What is deepfake technology? Three model families behind face deepfakes

This page belongs to the deepfake detection hub and defines the technology; the step by step account of a single swap is on how deepfakes are made. The definition matters for detection because each family leaves different traces, and the benchmarks on this site are sorted by which family made the fakes.

01What is deepfake technology?

FaceForensics++ records that "the term Deepfakes has widely become a synonym for face replacement based on deep learning" and that it "is also the name of a specific manipulation method that was spread via online forums" (arXiv 1901.08971). DF40's footnote gives the etymology the field uses: "Deepfake is a term derived from 'deep' (the use of deep nets) and 'fake' (does not exist)". Merriam-Webster's entry, first known use 2018, extends it to any "digital image, video, voice, etc. that has been convincingly generated or altered to misrepresent someone as doing or saying something that was not actually done or said".

As technology rather than vocabulary, a deepfake is the output of a model trained on faces to produce faces. FaceForensics++ divides what the model does into "facial expression manipulation and facial identity manipulation"; DF40 counts four types, face swapping, face reenactment, entire face synthesis and face editing, with 10, 13, 12 and 5 methods respectively (arXiv 2406.13495). The what is a deepfake page in this section covers the types; this one covers the models underneath them, which cut across the types.

02How does deepfake technology work?

Every face deepfake runs the same five steps. A face detector finds the face in each frame or image. The face is aligned, meaning rotated and scaled so the eyes and mouth land on fixed positions, and cropped. A trained model then produces a new face: the source's identity on the target's head, the target's face with a new expression, or a face that belongs to nobody. The result is blended back into the frame; for DeepFakes, FaceForensics++ reports, the output is "blended with the rest of the image using Poisson image editing". Finally the frames are encoded as video.

The three families differ only at the third step, in how the model that draws the face was trained.

03Family one: paired autoencoders

The DeepFakes method "is based on two autoencoders with a shared encoder that are trained to reconstruct training images of the source and the target face". The shared encoder learns a compressed description of any face; each decoder learns to redraw one person from it. At render time "the trained encoder and decoder of the source face are applied to the target face", so the target's pose and expression are described by the encoder and redrawn with the source's features. FaceForensics++ notes the cost: models "need to be trained for each pair of videos, which is a timeconsuming task".

Later swap models kept the structure and replaced the identity half with a face recognition network. FaceShifter (CVPR 2020) uses "a pretrained state-of-the-art face recognition model as identity encoder"; SimSwap (ACM MM 2020) injects an identity vector from a pretrained ArcFace model so that one model can swap arbitrary pairs instead of being trained per pair (arXiv 2106.06340). DeepfakeBench's survey of the field lists UADFV, the DeepFakes split of FaceForensics++, Celeb-DF, DFD, DFDC, DeeperForensics-1.0 and ForgeryNet as face-swapping datasets of this autoencoder approach (arXiv 2307.01426), which is why detectors trained on them learned autoencoder artefacts first.

04Family two: generative adversarial networks

A generative adversarial network trains a generator to produce images that a second network, the discriminator, cannot tell from real ones, and improves both in turn. In face deepfakes GANs appear in two roles: as a training signal inside swap and reenactment systems (the NeuralTextures method in FaceForensics++ trains its rendering network with a photometric and an adversarial loss), and as the whole method in entire face synthesis, where the model produces a face from a random code with no source person at all.

StyleGAN2 is the reference for the second role. Trained on the 70,000 images of FFHQ at 1024 by 1024, it improved the FID score from 4.40 for the original StyleGAN to 2.84, and its authors "expose and analyze several of its characteristic artifacts", including the water-droplet artefact caused by instance normalisation, "and propose changes in both model architecture and training methods to address them" (arXiv 1912.04958). The same paper notes that the redesigned generator "becomes significantly easier to invert", which "makes it possible to reliably attribute a generated image to a particular network". The how AI faces are generated page follows this family in detail.

GAN outputs also carry a known spectral signature. Frank et al. (ICML 2020) found GAN images "exhibit severe artifacts" in frequency space "caused by upsampling operations found in all current GAN architectures", which is the basis of the frequency detector family.

05Family three: diffusion models

A diffusion model learns to turn noise into an image by reversing a gradual noising process, one denoising step at a time. DF40 describes entire face synthesis as "Face AIGC" and states that "the two widely used technologies to generate synthesis faces are GAN (e.g., VQGAN) and Diffusion models (e.g., StableDiffusion)". Its Table 2 labels DDPM, RDDM, PixArt-alpha, DiT-XL/2 and SiT-XL/2 as latent diffusion methods, and the face-editing method Collaborative Diffusion as diffusion based; the authors write that they "include the just-released DiT, PixArt-α" to simulate current real-world deepfakes.

Diffusion is the youngest family and the one the older benchmarks do not contain. DF40's motivation is that FaceForensics++ "contains out-of-date forgery techniques from the past four years", and its Protocol 3 shows what that means for a detector: Xception trained on FaceForensics++ swaps scores 0.882 AUC on DeepFaceLab fakes, in the same family it trained on, and 0.394 on HeyGen, with an average of 0.546 across the unknown-domain sets. Corvi et al. (2023) study the same question for still images, GAN-trained detectors applied to diffusion output under compression and resizing (arXiv 2211.00680). Whether diffusion faces carry a spectral signature a frequency detector can use is studied in those papers and is outside the shared face benchmarks this site records.

06Which family made the fakes in each benchmark?

Counts and labels are as the papers state them. Two of the four FaceForensics++ methods are not learned at all: Face2Face and FaceSwap are "computer graphics-based approaches", included because the detection problem is the same.

07How is deepfake technology detected and measured?

Each family leaves its own traces, and the detector families on the detection techniques compared page map onto them: spatial detectors look for the blending boundary that autoencoder swaps leave, frequency detectors for the spectral artefacts of GAN upsampling and compression, and naive classifiers for whatever the training set contains. The scores are read against the family that made the test fakes. In DeepfakeBench (2023) every detector trained on FaceForensics++ c23 averages below 0.79 frame-level AUC across eight unseen datasets, and in DF40 a detector trained on swaps averages 0.546 on fakes from families it never saw.

For video, the family changes what moves between frames; the deepfake videos page covers how clips are scored. For people, the family changes what is visible: FaceForensics++ participants caught autoencoder swaps 77.60 percent of the time and reenactments at chance, and the signs of a deepfake page gives the rest of that table. No single benchmark score predicts how a detector performs on a family of fakes it was not trained on.