Multimodal deepfake detection: joint models for face and voice

This page belongs to the deepfake detection hub. It sits between the face-only benchmarks and the voice deepfake benchmarks, and covers the case where a single clip can be forged on either track or both.

01What is multimodal deepfake detection?

A multimodal detector takes the video frames and the audio waveform of the same clip and outputs one score for the clip. A unimodal detector reads one track: the face detectors in the DeepfakeBench table read frames, and the ASVspoof countermeasures read speech. The multimodal case matters because a talking-face forgery can be made in three ways, with the face swapped and the voice real, the voice cloned and the face real, or both forged and then lip-synced to each other.

The FakeAVCeleb authors state the gap plainly: earlier datasets "either contain deepfake videos or audios", and a detector trained on one track has no view of the other (arXiv 2108.05080). A joint model can also use a cue that neither track carries alone, the correspondence between mouth movement and speech sound, which AVFF makes the centre of its method.

02How does FakeAVCeleb pair the four combinations?

FakeAVCeleb starts from 500 real YouTube videos of 500 celebrities taken from VoxCeleb2, a web-collected celebrity set built the same way as the withdrawn recognition sets traced on this site, one video per person, with an average duration of 7.8 seconds, chosen so that each of four ethnic groups holds 100 videos split evenly between men and women. Fakes were made with two face swap methods (Faceswap and FSGAN), one voice cloning method (SV2TTS) and one lip-sync method (Wav2Lip), and every combination of real or fake video with real or fake audio is present. The paper's Figure 1 gives the cell sizes.

Two design choices shape the scores. Swaps were made only within an ethnic group and within a gender, and source and target faces were paired by a face similarity score, because the authors found cross-group swaps "easily detectable". And the dataset is released by request form, so counts in later papers can differ from the paper's 20,000 when authors use a subset. How this set compares with the other public deepfake sets that carry audio is tabulated on that page.

03What did single-track detectors score on it?

The FakeAVCeleb paper ran eight frame-level detectors across eight datasets and reports that its own set "have the lowest AUC values mostly": Xception on compressed frames scored 72.5 percent frame-level AUC on FakeAVCeleb against 99.7 on the FaceForensics++ Deepfakes split, Capsule 70.9 and Meso4 60.9 (Table 3). The average over the eight detectors on FakeAVCeleb "is around 65%", and those averages count the frames only, with the audio track unused.

The appendix separates the two tracks. A video-only EfficientNet-B0 reached 93.3 percent AUC and a video-only VGG 49.6; an audio-only VGG reached 97.8 and an audio-only Meso4 73.5. Combining one audio model and one video model by voting gave 82.8 percent for the EfficientNet-B0 pair but 51.4 for the Xception pair, and the authors note that "none of the ensemble-based methods could achieve a high detection score" above 90. Three off-the-shelf multimodal networks borrowed from other tasks scored 53.3, 68.8 and 66.2. A track that scores 97.8 alone and 82.8 in a pair shows why a joint model needs to learn the pairing rather than vote on it.

04How does a joint model score the two tracks?

AVFF (2024) trains in two stages (arXiv 2406.02951). The first stage sees only real videos from LRS3 and learns audio and visual representations that predict each other, through contrastive and autoencoding objectives with a complementary masking scheme, so the model learns what matching mouths and speech look like before it sees any fake. The second stage adds a classifier and trains it on real and fake clips. On the FakeAVCeleb 70 to 30 split the paper reports an accuracy of 98.6 percent and an AUC of 99.1 percent, which it describes as 14.9 and 9.9 points above the earlier audio-visual state of the art.

The same table scores video-only detectors under a convention worth noting: for audio-visual methods a clip counts as fake "if either or both audio and visual modalities have been manipulated", while for video-only methods it counts as fake "only if the visual modality has been manipulated". Under those rules Xception scored 70.5 AUC, LipForensics 82.4, FTCN 84.0 and RealForensics 94.6, and the earlier audio-visual AVoiD-DF 89.2.

05Does the score hold on manipulations the model never saw?

AVFF's Table 2 splits FakeAVCeleb into five categories by generator and trains on four while testing on the fifth. On the real-video, cloned-audio category, which video-only detectors cannot score at all, AVFF reached 92.4 AUC. On the FSGAN plus Wav2Lip plus SV2TTS category, the hardest for the others, it scored 100.0 where LipForensics scored 68.1 and the audio-visual AV-DFD 55.4. Averaged over the four categories with fake visuals, AVFF reports 99.5 AUC against 97.1 for RealForensics and 88.1 for AV-DFD.

Trained on FakeAVCeleb and tested on a subset of KoDF, a Korean-language set made with different tools and speakers, AVFF scored 95.5 AUC and RealForensics 93.6 (Table 3). That is a cross-dataset drop of about four points from the in-dataset figure, far smaller than the drops face-only detectors show between FaceForensics++ and Celeb-DF, but it is one dataset pair and one protocol. The in-the-wild results page shows what the same kind of claim looked like once test clips came from real platforms, where audio detectors lost 48 percent of their AUC.

06What about finding the forged seconds inside a clip?

LAV-DF (2022) asks a different question: not whether a clip is fake but where. Its fakes change a few words so that the sentiment of the whole statement flips, with the replaced audio made by SV2TTS and the matching frames by Wav2Lip. The set holds 136,304 videos from 153 identities, 36,431 fully real and 99,873 with fake segments (arXiv 2204.06228). The task is temporal forgery localisation, scored by average precision at an overlap threshold rather than by AUC.

The paper's own baseline shows the multimodal gain directly. BA-TFD, a 3D CNN with contrastive, boundary matching and frame classification losses, reached an AP at 0.5 overlap of 76.90 on the full set with both tracks and 58.55 with the video track only (Table II). The 18-point gap is the clearest published number for what the audio adds, because everything else in the comparison is held fixed. Mouth-only forgeries and the detectors built for them are covered on the lip-sync deepfakes page.

07Why numbers differ between sources

The FakeAVCeleb paper gives Xception a frame-level AUC of 72.5 percent (its Table 3); AVFF gives Xception 70.5 (its Table 1). The two are not the same measurement: the first is a frame-level score on the full set with the compressed-frame variant, the second a clip-level score on a 70 to 30 split under AVFF's labelling rule. The same holds for every detector that appears in both. A reader comparing a joint model with a face-only one should check the split, the unit of scoring and the rule that decides when a clip with real frames and cloned audio counts as fake.

Multimodal detectors cover forged video and audio arriving as a file or a stream. They do not cover a photograph or mask held to a camera, which is the presentation attack problem; the spoofing and deepfake tests in one verification flow page explains why a deployment needs both.