PaperlayerView exact revision on arXiv

Source-linked AI summary

Exploring Unbiased Deepfake Detection via Token-Level Shuffling and Mixing

Xinghe Fu, Zhiyuan Yan, Taiping Yao, Shen Chen, Xi Li

arXiv:2501.04376v1cs.CV

TL;DR

Deepfake detectors may generalize poorly because they overfit to forgery methods as well as forgery-irrelevant position and content factors. UDD intervenes on these factors with token-level shuffling and mixing in transformer latent space, using branch alignment to learn unbiased representations and classifiers. Extensive experiments confirm improved generalization and robustness across evaluation settings.

  • Problem

    Deepfake detection generalization can fail when forgery-irrelevant position and content factors shift, even with identical forgery techniques.

  • Method

    UDD uses token-level shuffling and mixing branches, together with feature contrastive and logit alignment losses, to intervene on position and content biases.

  • Results

    UDD demonstrates generalization capability and robustness, with extensive experiments outperforming existing state-of-the-art methods on unseen testing datasets.

  • Takeaways & Limitations

    The study indicates that addressing position and content biases can support more robust deepfake detection beyond focusing only on forgery-specific information.

  • Takeaways & Limitations

    The token-mixing strategy assumes forgery features are local and remain partially represented after token dropout and global latent feature exchange.

Abstract

from arXiv · show

The generalization problem is broadly recognized as a critical challenge in detecting deepfakes. Most previous work believes that the generalization gap is caused by the differences among various forgery methods. However, our investigation reveals that the generalization issue can still occur when forgery-irrelevant factors shift. In this work, we identify two biases that detectors may also be prone to overfitting: position bias and content bias, as depicted in Fig. 1. For the position bias, we observe that detectors are prone to lazily depending on the specific positions within an image (e.g., central regions even no forgery). As for content bias, we argue that detectors may potentially and mistakenly utilize forgery-unrelated information for detection (e.g., background, and hair). To intervene these biases, we propose two branches for shuffling and mixing with tokens in the latent space of transformers. For the shuffling branch, we rearrange the tokens and corresponding position embedding for each image while maintaining the local correlation. For the mixing branch, we randomly select and mix the tokens in the latent space between two images with the same label within the mini-batch to recombine the content information. During the learning process, we align the outputs of detectors from different branches in both feature space and logit space. Contrastive losses for features and divergence losses for logits are applied to obtain unbiased feature representation and classifiers. We demonstrate and verify the effectiveness of our method through extensive experiments on widely used evaluation datasets.

Introduction

Deepfake detectors can fail to generalize not only because forgery methods differ, but also because they overfit to position and content biases unrelated to forgery. UDD addresses these biases through token-level shuffling, mixing, and alignment strategies.

  • Cross-dataset generalization remains difficult because detectors can overfit to differences between training and testing forgery methods.
  • Generalization problems can persist with identical forgery techniques when detectors rely on image-center locations or content such as background, hair, and clothes.
  • UDD uses a shuffling branch to rearrange latent tokens and their position embeddings, disrupting position-related biased information.
  • UDD uses a mixing branch to recombine latent token content and reduce reliance on specific contextual information.
  • The proposed method combines shuffling and mixing branches with alignment strategies to improve generalization on unseen testing datasets.

General Deepfake Detection

Prior deepfake detection methods emphasize forgery artifacts and augmentation but do not directly constrain overfitting to position and content biases. The proposed framework applies token-level interventions to real and fake samples and aligns branch outputs for unbiased representations and classifiers.

  • Deepfake detection methods target subtle manipulation traces using frequency analysis and specialized network modules, but generalization remains challenging.
  • Existing synthesis and blending methods improve generalization by modifying RGB images, while the proposed method intervenes directly on latent token representations.
  • The framework applies random shuffling and mixing operations to both real and fake samples to reduce position and content bias.
  • During forwarding, token-shuffling and token-mixing branches share feature and logit alignment losses to obtain unbiased representations and classifiers.
  • The detection formulation treats images as conditioned on forgery, content, and position variables, while labels depend only on the forgery variable.

Token-Shuffling Branch

The token-shuffling branch intervenes on positional information in ViTs by randomizing position embeddings and blockwise token placement while preserving local correlations needed for forgery traces.

  • The shuffling module operates at the ViT embedding layer to reduce reliance on specific image locations.
  • Position embeddings are randomly cropped, resized, and flattened to introduce randomness in absolute position and scale.
  • Patch tokens are divided into s×s blocks and randomly permuted, while local correlation within each block is maintained.
  • The shuffled patch tokens are combined with new position embeddings to form the token embeddings used by the network.
  • The resulting intervention randomizes relative and absolute position information while preserving locality, helping reduce position bias.

Token-Mixing Branch

The token-mixing branch intervenes on content information by dropping and recombining latent tokens from same-label images. This creates varied content contexts while retaining partial forgery information.

  • The mixing module randomly drops target tokens and combines the remaining target tokens with tokens from another same-label image.
  • Random token dropout preserves the class token and a subset of patch tokens during the forward pass.
  • The method assumes forgery features are local and that latent tokens have undergone global feature exchange, so remaining tokens retain partial forgery features.
  • Mixing tokens from different sources recombines contextual information and reduces reliance on specific facial context.
  • The mixing branch is inserted at randomly selected forwarding layers to approximate intervention on the content latent variable.

Overall Framework

The framework uses three-branch ViT data flows with token-level interventions and alignment losses to learn forgery representations less biased toward position and image content.

  • Architecture: The framework trains vision transformers on three-branch data flows to capture causal correlations between images and forgery labels with reduced position and content bias.The branches build on position and image-content interventions.
  • Architecture: The architecture freezes backbone parameters and adds low-rank learnable parameters to attention and MLP layers for parameter-efficient training.The low-rank update is decomposed as ΔW = AB^T, with A and B learned during training.
  • Learning Objective: Feature-level contrastive learning aligns class tokens from the original and shuffled branches, using other batch samples as negatives.The aligned tokens are mapped through a three-layer MLP projector before contrastive learning.
  • Learning Objective: Logit-level Jensen–Shannon divergence aligns prediction probabilities from the different branches after classification.The divergence constraint is applied to the predicted logits.

Causal Analysis

The causal analysis treats position and content biases as forgery-irrelevant confounders that create backdoor paths to labels, motivating interventions that break those paths and isolate forgery-related features.

  • Causal Motivation: The analysis identifies position and content as factors contributing to spurious correlations and seeks to disentangle them from forgery-related causal features.This frames unbiased detection as an intervention on forgery-unrelated biases.
  • Causal Graph: An unobserved confounder U produces nuisance factors Z_p and Z_c alongside the forgery-related feature Z_f, with bias represented as Z_b.The backdoor path is X ← Z_b ← U → Z_f → Y.
  • Causal Graph: The backdoor path can bias training toward Z_b and hinder learning of the correct causal path from X through Z_f to Y.The proposed goal is to intervene on Z_b and break this path.
  • Intervention: The do-operator denotes actively intervening on a variable so that Z_b becomes independent of Z_f.This distinguishes intervention from conventional methods that only model correlation.
  • Intervention: After removing the backdoor, the learned correlation is equated with causality, and token shuffling and mixing serve as the corresponding image-level interventions.These operations are intended to remove position and content spurious correlations and learn more general forgery features.

Setup

The experiments train on FF++ (c23), evaluate generalization on four other datasets, and assess robustness on perturbed FF++ test data using AUC metrics.

  • Datasets: The study uses FF++, Celeb-DF, DFDC, DFDC-Preview, and DFD, training on FF++ and testing cross-dataset generalization on the other datasets.Robustness is evaluated on the FF++ test split.
  • Implementation: The implementation uses a ViT-B backbone initialized from CLIP, samples 8 training frames per video, and sets the mixing ratio r to 0.3.The shuffling branch divides the token map into 2 × 2 blocks.
  • Metrics: Evaluation uses frame-level and video-level AUC, with video-level scores computed from averaged predictions over 32 sampled video frames.Video-level AUC is the default reported metric unless otherwise specified.
  • Generalization Evaluation: The method achieves state-of-the-art frame-level and video-level AUC scores when trained on FF++ and evaluated on CDF, DFDCP, DFDC, and DFD.The cross-dataset setup targets overfitting to forgery-irrelevant position and content information.
  • Robustness Evaluation: The method achieves the highest averaged AUC in robustness evaluation and is less sensitive to severe perturbations on FF++ (c23).The evaluation reports video-level AUC across five perturbation types and five severity levels.

Ablation Study

Ablations show that shuffling and mixing improve cross-dataset generalization, while attention visualizations indicate reduced reliance on positional and content biases.

  • Component ablation: 93.13% video-level AUC on CDF and 81.21% on DFDC are achieved with both branches, versus 90.70% and 78.25% without them.The ablation attributes the improvement to jointly alleviating position and content bias during training.
  • Pre-trained weights: 88.56% AUC on CDF and 83.84% on DFDCP are achieved with UDD using ImageNet-pretrained weights, versus 81.66% and 77.72% without UDD.The improvement from UDD is reported as insensitive to backbone pretraining selection.
  • Mixing stages: Mid-stage token mixing gives the best average AUC, improving from 87.17% before the first block to 89.07%.Early mixing cannot effectively introduce content information, whereas late mixing has less effect on the final output.
  • Attention visualization: The baseline attends to specific regions and content such as upper-center areas, clothes, or backgrounds, whereas UDD captures more diverse forgery artifacts.The comparison uses last-layer attention maps from transformer models.
  • Method overview: UDD uses token-level shuffling and mixing branches with feature-level contrastive and logit-level alignment losses to learn less biased representations and classifiers.The approach targets both position and content biases identified as sources of generalization problems.

Training Setup

The experiments use a CLIP-initialized ViT-B detector trained on eight FF++ frames per video, with specified token-shuffling, mixing, rank, and loss settings.

  • Backbone and data: The detector uses ViT-B initialized with pretrained weights from CLIP’s vision encoder and trains on eight sampled FF++ (c23) frames per video.The setup specifies the backbone and frame sampling used to form the training set.
  • Optimization settings: Training uses AdamW with a warmup linear scheduler for the first 5 epochs followed by cosine annealing.The detailed training setup is provided for reproducibility.
  • Branch configuration: S-Branch divides the token map into 2 × 2 blocks, while M-Branch uses a mixing ratio r of 0.3.These are the stated branch-specific configuration choices.

Ablation on Hyperparameter λ1 for Lcon

The λ1 ablation finds that a small feature-contrastive loss weight performs best, while larger weights harm learning of general forgery features.

  • λ1 selection: 86.74% frame-level AUC on CDF is achieved with λ1 = 0.1, compared with 85.59% when λ1 = 0.The study evaluates λ1 values of 0, 0.1, 0.5, and 1 while keeping other hyperparameters fixed.
  • Interpretation: Larger λ1 values encourage invariant-image representation learning but negatively affect learning of general forgery features.The authors conclude that a relatively small λ1 is sufficient for feature-level alignment.

Ablation on Hyperparameter λ2 for Lalign

The ablations examine how alignment, shuffling, mixing, and testing perturbations affect generalization. They identify settings that preserve forgery information while reducing position and content bias.

  • Loss-weight ablations: 86.74% frame-level AUC on CDF is achieved when λ2 is set to 0.1, while larger values such as 1.0 degrade performance.The authors attribute the degradation potentially to incompatibility between the JS-divergence weight and learning rate.
  • Shuffling ablations: 2×2 shuffling blocks provide the best setting because larger block counts corrupt inter-patch correlations needed to preserve forgery clues.Patchwise shuffling with s = 14 is specifically described as damaging the correlation among patches.
  • Mixing ablations: γ = 0.3 gives 86.74% AUC on CDF, whereas γ = 0.7 reduces performance from 86.74% to 83.93%.Small ratios provide limited content variance, while large ratios alter the main forgery artifacts and break the alignment hypothesis.
  • Mixing ablations: The latent mixing module outperforms simple patch removal because it creates diverse combinations of content such as hair, background, ID, and gender.The removal-only variant is reported as suboptimal in cross-dataset testing.
  • Position-bias evaluation: The proposed method is more stable than the baseline under central-region cutouts, improving performance by 3.97% and 1.61% at cutout sizes 48 and 64.The result indicates that the baseline relies more heavily on specific positions, particularly the image center.
  • Content-bias evaluation: Attribute classifiers using the proposed detector backbone achieve AUCs closest to 0.5, indicating that content information contributes little to its real/fake decisions.The attributes tested include identity, gender, and race.
Loading 2501.04376v1…