# DF40: Toward Next-Generation Deepfake Detection

Zhiyuan Yan1 1Peking University
2Tencent Youtu Lab
Taiping Yao2 1Peking University
2Tencent Youtu Lab
Shen Chen2 1Peking University
2Tencent Youtu Lab
Yandan Zhao2 1Peking University
2Tencent Youtu Lab
Xinghe Fu2 1Peking University
2Tencent Youtu Lab
Junwei Zhu2 1Peking University
2Tencent Youtu Lab

Donghao Luo2 1Peking University
2Tencent Youtu Lab
Li Yuan1 1Peking University
2Tencent Youtu Lab
Chengjie Wang2 1Peking University
2Tencent Youtu Lab
Shouhong Ding2 1Peking University
2Tencent Youtu Lab
Yunsheng Wu2 1Peking University
2Tencent Youtu Lab

###### Abstract

We propose a new comprehensive benchmark to revolutionize the current deepfake
detection field to the next generation. Predominantly, existing works identify
top-notch detection algorithms and models by adhering to the common practice:
training detectors on one specific dataset ($e.g.$, FF++ [67]) and testing
them on other prevalent deepfake datasets. This protocol is often regarded as
a "golden compass" for navigating SoTA detectors. But can these stand-out
"winners" be truly applied to tackle the myriad of realistic and diverse
deepfakes lurking in the real world? If not, what underlying factors
contribute to this gap? In this work, we found the dataset (both train and
test) can be the "primary culprit" due to the following: (1) forgery
diversity: Deepfake techniques are commonly referred to as both face forgery
(face-swapping and face-reenactment) and entire image synthesis (AIGC,
especially face). Most existing datasets only contain partial types of them,
with limited forgery methods implemented ($e.g.$, 2 swapping and 2 reenactment
methods in FF++); (2) forgery realism: The dominated training dataset, FF++,
contains out-of-date forgery techniques from the past five years. "Honing
skills" on these forgeries makes it difficult to guarantee effective detection
generalization toward nowadays’ SoTA deepfakes; (3) evaluation protocol: Most
detection works perform evaluations on one type, $e.g.$, train and test on
face-swapping types only, which hinders the development of universal deepfake
detectors. To address this dilemma, we construct a highly diverse and large-
scale deepfake detection dataset called DF40, which comprises 40 distinct
deepfake techniques (10 times larger than FF++). We then conduct comprehensive
evaluations using 4 standard evaluation protocols and 7 representative
detection methods, resulting in over 2,000 evaluations. Through these
evaluations, we provide an extensive analysis from various perspectives,
leading to 12 new insightful findings contributing to the field. We also open
up 5 valuable yet previously underexplored research questions to inspire
future works.

Note: We will release the DF40 dataset with easy-to-use instructions, a
unified codebase for train and test, and pre-trained weights of all models on
GitHub. For a quick overview of our conclusions, please refer to the takeaways
in Sec 9.

##  1 Introduction

We are currently in 2024, an explosive era of Artificial Intelligence
Generated Content (AIGC), a world where you can effortlessly make anyone say
anything at any time, a realm where reality and fiction blend seamlessly,
creating a mesmerizing tapestry of digital artistry and potential deception.
Amidst this AIGC revolution, the ease of generating deepfakes111Deepfake is a
term derived from ”deep” (the use of deep nets) and ”fake” (does not exist in
the real world). has become a "double-edged sword." Unfortunately, deepfake is
often misused for manipulating one person’s identity (face-swapping) or
controlling facial expressions and movements in a portrait (face-reenactment).
It can be particularly harmful as it may lead to severe digital crimes and
undermine social trust. Therefore, there is an urgent need to develop a
reliable system for detecting deepfakes. In a narrow sense, deepfake refers to
face forgery, generally including face-swapping and face-reenactment [94]. In
a broader sense, it also includes entire image synthesis (not limited to
face), widely called AIGCs [81]. Naturally, deepfake detection methods can be
broadly classified into two sub-fields: face forgery detection and AIGC
detection. Previous works often treat these sub-fields as separate issues, as
it is widely believed that they may have distinct fake artifacts: face forgery
can be local, with only the facial region manipulated, while AIGC artifacts
can be global, involving the entire synthesized image content. For this
reason, most detection methods can only be applied to solve one type of these
issues.

Figure 1: Overview of our DF40 dataset. DF40 shows advantages in data
diversity, synthesis quality, and deepfake realism. Note all the above figures
are deepfake, which does not exist in the real world.

To illustrate, in face forgery detection, blending-based detectors [11; 46;
70; 45; 95] have achieved SoTA results on existing datasets ($e.g.$, CDF
[47]), which involve image blending to create pseudo-fake training fakes. All
these methods are based on an assumption that existing face-swapping should
share a blending step222Blending the altered face into an existing background
image, as initially proposed by [45].. However, actually, recent advancements
in face-swapping ($e.g.$, Simswap [13], FaceDancer [66]) directly generate all
content (including the background) without blending. Regrettably, this crucial
observation may not be well-known in the field, as most existing datasets
typically belong to "DF-family"333The term ”DF-family” refers to face forgery
techniques that involve creating a mask around the facial region and blending
the generated deepfake face back into the background image using that mask.
($e.g.$, CDF [47]). As a result, blending-based detection methods ($e.g.$,
[100; 70]) can achieve remarkable generalization results on the existing
deepfake datasets ($e.g.$, CDF [47]) due to the presence of blending artifacts
but fail to generalize well outside the DF-family datasets (forgeries wo
blending). As evidenced in [92], [70] achieves 85% AUC on the CDF dataset
(from DF-family), but only 47% in testing SD [64] generated images (outside
DF-family). In Sec. 4, we comprehensively re-evaluate it on 31 distinct
deepfakes (some are nowadays’ SoTA), showing that the generalization
capability of current blending-based methods is still limited. Similar
examples can be observed in the AIGC detection field. Recent work [87]
proposed detecting diffusion-generated images by measuring the error between
an input real image and its reconstruction counterpart using a pre-trained
diffusion model. However, this detector is still "diffusion-heavy," meaning it
only learns the diffusion-specific feature.

Hence, although many previous efforts have pursued detection generalization,
they often remain limited in addressing only a subset of deepfake types
($e.g.$, only face-swapping belongs to the "DF-family") and cannot truly non-
trivially be applied to generalize all deepfake types. In a real-world
scenario with unpredictability and complexity, creating such a "unified"
detector is essential. We discovered previous work [82] attempted to detect
all CNN-generated images within one unified model, but its scope is still
limited to the entire image synthesis, not including recent popular diffusion
models and other deepfake types ($e.g.$, face-swapping). Hence, this issue has
persistently been challenging, as most existing datasets either contain
limited types (see Tab. 1) or are specific to a single type ($e.g.$, DF-family
only).

Therefore, we realize that a diverse and comprehensive dataset is the true key
to "unlock" the potential of ideal deepfake detection. To this end, we "jump"
from the previous protocol settings ($e.g.$, train and test solely on DF-
family) and propose a new comprehensive dataset called DF40. Our main
contribution can be generally summarized as three folds: (1) Our DF40
implements 40 different deepfake techniques, including face-swapping, face-
reenactment, entire face synthesis, and face editing. We even include the
just-released DiT [59], PixArt-$\alpha$ [10], and highly popular software
DeepFaceLab [18] and HeyGen [28] to simulate real-world deepfakes; (2) We
introduce 4 standard protocols for evaluations and show 8 insightful findings
to the field. We also open up new research questions and topics to inspire
future research toward next-generation deepfake detection. (3) We release all
pre-trained weights from our evaluations, allowing other researchers can
directly leverage them to develop their algorithms for improved detection. For
example, we release the pre-trained model for CLIP-large (a vanilla binary
classifier trained on the proposed DF40 dataset), which achieves an AUC of 98%
on DeepForensics [35], 95% on FaceShifter [44], 90% on CDF-v2 [47], and 85% on
DFDC [20] at the frame level. This performance outperforms almost all other
existing SoTA detectors without relying on previously considered beneficial
techniques such as blending methods and other complex constraints.

Furthermore, it is important to note that, without our DF40 dataset, we might
only see "the tip of the iceberg" and assume that blending might be "all you
need" to solve most deepfake problems. However, our work reveals that the
generalization capabilities of blending-based detection methods are limited,
and there is still much room for improvement in the deepfake detection domain.
It is crucial to develop more robust detection methods that can effectively
handle diverse deepfake techniques and data sources, going beyond blending
artifacts to address the deepfake problem comprehensively. So in this work, we
re-evaluate existing deepfake detectors thoroughly and open up several
valuable yet previously underexplored research questions to inspire future
works. For now, we believe we have entered the next generation of deepfake
detection.

Table 1: Comparison of existing/previous deepfake datasets. DF40 surpasses any
other dataset in diversity, scale, and modeling. Deepfake data in DF40 is
created by 40 deepfake techniques, including 10 FS methods, 13 FR methods, 12
EFS methods, and 5 FE methods.

Dataset | Publication | Latest Fake | Methods | FS | FR | EFS | FE | Fake Videos | Fake Images | Pretraining
---|---|---|---|---|---|---|---|---|---|---
DF-TIMIT [41] | ArXiv’18 | faceswap-GAN [69] (2018) | 2 | 2 | - | - | - | 640 | - | -
UADFV [96] | ICASSP’19 | Unknown | 1 | 1 | - | - | - | 49 | 252 | -
FaceForensics++ [67] | ICCV’19 | NeuralTextures [76] | 4 | 2 | 2 | - | - | 4K | - | -
DeepFakeDetection [21] | None | Unknown | 5 | 5 | - | - | - | 3068 | - | -
CDF [47] | CVPR’20 | Unknown | 1 | 1 | - | - | - | 5,639 | - | -
DFFD [17] | CVPR’20 | StyleGAN [38] (2018) | 7 | 7 | - | - | - | 3000 | 0.2M+ | -
DeeperForensics-1.0 [35] | CVPR’20 | DF-VAE [35] (2020) | 1 | 1 | - | - | - | 10K | - | -
DFDC [22] | ArXiv’20 | StyleGAN [38] (2018) | 8 | 5 | 1 | 2 | - | 0.1M+ | - |
ForgeryNet [27] | CVPR’21 | StarGANv2 [15] (2020) | 15 | 6 | 4 | 2 | 3 | 0.1M+ | 1M+ | ✓
FakeAVCeleb [40] | NeurIPS’21 | Wav2Lip [60] (2021) | 4 | 2 | 2 | - | - | 9.5K | - | -
KoDF [42] | ICCV’21 | Wav2Lip [60] (2021) | 6 | 3 | 3 | - | - | 0.1M+ | - | -
FFIW [101] | CVPR’21 | FSGAN [57] (2019) | 3 | 3 | - | - | - | 10K | - | -
DF3 [36] | TMM’22 | StyleGAN3 [37] (2021) | 6 | - | - | 6 | - | 15k+ | - | -
DeepFakeFace [74] | ArXiv’23 | Stable-Diffusion [83] (2021) | 3 | 1 | - | 2 | - | - | 90K | -
DF-Platter [55] | CVPR’23 | FaceShifter [44] (2020) | 3 | 3 | - | - | - | 0.1M+ | - | -
DiffusionDeepfake [6] | ArXiv’24 | Stable-Diffusion [83] (2021) | 2 | - | - | 2 | - | - | 0.1M+ | -
DF40 (Ours) | - | PixArt-$\alpha$ [10] (2024) | 40 | 10 | 13 | 12 | 5 | 0.1M+ | 1M+ | ✓
|  |  |  |  |  |  |  |  |  |

i) Latest Fake: The year when the latest deepfake method was added to the
dataset, $e.g.$, the latest method in ours is PixArt-$\alpha$ [10] (2024).

ii) Methods: The number of different deepfake methods used to generate fakes
in the dataset. The methods are generally classified into:

face-swapping (FS), face-reenactment (FR), entire face synthesis (EFS), and
face editing (FE).

iii) Fake Videos and Fake Images: The number of fake videos and images
involved in the dataset.

iv) Pretraining: Indicates if pretraining was conducted and pretraining
weights were released in the dataset.

##  2 Background

This section briefly introduces the background and its related works,
structured around three focal points. First, we briefly introduce deepfake
generation techniques, including face-swapping (FS), face-reenactment (FR),
entire face synthesis (EFS), and face editing (FE). We consider both academic
works and popular software online. Second, we delve into deepfake detection,
including face forgery detection and AIGC detection. Last, we review existing
deepfake datasets and benchmarks, underscoring the need for diverse and
comprehensive datasets for next-generation deepfake detection.

###  2.1 Deepfake Generation.

Based on previous survey [54], deepfake techniques can be typically classified
into four types: face-swapping (FS), face-reenactment (FR), entire face
synthesis (EFS), and face editing (FE). (1) Face-swapping: This paper
classifies the face-swapping technique into two domains: DF-family and FS-
family. (i) DF-family involves creating a mask around the facial region (some
even include the neck [50]) and blending the generated deepfake face back into
the background image using that mask. Most existing and famous face forgery
datasets, such as FF-DF [67], Celeb-DF [47] and DFDC [20], belong to this
line. (ii) FS-family methods represent another significant category in face-
swapping deepfake generation. These methods typically involve the use of an
identity-background encoder. It disentangles a face image’s identity and
background information during encoding. Notably, these methods directly
generate all content, even the background. Much recent face-swapping research
works [90; 13] and popular software ($e.g.$, Roop [65]) are within this line.
(2) Face-reenactment: Generally, this technique can be used to modify source
faces, imitating the actions or expressions of another face. Differing from
face-swapping, face-reenactment techniques are rarely considered in existing
datasets. Two commonly used reenactment-based forgeries are Face2Face [77] and
NeuralTextures [76]. These two forgeries are implemented in the FF++ dataset.
Face2Face employs pairs of original and target faces, using key facial points
to generate varied expressions, while NeuralTexture uses rendered images from
a 3D face model to migrate expressions. Although these forgeries achieve more
realistic visual synthetic results compared to their face-swapping
counterparts in FF++, Due to the amazingly rapid development of the AIGC
technologies ($e.g.$, Digital Human), these relatively old-fashioned methods
cannot represent the modern’ SoTA reenactment methods. Our DF40 implements 13
face-reenactment methods in total, including the classical animation [72; 73],
SoTA’s audio-based driven methods [97; 60], image-based driven methods [86;
31; 7]. We also include the well-known best face generation technique, HeyGen
[28], in our dataset for evaluation. (3) Entire Face Synthesis: This technique
can be generally treated as "Face AIGC." With the rapid development of AIGCs,
this technique has achieved remarkably notable improvement. The two widely
used technologies to generate synthesis faces are GAN ($e.g.$, StarGAN [14])
and Diffusion models ($e.g.$, StableDiffusion [64]). (4) Face Editing: This
technique aims to modify the facial attributes ($e.g.$, age and gender) of the
given face images. Most of these works utilize the latent code of StyleGAN
[39] to perform editing during GAN inversion. In our DF40 dataset, we also
consider the diffusion-based face editing method [32].

###  2.2 Deepfake Detection

Since deepfake detection can be broadly classified into face forgery detection
and (general) AIGC detection (not limited to face), we will briefly introduce
the typical works of each sub-field. (1) Face Forgery Detection. Earlier
deepfake detection techniques primarily relied on traditional digital image
processing methods. These approaches utilized natural video characteristics
such as phoneme-viseme mismatches [4], depth of field [34], color components
[43], and head poses [96]. However, with the advent of deep learning, the
focus has now shifted towards learning-based detectors due to their superior
feature extraction capabilities. Following the recent deepfake benchmark [94],
Most existing deepfake detectors can be broadly divided into naive, spatial,
and frequency. (i) The naive detector employs CNNs to perform binary
classification that distinguishes deepfake content from authentic data.
Numerous CNN-based binary classifiers have been proposed, $e.g.$, MesoNet [2]
and Xception [67]; (ii) Spatial detector delves deeper into specific
representation such as forgery region location [56], disentanglement learning
[93], image reconstruction [8], erasing technology [79], image blending [70;
45; 11], $etc$; (iii) The frequency detector addresses this limitation by
focusing on the frequency domain for forgery detection. SPSL [48] and SRM [52]
utilize phase spectrum analysis and high-frequency noises, respectively. F3Net
[61] proposes using learnable filters for adaptive mining of frequency forgery
clues using frequency-aware image decomposition. In our work, we further make
another new type: blending-based detectors due to the distinct training
paradigm. These methods specifically focus on the detection of blending
artifacts [46; 45; 11], generating forged images during training in a self-
supervised manner to boost detector generalization. These techniques aim to
extract more comprehensive and discriminative features by leveraging various
aspects of the input data. (2) AIGC Detection. As generative models produce
increasingly realistic images, the importance of AIGC detection has grown. In
earlier studies, AutoGAN [98] revealed the presence of unique artifacts in
GAN-generated images, which can be observed periodically in the images’
frequency spectrum. Wang et al. [82] suggested that a classifier trained on
one CNN generator, with suitable training data and data augmentation, can
generalize effectively to other unseen generators. However, these approaches
have exhibited limited generalization capabilities when applied to images
generated by diffusion models. Recently, DIRE [87] employed the error between
an input image and its reconstruction using a pre-trained diffusion model to
detect fake images. Nonetheless, this method is specifically designed for
diffusion models and cannot be directly applied to detecting GAN-based models.

###  2.3 Existing Deepfake Datasets.

Most earlier public deepfake datasets published before 2021 [41; 96; 21; 47;
67; 17] generate deepfakes using only the face-swapping technique within "DF-
family." Also, these datasets contain only single or no more than 4 specific
manipulation approaches. Notably, DFDC [20] implements 7 deepfake approaches
(most are DF-family face-swapping) and extends the data scale to the million-
level. After that, ForgeryNet [27] applies 15 methods to create forgery data
with a million-level data scale. However, with the advent of both AIGCs and
diffusion-based generators, producing realistic content has become
increasingly popular and widely seen on social media. Consequently, it is
uncertain whether a detector trained on older forgery methods can generalize
to today’s SoTA deepfakes, $e.g.$, diffusion-generated content. In response,
many recent works [36; 74] have begun to focus on current generative models. A
very recent study, DiffusionDeepfake [6], proposes a diffusion-specific
dataset containing two mainstream state-of-the-art diffusion generators:
Stable-Diffusion [64] and MidJourney [53]. Furthermore, to detect these AIGC-
generated images (not limited to face), GenImage [102] introduces a million-
scale dataset created by 8 different generative models (including both GAN and
Diffusion). However, it is crucial to note that [6] and [102] are still within
only the AIGC scope and may not guarantee successful detection of other
deepfakes, $e.g.$, face-swapping. A more comprehensive comparison of existing
datasets can be referred to Tab. 1.

Table 2: Involved/Implemented deepfake methods of the proposed DF40 dataset.
We use the following 40 distinct methods to create deepfake videos and images
for evaluation.

Type | ID-Number | Method | Sub-Types | Venue | Real Data Source | Data Format | Data Used | Data Scale | Code Link
---|---|---|---|---|---|---|---|---|---
Face-swapping (FS) | 1 | FSGAN [57] | Parsing mask | ArXiv 2019 | FF++ & CDF | Video | Train & Test | 1500+ | Hyper-link
2 | FaceSwap [1] | Graphic based | None | FF++ & CDF | Video | Train & Test | 1500+ | Hyper-link
3 | SimSwap [13] | Disentangle | ICCV 2019 | FF++ & CDF | Video | Train & Test | 1500+ | Hyper-link
4 | InSwapper [33] | Used in Roop [65] | None | FF++ & CDF | Video | Train & Test | 1500+ | Hyper-link
5 | BlendFace [71] | Disentangle | ICCV 2023 | FF++ & CDF | Video | Train & Test | 1500+ | Hyper-link
6 | UniFace [90] | Disentangle | ECCV 2022 | FF++ & CDF | Video | Train & Test | 1500+ | Hyper-link
7 | MobileSwap [91] | Lightweight | AAAI 2022 | FF++ & CDF | Video | Train & Test | 1500+ | Hyper-link
8 | e4s [50] | Disentangle | CVPR 2023 | FF++ & CDF | Video | Train & Test | 1500+ | Hyper-link
9 | FaceDancer [66] | Disentangle | WACV 2023 | FF++ & CDF | Video | Train & Test | 1500+ | Hyper-link
10 | DeepFaceLab [18] | High quality | PR 2023 | UADFV [96] | Video | Test Only | 100 | Hyper-link
Face-reenactment (FR) | 11 | FOMM [72] | Image Driven | NeurIPS 2019 | FF++ & CDF | Video | Train & Test | 1,500+ | Hyper-link
12 | FS_vid2vid [84] | Landmark Driven | ArXiv 2019 | FF++ & CDF | Video | Train & Test | 1,500+ | Hyper-link
13 | Wav2Lip [60] | Audio Driven | MM 2020 | FF++ & CDF | Video | Train & Test | 1,500+ | Hyper-link
14 | MRAA [73] | Image Driven | CVPR 2021 | FF++ & CDF | Video | Train & Test | 1,500+ | Hyper-link
15 | OneShot [85] | Image Driven | CVPR 2021 | FF++ & CDF | Video | Train & Test | 1,500+ | Hyper-link
16 | PIRender [63] | Image Driven | ICCV 2021 | FF++ & CDF | Video | Train & Test | 1,500+ | Hyper-link
17 | TPSMM [99] | Image Driven | CVPR 2022 | FF++ & CDF | Video | Train & Test | 1,500+ | Hyper-link
18 | LIA [86] | Image Driven | ICLR 2022 | FF++ & CDF | Video | Train & Test | 1,500+ | Hyper-link
19 | DaGAN [31] | Image Driven | CVPR 2022 | FF++ & CDF | Video | Train & Test | 1,500+ | Hyper-link
20 | SadTalker [97] | Audio Driven | CVPR 2023 | FF++ & CDF | Video | Train & Test | 1,500+ | Hyper-link
21 | MCNet [30] | Image Driven | ICCV 2023 | FF++ & CDF | Video | Train & Test | 1,500+ | Hyper-link
22 | HyperReenact [7] | Image Driven | ICCV 2023 | FF++ & CDF | Video | Train & Test | 1,500+ | Hyper-link
23 | HeyGen [28] | Text Driven | None | VFHQ [89] | Video | Test Only | 50 | Hyper-link
Entire Face Synthesis (EFS) | 24 | VQGAN [24] | GAN based | CVPR 2021 | FF++ & CDF | Image | Train & Test | 48,000+ | Hyper-link
25 | StyleGAN2 [39] | GAN based | ArXiv 2019 | FF++ & CDF | Image | Train & Test | 48,000+ | Hyper-link
26 | StyleGAN3 [37] | GAN based | NeurIPS 2021 | FF++ & CDF | Image | Train & Test | 48,000+ | Hyper-link
27 | StyleGAN-XL [68] | GAN based | SIGGRAPH 2022 | FF++ & CDF | Image | Train & Test | 48,000+ | Hyper-link
28 | SD-2.1 [64] | GAN based | CVPR 2022 | FF++ & CDF | Image | Train & Test | 48,000+ | Hyper-link
29 | DDPM [29] | Latent Diffusion | NeurIPS 2020 | FF++ & CDF | Image | Train & Test | 48,000+ | Hyper-link
30 | RDDM [49] | Latent Diffusion | ArXiv 2023 | FF++ & CDF | Image | Train & Test | 48,000+ | Hyper-link
31 | PixArt-$\alpha$ [10] | Latent Diffusion | ICLR 2024 | FF++ & CDF | Image | Train & Test | 48,000+ | Hyper-link
32 | DiT-XL/2 [59] | Latent Diffusion | ICCV 2023 | FF++ & CDF | Image | Train & Test | 48,000+ | Hyper-link
33 | SiT-XL/2 [5] | Latent Diffusion | ArXiv 2024 | FF++ & CDF | Image | Train & Test | 48,000+ | Hyper-link
34 | MidJounery6 [53] | Popular Application | None | FFHQ [38] | Image | Test Only | 1,000 | Hyper-link
35 | WhichisReal [88] | GAN based | None | FFHQ [38] | Image | Test Only | 1,000 | Hyper-link
Face Editing (FE) | 36 | CollabDiff [32] | Diffusion based | CVPR 2023 | FF++ & CDF | Image | Test Only | 48,000+ | Hyper-link
37 | e4e [78] | StyleGAN based | SIGGRAPH 2021 | FF++ & CDF | Image | Test Only | 48,000+ | Hyper-link
38 | StarGAN [14] | StarGAN based | CVPR 2018 | CelebA [51] | Image | Test Only | 2,000 | Hyper-link
39 | StarGANv2 [15] | StarGAN based | CVPR 2020 | CelebA [51] | Image | Test Only | 2,000 | Hyper-link
40 | StyleCLIP [58] | StyleGAN based | ICCV 2021 | CelebA [51] | Image | Test Only | 2,000 | Hyper-link
|  |  |  |  |  |  |  |  |

i) Note-1: The nine "test only" data is utilized as the unknown domain data,
simulating the domain shift of real people distributions.

ii) Note-2: For HeyGen and DeepFaceLab, these two SoTA deepfakes are widely
used and highly realistic. However, since they belong

to one-to-one type [54], their implementation requires significantly more time
and resources. Thus, we only create 50 and 100 for each.

Figure 2: The general fake data generation pipeline of the proposed DF40
dataset.

##  3 DF40 Benchmark

###  3.1 Research Scope and Summary of DF40.

In this work, our scope specifically focuses on face deepfake detection,
including face-swapping (FS), face-reenactment (FR), entire face synthesis
(EFS), and face editing (FE). Natural image synthesis (such as art) is not
within our scope, but we show the potential of using model training on face
deepfake to detect these (non-face) AIGC-generated images. DF40 dataset
provides $40$ deepfake approaches with $4$ different types: FS, FR, EFS, and
FE. For FS and FR, we provide video format data (over 0.1M video clips in
total), and image format for EFS and FE (over 1M+ images in total). We also
introduce several latest/popular generation techniques ($e.g.$,
PixArt-$\alpha$ [10] in 2024) and widely used software ($e.g.$, HeyGen [28],
DeepFaceLab [18]). Furthermore, some classical and representative methods are
also included, $e.g.$, FOMM [72]. Our dataset shows the advantages in both
data diversity and scale (see Tab. 1).

###  3.2 Original Data Collection and Deepfake Data Generation.

##### Real Data:

We consider two mainstream and popular face datasets specifically used in the
deepfake detection field: FF++ [67] (c23 version) and CDF [47] as our original
data. There are two main reasons why we chose these two data domains as the
original data for creating fakes: (1) Consistency with previous work: By using
these datasets for training and evaluation, we can align with prior studies
and assess whether their conclusions and methods are still valid in the
context of our new dataset. For instance, many previous works [45; 26] follow
the "cross-manipulation" evaluation protocol to test the generalization
ability when the forgery method differs while the data domain remains the same
(FF++). Therefore, creating fakes of DF40 using FF++ allows us to extend their
results from evaluating solely on four limited and outdated forgery methods to
more than 30 distinct and latest deepfakes. (2) Impact study of domain and
forgery: Prior studies have not considered the scenario where only the data
domain changes while the forgery method remains the same. This omission
hinders the analysis of the sole impact of the data domain on model
generalization. In our DF40 dataset, we use both FF++ and CDF domains to
facilitate the research on the influence of both data domain and forgery
method, as detailed in our Finding-6. In essence, the choice of these two data
domains enables us to build upon previous work and to conduct a more
comprehensive analysis of the factors influencing the performance of deepfake
detection models. We also provide real data from other existing datasets
($e.g.$, CelebA [51]) to facilitate the unknown domain evaluations (see Tab. 2
for details). We show more details of these original face datasets in the
supplementary.

##### Fake Data:

To guarantee the diversity of deepfake approaches in the proposed DF40, we
introduce and implement 40 distinct deepfake techniques, which are listed in
Tab. 2. A detailed description of each deepfake method is provided in the
supplementary. They are selected according to perspectives of modeling types,
conditional sources, forgery effects, and functions. Formally, we denote
$x_{t}(i_{t},a_{t},b_{t})$ as the target subject to be manipulated, which
possesses attributes ($i$: person identity, $a$: identity-agnostic content,
$b$: external attributes) that can uniquely determine itself, while the source
$x_{s}(i_{s},a_{s},b_{s})$ is regarded as the conditional media ($c$), driving
the target to change either identity or attributes or even both. We use
$f_{sw},f_{re},f_{sy},f_{ed}$ to represent four types of deepfakes in our
work: FS, FR, EFS, and FE, respectively. Fig. 1 provides some visual examples
for each category in DF40, and Fig. 16 generally illustrates them from the
method perspective. (i) FS Approach: From Fig. 16(a), FS aims to replace the
content of $x_{t}$ with that of $x_{s}$ preserving the identity $i_{s}$.
Formally, $\tilde{x}_{t}(\tilde{i}_{s},a_{t},b_{t})$ only swaps identity $i$
from the source $x_{s}$ to the target $x_{t}$, and the identity-agnostic
content $a$ are preserved. The swapping process can be expressed as:

$f_{sw}(x_{t}(i_{t},a_{t},b_{t}),x_{s}(i_{s},a_{s},b_{s})|\text{swap})=\tilde{x}_{t}(\tilde{i}_{s},a_{t},b_{t})$
(1)

(ii) FR Approach: From Fig. 16(b), FR on $x_{t}(i_{t},a_{t},b_{t})$ preserves
its identity $i_{t}$ but has its intrinsic attributes $a_{t}$, $e.g.$, pose,
mouth and expression manipulated by a driven variable $c_{a}$ and forms
$\tilde{x}_{t}(i_{t},\tilde{a}_{s},b_{t})$. Mathematically, we can drive the
following equation:

$f_{re}(x_{t}(i_{t},a_{t},b_{t})|c_{a})=\tilde{x}_{t}(i_{t},\tilde{a}_{s},b_{t}).$
(2)

(iii) EFS Approach: EFS generates a completely synthesis face
$\tilde{x}_{t}(\tilde{i}_{t},\tilde{a}_{t},\tilde{b}_{t})$. In order to bridge
the personal identity gap between generative models and other deepfake
methods, we fine-tune the generative model $G$ with the same real data as
other forgery methods ($e.g.$, e4s [50]) and obtain a face-synthesis model
$f_{sy}$. After that, we can synthesize new synthesis faces from noise $n$ as
follows:

$f_{sy}(n)=\tilde{x}_{t}(\tilde{i}_{t},\tilde{a}_{t},\tilde{b}_{t}).$ (3)

The general generation process can be seen in Fig. 16(c). (iv) FE Approach:
From Fig. 16(d), FE on $x_{t}(i_{t},a_{t},b_{t})$ has its external attributes
$b_{t}$ altered, such as facial hair, age, gender, and ethnicity, controlled
by conditional source $c_{b}$, to obtain
$\tilde{x}_{t}(i_{t},a_{t},\tilde{b}_{s})$. We also include multiple attribute
manipulation with two editing approaches, $e.g.$, both hair and eyebrows are
manipulated. We can formulate the transformation as follows:

$f_{ed}(x_{t}(i_{t},a_{t},b_{t})|c_{b})=\tilde{x}_{t}(i_{t},a_{t},\tilde{b}_{s}),$
(4)

where $\tilde{\cdot}$ means that the element is manipulated by forgery
algorithms.

Table 3: Same data domain, different forgery types (Protocol-1): Cross-
manipulation evaluation of different models on FF domain. Within-forgery
evaluations are in gray. FS (FF) denotes all FS data within FF domain, with FR
(FF), FS (CDF), etc, being similar.

Training Set | Model | Testing Set (FF)
---|---|---
FS (FF) | FR (FF) | EFS (FF) | Avg. (FF)
FS (FF) | Xception [16] | 0.991 | 0.892 | 0.810 | 0.898
CLIP [62] | 0.996 | 0.908 | 0.837 | 0.914
SRM [52] | 0.988 | 0.867 | 0.703 | 0.853
SPSL [48] | 0.987 | 0.849 | 0.735 | 0.857
RECCE [8] | 0.991 | 0.855 | 0.758 | 0.868
RFM [80] | 0.992 | 0.884 | 0.821 | 0.899
FR (FF) | Xception [16] | 0.838 | 0.996 | 0.670 | 0.835
CLIP [62] | 0.932 | 0.999 | 0.798 | 0.910
SRM [52] | 0.893 | 0.998 | 0.698 | 0.863
SPSL [48] | 0.901 | 0.998 | 0.695 | 0.865
RECCE [8] | 0.865 | 0.997 | 0.716 | 0.859
RFM [80] | 0.892 | 0.999 | 0.776 | 0.889
EFS (FF) | Xception [16] | 0.665 | 0.807 | 0.999 | 0.824
CLIP [62] | 0.688 | 0.889 | 0.999 | 0.859
SRM [52] | 0.596 | 0.776 | 0.999 | 0.790
SPSL [48] | 0.659 | 0.811 | 0.999 | 0.823
RECCE [8] | 0.691 | 0.801 | 0.999 | 0.830
RFM [80] | 0.653 | 0.795 | 0.999 | 0.816
BI (FF) | SBI [70] | 0.810 | 0.714 | 0.678 | 0.734
|  |  |  |  |

Table 4: Same forgery types, different data domains (Protocol-2): Cross-domain
evaluation of different models on CDF domain. Within-forgery evaluations are
in gray. FS (FF) denotes all FS data within the FF domain, with FR (FF), FS
(CDF), etc, having similar meanings.

Training Set | Model | Testing Set (CDF)
---|---|---
FS (CDF) | FR (CDF) | EFS (CDF) | Avg. (CDF)
FS (FF) | Xception [16] | 0.922 | 0.657 | 0.642 | 0.740
CLIP [62] | 0.967 | 0.744 | 0.730 | 0.814
SRM [52] | 0.919 | 0.621 | 0.603 | 0.714
SPSL [48] | 0.938 | 0.656 | 0.648 | 0.747
RECCE [8] | 0.926 | 0.632 | 0.610 | 0.723
RFM [80] | 0.939 | 0.637 | 0.628 | 0.735
FR (FF) | Xception [16] | 0.481 | 0.857 | 0.369 | 0.569
CLIP [62] | 0.638 | 0.933 | 0.209 | 0.593
SRM [52] | 0.454 | 0.869 | 0.326 | 0.550
SPSL [48] | 0.479 | 0.852 | 0.256 | 0.529
RECCE [8] | 0.452 | 0.881 | 0.332 | 0.555
RFM [80] | 0.492 | 0.882 | 0.359 | 0.578
EFS (FF) | Xception [16] | 0.586 | 0.594 | 0.983 | 0.721
CLIP [62] | 0.617 | 0.735 | 0.988 | 0.780
SRM [52] | 0.589 | 0.620 | 0.964 | 0.724
SPSL [48] | 0.635 | 0.651 | 0.975 | 0.754
RECCE [8] | 0.623 | 0.603 | 0.984 | 0.737
RFM [80] | 0.644 | 0.666 | 0.981 | 0.764
BI (FF) | SBI [70] | 0.679 | 0.609 | 0.723 | 0.670
|  |  |  |  |

Table 5: Different forgery types, different data domains (Protocol-3): toward
real-world open-set evaluation of different models on the unknown domain. FS
(FF) denotes all FS data within the FF domain, with FR (FF) and EFS (FF) being
similar. BI donates using "BlendFake" only to train. Here, we use ❶ to mark
the FS method, ❷ for the FR, ❸ for the EFS, and ❹ for the FE.

Training Set | Model | Testing Set |
---|---|---|---
DeepFaceLab (❶) | HeyGen (❷) | MidJourney-6 (❸) | Whichisreal (❸) | StarGAN (❹) | StarGAN2 (❹) | StyleCLIP (❹) | e4e (❹) | CollabDiff (❹) | Avg.
FS (FF) | Xception [16] | 0.882 | 0.394 | 0.384 | 0.535 | 0.577 | 0.616 | 0.426 | 0.553 | 0.546 | 0.546
CLIP [62] | 0.930 | 0.539 | 0.540 | 0.439 | 0.896 | 0.746 | 0.730 | 0.738 | 0.674 | 0.692
SRM [52] | 0.866 | 0.473 | 0.298 | 0.538 | 0.606 | 0.617 | 0.572 | 0.410 | 0.699 | 0.564
SPSL [48] | 0.930 | 0.370 | 0.414 | 0.557 | 0.559 | 0.590 | 0.536 | 0.574 | 0.584 | 0.565
RECCE [8] | 0.899 | 0.537 | 0.293 | 0.509 | 0.580 | 0.599 | 0.399 | 0.520 | 0.492 | 0.536
RFM [80] | 0.918 | 0.719 | 0.286 | 0.496 | 0.652 | 0.570 | 0.705 | 0.689 | 0.798 | 0.648
FR (FF) | Xception [16] | 0.705 | 0.473 | 0.459 | 0.323 | 0.492 | 0.456 | 0.006 | 0.175 | 0.050 | 0.349
CLIP [62] | 0.845 | 0.614 | 0.632 | 0.466 | 0.762 | 0.436 | 0.298 | 0.631 | 0.611 | 0.588
SRM [52] | 0.786 | 0.604 | 0.510 | 0.357 | 0.473 | 0.434 | 0.044 | 0.428 | 0.080 | 0.413
SPSL [48] | 0.704 | 0.543 | 0.446 | 0.272 | 0.348 | 0.423 | 0.002 | 0.585 | 0.060 | 0.376
RECCE [8] | 0.724 | 0.576 | 0.314 | 0.278 | 0.529 | 0.374 | 0.005 | 0.177 | 0.060 | 0.337
RFM [80] | 0.739 | 0.588 | 0.511 | 0.325 | 0.407 | 0.423 | 0.009 | 0.201 | 0.030 | 0.360
EFS (FF) | Xception [16] | 0.497 | 0.325 | 0.472 | 0.772 | 0.777 | 0.677 | 0.984 | 0.611 | 0.997 | 0.679
CLIP [62] | 0.745 | 0.506 | 0.534 | 0.828 | 0.946 | 0.823 | 0.929 | 0.923 | 0.983 | 0.802
SRM [52] | 0.527 | 0.358 | 0.338 | 0.794 | 0.769 | 0.703 | 0.982 | 0.509 | 0.997 | 0.664
SPSL [48] | 0.641 | 0.383 | 0.427 | 0.694 | 0.699 | 0.723 | 0.922 | 0.602 | 0.967 | 0.673
RECCE [8] | 0.583 | 0.505 | 0.442 | 0.753 | 0.769 | 0.724 | 0.964 | 0.643 | 0.979 | 0.707
RFM [80] | 0.619 | 0.349 | 0.551 | 0.623 | 0.730 | 0.636 | 0.966 | 0.665 | 0.979 | 0.680
BI (FF) | SBI [70] | 0.764 | 0.402 | 0.342 | 0.426 | 0.591 | 0.586 | 0.564 | 0.379 | 0.570 | 0.514
|  |  |  |  |  |  |  |  |  |  |

Figure 3: Heatmaps of One-Verse-All (OvA) evaluation (Protocol-4): Training
the baseline ($i.e.$, Xception) on one fake and testing it on other remaining
fakes. We show the within-domain evaluation (FF++ domain) and cross-domain
evaluation (CDF domain). We also show the performance "drop" from the FF++ to
the CDF. Blue donates all FS methods, Green for FR, and Yellow for EFS.

##  4 Evaluations and Analysis

###  4.1 Experimental Setup

All pre-processing and training codebases in this work adhere to DeepfakeBench
[94] to align the standardized settings. By following these standardized
procedures, we aim to provide reliable and reproducible results for
evaluations. The details of dataset configuration, algorithm implementation,
and full training can be seen in the supplementary. Regarding evaluation, we
compute the frame-level Area Under the Curve (AUC) as our primary evaluation
metric. For detection selection, we choose the classical baseline Xception
[16] with four SoTA detectors (SRM [52], SPSL [48], RECCE [8], RFM [80]) that
use Xception as the backbone and implement a new algorithm for improved
detection. In this manner, we aim to revisit the extra improvement over the
baseline under our setting. We also include one SoTA blending-based method SBI
[70]. Note that the original SBI paper only uses "BlendFake" (BI) for
training, so here we do not train it with DF40 in evaluations.

Figure 4: Full results of SBI [70] on the proposed DF40 dataset for both the
FF (within) and CDF domain (cross). Discussion and analysis for the figure can
be seen in Sec. 5.1. We evaluate other detectors, including Xception [67] and
SPSL [48]) on our DF40 (CDF) in Fig. 9.

###  4.2 Evaluations

In this work, we conduct main evaluations using four types of protocols:
Cross-forgery evaluation (Protocol-1), Cross-domain evaluation (Protocol-2),
Toward unknown forgery and domain evaluation (Protocol-3), and One-Verse-All
(OvA) evaluation (Protocol-4). Our findings are highlighted in blue. We show
the observations and use t-SNE, logit distributions, and the causal graph for
analysis.

##### Protocol-1: Cross-forgery evaluation.

This evaluation aims to evaluate the model’s performance within the same data
domain but across different forgery methods. The results are presented in Tab.
4, and the observations are as follows: Finding-1: Asymmetric performance drop
among different forgery types. Notably, the performance drop between FS and FR
is moderate but more significant between these two and EFS. Specifically,
model training on FS yields higher results (around 0.8) on EFS, while training
on EFS only achieves about 0.6 on FS. Finding-2: Existing well-designed (SoTA)
detectors may not have obvious advantages over the baseline. In our
experiments, SRM, SPSL, RECCE, and RFM, all state-of-the-art deepfake
detectors using Xception as their backbone, achieve results similar to the
simple baseline Xception. This implies that these SoTA models might only learn
sub-optimal forgery features and lack clear advantages over the baseline,
although these SoTAs show higher results on previous datasets, $e.g.$, DFDC.
Finding-3: CLIP excels in deepfake detection than other baselines.
Outperforming other SoTA detectors and the Xception baseline across all
scenarios, CLIP demonstrates the power of pre-training in deepfake detection.
This raises the question: can we perform pre-training in the specific deepfake
domain instead of the general CV domain? We will explore pre-training with
CLIP in Sec. 5.2. Finding-4: Blending is not all you need to detect deepfakes,
even for face-swapping. As observed, the SoTA blend-based detector SBI only
achieves an average AUC result of 0.734, although it has demonstrated
significant generalization performance on previous deepfake datasets. Previous
research [45; 70; 12] has shown that models trained on blending data can
achieve significantly higher results than those trained on deepfake data,
suggesting that using blending for training is a necessary condition to
achieve SoTA results. However, our results indicate that blending is not all
you need. We conduct further analysis by testing SBI on individual forgery
types of our DF40 to determine which type of forgery SBI can successfully
simulate (see Sec. 5.1).

##### Protocol-2: Cross-domain evaluation.

Cross-domain evaluation assesses the model’s performance across different data
domains but with the same forgery methods. The results are presented in Tab.
4, and the observations are as follows: Finding-5: Relatively minor
performance drop when solely crossing data domains or forgery methods. As we
can see, the performance drop between FS and EFS is relatively small (0.9+)
compared to FR (0.8+). Also, we found that the discriminative forgery
artifacts of EFS do not have solid casual with data domain a very minor
performance drop (only about 1%). Finding-6: Forgery methods and data domains
together contribute to discriminative forgery artifacts. A significant
performance drop is observed when both forgeries and domains change. For
example, Xception training on FS (FF) achieves only 0.657 and 0.642 on FR
(CDF) and EFS (CDF), respectively. These results are significantly lower
(nearly a 20% drop) compared to results on FS (CDF) and FR (FF), which involve
crossing only one of the domains or forgeries. This suggests that both factors
together contribute to discriminative forgery artifacts for distinguishing
real and fake.

Figure 5: Causal graph for analyzing the influence of domain (D) and forgery
(F).

We conduct further casual analysis below for better clarification. To
intuitively convey our conclusions, we draw a causal graph to illustrate the
causal relationship of how domain (D) and forgery method (F) influence the
model’s generalization (R). The causal graph is presented in Fig. 5. In this
graph, D represents the data domain, and F represents the forgery method. We
hypothesize that these two factors influence three intermediate variables,
$X_{1}$, $X_{2}$, and $X_{3}$, which in turn affect the result $R$. The
relationships are described as follows: $X_{1}$ represents the effect of the
domain (D) on the result (R) independently; $X_{3}$ represents the effect of
the forgery method (F) on the result (R) independently; and $X_{2}$ represents
the combined effect of both the domain (D) and the forgery method (F) on the
result (R). Mathematically, the model’s generalization result $R$ can be
expressed as a function of these intermediate variables:
$R=f(X_{1},X_{2},X_{3})$, where $X_{1}=g(D)$ represents the domain-specific
influence, $X_{3}=h(F)$ represents the forgery method-specific influence, and
$X_{2}=k(D,F)$ represents the combined influence of both domain and forgery
method. Each of these variables $X_{1}$, $X_{2}$, and $X_{3}$ captures
different aspects of how D and F interact to impact the overall performance
$R$. The functions $g$, $h$, and $k$ are mappings that quantify the respective
influences: $X_{1}=g(D)$, $X_{3}=h(F)$, and $X_{2}=k(D,F)$. Finally, the
result $R$ is determined by integrating these influences:
$R=f(g(D),k(D,F),h(F))$. This formalization helps us understand and analyze
the separate and combined effects of the data domain and forgery method on the
model’s generalization capability.

The logits and confidence analysis (shown in Fig. 6) further supports this
point, showing the increased overlap between real and fake logits as domains
and methods change incrementally. Also, crossing domains can result in "wrong
confidence" for real predictions and vice versa. More specifically, we can
observe from Fig. 6, as follows: (1) For Xception: (i) Same Domain and Method:
Real and fake class distributions have small variance and high mean, with
minimal ambiguity in confidence and less overlap between the real and fake
logits. (ii) Cross Method, Same Domain: Fake class distribution has increased
variance and lower mean, while real class remains relatively unchanged. (iii)
Cross Domain, Same Method: Real class distribution has increased variance and
lower mean, while fake class remains relatively unchanged, causing a slight
performance decrease. (iv) Cross Method and Domain: Both real and fake class
distributions have significantly increased variance and lower means,
decreasing overall performance. Furthermore, in this case, the overlap between
the real and fake distributions becomes obviously larger than the case(i),
where both the domain and method are the same. (2) For SBI: It shows a
different behavior than Xception. The real class distribution consistently has
a small variance and high mean, while the fake class distribution has a larger
variance and lower mean. This might suggest that SBI can learn a more robust
distribution for real classes than the baseline (wo using blending),
generalizing well in the FF domain using the FS method (0.81 AUC). However,
when the real class distribution changes ($e.g.$, in the CDF domain),
performance drops significantly (to 0.679 AUC). We will give a further
discussion of SBI in Sec. 5.1.

##### Protocol-3: Unknown forgery and domain evaluation.

This protocol tests model performance across different data domains and
forgery methods, incorporating SoTA and popular software like DeepFaceLab
[18], MidJourney-6 [53], and HeyGen [28] to simulate real-world scenarios.
From the whole results in Tab. 5, we can see that: (i) Forgery artifacts can
vary significantly across different forgeries (especially for FR and EFS), and
artifacts of EFS can be similar to that of FE (see the results of StarGAN2 and
CollabDiff); (ii) Models trained on FR display limited generalization ability,
even falling below chance levels (0.5 AUC). Notably, Xception achieves only a
0.006 AUC on StyleCLIP. We provide further analysis of this phenomenon with
both logit distribution and t-SNE visualization in Sec. 5.9. (ii) HeyGen and
MidJourney-6 seem to pose significant challenges for detecting unknown
forgeries, as most detectors only achieve unexpected results (AUC below 0.5).
A possible reason for this is that both testing datasets exhibit highly
realistic forgery quality. Consequently, it is essential to develop more
robust detection methods in the future that can effectively identify forgeries
with not only high-quality fakes but also high-resolution images.

Figure 6:  Logits and confidence distribution analysis. We visualize the
logits distribution (before SoftMax) and confidence distribution (after
SoftMax) for both real and fake classes. The overlap in the logits
distribution represents the portion of "wrong classifications." We analyze two
models: Xception [67] and SBI [70]. More discussion and analysis can be
referred to Sec. 5.  Figure 7:  t-SNE Visualizations for three models: CLIP-
large, CLIP-base, and Xception (from left to right). These models are trained
on FS (FF). We conduct visualizations on FS (CDF), HeyGen [28], MidJourney
[53], and WhichisReal [53]. More discussion and analysis can be referred to
Sec. 5.

##### Protocol-4: One-Verse-All (OvA) evaluation.

The OvA evaluation trains a model on a specific forgery and tests it on all
other forgeries. The results, presented in Fig. 3, reflect 31$\times$31
evaluations for the heatmap (excluding 9 unknown domain forgeries). Finding-7:
FR forgeries may share transferable patterns for detecting other FR instances.
Most FR forgery methods demonstrate high AUC within the heatmap, even across
data domains. However, Wav2Lip, an audio-driven reenactment forgery that only
modifies the mouth region, is an exception. Its artifacts are more localized
compared to other FRs that generate all content, making it different.

Table 6: Comparison of different models/baselines used for pre-training. FS
(CDF) denotes all FS data within the CDF domain. DF40 (FF) is the combination
of FS (FF), FR (FF), and EFS (FF).

Training Set | Model | Testing Set |
---|---|---|---
FS (CDF) | FR (CDF) | EFS (CDF) | DeepFaceLab | HeyGen | MidJourney-6 | Whichisreal | StarGAN | StarGAN2 | StyleCLIP | CollabDiff | e4e | Avg.
DF40 (FF) | Xception | 0.752 | 0.831 | 0.681 | 0.851 | 0.704 | 0.269 | 0.632 | 0.721 | 0.569 | 0.495 | 0.675 | 0.542 | 0.644
CLIP-base | 0.915 | 0.926 | 0.843 | 0.907 | 0.671 | 0.548 | 0.684 | 0.913 | 0.782 | 0.813 | 0.948 | 0.823 | 0.814
CLIP-large | 0.942 | 0.896 | 0.858 | 0.948 | 0.784 | 0.746 | 0.849 | 0.974 | 0.909 | 0.929 | 0.977 | 0.967 | 0.898
|  |  |  |  |  |  |  |  |  |  |  |  |  |

Table 7: Similar to Tab. 6, we evaluate on GenImage [102] (non-face domain),
pure AIGCs.

Training Set | Model | Testing Set |
---|---|---|---
ADM | BigGAN | GLide | MidJourney | SD-v4 | SD-v5 | Vqdm | Wukong | Avg.
DF40 (FF) | Xception | 0.723 | 0.529 | 0.514 | 0.558 | 0.490 | 0.494 | 0.469 | 0.505 | 0.535
CLIP-base | 0.940 | 0.850 | 0.666 | 0.447 | 0.494 | 0.494 | 0.682 | 0.542 | 0.639
CLIP-large | 0.911 | 0.967 | 0.736 | 0.571 | 0.630 | 0.614 | 0.882 | 0.660 | 0.746
|  |  |  |  |  |  |  |  |  |

##  5 Analysis

In this subsection, we will dive deeper to provide insightful analysis based
on previous observations and offer several new findings to the detection field
to inspire future research.

###  5.1 Is Blending All You Need for Deepfake Detection?

Blending-based detectors have been considered highly effective for
generalizable deepfake detection. Many SoTA detectors [70; 45; 11] use
blending-generated pseudo-fake data and exclude actual deepfake data for
training. However, our evaluations empirically show that blending might not
all you need, as models trained with blending generally underperform compared
to those trained on actual deepfake data (Tab. 4, Tab. 4, Tab. 5). This is
likely because blending simulates fake artifacts similar to the "DF-family" of
Face Swapping (FS) and may struggle to generalize forgeries that do not
involve blending, such as the "FS-family" of FS and AI-generated content
(EFS). Also, we evaluate SBI on 31 known forgeries across FF++ and CDF domains
(see Fig. 4) and find that SBI performs well on some FS forgeries but also
achieves near-perfect results on non-blending methods, $e.g.$, SD-2.1.
However, it performs poorly on RDDM (FF), far below chance levels. Thus, an
interesting and meaningful question (Question-1) arises: Which types of
forgeries can be addressed by blending? And how to effectively combine
blending fakes with actual deepfakes for training? Moreover, we also found
that: Finding-8: SBI could be viewed as an "anomaly detection" model. SBI can
be considered an "anomaly detection" model, which might utilize the real
features for classifying fakes. Results in Fig. 6 show that when forgery
samples appear significantly different from real samples, SBI classifies them
as anomalies (forgery samples), likely because the pseudo-fake samples
generated by SBI closely resemble their original real counterparts.

###  5.2 Desirable Baselines/Backbones in Deepfake Detection for Pre-training.

Xception is often used as a baseline for deepfake detection, but is it the
most suitable backbone? In this work, we re-evaluate Xception and compare it
with the "stand-out" model CLIP (see Finding-3). We also include the large
version of CLIP (CLIP-large), attempting to assess the "scaling law." As seen
in Tab. 6, CLIP-large significantly outperforms CLIP-base (+8.4%) and Xception
(+20.54%) on average. We also evaluate non-face domain data to determine if
models trained on face-domain data can transfer to non-face-domain detection.
In Tab. 7, surprisingly, CLIP-large achieves a 0.746 AUC on previously unseen
non-face AIGCs, while Xception only reaches a 0.535 AUC, near chance levels.
This leads to Finding-9: CLIP-large is the most powerful baseline,
significantly outperforming Xception and Finding-10: CLIP-large can even
generalize to some non-face AIGCs when trained only on face data. However, why
can CLIP-large outperform the base by a notable margin? We analyze this point
in the following paragraph from the view of real face distribution.

###  5.3 Analysis of the Real Face Distribution.

The results in Tab. 6 raise the question: why does CLIP-large significantly
outperform Xception and its base version? We investigate further by analyzing
the learned features of the three models, as visualized in Fig. 7. (1) We see
that both versions of CLIP learn more informative features that can gather
some real samples into several different "groups" (see HeyGen and MidJourney),
while the real features of Xception mix all of them together. Leveraging
large-scale pre-training, CLIP can capture more informative facial features
($e.g.$, ID) about real faces and thus "know" that these features are
unrelated to deepfakes, while Xception could be overfitted to ID, as evidenced
by [23]. (2) Between the large and base versions, CLIP-large’s real samples
are closer to each other (see WhichisReal), suggesting it learns more
comprehensive features of real faces. We also see that Finding-11: CLIP-large
can implicitly "separate and align" different forgeries and data domains
("orthogonal" in WhichisReal), with no need for explicit constraints as [75].
This point is further discussed and confirmed through t-SNE and logit
distribution analysis in Sec. 5.4 below.

###  5.4 Comparative Analysis of CLIP-base and CLIP-large for Deepfake
Detection

##### t-SNE visualization:

Through t-SNE visualizations, we observe that the distribution of real images
(blue points) for CLIP-large is significantly more compact than CLIP-base,
where the points are more loosely scattered. This tight clustering among the
blue points for CLIP-large indicates that it can more effectively capture the
finer details and specific characteristics of different real images.
Additionally, CLIP-large demonstrates a superior ability to learn the distinct
features of various datasets. When performing dataset classification, we
notice that the decision boundaries between different real domains and between
real and fake domains can be orthogonal. This orthogonality is achieved
without the need for explicitly adding a loss to align these boundaries, as
suggested in the literature [75]. This implies that CLIP-large inherently
distinguishes between domain-specific and domain-agnostic features,
potentially due to insufficient real data, which makes it challenging to learn
truly common features. Instead of attempting to decouple these features
explicitly, CLIP-large identifies which features are domain-independent more
efficiently.

##### Logits Distribution Analysis:

The logits distributions provide further insights into the superior
performance of CLIP-large. The logits for real images learned by CLIP-large
are more concentrated and "tall and narrow," whereas those for CLIP-base are
more "short and wide." This indicates that CLIP-large has a better grasp of
the characteristics of real images, which enhances its ability to detect
fakes. As evidenced by the reduced overlap between the real and fake logits
distributions, CLIP-large’s deep understanding of real images translates into
a clearer differentiation between real and fake, improving detection accuracy.
This suggests that better comprehending real images directly contributes to an
improved understanding and detection of fake images.

Overall, the analysis highlights that CLIP-large outperforms CLIP-base in
generalization for deepfake detection due to its superior feature learning
capabilities. The compact clustering in t-SNE visuals and the focused logits
distributions underscore its ability to distinguish between real and fake
images more effectively. This enhanced understanding allows it to define more
precise and orthogonal decision boundaries, leading to improved performance in
detecting deepfakes across diverse datasets.

Figure 8: Frequency analysis on selected datasets of DF40. We compute the
average frequency spectra of high-pass filtered images, following [82].
Although the deepfake types differ, they can show similar patterns/artifacts
in the average spectra. For instance, methods from FS ($i.e.$, SimSwap [13],
BlendFace [71], InSwap) show similar "checkboard" patterns that can also be
observed in EFS ($i.e.$, SD1.5 [64], VQGAN [24]) and FE ($i.e.$, e4e [78]).
Figure 9:  Results of evaluating three (previous) SoTA models (trained on
FF++), $i.e.$, Xception [67], SPSL [48], and SBI [70]), on our DF40 (CDF). We
show that, in most cases, these SoTAs fail to generalize well in our proposed
forgeries, highlighting the importance of developing a comprehensive and
diverse dataset.  Table 8: Evaluation of training CLIP-large on different
variants of the proposed DF40 (face domain) to detect GenImage [102] (non-face
domain), pure AIGCs.

Model | Training Set | Testing Set |
---|---|---|---
ADM | BigGAN | GLide | MidJourney | SD-v4 | SD-v5 | Vqdm | Wukong | Avg.
CLIP-large | FS (FF) | 0.589 | 0.679 | 0.407 | 0.447 | 0.513 | 0.494 | 0.806 | 0.574 | 0.564
FR (FF) | 0.695 | 0.595 | 0.230 | 0.505 | 0.437 | 0.417 | 0.549 | 0.519 | 0.493
EFS (FF) | 0.912 | 0.992 | 0.906 | 0.591 | 0.729 | 0.72 | 0.956 | 0.713 | 0.815
DF40 (FF) | 0.911 | 0.967 | 0.736 | 0.571 | 0.630 | 0.614 | 0.882 | 0.660 | 0.746
|  |  |  |  |  |  |  |  |  |

###  5.5 Generalization to Non-face Domain AIGCs

We also evaluate non-face domain data to determine if models trained on face-
domain data can transfer to non-face-domain detection. From Tab. 8, we can
observe the following: (1) The model trained on EFS (FF) demonstrates the
highest average AUC value (0.815) when tested on non-face domain GenImage
deepfakes. This suggests that the model, when trained on EFS, learns features
related to forgery traces rather than features specific to face content. This
ability to generalize from face AIGCs to non-face AIGCs indicates the
robustness of the model and its potential to detect deepfakes across different
domains.

(2) The models trained on FS (FF) and FR (FF) show lower average AUC values
(0.564 and 0.493, respectively) when tested on non-face domain GenImage
deepfakes. This suggests that these models may be learning features more
specific to face content or the particular manipulation techniques (face swap
or drive) used in their training sets, limiting their ability to generalize to
non-face AIGCs.

(3) The model trained on DF40 (FF), which includes a combination of different
deepfake techniques, shows a relatively high average AUC value (0.746). While
this is lower than the model trained on EFS (FF), it still indicates some
level of generalization to non-face AIGCs. This suggests that training on a
diverse set of deepfake techniques can help the model learn more general
forgery-related features.

In summary, these results emphasize the importance of the training set in
deepfake detection. Models trained on EFS (FF) appear to learn more general
forgery-related features, enabling them to perform better on non-face AIGCs.
Models trained on FS (FF) and FR (FF), on the other hand, maybe learning more
technique-specific or face-specific features, limiting their performance on
non-face AIGCs. This highlights the need for more research into training
methods to help models generalize better across different deepfake techniques
and domains.

Table 9:  Results of evaluating three models ($i.e.$, I3D, CLIP-base, and
CLIP-large) trained on different variants of the proposed DF40 on other
previous deepfake datasets. Note that only FF-F2F [77] and FF-NT [76] are FR
methods, while other testing data all belong to FS.

Model | Training Set | Testing Set
---|---|---
CDF-v2 [47] | FF-DF [19] | FF-F2F [77] | FF-FS [25] | FF-NT [76] | FaceShifter [44] | DF1.0 [35]
I3D (video-level AUC) | FS (FF) | 0.863 | 0.980 | 0.939 | 0.999 | 0.879 | 0.979 | 0.875
FR (FF) | 0.684 | 0.917 | 0.846 | 0.374 | 0.895 | 0.876 | 0.807
FS (FF) + FR (FF) | 0.764 | 0.970 | 0.926 | 0.994 | 0.928 | 0.953 | 0.929
CLIP-base | FS (FF) | 0.823 | 0.965 | 0.678 | 0.985 | 0.585 | 0.932 | 0.945
FR (FF) | 0.649 | 0.669 | 0.572 | 0.457 | 0.682 | 0.625 | 0.947
EFS (FF) | 0.553 | 0.618 | 0.604 | 0.634 | 0.539 | 0.653 | 0.590
DF40 (FF) | 0.799 | 0.932 | 0.698 | 0.973 | 0.683 | 0.889 | 0.937
CLIP-large | FS (FF) | 0.905 | 0.989 | 0.777 | 0.991 | 0.608 | 0.963 | 0.965
FR (FF) | 0.698 | 0.756 | 0.614 | 0.487 | 0.738 | 0.626 | 0.983
EFS (FF) | 0.616 | 0.733 | 0.634 | 0.730 | 0.571 | 0.772 | 0.739
DF40 (FF) | 0.891 | 0.978 | 0.753 | 0.973 | 0.717 | 0.927 | 0.986
|  |  |  |  |  |  |  |

###  5.6 Artifacts of Deepfake Forgeries in Frequency

##### Brief Introduction:

Inspired by [82], we adopt a similar approach to visualize the average
frequency spectra of each dataset. The purpose is to examine the artifacts
generated by deepfake forgeries. Our methodology involves computing various
statistics for image datasets, either in grayscale or across each color
channel separately, and visualizing these statistics using heatmaps. We use
two metrics to evaluate the results: mean and std. (1) The mean represents the
average value of the DCT coefficients across the images in the dataset. A
higher mean value means that, on average, the images are brighter or have more
detailed features. For deepfake images, this might indicate that the synthetic
process adds extra brightness or emphasizes certain facial details. On the
other hand, a lower mean value suggests that the images are generally darker
or smoother, possibly missing some fine details. By comparing the mean values
of deepfake images to those of real images, we can see how well the fake
images replicate the overall brightness and texture of real human faces. (2)
The standard deviation (std) measures the spread or variability of the DCT
coefficients around the mean. A higher standard deviation means more variation
in the textures and details within the images. For deepfakes, this could point
to inconsistencies or artifacts from the generation process, making the images
easier to spot as fake. Conversely, a lower standard deviation indicates that
the images are more similar, which might suggest a more uniform generation
process but could also mean the images lack the natural diversity seen in real
faces. We can assess how consistent and realistic the deepfake images are
compared to real human faces by looking at the standard deviation.

##### Mean Analysis:

Finding-12: We observe that many GAN-generated images, such as those from
StyleGAN, often exhibit a checkerboard or grid-like pattern of bright spots on
the mean heatmap This phenomenon occurs because of the upsampling methods used
in the GAN architecture, which can introduce such artifacts during the image
generation process. These patterns are typically a result of the transposed
convolution operations, which can cause uneven overlaps and thus create these
visible grid artifacts. Moreover, it appears that different forgery methods
can share similar patterns. For instance, face-swapping techniques like
SimSwap also exhibit these GAN-like checkerboard artifacts. This similarity
indicates that these methods generate the entire image using AI without a
blending process. This contrasts with other Deepfake methods, such as those
used in Celeb-DF, which involve blending and thus do not produce the same
checkerboard artifacts.

##### Std Analysis:

The standard deviation heatmaps reveal additional artifacts. For example,
methods like DDPM and StarGAN also display checkerboard artifacts in the
standard deviation maps. Interestingly, while StyleGAN exhibits these
checkerboard patterns in the mean heatmaps, it does not show similar artifacts
in the standard deviation maps. This discrepancy suggests that while the
upsampling process affects StyleGAN’s mean values, the overall variability or
consistency across multiple generated images is not influenced similarly. This
could imply that StyleGAN maintains a certain level of uniformity regarding
pixel variance, even though the generation process distorts the mean values.
Additionally, we observe radial artifacts in the standard deviation heat maps
through methods such as HeyGen, DeepFaceLab, and DaGAN. These radial patterns
indicate a different type of artifact, possibly resulting from how these
methods handle image transformations and blending processes. The presence of
these radial artifacts in the standard deviation maps suggests inconsistencies
in the generation process, where certain regions of the images exhibit more
variability than others.

###  5.7 Generalization to External/Previous Deepfake Datasets

We also evaluate the model trained on DF40 to detect previous deepfake
datasets. Results in Tab. 9 show that (1) For the I3D detection method,
training on FS (FF) and FR (FF) combined (FS (FF) + FR (FF)) results in better
performance across most testing sets compared to training on FS (FF) or FR
(FF) individually. This suggests that combining face-swapping and face-
reenactment datasets for training improves the generalization capabilities of
the I3D method. (2) Among the CLIP-base detection methods, training on DF40
(FF) leads to better performance across most testing sets compared to training
on FS (FF), FR (FF), or EFS (FF) individually. This indicates that
incorporating diverse deepfake techniques in the training set improves the
generalization capabilities of the CLIP-base method. (3) The same trend is
observed for the CLIP-large detection methods, where training on DF40 (FF)
results in better performance across most testing sets compared to training on
FS (FF), FR (FF), or EFS (FF) individually. This further supports the
importance of training on diverse deepfake techniques to enhance the
generalization capabilities of the detection methods. (4) The CLIP-large
detection method generally outperforms the CLIP-base method across most
testing sets when trained on the same training sets. This suggests that the
larger model size of CLIP-large contributes to better deepfake detection
performance (similar to Finding-9).

###  5.8 Detection Results of Previous Detectors on the Proposed DF40 dataset

To evaluate the generalization capabilities of various deepfake detection
models, we tested three pre-trained (on FF++) models: Xception (baseline),
SPSL (frequency-based model), and SBI (blending-based model) on our DF40 (CDF)
dataset, which includes 31 known deepfake methods. These models were initially
trained on the FF++ dataset. The results in Fig. 9 indicate that all three
models struggle to generalize effectively to the DF40 dataset, with an average
AUC of only around 0.6. This performance is significantly below the ideal
detection threshold, underscoring the limitations of current models in
handling a diverse range of deepfake techniques. This finding highlights the
critical need for developing larger and more comprehensive datasets to train
robust deepfake detection systems. By expanding the diversity and volume of
the training data, we can improve the models’ ability to detect and generalize
across various deepfake methods, enhancing their real-world applicability and
effectiveness.

Figure 10:  t-SNE visualization and logits analysis for analyzing the model,
which is trained on FR (FF) and tested on StyleCLIP, achieving only about 0.05
AUC in Tab. 5 (Protocol-3). See the text in Sec. 5.9 for our analysis and more
details.  Figure 11: Logits and confidence analysis for comparing CLIP-base
and CLIP-large models.

###  5.9 Analysis of "Anomalous Values" in Experiments

In our previous experimental results summarized in Tab. 5 (protocol-3), we
observed an anomalous outcome where the Xception model, trained on FF (FR),
achieved an AUC of less than 0.2 on the StyleCLIP dataset. Given that an AUC
of 0.5 indicates performance by chance, this result is particularly
perplexing. To investigate further, we conducted a t-SNE analysis on the
feature distributions of different classes, as well as examined the logits and
confidence distributions for different prediction results.

The t-SNE analysis 10 revealed that the features learned during training for
real and fake images were inversely mapped during testing. Specifically, the
features for the training real images overlapped with the testing fake images,
indicating that the model might not have effectively learned robust real
features. This inversion suggests that the model’s naive discriminative
learning approach failed to adequately differentiate between real and fake
images, leading to a complete misclassification in the new testing set.

The logits distribution 10 further supports this observation. The confidence
curves for real and fake predictions were flipped, reinforcing the notion that
the model was predicting the opposite of what it should. This inversion
implies that the Xception model, in this context, was not only failing to
generalize but was actively misclassifying due to its inability to learn
stable and transferable features.

This analysis highlights a critical limitation of simple discriminative
learning approaches in deepfake detection. It underscores the need for more
sophisticated training strategies that can better capture the intrinsic
characteristics of real and fake images, ensuring more robust performance
across varied datasets. This could involve incorporating more diverse training
data, using advanced feature extraction techniques, or employing generative
adversarial networks to improve feature robustness and generalization.

##  6 Open Questions and Potential Topics for Future Research

Here, we will give further discussion on interesting research questions to
inspire future research toward next-generation deepfake detection.

(1) Question-1 in Sec. 5.1 highlights the role of blending data in training
deepfake detectors. Instead of using "BlendFake" only for training, how can we
effectively mine the true potential and position of BlendFake? For instance,
how can we combine Deepfake and BlendFake together for improved training
(creating "1+1>2" results)? And what kinds of forgeries can BlendFake address?

(2) Also, as the diversity of deepfake data increasingly goes up, Question-2
raise: how to design an incremental learning framework to effectively learn
(many) different forgeries incrementally? In the implementation of this
incremental learning framework, how can we deal with the real data?

(3) Previous research [93; 92] classified deepfake types at the instance
level. For example, if four deepfakes are applied for training, they will be
regarded as four distinct deepfakes. However, there are so many forgery
techniques available that it is hard to elaborate on them all. Question-3: can
we classify deepfakes based on FS, FR, EFS, and FE? It is still questionable
since different forgeries can share similar forgery patterns, $e.g.$,
generative artifacts (see Fig. 8). So, it would be possible to define a
"metric" to classify different forgeries into different classes, aiming to
learn effectively specific forgery features and common features jointly
(following the framework of UCF [93]).

(4) In our research, it can be seen that CLIP-large can achieve obvious
advantages over other models (including CLIP-base). We perform t-SNE (Fig. 7)
and logit distribution (Fig. 6) for deeper analysis. We found that CLIP-large
can learn a more robust distribution for the real face than CLIP-base. So,
Question-4: can we further "inflate" this CLIP-large model into a video model
for detecting deepfake videos? Or similarly, Question-5: can we leverage the
power of the current SoTA multi-modality technique to develop a better real
face representation for deepfake detection?

##  7 Conclusions, Board Impacts, Limitations, and Dataset Usage

(1) Conclusions: We have developed DF40, a highly diverse and groundbreaking
benchmark, comprising 40 distinct deepfake techniques to support the
detection. Leveraging DF40, we conducted over 2,000+ evaluations using 7
representative detectors under 4 standard evaluation protocols, creating 12
new findings and 5 open questions for future works. We hope the proposed DF40
could revolutionize the whole field for the next generation.

(2) Board Impacts: DF40 offers high-quality and realistic deepfake techniques,
facilitating the detection of today’s real-world deepfakes. Also, our
benchmark assists in safeguarding societal trust and promoting the responsible
use of such technology.

(3) Limitations: One limitation is the lack of comprehensive analysis for
video-level detectors. Actually, we provide evaluations using video models,
$e.g.$, I3D [9] in the supplementary. However, we have not delved deeply into
discussing and analyzing certain issues, $e.g.$, assessing and visualizing
whether video models can effectively capture both temporal and spatial
artifacts. In future work, we plan to broaden our benchmark’s scope and
address these concerns in detail.

(4) Dataset Usage: The proposed DF40 dataset can be incorporated seamlessly
into the codebase of DeepfakeBench [94], where the user can use the existing
more than 30 detection methods to train or test on our DF40, making it
convenient to use. We will release the dataset on GitHub.

##  8 Content Structure in Supplementary

We have organized additional important content in the supplementary due to the
limited space. We present a brief outline of the content structure of the
supplementary to facilitate readers to find the corresponding content, as
follows:

  * •

Section A.1: Dataset Generation Methods & Original Data:

    * –

Section A.1.1: Brief Introduction of Generation Methods;

    * –

Section A.1.2: Details of 40 Implemented Synthesis Methods;

    * –

Section A.1.3: Formulation of Manipulation Methods;

    * –

Section A.1.4: Details of Original Datasets;

  * •

Section A.2: Introduction of the Used Detection Methods:

  * •

Section A.3: Experimental Setup & Full Results:

    * –

Section A.3.1: Experimental Setup and Details;

    * –

Section A.3.2: Full Experimental Results and Further Discussion;

  * •

Section A.4 Additional information on Dataset Publication:

    * –

Section A.4.1: Descriptions of Links;

    * –

Section A.4.2: Descriptions of the Hosting Platform and Access to the Dataset;

    * –

Section A.4.3: Descriptions of licensing.

##  9 Takeaways

In this section, we very briefly outline several key takeaways to encapsulate
our contributions and conclusions:

  * •

(1) The dataset is pivotal in addressing the generalization problem in
deepfake detection. To this end, we build a highly diverse deepfake dataset
incorporating 40 distinct deepfake techniques, including the most recent ones.
The visual example can be seen in Fig. 12 (FS), Fig. 13, Fig. 14 (EFS), and
Fig. 15 (FE and other novel methods);

  * •

(2) Data domain and forgery method collectively determine the final detection
results (see the causal graph Fig. 5 for intuitive understanding);

  * •

(3) Many recent face-swapping methods ($e.g.$, Inswapper [33], SimSwap [13])
do not involve a blending process but generate all content directly (including
the background). See the artifacts between SimSwap (FS) and SD1.5 (EFS) in
Fig. 8.

  * •

(4) Blending is not all you need to detect deepfakes, even face-swapping
forgeries (Sec. 5.1);

  * •

(5) CLIP-large is the most powerful baseline model due to its notable ability
to learn robust real-face distribution (see Sec. 5.3);

  * •

(6) The model trained on the face domain (our dataset) can also be somehow
applied to the non-face domain (pure AIGC) fakes (see Sec. 5.5);

  * •

(7) There is an urgent need to develop an effective incremental learning
framework aiming to produce improved results, creating "1+1>2" results when
combining many different forgeries together for training (see Question-2).

## Acknowledgments and Disclosure of Funding

We would like to express our profound gratitude to all the individuals (all
collaborators) who have contributed to the successful completion of this work.
Our heartfelt appreciation goes out to Yue Han and Chengming Xu from Tencent
Youtu Lab, as well as Wentang Song from Shenzhen University, for their
invaluable support in code implementation and reproduction.

Furthermore, we extend our gratitude to Ke Sun from Xiamen University, Mingli
Zhu from the Chinese University of Hong Kong, Shenzhen (CUHK-Shenzhen),
Shaokui Wei from CUHK-Shenzhen, Mingda Zhang from CUHK-Shenzhen, and Yuhao Luo
from CUHK-Shenzhen for their insightful discussions and contributions to this
work.

Our sincere thanks go to the code developers of DeepfakeBench for their easy-
to-use codebase and unified training/testing framework. This includes Xinghang
Yuan (previously in CUHK-Shenzhen), Yize Chen (CUHK-Shenzhen), Kangran Zhao
(CUHK-Shenzhen), and Jikang Cheng (Wuhan University). Once again, we thank
everyone involved for their dedication and efforts in making this big project
successful.

## References

  * [1] Faceswap.  https://github.com/MarekKowalski/FaceSwap.  Accessed: 2020-05-10.
  * [2] Darius Afchar, Vincent Nozick, Junichi Yamagishi, and Isao Echizen.  Mesonet: a compact facial video forgery detection network.  In 2018 IEEE International Workshop on Information Forensics and Security, pages 1–7. IEEE, 2018.
  * [3] Triantafyllos Afouras, Joon Son Chung, and Andrew Zisserman.  Lrs3-ted: a large-scale dataset for visual speech recognition.  arXiv preprint arXiv:1809.00496, 2018.
  * [4] Shruti Agarwal, Hany Farid, Ohad Fried, and Maneesh Agrawala.  Detecting deep-fake videos from phoneme-viseme mismatches.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops, pages 660–661, 2020.
  * [5] Sara Atito, Muhammad Awais, and Josef Kittler.  Sit: Self-supervised vision transformer.  arXiv preprint arXiv:2104.03602, 2021.
  * [6] Chaitali Bhattacharyya, Hanxiao Wang, Feng Zhang, Sungho Kim, and Xiatian Zhu.  Diffusion deepfake.  arXiv preprint arXiv:2404.01579, 2024.
  * [7] Stella Bounareli, Christos Tzelepis, Vasileios Argyriou, Ioannis Patras, and Georgios Tzimiropoulos.  Hyperreenact: one-shot reenactment via jointly learning to refine and retarget faces.  In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 7149–7159, 2023.
  * [8] Junyi Cao, Chao Ma, Taiping Yao, Shen Chen, Shouhong Ding, and Xiaokang Yang.  End-to-end reconstruction-classification learning for face forgery detection.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 4113–4122, 2022.
  * [9] Joao Carreira and Andrew Zisserman.  Quo vadis, action recognition? a new model and the kinetics dataset.  In proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 6299–6308, 2017.
  * [10] Junsong Chen, Jincheng Yu, Chongjian Ge, Lewei Yao, Enze Xie, Yue Wu, Zhongdao Wang, James Kwok, Ping Luo, Huchuan Lu, et al.  Pixart-alpha: Fast training of diffusion transformer for photorealistic text-to-image synthesis.  arXiv preprint arXiv:2310.00426, 2023.
  * [11] Liang Chen, Yong Zhang, Yibing Song, Lingqiao Liu, and Jue Wang.  Self-supervised learning of adversarial example: Towards good generalizations for deepfake detection.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 18710–18719, 2022.
  * [12] Liang Chen, Yong Zhang, Yibing Song, Jue Wang, and Lingqiao Liu.  Ost: Improving generalization of deepfake detection via one-shot test-time training.  In Nips, 2022.
  * [13] Renwang Chen, Xuanhong Chen, Bingbing Ni, and Yanhao Ge.  Simswap: An efficient framework for high fidelity face swapping.  In Proceedings of the 28th ACM international conference on multimedia, pages 2003–2011, 2020.
  * [14] Yunjey Choi, Minje Choi, Munyoung Kim, Jung-Woo Ha, Sunghun Kim, and Jaegul Choo.  Stargan: Unified generative adversarial networks for multi-domain image-to-image translation.  In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 8789–8797, 2018.
  * [15] Yunjey Choi, Youngjung Uh, Jaejun Yoo, and Jung-Woo Ha.  Stargan v2: Diverse image synthesis for multiple domains.  In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 8188–8197, 2020.
  * [16] François Chollet.  Xception: Deep learning with depthwise separable convolutions.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 1251–1258, 2017.
  * [17] Hao Dang, Feng Liu, Joel Stehouwer, Xiaoming Liu, and Anil K Jain.  On the detection of digital face manipulation.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2020.
  * [18] DeepFaceLab.  https://github.com/iperov/DeepFaceLab.
  * [19] DeepFakes.  www.github.com/deepfakes/faceswap Accessed 2021-04-24.
  * [20] Deepfake detection challenge.  https://www.kaggle.com/c/deepfake-detection-challenge Accessed 2021-04-24.
  * [21] DFD.  https://ai.googleblog.com/2019/09/contributing-data-to-deepfake-detection.html Accessed 2021-04-24.
  * [22] Brian Dolhansky, Joanna Bitton, Ben Pflaum, Jikuo Lu, Russ Howes, Menglin Wang, and Cristian Canton Ferrer.  The deepfake detection challenge dataset.  arXiv preprint arXiv:2006.07397, 2020.
  * [23] Shichao Dong, Jin Wang, Renhe Ji, Jiajun Liang, Haoqiang Fan, and Zheng Ge.  Implicit identity leakage: The stumbling block to improving deepfake detection generalization.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 3994–4004, 2023.
  * [24] Patrick Esser, Robin Rombach, and Bjorn Ommer.  Taming transformers for high-resolution image synthesis.  In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 12873–12883, 2021.
  * [25] FaceSwap.  www.github.com/MarekKowalski/FaceSwap Accessed 2021-04-24.
  * [26] Alexandros Haliassos, Konstantinos Vougioukas, Stavros Petridis, and Maja Pantic.  Lips don’t lie: A generalisable and robust approach to face forgery detection.  In CVPR, 2021.
  * [27] Yinan He, Bei Gan, Siyu Chen, Yichun Zhou, Guojun Yin, Luchuan Song, Lu Sheng, Jing Shao, and Ziwei Liu.  Forgerynet: A versatile benchmark for comprehensive forgery analysis.  In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 4360–4369, 2021.
  * [28] HeyGen.  https://www.heygen.com.
  * [29] Jonathan Ho, Ajay Jain, and Pieter Abbeel.  Denoising diffusion probabilistic models.  Advances in neural information processing systems, 33:6840–6851, 2020.
  * [30] Fa-Ting Hong and Dan Xu.  Implicit identity representation conditioned memory compensation network for talking head video generation.  In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 23062–23072, 2023.
  * [31] Fa-Ting Hong, Longhao Zhang, Li Shen, and Dan Xu.  Depth-aware generative adversarial network for talking head video generation.  In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 3397–3406, 2022.
  * [32] Ziqi Huang, Kelvin CK Chan, Yuming Jiang, and Ziwei Liu.  Collaborative diffusion for multi-modal face generation and editing.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 6080–6090, 2023.
  * [33] inswapper.  https://github.com/haofanwang/inswapper.
  * [34] Yonghyun Jeong, Jongwon Choi, Doyeon Kim, Sehyeon Park, Minki Hong, Changhyun Park, Seungjai Min, and Youngjune Gwon.  Dofnet: Depth of field difference learning for detecting image forgery.  In Proceedings of the Asian Conference on Computer Vision, 2020.
  * [35] Liming Jiang, Ren Li, Wayne Wu, Chen Qian, and Chen Change Loy.  Deeperforensics-1.0: A large-scale dataset for real-world face forgery detection.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2020.
  * [36] Yan Ju, Shan Jia, Jialing Cai, Haiying Guan, and Siwei Lyu.  Glff: Global and local feature fusion for ai-synthesized image detection.  IEEE Transactions on Multimedia, 2023.
  * [37] Tero Karras, Miika Aittala, Samuli Laine, Erik Härkönen, Janne Hellsten, Jaakko Lehtinen, and Timo Aila.  Alias-free generative adversarial networks.  Advances in neural information processing systems, 34:852–863, 2021.
  * [38] Tero Karras, Samuli Laine, and Timo Aila.  A style-based generator architecture for generative adversarial networks.  In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 4401–4410, 2019.
  * [39] Tero Karras, Samuli Laine, Miika Aittala, Janne Hellsten, Jaakko Lehtinen, and Timo Aila.  Analyzing and improving the image quality of stylegan.  In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 8110–8119, 2020.
  * [40] Hasam Khalid, Shahroz Tariq, Minha Kim, and Simon S Woo.  Fakeavceleb: A novel audio-video multimodal deepfake dataset.  arXiv preprint arXiv:2108.05080, 2021.
  * [41] Pavel Korshunov and Sébastien Marcel.  Deepfakes: a new threat to face recognition? assessment and detection.  arXiv preprint arXiv:1812.08685, 2018.
  * [42] Patrick Kwon, Jaeseong You, Gyuhyeon Nam, Sungwoo Park, and Gyeongsu Chae.  Kodf: A large-scale korean deepfake detection dataset.  In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 10744–10753, 2021.
  * [43] Haodong Li, Bin Li, Shunquan Tan, and Jiwu Huang.  Identification of deep network generated images using disparities in color components.  Signal Processing, 174:107616, 2020.
  * [44] Lingzhi Li, Jianmin Bao, Hao Yang, Dong Chen, and Fang Wen.  Advancing high fidelity identity swapping for forgery detection.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 5074–5083, 2020.
  * [45] Lingzhi Li, Jianmin Bao, Ting Zhang, Hao Yang, Dong Chen, Fang Wen, and Baining Guo.  Face x-ray for more general face forgery detection.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2020.
  * [46] Yuezun Li and Siwei Lyu.  Exposing deepfake videos by detecting face warping artifacts.  arXiv preprint arXiv:1811.00656, 2018.
  * [47] Yuezun Li, Xin Yang, Pu Sun, Honggang Qi, and Siwei Lyu.  Celeb-df: A new dataset for deepfake forensics.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2020.
  * [48] Honggu Liu, Xiaodan Li, Wenbo Zhou, Yuefeng Chen, Yuan He, Hui Xue, Weiming Zhang, and Nenghai Yu.  Spatial-phase shallow learning: rethinking face forgery detection in frequency domain.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2021.
  * [49] Jiawei Liu, Qiang Wang, Huijie Fan, Yinong Wang, Yandong Tang, and Liangqiong Qu.  Residual denoising diffusion models.  arXiv preprint arXiv:2308.13712, 2023.
  * [50] Zhian Liu, Maomao Li, Yong Zhang, Cairong Wang, Qi Zhang, Jue Wang, and Yongwei Nie.  Fine-grained face swapping via regional gan inversion.  In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 8578–8587, 2023.
  * [51] Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang.  Large-scale celebfaces attributes (celeba) dataset.  Retrieved August, 15(2018):11, 2018.
  * [52] Yuchen Luo, Yong Zhang, Junchi Yan, and Wei Liu.  Generalizing face forgery detection with high-frequency features.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2021.
  * [53] MidJourney.  https://www.midjourney.com/home.
  * [54] Yisroel Mirsky and Wenke Lee.  The creation and detection of deepfakes: A survey.  ACM computing surveys (CSUR), 54(1):1–41, 2021.
  * [55] Kartik Narayan, Harsh Agarwal, Kartik Thakral, Surbhi Mittal, Mayank Vatsa, and Richa Singh.  Df-platter: multi-face heterogeneous deepfake dataset.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 9739–9748, 2023.
  * [56] Huy H Nguyen, Fuming Fang, Junichi Yamagishi, and Isao Echizen.  Multi-task learning for detecting and segmenting manipulated facial images and videos.  In IEEE International Conference on Biometrics Theory, Applications and Systems, pages 1–8. IEEE, 2019.
  * [57] Yuval Nirkin, Yosi Keller, and Tal Hassner.  Fsgan: Subject agnostic face swapping and reenactment.  In Proceedings of the IEEE/CVF international conference on computer vision, pages 7184–7193, 2019.
  * [58] Or Patashnik, Zongze Wu, Eli Shechtman, Daniel Cohen-Or, and Dani Lischinski.  Styleclip: Text-driven manipulation of stylegan imagery.  In Proceedings of the IEEE/CVF international conference on computer vision, pages 2085–2094, 2021.
  * [59] William Peebles and Saining Xie.  Scalable diffusion models with transformers.  In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 4195–4205, 2023.
  * [60] KR Prajwal, Rudrabha Mukhopadhyay, Vinay P Namboodiri, and CV Jawahar.  A lip sync expert is all you need for speech to lip generation in the wild.  In Proceedings of the 28th ACM international conference on multimedia, pages 484–492, 2020.
  * [61] Yuyang Qian, Guojun Yin, Lu Sheng, Zixuan Chen, and Jing Shao.  Thinking in frequency: Face forgery detection by mining frequency-aware clues.  In European Conference Computer Vision, pages 86–103. Springer, 2020.
  * [62] Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al.  Learning transferable visual models from natural language supervision.  In International conference on machine learning, pages 8748–8763. PMLR, 2021.
  * [63] Yurui Ren, Ge Li, Yuanqi Chen, Thomas H Li, and Shan Liu.  Pirenderer: Controllable portrait image generation via semantic neural rendering.  In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 13759–13768, 2021.
  * [64] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer.  High-resolution image synthesis with latent diffusion models.  In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684–10695, 2022.
  * [65] Roop.  https://github.com/s0md3v/roop.
  * [66] Felix Rosberg, Eren Erdal Aksoy, Fernando Alonso-Fernandez, and Cristofer Englund.  Facedancer: Pose-and occlusion-aware high fidelity face swapping.  In Proceedings of the IEEE/CVF winter conference on applications of computer vision, pages 3454–3463, 2023.
  * [67] Andreas Rossler, Davide Cozzolino, Luisa Verdoliva, Christian Riess, Justus Thies, and Matthias Nießner.  Faceforensics++: Learning to detect manipulated facial images.  In Proceedings of the IEEE/CVF Conference on International Conference on Computer Vision, pages 1–11, 2019.
  * [68] Axel Sauer, Katja Schwarz, and Andreas Geiger.  Stylegan-xl: Scaling stylegan to large diverse datasets.  In ACM SIGGRAPH 2022 conference proceedings, pages 1–10, 2022.
  * [69] shaoanlu.  https://github.com/shaoanlu/faceswap-GAN.
  * [70] Kaede Shiohara and Toshihiko Yamasaki.  Detecting deepfakes with self-blended images.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 18720–18729, 2022.
  * [71] Kaede Shiohara, Xingchao Yang, and Takafumi Taketomi.  Blendface: Re-designing identity encoders for face-swapping.  In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 7634–7644, 2023.
  * [72] Aliaksandr Siarohin, Stéphane Lathuilière, Sergey Tulyakov, Elisa Ricci, and Nicu Sebe.  First order motion model for image animation.  Advances in neural information processing systems, 32, 2019.
  * [73] Aliaksandr Siarohin, Oliver J Woodford, Jian Ren, Menglei Chai, and Sergey Tulyakov.  Motion representations for articulated animation.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 13653–13662, 2021.
  * [74] Haixu Song, Shiyu Huang, Yinpeng Dong, and Wei-Wei Tu.  Robustness and generalizability of deepfake detection: A study with diffusion models.  arXiv preprint arXiv:2309.02218, 2023.
  * [75] Yiyou Sun, Yaojie Liu, Xiaoming Liu, Yixuan Li, and Wen-Sheng Chu.  Rethinking domain generalization for face anti-spoofing: Separability and alignment.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 24563–24574, 2023.
  * [76] Justus Thies, Michael Zollhöfer, and Matthias Nießner.  Deferred neural rendering: Image synthesis using neural textures.  Transactions on Graphics, 38(4):1–12, 2019.
  * [77] Justus Thies, Michael Zollhofer, Marc Stamminger, Christian Theobalt, and Matthias Nießner.  Face2face: Real-time face capture and reenactment of rgb videos.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2016.
  * [78] Omer Tov, Yuval Alaluf, Yotam Nitzan, Or Patashnik, and Daniel Cohen-Or.  Designing an encoder for stylegan image manipulation.  ACM Transactions on Graphics (TOG), 40(4):1–14, 2021.
  * [79] Chengrui Wang and Weihong Deng.  Representative forgery mining for fake face detection.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2021.
  * [80] Chengrui Wang and Weihong Deng.  Representative forgery mining for fake face detection.  In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 14923–14932, 2021.
  * [81] Jian Wang, Shangqing Liu, Xiaofei Xie, and Yi Li.  Evaluating aigc detectors on code content.  arXiv preprint arXiv:2304.05193, 2023.
  * [82] Sheng-Yu Wang, Oliver Wang, Richard Zhang, Andrew Owens, and Alexei A Efros.  Cnn-generated images are surprisingly easy to spot… for now.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 8695–8704, 2020.
  * [83] Tengfei Wang, Yong Zhang, Yanbo Fan, Jue Wang, and Qifeng Chen.  High-fidelity gan inversion for image attribute editing.  arXiv preprint arXiv:2109.06590, 2021.
  * [84] Ting-Chun Wang, Ming-Yu Liu, Andrew Tao, Guilin Liu, Jan Kautz, and Bryan Catanzaro.  Few-shot video-to-video synthesis.  arXiv preprint arXiv:1910.12713, 2019.
  * [85] Ting-Chun Wang, Arun Mallya, and Ming-Yu Liu.  One-shot free-view neural talking-head synthesis for video conferencing.  In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10039–10049, 2021.
  * [86] Yaohui Wang, Di Yang, Francois Bremond, and Antitza Dantcheva.  Latent image animator: Learning to animate images via latent space navigation.  arXiv preprint arXiv:2203.09043, 2022.
  * [87] Zhendong Wang, Jianmin Bao, Wengang Zhou, Weilun Wang, Hezhen Hu, Hong Chen, and Houqiang Li.  Dire for diffusion-generated image detection.  In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 22445–22455, 2023.
  * [88] WhichFaceisReal.  https://www.whichfaceisreal.com/.
  * [89] Liangbin Xie, Xintao Wang, Honglun Zhang, Chao Dong, and Ying Shan.  Vfhq: A high-quality dataset and benchmark for video face super-resolution.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 657–666, 2022.
  * [90] Chao Xu, Jiangning Zhang, Yue Han, Guanzhong Tian, Xianfang Zeng, Ying Tai, Yabiao Wang, Chengjie Wang, and Yong Liu.  Designing one unified framework for high-fidelity face reenactment and swapping.  In European conference on computer vision, pages 54–71. Springer, 2022.
  * [91] Zhiliang Xu, Zhibin Hong, Changxing Ding, Zhen Zhu, Junyu Han, Jingtuo Liu, and Errui Ding.  Mobilefaceswap: A lightweight framework for video face swapping.  In Proceedings of the AAAI Conference on Artificial Intelligence, volume 36, pages 2973–2981, 2022.
  * [92] Zhiyuan Yan, Yuhao Luo, Siwei Lyu, Qingshan Liu, and Baoyuan Wu.  Transcending forgery specificity with latent space augmentation for generalizable deepfake detection.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024.
  * [93] Zhiyuan Yan, Yong Zhang, Yanbo Fan, and Baoyuan Wu.  Ucf: Uncovering common features for generalizable deepfake detection.  arXiv preprint arXiv:2304.13949, 2023.
  * [94] Zhiyuan Yan, Yong Zhang, Xinhang Yuan, Siwei Lyu, and Baoyuan Wu.  Deepfakebench: A comprehensive benchmark of deepfake detection.  In A. Oh, T. Neumann, A. Globerson, K. Saenko, M. Hardt, and S. Levine, editors, Advances in Neural Information Processing Systems, volume 36, pages 4534–4565. Curran Associates, Inc., 2023.
  * [95] Tianyun Yang, Juan Cao, Qiang Sheng, Lei Li, Jiaqi Ji, Xirong Li, and Sheng Tang.  Learning to disentangle gan fingerprint for fake image attribution.  arXiv preprint arXiv:2106.08749, 2021.
  * [96] Xin Yang, Yuezun Li, and Siwei Lyu.  Exposing deep fakes using inconsistent head poses.  In IEEE International Conference on Acoustics, Speech and Signal Processing, pages 8261–8265. IEEE, 2019.
  * [97] Wenxuan Zhang, Xiaodong Cun, Xuan Wang, Yong Zhang, Xi Shen, Yu Guo, Ying Shan, and Fei Wang.  Sadtalker: Learning realistic 3d motion coefficients for stylized audio-driven single image talking face animation.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 8652–8661, 2023.
  * [98] Xu Zhang, Svebor Karaman, and Shih-Fu Chang.  Detecting and simulating artifacts in gan fake images.  arXiv preprint arXiv:1907.06515, 2019.
  * [99] Jian Zhao and Hui Zhang.  Thin-plate spline motion model for image animation.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 3657–3666, 2022.
  * [100] Tianchen Zhao, Xiang Xu, Mingze Xu, Hui Ding, Yuanjun Xiong, and Wei Xia.  Learning self-consistency for deepfake detection.  In ICCV, 2021.
  * [101] Tianfei Zhou, Wenguan Wang, Zhiyuan Liang, and Jianbing Shen.  Face forensics in the wild.  In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 5778–5788, 2021.
  * [102] Mingjian Zhu, Hanting Chen, Qiangyu Yan, Xudong Huang, Guanyu Lin, Wei Li, Zhijun Tu, Hailin Hu, Jie Hu, and Yunhe Wang.  Genimage: A million-scale benchmark for detecting ai-generated image.  Advances in Neural Information Processing Systems, 36, 2024.

## Checklist

  1. 1.

For all authors…

    1. (a)

Do the main claims made in the abstract and introduction accurately reflect
the paper’s contributions and scope? [Yes] Our contributions are in Lines
53-59 of the "introduction" section. We claim the scope of deepfake detection
in Lines 36-39 of the "introduction" section, and we further clarify our
research scope in Lines 105-108 of the "DF40 benchmark" section.

    2. (b)

Did you describe the limitations of your work? [Yes] We describe the
limitations in Sec. 7.

    3. (c)

Did you discuss any potential negative societal impacts of your work? [No] Our
work is to detect those potentially "dangerous" deepfake techniques.

    4. (d)

Have you read the ethics review guidelines and ensured that your paper
conforms to them? [Yes]

  2. 2.

If you are including theoretical results…

    1. (a)

Did you state the full set of assumptions of all theoretical results? [No] We
do not provide any theoretical results.

    2. (b)

Did you include complete proofs of all theoretical results? [No] We do not
provide any theoretical results.

  3. 3.

If you ran experiments (e.g. for benchmarks)…

    1. (a)

Did you include the code, data, and instructions needed to reproduce the main
experimental results (either in the supplemental material or as a URL)? [Yes]
We have written detailed instructions to reproduce the main experimental
results in the supplementary.

    2. (b)

Did you specify all the training details (e.g., data splits, hyperparameters,
how they were chosen)? [Yes] We have specified all these details in the
supplementary.

    3. (c)

Did you report error bars (e.g., with respect to the random seed after running
experiments multiple times)? [No] We use the fixed seed that is the same as
DeepfakeBench [94] to align the settings and facilitate fair comparison.

    4. (d)

Did you include the total amount of compute and the type of resources used
(e.g., type of GPUs, internal cluster, or cloud provider)? [Yes] We have shown
these details in the supplementary.

  4. 4.

If you are using existing assets (e.g., code, data, models) or
curating/releasing new assets…

    1. (a)

If your work uses existing assets, did you cite the creators? [Yes] I have
cited all the existing software, datasets, and research works.

    2. (b)

Did you mention the license of the assets? [Yes] We provide the license in the
supplementary.

    3. (c)

Did you include any new assets either in the supplemental material or as a
URL? [Yes] We provide a URL to assess all of our code, dataset, and pre-
trained models.

    4. (d)

Did you discuss whether and how consent was obtained from people whose data
you’re using/curating? [Yes] All real people in our work are directly cited
from the previous/existing works.

    5. (e)

Did you discuss whether the data you are using/curating contains personally
identifiable information or offensive content? [Yes] All real people in our
work are directly cited from the previous/existing works.

  5. 5.

If you used crowdsourcing or conducted research with human subjects…

    1. (a)

Did you include the full text of instructions given to participants and
screenshots, if applicable? [No]

    2. (b)

Did you describe any potential participant risks, with links to Institutional
Review Board (IRB) approvals, if applicable? [No]

    3. (c)

Did you include the estimated hourly wage paid to participants and the total
amount spent on participant compensation? [No]

##  Appendix A Appendix

###  A.1 Dataset Generation Methods & Original Data

####  A.1.1 Brief Introduction of Generation Methods

Based on previous survey [54], deepfake techniques can be typically classified
into four types: face-swapping (FS), face-reenactment (FR), entire face
synthesis (EFS), and face editing (FE).

(1) Face-swapping: This paper classifies the face-swapping technique into two
domains: DF-family and FS-family. (i) DF-family involves creating a mask
around the facial region (some even include the neck [50]) and blending the
generated deepfake face back into the background image using that mask. Most
existing and famous face forgery datasets, such as FF-DF [67], Celeb-DF [47]
and DFDC [20], belong to this line. (ii) FS-family methods represent another
significant category in face-swapping deepfake generation. These methods
typically involve the use of an identity-background encoder. It disentangles a
face image’s identity and background information during encoding. Notably,
these methods directly generate all content, even the background. Much recent
face-swapping research works [90; 13] and popular software ($e.g.$, Roop) are
within this line.

(2) Face-reenactment: Generally, this technique can be used to modify source
faces, imitating the actions or expressions of another face. Differing from
face-swapping, face-reenactment techniques are rarely considered in existing
datasets. Two commonly used reenactment-based forgeries are Face2Face [77] and
NeuralTextures [76]. These two forgeries are implemented in the FF++ dataset.
Face2Face employs pairs of original and target faces, using key facial points
to generate varied expressions, while NeuralTexture uses rendered images from
a 3D face model to migrate expressions. Although these forgeries achieve more
realistic visual synthetic results compared to their face-swapping
counterparts in FF++, Due to the amazingly rapid development of the AIGC
technologies ($e.g.$, Digital Human), these relatively old-fashioned methods
cannot represent the modern’ SoTA reenactment methods. Our DF40 implements 13
face-reenactment methods in total, including the classical animation [72; 73],
SoTA’s audio-based driven methods [97; 60], image-based driven methods [86;
31; 7]. We also include the well-known best face generation technique, HeyGen,
in our dataset for evaluation.

(3) Entire Face Synthesis: This technique can be generally treated as "Face
AIGC." With the rapid development of AIGCs, this technique has achieved
remarkably notable improvement. The two widely used technologies to generate
synthesis faces are GAN ($e.g.$, StarGAN [14]) and Diffusion models ($e.g.$,
StableDiffusion [64]).

(4) Face Editing: This technique aims to modify the facial attributes ($e.g.$,
age and gender) of the given face images. Most of these works utilize the
latent code of StyleGAN [39] to perform editing during GAN inversion.

####  A.1.2 Details of Implemented Forgery Methods in DF40

We used a total of 40 distinct deepfake generation/synthesis methods (see Tab.
2 of the manuscript for details). We will briefly explain each synthesis
method below:

##### 1\. FSGAN [57]

FSGAN is proposed by Nirkin et al. [57], which is the latest face-swapping
method that has become popular recently. The key feature of this method is
that it performs reenactment along with the face swap. First, it applies
reenactment on the target video based on the source video’s pose, angle, and
expression by selecting multiple frames from the source having the most
correspondence to the target video. Then, it transfers the missing parts and
blends them with the target video. This process makes it much easier to train
and does not take much time to generate face-swapped video. We use the code
from the official FSGAN GitHub repository [57]. We used the best quality
swapping model recommended by the authors of FSGAN to prepare our dataset by
fine-tuning the input video pairs and generating better-quality results. We
adopt this method because of its efficiency and better quality of the results.
It is also used in the DFDC, ForgeryNet, FFIW, and FakeAVCeleb datasets. We
use the official code from https://github.com/NVlabs/imaginaire/ for
implementation.

##### 2\. FaceSwap [1]

FaceSwap is a pure landmark and graphics-based face-swapping method, not
employing any neural network. The outcome is relatively poor and considered as
the prototype of FS in the FF++ dataset. Despite its limitations, it still
provides a basic understanding of face-swapping techniques. FaceSwap relies on
traditional computer vision methods, such as facial landmark detection and
image warping, to achieve face-swapping results. Although the quality of the
results may not be as high as those produced by more advanced methods,
FaceSwap remains an essential reference point in the development of face-
swapping technology. Due to its popularity, it was used in FaceForensics++
datasets [67] to generate the face-swapped dataset. We use the official code
from https://github.com/MarekKowalski/FaceSwap/ for implementation.

Figure 12: Illustration of visual examples for all FS (face-swapping)
generated data on the FF domain. Figure 13: Illustration of visual examples
for all FR (face-reenactment) generated data on the FF domain. Figure 14:
Illustration of visual examples for all EFS (entire face synthesis) generated
data on the FF domain. Figure 15: Illustration of visual examples for all
unknown forgery data, including all types like FS, FR, EFS, and FE, simulating
the real-world SoTA deepfakes.

##### 3\. SimSwap [13]

SimSwap is one of the state-of-the-art (SOTA) methods for single-frame face
swapping. It has not been applied to academic datasets yet. The facefusion
software provides a good encapsulation of SimSwap, which can be directly
called for use. SimSwap leverages deep learning techniques, such as attention
mechanisms and GANs, to achieve high-quality face-swapping results in a single
frame. Its ability to produce visually appealing and realistic face swaps has
made it a popular choice for both research and practical applications. We use
the official code from https://github.com/neuralchen/SimSwap/ for
implementation.

##### 4\. InSwapper [33]

InSwapper is another SOTA method for single-frame face swapping that is also
utilized in Roop [65]. Similar to SimSwap, it has not been widely applied to
existing academic deepfake datasets, but many applications in the real world
due to its convenience and effectiveness. InSwapper can achieve good single-
frame face swap results, but it performs average in terms of frame-to-frame
consistency. InSwapper uses advanced deep learning techniques, including GANs
and attention mechanisms, to generate realistic face swaps. Its main focus is
on preserving the identity of the target face while seamlessly blending the
source face’s features. We use the popular code repository from
https://github.com/haofanwang/inswapper/ for implementation.

##### 5\. BlendFace [71]

BlendFace is the latest SOTA face-swapping method that was published in ICCV
2023. It has a good performance in single-frame face swapping, but the
continuous frames in the video tend to jitter noticeably. BlendFace employs
advanced deep learning techniques, such as GANs, to generate high-quality face
swaps. It also focuses on maintaining the target face’s identity while
blending the source face’s features seamlessly. The main challenge faced by
BlendFace is to achieve a stable and consistent face swap across video frames,
which remains an area for future research. We use the official code from
https://github.com/mapooon/BlendFace/ for implementation.

##### 6\. UniFace [90]

UniFace is another recent face-swapping technique that was published in ECCV
2022. It leverages disentangled representations to transfer identity and
attributes, utilizing Feature Disentanglement to separate identity and
attribute embeddings unsupervised. It employs Attribute Transfer and Identity
Transfer modules, powered by learned Feature Displacement Fields, to
granularly manipulate attributes and model adaptive identity fusion,
respectively, with an emphasis on maintaining consistency in reenactment and
attribute preservation in swapping. The model is designed to handle
challenging conditions like occlusions, extreme lighting, and large poses
without reliance on pre-estimated structures. The main drawback of this method
is the visible rectangular frame around the swapped face, which affects the
overall quality and realism of the face swap. Improving the blending and
transition between the source and target faces remains a challenge for
UniFace. We use the official code from https://github.com/xc-csc101/UniFace/
for implementation.

##### 7\. MobileFaceSwap [91]

MobileFaceSwap reduces the computational load of the model and realizes real-
time face swapping on mobile devices. It introduces a new idea of integrating
IDs into the network. MobileFaceSwap employs lightweight deep learning
architectures, such as MobileNet, to achieve real-time performance on
resource-constrained devices. The method focuses on maintaining the quality of
the face swap while reducing the computational complexity, making it suitable
for mobile applications and other scenarios where computational resources are
limited. We use the official code from
https://github.com/Seanseattle/MobileFaceSwap/ for implementation.

##### 8\. e4s [50]

e4s proposes a framework for explicit disentanglement of shape and texture
based on facial components, considering both geometry and texture details.
This method aims to create more realistic face swaps by separating and
recombining facial features more accurately. By focusing on the individual
components of the face, e4s can better preserve the identity of the target
face while seamlessly blending the source face’s features. This approach has
the potential to improve the overall quality and realism of face swaps in
various applications. The primary drawback of e4s is its noticeable temporal
inconsistency, which makes it easy to detect using temporal models. We use the
official code from https://github.com/e4s2022/e4s/ for implementation.

##### 9\. FaceDancer [66]

FaceDancer is a very recent work that was published in CVPR 2023, which
proposes a single-stage, identity-based method for face swapping of unknown
identities. This method aims to create high-quality face swaps even when the
source and target faces have not been previously encountered during training.
FaceDancer employs advanced deep learning techniques, such as GANs and
attention mechanisms, to achieve realistic results while maintaining the
identity of the target face. This method has the potential to broaden the
applicability of face-swapping technology to a wider range of scenarios and
use cases. This technology provides highly realistic visual results at both
spatial and temporal levels. We use the official code from
https://github.com/felixrosberg/FaceDancer/ for implementation.

##### 10\. DeepFaceLab [18]

DeepFaceLab [18] is a leading deepfake generation method. According to them,
the majority of deepfake videos are generated by DeepFaceLab or other similar
techniques (auto-encoder-based DF-family face-swapping techniques) such as
DeepFake [19] used in FF++ and face-swap GAN [69]. They provide a complete,
easy-to-use pipeline and provide end-to-end code with a windows software tool
as well. They have also shared some synthesis models that can be used to
generate deepfakes based on our requirements. Their method is a modification
of the original Faceswap model in which they added an intervening network
between the encoder and decoders. It helps the network to extract common
features between source and target videos. Moreover, their loss function
includes a mean squared error along with a structural dissimilarity index. We
used this deepfake generation method in our paper to include the most recent
and widely used method in our DF40. We use its official code repository from
https://github.com/iperov/DeepFaceLab/ to create fake videos one by one.

##### 11\. FOMM [72]

FOMM is a highly classic method of image animation and face reenactment,
previously used in the ForgeryNet dataset [27]. It employs deep learning
techniques, such as GANs and attention mechanisms, to generate high-quality
image animations and face reenactment results. FOMM has been widely used in
various applications, including video editing, virtual reality, and digital
content creation. Its ability to produce visually appealing and realistic
animations has made it a popular choice for both research and practical
applications. Thus, we propose to implement this classical synthesis method in
our benchmark. We use the official code from
https://github.com/AliaksandrSiarohin/first-order-model/ for implementation.

##### 12\. FS_Vid2vid [84]

FS_Vid2vid is another popular and classical synthesis method proposed by
NVIDIA. It can generate unseen domain videos. However, when the test domain is
significantly different from the training domain or the keypoint estimation is
inaccurate, the effect is poor. FS_Vid2vid employs advanced deep learning
techniques, such as GANs and attention mechanisms, to generate high-quality
face swaps across different domains. The main challenge faced by this method
is to achieve stable and consistent face swaps when dealing with significant
domain differences or inaccurate keypoint estimation. Improving the robustness
and generalizability of FS_Vid2vid remains an area for future research. We use
the official code from https://github.com/NVlabs/few-shot-vid2vid/ for
implementation.

##### 13\. Wav2Lip [60]

Recently, audio-based facial reenactment techniques along with lip-syncing
have been proposed by researchers. In lip-sync, the source person controls the
mouth movement, and in face reenactment, facial features are manipulated in
the target video. One of the most recent audio-driven facial reenactment
methods is Wav2Lip, which aims to lip-sync the video with respect to any
desired speech signal by reenacting the face. Wav2Lip has been widely used in
various applications, including video editing, virtual reality, and digital
content creation. Its ability to produce visually appealing and realistic lip-
sync animations has made it a popular choice for both research and practical
applications. We used this facial reenactment method because of the efficiency
of its synthesis process for generating lip-synced video. We use the official
code from https://github.com/Rudrabha/Wav2Lip/ for implementation. Also, the
audio and text data to be used for driving is randomly sampled from LRS3 [3].

##### 14\. MRAA [73]

MRAA is also a highly classic image animation method, but there seems to be no
existing deepfake dataset applied to this dataset so far. It identifies object
parts, tracks them in driving videos, and estimates motion using principal
axes within regions, leading to more stable and semantically meaningful
representations. It also models non-object motion with an affine
transformation to decouple foreground from background and disentangle shape
and pose in the region space for improved animation fidelity. The framework is
self-supervised, label-free, and optimized by reconstruction losses. MRAA has
the potential to improve the overall quality and realism of image animations
in various applications. We use the official code from
https://github.com/snap-research/articulated-animation/ for implementation.

##### 15\. OneShotFree [85]

OneShotFree presents a reenactment-based approach for animating articulated
objects with distinct parts, addressing the limitations of previous
unsupervised methods that struggle with motion representation and
articulation. It identifies object parts, tracks them in driving videos, and
estimates motion using principal axes within regions, leading to more stable
and semantically meaningful representations. It also models non-object motion
with an affine transformation to decouple foreground from background and
disentangle shape and pose in the region space for improved animation
fidelity. The framework is self-supervised, label-free, optimized by
reconstruction losses, and surpasses SoTA benchmarks, particularly for
articulated objects like human bodies. We use the official code from
https://github.com/zhanglonghao1992/One-Shot_Free-
View_Neural_Talking_Head_Synthesis/ for implementation.

##### 16\. PIRender [63]

PIender is a neural rendering system for generating controllable portrait
images by manipulating the motion of existing faces through intuitive and
semantically meaningful parameters. It leverages 3D Morphable Models (3DMM)
parameters for facial control, enabling precise adjustments to expressions and
poses. Unlike many existing techniques that offer limited or indirect editing
capabilities, PInder provides direct, fine-grained control for intuitive image
editing, allowing realistic modifications to facial aspects like posture and
expressions without the need for specialized software skills. Additionally,
it’s extended to address the audio-driven facial reenactment, synthesizing
coherent videos from a single reference image and audio stream, showcasing the
potential for intuitive controls in portrait manipulation and synthesis. We
use the official code from https://github.com/RenYurui/PIRender/ for
implementation.

##### 17\. TPSM [99]

TPSM (or called TPSMM) presents a thin-plate spline motion model for image
animation, an unsupervised method aimed at addressing the challenge of
animating objects with large pose discrepancies between source and driving
images. It introduces a new framework, starting with thin-plate splines to
estimate more flexible optical flow, enabling smoother warping of feature maps
from source to drive image domain. Multi-resolution occlusion masks are
employed to enhance feature fusion to improve occluded region restoration.
Additionally, dedicated auxiliary losses are designed to ensure a clear
division of labor among network modules, promoting high-quality image
generation. The method is demonstrated to animate various objects, including
faces, bodies, and animations, showing improved performance on benchmarks and
highlighting its potential for handling unseen manipulations. We use the
official code from https://github.com/yoyo-nb/Thin-Plate-Spline-Motion-Model/
for implementation.

##### 18\. LIA [86]

LIA is a recent SoTA face reenactment that was published in ICLR 2022, which
edits the Latent code by learning linear changes in the Latent space, $i.e.$,
learning a set of orthogonal Motion directions. This method aims to create
more realistic face reenactments and animations by editing the Latent code
directly. LIA is evaluated on real-world videos, demonstrating the capability
to animate still images without bias, eliminating the need for structure. This
approach has the potential to improve the overall quality and realism of face
swaps and animations in various applications. We use the official code from
https://github.com/wyhsirius/LIA/ for implementation.

##### 19\. DaGAN [31]

This method is a depth-aware generative adversarial network (DaGAN) for
talking head generation, aiming to create realistic synthetic videos that
encapsulate the identity of a person from a source image and the pose from a
driving video. It uniquely incorporates unsupervised depth recovery to learn
dense facial geometry (depth) from videos, which is vital for accurate face
synthesis and distinguishing facial structures amidst cluttered backgrounds
without requiring expensive annotations. Depth maps facilitate the estimation
of sparse key points capturing essential head movements and guide the
generation of motion fields for warping source representations via depth-aware
attention. Comprehensive experiments validate the model’s capacity to generate
high-quality videos, achieving significant advancements in unseen faces and
showcasing the effectiveness of depth awareness in talking head synthesis. We
use the official code from https://github.com/harlanhong/CVPR2022-DaGAN/ for
implementation.

##### 20\. SadTalker [97]

SadTalker is another recent popular talking head synthesis method that was
published in CVPR 2023. The system animates talking heads in videos through
audio-driven images using realistic facial expressions and head movements. It
decomposes the problem into two stages: audio-motion mapping and 3D motion
modeling. The ExpNet learns to extract facial expressions from audio with the
aid of an initial identity reference frame’s expression coefficients, ensuring
lip synchronization and reducing uncertainty. PoseVAE models head movements in
diverse styles, ensuring coherence with the beat alignment to audio.
Evaluations show that SadTalker surpasses previous methods in generating
higher-quality videos with accurate lip-sync and motion and reduced blurring,
especially for challenging tasks like head pose transfer and talking-head
videos. The system demonstrates the potential for creating coherent videos
with natural-looking animations from audio and reference images, advancing
video conferencing and digital media applications. We use the official code
from https://github.com/OpenTalker/SadTalker/ for implementation.

##### 21\. MCNet [30]

MCNet is another recent SoTA reenactment method that was published in ICCV
2023. This work presents a novel approach for generating high-fidelity talking
head videos, aiming to animate a static source image with dynamic poses and
expressions derived from a separate driving video while preserving the
original person’s identity. This is achieved through the Implicit Identity
Representation Conditioned Memory Compensation Network (MCNet), which
addresses the issue of ambiguous generation caused by large, complex motions
in the driving video. MCNet introduces a unique mechanism that learns a global
facial representation space and employs an implicit identity representation
conditioned memory bank to provide rich structural and appearance priors.
These priors help compensate for insufficient information in occluded regions
or subtle expression variations, significantly reducing artifacts and
enhancing video quality. The system incorporates a memory compensation module
(MCM) and an implicit identity representation conditioned memory module (IICM)
to query and utilize the learned memory effectively. Extensive experimentation
affirms its capability to generate realistic talking head videos even under
challenging conditions. We use the official code from
https://github.com/harlanhong/ICCV2023-MCNET/ for implementation.

##### 22\. HyperReenact [7]

HyperReenact is another recent SoTA reenactment method that was published in
ICCV 2023. It is a one-shot neural face reenactment method capable of
synthesizing realistic talking head sequences of a source individual driven by
a target’s facial pose, including 3D head orientation and expression.
HyperReenact is designed to handle both self and cross-subject reenactment
scenarios, requiring only a single source image. It excels in minimizing
visual artifacts, even when there are drastic differences in head pose between
the source and target images or when conducting cross-subject reenactment. By
leveraging the photorealism and disentangled properties of a pre-trained
StyleGAN2 model, HyperReenact first inverts real images into the latent space
before refining and retargeting them. The method is compared favorably with
several state-of-the-art reenactment techniques, showcasing its proficiency in
generating artifact-free details around facial areas such as the mouth and
eyes, even under extreme head poses. Additionally, the paper includes
extensive quantitative and qualitative evaluations, demonstrating
HyperReenact’s efficiency and effectiveness across various metrics and
benchmark tests. We use the official code from
https://github.com/StelaBou/HyperReenact/ for implementation.

##### 23\. HeyGen [28]

HeyGen is an AI-powered video creation platform that simplifies the process of
making professional-quality videos. With its user-friendly interface and
advanced features, HeyGen has become a popular choice for users looking to
create high-quality, engaging content without the need for extensive editing
skills and time investment. One of the standout features of HeyGen is its AI-
powered text-to-speech functionality, which allows users to effortlessly
convert written text into natural-sounding speech. This feature enables users
to create engaging voiceovers for their videos without the need for
professional voice actors or expensive recording equipment. In addition to its
text-to-speech capabilities, HeyGen also offers customizable avatars that can
be used to represent speakers in the videos. These avatars can be tailored to
match the desired appearance and style of the user, adding a personal touch to
the video content. Furthermore, HeyGen’s automated professional video editor
streamlines the video creation process by intelligently combining video clips,
images, text, and audio to produce polished and visually appealing videos.
This feature saves users significant time and effort typically required for
manual video editing. HeyGen’s combination of AI-powered features and user-
friendly interface makes it an ideal solution for users looking to create
professional-quality videos with minimal effort. Its versatility and
efficiency have made it popular for various applications, including content
creation, digital marketing, e-learning, and social media promotion. We use
the software from its official website https://www.heygen.com/ for creating
fake videos.

##### 24\. VQGAN [24]

VQGAN is a classical entire image synthesis method, which introduces a method
that enhances transformers’ capability to synthesize high-resolution images,
overcoming their traditional inefficiency for long sequences typical of pixel-