Explainable deepfake detection: what heat maps and masks show

This page belongs to the deepfake detection hub. It reads the explanation side of a detection paper; the method itself has its own Face X-ray page, and the benchmark behind the numbers is described under DeepfakeBench.

01What counts as an explanation in deepfake detection?

Three kinds appear in papers. A saliency or class activation map highlights the pixels or regions a model relied on. A predicted mask or boundary map is an output the network is trained to produce, so it is part of the detector rather than a view of it. And a ground-truth mask, which some datasets ship, marks the manipulated region so detectors can be trained or scored on where the fake is.

Grad-CAM, first posted in 2016, belongs to the first kind. It uses "the gradients of any target concept" flowing into the final convolutional layer "to produce a coarse localization map highlighting the important regions in the image for predicting the concept". DeepfakeBench applies it "to highlight the potential forgery regions detected by the models". The FaceForensics++ and DFD datasets provide masks of the manipulated regions, and DeepfakeBench extracts them for methods that use mask supervision.

02What does Face X-ray predict?

Face X-ray defines its output as a greyscale image "that reveals whether the input image can be decomposed into the blending of two images from different sources". Where the input is a real image, the mask is all zeros. Where it is a manipulated image, the paper writes the value at each pixel as 4 times M times (1 minus M), with M the blending mask, so values are largest where the soft mask is half way between face and background, which is the boundary, and zero deep inside or outside the pasted region.

The idea rests on one assumption: "it only assumes the existence of a blending step". Because most face swaps and reenactments paste an altered face into a background, the boundary is a trace many methods share. The authors build blended images from real photographs, so the network can be trained without fakes from any manipulation method, and a classifier reads the predicted boundary to decide real or fake. The paper's own Table 2 reports an AUC of 95.40 percent on DFD for the version trained on FaceForensics++ plus blended images, against 87.86 for an Xception baseline.

03How well does it score, and why do sources differ?

DeepfakeBench Table 3 trains Face X-ray on FaceForensics++ c23 and reports frame-level AUC. It is the best detector in the table on FaceForensics++ Face2Face at 0.9872 and lower on the rest: 0.9290 on NeuralTextures, 0.8989 on UADFV, 0.7655 on DFD, 0.6786 on Celeb-DF v2 and 0.5531 on DeeperForensics-1.0. The published AUC scores page sets these beside the other detectors.

The original paper reports higher numbers on shared test sets. The two sources do not describe the same experiment, as the table shows.

The paper prints percentages, converted here to the same scale. DeepfakeBench states that "the official code for Face X-ray is not available", so it re-implemented the data generation and training "carefully following the instructions of the original paper". It also fixes its own preprocessing and a frame-level protocol. Training data, code and protocol all differ, and neither source reports which one explains the gap, so the safe reading is that a Face X-ray score depends on who trained it and how it was scored.

04What can a heat map or mask not show?

A heat map shows where a model attended, not whether that region is forged. The sanity checks paper tested saliency methods by randomising model parameters and found that "some existing saliency methods are independent both of the model and of the data generating process", and that "reliance, solely, on visual assessment can be misleading". It found that Gradients and Grad-CAM passed its checks, while Guided Backpropagation and Guided Grad-CAM did not. So a pleasing picture is not evidence, and the method behind it matters.

A predicted mask has its own limits. Face X-ray says it "relies on the existence of a blending step", so an entirely synthetic image may defeat it. Compression matters too: on FaceForensics++ its overall AUC was 87.35 percent on the lightly compressed version and 61.6 percent on the heavily compressed one, because "the heavier the compression, the less significant the forgery evidence". The cross-dataset generalisation page documents the same pattern for other detectors.

05How should an explanation figure be read?

Ask four questions of any figure showing a heat map or predicted mask. Is it a view of the model, such as Grad-CAM, or an output the model was trained to produce, such as a boundary map? Does the paper show failures as well as successes? Does the mask match a ground-truth mask where one exists? And does the score on a dataset the method never saw match the picture?

The last question is the one the Face X-ray numbers answer: a clean boundary on a training-like fake and an AUC near 0.55 on DeeperForensics-1.0 can come from the same detector. The checklist in how to read a detection paper extends the questions to the evaluation protocol.