Source-linked AI summary
Robust Deepfake Detection, NTIRE 2026 Challenge: Report
Benedikt Hopf, Radu Timofte, Chenfan Qu, Junchi Li, Fei Wu, Dagong Lu, Mufeng Yao, Xinlei Xu, Fengjun Guo, Yongwei Tang, Zhiqiang Yang, Zhiqiang Wu, Jia Wen Seow, Hong Vin Koay, Haodong Ren, Feng Xu, Shuai Chen, Minh-Khoa Le-Phan, Minh-Hoang Le, Trong-Le Do, Minh-Triet Tran, Chih-Yu Jian, Yi-Fan Wang, Bang-Kang Chen, You-Chen Chao, Chia-Ming Lee, Fu-En Yang, Yu-Chiang Frank Wang, Chih-Chung Hsu, Aashish Negi, Hardik Sharma, Prateek Shaily, Jayant Kumar, Sachin Chaudhary, Akshay Dudhane, Praful Hambarde, Amit Shukla, Jielun Peng, Yabin Wang, Yaqi Li, Jincheng Liu, Xiaopeng Hong, Krish Wadhwani, Liam Fitzpatrick, Utkarsh Tiwari, Bilel Benjdira, Anas M. Ali, Wadii Boulila, Cristian Lazo Quispe, Aishwarya A, Akshara S, Ashwathi N, Jiachen Tu, Guoyi Xu, Yaoxin Jiang, Jiajia Liu, Yaokun Shi
TL;DR
Deepfake detectors remain insufficiently robust to image degradations, which can occur naturally or be introduced to circumvent detection. This report presents the NTIRE 2026 Robust Deepfake Detection Challenge, evaluating methods across degraded data with safeguards against test-set overfitting. Top-performing approaches generally used pretrained foundation models, ensembles, and degradation training, while one reported method achieved an AUC of 84.3 on the competition test set.
Problem
Deepfake detection robustness to low-quality images remains less studied despite the importance of handling degraded content.
Method
The challenge evaluates robust detectors using foundation models, ensembles, degradation-aware components, and degraded-image training.
Results
Top-performing methods generally leverage large pretrained foundation models, often ensembles and degradation models.
Takeaways & Limitations
High-quality pretraining can prevent overfitting, while exposure to low-quality images during training improves robustness.
Takeaways & Limitations
The evaluated setting processes each frame independently and uses no temporal modeling or video-based aggregation.
Abstract
from arXiv · showhide
Robustness is a long-overlooked problem in deepfake detection. However, detection performance is nearly worthless in the real world if it suffers under exposure to even slight image degradation. In addition to weaker degradations that can accidentally occur in the image processing pipeline, there is another risk of malicious deepfakes that specifically introduce degradations, purposefully exploiting the detector's weaknesses in that regard. Here, we present an overview of the NTIRE 2026 Robust Deepfake Detection Challenge, which specifically addresses that problem. Participants were tasked with building a detector that would later be tested on an unknown test-set, which included both common and uncommon degradations of various strengths. With a total number of 337 participants and 57 submissions to the final leaderboard, the first edition of the challenge was well received. To ensure the reliability of the results, participants were given only 24h to complete the test run with no labels provided, limiting the possibility of training on the test data. Furthermore, the top solutions were scored on a private test-set to detect any such overfitting. This report presents the competition setting, dataset preparation, as well as details and performance of methods. Top methods rely on large foundation models, ensembles, and degradation training to combine generality and robustness.
1. Introduction
Deepfake detection has become more important as generated internet content has grown, but robustness to low-quality images remains less studied. The challenge targets detectors that work beyond high-quality deepfakes, including lower-quality hard samples and degradation-based circumvention.
- Deepfake detection has grown in importance as generated content becomes more prominent online.
- Robustness to low-quality images remains less studied than generalization across datasets and methods.
- The challenge encourages models that handle lower-quality hard samples rather than only high-quality deepfakes.
- Image degradations can be maliciously used to circumvent detection, threatening a detector’s usefulness.
2. Challenge Details
The challenge evaluated robust deepfake detectors across controlled datasets with known and less common degradations, while limiting test-set adaptation and checking top methods on a private test set. Its evaluation used AUC across real and fake face images from multiple manipulation methods and degradation settings.
- Challenge phases: Training and validation provided 1000 and 100 images, respectively, while participants could use additional public datasets for robustness.
- Challenge phases: Testing released the public test set 24h before the phase ended and allowed only one submission, limiting further test-set finetuning.
- Challenge phases: Top submissions were evaluated on a fully unknown private test set, and rankings showed no major shifts between public and private testing.
- Dataset design: The datasets used CelebV-HQ face crops with face-swapping or reenactment fakes, excluding fully synthetic images.
- Dataset design: Training used common degradations, while validation added speckle and Poisson noise and testing introduced new fake methods and uncommon degradations.
- Evaluation: AUC was used because it is threshold-free and avoids calibration problems on unseen test sets.
3. Methods
The reported methods combine foundation-model backbones, heterogeneous ensembles, localized evidence, degradation-aware training, and specialized fusion to improve robust deepfake detection.
- ShalloReal: DINO-MAC: DINO-MAC fine-tunes DINOv3-Large with LoRA and classifies concatenated [CLS], register, and average patch-token features.The six 1024-dimensional vectors form a 6144-dimensional input to an MLP classification head.
- INTSIG: LOGER: LOGER combines full-image global models with patch-level local models to capture semantic inconsistencies and localized forensic artifacts.Its local branch uses top-10% Multiple Instance Learning pooling, while final fusion averages directional logit evidence before the sigmoid.
- AntInternational: DINOv3 showed superior generalization among the tested foundation models, which the team attributed to self-supervised pretraining on the diverse LVD-1689m dataset.The comparison included DINOv3, SigLIP, EVA-giant, and I-JEPA.
- AntInternational: AntInternational uses architecturally diverse DINOv3 ensemble branches and combines their predictions with empirically selected 35/65 weighting.The branches target global features and localized subtle artifacts, respectively.
- Robustness-oriented training: Training strategies across methods include dynamic and degraded-image augmentation, hybrid data curation, quality-aware routing, and robust optimization.ACVLAB uses GroupDRO over quality-based groups, while other teams use degradation-aware fusion or large hybrid deepfake datasets.
4. Conclusion
The challenge report finds that top-performing robust deepfake detectors generally combine large pretrained foundation models, ensembles, and degradation models.
- Top-performing methods generally leverage large pretrained foundation models, often ensembles and degradation models.The challenge attracted more than 300 participants and more than 50 leaderboard submissions.
ShallowReal
The passage lists affiliations for South China University of Technology and Zhejiang University.
- The listed affiliations are South China University of Technology and Zhejiang University.
- South China University of Technology is identified as affiliation 1.
- Zhejiang University is identified as affiliation 2.
Ant International
The passages list several deepfake-detection paper titles and their institutional affiliations, including work on CLIP, vision transformers, and DINOv3 ensembles.
- The affiliations include University of Science, VNU-HCM, Indian Institute of Technology Mandi, UPES, and MBZUAI.
- The listed titles include LoRA Fine-Tuning for CLIP Members and Robust Deepfake Detection using Large Scale Vision Transformers.
- Additional affiliations are Michigan State University, Prince Sultan University, and University of Illinois Urbana-Champaign.
- Another listed title is DINOv3 ViT-B/16 Linear Probe Ensemble for Robust Deepfake Detection.
B. Method comparison
Table 2 provides a comparative overview of the submitted methods.
- Table 2 compares the submitted methods.
C. Additional method details
This section provides supplementary method specifications and pipeline diagrams for several challenge submissions. It includes overview information, PRISM’s encoder pool, and detailed pipelines for ACUBE, PSU, and AI4Good.
- Additional method details: Supplementary material presents details omitted from the main paper, including Tab. 3 and Figs. 8–10.These materials are identified as additional method details.
- Method specifications: Table 2 organizes method specifications by rank, name, input, extra data, base model, and parameter count.The listed columns define the table’s method-overview structure.
- PRISM encoder pool: PRISM’s supplementary material includes an encoder pool specifying feature dimension and LayerNorm-only or frozen components.The encoder-pool notation defines d as feature dimension, LN as LayerNorm-only, and F as frozen.
- Submission pipelines: The supplementary figures depict ACUBE’s ConvNeXt pipeline with frequency-aware fusion and regularized training, PSU’s PRISM pipeline, and AI4Good’s self-supervised adversarial-training pipeline.Each figure caption identifies the corresponding submission and its stated design elements.