Source-linked AI summary
DeepFakes: a New Threat to Face Recognition? Assessment and Detection
Pavel Korshunov, Sebastien Marcel
TL;DR
GAN-based face swapping makes Deepfake videos increasingly easy to create and disseminate, creating a need for detection evidence and benchmarks. The paper constructs a public VidTIMIT-based database, evaluates recognition vulnerability, and tests detection baselines, finding high recognition false acceptance and challenging detection performance.
Problem
The rapid spread of GAN-generated face-swapped videos and limited public evaluation data motivate reliable Deepfake detection research.
Method
The paper creates a public VidTIMIT database of GAN-based face swaps and evaluates VGG and Facenet recognition systems alongside lip-sync and image-quality detection baselines.
Results
VGG and Facenet accepted HQ Deepfakes at 85.62% and 95.00% FAR, while IQM+SVM detected HQ Deepfakes at 8.97% EER.
Takeaways & Limitations
GAN-generated Deepfakes challenge both face-recognition systems and existing detection methods, with HQ videos posing a more serious detection challenge.
Abstract
from arXiv · showhide
It is becoming increasingly easy to automatically replace a face of one person in a video with the face of another person by using a pre-trained generative adversarial network (GAN). Recent public scandals, e.g., the faces of celebrities being swapped onto pornographic videos, call for automated ways to detect these Deepfake videos. To help developing such methods, in this paper, we present the first publicly available set of Deepfake videos generated from videos of VidTIMIT database. We used open source software based on GANs to create the Deepfakes, and we emphasize that training and blending parameters can significantly impact the quality of the resulted videos. To demonstrate this impact, we generated videos with low and high visual quality (320 videos each) using differently tuned parameter sets. We showed that the state of the art face recognition systems based on VGG and Facenet neural networks are vulnerable to Deepfake videos, with 85.62% and 95.00% false acceptance rates respectively, which means methods for detecting Deepfake videos are necessary. By considering several baseline approaches, we found that audio-visual approach based on lip-sync inconsistency detection was not able to distinguish Deepfake videos. The best performing method, which is based on visual quality metrics and is often used in presentation attack detection domain, resulted in 8.97% equal error rate on high quality Deepfakes. Our experiments demonstrate that GAN-generated Deepfake videos are challenging for both face recognition systems and existing detection methods, and the further development of face swapping technology will make it even more so.
I. INTRODUCTION
The paper addresses the growing availability of GAN-generated face-swapped videos and the need for detection. It introduces a public database and evaluates face-recognition vulnerability and several detection baselines.
- Motivation: Publicly available software and GANs enable rapidly disseminated, high-quality face-swapped videos that pose detection and filtering challenges.The paper links this development to public concern and deliberate misinformation.
- Contributions: The paper presents a publicly available VidTIMIT database containing 620 GAN-based face-swapped videos in low- and high-quality versions.It selected 16 similar-looking subject pairs and retained each video's original audio track.
- Contributions: The study evaluates the vulnerability of VGG- and Facenet-based face-recognition systems to untampered and face-swapped videos.It also provides corresponding recognition and detection systems and scores as open-source software.
- Contributions: Detection experiments compare lip-sync inconsistency analysis with PCA, LDA, and IQM+SVM baselines from presentation attack detection.The audio-visual method tests whether generated mouth movements remain synchronized with speech.
II. RELATED WORK
Prior work advanced face swapping and introduced detection datasets and methods, but publicly available evaluation data for GAN-generated Deepfake videos remained limited. The paper argues that existing approaches require testing because GAN-based swaps can reproduce facial motion cues.
- Face swapping: Earlier face-swapping research emphasized blending, GAN-based replacement, and audio-driven mouth synthesis rather than detection.These approaches progressed from appearance matching and blending toward neural-network-based generation.
- Detection research: Existing detection studies used Face2Face data, Snapchat videos, or image datasets that did not necessarily represent GAN-generated Deepfakes.Reported methods included SURF+SVM and LBP-like features with SVM classifiers.
- Open gap: No public database applied a GAN-based approach to Deepfake videos, leaving the effectiveness of prior detection methods unclear.The paper states that its generated Deepfakes can mimic facial expressions, mouth movements, and blinking.
III. DEEPFAKE DATABASE
The database uses controlled VidTIMIT videos and manually paired subjects with similar visual features. GAN models generate reciprocal face swaps in low- and high-quality versions.
- Source data: The source data contain 10 controlled-environment videos for each of 43 VidTIMIT subjects, with subjects facing the camera and reciting fixed phrases.The authors selected 16 pairs whose members shared prominent visual features such as mustaches or hairstyles.
- Generation: Each selected subject pair produced reciprocal face swaps, transferring each subject’s face onto the other subject’s videos.The swaps used an available GAN-based face-swapping implementation.
- Quality variants: Two GAN models were trained per subject pair to produce low-quality and high-quality video versions.The models differed in facial-region input and output resolution and training settings.
A. Evaluation protocol
The evaluation separates recognition vulnerability from Deepfake detection. Recognition uses enrolled original videos and swapped probes, while detection uses subject-disjoint train and test subsets.
- Face-recognition protocol: Recognition enrollment uses 2 original videos per subject, with the remaining 8 original videos serving as probes in the licit scenario.The same enrollment model is later used with tampered probes.
- Metrics: False acceptance rate and false reject rate are computed across thresholds, with equal error rate defined where the two rates are equal.EER provides a single performance value for the recognition system.
- Face-recognition protocol: Deepfake vulnerability is measured by applying the licit-scenario EER threshold to swapped probes and reporting their false acceptance rate.A higher tampered-video FAR indicates poorer distinction from genuine enrolled videos.
- Detection protocol: Deepfake detection is treated as binary classification distinguishing original from Deepfake videos.The data include both genuine and tampered content.
- Data splitting: Subject-disjoint train and test subsets prevent the same subject from appearing in both sets, and the study reports test EER and FRR at FAR = 10%.No development set was used because the dataset was not large enough.
IV. ANALYSIS OF DEEPFAKE VIDEOS
This section evaluates VGG- and Facenet-based face recognition systems against swapped-face videos and applies baseline Deepfake detection systems.
- The analysis tests face-recognition vulnerability and several baseline methods for detecting videos with swapped faces.
A. Vulnerability of face recognition
VGG and Facenet recognition systems perform well on untampered videos but are highly vulnerable to GAN-generated face swaps. Both systems fail to reliably distinguish swapped faces from originals.
- 98.95% and 99.63% LFW accuracy are reported for VGG and Facenet, respectively, using cosine-distance classification.The systems use fc7 and bottleneck features from pre-trained VGG and Facenet architectures.
- 0.03% and 0.00% EER are obtained for VGG and Facenet in the licit non-tampered scenario.These thresholds are then used to evaluate Deepfake probes.
- 88.75% and 85.62% FAR occur for VGG on LQ and HQ Deepfakes, while Facenet reaches 94.38% and 95.00%.The values are computed using the EER thresholds from the licit scenario.
- Both systems cannot effectively distinguish GAN-generated swapped faces from original faces.The paper notes that Facenet is more vulnerable than VGG, consistent with previous findings.
B. Detection of Deepfake videos
The paper compares audio-visual and image-based baselines for Deepfake detection. Lip-sync detection fails, whereas IQM+SVM provides the strongest reported performance but faces greater difficulty on HQ videos.
- The evaluated baselines include lip-sync inconsistency detection and several solely image-based systems.The image-based systems include raw-pixel and image-quality features with PCA-LDA or SVM classifiers.
- The lip-sync system extracts audio and visual features, reduces joint-feature dimensionality with PCA, and classifies videos using an LSTM.Audio uses MFCCs, while visual features are based on distances between mouth landmarks.
- IQM+PCA+LDA uses 95% retained variance and produces a 2-dimensional transform, while Pixels+PCA+LDA retains 99% variance and produces 446 dimensions.
- IQM+SVM averages scores from 20 frames using 129 image-quality measures, including signal-to-noise ratio, specularity, and blurriness.The approach is borrowed from presentation attack detection.
- 8.97% EER is achieved by IQM+SVM on HQ Deepfakes, while lip-sync detection cannot detect face swapping.The results indicate that HQ videos are more challenging for IQM+SVM than lower-quality videos.
V. CONCLUSION
The paper releases a VidTIMIT-based Deepfake database and shows that face recognition and existing detection methods remain vulnerable. Higher-quality swaps are harder to detect, motivating new datasets and more generic methods.
- The database contains 620 Deepfake videos covering 16 subject pairs from VidTIMIT.
- The dataset includes 64 × 64 low-quality and 128 × 128 higher-quality GAN-generated video versions.
- Up to 95.00% equal error rate is reported for VGG- and Facenet-based recognition algorithms on Deepfake videos.The systems fail to distinguish such videos from original ones.
- 8.97% equal error rate is achieved when image-quality measures with an SVM classifier detect HQ Deepfake videos.
- Continued advances in face swapping are expected to produce Deepfakes that existing algorithms find harder to detect.The authors call for new databases and more generic detection methods.