SlowGuess/NeurIPS_2023_OCR huggingface dataset:
In this section, we focus on performing two types of evaluations: 1) within-domain and cross-domain evaluation, and 2) cross-manipulation evaluation. The purpose of the within-domain evaluation is to assess the performance of the model within the same dataset, while cross-domain evaluation involves testing the model on different datasets. We also perform cross-manipulation evaluation to evaluate the model's performance on different forgeries under the same dataset.
Within-Domain and Cross-Domain Evaluations In this evaluation, we specifically train the model using  $\mathrm{FF}++$  (c23) as the default training dataset. Subsequently, we evaluate the model on a total of 14 different testing datasets, with 6 datasets for within-domain evaluation and 8 datasets for cross-domain evaluation. Tab. 3 provides an extensive evaluation of various detectors, divided into Naive, Spatial, and Frequency types, based on both within-domain and cross-domain tests. Regarding the results in Tab. 3, we observe that, for the within-domain evaluations, a majority of the detectors performed commendably, evidenced by high within-domain AUC. Remarkably, detectors such as UCF, Xception, EfficientB4, and F3Net registered significant average scores, specifically  $95.37\%$ ,  $94.50\%$ ,  $93.89\%$ , and  $94.49\%$  respectively. Furthermore, an unexpected revelation comes from the performance of Naive Detectors. Astonishingly, Naive Detectors (e.g., Xception and EfficientB4), which essentially rely on a straightforward CNN classifier, register high AUC values that are comparable to more sophisticated algorithms. This could potentially suggest that the performance leap from advanced state-of-the-art methods to Naive Detectors might not be as substantial as perceived, particularly in consistent settings (e.g., pre-training or data augmentation). In other words, the performance gap could be a product of these additional factors rather than the intrinsic superiority of the method. To delve deeper into this phenomenon, we will investigate the impact of data augmentation, backbone architecture, pre-training, and the number of training frames in the following section (see Sec. 4.3).
Figure 3: Visualization of different augmentation methods. We apply two detectors, one in the spatial domain (Xception) and one in the frequency domain (SPSL), and then use 8 different augmentation strategies to measure the effect on 5 test datasets.
Figure 4: Visualization of the performance of 3 different backbones, ResNet, EfficientNet-B4, and Xception, across 4 different detectors, CORE, SPSL, UCF, and Face X-ray. The evaluation is conducted using the AUC metric, following the settings described in the previous section.
Cross-Manipulation Evaluations We also conduct a cross-manipulation evaluation to assess the model's performance on various manipulation forgeries within the same dataset (FF++ [33]). In this evaluation, only the forgery algorithm is altered. Other factors such as background and identity remain consistent across all the different forgeries. Fig. 2 compares the cross-manipulation detection performance of 10 detectors. Upon examining the figure, it becomes evident that the issue of generalization is prominent. While detectors such as CORE, EfficientB4, SPSL, SRM, and Xception exhibit excellent performance on the FF-DF test data when trained on FF-DF, their performance significantly deteriorates when faced with FF-FS forgeries. Furthermore, the "FT-NT" test data poses challenges for almost all detectors, as reflected by the diminished AUC values in this category throughout the heatmaps. In contrast, the "FT-DF" test data emerged as a comparatively facile challenge for the detectors. In summary, the varying nature of forgeries highlights a significant generalization gap. Models trained on specific forgeries often struggle to adapt to other unseen forgeries. This underscores the importance of training models to recognize generic forgery artifacts to better combat unseen forgery types.
Effect of Data Augmentation We assess the influence of various augmentation techniques on the performance of forgery detectors in this section. Specifically, we investigate the impact of rotations, horizontal flips, image compression, isotropic scaling, color jitter, and Gaussian blur on two prototypical detectors: one from the spatial domain (Xception) and one from the frequency domain (SPSL). Fig. 3 compares the performance when training these detectors with all data augmentations (denoted as "w_All"), without any data augmentations ("wo_All"), and without a specific augmentation.
Our findings can be summarized into three main observations: First, in the case of within-domain evaluation (as seen in the  $\mathrm{FF} + + _{\cdot}\mathrm{c23}$  dataset), removing all augmentations appears to improve detector performance by approximately  $2\%$  for both Xception and SPSL, suggesting that most augmentations may have a negative impact within this context. Second, for evaluations involving compressed data  $(\mathrm{FF} + + _{\cdot}\mathrm{c40})$ , certain augmentations such as Gaussian blur demonstrate effectiveness in both Xception and SPSL detectors, as they simulate the effects of compression on the data during training. Third, in the context of cross-domain evaluations (CelebDF-v2, DFD, and DFDCP), operations like compression and blur may significantly degrade the performance of SPSL in the DFD and DFDCP datasets, possibly due to their tendency to obscure high-frequency details. Similar negative effects of
Figure 5: Visualization of the effect of pre-trained weights on three different architectures. The evaluation is conducted using the AUC metric, following the settings described in the previous section.
the blur operation are observed for Xception, likely as it diminishes the visibility of visual artifacts. These findings underscore the need for further exploration into identifying a universally beneficial augmentation that can be effectively utilized across a wide range of detectors in generalization scenarios, irrespective of their specific attributes or datasets.
Model	FF++_c23	FF++_c40	CDF-v2	DFD	DFDCP	UADFV	Average
ResNet	0.8493	0.7846	0.7027	0.6464	0.6170	0.8739	0.7456
ResNet-DSC	0.8968	0.8048	0.7582	0.7006	0.6766	0.8895	0.7877
Improvement (%)	+5.60%	+2.57%	+7.90%	+8.39%	+9.64%	+1.78%	+5.64%
Table 4: Ablation study regarding the effectiveness of the depthwise separable convolution module (DSC) for ResNet. The models are trained on  $FF++\_c23$  and tested on other datasets. The metric is the frame-level AUC.
Effect of Backbone Architecture We here investigate the impact of different backbone architectures on the performance of forgery detection models. Specifically, we compare the performance of three popular backbones: Xception, EfficientNet-B4, and ResNet34. Each backbone is integrated into the detection model, and its performance is evaluated on both within-domain and cross-domain datasets (see Fig. 4). Our findings reveal that Xception and EfficientNet-B4 consistently outperform ResNet34, despite having a similar number of parameters. This indicates that the choice of backbone architecture plays a crucial role in detector performance, especially when evaluating the DeepfakeDetection dataset using CORE. In summary, these results highlight the critical role of carefully selecting a suitable backbone architecture in the design of deepfake detection models. Further research in this direction holds the potential for advancing the field in the future.
Additional In-depth Analysis towards the Effect of Backbone Architecture When analyzing the effect of backbone architecture, our analysis in Sec. 4.3 shows that Xception and EfficientNet-B4 work better than ResNet-34. Given the three architectures have similar numbers of parameters, we are curious about why there exists an obvious performance gap among the three architectures. Here, we dive deeper to explore the possible reasons.
After our preliminary investigation, we found that the reasons are related to two factors, namely architecture and models' scale. First, we identify a common module in EfficientNet and Xception that is not present in ResNet, namely the depthwise separable convolution module. We hypothesize that this module might be contributing to the performance advantage. To evaluate this, we insert this module into ResNet, replacing only the first convolutional layer. Experiments demonstrate significant improvements on many test datasets (as shown in Tab. 4). Second, upon closer scrutiny, additional factors that might exert an impact on the ultimate performance come to light. These encompass the number of layers within the model architecture as well as the number of parameters associated with it. Referring to Tab. 8 in the Appendix, it becomes evident that the parameter numbers remain comparable among the three models. Subsequently, a comprehensive exploration is conducted to assess the impact of layer numbers. This assessment involves a diverse range of ResNet variants, including ResNet 50 and ResNet 152. Results in Tab. 9 in our Appendix uncover that ResNet 50, characterized by a greater number of layers in comparison to ResNet 34, yields a substantial enhancement in performance. However, when confronted with a higher layer count, as exemplified by ResNet 152, the extent of improvement becomes restricted.
Figure 6: t-SNE visualization for each detector. These detectors are trained and tested on  $\mathrm{FF}++$  (c23).
Effect of Pre-training of the Backbone This analysis focuses on the impact of pre-training on forgery detection models. Following the previous section, we analyze three typical architectures: Xception, EfficientNetB4, and ResNet34. Fig. 5 reveals that the pre-trained models can largely outperform their non-pre-trained counterparts, especially in the case of Xception (about  $10\%$  in DFDCP) and EfficientB4 (about  $10\%$  in DeepFakeDetection). This can be attributed to the ability of pre-trained models to capture and leverage meaningful low-level features. However, the benefits of pre-training are less pronounced for ResNet34, mainly due to its architectural design, which may not fully exploit the advantages offered by pre-trained weights. Overall, our findings underscore the importance of both architectural choices and the utilization of pre-trained weights in achieving optimal forgery detection performance.
Visualizing Representations Deepfake detection can be considered a representation learning problem, where detectors learn representations through their backbones and employ various classification algorithms. It is crucial to assess whether the learned representations align with the expectations. To accomplish this, we utilize t-SNE [44] for analysis, which allows us to visualize the representation.
We examine t-SNE visualization from two perspectives. First, we assess whether the detectors can accurately differentiate between real and fake samples. This is achieved by assigning labels to the points in the t-SNE plot based on their corresponding ground truth. Second, we delve deeper into the fake category and investigate whether the models capture common features across different forgery types rather than being overfitted to specific forgeries. To conduct this analysis, we train and test each detector on the FF++ (c23) dataset and visualize the t-SNE representation using the test data. Also, we visualize all the samples with their corresponding labels, where the Deepfakes, Face2Face, FaceSwap, and NeuralTextures represent different forgery types in FF++. For visualization purposes, we randomly select 5000 samples, with an equal distribution of 2500 real and 2500 fake samples. Default parameters are used for t-SNE.
From the t-SNE results shown in Fig. 6, we observe that different detectors learn distinct feature representations in the visualized space. Notably, the results indicate that Meso4 struggles to differentiate between real and fake samples, as the two categories overlap and cannot be clearly distinguished.
5 Conclusions, Future Plans, and Societal Impacts
Conclusions We have developed DeepfakeBench, a groundbreaking and comprehensive framework, emphasizing the benefits of a modular architecture, including extensibility, maintainability, fairness,
and analytical capability. We hope that DeepfakeBench could contribute to the deepfake detection community in various ways. First, it provides a concise yet comprehensive platform that incorporates a tailored data processing pipeline, and accommodates a wide range of detectors, while also facilitating a fair and standardized comparison among various models. Second, it assists researchers in swiftly comparing their new methods with existing ones, thereby facilitating faster development and iterations. Last, the in-depth analysis and comprehensive evaluations performed through our benchmark have the potential to inspire novel research problems and drive future advancements in the field.
Limitations and Future Plans To date, DeepfakeBench primarily focuses on providing algorithms and evaluations at the frame level. We will further enhance the benchmark by incorporating video-level detectors and evaluation metrics. This expansion will enable a more comprehensive assessment of forgery detection performance, considering the temporal dynamics and context within videos. Besides, we also plan to carry out more evaluations for detecting images directly produced by diffusion or GANs, using the existing benchmark. In the current version, we have provided the visualizations and analysis for GAN-generated and diffusion-generated data in the frequency domain (see Sec. A.4 in the Appendix). Furthermore, we aim to include a wider range of typical detectors and datasets to offer a more comprehensive platform for evaluating the performance of detectors. DeepfakeBench will continue to evolve as a valuable resource for researchers, facilitating the development of advanced deepfake detection technologies.
Societal Impact and Ethical Issue The potential ethical issue lies in the risk that malicious actors might exploit DeepfakeBench to refine deepfakes to evade detection. 1) Inherent challenge with benchmarking: DeepfakeBench, like any benchmark created for positive intent, could inadvertently provide a blueprint for these actors due to its transparent nature. 2) Potential solutions and forward path: As solutions, we are contemplating controlled access for users and are committed to the dynamic evolution of DeepfakeBench to ensure it remains robust against emerging threats.
6 Contents in Appendix
The Appendix accompanying this paper provides additional details. The Appendix is organized as follows: 1) Details of data processing This section provides further elaboration on the data processing steps, including face detection, face cropping, alignment, and etc. 2) Details of algorithms implementation and visualizations This section dives into the implementation details of the algorithms used in the study. It also includes additional visualizations to help readers gain a deeper understanding of the experimental results. 3) Training details and full experimental results: This section presents comprehensive details of the training process, including additional evaluation metrics beyond those reported in the main paper. 4) Other analysis results: This section conducts analysis on some parts that are not analyzed in detail in the main text, such as analyzing and visualizing the frequency domain analysis of images generated by GAN and diffusion, etc.
This work is supported by the National Natural Science Foundation of China under grant No. 62076213, Shenzhen Science and Technology Program under grant No. RCYX20210609103057050, No. ZDSYS20211021111415025, No. GXWD20201231105722002-20200901175001001, and the Guangdong Provincial Key Laboratory of Big Data Computing, the Chinese University of Hong Kong, Shenzhen.
[1] Darius Afchar, Vincent Nozick, Junichi Yamagishi, and Isao Echizen. Mesonet: a compact facial video forgery detection network. In 2018 IEEE International Workshop on Information Forensics and Security, pages 1-7. IEEE, 2018. 2, 6, 17, 21
[2] Junyi Cao, Chao Ma, Taiping Yao, Shen Chen, Shouhong Ding, and Xiaokang Yang. End-to-end reconstruction-classification learning for face forgery detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 4113-4122, 2022. 2, 6, 18
[3] Liang Chen, Yong Zhang, Yibing Song, Lingqiao Liu, and Jue Wang. Self-supervised learning of adversarial example: Towards good generalizations for deepfake detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 18710-18719, 2022. 1, 3, 14, 15, 21, 31
[43] Ruben Tolosana, Ruben Vera-Rodriguez, Julian Fierrez, Aythami Morales, and Javier Ortega-Garcia. Deepfakes and beyond: A survey of face manipulation and fake detection. Information Fusion, 64:131-148, 2020. 3
[44] Laurens Van der Maaten and Geoffrey Hinton. Visualizing data using t-sne. Journal of Machine Learning Research, 2008. 5, 9
[45] Chengrui Wang and Weihong Deng. Representative forgery mining for fake face detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2021. 2
[46] Jingdong Wang, Ke Sun, Tianheng Cheng, Borui Jiang, Chaorui Deng, Yang Zhao, Dong Liu, Yadong Mu, Mingkui Tan, Xinggang Wang, et al. Deep high-resolution representation learning for visual recognition. IEEE Transactions on Pattern Analysis and Machine Intelligence, 43(10):3349-3364, 2020. 2, 18
[47] Junke Wang, Zuxuan Wu, Wenhao Ouyang, Xintong Han, Jingjing Chen, Yu-Gang Jiang, and Ser-Nam Li. M2tr: Multi-modal multi-scale transformers for deepfake detection. In ICMR, pages 615-623, 2022. 15
[48] Sheng-Yu Wang, Oliver Wang, Richard Zhang, Andrew Owens, and Alexei A Efros. Cnn-generated images are surprisingly easy to spot... for now. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 8695-8704, 2020. 2, 6, 17, 24, 25, 30
[49] Mika Westerlund. The emergence of deepfake technology: A review. Technology Innovation Management Review, 9(11), 2019. 3
[50] Zhiyuan Yan, Yong Zhang, Yanbo Fan, and Baoyuan Wu. Ucf: Uncovering common features for generalizable deepfake detection. arXiv preprint arXiv:2304.13949, 2023. 2, 6, 18
[51] Xin Yang, Yuezun Li, and Siwei Lyu. Exposing deep fakes using inconsistent head poses. In IEEE International Conference on Acoustics, Speech and Signal Processing, pages 8261-8265. IEEE, 2019. 4
[52] Hanqing Zhao, Wenbo Zhou, Dongdong Chen, Tianyi Wei, Weiming Zhang, and Nenghai Yu. Multi-attentional deepfake detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2021. 1, 18
[53] Peng Zhou, Xintong Han, Vlad I. Morariu, and Larry S. Davis. Two-stream neural networks for tampered face detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshop, 2017. 1
[54] Mingjian Zhu, Hanting Chen, Qiangyu Yan, Xudong Huang, Guanyu Lin, Wei Li, Zhijun Tu, Hailin Hu, Jie Hu, and Yunhe Wang. Genimage: A million-scale benchmark for detecting ai-generated image. arXiv preprint arXiv:2306.08571, 2023. 25
A.1 Details of Data Processing
This section introduces a data preprocessing script tailored for deepfake datasets. This script incorporates a series of fundamental steps, including face detection, face cropping, face alignment, and various other preprocessing operations. These steps are of utmost importance as they facilitate the acquisition of consistent face images, thereby ensuring the effectiveness and reliability of subsequent analysis and model training. The following subsections describe each step in detail.
Overall Workflow The preprocessing script follows a sequential workflow. It starts by detecting faces in each video frame using the Dlib [35] face detection algorithm. Once the faces are detected, the script proceeds to align and crop the faces based on the detected facial landmarks. If a mask video file is provided, the script also extracts and saves the masks for each aligned face. The face images, landmarks, and masks are saved in separate folders but in the same directory for further analysis. The preprocessing script also supports parallel processing, which enables multiple videos to be processed simultaneously, improving the overall processing speed. Each video is processed independently, and the results are saved separately to ensure data integrity and prevent conflicts. Throughout the preprocessing process, logging is used to track the progress and any errors that occur. The log file provides a detailed record of the preprocessing steps, allowing for easy troubleshooting and analysis of the preprocessing pipeline.
Face Detection The first step in the preprocessing pipeline is face detection. We employ the Dlib library, which provides an efficient face detection algorithm. The face detector scans each video frame and identifies the bounding boxes that enclose the faces.
Face Alignment Once the faces are detected, the next step is face alignment. Face alignment refers to the process of transforming the faces in the images to a standardized pose. In our preprocessing script, we use facial landmarks to perform face alignment. We utilize the Dlib library, which provides a pre-trained shape predictor model that can effectively detect facial landmarks. Using the shape predictor model, we extract the facial landmarks for each detected face in the image. Specifically, we extract the landmarks for the eyes, nose, and mouth. These landmarks serve as reference points for aligning and cropping the face. To align the faces, we use an affine transformation, which is a linear mapping that preserves the shape of the face. The transformation is estimated based on the detected landmarks and a set of target landmarks, which define the desired position and size of the face. We apply the transformation to the original image to obtain the aligned face.
Face Cropping After aligning the faces, the next step in the preprocessing pipeline is face cropping. To perform face cropping, we utilize the aligned faces obtained from the alignment step. To account for variations in face size and position, we introduce one parameter: margin. The margin parameter determines the amount of space around the aligned face that is included in the cropped image. Too large of a margin in the face cropping process can lead to the overfitting of the detection models to the contextual information surrounding the face, rather than focusing on the facial features themselves. This may result in the model relying more on irrelevant background details and thus reducing its generalization performance on unseen data. On the other hand, using too small of a margin in the face cropping process can lead to incomplete facial information being captured in the cropped face images. This occurs because a small margin restricts the region of interest to only the immediate vicinity of the aligned face. As a result, important facial features or parts of the face that extend beyond this limited region may be excluded from the cropped images. Therefore, there may exist a trade-off when choosing the margin parameter in the face-cropping process. In this paper, we fix the margin to be 1.3 for all datasets following the previous work [3]. For the overall face cropping process, we first calculate the bounding box of the aligned face region. The bounding box is then expanded by applying the margin parameter, which increases the size of the region of interest. Finally, we resize the expanded bounding box to the desired scale, resulting in a cropped face image with consistent dimensions (fixed with  $256 \times 256$  in this paper).
Landmark Extraction Extracting landmarks is an essential step in the preprocessing pipeline as it provides valuable information about facial structure and geometry. Landmarks are specific points on the face, such as the corners of the eyes, nose, and mouth, that serve as reference points for various
Example 1
Detected Landmark
Figure 7: Illustration and visualization of the preprocessing procedure. We perform face detection and aligned cropping to the frame and its corresponding mask.
Aligned Face
Aligned Mask
Example 2
Original Mask
Detected Landmark
Aligned Mask