Source-linked AI summary
The Creation and Detection of Deepfakes: A Survey
Yisroel Mirsky, Wenke Lee
TL;DR
Deepfakes are increasingly believable and can support impersonation, misinformation, and defamation, creating a need for clearer understanding of their threats and defenses. This survey reviews how human deepfakes are created and detected, their architectures and trends, and the weaknesses of current countermeasures. It reports that detector performance declines as deepfake quality improves and identifies limitations and future research needs.
Problem
The field lacks a technical and encompassing account of deepfake techniques, advancements, challenges, capabilities, limitations, and trajectory.
Method
The survey reviews human visual deepfakes, their technical building blocks and architectures, detection countermeasures, weaknesses, limitations, and future directions.
Results
Detector performance decreased across three late-2019 benchmarks, achieving AUCs of 0.86 on DFD, 0.76 on DFDC, and 0.66 on Celeb-DF as deepfake quality improved.
Takeaways & Limitations
The survey provides a technical reference for understanding and preventing malicious human reenactment and replacement deepfakes.
Takeaways & Limitations
Deepfake training can require laborious and impractical data pairing across multiple identities and actions.
Abstract
from arXiv · showhide
Generative deep learning algorithms have progressed to a point where it is difficult to tell the difference between what is real and what is fake. In 2018, it was discovered how easy it is to use this technology for unethical and malicious applications, such as the spread of misinformation, impersonation of political leaders, and the defamation of innocent individuals. Since then, these `deepfakes' have advanced significantly. In this paper, we explore the creation and detection of deepfakes and provide an in-depth view of how these architectures work. The purpose of this survey is to provide the reader with a deeper understanding of (1) how deepfakes are created and detected, (2) the current trends and advancements in this domain, (3) the shortcomings of the current defense solutions, and (4) the areas which require further research and attention.
1 INTRODUCTION
Deepfakes are AI-generated human-realistic content with creative uses but serious risks of impersonation, misinformation, and defamation. This survey addresses how they are created and detected, their advances and challenges, and weaknesses in current defenses.
- Definitions: Deepfakes are AI-generated content designed to appear authentic to human viewers, primarily using artificial neural networks.The term combines “deep learning” and “fake.”
- Applications: Deepfakes have benign applications including foreign-film dubbing, historical-figure reanimation, virtual clothing try-ons, and entertainment memes.
- Risks: Malicious deepfakes can enable identity theft, impersonation, misinformation, defamation, and other social harms.The paper links these concerns to prominent face-swapping examples and political impersonation.
- Research trajectory: Deepfake research expanded from 3 papers in 2017 to over 250 papers during 2018–20.
- Survey goals: The survey aims to explain deepfake creation and detection, review advances and challenges, guide architecture design, and assess the attacker–defender game.
- Scope: The survey focuses on human-face and body deepfakes, while addressing broader domains such as forensics, finance, and healthcare as future trends.
- Terminology: Unlike adversarial machine learning, deepfakes seek to fool humans rather than machine-learning algorithms.
2 OVERVIEW & ATTACK MODELS
Human deepfakes are organized into reenactment, replacement, editing, and synthesis categories. Reenactment and replacement are emphasized because they can give attackers control over a person’s identity and enable impersonation or abuse.
- Categories: The survey defines deepfakes as believable media generated by a deep neural network and categorizes human visuals into reenactment, replacement, editing, and synthesis.
- Reenactment: Reenactment uses a source identity to drive a target’s expression, mouth, gaze, pose, or body.Examples include dubbing, gaze control, face frontalization, and body pose transfer.
- Attack models: Reenactment attacks can impersonate what a person says or does, enabling defamation, misinformation, blackmail, trust exploitation, and evidence tampering.
- Replacement: Replacement transfers source content or identity onto a target, including facial transfer and face swapping.Face swapping can support memes and anonymization, but also harmful impersonation.
- Editing: Editing alters or removes target attributes such as clothing, facial hair, age, weight, beauty, or ethnicity.The same capability can support entertainment or create misleading personas and humiliating imagery.
- Synthesis: Synthesis creates a human face or body without using a target as a basis, supporting stock footage and fictional characters as well as fake personas.
- Scope: The survey prioritizes reenactment and replacement because they give attackers control over an individual’s identity.
3 TECHNICAL BACKGROUND
Deepfake systems commonly combine generative and encoder-decoder networks, trained with differentiable losses and optimization procedures. Their effectiveness is constrained by data pairing, image alignment, identity-specific training, and video artifacts.
- Network Architectures: Most deepfakes use variations or combinations of generative networks and encoder-decoder networks.Encoder-decoder systems summarize inputs in latent encodings, while generative adversarial networks use competing generators and discriminators.
- Training and Loss Functions: Supervised training uses paired samples, a differentiable loss, back-propagation, and optimization to update network weights across epochs.One-shot and few-shot approaches adapt a pretrained network using inner-layer information or additional iterations on a small number of new samples.
- Training and Loss Functions: L1 and L2 losses require paired images and perform poorly when source and target images have large pose or facial-feature offsets.Perceptual loss instead compares feature-map activations from a perceptual model, often a face-recognition network such as VGGFace.
- Network Architectures: Encoder-decoder networks compress inputs into latent representations that can be manipulated to influence generated outputs.Symmetric encoder-decoder models trained to reconstruct inputs are autoencoders; variational autoencoders support interpolation and modification through disentangled latent concepts.
- Network Architectures: Generative adversarial networks train a generator to create samples and a discriminator to distinguish real from generated data.After training, the discriminator is discarded and the generator produces content intended to resemble the original distribution.
- Challenges: Deepfake quality is limited by identity-specific training data, difficult paired-data collection, occlusions, and temporal artifacts such as flickering.Self-supervised, unpaired, and encoding-based approaches are used to reduce the burden of pairing inputs and outputs.
4 REENACTMENT
The survey organizes deep-learning reenactment models chronologically and by identity generalization, covering one-to-one, many-to-one, and many-to-many approaches for faces and bodies. These methods use varied representations and architectures, with progress toward temporal coherence, broader identity generalization, few-shot adaptation, and real-time generation.
- 4 REENACTMENT: Reenactment research is reviewed chronologically and organized by identity generalization, with Table 1 systematizing the discussed models.The review covers deep-learning-based reenactment and later contrasts methods and significant approaches.
- 4.1.1 One-to-One: One-to-one reenactment methods include CycleGAN, which avoids paired data but requires similar source and target distributions to reduce artifacts.The relevant domains must share similar poses and expressions.
- 4.1.2 Many-to-One and 4.1.3 Many-to-Many: Many-to-one and many-to-many approaches decouple source and target identities using conditional generators, facial boundaries, labels, action units, landmarks, or latent representations.Examples include CVAE-GAN, ReenactGAN, GATH, GANnotation, and FaceFeat-GAN.
- Temporal Reenactment: Temporal reenactment models improve video consistency by modeling motion, previous frames, optical flow, or sequence-level discrimination.MoCoGAN disentangles motion and content and uses separate discriminators for per-frame realism and temporal coherence; Vid2Vid conditions each frame on recent source and generated frames.
- 3D Parametric Approaches: FaceFeat-GAN improves facial diversity while preserving identity, but is less practical because its input seed must be selected empirically to fit the source.Earlier many-to-many systems also remained limited to low-resolution or partial faces.
- Efficiency and Adaptation: Reenactment systems also reduce data and runtime demands: one method uses three minutes of footage, another few-shot method uses only a few sample images, and FSGAN reaches 30fps.The three-minute system segments and orients limbs before generation, while FSGAN uses fewer neural networks for real-time reenactment.
5 REPLACEMENT
Replacement deepfakes transfer one identity onto another face using architectures ranging from encoder-decoder systems to few-shot and occlusion-aware pipelines. The survey organizes these approaches by identity mapping and reviews their training objectives and limitations.
- One-to-One: The original Reddit deepfake model uses one shared encoder with separate source and target decoders, enabling identity swapping through a shared latent space.The encoder maps both identities into a common representation; the target decoder reconstructs the swapped face.
- One-to-One: DeepFaceLab and FaceSwap-GAN extend the basic architecture with adversarial, perceptual, masked, self-attention, cycle-consistency, and segmentation-based components.These additions target image quality, identity leakage, fidelity, and occlusion handling.
- One-to-Many: One-to-many methods transfer a source identity to multiple target identities through style transfer, alignment, multiscale CNN processing, and segmentation-mask blending.The process aligns the target to a reference source, transfers identity features, then blends the output back into the target frame.
- Many-to-Many: Many-to-many replacement methods can be identity-agnostic, but some require paired faces with different identities and matching expressions for training.Other encoder-decoder designs disentangle identity from pose, hair, background, and lighting to provide more control.
- Few-Shot and Specialized Methods: Few-shot and specialized pipelines reduce reference-data requirements while adding mechanisms for landmarks, in-painting, occlusion correction, blending, and identity conditioning.The survey also describes face-transfer approaches that combine reenactment and replacement methods, while warping-based methods remain sensitive to occlusions.
6 COUNTERMEASURES
Deepfake countermeasures include detection methods that analyze spatial or temporal artifacts, generic classifiers, anomaly detectors, provenance systems, and adversarial counter-attacks. The survey emphasizes that detectors must address artifacts, unknown creation methods, and evasion.
- Artifact-Based Detection: Deepfake detection methods target seven artifact categories spanning spatial blending, environment, and forensics, plus temporal behavior, physiology, synchronization, and coherence.These categories capture inconsistencies in appearance, context, model traces, behavior, biological signals, speech alignment, and frame sequences.
- Spatial Artifacts: Spatial detectors analyze blending boundaries, environmental inconsistencies, model fingerprints, sensor noise, and other residual or structural imperfections.Examples include edge and frequency analysis, foreground-background comparison, generator attribution, PRNU, and head-pose monitoring.
- Temporal Artifacts: Temporal detectors use behavioral, physiological, synchronization, and coherence cues to identify anomalies across audio, video, facial signals, and frame sequences.Methods monitor mannerisms, emotion discrepancies, pulse or blinking, viseme-phoneme alignment, flicker, jitter, and optical flow.
- Generic Detection: Generic deep-learning approaches use classification or anomaly detection, with anomaly models trained on normal data to better handle unknown creation methods.Classifiers can localize tampered regions, but the survey notes that they may be vulnerable to adversarial evasion.
- Prevention and Mitigation: Prevention approaches track multimedia provenance through distributed ledgers or blockchain systems, rank or authenticate content, and use adversarial noise to disrupt deepfake generation or training.These methods operate on content provenance or on the inputs used by deepfake systems rather than relying only on post-generation detection.
7 DISCUSSION
Deepfake methods involve trade-offs among data, quality, speed, and accessibility, while recent advances improve realism and reduce data requirements. The survey argues that current detectors face an adaptive arms race and that broader defenses are needed.
- Trade-offs Between Methodologies: The most threatening deepfakes combine practical implementation with believability, creating trade-offs among training data, execution speed, accessibility, and quality.Many-sample models can be highly realistic but often require extensive target footage, whereas few-shot approaches balance limited data and quality.
- Trade-offs Between Methodologies: Online social-engineering attacks require real-time performance, but high-resolution models and temporal processing increase computational and preprocessing costs.Availability and reproducibility also affect proliferation because public code and datasets make methods easier to adopt.
- Research Trends: Recent trends include identity-agnostic models, self-supervised and few-shot learning, higher-resolution generation, improved perceptual and adaptive normalization losses, and multi-network pipelines.Pipeline designs assign separate responsibilities such as conversion, generation, occlusion handling, and blending.
- Research Trends: Current deepfakes remain limited by frontal-pose reenactment, dependence on driver performance, imperfect realism at real-time speeds, and difficulties rendering hair, teeth, tongues, shadows, and hands.The survey reports real-time systems at 30fps but says their realism is not yet sufficient.
- The Deepfake Arms Race: Detector performance declines as deepfake quality improves, with AUC values of 0.86, 0.76, and 0.66 on DFD, DFDC, and Celeb-DF, respectively.Artifact detectors can be evaded by mitigating the targeted flaw, while deep-learning classifiers can be attacked with transferable perturbations.
- Future Directions: The survey advocates proactive and out-of-band defenses, including provenance and authenticity frameworks, adversarial protection, theoretical attack limits, and research on detector vulnerabilities.The authors caution that relying solely on content-based countermeasures risks a reactive arms race.
8 CONCLUSION
The survey focuses on human reenactment and replacement deepfakes, explaining their architectures and reviewing detection work. It frames this understanding as useful for addressing malicious deepfakes and their broader harms.
- Scope: The survey focuses on reenactment and replacement deepfakes involving humans.Its scope centers on these attack types while acknowledging that deepfakes extend beyond human visuals.
- Contribution: It reviews how these technologies work, how their architectures differ, and what methods are used to detect them.The conclusion presents this technical review as the survey’s central contribution.
- Implications: The authors connect this understanding with efforts to prevent malicious deepfakes.The broader motivation includes addressing psychological, political, monetary, and physical harm from malicious use.