Xception as a deepfake detector: every published score and its conditions

This page is part of the deepfake detection hub and expands one row of the results table. Every figure below names its training set, compression level, metric and source, because the same model's score moves by half under different conditions.

01What is Xception and why is it the baseline?

Xception is a convolutional network proposed by François Chollet in 2017 that replaces the Inception modules of its predecessor with depthwise separable convolutions. It has 36 convolutional layers in 14 modules with linear residual connections and 22,855,952 parameters, slightly fewer than Inception V3's 23,626,728, and scores a top-1 accuracy of 0.790 on the ImageNet validation set against Inception V3's 0.782 (arXiv 1610.02357). It was built for general image classification, not for faces.

It became the deepfake baseline because FaceForensics++ chose it. The ICCV 2019 paper tested several detectors on its four manipulations and found XceptionNet the strongest, and every benchmark since has kept it as the reference point. In DeepfakeBench's Table 3, 8 of the 15 detectors evaluated use an Xception backbone, including UCF, SPSL, F3Net and CORE; the purpose-built methods change the input, the loss or the training data and leave the network alone (arXiv 2307.01426). A detector that beats Xception has beaten a 2017 classifier with no deepfake-specific design.

02What did the FaceForensics++ paper report?

The first Xception deepfake numbers are accuracies, not AUCs, on video frames from the paper's own dataset: 1,000 pristine YouTube videos manipulated by DeepFakes, Face2Face, FaceSwap and NeuralTextures, released raw and at two H.264 compression settings, constant rate factor 23 (the HQ or c23 release) and 40 (LQ or c40). Trained on all four manipulations together, XceptionNet reached a binary accuracy of 99.26 percent on raw frames, 95.73 percent at c23 and 81.00 percent at c40 (Table 1 of arXiv 1901.08971).

The paper ran a user study on the same material for comparison: 204 participants reached 68.69 percent on raw frames, 66.57 percent at c23 and 58.73 percent at c40. The detector beat people at every compression level, and the gap narrowed as quality fell. These are in-dataset numbers: the test frames came from the same 1,000 source videos and the same four generators as the training frames. The FaceForensics++ page describes the set.

03What does DeepfakeBench report for Xception?

DeepfakeBench retrains every detector under one protocol, with the same face crops, the same frame sampling and the same metric, and its Table 3 is the most complete single row of Xception scores. All detectors are trained on FaceForensics++ c23 and evaluated as frame-level AUC. Within the training distribution Xception scores 0.9637 on c23 and 0.8261 on c40, and per manipulation 0.9799 on DeepFakes, 0.9785 on Face2Face, 0.9833 on FaceSwap and 0.9385 on NeuralTextures, for a within-domain average of 0.9450.

Outside it the row reads 0.9379 on UADFV, 0.8341 on DeeperForensics-1.0, 0.8163 on DFD, 0.7794 on Celeb-DF v1, 0.7374 on DFDC Preview, 0.7365 on Celeb-DF v2, 0.7077 on DFDC and 0.6249 on FaceShifter, for a cross-domain average of 0.7718. The benchmark's README notes that version 2 has run more evaluations and will update the table, so these are the paper's 2023 numbers; the DeepfakeBench page tracks the protocol and the cross-dataset generalisation page puts the drop beside other detectors.

Xception trained on FaceForensics++ c23, DeepfakeBench Table 3 (arXiv 2307.01426), read 9 November 2026. Dataset descriptions from the datasets' own papers as recorded on the datasets page.

04How much does the training subset change the score?

A great deal, and the Face X-ray paper (CVPR 2020) measured it. Its Table 1 trains Xception on the DeepFakes subset of FaceForensics++ alone and tests on each manipulation: 99.38 AUC on DeepFakes, 75.05 on Face2Face, 49.13 on FaceSwap and 80.39 on NeuralTextures, in percent (arXiv 1912.13458). The same architecture that scores 0.9833 on FaceSwap when FaceSwap is in its training set scores at chance when it is not. Its Table 2 gives Xception trained on all of FaceForensics++ an AUC of 87.86 on DFD, 48.98 on DFDC and 36.19 on Celeb-DF, as those sets stood in early 2020.

The lesson is that Xception learns whatever artefact separates real from fake in the data it was given. Given one generator, it learns that generator's fingerprint. Given four, it learns something broader but still tied to the compression and source footage of the 1,000 videos. The face swap deepfakes page shows what a detector built around the one artefact all swaps share does with the same training data.

05Why do Xception's Celeb-DF scores differ between sources?

Because the conditions differ, and both numbers are correct. The Face X-ray paper reports 36.19 AUC for Xception on Celeb-DF in 2020, trained on FaceForensics++ at the compression the authors used, tested on the Celeb-DF release of that date, with their own face crops and frame sampling. DeepfakeBench reports 0.7365 on Celeb-DF v2 in 2023, trained on c23 under its unified preprocessing, with frame-level AUC under its own evaluation code. Different training compression, different dataset version, different crops and different evaluation code moved the score by about 37 points. The same model name on two tables is not the same measurement, and the how to read a detection paper page lists the fields to check before two scores are compared.

The same caution applies to the FaceForensics++ accuracies. Accuracy at a fixed threshold is not AUC, and 95.73 percent accuracy at c23 in 2019 and 0.9637 AUC at c23 in 2023 describe different experiments on the same data. Neither is reported broken down by any attribute of the people in the videos; the Gender Shades study is the standing reminder that an aggregate rate can hide a large subgroup gap, and no published Xception table yet reports one.

06What does an Xception score tell you?

That a 2017 classifier with 22.9 million parameters separates real from fake frames almost perfectly when the test frames come from the same distribution as its training frames, and loses between 3 and 34 points of AUC when they do not. No published Xception score is a measurement of performance on an unknown video from the internet. The in-dataset numbers set the ceiling; the cross-dataset row is the number to quote when the question is what the detector does elsewhere.