UCF deepfake detection: the disentanglement detector with the leading in-dataset score

This page belongs to the deepfake detection hub and reads one row of the DeepfakeBench table in detail. The Xception as a deepfake detector page covers the baseline that UCF is built on and compared against.

01What does UCF do differently?

UCF starts from a diagnosis. Its authors argue that detectors overfit in two ways: to features that have nothing to do with forgery, such as background, identity or lighting, and to patterns specific to one forgery method, which do not transfer to another (arXiv 2304.13949). The paper's Figure 2 shows a t-SNE plot of Xception features on FaceForensics++ clustering by manipulation method, which the authors read as evidence that "Xception actually learns method-specific features".

The fix is a disentanglement framework that "decomposes image information into three distinct components: forgery-irrelevant, method-specific forgery, and common forgery features". Three mechanisms keep the parts apart: a multi-task head with a multi-class classifier that predicts which forgery method made the image and a binary real-or-fake classifier; a conditional decoder that reconstructs the image from forgery-irrelevant features plus a forgery condition; and a contrastive regularisation that pushes common and specific forgery features apart. At test time only the common forgery features are used to decide real or fake.

The backbone is "a modified version of Xception", initialised from ImageNet weights, with faces aligned by DLIB and resized to 256 by 256; training uses Adam at a learning rate of 0.0002 and a batch size of 32, with compression, horizontal flip and brightness-contrast augmentation. The default training set is the HQ (c23) version of FaceForensics++.

02What does UCF score in DeepfakeBench's table?

DeepfakeBench, from the same group, trains all fifteen detectors on FaceForensics++ c23 and reports frame-level AUC on six within-domain and eight cross-domain test sets (arXiv 2307.01426, Table 3). UCF leads nine of the sixteen columns: FF++ c23 0.9705, FF++ c40 0.8399, the Deepfakes split 0.9883, the FaceSwap split 0.9896, the NeuralTextures split 0.9441, the within-domain average 0.9527, DFDC 0.7191, DFDC Preview 0.7594 and UADFV 0.9528. The table's Top3 count gives UCF six within-domain and five cross-domain top-three finishes, more than any other detector.

It does not lead the cross-domain average. SPSL's 0.7875 beats UCF's 0.7801, and SPSL also takes both Celeb-DF columns, 0.8150 on v1 and 0.7650 on v2 against UCF's 0.7793 and 0.7527. On FaceShifter UCF scores 0.6462, third behind Face X-ray's 0.6553 and Capsule's 0.6465; the FaceShifter page explains why that set is low for everyone. The full set of frame-level rows for UCF and its peers carries every cell with its conditions.

03What did the UCF paper itself report?

The paper's own experiments use a different protocol from DeepfakeBench and give higher cross-dataset numbers. Trained on all four FaceForensics++ manipulations (the "FF-ALL" setting, HQ compression), UCF reports AUC of 0.805 on DFDC, 0.824 on Celeb-DF and 0.945 on DFD, with an average of 0.828 across the fifteen cells of Table 1 that also include four leave-one-method-out training sets. SPSL averages 0.817 in the same table, SRM 0.805, F3Net 0.785, SLADD 0.782, Face X-ray 0.773 and the Xception baseline 0.702.

Table 4 shows where the gain comes from. The Xception baseline scores 0.986 on FaceForensics++, 0.672 on Celeb-DF, 0.727 on DFD and 0.651 on DFDC. Adding the disentanglement framework alone lifts the three unseen sets to 0.785, 0.933 and 0.772; adding the multi-task head gives 0.804, 0.944 and 0.785; adding contrastive regularisation gives the final 0.824, 0.945 and 0.805. The within-dataset score barely moves, from 0.986 to 0.996, which is the pattern a generalisation method should show.

04Why numbers differ between sources

Three differences explain why the paper's 0.824 on Celeb-DF becomes 0.7527 in DeepfakeBench's table, and 0.805 on DFDC becomes 0.7191. First, DeepfakeBench's Table 1 marks UCF, like Face X-ray, F3Net, SPSL and SRM, as "Unpublished code, reproduced by us"; the benchmark number comes from a re-implementation, not the authors' weights. Second, the benchmark fixes preprocessing, frame sampling and training settings for every detector, where the paper used its own. Third, DeepfakeBench reports frame-level AUC explicitly, while the UCF paper reports AUC without stating the level in the text read for this page.

One more discrepancy sits inside DeepfakeBench itself. Its section 4.2 prose gives UCF's within-domain average as 95.37 percent, while Table 3 prints 0.9527. This site uses the table value. Both sources agree on the ranking: UCF first within-domain, SPSL first cross-domain.

05Is UCF the best deepfake detector?

On the stated measure, in-dataset frame-level AUC on FaceForensics++ c23 in DeepfakeBench, yes, at 0.9705. On any other measure the answer changes. The cross-dataset generalisation page shows how every score falls on unseen sets: UCF's 0.9705 against Xception's 0.9637 in-dataset becomes 0.7527 against 0.7365 on Celeb-DF v2, and 0.6462 against 0.6249 on FaceShifter. The DeepfakeBench authors themselves write that naive detectors "register high AUC values that are comparable to more sophisticated algorithms". The DF40 benchmark (2024) adds "Finding-2: Existing well-designed (SoTA) detectors may not have obvious advantages over the baseline" on its forty generators.

No single benchmark score predicts how a detector performs on unseen manipulations. A value of 0.9705 says that UCF separates real from fake frames almost perfectly on the compression level and four generators it was trained on; the 0.6462 on FaceShifter says what happens one generator later. A score on a curated set also says nothing about a fake that arrives through an injection or a video call, the routes described on the deepfake attack vectors page.

06How to read a disentanglement result

The claim in UCF's title is that a shared trace exists across forgery methods and can be isolated. The ablation in Table 4 is the evidence: each component raises the unseen-set scores while leaving the in-dataset score almost unchanged. The multi-class head is the unusual part; it uses the method label, which every curated dataset provides and no circulating fake does, so a reader should check whether a later paper that trains on found fakes can keep the benefit.

The vocabulary matters when comparing with recognition work. UCF outputs one score per frame and is judged by AUC, where a face recognition system outputs a similarity between two faces and is judged by error rates at a threshold; the 25 face recognition terms page separates the two.