Detector calibration: what a 0.9 score does and does not mean

This page belongs to the deepfake detection hub and sits beside the definitions on the how AUC and EER are defined page. Those metrics rank scores; this page is about whether the scores mean anything as probabilities.

01What does calibration mean for a detector score?

A detector outputs a number between 0 and 1 for each frame or clip. The number is a probability only if it behaves like one. Guo et al. put the definition in one sentence: "given 100 predictions, each with confidence of 0.8, we expect that 80 should be correctly classified" (arXiv 1706.04599). For a deepfake detector, read "confidence of 0.8" as "scored 0.8 fake": across all items the model scores 0.8, eight in ten should be fake.

The paper's headline result is that this property is not automatic and has been getting worse. "Modern neural networks, unlike those from a decade ago, are poorly calibrated": a 5-layer LeNet on CIFAR-100 had an average confidence close to its accuracy, while a 110-layer ResNet on the same data was confident well beyond its accuracy. Depth, width, weight decay and batch normalisation all moved the gap. Deepfake detectors are deep image classifiers of exactly this kind, trained with the same losses, so there is no reason to expect their raw scores to be calibrated, and no benchmark table on this site reports that they are.

02How is calibration measured?

The tool is a reliability diagram: sort predictions into M equally spaced confidence bins, and for each bin plot the fraction that were correct against the average confidence in the bin. A calibrated model sits on the diagonal. Expected calibration error, ECE, collapses the diagram to one number, the weighted average over bins of the absolute gap between accuracy and confidence, with each bin weighted by its share of the samples. Maximum calibration error, MCE, is the largest gap in any bin. Guo et al. use ECE "as the primary empirical metric to measure calibration", and "for perfectly calibrated classifiers, MCE and ECE both equal 0".

Their Table 1, with M = 15 bins, gives the scale of the problem for standard vision networks. On CIFAR-100, ResNet 110 had an ECE of 16.53 percent before calibration, Wide ResNet 32 had 15.0, DenseNet 40 had 10.37 and the shallow LeNet 5 had 4.85. After temperature scaling, a method described below, the same four models measured 1.26, 2.32, 1.18 and 2.02. None of these are deepfake detectors; they are image classifiers of the same family as detector backbones.

03Why does AUC ignore calibration?

AUC is a ranking statistic. It asks how often a randomly chosen fake scores above a randomly chosen real, and any monotonic change to the scores, squashing them towards 0.5 or stretching them towards the ends, leaves every pairwise ordering intact and the AUC unchanged. The same is true of equal error rate, which is read off the same curve.

Corvi et al. (2023) show the two metrics coming apart on one detector. Their Table 2 reports a diffusion-image detector fused from two models at an average accuracy of 64.5 percent and an AUC of 94.1; after calibration, accuracy rose to 87.8 percent and the AUC stayed at 94.1 (arXiv 2211.00680). The detector ranked images equally well before and after. What changed was where its scores sat relative to the threshold, which is the part of the output a user actually acts on. The accuracy versus AUC page covers why the two disagree in general; calibration is the specific reason here.

04How does log loss penalise miscalibration?

Log loss, also called negative log likelihood or cross entropy, charges each prediction the negative logarithm of the probability it assigned to the true label. A confident wrong answer costs a great deal; a hedged one costs little. Guo et al. restate the standard result that "in expectation, NLL is minimized if and only if" the model's probabilities "recover the ground truth conditional distribution", which is to say that log loss is minimised by a calibrated model and by nothing else.

The Deepfake Detection Challenge used it for exactly this reason. Entries were ranked by log loss on a private test set of 10,000 clips, and the winning score was 0.4279 (arXiv 2006.07397, Table 2). The organisers note that 60 percent of submissions scored at or below 0.69, "roughly the score if one were to predict a probability of 0.5 for every video", which is the log loss of refusing to commit. The winner's loss split into 0.1983 on the challenge's own fakes and 0.6605 on the organic internet videos in the set, a near chance result on material from outside the training distribution. The how the challenge scored log loss page has the full table.

05What does a 0.9 mean on a new distribution?

Calibration is a property of a model on a distribution, not of the model alone. A detector whose 0.9 means 90 percent on FaceForensics++ c23 has no such guarantee on Celeb-DF v2 or on a clip from a social platform, because the scores it produces there come from inputs it never saw. The why scores fall on unseen sets page shows the ranking itself degrading, Xception from 0.9637 to 0.7365 frame-level AUC in DeepfakeBench; a probability fitted on the first set has no claim on the second, and the papers in that table do not report one.

Prevalence changes the reading again. The DFDC authors point out that in use "the ratio of Deepfaked videos to real videos may be less than one in a million", and that precision, the share of flagged items that are really fake, "is the most indicative metric for how a detection model will perform over a real distribution of videos". A score of 0.9 that was calibrated on a test set with half fakes is far from a 90 percent chance of fake when fakes are one in a million; the posterior depends on the base rate as much as on the model. The dataset bias page explains why the training distribution is narrower than it looks.

06How is a detector calibrated after training?

Post-hoc methods fit a small transform of the scores on a held-out validation set while the network's weights stay fixed. Platt scaling fits a logistic regression with two parameters on the raw logits. Temperature scaling, the method Guo et al. recommend, fits one: the logits are divided by a scalar T chosen to minimise log loss on the validation set, with T above 1 softening over-confident outputs. Because dividing by T does not change which class has the highest logit, "temperature scaling does not affect the model's accuracy"; it moves the probabilities, not the decisions.

Challenges that score calibrated decisions make the omission visible. ASVspoof 5 reports both a minimum detection cost, computed at the best threshold in hindsight, and an actual cost at the threshold the system chose; the top closed-condition system scored 0.2436 on the first and 0.9956 on the second, and the organisers state that "the top systems in both conditions obtained actDCF values close or equal to 1.0" because their scores were not calibrated (arXiv 2408.08739). A ranking metric said the system was good; the deployed threshold said it was useless.

07What to report alongside AUC

A benchmark row that gives only AUC describes a ranking and nothing about the scores. For a detector that someone will read at a threshold, the protocol on the fixing an operating point on your own data page applies, with two additions: the calibration set the scores were fitted on, and the ECE or log loss on the test set at the reported threshold. No single benchmark score predicts how a detector performs on unseen manipulations, and a probability that was never calibrated predicts nothing at all.