What is deepfake detection? How detectors decide, and how their decisions are scored

This page is the definition entry in the deepfake detection hub. It explains the task and its scoring; the twenty named detectors page lists the models that perform it, and the catalogue of generation methods lists what they are asked to catch.

01What does a deepfake detector actually decide?

A detector answers one question about one input: was this face manipulated or generated, or is it a real recording? FaceForensics++, the paper that fixed the task's shape in 2019, states it plainly: "We cast the forgery detection as a per-frame binary classification problem of the manipulated videos" (arXiv 1901.08971). The input is a cropped face, the output is a number between 0 and 1, and a threshold turns the number into a label.

The task is binary even when the fakes are not. FaceForensics++ was made with four manipulation methods and DF40 with forty, but the detector is scored on whether it separates every fake from every real, not on which method it names. Deciding which generator made a fake is a separate problem the papers call manipulation classification or attribution. Detection also says nothing about who the person is; that is face recognition, which shares the pipeline but asks a different question.

02How does a detector reach its score?

The mechanics fit in one paragraph because the frame-to-score pipeline page carries the detail. A face detector finds the face and its landmarks, the crop is aligned to a fixed geometry, and a trained network turns the crop into a score. DeepfakeBench applies the same pipeline to every dataset and samples 32 frames per video for training and testing, so that differences in cropping or frame count do not masquerade as differences between models (arXiv 2307.01426).

What the network learns to look at varies. The DeepfakeBench paper groups detectors into naive models, which are plain CNN classifiers, spatial models, which are pushed toward a cue such as a blending boundary or a reconstruction error, and frequency models, which read the spectrum or the noise residual. All three families produce the same kind of output, which is why one metric can grade them all.

03How is deepfake detection scored?

A benchmark holds out a test set of real and fake faces with known labels, runs the detector on every item and compares scores with labels. DeepfakeBench uses four metrics: "accuracy (ACC), the area under the ROC curve (AUC), average precision (AP), and equal error rate (EER)". AUC is the headline because it does not depend on a threshold: it measures how well the scores rank fakes above reals across every possible cut-off, so a detector whose scores are shifted but correctly ordered still scores well. Accuracy depends on the threshold and on the real-to-fake ratio of the test set.

Two conventions change the number without changing the model. Frame-level scoring treats every frame as an item; video-level scoring pools frames into one decision per clip. DeepfakeBench notes that "some are at the frame level, while others are at the video level, leading to unfair comparisons" and fixes on frames. Compression is the other: FaceForensics++ releases its videos raw, at H.264 quantisation parameter 23 and at 40, and the same detector scores differently on each. The definitions of AUC, EER and false positive rate are set out with their formulas on the metrics page.

04What do the published numbers look like?

Two rows anchor the scale. In FaceForensics++, XceptionNet trained on all four methods reached a binary accuracy of 99.26 percent on raw video, 95.73 percent on the c23 release and 81.00 percent on the c40 release, against 68.69, 66.57 and 58.73 percent for 204 human participants shown the same test images (Table 1 and section 4.1). In DeepfakeBench Table 3, the same architecture trained on FaceForensics++ c23 scored 0.9637 frame-level AUC on that set and 0.7718 on average across Celeb-DF v1 and v2, DeeperForensics-1.0, DFD, DFDC, DFDC Preview, FaceShifter and UADFV.

The gap between the first and second number of each pair is the central fact of the field. A detector scored on the set it was trained on reports an in-dataset figure; scored on a set made with other footage or other methods it reports a cross-dataset figure, and across the fifteen detectors in Table 3 the cross-dataset averages run from 0.6551 to 0.7875. Both kinds of figure, with their conditions, are on the in-dataset and cross-dataset scores table.

05Why does the score fall outside the benchmark?

Because the benchmark fixes the generators, the footage and the compression, and the world does not. DF40 re-ran Xception on fakes from forty generators and found that a model trained on face swaps from FaceForensics++ footage averaged 0.546 AUC on nine test-only sets built with newer methods on other footage, with 0.394 on one text-driven reenactment method (arXiv 2406.13495, Table 5). Deepfake-Eval-2024 went further and collected fakes that actually circulated in 2024 from 88 websites; it reports that open-source detectors' AUC fell "by 50% for video, 48% for audio, and 45% for image models compared to previous benchmarks" (arXiv 2503.02857).

No single benchmark score predicts how a detector performs on a manipulation it has not seen. A published AUC therefore carries four conditions with it: the training set, the test set, the compression and the level, frame or video, at which it was computed. A number quoted without them is not comparable to anything.

06What deepfake detection is not

It is not provenance. A detector infers manipulation from the pixels after the fact; a content credential records the origin at capture or export time, and the two answer different questions. It is not liveness or presentation attack detection, which asks whether a live person is in front of a camera rather than whether a stored clip was altered. And it is not a verdict: the output is a score under a threshold, and the papers above report the error rates that come with every threshold.