Robust Deepfake Detection, NTIRE 2026 Challenge: Report

1. Introduction

• The challenge seeks models that detect deepfakes in lower-quality, hard samples rather than only high-quality content.The authors propose it to engage the community in developing such models.Source: §1 · p. 1
• Prior work improved generality across dataset and method shifts [50] [66] [86] [96], but robustness to low-quality images was less studied.Some studies examined low image quality [50], while degradation modeling improved benchmark performance [24].Source: §1 · p. 1
• Image degradations could be used maliciously to circumvent deepfake detection, risking a detector’s usefulness [24].Source: §1 · p. 1

2. Challenge Details

• The challenge provided 1,000 training and 100 validation images, withheld validation labels, and released the public test set 24 hours before testing ended with one submission allowed.The validation set was accessed through Codabench; the organizers noted that manual labeling could not be fully ruled out for either validation or public testing.Source: §2 · p. 2
• Top submissions were evaluated on a fully unknown private test set, and rankings showed no major shifts from the public test set.Participants provided code and pretrained models; private-set performance determined the top methods’ ranking.Source: §2 · p. 2

2.1. Dataset

• All four datasets used CelebV-HQ [95] face crops and face-swapping or reenactment fakes, with validation and test splits designed for greater out-of-domain generalization.The datasets contained no fully synthetic images.Source: §2.1 · p. 2
• The 1,000-image training split was balanced between real and FaceSwap fakes and used common degradations, while omitting uncommon ones to test generalization.The degradation model adapted PMM [24] and varied Gaussian noise, JPEG compression, smoothing, resizing, and color and contrast adjustments.Source: §2.1 · p. 2
• Validation used 100 balanced images with StyleFeatureEditor in addition to FaceSwap and added speckle and Poisson noise; public testing used 1,000 balanced images, added FSGAN [51], and included uncommon degradations.The public-test uncommon degradations included salt-and-pepper noise, black-and-white filters, and overlays; the 1,000-image private split added another fake method and two more uncommon degradations to check top solutions for public-test overfitting.Source: §2.1 · pp. 2–3

2.2. Evluation metric

• The challenge used AUC, a threshold-free metric that avoids calibration problems on unseen test sets.The protocol follows common practice in face forgery detection [24] [50] [66].Source: §2.2 · p. 3

3.1. SHALLOW REAL: DINO-MAC

• ShalloReal fine-tunes DINOv3-Large with LoRA and classifies concatenated CLS, register, and average-patch tokens through a Multi-Aspect Classification head.Its training also uses dynamic image resolutions, auxiliary heads, supervised contrastive loss, and stochastic depth.Source: §3.1 · p. 3

3.2. INTSIG: LOGER: Local-Global Ensemble for Robust Deepfake Detection in the Wild

• LOGER combines multiscale global detectors using DINOv3 and MetaCLIP2 with DINOv3 patch-level detectors that use top-10% MIL pooling for localized forgery traces.The five outputs are averaged as directional evidence scores in logit space before sigmoid; horizontal-flip TTA is used for four models.Source: §3.2 · pp. 3–4

3.3. ANT INTERNATIONAL: An Ensemble of Architecturally-Diverse Large-Scale Vision

• ANT International ensembles DINOv3 CLS and attention-pooling models with 35/65 weights, and augments training with expanded degradations while avoiding text overlays on faces.Its hybrid dataset includes DDL real images and self-blended images; the team reports DINOv3 generalized better than the tested SigLIP, EVA-giant, and I-JEPA models.Source: §3.3 · pp. 4–5

3.4. HCMUS-AQUA: Robust Deepfake Detection via Multi-Stream DINO-CLIP Fusion and Discretized Voting

• HCMUS-AQUA combines global texture, localized facial, and hybrid semantic streams, trains with compound degradations, and aggregates quantized stream probabilities using 1:2:2 Local:Global:Fusion weights.The facial stream uses a seven-step recovery pipeline that reduces spatial parsing failure from 15% to 1.8%; the training pool contains 377,343 frames from 14 datasets.Source: §3.4 · pp. 5–6

3.5. ACVLAB: Select and Detect: Quality-Aware Expert Routing and Robust Optimization for Deepfake Detection

• ACVLAB routes CLIP semantic features to quality-specific expert heads, then uses GroupDRO over quality groups and patch-level evidence aggregation to address shortcut learning and localized traces.The quality proxy routes inputs by estimated quality regime, while GroupDRO reweights losses to reduce worst-group risk.Source: §3.5 · p. 6

3.6. REAGVIS LABS: Beyond Backbones: Degradation-Aware Prototype Fusion for Robust Deepfake Detection

• REAGVIS reports an AUC of 84.3 on the competition test set using CLIP-GAPL and DINOv3-GenD backbones, degradation-aware fusion, and rank-based score calibration.The fusion MLP uses degradation descriptors to learn adaptive weighting; final scores combine ranked fusion and backbone predictions.Source: §3.6 · pp. 6–7

3.7. HIT-VIRLAB: Hierarchical Adaptive Feature Aggregation with Degraded-Original Consistency Learning for Robust Deepfake Detection

• HIT-VIRLAB uses FSFM-initialized ViT features with hierarchical adaptive aggregation and degraded-original consistency learning, while Anonymous LoRA fine-tunes CLIP across OpenMMSec domains before deepfake-only training.Anonymous’s final model uses LoRA rank 64 and alpha 128 and averages predictions across original, flipped, and 90°-rotated views.Source: §3.7 · pp. 7–8, §3.8 · p. 8

3.9. ZEKE: Robust Deepfake Detection using Large Scale Vision Transformers

• Other approaches include frozen CLIP inference by ZEKE, degradation-augmented three-stage CLIP fine-tuning by TCD VISION, SBI/PMM-trained model ensembles by AI4GOOD, and PRISM’s paradigm-diverse encoder ensemble alongside ACUBE’s RGB and frequency branches.PRISM tunes only LayerNorm parameters for vision-language encoders and scores models on held-out data under degradations; the supplied ACUBE passage describes only its two-branch architecture.Source: §3.9 · p. 8, §3.10 · p. 8, §3.12 · p. 9

3.13. ACUBE: Robust Deepfake Detection using ConvNeXt with Frequency-Aware Fusion and Regularized Training Strategy

• ACUBE fuses RGB semantic and grayscale Fourier-magnitude features, with moderate degradation augmentation, balanced regularized training, and flip-based test-time augmentation.The pipeline uses weighted sampling and label smoothing, mixup, weight decay, and dropout; it initially freezes the backbone before lower-learning-rate fine-tuning, and averages original and flipped predictions at inference [72].Source: §3.13 · p. 9

3.14. NTR: DINOv3 ViT-B/16 Linear Probe Ensemble for Robust Deepfake Detection

• NTR trains a five-fold linear-probe ensemble on frozen DINOv3 ViT-B/16 features, averaging sigmoid predictions with horizontal-flip test-time augmentation [72].The backbone was pretrained on 1.69 billion image-text pairs; its generalizable representations and frozen weights are intended to limit overfitting on the small training set.Source: §3.14 · p. 9

4. Conclusion

• Top-performing methods generally leveraged large pretrained foundation models, often ensembles and degradation models.The report says high-quality pretraining can prevent overfitting, while exposure to low-quality images during training improves robustness.Source: §4 · p. 9
• The challenge included 14 finally submitted methods and drew > 300 participants and > 50 leaderboard submissions.Source: §4 · p. 9
• High-quality pretraining can prevent overfitting, while exposure to low-quality images during training improves robustness.Source: §4 · p. 9

Anonymous

• Anonymous’s contribution is titled “LoRA Fine-Tuning for CLIP Members.”The supplied passage gives no further method or result details.Source: Anonymous · p. 15
• The Anonymous title specifies CLIP members as the focus of its LoRA fine-tuning contribution.The supplied passage does not define “CLIP Members.”Source: Anonymous · p. 15

Zeke

• Zeke’s contribution is titled “Robust Deepfake Detection using Large Scale Vision Transformers.”The supplied passage gives no further method or result details.Source: Zeke · p. 16
• Zeke’s title frames the contribution around robust deepfake detection with large-scale vision transformers.No performance claims are provided in the supplied passage.Source: Zeke · p. 16

NTR

• NTR’s contribution is titled “DINOv3 ViT-B/16 Linear Probe Ensemble for Robust Deepfake Detection.”The supplied passage gives no further method or result details.Source: NTR · p. 16
• NTR’s title identifies a linear-probe ensemble for robust deepfake detection.No performance claims are provided in the supplied passage.Source: NTR · p. 16

• Table 2 provides a comparative overview of submitted methods.Source: B. Method comparison · p. 16

• Table 2 overviews method specifications, including rank, name, input, extra data, base model, and parameter count.Source: Table 2 · p. 17, C. Additional method details · p. 17
• PRISM’s pipeline is shown alongside its encoder pool, with d denoting feature dimension and LN and F denoting LayerNorm-only and frozen.Source: Figure 8 · p. 17, Table 3 · p. 19
• The section also shows AI4Good’s self-supervised adversarial-training pipeline and ACUBE’s ConvNeXt pipeline with frequency-aware fusion and regularized training.Source: Figure 9 · p. 18, Figure 10 · p. 19