Individualized Deepfake Detection Exploiting Traces Due to Double Neural-Network Operations

TL;DR

This work targets deepfake detection tailored to specific public figures by conditioning on identity and exploiting the near-idempotence of neural-network deepfake generators. It introduces a reconstruction operator $R$, an identity-aware feature extractor, an identity decoder, and a Siamese classifier trained with contrastive learning to distinguish authentic from deepfake images via changes in feature space after sequential processing. Empirical results on a curated dataset of 45 identities show a mean AUC of $0.940$ with reduced variance, outperforming strong baselines and demonstrating the value of identity conditioning and the idempotence principle. The approach offers a practical, journalist-friendly tool for verifying claims about public figures and suggests avenues for generalization across deepfake operators and broader datasets.

Abstract

In today's digital landscape, journalists urgently require tools to verify the authenticity of facial images and videos depicting specific public figures before incorporating them into news stories. Existing deepfake detectors are not optimized for this detection task when an image is associated with a specific and identifiable individual. This study focuses on the deepfake detection of facial images of individual public figures. We propose to condition the proposed detector on the identity of an identified individual, given the advantages revealed by our theory-driven simulations. While most detectors in the literature rely on perceptible or imperceptible artifacts present in deepfake facial images, we demonstrate that the detection performance can be improved by exploiting the idempotency property of neural networks. In our approach, the training process involves double neural-network operations where we pass an authentic image through a deepfake simulating network twice. Experimental results show that the proposed method improves the area under the curve (AUC) from 0.92 to 0.94 and reduces its standard deviation by 17%. To address the need for evaluating detection performance for individual public figures, we curated and publicly released a dataset of ~32k images featuring 45 public figures, as existing deepfake datasets do not meet this criterion.

Figures (13)

• Figure 1: (a) Comparison of AUC performance for nine off-the-shelf deepfake detection methods (listed in TABLE \ref{['tab:summary3']}), two fine-tuned methods, and the proposed method, evaluated on GAN-based Faceswap-GAN fsg deepfakes and diffusion-based DiffSwap zhao2023diffswap deepfakes. Square markers denote methods without finetuning (unfilled) and with finetuning (filled), while the star marker highlights the proposed method. Method names are labeled near their respective markers for better visualization. (b) The inference pipeline of the proposed individualized deepfake detector leveraging the near-idempotence property and identity conditioning. The identity conditioning is achieved by combining the identity-aware processing trace and the input identity vector. To leverage the idempotence property, the test image is passed through a reconstruction operator $R$. If the test image exhibits a marginal change in the observed amount of processing traces, the test image is considered "deepfake"; if a significant change is observed, the image is considered "authentic." (c) t-SNE visualization of authentic, deepfake, and doubly-processed images and their corresponding vector shifts in t-SNE feature space across the two transformations. Red arrows indicate the vector shifts for the first transformation, while black arrows represent shifts during the second transformation. The first transformation causes a significant change when a deepfake operator initially processes an authentic image. In contrast, the second transformation results in only minor shifts. For more details, please refer to Section \ref{['sec:veri_near_idem']}.
• Figure 2: The training pipeline of the proposed deepfake detector leveraging the near-idempotence property of the deepfake generator. A side-by-side comparison with conventional deepfake detectors is also shown. In the proposed method, an authentic image is passed through a deepfake simulating network or reconstruction operator twice. Due to the near-idempotence property, the features for the first and the second outputs will be nearly identical. The features are obtained from an identity-aware feature extractor that is trained separately. We freeze the feature extractor network and train a Siamese network and an identity decoder to increase the Euclidean distance between the first pair (consisting of the authentic image and the first output image) and to decrease the Euclidean distance between the second pair (consisting of the first and the second output images).
• Figure 3: (a) Facial regions from raw images (first row) and reconstructed images (second row). The reconstructed images are singly processed. (b) Facial regions from deepfake images (first row) and reconstructed images (second row). The reconstructed images are doubly processed. The reconstruction models trained with images from the same person result in good visual quality for both raw and deepfake images.
• Figure 4: Backbone network training for identity-aware deepfake feature extraction. An authentic and deepfake image pair is passed through the teacher and student networks. The teacher network passes down the deepfake trace knowledge to the student network through loss functions $L_1$ and $L_2$. The loss function $L_3$ increases the feature distance between the authentic and the deepfake image.
• Figure 5: ROC curves for deepfake detection using the proposed method. Each plot contains results from a public figure, and each curve represents a trial of training the network. AUC values are large with small standard deviations, indicating good performance.