A Rich Knowledge Space for Scalable Deepfake Detection
Authors: Inho Jung
Hyeongjun Choi
Binh M. Le
Hohyun Na
Simon S. Woo
Venue: ICLR 2026 Poster (2026)
Keywords: Deepfake Detection
Media Forensics
Multi-modal Learning
Primary area: alignment, fairness, safety, privacy, and societal considerations
TL;DR: We propose a scalable framework that unlocks training on a 3.6M-scale integrated visual-language dataset for deepfake detection.

Abstract: The proliferation of realistic deepfakes has driven the development of numerous benchmark datasets to support detection research. Despite their increasing volume and diversity, no prior effort has systematically consolidated these resources into a unified framework for large-scale model training, nor has there been a massively pre-trained model tailored to deepfake detection. In this work, we introduce Multi-modal Multi-type Integrated Deepfake Dataset (MMI-DD), a large-scale resource containing 3.6 million facial images, the largest collection to date. It unifies diverse benchmarks with uniform preprocessing, and further provides fine-grained annotations across four deepfake types, as well as VLM-generated descriptions capturing both facial and environmental attributes for each image. By leveraging this comprehensive multi-modal dataset, we construct a foundational deepfake knowledge space that empowers our model to discern a broad spectrum of synthetic media. Our method, $SD^2$ (Scalable Deepfake Detection), refines CLIP for deepfake detection, optimizing image-text classification with rich, type-specific labels. We enhance this with intermediate visual features capturing low-level cues and text label separation loss for stability. We further leverage VLM-generated descriptions and contrastive learning to expand the scope of forgery knowledge, reducing overfitting and enhancing generalization. Extensive experiments on challenging deepfake datasets and AIGC benchmark demonstrate the effectiveness, scalability, and real-world applicability of our approach.

Published as a conference paper at ICLR 2026
A RICH KNOWLEDGE SPACE FOR SCALABLE DEEPFAKE DETECTION
Inho Jung Hyeongjun Choi Binh M. Le College Computing and Informatics
Hohyun Na
Simon S. Woo"
Sungkyunkwan University, Suwon, Republic of Korea (inhovation9] junhjun, bmle, skghgus9, swoo [g. skku aakuueduu edu
ABSTRACT
The proliferation of realistic deepfakes has driven the development of numerous benchmark datasets to support detection research. Despite their increasing vol- ume and diversity, no prior effort has systematically consolidated these resources into unified framework for large-scale model training, nor has there been a mas- sively pre-trained model tailored to deepfake detection. In this work, we intro- duce Multi-modal Multi-type Integrated Deepfake Dataset (MMI-DD), large- scale resource containing 3.6 million facial images, the largest collection date. It unifies diverse benchmarks with uniform preprocessing, and further provides fine- fine-grained annotations across four deepfake types, as well VLM-generated descriptions capturing both facial and environmental attributes for each image. By leveraging this comprehensive multi-modal dataset, construct foundational deepfake knowledge space that empowers our model to discern a broad spectrum of synthetic media. Our method, SD² (Scalable Deepfake Detection), refines CLIP for deepfake detection, optimizing image-text classification with rich, type- specific labels. We enhance this with intermediate visual features capturing low- level cues and text label separation loss for stability. We further leverage VLM- generated descriptions and contrastive learning to expand the scope of forgery knowledge, reducing overfitting and enhancing generalization. Extensive exper- iments on challenging deepfake datasets and AIGC benchmark demonstrate the effectiveness, scalability, and real-world applicability of our approach.
INTRODUCTION
Over the past decade, significant advancements in deep learning have enabled the creation of highly realistic synthetic media, often misused for malicious purposes (Patrini, 2019; Donie, 2019; Rachel & Donie, 2019; Romano, 2019). The proliferation of user-friendly, open-access deepfake tools (DeepFaceLab, 2023; FaceSwap, 2016; Siarohin et al., 2019) has further exacerbated and ac- celerated the rapid spread of such content across the digital landscape. This trend has raised profound socictal concerns regarding its implications for security, privacy, and trust in digital media (Federal Bureau of Investigation (FBI), 2022; Li et al., 2022). Consequently, detecting deepfake media has emerged as a critical challenge in computer vision, necessitating the development of robust solutions supported by large-scale resources (Yan et al., 2024; Dolhansky al., 2020).
Researchers have actively pursued the development robust deepfake detection models, spurred by the emergence of deep learning. These methods scrutinize various dimensions of synthesis tifacts, such as spatial inconsistencies (Nguyen et al., 2019; Le & Woo, 2023; Tariq et al., 2021), frequency-domain irregularities (Qian al., 2020; Song et al., 2022; Le & Woo, 2022), and tempo- ral anomalies ( (Wang et al., 2023b; Zheng et al., 2021; Gu et al., 2021), and perceptually trace those artifacts (Tan al., 2023; Lin et al., 2023). In parallel, worldwide research groups have developed forensic datasets to support both the training and evaluation of detectors, encompassing enterprise- led efforts (Dolhansky et al., 2020; Dufour & Gully, 2019; Kwon et al., 2021), as well as academic contributions (Rossler et al., 2019; Cho et al., 2023; Yan et al., 2024). Nevertheless, most prior work (Zhao et al., 2021; Wang et al., 2023b; Zheng et al., 2021; Shiohara & Yamasaki, 2022; Ni
"Corresponding author

---

Published as a conference paper at ICLR 2026
et al., 2022; Cao et al., 2022; Dong et al., 2023; Dat et al., 2024) adheres to conventional practices, training on a single dataset (e.g. FaceForensicst*)) and validating on others (e.g. DFDC). However, this training paradigm poses three fundamental limitations: (i) the model sees only narrow range of forensic artifacts, restricting its ability to detect more advanced manipulations; (ii) it becomes biased toward the source dataset, reducing robustness groups, capture conditions, or post-processing; and (iii) a single-datasel training setup conceals the model's limitations in heterogeneous contexts and misleads about its practical applicability where training data naturally arise from multiple sources. Hence, there is an urgent need to leverage the full spectrum of available resources to develop detectors that enhance both robustness and knowledge, establishing practical benchmarks and applicability in real-world scenarios.
unseen data with varying demographic
Nevertheless, training models on large-scale, heterogeneous datasets remains challenging due to distributional shifts and the risk of poor generalization. To explore this, we in-
Pre-trained CLIP space
SD
Palt
vestigate three CLIP (Radford et al., 2021)-
mAuc (%)
adapted baselines commonly used for deepfake detection as illustrated in Fig. 1 (left). Each model is progressively trained scale dataset (Sec. 3), scaling from 100K to 3M images sourced from 11 distinct datasets. Mod- els are then evaluated on cross-domain bench- marks (see Sec. 5.2.1). Surprisingly, even with these state-of-the (SOTA) CLIP adaptation methods, we observe notable performance degradation as training data size increases. This finding highlights the difficulty of main- taining generalization across massive, diverse data, and motivates our proposed approach. Our method directly addresses these limitations through multi-modal supervision with carefully designed training objectives.
REAL
our large-
Envvesmmnt
EFS
100K
1M
JM
Scale Training
Figure 1: Scalability and goal of approach. (Left) As training data grows, baseline detec- tors reach limits and saturate, unable to exploit larger datasets, while our SD² steadily imprrves detection performance, overcoming these con- straints. (Right) SD² aims to forge a foundational deepfake knowledge space that effectively lever- ages large-scale, diverse datasets.
In this research, we propose a novel CLIP-based visual-language learning strategy for deepfake detection that unifies representations across diverse deepfake datasets with varying distributions, dubbed SD2 (Scalable Deepfake Detection). Our approach consolidates multiple datasets, incorpo- rating a broad spectrum of forgery knowledge. To this end, we construct Multi-modal Multi-type Integrated Deepfake Dataset (MMI-DD) by integrating broad range of deepfake sources. Our dataset has three key features: (i) it incorporates diverse sources and manipulation types with uni- form preprocessing; (ii) each image is meticulously annotated into one of five types; and (iii) each image is paired with VLM-based text descriptions capturing facial attributes and environmental con- text, resulting in a Large-scale this dataset, our model builds a comprehensive knowledge base (Fig. 1 (right)).
dataset for unified visual-language learning. Leveraging
We first propose Cross-Layer Attention Module (CLAM), which fuses visual features from the final and intermediate layers of CLIP. It captures lulti-level forgery cues to support our learning strategies: classification and contrastive learning. For classification, we leverage type-specific text labels matched to images, enabled by our detailed annotations. Using these labels, we introduce our Fine-Grained Image-Text Classification Loss that distinguishes real from four forgery types in the embedding space, extending the detector's knowledge beyond binary decision. Also, add Text Label Separation Loss to stabilize training by explicitly separating text label embeddings associated with each type. Moreover, propose Dual Image- Text Contrastive Loss, which aligns each image with two types of VIMM-generated descriptions to enhance semantic-visual coherence. This objective mitigates overfitting dataset-specific artifacts arising from solely relying on cross- entropy loss, as observed by Wang et al. (2024b) and Sun et al. (2023).
Finally, we conduct extensive experiments to validate our SD² on intra- and cross-domain datasets from popular benchmarks. We show that our model accommodates broader range of training data
'll baseline detectors are based on the CLIP architecture, including the state-of-the-art CLIP-SVD (Ef- fort) (Yan al., 2025b). Detailed deseriptions and extensive analysis are provided in Sec. 5.3.
2

---

Published as a conference paper at ICLR 2026
and achieves superior generalization performance on challenging real-world datasets. Additionally, we demonstrate that the CLIP image encoder. fine-tuned with our strategies, achieves SOTA results on non-facial Al-Generated Content (AIGC) benchmark, highlighting its applicability.
Our main contributions are summarized as follows: (i) we introduce MMI-DD, a multi-moda inte- grated dataset by collecting deepfake datasets annotated with five categories, along with two types of text descriptions, enabling effective utilization of a broad range of resources for training. By releasing MMI-DD, we provide the community with large-scale, multi-modal resource, fostering broader exploration and study in deepfake detection; (ii) we propose SD², novel visual-language learning framework that not only captures rich semantic attributes through textual information but also demonstrates unprecedented scalability, consistently improving with data volume, unlike prior methods that saturate or degrade; and (iii) we demonstrate that our approach outperforms existing SOTA baselines on both real-world deepfake benchmarks and AIGC detection benchmark.
RELATED WORK
2.1
CONVENTIONAL DEEPFAKE DETECTION
With the advent of deep learning, CNN-based models (He et al., 2016; Chollet, 2017; Tan & Le, 2019) and Transformer-bant architectures (Vaswani et al., 2017) have dominated the field of face forensics detection, leveraging large-scale datasets enhance classification performance. Many approaches improve generalization to unseen benchmark datasets through architectural innova- tions (Rossler al., 2019; Zhao al., 2021; Zheng et al., 2021) and augmentation strategies (Sh- iohara & Yamasaki, 2022; Dat et al., 2024). However, most studies (Zhao et al., 2021; Wang et al., 2023b; Zheng et al., 2021; Shiohara & Yamasaki, 2022; Ni al., 2022; Cao et al., 2022: Dong al., 2023; Dat et al., 2024) adhere to a conventional paradigm, training on a single dataset and validating on others. While methodologically advanced, this approach limits the diversity of knowledge mod- els can acquire and their practical utility due to constrained training data. To address this challenge, several works have expanded training data volume (Lai al., 2024; Amin et al., 2023) by integrating multiple benchmark datasets, yet these efforts remain limited by the scope and modality of available deepfake datasets.
2.2 DEEPFAKE DETECTION VIA MULTI-MODAL MODELS
The rapid progress of Vision-Language Models (VLMs) has demonstrated impressive visual under- standing and natural language interaction capabilities. Particularly, CLIP (Radford et al., 2021) has emerged as a promising foundation model for deepfake detection (Ojha et al., 2023), which lever- ages its frozen image embeddings for classification. Subsequent studies (Baraldi et al., 2024; Koutlis & Papadopoulos, 2024; Yan et al., 2025a; Cui al., 2024) also utilize the frozen CLIP encoder, fo- cusing on extracting fine-grained forgery cues suitable for deepfake detection tasks. Recent research has expanded the use of CLIP to improve generalization by incorporating not only its visual part but also its textual part (Wu et al., 2023; Khan & Dang, 2024). Further extending beyond simple text labels, natural language is incorporated to provide detailed supervision for CLIP fine-tuning (Sun et al., 2023), and class-awan deepfake classification objectives introduced through prompt de- sign (Wang et al., 2024b). Despite these advancements, most studies still adhere to the traditional single-dataset training paradigm, failing to fully exploit the scalability of pre-trained models from a data-centric perspective. In this work, we propose a methodology that integrates heterogeneous training datasets, harnessing the capacity of CLIP for generalizable deepfake detection.
LARGE-SCALE DEEPFAKE DETECTION DATASET
3.1 DATASET COLLECTION
We collect and preprocess diverse deepfake benchmark datasets to facilitate joint training across multiple datasets, which are summarized in Tab. 1. The recently introduced DF40 (Yan et al., 2024), which is known for its extensive data diversity, has primarily been used for evaluation. In contrast, we are the first to leverage the entire training set from DF40 for model training, integrating them with six additional popular deepfake datasets: DFF (Song et al., 2023), DFFD (Dang et al., 2019),
3

---

Published as a conference paper at ICLR 2026
Table 1: Summary of our integrated dataset, MMI-DD, including the numbers of real and fake images and their type annotations.
3.6M Multi-modal Dataset
Dataset: Collaborative- Colfabortive-Dfflaiio Diffussinn
Source:
CelebA
Datavel
Forgery Types
Real Images
Images
Total
Type:
(REAL
F6
IFS
Ft
DF40
EFS, FE
77,200
1,613,000
1.69,2000
Face: waman fair skie, way blonde Rat,
DFF
EFS
24,200
57,500
81,700
DFFD
FE
20,000
136,000
156,000
Environment: bonnd biithhhgee Bockgeound with
DFDCP
FS
11,700
38,800
50,500
KoDF
FS
11,500
28,200
39,700
VLM- Generatedd
FF++ (c40)
FS,
32,000
160,000
192,000
(LMITLQQ)
FS
10,240
10,240
VLM Prompts
TIMIT (HQ)
FS
10,240
10,240
CelebA
202.600
202,600
01. Descriée the face including ege, gonder, expression, Deserize the onvirement techulieg background, ..
Celcha-HQ
30,000
30,000
CelebV-HQ
1,05,1000
1,051,100
FFHQ
70,000
70,000
Figure 2: Illustration of detailed anno-
Overall
1,530,300
3,05
3,584,250
tations in the integrated dataset.
DFDCP (Dolhansky et al., 2020), KoDF (Kwon et al., 2021), FF++ (c40) (Rossler et al., 2019), and TIMIT (Korshunov& & Marcel, 2018) (including high-quality (HQ) and low-quality (IQQ) variants). To balance the ratio of real and fake images, we further incorporate four additional real datasets: CelebA (Liu et al., 2015), CelebA-HQ (Karras et al., 2017), CelebV-HQ (Zhu et al., 2022), and FFHQ (Karras et al., 2019). This results in a large-scale facial image dataset comprising a total of 3.6 million images. All deepfake datasets are preprocessed in a consistent manner by cropping face regions. To address potential challenges in large-scale dataset integration (e.g., preprocessing incon- sistencies, identity overlap, and data leakage), we implement rigorous data partitioning protocols. Detailed descriptions of the datasets, along with our protocols for data cleaning and partitioning, are thoroughly documented in Sec. A of the Appendix.
Categorical Annotation with Text Augmentation. Our six researchers independently and man- ually categorize images from the datasets, and cross-check another. Following prior works (Yan et al., 2024; Mirsky & Lee, 2021), each image is labeled as either REAL or one of four deep- fake types: Face Swapping (FS), Face Reenactment (FR), Entire Face Synthesis (EFS), and Face Editing (FE). For each type, we construct a set of text labels. During training, text labels cor- responding to each image type serve as anchors for fine-grained deepfake classification based on image-text similarity. Unlike previous works (Khan & Dang, 2024; Wu et al., 2023) that use simple text labels such as "a photo of a [real/fake] image". we augment text la- bels from simple label to about 30 comprehensive labels using GPT-ol (OpenAI, 2024) and human feedback. For example, for the Face Swapping, we generate a range of diverse labels, including the simple label "a photo of Face Swapping" as well as more detailed la- bels such as "a deepfake-craffe with another's s". This augmentation encourages the model to develop deeper semantic un- derstanding of each type and can enhance its ability to distinguish different types of deepfakes. Please visit Sec. E of the Appendix for more details of text annotations and their augmentation.
photo replacing one individual's s face
3.2 DATASET ANNOTATION
Contextual Text Generation. While traditional categorical labels suffice for training a deepfake classifier, portrait images contain not only forensic cues, but also unrelated details such as demo- graphic traits or background contexts. Recent work by (Wang et al., 2025) empirically and theo- retically demonstrates that when spurious features such as background or lighting strongly correlate with the training data's 's text descriptions, CLIP's contrastive objective aligns image embeddings with these features. Consequently, when repurposed for deepfake detection, this leads the model to focus more such spurious correlations rather than forensic signals, resulting in a less robust detector. To address this vulnerability, we propose generating comprehensive text descriptions for all images to disentangle forensic cues from contextual elements, enhancing the model's understanding be- yond binary classification. Our ablation studies (Sec. 5.3) further show that including contextual descriptions improves performance unseen datasets. To generate these auxiliary descriptions,
4

---

Published as a conference paper at ICLR 2026
Text Label
Text Label Separation Loss
Uc
Text Encoder
REAL
BPS
LoRA
Text Description
1
Wei
FR
Ls
Fuoe
Classification Loss
Dual Contractive Loes
Image
Image Encoder
Firual
A Adapter
LoRA
CLAM
f
AVG
Lc
LD
Figure 3: Overview of SD² training framework. SD² employs CLIP text and image encoders, both fin-tuned with LoRA. The Cross-Layer Attention Module (CLAM) enhances visual features by fusing -oigh--iiel information. The model is optimized with three objectives: Classifica- tion Loss (Lc) to distinguish real and four fake types, Text Label Separation Loss (Ls) to enforce separation among types, and Dual Contrastive Loss (Lp) align image-text pairs.
we leverage Intern VL (Chen al., 2024) in a Visual Question Answering setting. Specifically, we use two distinct prompts to obtain different aspects of the images: (1) facial that captures facial attributes and (2) environmental that describes background context. To validate the quality of the VI.M-generaeed descriptions, manually audit randomly sampled images from each dataset and confirm that the descriptions align with the visual content. Furthermore, recent research (Lu & Zhong, 2024) demonstrates that SOTA VLMs exhibit high degree of perceptual alignment with human observations, particularly in describing human portrait images. This establishes our use of VLM-driven annotation as reliable and scalable alternative manual efforts for large-scale dataset construction. Examples of our annotated data are presented in Fig. 7, and further details are provided in Sec. F, both included in the Appendix.
Our dataset annotation procedure, combining human and VL.--geerated annotations, illustrated in Fig. 2. To the best of knowledge, MMI-DD is among the largest and most diverse collections available for training deepfake detection models. It enables the construction of a comprehensive knowledge space and a more diverse foundation for face forensics, in contrast conventional ap- proaches that train models on a single dataset.
SD²: VISUAL- LEARNING FOR DEEPFAKE DETECTION
We propose novel multi-modal learning framework for deepfake detection based CLIP (Radford et al., 2021), which integrates image and text modalities. Figure 3 illustrates our overall proposed training framework. We define data format S {EIn Cn. d', d J >= where x e is an image in a batch B and E C = {REAL, FS, FR, EFS,FE) is the type of the image. Here, df and d' represent text descriptions the facial and environment attributes of æ, respectively. ε, and &r are the CLIP image and text encoders.
4.1 ENHANCED CLIP VISION EMBEDDINGS
Cross-Layer Attention Module. Although previous studies leverage the final layer's output from the CLIP vision encoder for image representation, our investigation (Sec. 5.3) reveals that relying solely on the final representation is suboptimal. It struggles to capture low-level artifacts critical to distinguish fake images (Koutlis Papadopoulos, 2024; Yan et al., 2025a). To address this, introduce the Cross-Layer Attention Module (CLAM), which offers two significant advantages for visual representation: (i) it fuses multi-level features from all encoder layers, capturing both high-level semantics and low-level artifacts to construct richer visual representation than using
5

---

Published as a conference paper at ICLR 2026
the final layer alone; and (ii) it adopts self-attention mechanism that dynamically highlights the most relevant lower-level features and guides them to achieve the objective earlier, benefiting the detector's 's generalization (Zhang al., 2022). Specifically, we first extract the [CLS] ] token from each the transformer layers within the CLIP image encoder ε,, denoted as fal E RD for layer I (1...., L). This collection of tokens, fas [ f (ele ) RRLDD forms a sequence of hierarchical features. We then employ a multihead self-attention mechanism (Vaswani et al., 2017) over these features to capture the inter-dependencies across all transformer encoder blocks:
San
Attn(fa.W . ("s,
fsat = Concat ( (1 I Wo.
(1)
K w and Wo are learnable projection matrices, and H is the number of atten- tion heads. The resulting feature sequence fsat is first aggregated into single vector, f via global average pooling. This single vector f'u is then concatenated with the model's final representation, fimal, to leverage both low-level and high-level information. The combined vector is further refindd using a lightweight adapter, composed of two linear layers with a GELU activation (Hendrycks & Gimpel, 2016), to produce the final visual representation f as follows:
where W (((h) (N) Q
f= 22 GELU(W; Concat ([S'ar ffmal) )
(2)
where Wi and W2 are learnable weights.
4.2 FINE-GRAINED DEEPFAKE CLASSTFICATION
Image- mext Classification Loss. During the training phase, we randomly sample the set of the text labels T (RREAL lrs, frR, lers; (yg} for each type once per batch. After extracting the text embedding the. = (tc,,) from text label fo.. we compute the cosine similarity between the image and the text embeddings. The similarity score serves as a logit and is passed to the cross-entropy loss as follows:
[8
exp (T sim(fi, uo,))
Lc = log
(3)
[C| == exp (r -immmm Mey)
1=1
where sim(a,
0.b" ] and T is learnable logit scaling parameter initialized following CLIP (Radford et al., 2021).
Text Label Separation Loss. While humans can distinguish our manually curated text labels, they may not be sufficiently separated in the CLIP embedding space. We observe that the cosine similarities among different text label embeddings remain high, which can hinder classification. To address this, we introduce separation loss that enforces greater distinctiveness among text label embeddings, thereby improving classification. We compute the cosine similarity between each pair of text label embeddings and enforce the similarity matrix to be closer to the identity matrix. This separation loss is formulated as:
Ls sim - II
(4)
where I is the identity matrix and || || the Frobenius norm.
4.3 DUAL IMAGE-TEN CONTRASTIVE LEARNING
Multi-Aspect Semantic Alignment. We employ a dual contrastive loss to align each image with both its corresponding facial and environmental descriptions. For each image, we construct two distinct positive pairs: one with its facial description and the other with its environmental description. All other text descriptions within the batch serve negatives for both alignment objectives. This dual supervision provides two key advantages: (i) it encourages the model to jointly attend to both detailed facial attributes and broader contextual elements within the scene; and (ii) it encourages disentanglement between forensic signals and non con-forensic contextual elements, helping the model avoid spurious forgery cues.

---

Published as a conference paper at ICLR 2026
Efficient Contrastive Learning with SigLIP Loss. For our image-text alignment, adopt the SigLIP loss (Zhai et al., 2023) to avoid the substantial computational cost conventional softmax- based losses (e.g., InfoNCE), which demand massive batch sizes (32K in CLIP (Radford et al., 2021)). SigLIP utilizes a sigmoid-based binary cross-entropy loss and efficiently gathers negative samples by swapping text embeddings across GPUs, enabling strong performance without relying on large-scale batches. Given a text description dř, where K E {f, e). we extract the corresponding text embedding of Ed")). The SigLIP loss between image and text embeddings is given by:
(oy(T-sim(far) LD ΣΣ log 2ig(T sim(fi, + +b) log a 2iy(T sim(fi of) + +b)] (5)
where fi denotes the image embedding for the i-th sample in the local mini-batch B, while of and ug denote text embeddings Ban, the global batch formed by gathering text embeddings from all GPUs. Specifically, v/ and of are derived from df and d', respectively. The similarity between image and text embeddings is scaled by reusing the logit scaling parameter 7 from the classification loss, along with bias term initialized -T. The binary indicator Zij {-1,+1} specifies whether the image-text pair (fi, 0y) is positive negative, thereby determining the direction of the logit. The final logit is then passed through sigmoid function (--) to compute the contrastive loss.
4.4 OVERALL OBJECTIVE FUNCTION
The overall loss combines the classification and regularization terms, promoting both accurate clas- sification and meaningful image-text alignment. The loss is defined as:
Lgp² = a Le + Ls LD=
where a is a hyperparameter controlling the contribution of the classification loss term. We present the pseudo-code for the SD2 implementation in Alg. 1 of the Appendix.
EXPERIMENTS
5.1 EXPERIMENTAL SETTINGS
Training Details. For training our large-scale multi-modal dataset, we adopt CLIP-ViT-L/I4 (II- harco et al., 2021) the backbone for visual- languuge training. The model is optimized using AdamW (Loshchilov & Hutter, 2017) at a learning rate of 5e-7 and a batch size of 1,024 through gradient accumulation over 4 epochs. To efficiently fine-tune the model, apply Low-Rank Adap- tation (LoRA) (Hu et al., 2022) to both the image and text encoders, with hyperparameters set as follows: Tlora 8, Olorra 32, and Pdropout 0.1. We employ data augmentation techniques from CLIP training for deepfake detection (Yan et al., 2024), including random rotation, isotropic resizing, brightness and contrast adjustments, and compression. The overall objective function uses hyperparameter
2.0. Our method is implemented in PyTorch (Paszke et al., 2019) on 8 NVIDIA GeForce RTX 3090 GPUs.
Testing Details. During testing, we use the most straightforward text label from the predefined text label set for each of the five types (e.g., Face Swapping: "a photo of Face Swapping "). The image feature is then matched with the most similar text feature based on cosine similarity to
compute the classification logits. The final classification is based on the logits corresponding each label. If the logit for real is the highest, the image is classified as real. Otherwise, it is classified as fake.
5.2 EXPERIMENTAL RESULTS
5.2.1 FACIAL DEEPFAKE DETECTION
Evaluation Protocols. We adopt six baseline models: (1) Xception (Chollet, 2017), a CNN detect- ing subtle distortions with separable convolutions, (2) RECCE (Cao et al., 2022), spatial-domain

---

Published as a conference paper at ICLR 2026
method tracing forgery via reconstruction, (3) SPSL (Liu et al., 2021a), frequency-domann ap- proach finding artifacts with phase- baase-based learning, (4) CLIP (Radford et al., 2021), a vision foun- dation model, fully fine-tuned with linear head for classification, (5) CLIP-LoRA (Radford et al., 2021; Hu et al., 2022), a CLIP adaptation with our LoRA settings, and (6) CLIP-SVD (Effort) ( (Yan et al., 2025b), SOTA method that adapts CLIP via Singular Value Decomposition (SVD) to pre- serve pre-trained knowledge while learning forgery-specific features.
We conduct two evaluations assess facial deepfake detection performance. (i) Intra-domain evaluation: To ensure the fairness, all baselines are trained on our integrated dataset, MMI-DD, and then evaluated across seven datasets, including DF40 (Yan al., 2024), DFF (Song et al., 2023), DFFD (Dang et al., 2019), DFDCP (Dolhansky et al., 2020), KoDF (Kwon et al., 2021), FF++ (c40) (Rossler et al., 2019), and TIMIT (Korshunov & Marcel, 2018). Specifically, we divide DF40 into six subsets: FF. CDF, FS, FR, EFS, and FE. Both FF and CDF (32 fake types each) are derived from FaceForensics** (Rossler et al., 2019) and Celeb-DF (Li et al., 2020) domain, respectively. FS. FR, EFS, and FE are organized based on manipulation types, irrespective of source domains. FS, FR, EFS, and FE subsets include 9, 12, 10, and I manipulation types, respectively. This evaluation assesses model effectiveness within the training domain and measures how well each method leverages large-scale training data. (ii) Cross-domain evaluation: We use the same trained models and test them challenging real-world benchmarks, including WildDeepPake (Zi et al., 2020), UADFV (Li et al., 2018), DFDC (Dolhansky et al., 2020), and DF40-Test subset from the DF40 (Yan al., 2024). Among these DF40-Test subsets. FS and FR include fake data from single manipulation type. while EFS and FE contain 2 and types of fake data, respectively. A detailed description of DF40-Test is provided in Sec. A.2 of the Appendix. This experiment measures the generalization ability of each method to unseen distributions.
Table 2:
detection performance (AUC). The best results are highlighted in bold.
Methods
Detector Type
DF40
DRED
KoDF
FF++ (o40)
mAUC
Xoeption
Naive
97.15
93.
91.87
95.66
96.29
91.25
96.73
99.45
95.53
78.63
94.02
Spatial
90.81
94.93
SPSL.
Frequency
97.59
93.98
93.45
95.62
97.26
99.63
92.50
95.70
98.71
95.59
80.40
94.5%
CLIP
CLIPPhassd
61.72
57.28
55.61
67.58
54.55 $4.50
65.39
32
73.55
79.61
59.05
52.84
62.68
CLIP-LRRA CLIP-SV (Bitoa)
CLiP-bised
88.54
87.53
84.30
86.50
92.57
95.53
84.33
97.
90.95
84
72.52
810 (ours)
CLIP-hosed
97,52
96.66
97.61
94.23
98.94
99.73
98.02
99.88
99.66
97.08
74.09
95.76
Table 3: Cross-domain detection performance (AUC).
DF40- Test
Methods
Detoctor Type
UADEV
WildDeepFake
DFDC
mAUC
FS
FR
EFS
FE
Xception
Naive
69.40
70.43
60.46
96.76
92.97
44.63
76.04
72.67
RECCE
Spatial
58.78
64.62
60.04
94.34
90.59
47.27
80.22
70.84
SPSL
Frequency
60.37
69.61
60.11
95.92
95.51
64.55
83.71
75.68
CLII
CLII--hase
54.98
58.08
55.77
96.39
87.96
59.44
76.22
69,83
CLIP-LoRA
CLIP-baser
66.55
69.41
69.44
92.74
84.33
40.75
81.62
72.
CLIP-SVD (Effort
CLIP-based
95.47
75.89
69.57
97.07
78.88
60.60
96.41
81.98
SD (ours)
CL.P--hsed
96.44
82.80
80.36
99.29
84.49
74.06
97.13
87.79
Experimental results reveal two key strengths of our approach. As shown in Tab. 2, SD² achieves superior overall intra-domain detection, with an mAUC of 95.76%, outperforming all basclines in the majority of the 11 subsets. Additionally, Tab. 3 highlights robust cross coos--dominn generalization, with an mAUC of 87.79%, surpassing baselines on challenging unseen datasets. These results confirm SD²ss capacity to generalize without overfitting, excelling in both settings.
Results.
5.2.2 GENERAL SYNTHETIC IMAGE DETECTION
Although our model is primarily trained on facial image-text pairs, we explore its ability to detect synthetic content beyond facial manipulations.
8

---

Published as a conference paper at ICLR 2026
Evaluation Protocols. We utilize only the vision encoder of our model and perform linear probing for binary classification. All other components are frozen, and only the linear layer is trained. This setup follows the same approach UnivFD (Ojha et al., 2023), which uses linear probing with frozen CLIP for synthetic image detection. To ensure a fair comparison, our model and all baselines follow the same protocol (Zhu al., 2023b), fine-tuning on SID v1.4 fake images and ImageNet real images. Generalization performance is then evaluated on test sets containing 8 generative models. We measure performance using accuracy (ACC), consistent with (Yan al., 2025a; Zhu et al., 2023a), with classification threshold of 0.5 for fair comparison.
Table 4: Cross-model evaluation performance (ACC) the Genlmage dataset. While the results are directly sourced from (Yan et al., 2025a), we additionally implement CLIP-SVD, a.k.a. Effort, from (Yan al., 2025b) following its official code.
Methods
Midjourney
ADM
GLIDE
Wukong
VQDM
BigGAN
ResNei-50 (Ile al, 2016)
53.50
DeiT-S (Touvron el 2021)
55.60
99.90
99.80
49.80
58.10
98.90
56.90
53.50
71.56
Swin-T
2021b)
49.80
74.78
CNNSpoc (Wang at,,l,22000
52.80
96.30
95. 90
50.
39 80
78.60
53.40
46.80
64.21
Spec (Zhung et al., 2019)
2019)
52.00
99.40
99.20
49.70
49,80
94,80
55.60
49.80
68.79
F3Nei (Qian 2020)
50.10
99.90
99.90
49.90
50.00
99.90
49.90
49.90
63.69
GramNet (1.iu et al., 2020)
54.20
99.20
99.
50,30
54.60
98.90
50,80
$1.70
69.85
DIRE (Wang al., 2023a)
60.20
99.90
99 89.80
50.90
55,00
99.20
50.10
50.20
70.66
UnivFD (Ojia al., 2023)
73.20
84,20
84,00
55,20
76.90
75.60
56.90
80.30
73.29
GenDet (Zha al., 2023s)
96.10
96.
58.00
92.80
66.50
75.00
81.56
PatchCraft (Zhong es al., 2023)
79.00
89.50
89.30
77.30
78.40
89.30
83,70
72.40
82,
AIDE
99.74
99.76
CLIP-SVD (Eiffort) (Yan et al., 20256)
71.70
99.90
99.71
63.35
66.64
99.20
86.19
52.84
79.94
SD (ours)
85.76
98.45
98.23
68.25
88.59
98.27
91.15
79.34
88.50
Results. Results on the Genlmage dataset are presented in Tab. 4. Our method achieves mACC of 88.50% across 8 test sets. Compared to other CLIP-based baselines UnivFD and CLIP-SVD (Effort), our approach surpasses them by 15.21% and 8.56%, respectively. Furthermore, when compared to the SOTA method AIDE, our method outperforms AIDE by 1.62%. This highlights the superior generalization capabilities of SD2 for synthetic image detection.
5.3 ABLATION STUDY
Classification Loss. The classification loss, comprising image-text classification and text label sep- aration objectives (Sec. 4.2), is critical for training convergence. Without enforcing orthogonality among the text label embeddings, training fails to stabilize. Thus, we jointly term these as clas- sification loss here. As shown in the first row of Tab. 5, applying our classification loss yields 80.24% AUC, significantly enhancing performance. Comparisons to cross-domain evaluation re- sults in Tab. our method outperforms baselines such Xception, RECCE, and SPSL. Notably, it also improves performance over CLIP and CLIP-LoRA, even though they share the same CLIP- ViT-L/14 backbone. This result suggests that pre-trained backbones require tailored objectives for deepfake detection.
Leveraging Intermediate Features. We further assess the impact of incorporating intermediate fea- tures from the CLIP image encoder through our CLAM (Sec. 4.1). The second row of Tab. 5 shows a 1.6% AUC increase, emphasizing the benefit of leveraging multi-level features. Additionally, we provide qualitative comparison regarding the presence of CLAM in Appendix Sec. C.
Contrastive Loss. Our dual image-text contrastive loss with Ven--geneateed descriptions (Sec. 4.3), significantly boosts detection performance. As detailed in Tab. 5 (rows 3-4), jointly leveraging two contrastive losses: Cp-Face using facial descriptions and -D-Env using environmental descriptions achieves the highest performance gain of 5.95%. While individual semantic cues are beneficial, their joint application proves optimal for robust generalization.
Combining All Components. Combining all components yields the highest AUC of 87.79%, as shown in the final row of Tab. 5. Each component contributes incrementally, with their synergy maximizing performance. Thus, adopt this configuration as final model.

---

Published as a conference paper at ICLR 2026
Table 5: Ablation studies analyzing the impact of key components. All models are trained on our integrated dataset and tested on four cross- domain datasets in Sec. 5.2.1.
Table Performance (mAUC) across training data scales, from 100K to 3M (full dataset).
Scale of Training Data
Methods
100K
JM
3M
Le CLAM
Li-Face
Li-Env
mAUC
Xception
71.11
71.69
72.96
REČCE
69.71
69.28
70.84
80.24
SPSL
71.56
73.84
75.68
CLIP
69.82
69.74
69.83
81.84
CLIP-LORA
78.84
78.40
72.12
/
V
84.34
CLIP-SVD (Effort)
82.27
82.00
81.98
/
V
87.79
SD2 (ours)
82.90
84.85
87.79
Scale of Training Dataset. We train our proposed SD² and baselines with 100K, 1M, and 3M im- ages from our integrated dataset, assessing cross-domain performances as in Sec. 5.2.1 with mAUC reported in Tab. 6. Our findings reveal that dataset scale alone does not guarantee performance gains. Conventional methods such as Xception, RECCE, and SPSL. exhibit early saturation. Simi- larly, strong vision foundation models like CLIP, CLIP-LoRA, and CLIP-SVD (Effort) also struggle to scale, with performance plateauing even degrading as data increases. In contrast, SD² not only outperforms all baselines but also continues to improve with more data. This suggests our multi- modal strategy is key to leveraging large-scale datasets, addressing a limitation of prior approaches.
Hyperparameter Sensitivity. We conduct additional experi- ments on hyperparameters assess the robustness of SD² All experiments in this section are trained on a IM-sized subset of the MMI-DD dataset, with performance measured by cross-domain mAUC, following the protocol described in Sec. 5.2.1. We first analyze the effect of the weighting fac- a introduced in Eq. 6. As shown in Tab. 7, SD2 achieves consistently strong performance across different a values, in- dicating low sensitivity this factor. We further evaluate the impact of the LoRA rank by varying
Table 7: Hyperparameter sensitivity on cross-domain mAUC.
Hyperparameter
mAUC
a = 1.5
83.45
2.0
84.85
2.5
83.02
{4. 8, 16) while keeping the other LoRA hyperparameters fixed (ohor 32, Pamppuut lora 0.1). The results demonstrate stable perfor- mance across rank variations, supporting the architectural ro- bustness of the proposed framework. Based on these results, we adopt the best- pereoorefrmmiggggg configuration in the final model.
4
82.97
Nea 8
84.85
Pla
84.37
CONCLUSION
In many cases, existing deepfake detectors remain tied single-dataset training, limiting their abil- ity to leverage diverse available data resources and build comprehensive knowledge. Additionally, as training data scales up, they struggle to consolidate heterogeneous distributions, leading to a per- formance drop. To address these challenges, we unify 3.6M facial images from 11 datasets, namely MMI-DD, enriched with fine-grained type annotation and "L.--generated descriptions. Building on this, we propose SD2 scalable rision-language framework for deepfake detection. SD² enhances CLIP with the Cross-Layer Attention Module (CLAM) to capture multi-leva visual features, and is optimized with three complementary objectives: type-aware classification, type embedding separa- tion, and semantic alignment. Extensive experiments show that SD² achieves SOTA performance across facial and non-facia domains, while exhibiting strong scalability as data volume increases.
ACKNOWLEDGEMENT
This work was partly supported by Institute for Information & communication Technology Planning & evaluation (ITTP) grants funded by the Korean government MSIT: (RS- RCS-2022-I1220688, RS-2019- 11190421). Also, this work was supported by the Cyber Investigation Support Technology Devel- opment Program Ww..R-2225-02304990 of the Korea Institute of Police Technology (KIPoT))
10

---

Published as a conference paper at ICLR 2026
funded by the Korean National Police Agency. Lastly, this work supported by the National Research Foundation of Korea (NRF) grant funded by the Korea government (MSIT) (No. RS- 2024-00356293).
REFERENCES
Muhammad Ahmad Amin, Yongjian Hu, Huimin She, Jicheng Li, Yu Guan, and Muhammad Zain Amin. Exposing deepfake frames through spectral analysis of color channels in frequency do- main. In 2023 1 11th International Workshop on Biometrics and Forensics (IWBF), pp. 1-6. IEEE, 2023.
Lorenzo Baraldi, Federico Cocchi, Marcella Cornia, Lorenzo Baraldi, Alessandro Nicolosi, and Rita Cucchiara. Contrasting deepfakes diffusion via contrastive learning and global-local similarities. In European Conference on Computer Vision, pp. 199-216. Springer, 2024.
Junyi Cao, Chao Ma, Taiping Yao, Shen Chen, Shouhong Ding, and Xiaokang Yang. End-to-end ieconstructoon-caasifiiae learning for face forgery detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 4113 4122, 2022.
Zhe Chen, Jiannan Wu, Wenhai Wang, Weijie Su, Guo Chen, Sen Xing, Muyan Zhong, Qinglong Zhang, Xizhou Zhu, Lewei Lu, et al. Internvl: Scaling up vision foundation models and aligning for generic disual-linguiste tasks. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 181888 2024.
Beomsang Cho, Binh M Le, Jiwon Kim, Simon Woo, Shahroz Tariq, Alsharif Abuadbba, and Kris- ten Moore. Towards understanding of deepfake videos the wild. In Proceedings of the 32nd ACM International Conference Information and Knowledge Management, pp. 4530-4537, 2023.
Yunjey Choi. Minje Choi, Munyoung Kim, Jung-Woo Ha. Sunghun Kim, and Jacgul Choo. Star- gan: Unified generative adversarial networks for multi-domain image-to-image translation. In Proceedings of the IEEE conference computer vision and pattern recognition, pp. 9789-8797, 2018.
Yunjey Choi, Youngjung Uh, Jaejun Yoo, and Jung- Woo Ha. Stargan v2: Diverse image synthesis for multiple domains. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 8188-8197, 2020.
François Chollet. Xception: Deep learning with depthwise separable convolutions. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 1251-1258, 2017.
Xinjie Cui, Yuezun Li, Ao Luo, Jiaran Zhou, and Junyu Dong. Forensics adapter: Adapting clip for generalizable face forgery detection. arXiv preprint axX1v:2411.19715, 2024.
Hao Dang, Feng Liu, Joel Stehouwer, Xiaoming Liu, and Anil K Jain. On the detection of digital face manipulation. arXiv preprint arXiv:1910.01711 2019. URL attpp:://axxv..
abs/1910. 01717.
Nguyen Dat, Mejri Nesryne, Pal Singh Inder, Kuleshova Polina, Astrid Marcella, Kacem Anis, Ghorbel Enjie, and Aouada Djamila. Laa-net: Localized artifact attention network for quality- agnostic and generalizable deepfake detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 17395-17405, 2024.
DeepFaceLab. Deepfacelab. https:
2023. Ac-
cessed: 2023-01-01.
Github Community DeepFakes. Deepfakes. faceswap, 2017. Accessed: 2021-01-01.
https://ggthbb.ccm/bpppptt
Jiankang Deng, Jia Guo, Yuxiang Zhou, Jinke Yu, Irene Kotsia, and Stefanos Zafeiriou. Retinaface: Single-stage dense face localisation in the wild. arXiv preprint 1r05v:/905.006 2019.
11

---

settored-iideo-eelosil.. Published as a conference paper at ICLR 2026
Brian Dolhansky, Joanna Bitton, Ben Pflaum, Jikuo Lu, Russ Howes, Menglin Wang, and Cristian Canton Ferrer.
The deepfake detection challenge (dfde) dataset. arXiv preprint
2oXY::2006.07397, 2020.
Shichao Dong. Jin Wang. Renhe Jiajun Liang. Haoqiang Fan, and Zheng Ge. Implicit identity The stumbling block to improving deepfake detection generalization. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 3994-4004, 2023.
leakage:
O' Sullivan Donie. Doctored videos shared to make pelosi sound drunk viewed millions of times social media. /etps://editt html, 2019. Accessed: 2023-05-31.
enn. cwm/c01 9/05/205/3 /ttp///ppcc/////////o//ll
Nick Dufour and Andrew Gully,
Contributing data to deepfake de- http:///oooo..ea.....oooooooo//a /attogg/lleee///00000
tection research.
2019.
Accessed: 2023-
01-01.
Github Community FaceSwap. Faceswap.
attps://gg.hhub..omm/aaakttooo
FaceSwap, 2016. Accessed: 2021-01-01.
Federal Bureau of Investigation (FBI). Deepfakes and stolen pii utilized to apply for remote work
positions. https: www. ic3. http//Meeaaaaa22222////// W1/2222/PS2222 pwwp///a22222222 628, 2022, Accessed: 2022- 07-01.
Zhihao Gu, Yang Chen, Taiping Yao, Shouhong Ding, Jilin Li, Feiyue Huang, and Lizhuang Ma. Spatiotemporal inconsistency learning for deepfake video detection. In Proceedings of the 29th ACM international conference multimedia, pp. 3173-344111 2021.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp- 770-778, 2016.
Dan Hendrycks and Kevin Gimpel. 1rXiv:160..0844 2016. URL https:://axxi..rr/pt//p/s www.xii..rggabs////e wtt.:/r//./bbb.b.o///e//. 08415.
Gaussian error linear units (gelus). arXiv preprint 08411
HeyGen., 2020. https: /www www.wheegenccom com.
Edward J. Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. Lora: Low-rank adaptation of large language models. In International Confer- ence on Learning Representations, 2022. URL https: http::://peereeeeeeee http//ppeeeeieeeeeeeee net wtt.:/wwwwwttwtwme///e/e ffr.mmirummi nžeVKeeFYf9.
Ziqi Huang, Kelvin CK Chan, Yuming Jiang, and Ziwei Liu. Collaborative diffusion for multi- modal face generation and editing. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp. 6080-6090, 2023.
Gabriel Ilharco, Mitchell Wortsman, Nicholas Carlini, Rohan Taori, Achal Dave, Vaishaal Shankar, Hongseok Namkoong, John Miller, Hannaneh Hajishirzi, Ali Farhadi, and Ludwig Schmidt. Openclip, July 2021. URL /estps://dol org/10. 10. 5281/zenodo. 5143773.
Tero Karras, Timo Aila, Samuli Laine, and Jaakko Lehtinen. Progressive growing of gans for im- proved quality, stability, and variation. arXiv preprint arXiv:1710.101990 2017.
Tero Karras, Samuli Laine, and Timo Aila. A style-based generator architecture for generative adversarial networks. In Proceedings the recognition, pp. 4401-4410, 2019.
the IEEE/CVF conference on computer vision and pattern
Sohail Ahmed Khan and Nguyen Duc-Tiee Dang. Clipping the deception: Adapting vision- langugge models for universal deepfake detection. In Proceedings of the 2024 International Conference on Multimedia Retrieval, pp. 1005-1015, 2024.
Davis E King. Dlib-ml: A machine learning toolkit. The Journal of Machine Learning Research, 10: 10:1755-1758. 2009.
12

---

Published as a conference paper at ICLR 2026
Pavel Korshunov and Sébastien Marcel. Deepfakes: new threat to face recognition? assessment and detection. arXiv preprint arXiv: arXiv:1812.08685, 2018.
Christos Koutlis and Symeon Papadopoulos. Leveraging representations from intermediate encoder- blocks for synthetic image detection. In European Conference on Computer Vision, pp. 394 411. Springer, 2024.
Patrick Kwon, Jaeseong You, Gyubyeon Nam, Sungwoo Park, and Gyeongsu Chae. Kodf: A large- scale korean deepfake detection dataset. In Proceedings of the IEEF/CVF international confer- ence on computer vision, pp. 10744-10753, 2021.
Yingxin Lai, Zitong Yu, Jing Yang, Bin Li, Xiangui Kang, and Linlin Shen. Gm-df: Generalized multi-scenario deepfake detection. arXiv preprint 200,:2840.20077,, 2024.
Binh M. Le and Simon Woo. Quality-agnostic deepfake detection with intra-model collaborative learning. In Proceedings of the IEFF/CVF International Conference on Computer Vision (ICCV), 2023.
Binh M Le and Simon S Woo. Add: Frequency attention and multi-view based knowledge distilla- tion to detect low-quality compressed deepfake images. In Proceedings of the Thirty-Sixth AAAI Conference on Artificial Intelligence, pp. 122-130, 2022.
Changjiang Li. Li Wang, Shouling Ji, Xuhong Zhang, Zhaohan Xi, Shanqing Guo, and Ting Wang. Seeing is living? rethinking the security of facial liveness verification in the deepfake era. In 31st USENIX Security Symposium (USENIX Security 22). pp. 2673-2690, 2022.
Lingzhi Li, Jianmin Bao, Hao Yang, Dong Chen, and Fang Wen. Faceshifter: Towards high fidelity and occlusion aware face swapping. arXiv preprint arXiv:1912.14557, 2019.
Yuezun Li, Ming-Ching Chang, and Siwei Lyu. In ictu oculi: Exposing ai created fake videos by detecting eye blinking. In 2018 IEEE International workshop on information forensics and security (WIFS), pp. 1-7. Ieee, 2018.
Yuezun Li, Xin Yang, Pu Sun, Honggang Qi, and Siwei Lyu. Celeb-df: large-scale challenging dataset for deepfake forensics. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 3207-3216, 2020.
Mingqian Lin, Lin Shang, and Xiaoying Gao. Enhancing interpretability in ai-generated image detection with genetic programming. 2023 IEEE International Conference on Data Mining Workshops (ICDMW), pp. 371-378. IEEE, 2023.
Honggu Liu, Xiaodan Li, Wenbo Zhou, Yuefeng Chen, Yuan He, Hui Xue, Weiming Zhang, and Nenghai Yu. Spatial-phase shallow learning: rethinking face forgery detection in frequency do- main. In Proceedings of the IEEE/CVE conference on computer vision and pattern recognition. pp. 772-781, 2021a.
Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and Baining Guo. Swin transformer. Hierarchical vision transformer using shifted windows. In Proceedings the IEEE/CVF international conference on computer vision, pp. 10012-10022, 2021b.
Zhengzhe Liu, Xiaojuan Qi, and Philip HS Torr Global texture enhancement for fake face detec- tion in the wild. Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 8060-8069, 2020.
Ziwei Liu, Ping Luo. Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In Proceedings of International Conference on Computer Vision (ICCV) December 2015.
Ilya Loshchilov and Frank Hutter. Decoupled weight decay regularization. arXiv: 17111111100000 2017.
arXiv preprint
Haoming Lu and Feifei Zhong. Can lisiun-language models replace human annotators: case study with celeba dataset. arXiv preprint arXiv:2410.09416. 2024.
13

---

Published as a conference paper at ICLR 2026
Laurens van der Maaten and Geoffrey Hinton. Visualizing data using t-sne. Journal of machine learning research, 9Noov) 2000,,,,7-2,,,,,, 2008.
MidJoumey,, 2022. hitps: : www. www.mmidjj.... wwwwnurrjjedd.oommomm hom/.
Yisroel Mirsky and Wenke Lee. The creation and detection of deepfakes: A survey, ACM computing surveys (CSUR), 54(1):1-41, 2021.
Huy H Nguyen, Junichi Yamagishi, and Isao Echizen. gigsule-forensien Using capsule networks to detect forged images and videos. In ICASSP 2019-2019 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 2307-2311 IEEE, 2019.
Yunsheng Ni, Depu Meng, Changqian Yu, Chengbin Quan, Dongchun Ren, and Youjian Zhao. Core: Consistent representation learning for face forgery detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 12-21, 2022.
Yuval Nirkin, Yosi Keller, and Tal Hassner. Fsgan: Subject agnostic face swapping and reenactment, In Proceedings of the IEEE/CVF international conference computer vision, pp. 7184-7193, 2019.
Utkarsh Ojha, Yuheng Li, and Yong Jac Lee. Towards universal fake image detectors that generalize across generative models. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp.
2023.
OpenAl. Learning to reason with 1lms. https://openal com/ inexx/ learning-to- rea-or-asoo--iene 11mm/ 2024. [Accessed 19-09-2024).
Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, et al. Pytorch: An imperative style, high- performance deep learning library. Advances in neural information processing systems, 32, 2019.
Or Patashnik, Zongze Wu, Eli Shechtman, Daniel Cohen-Or, and Dani Lischinski. Styleclip: Text- driven manipulation of stylegan imagery. In Proceedings of the IEEE/CVF international confer- ence on computer vision, pp. 2085-2094 2021.
Giorgio Patrini. Mapping the deepfake landscape deeptrace. https://wwt: h/mp::://www../// linkedin........ com/ 2019. Accessed: 2022-
pul se/ ht/pm/ppppmneeppeeeeee fake- hawpepasaaaaaaaaapaaaaeaeeeaea witpppe-iioiioooo--peeee-e 01-18.
KR Prajwal, Rudrabha Mukhopadhyay, Vinay P Namboodiri, and CV Jawahar. A lip sync expert is all you need for speech to lip generation in the wild. Proceedings of the 28th ACM international conference on multimedia, pp. 184-492, 2020.
Yuyang Qian, Guojun Yin, Lu Sheng, Zixuan Chen, and Jing Shao. Thinking in frequency: Face forgery detection by mining frequency-aware clues. In European conference on computer vision, pp. 86-103. Springer, 2020.
Metz Rachel and O'Sullivan Donie. A deepfake video of mark zuckerberg presents challenge for facebook. https:/ /tte:///ddiiin../ cnn. com/ 20///2199/000 zuckerberg- wwwpddeeeeeeeeeeeeeee ruckerbberg-deefftte//iiii indee.iidxx...me html, 2019. Accessed: 2023-05-31.
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Krueger Gretchen, and Sutskever llya. Learning transferable visual models from natural language supervision. In International conference on machine learning, pp. 8748-8766 8763.877..111 PmLR, 2021.
Xingyu Ren, Alexandros Lattas, Baris Gecer, Jiankang Deng, Chao Ma, and Xiaokang Yang. Facial geometric detail recovery via implicit representation. In 2023 IEEE 17th International Conference on Automatic Face and Gesture Recognition (FG), pp. 1-8. IEEE, 2023.
Aja Romano. New deepfakes research finds they're mainly used to degrade women. http://00....eeiee.eoaaaeeeoeeee htw.uuub-------depttaaeerrrrrrre report, 2019. Accessed: 2020-07-23.
14

---

Published as a conference paper at ICLR 2026
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjöm Ommer. High- resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF confer- on computer vision and pattern recognition, pp. 10684-10695, 2022.
Andreas Rossler, Davide Cozzolino, Luisa Verdoliva, Christian Riess, Justus Thies, and Matthias Niessner. Faceforensics++: Learning to detect manipulated facial images. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2019.
Rasmus Rothe, Radu Timofte, and Luc Van Gool. Deep expectation of real and apparent age from single image without facial landmarks. International Journal of Computer Vision, 126(2-4): 144-157,500 2018.
Conrad Sanderson and Brian Lovell. Multi-region probabilistic histograms for robust and scalable identity inference. In International conference on biometrics, pp. 199-208. Springer, 2009.
Kaede Shiohara and Toshihiko Yamasaki. Detecting deepfakes with self-blended images. In Pro- ceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp. 18720- 18729, 2022.
Aliaksandr Siarohin, Stéphane Lathuilière, Sergey Tulyakov, Elisa Ricci, and Nicu Sebe. First order motion model for image animation. Advances in neural information processing systems, 32, 2019.
Haoyu Song, Jiaxin Huang, Qianru Li, Yan Gong, Shandeng Dong, Shiwen Wang, Peng Xu, Chun Liu, Weichao Ren, et al. Robustness and generalizability of deepfake detection: A study with diffusion models. arXiv preprint arXiv:2309.02211 022 2023. URL https: www.httts///exxi.ccoo http:///xxvvv.//eeeee/ 2309.02 02218.
Luchuan Song, Zheng Fang, Xiaodan Li, Xiaoyi Dong, Zhenchao Jin, Yuefeng Chen, and Siwei Lyu. Adaptive face forgery detection in cross domain. In European Conference on Computer Vision, pp. 467-484. Springer, 2022.
Ke Sun, Shen Chen, Taiping Yao, Haozhe Yang, Xiaoshuai Sun, Shouhong Ding, and Rongrong Ji. Towards general vinual-linguistic face forgery detection. arXiv preprint arXiv:2307. 16545, 2023.
Chuangchuang Tan, Yao Zhao, Shikui Wei, Guanghua Gu, and Yunchao Wei. Learning on gradients: Generalized artifacts representation for gan-generated images detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Puttern Recognition, pp. 12105-12114 14, 2023.
Mingxing Tan and Quoc V. Le. Efficientnet: Rethinking model scaling for convolutional neural net- works. Proceedings of the 36th International Conference Machine Learning (IC11),97:6105- 6114, 2019. URL http: http//poeddiieeec ngs ml r. m.rrprress press /9 / taan 9a html. PMLR.
97:6105-
Shahroz Tariq, Sangyup Lee, and Simon Woo. One detector to rule them all: Towards general deepfake attack detection framework. In Proceedings of the web conference 2021, pp. 3625- 2021.
Justus Thies, Michael Zollhofer, Marc Stamminger, Christian Theobalt, and Matthias Nießner. Face2face: Real-time face capture and reenactment rgb videos. Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 2387-2395, 2016.
Justus Thies, Michael Zollhöfer, and Matthias Nießner. Deferred neural rendering: Image synthesis using neural textures. ACM Transactions on Graphics (TOG), 38(4):1-12) 2019.
Hugo Touvron, Matthieu Cord, Matthijs Douze, Francisco Massa, Alexandre Sablayrolles, and Hervé Jégou. Training data-efficient image transformers & distillation through attention. In International conference on machine learning, pp. 10347-10357. PMLR, 2021.
Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Lukasz Kaiser, and Illia Polosukhin. Attention is all you need. Advances in Neural Informa- tion Processing Systems (NeurIPS), 00:5998-6008 2017. URL https: pestpa://paperee //pppp/pp..ppp//ee/teee/eee/eesp nips. ca/ scc/paper/11 81 -tttttttttnntttee -you--ee-dddd
15

---

Published as a conference paper at ICLR 2026
Qizhou Wang, Yong Lin, Yongqiang Chen, Ludwig Schmidt, Bo Han, and Tong Zhang. A sober look at the robustness of clips to spurious features. Advances in Neural Information Processing Systems, 37:122484-122522 2025.
Sheng- Yu Wang, Oliver Wang, Richard Zhang, Andrew Owens, and Alexei A Efros. Cnn- Con-generated images are surprisingly easy to spot... for now. In Proceedings of the IEEE/CVF conference on computer vision and patlern recognition, pp. 8695-8704, 2020.
Xudong Wang, Ke-Yue Zhang, Taiping Yao. Qianyu Zhou, Shouhong Ding, Pingyang Dai, and Rongrong Ji. Tf-fas: twofold-element fine-grained semantic guidance for generalizable face anti- spoofing. In European Conference on Computer Vision, pp. 148-168. Springer, 2024a.
Yabin Wang. Zhiwu Huang, Su Zhou, Adam pound-foolish in deepfake detection. arXiv preprint arXiv:2408. 240.:22200.. 2024b.
and Xiaopeng Hong. Penny-wise and
Zhendong Wang, Jianmin Bao, Wengang Zhou, Weilun Wang, Hezhen Hu, Hong Chen, and Houqiang Li. Dire for diftusion-generater image detection. In Proceedings of the IEEF/CVF International Conference Computer Vision, pp. 22445-22455, 2023a.
Zhendong Wang, Jianmin Bao, Wengang Zhou, Weilun Wang, and Houqiang Li. Altfreezing for more general video face forgery detection. In Proceedings of the IEEE/CVF Conference on Com- puter Vision and Pattern Recognition, pp. 4129 4129-4138, 2023b.
WhichFaceisReal, 2019. https: wwwp wttp::/wwwchaaceireeeeeeoo.
hettps:/www.wwwcchhttt
com/.
Haiwei Wu, Jiantao Zhou, and Shile Zhang. Generalizable synthetic image detection via language- guided contrastive learning. arXiv preprint 2rXiv:2305.13800 2023.
Liangbin Xie, Xintao Wang, Honglun Zhang, Chao Dong, and Ying Shan. Vfhq: high-quality dataset and benchmark for video face super-resolution. In Proceedings of the IEEE/CVF Confer- ence on Computer Vision and Pattern Recognition, pp. 657-666, 2022.
Shilin Yan, Ouxiang Li, Jiayin Cai, Yanbin Hao, Xiaolong Jiang, Yao Hu, and Weidi Xie. A sanity check for Al-generated image detection. In The Thirteenth International Conference on Learning Representations, 2025a. URL ntttpa://ict r. cc/ virvvrttall /2025/ p29tp//eettr..5.
Zhiyuan Yan, Taiping Yao, Shen Chen, Yandan Zhao, Xinghe Fu, Junwei Zhu, Donghao Luo, Chengjie Wang, Shouhong Ding, Yunsheng Wu, et al. Df40: Toward next-generation deepfake detection. arXiv preprini arXiv:2406. 13495, 2024.
Zhiyuan Yan, Jiangming Wang, Peng Jin, Ke- Yue Zhang, Chengchun Liu, Shen Chen, Taiping Yao, Shouhong Ding, Baoyuan Wu, and Li Yuan. Orthogonal subspace decomposition for gener- alizable Al-generated image detection. In Forty-second International Conference Machine Learning, 2025b. URL https: ccmmml...... cc www.cmlcc////oc.cc.mmcm.ce.cccce
Ran Yi, Zipeng Ye, Juyong Zhang, Hujun Bao, and Yong-Jin Liu. Audio-driven talking face video generation with learning-basee personalized head pose. arXiv preprint arXiv:2002. 10137, 2020.
Xiaohua Zhai, Basil Mustafa, Alexander Kolesnikov, and Lucas Beyer. Sigmoid loss for language image pre-training. In Proceedings of the IEEE/CVF international conference on computer vision, pp. 11975-11986. 2023.
Beichen Zhang, Pan Zhang, Xiaoyi Dong, Yuhang Zang, and Jiaqi Wang. Long-clip: Unlocking the long-text capability of clip. In European Conference Computer Vision, pp. 310-325. Springer, 2024.
Kaipeng Zhang, Zhanpeng Zhang, Zhifeng Li, and Yu Qiao. Joint face detection and alignment using multitask cascaded convolutional networks. IEEE signal processing letters, 23(10) 1499-1503, 2016.
Linfeng Zhang, Chenglong Bao, and Kaisheng Ma. Self-distillatinn: Towards efficient and compact neural networks. IEEE Transactions Pattern Analysis & Machine Intelligence, 44(08):4388- 4403, August 2022. ISSN 1939-3539. doi: 10.10000// //doi. deeecompttersocceeeeee wtw.eetytt..e.eeeeeeeeeeee / 10. 1109 TPAMT 2021 3067.00..
URL https:
16

---

Published as a conference paper at ICLR 2026
Xu Zhang, Svebor Karaman, and Shih-Fu Chang. Detecting and simulating artifacts in gan fake images. In 2019 IEEE international workshop on information forensics and security (WIFS), pp- 1-6. IEEE, 2019.
Hanqing Zhao, Wenbo Zhou, Dongdong Chen, Tianyi Wei, Weiming Zhang, and Nenghai Yu. Multi- attentional deepfake detection. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 2185-21880 2194, 2021.
Yinglin Zheng. Jianmin Bao, Dong Chen, Ming Zeng, and Fang Wen. Exploring temporal coherence for more general video face forgery detection. In Proceedings of the IEEE/CVF international conference on computer vision, pp. 15044-15054, 2021.
Nan Zhong, Yiran Xu, Zhenxing Qian, and Xinpeng Zhang. Rich and poor texture contrast: A simple yet effective approach for ai-generated image detection. CoRR, 2023.
Hao Zhu, Wayne Wu, Wentao Zhu, Liming Jiang, Siwei Tang, Li Zhang, Ziwei Liu, and Chen Change Loy. Celebv-hq: A large-scale video facial attributes dataset. In European con- ference on computer vision, pp. 650-667. Springer, 2022.
Mingjian Zhu, Hanting Chen, Mouxiao Huang, Wei Li, Hailin Hu, Jie Hu, and Yunhe Wang. Gendet: Towards good generalizations for ai-generated image detection. arXiv preprint arXiv:2312.08888,
2023a.
Mingjian Zhu, Hanting Chen, Qiangyu Yan, Xudong Huang, Guanyu Lin, Wei Li, Zhijun Tu, Hailin Hu, Jie Hu, and Yunhe Wang. Genimage: A million-scale benchmark for detecting ai-generated image. Advances in Neural Information Processing Systems, 36:77771-77782 2023b.
Bojia Zi, Minghao Chang, Jingjing Chen, Xingjun Ma, and Yu-Gang Jiang. Wilddeepfake: A chal- lenging real-world dataset for deepfake detection. Proceedings of the 28th ACM international conference on multimedia, pp. 2382-2390, 2020.
17

---

Published as a conference paper at ICLR 2026
APPENDIX
GENAL USAGE DISCLOSURE
We employed GPT-5 for text rephrasing, grammar checking, and code debugging. The authors reviewed and modified all outputs. All ideas and content were originally written and verified by the authors.
A DATASETS
Here, we describe the various benchmark deepfake datasets that we have integrated. These datasets utilized to train and evaluate our proposed model. We also detail the preprocessing steps applied to the collected datasets.
A.1 TRAINING DATASETS
DF40. DF40 (Yan al., 2024) comprehensive deepfake dataset proposed by Yan et al., incorporating variety of the latest forgery techniques. It features 40 distinct deep- fake generation and editing methods, making valuable resource for evaluating detection performance. The dataset is created from popular real image datasets, including Face- Forensics++ (Rossler et al., 2019) and Celeb-DF (Li et al., 2020), ensuring diverse and rep- resentative content. These deepfake samples are categorized into four manipulation types: Face Swapping (FS), Face Reenactment (FR), Entire Face Synthesis (EFS), and Face Edit- ing (FE). The DF40 dataset consists of a total of 77,200 real images and 1,613,000 fake images, providing a robust and extensive collection for evaluation.
DFF. DeepFakeFace (DFF) (Song et al., 2023) consists of 30,000 real images and 90,000 fake images. The real images are collected by sorting celebrity face photos extracted from the IMDB-WIKI (Rothe et al., 2018) dataset using RetinaFace (Deng et al., 2019), en- suring high-quality and diverse real samples. The fake images generated using three different techniques: Stable Diffusion v1.5 (Rombach et al., 2022), Stable Diffusion In- painting (Rombach et al., 2022), and InsightFace (Ren al., 2023), representing a variety of deepfake generation methods.
DFFD. Diverse Fake Face Dataset (DFFD) (Dang et al., 2019) consists of 58,703 real images, 240,336 fake images, 1,000 real video clips, and 3,000 fake video clips. The real images in DFFD are sourced from the FFHQ (Karras et al., 2019) and CelebA (Liu et al., 2015) datasets, while both real and fake videos are derived from the FaceForen- sics++ (Rossler et al., 2019) dataset. The dataset includes fake vidcos generated using four distinct categories of methods: identity swap, expression swap, attribute manipulation, and entire face synthesis.
DFDCP. DFDCP (Dolhansky et al., 2020) is preview version of the DeepFakes Detec- tion Challenge (DFDC) dataset, consisting of approximately 5,000 videos, including both original and manipulated content. The dataset is constructed with careful consideration of diversity across various aspects such as gender, skin color, and age. The original videos encompass wide range of lighting environments and head poses.
KoDF. Korean DeepFake Detection Dataset (KoDF) (Kwon et al., 2021) consists of 62,166 real video clips 90 seconds and 175,776 fake clips of 15 seconds or longer. The fake clips in the KoDF dataset are generated using six distinct forgery methods: FaceSwap (FaceSwap. 2016), DeepFaceLab (DeepFaceLab, 2023), FSGAN (Nirkin et al., 2019), FOMM (Siarohin et al., 2019), ATFHP (Yi et al., 2020), and Wav2Lip (Prajwal et al., 2020). Specifically, FaceSwap. DeepFaceLab, and ESGAN are face-swapping mod- els, while FOMM is a video-driven face- mece-reenattment model. ATFHP and Wav2Lip audio-driven face-reenactment models.
FF++ (c40). FaceForensics+* (FF++) (Rossler et al., 2019) is a widely used face forgery detection dataset consisting of 1,000 real videos and 4,000 fake videos. The fake videos are generated using both graphics- manipulation techniques (Face2Face (Thies et al., 2016), FaceSwar wap (FaceSwapp 201 2016)) and learning- methods (DeepFakes (DeepFakes,
18

---

Published as a conference paper at ICLR 2026
2017), FaceShifter (Li et al., 2019), and NeuralTextures (Thies et al., 2019)). FF++ is provided in three versions based on the compression level: raw, lightly compressed (c23), and heavily compressed (c40). Since the aforementioned DF40 dataset includes the c23 version, we add the c40 version for our experiments.
TIMIT TIIII (TIMIT) (Korshunov & Marcel, 2018) consists of fake videos generated from the real video sequences of the VidTIMIT (Sanderson & Lovell, 2009) dataset using a GAN-based face-swapping method. The authors of the TIMIT dataset trained types of fake video generation models: one using a GAN model to generate low-quality fake videos (LQ) and another using GAN model to generate high-quality fake videos (HQ). The dataset contains total of 640 fake videos, with 320 videos of low quality and 320 videos of high quality.
CelebA. CelebA (Liu et al., 2015) is a large-scale face attributes dataset containing 202,599 images of 10,177 celebrities. Each image is meticulously labeled by a professional team, providing 40 binary attributes and 5 facial landmarks (both eyes, nose, and the corners of the mouth).
CelebA-HQ. CelebA-HQ (Karras et al., 2017) is high-quality version of the widely used CelebA dataset. The CelebA-HQ dataset consists of 30,000 images selected from the orig- inal CelebA dataset, which have been enhanced to resolution of 1,024 1,024. The image enhancement process begins with enlarging the original CelebA images to 4,096x4,099 using the mirror padding method, followed by Gaussian filtering to smooth the image. The enlarged image is then cropped to size of 1,024 1,024, centered on the face, using landmark positions from the Celeb dataset. This process is applied to a total of 202,599 images from the original CelebA dataset, with the top 30,000 images selected based on frequency-based quality metric to form the CelebA-HQ dataset.
CelebV-HQQ CelebV-HQ (Zhu al., 2022) consists of 35,666 video clips, totaling approx- imately 65 hours of footage, sourced from 15,653 unique individuals. All videos maintain a minimum resolution of 512x512 and have durations ranging from 3 to 20 seconds. The dataset is curated with 83 manually labeled facial attributes, covering aspects of appear- ance, behavior, and emotion, ensuring diverse and well-annotated collection.
FFHQ. FFHQ (Karras et al., 2019) consists of 70,000 high-resolution images of 1024x 1024, providing diverse set of human faces with variations in age, ethnicity, and accessories such as glasses and hats. The images are sourced from https: /www. flickr.com and automatically aligned and cropped using dlib (King, 2009).
A.2 EVALUATION DATASETS
WildDeepFake. WildDeepFake (Zi et al., 2020) is dataset designed to address the limi- tations of existing deepfake detection models in real- world scenarios. consists of 7,314 face images extracted from 707 fake videos, providing diverse and challenging bench- mark for evaluating detection performance. Unlike prior datasets with limited diversity and low image quality, WildDeepFake captures a wide range of deepfake variations by collecting videos from the Internet.
UADFV. UADFV (Li et al., 2018) consists a total of 96 videos, including 49 real and 49 fake videos, providing a balanced set for evaluating detection models. The average duration videos in the dataset is approximately 11.14 seconds, ensuring a consistent temporal structure across samples.
DFDC. DFDC (Dolhansky et al., 2020) is introduced as part of the DeepFake Detection Challenge (DFDC), consisting of 128, 154 video clips. It encompasses a diverse range of deepfake generation techniques along with refinement methods to enhance the realism of manipulated content. To further increase the complexity and robustness of the data set, the validation and test sets incorporate additional augmentations such as distractor, which over- lays various objects, and augmenter, which applies geometric and color transformations as well frame rate modifications.
Dest- De40-Test (Yan al., 2024) is specialized evaluation dataset created by aggregating the test-only subsets defined in DF40 (Yan et al., 2024). To ensure a compre- hensive assessment of deepfake detection models, the original authors curated distinct test
19

---

Published as a conference paper at ICLR 2026
sets for each manipulation type. We combine these test-only datasets into unified version, which is utilized for our evaluation. This dataset includes fake images generated using var- tous state-of arr methods, such as DeepFaceLab (DeepFaceLab, 2023) (for FS type), HeyGen (HeyGen., 2020) (for FR type), MidJourney6 (MidJourney, 2022) and Whichis- Real (WhichFaceisReal, 2019) (for EFS type), and CollabDiff (Huang et al., 2023), Star- GAN (Choi et al., 2018), StarGANv2 (Choi et al., 2020), and StyleCLIP (Patashnik et al., 2021) (for FE type). The real images are sourced from UADFV (Li et al., 2018), VFHQ (Xie et al., 2022), and FFHQ (Karras et al., 2019), consisting of a total of 17,065 real images and 14,164 fake images.
A.3 PREPROCESSING
We apply the following preprocessing steps to the collected datasets. First, we detect faces in the im- ages (frames) using a Multi-task Cascaded Convolutional Networks (MTCNN) (Zhang al., 2016). To reduce noise and ensure reliable face detection, we select only bounding boxes with a confidence score greater than 0.9. We then crop the images into square regions centered on the detected bound- ing boxes. For image datasets, all cropped images are used for training and evaluation. For video datasets, we sample 32 frames evenly spaced from the entire video. When the original dataset is al- ready split into training, validation, and test sets, we use the training and validation sets for training. In cases where the dataset not pre-split, we randomly shuflle the images (or video frames) in a 9:1 ratio and then sample them to form the training and test sets.
A.4 DATA PARTITIONING PROTOCOLS
Integrating multiple deepfake datasets introduces the challenge of identity overlap due to shared original data sources, as detailed in Tab. 8. To prevent data leakage we implement specific data partitioning protocols tailored to the nature of the overlap.
Table 8: Identity counts and original data sources for each dataset.
Index
Dataset Name
Identity Count (Subjects)
Dataset Source
DF40
1,059
FaceForensics++ CDF
2
DFF
Unknown Unknown
IMDb-WIKI
DFFD
FFHQ. CelebA, FaceForensics*+
4
DFDCP
66
Paid Actors
KoDF
403
Paid Korean Subjects
6
FF++ (c40)
1,000
YouTube Videos
TIMIT (L.Q)
32
VidTIMIT
8
TIMIT (HQ)
32
VidTIMIT
CelebA
177
Web Crawled
10
CelebA-HQ
Unknown
CelebA
11
FFHQ 70,000
Flickr
Protocol 1: Managing Overlaps with Quality Variations (same source, different quality). Several datasets, including DF40 & FF++ (c40), TIMIT (L.Q) & TIMIT (HQ). and CelebA & CelebA-HQ, share identical source subjects but differ in visual quality (e.g. compression level, resolution). For these cases, we utilize these variations as a form of natural data augmentation. Exposing the model to diverse quality levels for the same identity enhances robustness against com- pression artifacts and resolution degradation. To prevent data leakage, we follow the official training and testing splits provided by the original datasets (e.g., FF++, TIMIT). For datasets without prede- fined splits (e.g., CelebA, CelebA-HQ), we partition the data based on unique identity IDs, ensuring that subject appears in both the training and testing sets.
Protocol 2: Managing Overlaps within DFFD (same source, same quality). The DFFD dataset is constructed from FFHQ, CelebA, and Faceoorensics*+, meaning its images share both source identities and visual quality with other datasets in our corpus. To prevent data duplicates, remove
20

---

Published as conference paper at ICLR 2026
the F subset. For the remaining subsets (originating from FFHQ and CelebA), apply a random pre-compression process (JPEG quality 60-100) before storage. This strategy is designed to simulate the relationship between high-quality and low-quality forensic data, mimicking the domain shift observed between DF40 and FF++.
B ACCURACY RESULTS FOR DEEPFAKE DETECTION
In Sec. 5.2.1 of our main paper, we report deepfake detection performance using Area Under the Curve (AUC). Here, we additionally present accuracy (ACC) results for comprehensive analysis. For a fair comparison, we apply a classification threshold of 0.5 for all datasets. As shown in Tab. and 10, our model exhibits superior overall performance (mACC) in both intra- and cross- domain evaluations, demonstrating its robust learning capacity on diverse training sets and strong generalization.
Table 9: Intra-domain detection performance (ACC).
Deaster
mADC
FF
CDF
F5
FR
EFS
97.16
97.15
100.0
101.0
REOCCE
Spaiial
90.02
97.04
91.37
03.86
92.70
60.14
79.52
88.78
92.96
K3.00
32.81
100.0
100.0
96.02
SPSL
Reequency
97.32
97.13
91.33
93.43
91.38
58.37
$5.55
39.62
94.93
$9.59
34.35
109.0
100.0
90.05
CLIP
CLiB-bsacd
94.90
96.07
63.06
91.82
67:93
56.22
37:73
84.61
54.52
52.95
82.43
97.11
07.80
78.61
CLIP- LoRA
CLIP-beac
96.12
98.83
89.09
91.94
85-93
56.89
$0.22
85.72
84.68
$9.80
83.14
100.0
100.0
98,26
(hifort)
<3 3.IP-rosod
96.85
95.91
89.01
91.34
64.36
87.78
99.05
100.0
(ears)
99.51
Table 10: Cross-domain detection performance (ACC).
DF40-Test
Methods
Detector Type
UADFV
WildDeepFake
DFDC
mACC
FS
FR
EFS
FE
Xception
Naive
52.58
65.14
$2.01
90.78
89.42
82, 48
66.85
71.33
RECCE
Spatial
53.76
61.00
51.96
84.15
82.75
75.62
72.20
SPSI.
Frequency
54.66
63.15
54.98
87.20
85.99
78.92
76.14
71.58
CLIP
CLIP-based
53.38
59.35
51.71
86.24
83.71
77.64
69,80
68.83
CLIP-LoRA
CLIP-based
55.90
55.31
60.84
76.36
73.79
66.42
74.59
66, 17
CLIP-SVD (Effort)
CLIP-based
90.98
66.05
63.61
88.16
83.21
81.24
87.98
80.18
SD (ours)
CLIP-based
89.62
69.16
73.66
91.95
85.67
84.25
90.44
83.53
C MORE ABLATION STUDIES
C.I TEXT LABEL SEPARATION Loss
To analyze the impact of the proposed text label separation loss (Cs) in Sec. 4.2, we conduct an ablation study on text label embeddings across the five defined types. We first compute the mean embeddings of text labels for each type and measure the cosine similarity between types. As shown in Fig. 4 (a), using the original CLIP text encoder results in high inter-type similarity (depicted in darker blue), indicating poor separability among manipulation types. contrast, Fig. (b) demon- strates that after applying the separation loss, our optimized model produces text embeddings that are nearly orthogonal across different types (with similarity approaching O), leading to well-separated representations. These results highlight the effectiveness of our loss function in enforcing more structured and discriminative embedding space.
Moreover, measure the intra-type cosine similarity by randomly sampling five text labels from each type. Fig. 5 shows that intra-type cosine similarity significantly higher (depicted in darker blue) when using model's 's text encoder (b) compared to the original CLIP text encoder (a). This demonstrates that augmenting each type with semantically similar text labels enhances the model's semantic understanding of each manipulation type.
21

---

Published as a conference paper at ICLR 2026
(a) Inter-type Similaritics in Original CLIP
Inter-type Similarities Our Model
REAL
1,00000
0,8879
0.8655
0.8068
0.8819
REAL
1,0000
-0.0018
-0.0023
0.0020
-0 0.,0008
FS
0.8379
1,0000
0.9122
0.9217
0.9894
-0.0018
1.0000
0,0002
-0,0003
0.0013
FR
1,00000
0.9175
-0.00223
-0.0012
0.0003
-0.25
8068
0.9217
8.8698
1.0000
0.9318
0.00020
-0.0008
-0.0012
1. 1,00000
-0.00115
-0.30
8
0.8819
0.9294
0.91
0.9338
1.0000
-0.0008
0.0013
0.0003
+0,0015
1.0000
-0.55
-1.00
REALL
135
Figure 4: Cosine similarity between text labels across different types. (a) Using the original CLIP, the text labels across different types exhibit high similarity the embedding space, preventing effec- tive convergence of the intended type-guided separation. (b) With the application of our separation loss, we successfully enforce separation between different types, thereby optimizing the classifica- tion objective.
(a) Intra-type Similarities in Original CLIP
REAL
PS
FR
EFS
FE
1.39
6-505
3::0
0.:81
1:000
6:714
6:721
0:117
8:093
0.017
6:611
0.555
1:CC
3.7%1
6:307
0.716
0.115
1.500
6:124
0.915
1:00
8:51
01:917
01714
1:000
0:724
01117
0.330
1,00
01721
8.000
0.:48
1:B
0.444
01:447
8:127
8::04
1,000
1/442
L,05
8.779
0.10
0.722
6:724
1.000
8.351
00084
0.8M
1800
0/711
0.042
CU727
Intra-type Similarities Our Model
1:177
3:591
11/B5
1:110
E:152
5.106
2:003
3:540
E/772
11/05
1.500
0.109
6.47
1O0CE
6.9
01/911
0.991
3:000
6:000
01:55
1,00
0.991
6.407
0.043
4/574
6482
0:971
8.90
6:400
1:60
(.00)
6:053
1:000
8:40>
8.400
0.43
4:4
1800
0:977
8:000
6:541
0:067
0LP54
0059
6.77
1,000
Figure Cosine similarity between text labels within the same type. (a) In the original CLIP embedding space, our carefully crafted text labels exhibit low similarity with other text labels of the same type. (b) After optimization with our separation loss, the similarity between text labels of the same type increases significantly, demonstrating that the model has learned to capture the semantics of each type effectively.
C.2 QUALITATIVE ANALYSIS OF CLAM
To qualitatively verify the impact of CLAM on feature representation, we visualized the image embeddings using t-SNE (Maaten & Hinton, 2008). Specifically, randomly sampled 500 images from the DF40- Test (Yan et al., 2024) for this visualization. Figure 6 compares the feature spaces of our framework with and without the CLAM module. The results demonstrate that CLAM leads to significantly more separable and structured feature representations, effectively disentangling real and fake samples.
22

---

Published as a conference paper at ICLR 2026
Figure 6: Impact CLAM on feature representation. (Left) Without CLAM, real and fake embed- dings are heavily entangled. (Right) With CLAM, the feature space exhibits enhanced separability, forming more discriminative manifold with distinct clusters.
D PSEUDOCODE
We present the pseudocode implementation of our SD² objective in Alg. 1.
Algorithm SD2 Pseudocode
E_I:
image encoder Vision Transformes E text encoder vision Transformer
CLAM: Cross-Laver Attention Module
GAP: Global Average Pooling
adapter: learnable adapter for image encoder
4 t_prime, bi temperature & bias of Sigl.1P
images 4 ylR]: sinibatch of categorical labels
xBB, C, H, W]: minibatch
CBB, L]: minibatch of augmanted text labels
d_I,, 2l: minibatch of facial descriptiens
dLe(B, Ll: minibatch of environmental descriptions
extract visual feature representations of images
f_final [_I(x)
f_ = (TAM(x) [_sa__prime (fPsaa)
adapter([f_fiial,, f_sat_prime])
extract all textual representations
u.c - B_T(c)
v_6, (LTE) B_Fid_e)
4 classsfication loss
logits (f, u.c.T)
loa8_o oross_entropy_losa (logits, y)
text label separation loss
= 12_normalize [u_c]
loss_s mean (power (dot (u_e, -mp-ec (B), 2))
dual contrastive loas
loss_d =iqglip(s, v_fi + siglip(f, v_e)
siglip(img, ixt):
= exx[t_ppimme
z_i =12_nozmalizeiime
z_t
logits dat (z_i, z.t.))
labels - eyee (3)
return [Lo[( logite))
E TEXT LABELS CONSTRUCTION
We manually curate text labels for five types: REAL, Face Swapping, Face Reenactment, Entire Face Synthesis, and Face Editing. Specifically, we input their definitions, descriptions, and simple
23

---

Published as a conference paper at ICLR 2026
prompt, "a photo of {type}" into GPT-ol (OpenAI, 2024) to generate 64 text labels per type. However, these generated text labels may misrepresent the type, lack sufficient coverage, or overlap ambiguously with other types. To refine them, we embed the text labels using the pre-trained CLIP text encoder (Radford et al., 2021) and compute the mean vector for each type. We then filter half of the labels farthest from the mean vector. Subsequently, researchers manually inspect the remaining text labels, removing those with inadequate descriptions or redundancy across types. The final text labels used in training are listed in Tabs. 11-15.
F TEXT DESCRIPTION DETAILS
In this section, we describe the process generating text descriptions for deepfake datasets, includ- ing detailed information on facial attributes and environmental factors. We also detail the design of the prompts used to generate these descriptions and describe the generation process. Finally, present examples of the text descriptions from our datasets.
F.1 PROMPT DESIGN FOR TEXT DESCRIPTIONS
Recent work (Wang et al., 2024a) leverages text descriptions tailored to Face Anti-Spoofing (FAS). Instead of relying
grained prompts, the authors improve generalization by aligning the visual and language components. Inspired by this approach, we generate text descriptions based on two key factors: facial attributes (age, gender, expression, and facial features) and environmental aspects (background and lighting). We directly adopt the facial and environmental prompts used in the referenced work extract these features. The following prompts used in our experiments:
Facial Description Prompt:
"Please describe the face (including age, gender, expression, appearance, etc.) of the person in one sentence."
Environmental Description Prompt:
"Please describe the environment (including background, lighting intensity, etc.) in one sentence."
F.2 TEXT DESCRIPTION GENERATION VIA VLM
For generating text descriptions, we utilize Intern (Chen et al., 2024), an open-source vision- language model with billion parameters. We perform inference using the aforementioned prompts for all images used joint training and store the resulting responses. line with findings from previous work (Zhang et al., 2024), we recognize that CLIP's effective token length often falls below 20 tokens, even though it is limited to 77 tokens. To mitigate this, we append the phrase "in one sentence" " to each prompt and set the maximum length of the textual token sequence to 60. Our VQA inference using Intern VL is implemented in Py Torch and performed on 4 NVIDIA GeForce RTX 3090 GPUs. Examples of our annotated data are visualized in Fig.
24

---

Published as a conference paper at ICLR 2026
Type: REAL
Face: The individual appears to be middle-aged, male, wearing glasses, and has professional appearance studio background of
Environment: The environment has busy television studio background with various lights and screans, likely From a news broadcast. The lighting appears to be weli-lit, illuminating the man clearly for his report.
Type: Face Swapping
Face:
The in the portroit has fair complexion, light skin, shoulder-langth wany light pink blush her checks, full lips, and a friendly, radient smile.
Environment: photo, background is an setting light- walls visible,
natural light illuminating
Type: Face Recnactment
Face: The person appears to be middlc-aged with short, graging hair. They have serious or noutrol expression, weering
Environment:
The man in newsroom with blurred background. The lighting typical for an indoor news setting, creating soft lighting.
Type: Entire Face Synthesis
youngg adult fomale with shoulder-length brown hair, gontle expression, and light, expressive and is dressed in white garment.
Face:
The person the
Environment: image cutdoor setting green faliage bockground, possibly park garden, with soft, natural lighting illuminating the face.
Type: Face Editing
Face: The shows young woman with long, straight hair, wearing makeup and slight smille on her face.
Environment: background blurred with obstroct white designs, and the lighting soft evenly illuminates face.
Figure 7: Visualizations of annotated data. Each image in our unified dataset is labeled in two ways. First, we assign one of five types through human annotation. Then, we generate two distinct text descriptions related facial attributes and environmental factors using VL.M-based VQA.
25

---

Published as a conference paper at ICLR 2026
Table 11: Text label for REAL type. The first simple text label, highlighted in bold, is used in the image-text classification evaluation. The remaining augmented labels provide range of descriptive variations that enhance the model's ss understanding of REAL. images.
Set of Text Labels Assigned to tREAL
"a photo of a real face."
"a naturally captured image, preserving the individual's 's real identity." an untainted photograph showing the person in their true essence." "a legitimate image capturing the subject's 's natural essence." "a real and unedited portrayal of the subject's s appearance." "a natural image displaying the individual in their genuine state." "a true photographic capture of the person in their real form." "a completely original image capturing the real essence of the individual." " "a true photograph of the individual, free of any artificial inftuence." "a true-to-life image portraying the individual as they are." "an unmanipulated photo reflecting the subject's 's true identity." "an unembellished image depicting the subject's 's true self." "a raw image that genuinely reflects the person's 's appearance." "a photo that faithfully represents the subject's 's true face." "a legitimate image preserving the subject's 's true form." "a naturally captured photograph preserving the person's identity." "a true-to-life depiction of the subject as they exist." an unprocessed representation of the subject's natural form."" "a natural photo, free from the influence of any digital technology." "a pristine image that genuinely reflects the subject's features." " "a truthful and unaltered photo of the subject's 's face."
"a an unaltered photograph revealing the person's 's authentic appearance." "a straighfforward image emphasizing the individual's 's genuine identity."
"a straightforward, unedited photograph of the person."
"a clear, natural portrayal of the individual's features."
"an unaltered capture of the subject's 's genuine features." an unprocessed image portraying the subject they naturally appear." "a genuine photo capturing the true identity of the individual."
"a raw depiction of the subject's 's natural traits."
"a pure, unaltered depiction of the individual' ' face."
26

---

Published as a conference paper at ICLR 2026
Text label for Face Swapping type. The first simple text label, highlighted in bold, is used the image-text classification evaluation. The remaining augmented labels provide a range of descriptive variations that enhance the model's understanding of Face Swapping images.
Table 12:
Set of Text Labels Assigned to Lps
"a photo of face swapping." "a synthetic image where the face transition appears imperceptible." "a manipulated image where one individual's face has been seamlessly replaced with another."
"a synthesized image featuring the flawless substitution of one face for another." an example of face transposition where two identities are seamlessly integrated." "a seamless face overlay creating the illusion of identity transference." "an edited photo blending two identities through advanced facial synthesis." "a reimagined image where one person's face has been digitally replaced with another's. "a realistic visualization of one face superimposed onto another individual." "a deepfake alteration creating the illusion of the source face belonging to the target." "a face- secessw image retaining the natural appearance of the overall photograph." " "a computational synthesis of one person's 's face overlaid onto another's 's body." "a deepfake- crafttd photo replacing one individual's 's face with another's. 's." "a deepfake showcasing the complete substitution of the original face." "an altered image with flawlesslly transplanted face from another source." "
"a face-swapped image designed to merge two identities into a convincing portrayal." "an expertly replaced face that merges the identities of two individuals."
"a digitally altered face that replaces the original while retaining realism."
"a photo demonstrating the realistic substitution of one face for another."
"a synthetic rendering that replaces the original face with a new, realistic identity""
"a hybridized photo where the facial features of two people are merged."
"a realistic depiction of face replacement using cutting-edge Al algorithms." "a digital transition of one face into another's 's context, creating cohesive visual." "a visually realistic replacement of one face with another using Al techniques." "a creative deepfake, blending two distinct facial identities in one frame."
"a reconfigured image where the original identity has been replaced with a new face." "a photograph that combines the facial identity of the source with the context of the get."
"a synthetic face replacement that mimics the appearance of another individual."
an altered image with flawlessly exchanged face, keeping the target's 's proportions."
27

---

Published as a conference paper at ICLR 2026
Table 13: Text label for Face Reenactment type. The first simple text label, highlighted in bold, is used in the image-text classification evaluation. The remaining augmented labels provide range of descriptive variations that enhance the model's understanding of Face Reenactment images.
Set of Text Labels Assigned to LFR
"a photo of a face reenactment."
"a dynamic synthesis combining source facial expressions with a target's 's identity."
"a manipulated image where source-driven behaviors redefine the target's 's facial anima- tions."
"a synthetic face combining the target's 's features and the source's 's expressive cues." "a dynamic facial synthesis that animates the larget with the source's emotional at- tributes."
"a synthesized depiction of a larget face animated by the source's 's emotional behavior." "a reenacted face, maintaining the target's appearance while expressing the source's 's ges- tures."
"a manipulated larget face enhanced with external expressive characteristics. "a synthesized face showcasing transferred expressions while preserving the target's 's iden- tity."
"a target face retaining its identity but animated by the source's expressive behavior."
"a synthetic animation that mimics the source's expressions the target's features."
"a motion-trant tration-rransferred facial image, preserving the target's look but expressing the source's 's feelings."
"a facial synthesis driven by the source's 's emotive and dynamic behaviors."
"a synthesis of dynamic expressions from a source, applied to a target's 's visage." "a synthetic reenactment combining the source's 's emotive characteristics with the target's identity."
"a face manipulation highlighting the dynamic interplay of source emotions on the target." "a dynamically altered image where the expressions of source person have been imposed on the target's face."
"a reenacted depiction where the source's 's emotional gestures guide the target's behavior. "a manipulation that transfers source emotive behavior onto the target with realism." "a synthesized animation, infusing source emotions into preserved target identity." "a synthetic reenactment image that transfers the essence of source movements."
"a reenactment image that synchronizes the source's emotional expression onto the tar- get."
"a deepfake creation where the source's 's expressions animate the target' 's face."
"a reenactment-burt image, preserving the target's static identity while adding source movements."
"a reenacted target face enriched with the emotive characteristies of the source individ- ual."
28

---

Published as a conference paper at ICLR 2026
Table 14: Text label for Entire Face Synthesis type. The first simple text label. highlighted in bold, is used in the image-text classification evaluation. The remaining augmented labels provide range of descriptive variations that enhance the model's understanding of Entire Face Synthesis images.
Set of Text Labels Assigned to tEFs
"a photo of a entire face synthesis."
"a digital portrayal of human face, generated entirely by deep learning." " "an artificial human visage created with advanced machine learning tools." "an ai di-generated faciiiaa facial image designed to mimic natural human appearance." "a generative model's 's output of human face, appearing lifelike but not real." "a completely synthesized human face, crafted using deep learning algorithms.." "a simulated human face created by neural networks appear authentic." "an artificial face image generated exhibit human-like detail and emotion." "a synthetic facial image where every element is the product of ai model." "a representation of human face that is digital construct, not real person." "
"a nigh-resolution image of a face that is completely ai-generated." "a face generated from a neural network trained to create photorealistic human features." "a fully artificial human face crafted by advanced ai technologies." "a non-real facial image created entirely through ai-driven synthesis techniques."
"a photorealistic face that showcases ai' 's ability to generate human-like features."
"a digital face image, where every aspect synthesized."
"an example of ai-driven facial synthesis, where the face is purely artificial." an ai ai-crafted face, where realism is achieved through advanced neural techniques."
"a digital creation of a face, formed entirely by deep learning synthesis."
"a neural network- network-generatee face that appears entirely plausible."
"a computer-generaaee human commaaface face that mirrors the natural variation of real individuals."
"a fabricated face image, where every detail is the result of neural network generation."
29

---

Published as a conference paper at ICLR 2026
Table 15: Text label for Face Editing type, The first simple text label, highlighted in bold, used in the image-text classification evaluation. The remaining augmented labels provide a range of descriptive variations that enhance the model's 's understanding of Face Editing images.
Set of Text Labels Assigned to LFF
"a photo of a face editing."
"a deepfake face with modified visual characteristics while preserving the original iden- tity."
"an altered face image with adjustments to specific attributes such as age and gender." "a synthetically enhanced face with refined or transformed facial features." "an edited portrait where certain aspects of the face have been subtly or significantly changed."
"a manipulated face that showcases alterations in appearance without changing the core identity."
"a modified image that presents adjusted traits while maintaining recognizable fea- tures."
"a deepfake gennrratd face with enhanced or altered attribute details."
"an ai-edited face image focusing on the transformation of facial characteristics." " "a synthetically modified face exhibiting adjusted features while retaining its essence." "a digitally enhanced face displaying changes key appearance attributes."
"an adjusted portrait that demonstrates transformations in facial aspects while remaining authentic."
"a modified face image that retains overall identity while refining selected attributes."
"an altered image where specific facial details have been modified to achieve a desired look."
"a manipulated portrait with tailored changes improve transform visual features." "an ai prroceeseed face displaying modified traits while keeping the original structure in- tact."
"a face image where certain attributes have been altered while preserving overall facial identity."
"an edited facial image that reflects changes in specific visual features without affecting recognition."
"a modified portrait that presents an adjusted version of the original face." "a transformed facial image that showcases refinements in appearance while maintaining a natural look."
an adjusted face that highlights changes in selected attributes while retaining key facial features."
"a synthetically altered portrait where facial details have been subtly enhanced or modi- fied."
"an ai-edited face image with visible improvements or changes to certain characteristics."
"a deepfake face showing controlled modifications in appearance while keeping identity consistent."
"a processed face that reflects tailored adjustments to achieve refined appearance." "a modified image where selective facial altributes have been enhanced or transformed." "an edited portrait that demonstrates balance between original structure and refined details."
"a transformed face where visual attributes have been modified while maintaining real- ism."
30


Reviews:
[{"review_id": "MAgeS62FYf", "reviewer": "Reviewer_MC2Z", "summary": "This paper introduces a new large-scale deepfake dataset called MMI-DD, which consolidates 3.6 million images from 11 different sources annotated with fine-grained DeepFake types. The data also contains VLM-generated text descriptions of facial and environmental attributes.​ The authors also propose SD², a scalable, CLIP-based detection baseline. The model uses a multi-modal learning strategy that leverages the detailed annotations through specialized classification and contrastive loss functions.", "questions": "- What procedure was followed to resolve labeling disagreements among the researchers?\n- How did the authors verify the factual accuracy of the VLM-generated facial and environmental descriptions? Was there a human review process to filter out hallucinations or irrelevant details?\n- What is the rationale behind the claim that the model is able to ground the reasoning to the visual cues through the CLAM module?\n- The dual contrastive loss aims to disentangle forensic cues from spurious correlations. Have you conducted experiments to test this, for example, by evaluating the model on images where a known fake face is placed in diverse and unseen environments?\n- In the general synthetic image detection experiment (Table 4), could the authors clarify whether the performance gains come from the MMI-DD pre-training or from the subsequent fine-tuning on ImageNet and SD v1.4 data?\n- Figure 1 and Table 6 show that the proposed model scales better than baselines. How does the computational cost (e.g., total GPU hours) of training SD2 on the full 3.6 million image dataset compare to the other methods? And what are the inference times of each of these models?", "limitations": "", "rating": null, "confidence": 5, "soundness": 1, "presentation": 2, "contribution": 1, "strengths": "- The authors make a noteworthy attempt to address a significant challenge in the field: the lack of a large-scale, unified benchmark for DeepFake detection and reasoning. By integrating 11 distinct datasets into a single resource (MMI-DD), they provide a valuable foundation that could encourage the community to move beyond single-dataset training paradigms.\n- The work highlights a critical and often overlooked issue, which is the performance saturation or degradation of existing models when trained on increasingly large and heterogeneous datasets.", "weaknesses": "- The paper states that six researchers manually categorized the images, but it does not report the inter-annotator agreement score or detail the protocol for resolving disagreements. This omission makes it difficult to assess the reliability and consistency of the fine-grained labels, which are crucial for the proposed classification loss.\n- The annotations are generated using proprietary models like GPT-4o. This assumes that GPT-4o is a good DeepFake detector and reasoning model, which is wrong. MLLMs are inherently built for global semantics rather than capturing subtle inconsistencies that occur in DeepFakes. Papers like [1, 2] show that subtle changes are ignored, and these models are broadly good in overall content understanding. The paper also provides no information on how the quality, accuracy, and potential biases of these machine-generated captions were validated. This means that the annotations are highly unreliable and noisy.\n- The paper makes claims about how its components work, for example, that CLAM captures low-level forgery artifacts. However, there is no qualitative evidence, such as attention maps or feature visualizations, to verify these claims and provide insight into the model's decision-making process.\n- Section 5.2.2 states the model's vision encoder is frozen for linear probing but also mentions that the protocol involves fine-tuning on new data (SD v1.4 and ImageNet). This contradiction makes it difficult to determine if the strong performance is due to the pre-training on the MMI-DD dataset or the subsequent task-specific tuning.\n\n[1] Tong, Shengbang, et al. \"Eyes wide shut? exploring the visual shortcomings of multimodal llms.\" Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2024. [2] Huynh, Ngoc Dung, et al. \"Vision-Language Models Can't See the Obvious.\" Proceedings of the IEEE/CVF International Conference on Computer Vision. 2025.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "CWfuMu0joV", "reviewer": "Reviewer_6zHj", "summary": "- This paper presents a visual–language framework for deepfake detection together with a large-scale, multi-modal knowledge space constructed by unifying 11 datasets into a 3.6M-image corpus with consistent preprocessing, five-way type labels (REAL/FS/FR/EFS/FE), and VLM-generated facial and scene descriptions. The goal is to achieve scalable, cross-domain generalization beyond single-dataset training by leveraging richer supervision from text and multi-level visual cues. Specifically, the method (SD2) adapts CLIP with a cross-layer attention module that fuses intermediate and final vision features, a fine-grained image–text classification objective using type-specific labels, and a text-label separation loss to stabilize class embeddings, together with a dual image–text contrastive loss that aligns each image with both facial and scene descriptions. To enable efficient and robust training at scale, the approach fine-tunes CLIP encoders with LoRA and employs a SigLIP-style contrastive objective to avoid very large batches. Furthermore, extensive experiments show superior intra-domain and cross-domain AUC over CNN/Transformer and CLIP-based baselines, and competitive accuracy on a non-facial AIGC benchmark using the frozen vision encoder with linear probing, underscoring the method’s effectiveness, scalability, and practical applicability.", "questions": "- How are near-duplicates and identity overlaps managed across the 11 sources? Could clarify the criteria for duplicate removal, report per-source identity counts, and describe any identity-disjoint checks implemented to prevent data leakage.\n- How accurate are the VLM-generated facial and scene descriptions? Have authors conducted a small-scale human audit (e.g., inter-annotator agreement, error type analysis) or performed an ablation study in which captions are shuffled or masked to quantify their causal impact?\n- How are heterogeneous source labels mapped to the five target categories (REAL/FS/FR/EFS/FE)? Does proposed framework support open-set or “other manipulations” (e.g., audio-visual inconsistencies, partial edits, diffusion-based reenactment), and how are such cases handled?\n- How sensitive are the results to prompt templates, temperature, and LoRA rank choices? Report the random seeds, hyperparameter ranges, and effect sizes (with confidence intervals) for main comparisons.", "limitations": "", "rating": 6, "confidence": 5, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "- Overall, the paper is clearly written and easy to follow, with a well-articulated connection between the unified corpus and the proposed vision–language (V–L) objectives.\n- The data contribution is significant: the authors unify 11 sources into a 3.6M-image corpus with consistent preprocessing, five-way labels, and VLM-generated descriptions.\n- The proposed method is both practical and modular, building on CLIP by introducing cross-layer attention, text–label separation, and dual image–text contrastive training.\n- The authors also address training efficiency, employing LoRA fine-tuning and a SigLIP-style objective to reduce batch requirements. The results are strong across both intra- and cross-domain settings, with additional linear-probe transfer experiments on a non-facial AIGC benchmark further demonstrating robustness.", "weaknesses": "- The unified corpus may inherit dataset biases and spurious correlations; issues such as deduplication, identity overlap, and source-specific artifacts are not sufficiently quantified.\n- VLM-generated descriptions can introduce noise or hallucinations, yet the paper does not assess caption quality or analyze its impact on downstream accuracy.\n- The reported performance gains may be partly attributable to corpus scale or data curation rather than architectural improvements; stronger experimental controls, e.g., equalizing data size, testing alternative prompts, or using simpler adapters.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "9voVvpSUaX", "reviewer": "Reviewer_zo7x", "summary": "The paper finetunes CLIP image and text encoder with image-text deepfake pairs by curating all the existing datasets. The text and caltegorical annotation for each image is generated using InternVL and gpt o1 respectively.", "questions": "1. Can you show the results of recent methods when trained on the bigger dataset and show the performance comparison.", "limitations": "", "rating": 6, "confidence": 5, "soundness": 4, "presentation": 3, "contribution": 3, "strengths": "1. The paper is well motivated. I agree that the current deepfake methods in the community train on FF++ and test on other datasets which doesn't necessarily reflect their in-the-wild performance and are overfitted to the training domain. The proposed methods aims to scale the data bottleneck by training in a contrastive manner using image-text pairs, ands highlight that the model performance improves with dataset size.\n2. The paper is well-written. \n3. The performance improvement with data scaling is impressive.\n4. The data scaling shows emergent behavior and the performance improves on datasets \"beyond facial manipulations\".", "weaknesses": "The paper doesn't compare with recent deepfake detection methods. The authors should compare the recent methods by training them using the bigger curated dataset proposed, and then compare it with SD^2, to see whether there is a performance improvement or not . This will highlight whether the CLIP-based LoRA training is actually useful or it is just because of data scaling where the CLIP-based methods are not scalable. It is still not clear that other non-CLIP based methods are scalable or not. \n\nPlease compare with 1 or 2 SOTA methods from NeurIPS 25, CVPR 25, AAAI 25, etc.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "1Vo8guarDC", "reviewer": "Reviewer_cYdy", "summary": "This paper introduces SD2 (Scalable Deepfake Detection), a CLIP-based visual-language model trained on a newly built MMI-DD dataset containing 3.6 million multimodal facial images across 11 datasets. It proposes three main components: the Cross-Layer Attention Module (CLAM), the Text Label Separation Loss, and the Dual Contrastive Loss to enhance generalization and scalability in deepfake detection. Experimental results demonstrate strong performance across multiple benchmarks, suggesting that SD2 scales effectively with increasing data size.", "questions": "Please check Weaknesses for the details.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The authors integrate eleven existing datasets into a unified corpus with over 3.6 million multimodal samples, covering four manipulation types and both real and fake instances (Section 3.1, Table 1). They also include human-verified textual labels and VLM-generated descriptions, enhancing the dataset’s semantic richness and enabling cross-modal learning (Figure 2). This large-scale integration and annotation pipeline offer a solid infrastructure that benefits future research in multimodal forensics.\n\n2. The model introduces the Cross-Layer Attention Module (CLAM) to fuse visual features from different transformer layers and employs Dual Contrastive and Label Separation losses to strengthen cross-modal alignment. Each component is separately evaluated in the ablation study, where removing CLAM or either loss leads to performance drops of 1.24–1.97% on the cross-domain mAUC. This structured experimental setup provides convincing evidence that the proposed components meaningfully contribute to the final performance. Across intra-domain and cross-domain tests, SD2 achieves 95.76 mAUC and 87.79 mAUC respectively, surpassing prior models and methods. What I like is that the authors further report that performance continues to improve as training data size increases from 1M to 3.6M samples (Table 6). These findings support the paper’s claim that SD2 scales effectively and avoids the overfitting observed in earlier CLIP-based detection frameworks.\n\n3. The extension to non-facial AIGC data highlights broader applicability. The experiments on non-facial synthetic datasets, such as synthetic scene and object generation benchmarks, show that SD2’s vision encoder generalizes beyond facial forgeries. The model outperforms prior works on the averaged mAUC, confirming the potential of multimodal pretraining for generalized forgery detection. This result is a noteworthy attempt to bridge the gap between face-centric and content-agnostic AIGC detection, which is important in the current stage.", "weaknesses": "1. The overall novelty of SD2 is somehow limited, as most techniques extend existing designs rather than introduce new concepts. The proposed Cross-Layer Attention Module (CLAM) aggregates multi-level visual features from intermediate transformer layers. However, similar multi-scale fusion strategies have long existed in CNN-based architectures, and recent ViT variants also exploit cross-layer interactions. As a result, CLAM feels more like a standard adaptation of established ideas to a CLIP backbone rather than a novel architectural contribution.\n\n2. Parts of the loss terms largely reuse ideas already present in prior multimodal learning frameworks. For example, the Dual Contrastive Loss directly follows CLIP-style image-text alignment, while the Text Label Separation Loss resembles class-wise embedding decorrelation objectives used in prior works.  Without further explanations and comparisons, the learning objective feels incremental rather than innovative.\n\n3. Certain implementation details remain unclear, for example,  parameter updates in Eq. (4). The paper introduces the Text Label Separation Loss (Section 3.3, Eq. 4) but I can not find out which parts of the model are updated under this loss. Clarifying which components receive gradient updates would  strengthen the technical clarity of the paper.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)