ForgeryNet: 2.9 million images and 221,247 clips across 15 methods

This page is part of the deepfake detection hub and documents one row of the public deepfake datasets table. It records the counts, the four benchmark tasks and the one result the paper reports that later benchmarks confirmed: a detector trained on one forgery category drops sharply on another.

01What does ForgeryNet contain?

The dataset has two subsets. The image-forgery set holds 1,438,201 real and 1,457,861 fake still images, and the video-forgery set holds 99,630 real and 121,617 fake clips, 221,247 in all (arXiv 2103.05630). The paper's abstract gives the headline sizes as 2.9 million images and 221,247 videos, with 7 image-level and 8 video-level manipulation approaches, 36 perturbation types plus mixed perturbations, and annotations of "6.3 million classification labels, 2.9 million manipulated area annotations and 221,247 temporal forgery segment labels". Both sets are split into training, validation and test subsets "with a ratio close to 7:1:2".

Counts from the ForgeryNet comparison table and abstract. The original footage came from four public datasets and was chosen for variety in "angle, expression, identity, lighting, scenario", and the authors state that all the original data carry a Creative Commons Attribution licence. The paper was first submitted to arXiv on 9 March 2021, after DeeperForensics-1.0 and before the first in-the-wild sets.

02Which manipulation methods and categories does it use?

The 15 approaches span "face transfer, face swap, face reenactment and face editing", chosen so that the learning models behind them vary: "encoder-decoder structure, generative adversarial network, graphics formation and RNN/LSTM". The paper groups them at the top level into identity-remained forgeries, where the person is the same but expression or attributes change, and identity-replaced forgeries, where another person's face is put in. Later taxonomies keep the same top-level split.

The paper also fixes what counts as a forgery. Its footnote defines "face forgery" as "an image or a video containing modified identity, expressions or attribute(s) with a learning-based approach", and separates that from cheap fakes made "with off-the-shelf softwares without learnable components". The 36 perturbations follow visual quality assessment practice "with distortions of compression, transmission, capture, color, etc.", and the paper lists "optical distortion, multiplicative noise, random compression, blur" among them. The GAN against diffusion artefacts page explains why those perturbations matter: resizing and compression remove the high-frequency traces most detectors depend on.

03What are the four benchmark tasks?

ForgeryNet defines four tasks rather than one. Image Forgery Classification "distinguishes whether an image is forgery or not", with two-way, three-way and n-way label sets. Spatial Forgery Localization is defined as "localizing the face area manipulated by deep forgery approaches", with the difference between the forged and real image before perturbation as ground truth. Video Forgery Classification works on untrimmed videos, each of which "splices real and manipulated frames together", so only part of a clip is fake. Temporal Forgery Localization, which the authors present as a new task, asks a model to find the forged segments within such a clip.

The video construction is the distinctive choice. Earlier sets manipulated whole clips; ForgeryNet's untrimmed videos mean a frame-level detector that samples a few frames can miss the forged segment entirely, and the 221,247 segment labels exist to score that.

04What did the baselines score?

On binary image classification under Protocol 1, where training and test share the same forgery approaches, Xception reaches an accuracy of 80.78 percent and 90.12 AUC, F3-Net 80.86 percent and 90.15 AUC, and the largest model tested, ResNeSt-101, 82.06 percent and 91.02 AUC (Table 2). Video classification scores higher: X3D-M reaches 93.75 AUC single-crop and 96.99 multi-crop, SlowFast 93.88 and 97.28 (Table 6), and the authors note that "Video-level classification has better results than the image-level setting".

Protocol 2 is the cross-forgery test, and it is the result that carries. Xception trained on identity-replaced forgeries scores 92.80 AUC on identity-replaced test data and 74.86 on identity-remained data; trained the other way round it scores 90.71 on identity-remained and 75.83 on identity-replaced (Table 4). The video models drop further: X3D-M trained on identity-replaced forgeries falls from 92.91 to 62.87 AUC on identity-remained forgeries (Table 8). The authors write that models "have significant performance drops when tested on unseen ID-remained forgery approaches, and vice versa".

AUC in percent from ForgeryNet Tables 4 and 8.

05How does ForgeryNet compare with later datasets?

For three years it was the method-count leader. DF40 (2024) records that "ForgeryNet applies 15 methods" where earlier sets "contain only single or no more than 4 specific manipulation approaches", and its comparison table lists ForgeryNet as 6 face-swapping, 4 face-reenactment, 2 entire-face-synthesis and 3 face-editing methods with StarGANv2 as its latest generator (arXiv 2406.13495). The DF40 dataset then raised the count to 40 techniques. Deepfake-Eval-2024 names ForgeryNet alongside FaceForensics++ as a set that uses "outdated manipulation techniques" compared with fakes that circulated in 2024 (arXiv 2503.02857).

ForgeryNet's image counts also appear in the generated-image literature: GenImage's comparison table lists it at 1,438,201 real and 1,457,861 fake images, the same figures as the paper, against GenImage's own 1,331,167 and 1,350,000 (arXiv 2306.08571). The cross-forgery drop that ForgeryNet measured in 2021 is the finding DF40 restated in 2024 and Deepfake-Eval-2024 measured in the wild, and the sibling pages on deepfake detection tips tested against the evidence and whether Content Credentials survive upload follow what that means for a viewer who has only the clip.

A dataset's method count fixes the forgeries a detector can learn; ForgeryNet's own cross-forgery table shows a 15 to 30 point AUC drop the moment the test category changes.