing the January 2024 case as a real-time deepfake. The police believed "the pre-recorded video conference was generated using downloaded online public video clips and voices of the impersonated officer", and the fraudster ended the meeting and continued by instant messaging. Neither Hong Kong case is recorded as a live, interactive swap of the kind the GOTCHA paper benchmarks; both are recordings or altered clips played into a conference. The same reply counts 21 online deepfake clips impersonating officials or celebrities between 1 November 2023 and 31 May 2024, all removed at police request, with no report of anyone defrauded by them.

04What has been measured for detection in a live call?

Conventional detectors score a saved clip; the temporal and video-level detection page explains how. A live call allows something a file does not: the other party can be asked to do something. The GOTCHA study built this into a challenge-response protocol and is, as of its 2024 version, the only published measurement of such a test on real-time swaps. It recorded 47 participants performing eight challenges, generated 56,247 short real and fake videos across the three pipelines, and reports that human raters separated original from swapped responses with an AUC of 88.6% (accuracy 81.2% at the authors' threshold) and that an automated fidelity score reached an AUC of 80.1%.

The challenges that worked are physical: head movement, occluding the face with a hand, sunglasses or a mask, deforming the face, protruding the tongue, altering expression, and a flash of illumination. The Hong Kong police advice in the same Legislative Council reply is the informal version of the same idea: ask the person to turn their head "up, down, left or right" and watch for any abnormality. Both rely on the swap failing at the edges of its training data, which the GOTCHA authors note the imposter can reduce by collecting more diverse footage of the target. An imposter who knows which challenge is coming is the live-call version of the adaptive attacker that the adversarial attacks on detectors page documents for saved clips.

05Why do presentation attack tests not cover a call?

Liveness products are certified against ISO/IEC 30107-3:2023, whose scope says "the attacks considered in this document take place at the biometric capture device during presentation". A face swap injected as a virtual camera never passes the capture device, so an APCER figure from that standard says nothing about it. CEN/TS 18099:2024, valid from 16 December 2024, is the first test specification for biometric data injection attack detection and places presentation attack testing out of its own scope for the same reason.

The gap also reaches the matching stage. A verification system compares the injected face with the enrolled one, and if the swap carries the enrolled identity, the comparison passes at the operating thresholds the face verification metrics page describes; NIST SP 800-63A sets a false match rate of 1 in 10,000 or better for that step but states that the comparison itself "does not prevent these attacks". Verification accuracy and injection resistance are two different measurements, and a vendor figure for one is not evidence of the other.

06What the numbers do and do not show

Three facts are on the record. A live swap runs above 20 frames per second on a consumer GPU. The two Hong Kong video conference cases involved recordings or altered clips rather than interactive swaps. One peer-reviewed challenge-response test reached an AUC of 88.6% for humans and 80.1% for an automated score, on a dataset the authors built from 47 people. No published study has measured how often live swaps appear in real calls, and no detector has a reported figure on swaps injected into commercial meeting software, so any such percentage quoted elsewhere has no primary source behind it. The face that a swap wears is also someone's biometric data, which is why the facial recognition privacy rulings on scraped face databases apply to the footage a target-specific swap is trained on.