DeepfakeBench: A Comprehensive Benchmark of Deepfake Detection
Authors: Zhiyuan Yan
Yong Zhang
Xinhang Yuan
Siwei Lyu
Baoyuan Wu
Venue: NeurIPS 2023 Datasets and Benchmarks Poster (2023)
Keywords: Deepfake Detection
Benchmark
TL;DR: A comprehensive benchmark for deepfake detection, with a unified data management module, standard evaluations, and a modular code base, a series of analysis tools and new insights.

Abstract: A critical yet frequently overlooked challenge in the field of deepfake detection is the lack of a standardized, unified, comprehensive benchmark. This issue leads to unfair performance comparisons and potentially misleading results. Specifically, there is a lack of uniformity in data processing pipelines, resulting in inconsistent data inputs for detection models. Additionally, there are noticeable differences in experimental settings, and evaluation strategies and metrics lack standardization. To fill this gap, we present the first comprehensive benchmark for deepfake detection, called \textit{DeepfakeBench}, which offers three key contributions: 1) a unified data management system to ensure consistent input across all detectors, 2) an integrated framework for state-of-the-art methods implementation, and 3) standardized evaluation metrics and protocols to promote transparency and reproducibility.  Featuring an extensible, modular-based codebase, \textit{DeepfakeBench} contains 15 state-of-the-art detection methods, 9 deepfake datasets, a series of deepfake detection evaluation protocols and analysis tools, as well as comprehensive evaluations.  Moreover, we provide new insights based on extensive analysis of these evaluations from various perspectives (\eg, data augmentations, backbones). We hope that our efforts could facilitate future research and foster innovation in this increasingly critical domain. All codes, evaluations, and analyses of our benchmark are publicly available at \url{https://github.com/SCLBD/DeepfakeBench}.

DeepfakeBench: A Comprehensive Benchmark of Deepfake Detection
Zhiyuan Yan', Yong Zhang", Xinhang Yuan', Siwei Lyu', Baoyuan Wul*
School of Data Science, The Chinese University of Hong Kong, Shenzhen (CUHK-Shenzheng China Tencent Al Lab
Department of Computer Science and Engineering, University at Buffalo, State University of New York, USA
Abstract
A critical yet frequently overlooked challenge in the field of deepfake detection is the lack of a standardized, unified, comprehensive benchmark. This issue leads to unfair performance comparisons and potentially misleading results. Specifically, there is a lack of uniformity in data processing pipelines, resulting in inconsistent data inputs for detection models. Additionally, there are noticeable differences experimental settings, and evaluation strategies and metrics lack standardization. To fill this gap, we present the first comprehensive benchmark for deepfake detec- tion, called DeepfakeBench, which offers three key contributions: 1) unified data management system to ensure consistent input across all detectors, 2) an integrated framework for state-of-the-art methods implementation, and 3) standardized evalu- ation metrics and protocols to promote transparency and reproducibility. Featuring extensible, modular-based codebase, DeepfakeBench contains 15 state-of-the-arr detection methods, 9 deepfake datasets, a series of deepfake detection evaluation protocols and analysis tools, well comprehensive evaluations. Moreover, we provide new insights based on extensive analysis of these evaluations from various perspectives (e.g., data augmentations, backbones). We hope that our efforts could facilitate future research and foster innovation in this increasingly critical domain. All codes, evaluations, and analyses of benchmark are publicly available https: /tte:://itttttt com wwt.///.//////////..////..t.w RSSCLBDDDeeD Deepf akeBench.
Introduction
Deepfake, widely recognized for its facial manipulation, has gained prominence as a technology capable of fabricating videos through the seamless superimposition of images. The surging popularity of deepfake technology in recent years can be attributed to its diverse applications, extending from entertainment and marketing more complex usages. However, the proliferation of deepfake is not without risks. The same tools that enable creativity and innovation can manipulated for malicious intent, undermining privacy, promoting misinformation, eroding trust in digital media, etc.
Responding the risks posed by deepfake contents, numerous deepfake detection methods [53, 22, 33, 32, 52, 3] have been developed to distinguish deepfake contents from real contents, which are generally categorized into three types: naive detector, spatial detector, and frequency detector. Despite rapid advancements in deepfake detection technologies, a significant challenge remains due to the lack of standardized, unified, and comprehensive benchmark for fair comparison among different detectors. This issue causes three major obstacles to the development of the deepfake detection field. First, there is a remarkable inconsistency in the training configurations and evaluation standards utilized in the field. This discrepancy inevitably leads to divergent outcomes, making fair
"Corresponding author: Baoyuan Wu @vubacyuan@cuhlee
37th Conference on Neural Information Processing Systems (NeurIPS 2023) Track on Datasets and Benchmarks.

---

Model Type
Detectoos
Bookbone
Repostories
Reference
Nuve Devector
MesoNet [1]
Designed CNN
hespo if thght cos wwt.///arriiiooooe /DarIoak /Neootet
WIFSS 2015
Nave Desettor
Mescinorpton L1]
Designed UNN
heepe 1/ /ightsbb www.barttona sandt///annn /Neeoter lsteper /pttaraangggs
WirSS-011
Navee Desector
CNN-AM [45]
ResNet [16]
gathaab so ht/Citbbeeette i
CVP2-200
Nave Desector
EmickutNe B4 [40]
EmiiienNN [40]
uespa //ggt///taaa con/ Lukene aas E.1 cea PyT oo
JCML, 2019
Desesior
Necption (15)
Nerptin [1]
harge s//g /iihhhh caoe com//ndgert htt.g///////aaaeeeeoo httas//aaaaaeeteeeeoeooo
ICCV5-0019
Sperinl Detector
Capaile [29]
Decigned Copaile [14]
hespes// //ggt//bb con/ntt cww/ntt---eeeeeee -paenng whi Taihaa//oog (oaparte--eeeaeee Fe--Fonntteon
ICASSP-3019
Spotill Detecto
[2]]
Xception] [S]
//gpp://hthhh coar daneobabaa 279392219 Face Artifacts
CVPRW 2019
Spotill
X [20]
HRNet
Unpublished code, repeoduced by us evlab. coo edu/pro jeoject /ncymmaenn astpa:// cww//18 sJtu/nBccE atopa: Unqublisted code. reproduoed
Spotiol Detector
FHD [s]
Noepecon [5]
Xeeptins
CVT2W-22022
RECCE
Designed Netwoeks
CVP3 5022
Spotial Dntector
[S])
Ncrption
ICU9-2002
Detrctor
Fobet
Ncepeoon
Unpablished code, repeodrced
UCUV-2000
Frequenes Detectur
SPSL. [26]
Xecptin [5]
Ungublishd code, repesdueed
CVPR. [V22
Froquencs Detector
SRM [27]
Xecption [5]
Uigublishe code, repeodicedd
CVPR. 2021
Table 1:
Summary of the compared deepfake detectors. For detectors without publicly available repositories, we undertake careful re-implementation, adhering to the instructions specified in the original papers.
comparison difficult. Second, the source codes of many methods are not publicly released, which could be detrimental to the reproducibility and comparability of their reported results. Third, we find that the detection performance can be significantly influenced by several seemingly inconspicuous factors, e.g., the number of selected frames in a video. Since the settings of these factors are not uniform and their impacts are not thoroughly studied in most existing works, the reported results and corresponding claims may be biased misleading.
To bridge this gap, we build the first comprehensive benchmark, called DeepfakeBench, offering unified platform for deepfake detection. Our main contributions are threefold. 1) An extensible modular- codebase: Our codebase consists of three main modules. The data processing module provides a unified data management module to guarantee consistency across all detection inputs, such that alleviating the time-consuming data processing and evaluation. The training module provides a modular framework to implement tfate-of-hh-as art detection algorithms, facilitating direct comparisons among different detection algorithms. The evaluation and analysis module provides several widely adopted evaluation metrics and rich analysis tools to facilitate further evaluations and analysis. 2) Comprehensive evaluations: We evaluate 15 saate-of-the-aee detectors with 9 deepfake datasets under wide range of evaluation settings, providing holistic performance evaluation of each detector. Moreover, we establish a unified evaluation protocol that enhances the transparency and reproducibility of performance evaluation. 3) Extensive analysis and new insights: We provide extensive analysis from various perspectives, not only analyzing the effects of existing algorithms but also uncovering new insights inspire new technologies. In summary, we believe DeepfakeBench could constitute substantial step towards calibrating the current progress in the deepfake detection field and promoting more innovative explorations in the future.
2 Related Work
Deepfake Generation Deepfake technology, which generally centers on the artificial manipulation of facial imagery, has made considerable strides from its rudimentary roots. Starting in 2017, learning- based manipulation techniques have made significant advancements, with two prominent methods gaining considerable attention: Pnce-Swapping and Rece-Reenatt 1) Face-swapping constitutes significant category of deepfake generation. These techniques typically involve autoencoder-basee manipulations, which are based on two autoencoders with a shared encoder and two different decoders. The autoencoder output is then blended with the rest of the image to create the forgery image. Notable face-swapping datasets of this approach include UADFV [21], FF-DF [7], CelebDF [23], DFD [9], DFDC [8], DeeperForensics- 1.0 [17], and ForgeryNet [31]. 2) Face-reenactment is characterized by graphics-based manipulation techniques that modify source faces imitating the expressions of a different face. Neural Textures [41] and Face2Face [42], utilized in FaceForensicst+, stand out as standard face-reenactment methods. Face2Face uses key facial points to generate varied expressions, while NeuralTexture uses rendered images from 3D face model migrate expressions.
Deepfake Detection Current deepfake detection can be broadly divided into three categories: naive detector, spatial detector, and frequency detector. 1) Naive detector employs CNNs to directly distinguish deepfake content from authentic data. Numerous CNN-based binary classifiers have been proposed, e.g., MesoNet [1] and Xception [33]. 2) Spatial detector delves deeper into specific representation such as forgery region location [28], capsule network [29], disentanglement learning [50, 24], image reconstruction [2], crasing technology [45], etc. Besides, some other

---

Feature/ / Paper
DeepfakeBench
Paper [25]
Scope of Deepfake
Face-swapping Diffusion + GAN
Face-swapping
Number of Detectors
15
11
Number of Datusets
8
Code Open Source
Not yet
Modular and Extensible Codebase
User-Friendly APIs
Customizable Preproesssing Module
Unified Training Framework
Rich Analysis Tools
Analysis of FLOPs
Evaluation Metries
AUC, AP, ACC, EER, Precision, Recall
AUC
Table 2: Comprehensive comparison of our benchmark with existing benchmark [25].
methods specifically focus on the detection of blending artifacts [22, 20, 3]. generating forged images during training in self-supervised manner to boost detector generalization. 3) Frequency detector addresses this limitation by focusing on the frequency domain for forgery detection [13, 32, 26, 27]. SPSL [26] and SRM [27] are other examples of frequency detectors that utilize phase spectrum analysis and high-frequency noises, respectively. Qian el al. [32] propose the use learnable filters for adaptive mining of frequency forgery clues using frequency-awand image decomposition.
Related Deepfake Surveys and Benchmarks The growing implications of deepfake technology have sparked extensive research, resulting in the establishment of several surveys and dataset bench- marks in the field. 1) Surveys provide detailed examination of various facets of deepfake technology. For instance, Westerlund et al. [49] present thorough analysis of deepfake, emphasizing its legal and ethical dimensions. Tolosana et al. [43] furnish a comprehensive review of face manipulation techniques, including deepfake methods, along with approaches to detect such manipulations. 2) Benchmarks in this field have emerged as essential tools to provide realistic forgery datasets. For instance, FaceForensics (FF++) [33] serves manipulated videos and a variety of forgery types. The Deepfake Detection Challenge Dataset (DFDC) [10] introduces a diverse range of actors across different scenarios.
prominent benchmark, offering high-quality
While these benchmarking methodologies have made significant contributions, they specifically focus on their own datasets, without offering standardized way to handle data across different datasets, which may lead inconsistencies and obstacles to fair comparisons. Also, the lack of a unified framework in some benchmarks could lead to variations in training strategies, settings, and augmentations, which may result in discrepancies in the outcomes. Furthermore, the provision of comprehensive analytical tools is not always prominent, which might restrict the depth of analysis on the potential impacts of different factors. One notable work [25] aims to build a benchmark for evaluating various detectors under different datasets. Another recent work [18] introduces benchmark centered around detecting GAN-generated images using continual learning. However, these two benchmarks still lack modular, extensible, and comprehensive codebase that includes data preprocessing, unified settings, training modules, evaluations, and a series of analytical tools. BeepfakeBench, on the other hand, presents concise but comprehensive benchmark. Its contributions are threefold: introducing a unified data management system for consistency, offering an integrated framework for implementing advanced methods, and analyzing the related factors with a series of analysis tools. Detailed comparisons between our Deepfake and [25] are shown in Tab.2.
3
Our Benchmark
3.1 Datasets and Detectors
Datasets
Our benchmark currently incorporates a collection of 9 widely recognized and exten- sively used datasets in the realm of deepfake detection: FaceForensies+* (FF++) [33], CelebDF-v1 (CDFv1) [23]. CelebDF-v2 (CDFv2) [23]. DeepPakeDetectton (DFD) [9], DeepFake Detection
Challenge Preview (DFDC-P) [11], DeepFake Detection Challenge (DFDC) [10], UADFV [21],
FaceShifter (Fsh) [19], and Deeperfoorensics-1.. 1.0 (DF-1.0) [17]. Notably, FF++ contains 4 types of
manipulation methods: Deepfakes (FF-DF) [7], Face (FF-F2F) [42], FaceSwap (FF-FS) [14],
NeuralTextures (FF-NT) [41]. There are three versions of FF++ in terms of compression level, i.c.,
3

---

Evaluation & Analyais Module
Evaluation
Analysis
Propancy
Training Module
Naive
Spatial Detector
Frequency Detector
Faegson Ranglem
Thaning Singlees
Thening Sumpras
Dosgrel Appritin
Traniig Senglees
Freganey
Processing Module
Preprocessing
Lantrotts
Data Arrangement
Towey Jandssts
Premen
Der Vadeo
Alaxe di Crty Facts
Alland Pace
Rearrange
Extecled
Dergrry Region
Pronided
JSON File
Figure 1: The general structure of the modular- based codebase of DeepfakeBench.
raw, lightly compressed (c23), and heavily compressed (c40). The detailed descriptions of each dataset presented in the Sec. A.3 of the Appendix. Typically, FF++ is employed for model training, while the rest are frequently used as testing data. However, our benchmark allows users to select their combinations of training and testing data, thus encouraging custom experimentation.
is notable that, although these datasets have been widely used in the community, they are not usually provided in readily accessible and combined format. It often requires substantial investment of time and effort data sourcing, pre-processing (e.g., frame extraction, face cropping, and face alignment), and organization of the datasets, which are often organized in diverse structures. This considerable data preparation overhead often diverts researchers' attention away from the core tasks like methodology design and experimental evaluations. To tackle this challenge, benchmark offers a collection of well-processed and systematically organized datasets, allowing researchers to devote more time the core tasks. Additionally, our benchmark enriches some datasets (c.g-, FF++ [33] and DFD [9]), by including mask data (i.e., the forgery region) that is aligned with the respective facial images in these datasets. could facilitate more comprehensive deepfake detection studies. In summary, our benchmark provides a unified, user-friendly, and diversified data resource for the deepfake detection community. It eliminates the cumbersome task of data preparation and allows researchers to concentrate more on innovating effective deepfake detection methods.
Detectors Our benchmark has implemented a total of 15 established deepfake detection algorithms, detailed in Tab. 1. The selection of these algorithms is guided by three criteria. First, prioritize methods that hold a classic status (e.g., Xception), or those considered advanced, typically published computer vision or machine learning. Second, our
in recent top-tier conferences or journals benchmark classifies detectors into three categories; naive detectors, spatial detectors, and frequency detectors. Our primary emphasis on image forgery detection, hence, temporal-bass detectors have not yet been incorporated. Moreover, we have refrained from including traditional detectors (c.g., Headpose [51]) due to their limited scalability to large-scale datasets, making them less suitable for our benchmark's 's objectives. Third, we aim to include methods that are straightforward to implement and reproduce. We notice that several existing methods involve series of steps, some of which reliant on third-part algorithms or heuristic strategies. These methods usually have numerous papper-parmmeters and are fraught with uncertainty, making their implementation and reproduction challenging. Therefore, these methods without open-source codes intentionally excluded from our benchmark. However, it important to note that there are also some non-open-source methods employed that are derived from the code directly provided by their respective authors.

---

3.2 Codebase
We have built an extensible podular-based codebase as the basis of DeepfakeBench. As shown in Fig. 1, it consists of three core modules, including Data Processing Module, Training Module, and Evaluation and Analysis Module.
Data Processing Module The Data Processing Module includes two pivotal sub-modules that automate the data processing sequence, namely the Data Preprocessing and Data Arrangement sub-modules. 1) Data preprocessing sub-module presents a streamlined solution. First, Users provided with a YAML configuration file, enabling them to tailor the preprocessing steps to their specific requirements. Second, we furnish a unified preprocessing script, which includes frame extraction, face cropping, face alignment, mask cropping, and landmark generation. 2) Data arrangement sub-module further augments the convenience of data management. This sub-module comprises suite of JSON files for each dataset. Users can execute rearranged script to create unified JSON file for each dataset. This unified file provides access to the corresponding training. testing, and validation sets, along with other information such as the frames, landmarks, masks, elc, related to each dataset.
Training Module The Training Module currently accommodates 1.5 detectors across three cate- gories: naive detector, spatial detector, and frequency detector, all of which are shown in Tab. 1. 1) Naive detector leverages various CNN architectures directly detect forgeries without relying on additional manually designed features. 2) Spatial detector builds upon the backbone of CNNs used in the Naive Detector and further explores manual-designed algorithms to detect deepfake. 3) Frequency detector focuses on utilizing information from the frequency domain and extracting frequency artifacts for detection. Each detector implemented in our benchmark is managed in a streamlined and efficient way, with YAML config file created for each one. This allows users to easily set their desired parameters, e.g-, batch size, learning rate, ele. These detectors are trained on unified trainer that records the metries and losses during the training and evaluation process. Thus, the training and evaluation processes, logging, and visualization are handled automatically, eliminating the need for manual specification.
Evaluation and Analysis Module For evaluation, we employ 4 widely used evaluation metrics: accuracy (ACC), the area under the ROC curve (AUC), average precision (AP), and equal error rate (EER) Besides, it is notable that there is an inconsistency in the usage of these evaluation metrics in the community, some to unfair comparisons. Our benchmark currently adopts the frame level evaluation to build a fair basis for comparison among detectors. In addition to the evaluation values of these metrics, also provide several visualizations to facilitate performance comparisons, e.g., the ROC-AUC curve, radar chart, and histogram. For analysis, we provide various visualization tools to gain deeper insights into the detectors' performance. For example, Grad-CAM [36] is used to highlight the potential forgery regions detected by the models, providing interpretability and assisting understanding the underlying reasoning for the model's predictions. To explore the learned features and representations, we employ t-SNE visualization [44]. Furthermore, we offer custom visualizations tailored to specific detectors. For example, for Face X-ray [20], we provide visualizations of the detection boundary of the face, as described in its original paper (see the top-right corner of Fig. 1).
the frame level, while others are at the video level, leading
Evaluations and Analysis
4.1 Experimental Setup
In the data processing, face detection, face cropping, and alignment are performed using DLIB [35]. The aligned faces are resized to 256 x 256 for both the training and testing. In the training module, we employ the Adam optimization algorithm with a learning rate of 0,0002. The batch size is fixed at 32 for all experiments. We sample 32 frames for each video for training and testing. We primarily leverage pre-trained backbones from ImageNet if feasible. Otherwise, we resort to initializing the remaining weights using a normal distribution. We also apply widely used data augmentations, i.e., image compression, horizontal flip, rotation, Gaussian blur, and random brightness contrast. In terms of evaluation, we compute the average value of the top-3 metries (e.g., average top-3 AUC) as our evaluation metric. We also report other metrics (i.e., AP, EER, Precision, and Recall) in the Sec. A.3 of the Appendix. Further details of dataset configuration, algorithms implementation, and full training details can be seen in the Sec. A. Sec. A.2, and Sec. A.3 of the Appendix, respectively.
5

---

Willin Dumeein Evalutioon
Cross Dunaiin Evaluation
Type
Detector
Bockbour
FP-423
FF-e8)
FE-D0
ER-E2F
FF-ES
FENT
Asg.
Topo CEPVI
CORV2
DE-LO
DEDC
DFCCP
LADFY
Aug. Tops
Natee
Mood [1)
MoeNi
01677
BATT
IL5IDI
0L718
0.9944
0.5000
0.7100
Naive
Moulteep[1 [1]
MosNii
0,753
0.7378
0.552
0.6667
6,742
0
0.757
0.7366
0.096
09233
0,0099
06236
0.7561
0.658
0,949
0,7364 3
Naive
CSN-Asg (45)
RoNe
0,543
0.7546
0,004
0L575S
0L7313
D8419
0.7420
0.7022
0.7933
0.6464
06361
0.5665
0.839
07020
0
Vaho
Nerpion
Napuizr
019677
0.8761
01979
BSTR5
METT
D3950
0.776
0TWS
0.5411
88163
7774
0 9.799
03718
Naire
Ribocetb4
Speial
Capeate
Capuza
018421
0.3010
19999
CNTH
0.7409
DLARS
DWSSS
07198
Spxial
PWA
Naptize
0,539
Soxial
Xeny (20)
Sprial
Noptior
Spaial
LUKE [X]]
Acppiize
018194
0/9/97
BUBIC
CURLT
L19431
0L7798
0.5115
0.3015
02244
BA002
0.442
11784
Spiral
Bezze [:]
Denggned 010621
(U8190
D09422
00557
0.5319
EL7985
0.819
IUT3S
Spxial
UCF [50]
Noytiox
0,9718
6:8399
0.5853
0.5540
8.9896
0L9441
0.9227
0.7793
0,7527
0.8241
0.5074
0.7191
0.7944
0,6402
0,9518
0,7601 5
Iroqancy
22N6 (12]
Aceptize 01063
018271
0.933
CUS44
L4944V
OL7189
01782
0.6431
0.993
07754
0L3914
1US45
Faguas
SPSL, [20]
0.9610
0.8174
0.9781
0.5744
0.0025
0,9099
0.9406
8:3100
0.7680
0.3767
0.122
0.7040
0.7408
0.6457
0,9424
07776
3
Faquasa
SRM [27]
Noytion
0.9576
0,8114
0.973
0.5666
C.740
0,9095
0.925
0.7926
0 7502
0.8638
0.1100
0,6595
0.7408
066044
0,9427
0,3700 2
Table 3: Within- and cross-domain evaluations using the AUC metric. All detectors are trained on FF-c23 and evaluated on other data. "Avg." donates the average AUC for within-domain and cross-domain evaluation, and the overall results. "Top3" represents the count of each method ranks within the top-3 across all lesting datasets. The best-performing method for each column is highlighted in red.
Xception
Fillat
0.5e
0000
0302 930
6:60
Figure 2: Visualization of heat maps showing the cross maniplaannnotaoonn evaluation results. The color represents the AUC performance index the corresponding detector under specific test data, and the darker the color, the better the performance. All heat maps use uniform color scale for performance comparison.
4.2 Evaluations
In this section, we focus on performing two types of evaluations: 1) within-domain and cross- domain evaluation, and 2) crass-maniinlation evaluation. The purpose of the within-domain evaluation is to assess the performance of the model within the same dataset, while cross- droms-d evaluation involves testing the model different datasets. We also perform cross manipulation evaluation to evaluate the model's performance on different forgeries under the same dataset.
Within-Domain and Cross-Domain Evaluations In this evaluation, we specifically train the model using FF++ (c23) as the default training dataset. Subsequently, we evaluate the model on a total of 14 different testing datasets, with 6 datasets for within-domall evaluation and 8 datasets for cross-domain evaluation. Tab. provides an extensive evaluation of various detectors, divided into Naive, Spatial, and Frequency types, based on both -tthin-domiin and cross cross-domain tests. Regarding the results in Tab. 3, we observe that, for the commendably, evidenced by high EfficientB4, and F3Net registered significant average scores, specifically 95.37% 94.50% 93.89% and 94.49% respectively. Furthermore, unexpected revelation comes from the performance of Naive Detectors. Astonishingly, Naive Detectors (e.g., Xception and EfficientB44, which essentially rely on straightforward CNN classifier, register high AUC values that are comparable to more sophisticated algorithms. This could potentially suggest that the performance leap from advanced Mlate-of-hee of-the-art methods to Naive Detectors might not be as substantial as perceived, particularly in consistent settings (e.g., pre-training or data augmentation). In other words, the performance gap could be a product of these additional factors rather than the intrinsic superiority of the method. To delve deeper into this phenomenon, we will investigate the impact of data augmentation, backbone architecture, pre- mra-trannng. and the number of training frames in the following section (see Sec. 4.3).
evaluations, a majority of the detectors performed AUC. Remarkably, detectors such as UCF, Xception,

---

DeNCS UPLL NNTOOk Heo
DiNudo: MPA Nrroes CHECEAZ
DOWCEESSP 5/S) NIE 212
DINDX: 3PLL Nittra EXecP
300
6412
Commantion
die
Cit
Jeweer teen
Deeczer councee Tee (enc/e)
Ju
Cniy fork
Figure 3: Visualization of different augmentation methods. We apply two detectors, one in the spatial domain (Xception) and one in the frequency domain (SPSL.), and then use 8 different augmentation strategies to measure the effect on 5 test datasets.
Figure 4: Visualization of the performance of 3 different backhones, ResNet, EfficientNet-B4, and Xception. across different detectors, CORE, SPSL, UCF and Face X-ray. The evaluation is conducted using the AUC m following the settings described in the previous section.
Cross-Manipulationn Evaluations We also conduct a cross mosssmmanpplltiion evaluation to assess the model's performance on various manipulation forgeries within the same dataset (FF++ [33]). In this evaluation, only the forgery algorithm is altered. Other factors such as background and identity remain consistent across all the different forgeries. Fig. 2 compares the manipulaann detection performance of 10 detectors. Upon examining the figure, it becomes evident that the issue of generalization is prominent. While detectors such as CORE, EfficientB4, SPSI., SRM, and Xception exhibit excellent performance on the FF-DF test data when trained on FF-D,, their performance significantly deteriorates when faced with FF-FS forgeries. Furthermore, the "FT-NT" test data poses challenges for almost all detectors, as reflected by the diminished AUC values in this category throughout the heatmaps. In contrast, the "FT-DF" test data emerged as comparatively facile challenge for the detectors. In summary, the varying nature of forgeries highlights a significant generalization gap. Models trained on specific forgeries often struggle to adapt to other unseen forgeries. This underscores the importance of training models to recognize generic forgery artifacts to better combat unseen forgery types.
4.3 Analysis
Effect of Data Augmentation We assess the influence of various augmentation techniques on the performance of forgery detectors in this section. Specifically, we investigate the impact of rotations, horizontal flips, image compression, isotropic scaling, color jitter, and Gaussian blur on two prototyp- ical detectors: one from the spatial domain (Xception) and one from the frequency domain (SPSL.. Fig. 3 compares the performance when training these detectors with all data augmentations (denoted as "w "w_"ll"), without any data augmentations "ll",, and without a specific augmentation.
Our findings can be summarized into three main observations: First, in the case of Mithin-domain evaluation (as seen in the FF++_c2] dataset), removing all augmentations appears to improve detector performance by approximately 2% for both Xception and SPSL, suggesting that most augmentations may have a negative impact within this context. Second, for evaluations involving compressed data (FF++_o -FF++_c40), certain augmentations such as Gaussian blur demonstrate effectiveness in both Xception and SPSL detectors, as they simulate the effects of compression on the data during training. Third, in the context of cross-domain evaluations (CelebDF-v2, DFD, and DFDCP), operations like compression and blur may significantly degrade the performance of SPSL in the DFD and DFDCP datascts, possibly due to their tendency to obscure high- fregufryyyency details. Similar negative effects of
7

---

Averape Top AUC Xeeption
Avarage Top Resheette
Average Top Efficenheets
Figure 5: Visualization of the effect of pre-trained weights on three different architectures. The evaluation conducted using the AUC metric. following the settings described in the previous section.
the blur operation observed for Xception, likely as it diminishes the visibility of visual artifacts. These findings underscore the need for further exploration into identifying a universally beneficial augmentation that can be effectively utilized across wide range of detectors in generalization scenarios, irrespective of their specific attributes or datasets.
Model
FF++_22
FF++_c40
CDF-v2
DFD
DFDCP
UADFV
Average
0.8493
0.7846
0.7027
0.6464
0.6170
0.8739
0.7456
ResNet- DSC
0.8968
0.8048
0.7582
0.7006
0.6766
0.8895
0.7877
Improvement (%)
+5.6
60%
+2.57%
+7.90%
+8.39%
+9.64%
+1.78%
+5.64%
Table 4: Ablation study regarding the effectivvness of the depthwise separable convolution module (DSC) for ResNet. The models are trained on FF++ _c23 and tested other datasets. The metric is the frame-level AUC.
Effect of Backbone Architecture We here investigate the impact of different backbone architec- tures on the performance of forgery detection models. Specifically, we compare the performance of three popular backbones: Xception, EfficientNec-BD B4, and ResNet34. Each backbone is integrated into the detection model, and its performance evaluated on both within-domain and cross-domain datasets (see Fig. 4). Our findings reveal that Xception and EfficientNet-B4 consistently outper- form ResNet34, despite having similar number of parameters. This indicates that the choice of backbone architecture plays crucial role in detector performance, especially when evaluating the Deepfake dataset using CORE. In summary, these results highlight the critical role of carefully selecting a suitable backbone architecture in the design of deepfake detection models. Further research in this direction holds the potential for advancing the field in the future.
Additional In-depth Analysis towards the Effect of Backbone Architecture When analyzing the effect of backbone architecture, our analysis in Sec. 4.3 shows that Xception and EfficientNet-BA work better than ResNet-34. Given the three architectures have similar numbers of parameters, we are curious about why there exists an obvious performance gap among the three architectures. Here, we dive deeper to explore the possible reasons.
After our preliminary investigation, we found that the reasons are related to two factors, namely architecture and models' scale. First, we identify common module in EfficientNet and Xception that is not present in ResNet, namely the depthwise separable convolution module. We hypothesize that this module might be contributing to the performance advantage. To evaluate this, we insert this module into ResNet, replacing only the first convolutional layer. Experiments demonstrate significant improvements on many test datasets (as shown in Tab. 4). Second, upon closer scrutiny, additional factors that might exert an impact on the ultimate performance come to light. These encompass the number of layers within the model architecture as well as the number of parameters associated with it. Referring to Tab. 8 in the Appendix, it becomes evident that the parameter numbers remain comparable among the three models. Subsequently, a comprehensive exploration is conducted to assess the impact of layer numbers. This assessment involves diverse range of ResNet variants, including ResNet 50 and ResNet 152. Results in Tab. 9 in our Appendix uncover that ResNet 50, characterized by a greater number of layers in comparison to ResNet 34, yields substantial enhancement in performance. However, when confronted with a higher layer count, as exemplified by ResNet 152, the extent of improvement becomes restricted.
8

---

Capsule
EfficientNeBB4
Face X-ray
Meso4
F3Net
Mesolnception
Xception
SPSL
FWA
FFD
CNN-Aug
RECCE
Deepfakes
Face2Face
FaceSwap
NeurlTexture
Figure 6: t-SNE visualization for each detector. These detectors trained and tested on FF++ (c23).
Effect of Pre-training of the Backbone This analysis focuses on the impact of pre-training on forgery detection models. Following the previous section, we analyze three typical architectures: Xception, EfficientNetB4, and ResNet34. Fig. 5 reveals that the pre-trained models can largely outperform their pre--retrd counterparts, especially in the case of Xception (about 10% in DFDCP) and EfficientB4 (about 10% in DeepFakcDetcction) This can be attributed to the ability of pre-trained models to capture and leverage meaningful low-level features. However, the benefits of pre-training are less pronounced for ResNet34, mainly due to its architectural design, which may fully exploit the advantages offered by pre-trained weights. Overall, our findings underscore the importance of both architectural choices and the utilization of pre-trained weights in achieving optimal forgery detection performance.
Visualizing Representations Deepfake detection can be considered representation learning prob- lem, where detectors learn representations through their backbones and employ various classification algorithms. It crucial assess whether the learned representations align with the expectations. To accomplish this, we utilize t-SNE [44] for analysis, which allows us to visualize the representation.
We examine t-SNE visualization from two perspectives. First, accurately differentiate between real and fake samples. This is achieved by assigning labels to the points in the t-SNE plot based on their corresponding ground truth. Second, delve deeper into the fake category and investigate whether the models capture common features across different forgery types rather than being overfitted specific forgeries. To conduct this analysis, train and test each detector on the FF++ (c23) dataset and visualize the t-SNE representation using the test data. Also, we visualize all the samples with their corresponding labels, where the Deepfakes, Face2Face. FaceSwap, and NeuralTextures represent different forgery types in FF++. For visualization purposes, we randomly select 5000 samples, with an equal distribution of 2500 real and 2500 fake samples. Default parameters are used for t-SNE.
whether the detectors can
From the t-SNE results shown in Fig. 6, we observe that different detectors learn distinet feature rep- resentations the visualized space. Notably, the results indicate that Meso4 struggles to differentiate between real and fake samples, the two categories overlap and cannot be clearly distinguished.
Conclusions, Future Plans, and Societal Impacts
Conclusions We have developed BeepfakeBench, a groundbreaking and comprehensive framework, emphasizing the benefits of modular architecture, including extensibility, maintainability, faimess,

---

and analytical capabillit. We hope that DeepfakeBench could contribute to the deepfake detection community in various ways. First, it provides a concise yet comprehensive platform that incorporates a tailored data processing pipeline, and accommodates wide range of detectors, while also facilitating a fair and standardized comparison among various models. Second, it assists researchers swiftly comparing their new methods with existing ones, thereby facilitating faster development and iterations. Last, the in-depth analysis and comprehensive evaluations performed through our benchmark have the potential to inspire novel research problems and drive future advancements in the field.
Limitations and Future Plans To date, Deepfake primarily focuses on providing algorithms and evaluations at the frame level. We will further enhance the benchmark by incorporating video- level detectors and evaluation metrics. This expansion will enable more comprehensive assessment of forgery detection performance, considering the temporal dynamics and context within videos. Besides, we also plan to carry out more evaluations for detecting images directly produced by diffusion or GANs, using the existing benchmark. In the current version, we have provided the visualizations and analysis for GAN-generated and diffusion- generattd data in the frequency domain (see Sec. A.4 in the Appendix). Furthermore, aim to include wider range of typical detectors and datasets to offer a more comprehensive platform for evaluating the performance of detectors. Deepfake will continue to evolve as valuable resource for researchers, facilitating the development of advanced deepfake detection technologies.
Societal Impact and Ethical Issue The potential ethical issue lies in the risk that malicious actors might exploit BeepfakeBenche refine deepfakes to evade detection. 1) Inherent challenge with benchmarking: Deepfake Bench, like any benchmark created for positive intent, could inadvertently provide blueprint for these actors due to transparent nature. 2) Potential solutions and forward path: As solutions, we are contemplating controlled access for users and are committed to the dynamic evolution of DeepfakeBench to ensure remains robust against emerging threats.
6 Contents in Appendix
The Appendix accompanying this paper provides additional details. The Appendix is organized as follows: 1) Details of data processing This section provides further elaboration on the data processing steps, including face detection, face cropping, alignment, and etc. 2) Details of algo- rithms implementation and visualizations This section dives into the implementation details of the algorithms used in the study. It also includes additional visualizations to help readers gain a deeper understanding of the experimental results. 3) Training details and full experimental results: This section presents comprehensive details of the training process, including additional evaluation metrics beyond those reported in the main paper. 4) Other amalysis results: This section conducts analysis on some parts that are not analyzed in detail in the main text, such as analyzing and visualizing the frequency domain analysis of images generated by GAN and diffusion, etc.
7
Acknowledgement
This work supported by the National Natural Science Foundation of China under grant No. 62076213, Shenzhen Science and Technology Program under grant No. 11TX2000009100057707 No. ZDSYS2021 1120111111111111111 14150225, No. GXWD20201231 D 105222002220000000000 2000000000100000000 and the Guangdong Provincial Key Laboratory of Big Data Computing, the Chinese University of Hong Kong, Shenzhen.
References
[1] Darius Afchar, Vincent Nozick, Junichi Yamagishi, and Isao Echizen. Mesonet: compact facial video forgery detection network. In 2018 IEEE International Workshop on Information Forensics and Security, pages 1-7. IEEF, 2018. 2, 6, 17,21
[2] Junyi Cao, Chao Ma, Taiping Yao, Shen Chen, Shouhong Ding, and Xiaokang Yang. End-to-end coannstructionccassffcaaaa learning for face forgery detection. In Proceedings of the IEEE/CVF Confer- ence on Computer Vision and Pattern Recognition, pages 4122-4122, 2022. 2, 18
[3] Liang Chen, Yong Zhang, Yibing Song. Lingqiao Liu, and Jue Wang. Self-supervised learning of adversarial example: Towards good generalizations for deepfake detection. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pages 18710-1877 2022. 1,3, 14, 21,
10

---

[4] Liang Chen, Yong Zhang, Yibing Song, Jue Wang, and Linggiao Liu. Ost: Improving generalization of deepfake detection via one-shot test-time training. In Nips, 2022. 21
[5] François Chollet. Xception: Deep learning with depthwise separable convolutions. In Proceedings of the IEEE/CVF Conference on Computer Vision and Puttern Recognition, pages 1251-1258, 2017. 2, 18, 19
[6] Hao Dang, Feng Liu, Joel Stehouwer, Xiaoming Liu, and Anil K Jain. On the detection of digital facc manipulation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Puttern Recognition.
2020. 2, 6, 18
[7] DeepFakes. www www.gi www.githun githu.. com//beepaakes//tcceaaa Accessed 2021-04-24. 2,3
[8] Deepfake detection challenge. httpp:////uu..gggg.aacccccccceee
httpa/agggel..cc//eeeeeaeeeeeeee wttpc/////cccc//cccccccc htt.:/depppaake-ddeettttttoo chaneeeneeneaaeeeeeeeeee Ac-
cessed 2021-04-24, 2
[9] DFD. /ttpa://ai./ html Accessed 2021 -04-24... 2, 3, 4, 15, 21
[10] Brian Dolhansky, Joanna Bitton, Ben Pflaum, Jikuo Lu, Russ Howes, Menglin Wang, and Cristian Canton Ferrer. The deepfake detection challenge dataset. arXiv preprint arXiv: 2006607377 2020. 3, 17, 20, 21
[11] Brian Dolhansky, Russ Howes, Ben Pflaum, Nicole Baram, and Cristian Canton Ferrer. The deepfake detection challenge (dfde) preview dataset. arXiv preprint arXiv: 1910.0884,, 2019. 3, 17, 20, 21
[12] Shichao Dong, Jin Wang, Renhe Ji, Jiajun Liang. Haoqiang Fan, and Zheng Ge. Implicit identity leakage: The stumbling block to improving deepfake delection generalization. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages
2023. 31
[13] Ricard Durall, Margret Keuper, and Janis Keuper. Watch your up-convolution: Cnn based generative deep neural networks are failing to reproduce spectral distributions. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 7890-7899, 2020. 3
[14] FaceSwap. www. github. hoop//aarekkoallkkkaaaaaaaa
Accessed 2021-04-24.
[15] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Spatial pyramid pooling in deep convolutional networks for visual recognition. IEEE Transactions Pattern Analysis and Machine Intelligence, 1999)1190--1916, 2015. 18
[16] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 770-778,
2016. 2, 17, 18
[17] Liming Jiang, Ren Li, Wayne Wu, Chen Qian, and Chen Change Loy. Deeperforensies-1. 1.0: A large-scale dataset for real-world face forgery detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2020. 2, 3, 17, 20, 21
[18] Chuqiao Li, Zhiwu Huang, Danda Pani Paudel, Yabin Wang, Mohamad Shahhazi, Xiaopeng Hong, and Luc Van Gool. continual deepfake detection benchmark: Dataset, methods, and essentials. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, pages 1339-1349. 2023. 3
[19] Lingzhi Li, Jianmin Bao, Hao Yang, Dong Chen, and Fang Wen. Advancing high fidelity identity swapping for forgery detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 5074-5000000 5083, 2020. 3, 20, 21
[20] Lingzhi Li, Jianmin Bao, Ting Zhang, Hao Yang, Dong Chen, Fang Wen, and Baining Guo. Face x-ray for more general face forgery detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2020. 2, 3, 5, 6, 15, 18, 19, 21,
[21] Yuezun Li, Ming Ching Chang, and Siwei Lyu. In ictu oculi: Exposing ai created fake videos by detecting eye blinking. In 2018 IEEE International Workshop on Information Forensics and Security, 2018. 3, 17, 20,
[22] Yuezun and Siwei Lyu. Exposing deepfake videos by detecting face warping artifacts. arXiv preprint arXiv:181 1.006, 2018. 1, 2, 3, 6, 15, 18, 19, 21
[23] Yuezun Li. Xin Yang. Pu Sun, Honggang Qi. and Siwei Lyu. Celeb-df: A new dataset for deepfake forensics. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2020.
2, 3, 17, 20, 21

---

[24] Jiahao Liang. Huafeng Shi, and Weihong Deng. Exploring disentangled content information for face forgery detection. In European Conference on Computer Vision. pages 128-145. Springer, 2022.
[25] Chenhao Lin, Jingyi Deng, Penghin Hu, Chao Shen, Qian Wang, and Qi Towards henchmarking and evaluating deepfake detection. arXiv preprini urXiv:2203.021133 2022. 3
[26] Honggu Liu, Xiaodan Li, Wenho Zhou, Yuefeng Chen, Yuan He, Hui Xue, Weiming Zhang, and Nenghai Yu. Spatial-phase shallow learning: rethinking face forgery detection in frequency domain. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2021. 2, 3, 6, 19.
[27] Yuchen Luo, Yong Zhang, Junchi Yan, and Wei Liu. Generalizing face forgery detection with high- frequency features. In Proceedings of the IEEE/CVE Conference on Computer Vision and Pattern Recognition, 2021. 2, 3, 6, 19, 31
[28] Huy II Nguyen. Fuming Fang, Junichi Yamagishi, and Isao Echizen, Multi-task learning for detecting and segmenting manipulated facial images and videos. In IEEE International Conference on Biometrics Theory, Applications and Systems, pages 1-8, IEEE, 2019. 2, 15
[29] Huy Nguyen, Junichi Yamagishi, and Isao Echizen. Capsule-forensiee Using capsule networks to delect forged images and videos. In IEEE International Conference on Acoustics, Speech and Signal Processing, pages 2307-2311 1. IEEE, 2019. 2, 6, 18
[30] Yunsheng Ni, Depu Meng, Changqian Yu. Chengbin Quan, Dongchun Ren, and Youjian Zhao. Core: Consistent representation learning for face forgery detection. In Proceedings of the IEEE/CVF Conference Computer Vision and Puttern Recognition Workshop, pages 12-21, 2022. 2, 6. 18
[31] Ivan Perov, Daiheng Gao, Nikolay Chervoniy. Kunlin Liu, Sugasa Marangonda. Chris Umé, Mr Dpfks, Carl Shift Facenheim, Luis RP, Jian Jiang, et al. Deepfacelab: A simple, flexible and extensible face swapping framework. arXiv preprint arXiv:2005.05533. 2020. 2
[32] Yuyang Qian, Guojun Yin, Sheng, Zixuan Chen, and Jing Shao. Thinking frequency: Face forgery detection by mining mequency-awan clues. In European Conference Computer Vision, pages 86-103. Springer, 2020. 2. 6, 19
[33] Andreas Rossler, Davide Cozzolino, Luisa Verdoliva, Christian Riess, Justus Thies, and Matthis Nießner. Faceforensics++: Learning to detect manipulated facial images. In Proceedings of the JEEE/CVF Confer- ence on International Conference on Computer Vision, pages 1- 11, 2019. 1, 2, 3, 4, 6, 7, 15, 17, 18, 19,
20, 21, 29
[34] Sara Sabour, Nicholas Frosst, and Geoffrey Hinton. Dynamic routing between capsules. Advances in Newral Information Processing Systems, 30, 2017. 2, 18
[35] Christos Sagonas, Epameinondas Antonakos, Georgios Tzimiropoulos, Stefanos Zafeiriou, and Maja Pantic. 300 faces in-the-wild challenge: Databasc and results. Image and Vision Computing, 47:3-18,
2016. 5, 14
[36] Ramprasaath R Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedantam, Devi Parikh, and Dhruv Batra. Grad-cam: Visual explanations from deep networks via gradient-based localization. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 618-626, 2017. 5
[37] Kaede Shiohara and Toshihiko Yamasaki. Detecting deepfakes with self-blended images. In Proceedings of the IEFF/CVF Conference on Computer Vision and Pattern Recognition, pages 18720-18729, 2022. 18
[38] Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recogni- tion. arXiv preprint arXiv: 1409.1556, 2014. 18
[39] Christian Szegedy, Wei Liu, Yangqing Jia, Pierre Sermanet, Scott Reed, Dragomir Anguelov, Dumitru Erhan, Vincent Vanhoucke, and Andrew Rabinovich. Going deeper with convolutions. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 1-9, 2015. 17
[40] Mingxing Tan and Quoc Lc. Efficientnet: Rethinking model scaling for convolutional neural networks. In International Conference on Machine Learning, pages 6105-6114, PMLR, 2019. 2, 6. 18
[41] Justus Thies, Michael Zollhöfer, and Mathias Nießner. Deferred neural rendering: Image synthesis using neural textures. Transactions on Graphics, 3-14):1-12, 2019. 2,3
[42] Justus Thies, Michael Zollhofer. Mare Stamminger, Christian Theobalt, and Matthias NieBner. Face2face: Real- tiae face capture and reenactment of rgb videos. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2016. 2,3
12

---

[43] Ruben Tolosana, Ruben Vera-Rodriguez, Julian Fierrez, Aythami Morales, and Javier Ortega-Garcia. Deepfakes and beyond: A survey of face manipulation and fake detection. Information Fusion, 64:131- 148, 2020.
[44] Laurens Van der Maaten and Geoffrey Hinton. Visualizing data using Journal of Machine Learning Research, 2008.
[45] Chengrui Wang and Weihong Deng. Representative forgery mining for fake face detection. In Proceedings of IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2021.
[46] Jingdong Wang. Ke Sun, Tianheng Cheng, Borui Jiang, Chaorui Deng, Yang Zhao, Dong Liu, Yadong Mu, Mingkui Tan, Xinggang Wang, et al. Deep high-resolution representation learning for visual recognition. IEEE Trunsactions on Pattern Analysis and Machine Intelligence, 43 43(100:3349-3366 2020. 2, 18
[47] Junke Wang, Zuxuan Wu, Wenhao Ouyang, Xintong Han, Jingjing Chen. Yu-Gang Jiang, and Ser-Nam Li. M2tr: Multi-modal multi-scale transformers for deepfake detection. In JCMR, pages 615-623, 2022. 15
[48] Sheng- Wang, Oliver Wang, Richard Zhang, Andrew Owens, and Alexei Efros. Can-generated images are surprisingly easy to spot... for now. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 8695-877 8704, 2020. 2, 6, 17, 24, 25, 30
[49] Mika Westerlund. The emergence of deepfake technology: A review. Technology Innovation Management Review, 9(11), 2019.
[50] Zhiyuan Yan, Yong Zhang, Yanbo Fan, and Baoyuan Wu. Ucf: Uncovering common features for generalizable deepfake detection. arXiv preprint arXiv:2304.1390 2023. 2, 6, 18
[51] Xin Yang, Yuezun Li, and Siwei Lyu. Exposing deep fakes using inconsistent head poses. In IEEE International Conference on Acoustics, Speech and Signul Processing, pages 8261-8265. IEEE, 2019. 4
[52] Hanqing Zhao, Wenho Zhou, Dongdong Chen, Tianyi Wei, Weiming Zhang, and Nenghai Yu. Multi- attentional deepfake detection. In Proceedings of the IEEE/CVF Conference Computer Vision and
Pattern Recognition, 2021. 1, 18
[53] Peng Zhou, Xintong Han, Vlad I. Morariu, and Larry S. Davis. Two-stream neural networks for tampered face detection. In Proceedings of the IEEE/CVF Conference Computer Vision and Pottern Recognition Workshop. 2017.
[54] Mingjian Zhu, Hanting Chen, Qiangyu Yan, Xudong Huang, Guanyu Lin, Wei Li, Zhijun Tu, Hailin Hu, Hu, and Yunhe Wang. Genimage: million-seale benchmark detecting ai-generated image. arXiv preprint or Xiv:22006..08 08571, 2023. 25
13

---

A Appendix
A.1 Details of Data Processing
This section introduces data preprocessing script tailored for deepfake datasets. This script incorpo- rates a series of fundamental steps, including l'ace detection, face cropping, f'ace alignment, and various other preprocessing operations. These steps are of utmost importance as they facilitate the acquisition of consistent face images, thereby ensuring the effectiveness and reliability of subsequent analysis and model training. The following subsections describe each step in detail.
Overall Workflow The preprocessing script follows sequential workflow. It starts by detecting faces in each video frame using the Dlib [35] face detection algorithm. Once the faces are detected, the script proceeds to align and crop the faces based the detected facial landmarks. If a mask video file is provided, the script also extracts and saves the masks for each aligned face. The face images, landmarks, and masks are saved in separate folders but in the same directory for further analysis. The preprocessing script also supports parallel processing, which enables multiple videos to be processed simultaneously, improving the overall processing speed. Each video processed independently, and the results are saved separately to ensure data integrity and prevent conflicts. Throughout the preprocessing process, logging is used track the progress and any errors that occur. The log file provides detailed record of the preprocessing steps, allowing for easy troubleshooting and analysis of the preprocessing pipeline.
Face Detection The first step in the preprocessing pipeline is face detection. We employ the Dlib library, which provides an efficient face detection algorithm. The face detector scans each video frame and identifies the bounding boxes that enclose the faces.
Face Alignment Once the faces are detected, the next step is face alignment. Face alignment refers to the process of transforming the faces in the images to a standardized pose. In our preprocessing script, we use facial landmarks to perform face alignment. We utilize the Dlib library, which provides a pre-trained shape predictor model that can effectively detect facial landmarks. Using the shape predictor model, we extract the facial landmarks for each detected face in the image. Specifically, we extract the landmarks for the eyes, nose, and mouth. These landmarks serve as reference points for aligning and cropping the face. To align the faces, we use affine transformation, which is linear mapping that preserves the shape of the face. The transformation is estimated based on the detected landmarks and a set of target landmarks, which define the desired position and size of the face. We apply the transformation to the original image to obtain the aligned face.
Face Cropping After aligning the faces, the next step in the preprocessing pipeline is face cropping. To perform face cropping, we utilize the aligned faces obtained from the alignment step. To account for variations face size and position, we introduce one parameter: margin. The margin parameter determines the amount of space around the aligned face that is included in the cropped image. Too large of margin in the face cropping process can lead to the overfitting of the detection models the contextual information surrounding the face, rather than focusing on the facial features themselves. This may result in the model relying more on irrelevant background details and thus reducing its generalization performance on unseen data. On the other hand, using too small of a margin in the face cropping process can lead to incomplete facial information being captured in the cropped face images. This occurs because a small margin restricts the region of interest to only the immediate vicinity of the aligned face. As a result, important facial features or parts of the face that extend beyond this limited region may be excluded from the cropped images. Therefore, there may exist off when choosing the margin parameter in the face-cropping process. In this paper, we fix the margin to be 1.3 for all datasets following the previous work [3]. For the overall face cropping process, we first calculate the bounding box of the aligned face region. The bounding box is then expanded by applying the margin parameter, which increases the size of the region of interest. Finally, we resize the expanded bounding box to the desired scale, resulting in a cropped face image with consistent dimensions (fixed with 256x256 in this paper).
Landmark Extraction Extracting landmarks is an essential step in the preprocessing pipeline as it provides valuable information about facial structure and geometry. Landmarks are specific points on the face, such as the corners of the eyes, nose, and mouth, that serve reference points for various
14

---

Example 1
Exumple 2
Ocignal Frunz
Aligsed Fice
Original Faun
Aligned Face
Detected Landmark
Detected Landnock
Original Mask
Origical Mask
Aligned Mark
Aligned Mask
Figure 7: Illustration and visualization of the preprocessing procedure. We perform face detection and aligned cropping to the frame and its corresponding mask.
facial analysis algorithms. Several algorithms, such Face X-ray [20], FWA [22]. SLADD [3], etc. rely on landmarks to perform operations and analysis on facial images. By extracting landmarks during the preprocessing step, we aim provide comprehensive dataset that includes both the aligned face images and the corresponding landmark coordinates. Users can leverage landmarks to develop and train models without the need for additional face- detectinnn steps during training, thereby reducing computational overhead and improving training speed.
Mask Extraction (Optional) some deepfake datasets (i.e., FaceForensicst+ [33] and DFD [9]) an additional mask is provided, indicating the regions of the face that are manipulated modified. Also, we see that there are several works that rely on mask data for the detection, e.g., Multi-task [28]. Face X-ray [20], M2TR [47], etc. Thus, if the dataset includes masks, our script also extracts and saves these masks. Since we have performed the face alignment and cropping operations in the previous steps, we need to do the same operations for the mask data. To extract masks, we utilize the additional video files provided by the authors that contain the mask information for each frame. Note these mask video files have the same frame count and frame rate as the original video. During the face cropping step, a mask video file is provided, we extract the corresponding frames and masks for each video. The mask data is saved and frames. The masks can be used to identify specific areas of interest for further analysis or to train models that specifically focus on detecting manipulated regions.
separate folder but with the same dictionary the videos
Frame Sampling the preprocessing pipeline, we incorporate frame sampling techniques to strike balance between computational requirements and maintaining diverse set of examples. This step aims to extract a subset of frames from each video in the datasct. The frame sampling process depends on the specified mode, which can be either "fixed num frames" or "fixed stride" In the "fixed num frames" mode, we extract a fixed number of frames from each video. This approach ensures that the resulting dataset contains consistent number of frames for each video, regardless of the video's ' duration. By selecting a predetermined number of frames, we obtain a manageable dataset size that is suitable for subsequent analysis or model training. In the "fixed _triddest mode, we sample frames with a fixed stride. This means that we skip certain number of frames between each frame that is selected. This approach allows us capture frames at regular intervals throughout the video, providing representative sampling of the temporal dynamics. By choosing an appropriate stride, we can control the density of the selected frames and adjust the amount of temporal information included in the dataset. Frame sampling serves two primary purposes. Firstly, reduces the computational requirements for subsequent steps in the pipeline, such as face detection and alignment, by operating on subset of frames rather than the entire video. This improves the overall efficiency of the preprocessing process, particularly when dealing with large-scale datasets. Secondly, frame sampling ensures that the resulting dataset maintains diverse set of examples. By selecting frames regular intervals or a fixed number frames per video, we capture different facial expressions, poses, and actions exhibited by individuals. This diversity enhances the generalizability of models trained on the dataset, enabling them handle wide range of scenarios and variations encountered in real-world applications. Note in this paper only choose the "fixed num frames" mode.
15

---

Parallel Processing To improve the processing speed, we use parallel processing techniques. We leverage the concurvent, library, which provides a high-level interface for asynchronously executing callables. By using multiple processes, we can process multiple videos simultaneously. significantly reducing the overall processing time. The number of processes used determined based on the CPU capabilities of the system. We assign one process per CPU core to maximize the utilization of available resources.
Saving Processed Data After completing the preprocessing steps, save the processed data for future use. The cropped face images, extracted landmarks, and masks (if available) are saved in structured directory format. Each video is associated with separate directory, containing the processed frames, landmarks, and masks (if applicable). This organization allows for efficient data retrieval and analysis during subsequent stages.
Arrangement The process of rearranging the dataset structure is motivated by the need for unified and convenient way load different datasets. Each dataset typically has its own distinct structure and organization, making it hard and troublesome to handle them uniformly. This could involve writing separate input/output (I/O) code for each dataset, leading to duplication of effort and potential difficulties in managing the data.
To this end, we adopt unified approach by organizing and managing the dataset information using a JSON file. This enables a standardized structure that subsequent algorithms and models can easily process. By leveraging the JSON file format, we provide comprehensive and adaptable representation of the dataset, accommodating the specific requirements and characteristics of each dataset. The rearranged structure organizes the data a hierarchical manner, grouping videos based on their labels and data splits (i.c., train, test, validation). Each video is represented as dictionary entry containing relevant metadata, including file paths, labels, compression levels (if applicable), etc. This unified representation facilitates streamlined dataset loading and handling, eliminating the need for dataset-specific 1/O code.
The JSON file serves as a centralized repository of dataset information, providing consistent and easily accessible format. Users can leverage existing code and tools to parse and analyze the JSON file, promoting reproducibility and facilitating collaborations across different datasets. Additionally. the JSON file simplifies the data preprocessing pipeline. reducing duplication of effort and enhancing the efficiency of subsequent data analysis and model training processes.
The whole process of data preprocessing and arrangement can be summarized in the following Algorithm. 1.
Algorithm Data Preprocessing and Arrangement
I: Input: Video dataset
2: Output: Preprocessed dataset with rearranged structure
Procedure:
4: Perform the following preprocessing steps for each video the dataset:
5: Extract a subset of frames from each video using frame sampling techniques.
6: Detect faces in each video frame using the Dlib face detection algorithm.
7:
Align and crop the faces based on the detected facial landmarks using Dlib shape predictor model.
8:
(Optional) Extract and save masks for each aligned face provided.
9:
Extract landmarks for each detected face using Dlib shape predictor model.
10: Save the processed face images, landmarks, and masks (if applicable) in separate folders.
11: Use parallel processing speed up the overall processing time by processing multiple videos simultaneously.
12: Save the processed data in structured directory format with a JSON file containing metadata.
13: Return the rearranged dataset structure with metadata stored in the JSON file.
The provided config file contains settings for two different preprocessing tasks: "preprocess" and "rearrange". We will go through each section and explain the available settings and their advantages in this section.
Configuration
16

---

For the Preprocess:
dataset_namd name: This setting allows the user to specify the name of the dataset. Users can choose
from list of supported dataset names such FaceForensics++ [33], Celeb-DF-vl [23], Celeb-
DF-v2 [23], DFDCP [11], DFDC [10], DeeperForensics- 1.0 [17], and UADFV [21]. Each dataset has its characteristics and purpose.
dataset_roof paabset_rott_pathh patppphthhhhhh This setting defines the root path where the dataset is located. Users need to provide the path to the dataset directory.
comp: This setting is specific the FaceForensics++ dataset and determines the compression level of the videos. Users can choose from "raw", "c23", or "c40". Different compression levels have different trade-offs between video quality and file size.
mode: This setting determines the mode of preprocessing, either "fixed _um faramesss_" or "fixed_stride". stride".. In "fixed n_m__num__t__________ farm__srm_s""__ mode, users can specify the number of frames to ex- tract from each video using the mnum_frames" setting. the number of frames to skip between each frame extracted using the "stride" setting.
fixee_stride mode, users can specify
stride:
This setting is used when the mode is set to "fried_stride". stride". It determines the number of
frames to skip between each frame extracted. higher stride value will result fewer extracted frames.
num frames: This setting is used when the mode is set to "fixed num frames". It specifies the number of frames extract from each video. Extracting a fixed number of frames allows for consistent and manageable data sizes.
For the Arrangement:
dataset_name This setting allows users specify the of the dataset users want to rearrange.
dataset_rode poceee__roo__ptieee path: This setting defines the root path where the dataset is located.
output file path: This setting specifies the path where the output JSON file will be saved. The JSON file contains information about the rearranged dataset.
comp: This setting is specific to FaceForensics** dataset and determines the compression level of the videos. Users choose from "raw", "c23", or "c40".
perturbation: This setting is specific to the DeeperForensics-1.00 dataset and allows users to select different levels of perturbations to apply to the dataset. There are options such as "end_to__em" "end_te _en_ttte________e______eeeee level_ 1", "end to end mix 2 distortions", etc.
Dataset rearrangement is specifically designed for rearranging datasets. It provides the flexibility to modify and rearrange the dataset according specific needs. The script generates JSON file that contains information about the rearranged dataset. This file can be used for further analysis or as input other scripts models. By using this config file, users can easily customize the preprocessing and rearrangement tasks to suit their specific dataset and requirements. The flexibility offered by this file enables efficient and consistent preprocessing of various deepfake datasets.
A.2 Details of Algorithms Implementation and Visualizations
Algorithms Implementation In addition to the basic information in Tab. 2 of the main manuscript, here we describe the general idea of the implemented detection algorithms in the DeepfakeBench as follows.
1) Meso4 [1]: is CNN-based deepfake detection method targeting the mesoscopic properties of images. The model is trained on unpublished deepfake datasets collected by the authors. We evaluate two variants of MesoNet, namely, Meso4 and Mesolncep. Meso4 uses conventional convolutional layers.
2) MesoIncep [1]: this detector, similar to Meso4, utilizes a designed CNN architecture and also implemented in the MesoNet repository. Note that MesoIncep based on the more sophisticated Inception modules [39].
3) CNN-Aug [48]: detects GAN-generated images using ResNet [16] with widely-used augmenta- tions. In the BeepfakeBench, employ ResNet-34 [16] with JPEG compression and Gaussian
17

---

blurring augmentations, etc. The effect of augmentations we used in this work has been explored in Sec. 4 the main paper. The specific settings of the augmentations can be found in the following section in Sec. A.3.
4) EfficientNet-B4 [40]: is Based on the EfficientNet architecture [40]. We find that many detectors utilize this architecture as their basic backbone for feature extraction (e.g.. SBIs [37], multi- attention [52], etc). Also, we implement this framework in our benchmark, we can compare the performance of different basic architectures and find the improvement bring by only the architecture.
5) Xception [33]: corresponds to a deepfake detection method based on the XceptionNet model [5] trained on the FaceForensies++ dataset [33]. There three variants of Xception, namely, Xception-raw, Xceptionc23, and Xception-c40: Xception-raw is trained on raw videos, while Xception-c23 and Xception-c40 are trained on H.264 videos with medium (23) and high degrees (40) of compression, respectively.
6) Capsule [29]: uses capsule structures [34] based on VGG19 [38] network as the backbone architecture for deepfake classification. This model originally trained on the FaceForensics** dataset [33].
DSP-FWA [22]: detects deepfake videos using a ResNet-50 [16] expose the face-warping artifacts introduced by the resizing and interpolation operations in the basic deepfake maker algorithm. This model is trained on self-collected face images. In the original paper, DSP-FWA further improves the FWA algorithm by including spatial pyramid pooling (SPP) module [15] to better handle the variations in the resolutions of the original target faces. Note that in the DeepfakeBench, we do not adopt the SPP module since we try to use the same architecture (backbone) for each detector so that we can find the actually effective technologies toward deepfake detection. Instead, we use the standard Xception for this detection other detectors. However, we utilize the multi-scale strategy in the dynamic forgery data generation process to obtain different scale faces blending (the scale parameters we set are [0.2, 0.3, 0.4, 0.5, 0.6, 0.7, 0.8). Following its paper, we first align the face image to multiple scales and randomly select an ali aligned image. We visualize blending examples to show that our implementation can achieve similar forgery samples as the original paper (see Sec. A.2).
8) Face X-ray [20]: uses blended artifacts in forgeries to improve generalization ability to detect unseen forgeries. In this work, following the original paper, we train an HRNet [46] both with constructed blended images and fake samples from the considered datasets (FaceForensicss++ [33] in our main experiments). Note that the code for this detector is not publicly available, we re- implement it carefully following the instructions and settings in the original paper. We visualize blending examples to show that our implementation can achieve similar forgery samples as the original paper (see Sec. A.2).
9) FFD [6]: applies an attention mechanism to detect and localize manipulation regions. The author proposes two types of attention -badd layers, named manipulation appearance model and direct regression, guide the network focus discriminative regions. Mcanwhile, three types of loss functions are proposed to supervise the learning progress. In our implementation, we adopt the Xception [5] as the backbone and direct regression as the attention- layer train the model.
10) CORE [30]: explicitly constrains the consistency of different representations. Different repre- sentations are first captured with different augmentations, and then the cosine distance of the representations is regularized to enhance consistency. This detector utilizes the Xception back-
bone [5].
11) RECCE [2]: constructs a graph over encoder and decoder features in a multi-scale manner. further utilizes the reconstruction differences the forgery traces on the graph output as guide to the final representation, which fed into a classifier for forgery detection. End-to-end optimization for reconstruction and classification learning.
12) UCF [50]: introduces a multi-task disentanglement framework to address two main challenges that contribute to the generalization problem in deepfake detection: overfitting to irrelevant features and overfitting to method-specific textures. By uncovering common features, the framework aims to enhance the generalization ability of the model. This detector utilizes the Xception backbone [5]. The code for this detector is not publicly available, we re-implement carefully following the instructions and settings in the original paper.
18

---

VUCEE
Figure 8: Illustration and visualization of the DSP-FWA algorithm. We use the data from FaceForen-
sics++ [33] and apply some augmentations to the source image, as well as the blending image.
13) F3Net [32]: uses cross-attention two-stream networks to collaboratively learn frequency-aware clues from two branches: FAD and LFS, where the FAD module partitions the input image in the frequency domain based on learnable frequency bands and represents the image with frequency- aware components to learn forgery patterns through frequency-aware image decomposition, and the LFS module extracts localized frequency statistics to describe statistical discrepancies between real and fake faces, allowing for effective mining through CNNs and revealing unusual statistics of forgery images at each frequency band while sharing the structure of natural images. This detector utilizes the Xception backbone [5]. The code for this detector is not publicly available, we re-implement it carefully following the instructions and settings in the original paper.
14) SPSL [26]: combines spatial image and phase spectrum to capture the up-sampling artifacts of face forgery to improve the transferability (generalization ability), for face forgery detection. This paper theoretically analyzes the validity of utilizing the phase spectrum. Moreover, this paper notices that local texture information is more crucial than high-level semantic information for face forgery detection. This detector utilizes the Xception backbone [5]. The code for this detector is not publicly available, we re-implement it carefully following the instructions and settings in the original paper.
15) SRM [27]: extracts high-frequency noise features and fuses two different representations from RGB and frequency domains to improve the generalization ability. This detector utilizes the Xception architecture [6]. This detector utilizes the Xception backbone [5]. The code for this detector is not publicly available, we re-implement it carefully following the instructions and settings in the original paper.
Visualizations We implement all 15 detectors mentioned above. However, not all of them have publicly available code, so we implement some of them ourselves following the settings and instruc- tions provided in the original papers. This allowed us to verify the correctness of our implementation and gain better understanding of these detectors. To further assess the performance and behavior of the detectors, we conduct visualizations of the results for 2 specific detectors: DSP-FWA [22] and Face X-ray [20].
1) DSP-FWA: Note that the official code for DSP-FWA does not include the training code or the code for dynamically generating forgery data using self- beeeddinnngg in each iteration during training. To this end, we make use of certain parts of the code provided in the official repository and implement the training process and forgery data generation ourselves. In our implementation of DSP-FWA, we use the Xception network [5] as the backbone. This choice is to ensure consistency in the benchmark by using the same backbone network across different detectors. By doing so, we could focus solely evaluating the algorithmic performance of DSP- -WA itself. By incorporating own implementation of the training process and forgery data generation, we are able to overcome the absence of these components in the official code. This allows DSP-FWA and ensure a fair comparison with other detectors in our benchmark. We visualize the original images, blending masks, and blending images in Fig. 8.
thoroughly evaluate
2) Face X-ray: Note that the official code for Face X-ray is not available. So we re-implement the data manipulation and training process carefully following the instructions of the original paper. The visualizations can be seen in Fig. 10.
19

---

Real
Deepfakes
Face2Face
FaceSwap
NeurarTexturee
TWA-Blending
Figure 9: t-SNE visualization FWA-generated data. By assigning distinct labels to various forgeries, enhance the clarity of their representation within the feature space.
Fay
SYOKE
*9
Top Moni
Mosc
Mark
Moxi
DAMCRS Repoo
GaYSA Resion
CHANSAS TASSS
Srage
Suagon
Trogge
Figure 10: Illustration and visualization of the Face X-ray algorithm. We use the data from Face- Forensics++ [33] and apply some augmentations to the source image, as well as the blending image.
Furthermore, conduct 1-SNE analysis for FWA, visualizing labels in the feature space. Our find- ings suggest that images generated through blending technology (new data generated by FWA) exhibit distinctiveness, distancing them from images generated by alternative manipulation methodologies. This characteristic enlarges the forgery space, culminating in enhanced generalization capabilities.
A.3 Training Details and Full Experimental Results
Datasets Our benchmark currently incorporates collection of widely recognized and exten- sively used datasets in the realm of deepfake forensics: FaceForensics** (FF++) [33], CelebDF- vI [23], CelebDF-v2 [23], DeepFakeDetectton (DFD) [9], DeepFake Detection Challenge Preview (DFDC-P) [11], DeepFake Detection Challenge (DFDC) [10], UADFV [21], FaceShifter [19], and DeeperForensics-I1 0 (DF-1.0) [17]. The detailed descriptions of each dataset are presented in Tab.
The dataset splitting for different datasets used in deepfake detection is described as follows:
1) FaceForensics++ (FF++): The FF++ dataset is divided into several subsets, including FF-DF FF-F2F, FF-FS, FF-NT, and FF-all. Each subset corresponds to a combination of deepfake and real videos from YouTube. In the real dataset, the data is duplicated and split into three sets: train, test,
20

---

Danaset
Real Videos
Fake Videos
Total Videos
Rights Cleured
Total Subjects
Synthesis Medhods
Perurisaions
Downloud Link
Fite [33]
1000
4000
5000
NO
N/A
4
Hyper Link
PaceShifeer [19]
1000
2000
NO
N/A
Hyper link
1lyper
[11]
1151
YES
Htype--
DEDC [10]
23,054
104,500
128,154
YES
960
8
Hyper link
CelchDi-v v1 [23]
408
795
1203
NO
N/A
1
Hypper link
ColchDF-22 -22 [25]
590
5639
6229
NO
59
Hyper link
13--.0
50,000
10,000
60,000
Hyper link
VADEV [20]
Hyper
Table 5: Summary of the datasets used for deepfake detection. The table provides information the number of real and fake videos, the number of videos, whether rights have been cleared, the number of agreeing subjects, the total number of subjects, the number of synthesis methods, and the number of perturbations.
and validation. For the fake dataset, the train, test, and validation splits are determined based on the information provided the corresponding JSON files used in the arrangement process (see Sec. A.I), Masks are also included in the dataset.
2) DeepFakeDetection:: Since the dataset does not have the official splitting, the fake and real data are duplicated and split into the train, test, and validation sets in our benchmark. Masks included in this dataset as well.
3) FaceShifter: The real data is duplicated and split into the train, test, and validation sets, similar to the FF++ dataset. The train, test, and validation splits for the fake dataset are determined using the FF++ JSON files used in the arrangement process.
Celeb-DF-v1/v2: All the real and fake videos are used as the training dataset, and a subset of real and fake videos is selected as the test dataset based on text file provided by the author. The validation set to be the same the test set.
5) DFDCP: The dataset contains real videos and fake videos generated by different methods: method A and method B. The train and test splits are determined hased on the given method. The validation set is set to be the same the test set.
6) DFDC: The train and test splits are determined based on the given method, similar to DFDCP. The validation set set to be the same as the test set.
The dataset includes various perturbation methods in the fake data subset. One perturbation method is considered a separate category of fake videos. In the fake dataset, the train, test, and validation splits are determined based on the provided text file. The real dataset duplicated and split into train, test, and validation sets.
DeeperForensics-
8) UADFV: The strategy used for the UADFV dataset involves duplicating the real and fake parts of the dataset three times create the train, test, and validation sets.
Experimental Setup In the training module, utilize the Adam optimization algorithm with learning rate of 0.0002. The batch size is set to 32 for most experiments. However, for the DSP- FWA [22] and Face X-ray [20] detectors, the batch size is adjusted to 16 due to the input data being pairs. Specifically, for DSP-FWA and Face X-ray, which generate forgery images dynamically during training. the input size is doubled.
For the naive detectors (e.g., ResNet, Xception, and EfficiintNeet, we employ their official models, initializing the parameters through pre-training on the ImageNet. The pre-trained backbones from ImageNet are used to initialize the remaining weights. However, Meso4 [i] and Mesolncep [1] do not have pre-training weights in ImageNet, pre-training is not utilized for them. The effect of pre-training evaluated Sec. 4.3 of the main paper.
Regarding evaluation, we compute the average value of the top-3 metrics, such as the average top-3 Area Under the Curve (AUC), as our primary evaluation metric. Additionally, we report the top-1 results. Other widely used metrics, including Average Precision (AP) and Equal Error Rate (EER), are also computed and presented in the following sections. Furthermore, the validation set is not utilized in our experiments. Following previous works [3, 4], we adopt the practice of selecting the model that achieves the highest performance on the test set rather than the validation set for final evaluation.
important to note that
21

---

To ensure fair and consistent evaluation, all experiments are conducted in standardized environment using the NVIDIA A100 GPU. More software library dependencies can be seen on our GitHub website (https: htttps://githubb wttp:/ccc/cccceeeeeeeeee akeBench).
Data Augmentation Our benchmark utilizes a series of widely used data augmentation methods for image processing. We describe each augmentation method as follows:
1) Horizontal Flip:
This augmentation randomly flips the image horizontally with a probability of 0.5, simulating mirror images.
2) Rotation: This augmentation randomly rotates the image within range of -00 to 10 degrees with probability of 0.5. By applying random rotations, it introduces diversity in object orientations, making the model more robust to different angles and orientations.
3) Isotropic Resize:
This augmentation resizes the image while maintaining isotropy, ensuring that the aspect ratio of the image preserved. It randomly selects one interpolation method (INTER AREA, INTER CUBIC, INTER LINEAR) for resizing. The maximum side length is determined by the configured value. Isotropic resizing is particularly useful when dealing with objects that have varying scales and proportions, allowing the model to learn from different object sizes and maintain the aspect ratio of the objects.
4) Random Brightness and Contrast:
This augmentation randomly adjusts the brightness and contrast of the image with a probability of 0.5. By applying random brightness and contrast variations, it introduces changes in the illumination and contrast levels of the images. This helps the model generalize better different lighting conditions and improves its robustness to variations in brightness and contrast.
5) FancyPCA:
This augmentation applies the FancyPCA algorithm with a probability of 0.5. Fan- cyPCA performs Principal Component Analysis (PCA) on the pixel values of the image and perturbs the components to introduce color variations. By altering the principal components of the image, it can change the color distribution, leading to more diverse training samples.
6) Hue Saturation Value (HSV) Adjustment: This augmentation randomly adjusts the hue, satura- tion, and value of the image. While the probability is not specified in the code snippet, it allows for variations in the color representation of the images. Adjusting the hue changes the overall color tone, saturation controls the intensity of colors, and value adjusts the brightness.
7) Image Compression:
This augmentation applies image compression with probability of 0.5. It reduces the quality of the image by compressing it. The lower and upper limits, set to 40 and 100 respectively, control the compression quality. Image compression introduces artifacts and reduces the image quality, simulating real-world scenarios where images may be of lower quality or have compression artifacts. This augmentation helps the model learn handle such variations and improves its robustness in practical applications.
Full Experimental Results
Overview the main paper, our focus on presenting the experimental results obtained from selecting the models that achieve the highest performance on each individual testing dataset. The primary metric utilized for evaluation in the main paper is the Area Under the Curve (AUC). In order to provide a more comprehensive view of our experimental results, present the complete set of results here. We have incorporated three different widely utilized metrics for assessment: AUC, Average Precision (AP), and Equal Error Rate (EER). These metrics are dynamically recorded throughout the training process as part of our benchmark. Additionally, we have stored the prediction results along with their corresponding labels, which facilitates the computation of additional metrics. In this paper, we compare the aforementioned metrics as a means to compare the performance of the 15 detectors across the 14 testing datasets.
Comprehensive Metrics In addition to saving the best cest-performing model throughout the training process, we also save the last model to evaluate its performance at the completion of training epochs. This allows us to assess the models' effectiveness after undergoing the entire training duration. Furthermore, by recording the predictions and corresponding labels, we are able to calculate additional metrics such Precision and Recall, in addition to the previously mentioned metrics.
22

---

Nabl Footte Eane (11))
Openss
Pala Rea
Figure 11: Illustration and visualization of within-datasel evaluation. We draw the ROC-AUC curve using the models at the last trained epoch.
SPC
Figure 12: Illustration and visualization of cross-dataset evaluation. We draw the ROC-AUC curve using the models at the last trained epoch.
Here, we present the ROC-AUC curve and Precision-Recee curve for all detectors. These detectors are trained on the FF++ (c23) dataset and evaluated on a total of 14 testing datasets, encompassing both within- and cross-dataset evaluations (see Fig. 1 1. Fig. 13. Fig. 12, Fig. 14). These visualizations provide a more comprehensive understanding of the experimental outcomes, allowing for more detailed analysis of the detectors' performance. Moreover, approach facilitates the computation of additional evaluation metrics based on user requirements, thereby demonstrating the convenience and versatility of our benchmarking framework.
benchmark, our proposed
Full Testing Results During the Training Process To facilitate the monitoring of model perfor- mance during the training process, utilize Bend to record various metrics. These metrics include training loss, training accuracy, AUC, AP, and EER, as well as testing loss and testing metrics (AUC, AP, EER). By visualizing these metries, users gain insight into the performance trends during training, enabling them to debug issues and optimize parameters as needed.
In this section, we present visualizations of testing metrics plotted against the training steps. The metrics of interest include AUC, AP, and EER, which provide a comprehensive assessment of the detectors' performance across different datasets (see Fig. 16. Fig. 19, Fig. 15, Fig. 18, Fig. 17, Fig. 20). By comparing the curves, we can analyze the relative performance of the detectors using different evaluation metries.
Furthermore, we can observe the stability of the testing results. Some detectors may exhibit volatility and lack stability in their metrics, which introduces uncertainty. In such cases, while the overall
23

---

Figure 13: Illustration and visualization of evaluation. We draw the Precision-Recal curve using the models at the last trained epoch.
Figure 14: Illustration and visualization of cross-dataset evaluation. We draw the Precision-Reed curve using the models at the last trained epoch.
results may not be consistently good, there may be instances where individual metrics perform well. To address this, we adopt an average-based approach, computing the average values for each testing metric to determine the final results (Top-3). By examining the provided figures, we can also discern the stability of each detector's performance.
Note that due to the differing training batch sizes of DSP-FWA and Face X-ray detectors compared to the other 13 detectors, we visualize them separately. This distinction allows for more clear comparison within their respective groups.
A.4 Other Analysis Results
Artifacts of deepfake forgeries in Frequency Inspired by [48], we adopt a similar approach to visualize the average frequency spectra of each dataset. The purpose is to examine the artifacts generated by deepfake forgeries. Our methodology involves computing the average frequency spectrum of a selected set of images, specifically 2000 randomly sampled images. To mitigate computational complexity, a random subset of both real and fake images is chosen for analysis. The process begins by converting the images to grayscale and applying high-pass filter. Subsequently, a Fourier transform is performed, with the zero frequency component shifted to the center of the spectrum. Finally, the spectra are summed and averaged to obtain the final result.
The resulting visualization comprises three subplots for each deepfake forgery. The first subplot illustrates the average spectrum of the real image, the second subplot represents the average spectrum
24

---

Figure 15: Illustration and visualization of all testing results during the training process. The metric is AUC. We compare 13 detectors (except for the Face X-ray and DSP-FWA) on different datasets using the AUC metric.
of the fake image, and the third subplot showcases the difference between the spectra of the real and fake images.
Our findings align with those reported in [48]. We observe that deepfake forgeries do not exhibit obvious artifacts, as observed other images generated by GANs. This consistency with the findings in [48] can be attributed to the various pre-processing and post-processing steps involved in the creation of deepfake images. These steps, which include resizing. blending, and MPEG compression of the synthesized face region, introduce perturbations in the low-level image statistics. As result, the frequency patterns may not emerge distinctly in our visualization method.
Visualizations of GAN-generated and diffusion-generated artifacts in Frequency Following the similar process Sec. A.4, we also visualize the artifacts generated by GANs and diffusion models. Specifically, we utilize the Genlmage dataset [54] and apply the frequency analysis tool in our benchmark for analysis. The visualizations are shown Fig. 22. This analysis has unearthed intriguing observations specific to diffusion-generrted images when contrasted with GAN-generater images. Particularly, diffusion -eneriate images exhibit fewer artifacts, while GAN-generated images display noticeable checkerboard pattern of artifacts.
25

---

Cantariie
Crotuation
Figure 16: Illustration and visualization of all testing results during the training process. The metric AP. We compare 13 detectors (except for the Face X-ray and DSP-FWA) on different datasets using the AP metric.
Cross-data evaluation and the importance of phase spectrum In Tab. of the manuscript, we highlight the SPSL detector, which achieves an impressive average score of 78.75% in cross-doman evaluation. A distinctive feature of SPSI. compared to Xception is the incorporation of the phase spectrum, which is concatenated with the spatial image in the channel dimension. As mentioned in the original SPSL paper, the phase spectrum can capture up-sampling artifacts present in many forgery processes. Motivated by this finding, we explore the potential benefits of incorporating the phase spectrum feature into blending-base detectors. We hypothesize this would enhance performance in both cross-data and cross- manipulanii evaluations.
Cross-data evaluation: To validate our hypothesis, we first conduct an experiment which integrate the spectrum feature into the FWA detector, resulting in improved FWA (iFWA). The experimental results, summarized Tab 6, show a significant improvement achieved by iFWA (from 73.16% to 80.35% in average AUC).
Cross-manipulation evaluation: Second, we conduct experiments and show the cross- manipulation outcomes achieved by iFWA in Tab. These visualizations serve to strengthen argument about the consistent performance of iFWA.
26

---

Coa
Exalurtion Se Betioorratas mecri
Figure 17: is EER. We compare 13 detectors (except for the Face X-ray and DSP-FWA) different datasets using the EER metric.
Illustration and visualization of all testing results during the training process. The metric
These two analyses and experimental validations aim to explain the phenomena observed in our evaluations, ensuring experimental evaluations are not only fair and comprehensive, but also insightful.
Model
FF++_c23
FF++_c40
CDF-v2
DFDCP
DFD
Average
FWA
0.8765
0.7357
0.6680
0.6375
0.7403
0.7316
iFWA
0.9557
0.7496
0.7612
0.7104
0.8408
0.8035
Improvement
+7.92%
+1.39%
+9.32%
+7.29%
+ +10.05%
+7.19%
Table 6: Cross-dota evaluation between iPWA (with the spectrum feature) and FWA (without the spectrum feature). The models trained FF++_c2. and tested other datasets. The metric is the frame-level AUC.
Why do Naive detectors work can perform as well as more advanced in certain settings? From results in Tab. 3, we have observed that some Naive detectors (i.e., Xception and EfficientNe(B4) can exhibit competitive performance compared to more complex methods, which might be surprising given the advancements in the field. We then explain this phenomenon from the following aspects.
27

---

10
Trsbu CESTRUR SERIE
Figure 18: Illustration and visualization of all testing results during the training process. The metric AUC. We compare Face X-ray and DSP-FWA on different datasets using the AUC metric.
Model
Training
FF-DF
FF-F2F
FF-FS
FF-NT
Average
FWA
FF-DF
0.90
0.91
0.92
0.90
0.91
IFWA
FF-DF
0.97
0.97
0.98
0.90
0.96
Improvement
+7%
+6%
+6%
+0%
+5%
Table 7: Cross manipulation evaluation between iFWA (with the spectrum feature) and FWA (without the spectrum feature). models are trained on FF-DF and tested on other forgeries in FF++_c23. metric the frame-level AUC.
First, Naive detectors, despite their simplicity, may have inherent strengths that are yet to be fully understood and harnessed. However, few previous studies have deeply explored the capabilities of these baseline methods or identified the conditions under which they can be particularly effective. Second. previous works have shown that some strategies or tricks could bolster the performance of Naive detectors, e.g., pre-training or data augmentation. To this end, we conduct an experiment to compare the performance of the Naive detector and the complex one under the conditions with or without tricks. By adding the tricks, find the gap between the Naive detector and complex detector
28

---

3
Figure 19: Illustration and visualization of all testing results during the training process. The metric is AP. We compare Face X-ray and DSP-FWA on different datasets using the AP metric.
Model
Number of Layers
Number of Parameters
Xception
71
22.9M
ResNet 34
34
21.8M
EfficientNet-BB B4
75
19M
Table 8: Summary of the statistics for Xception, ResNet 34, and EfficientNet-44
reduced (see Tab. 10). Showing that the performance of the Naive detector is effectively mined by using these tricks.
Apart from these two aspects, we also find that the problem of consistency in experimental procedures and evaluation metrics is also notable. It is worth noting that comparison methodologies can vary across studies, and directly adopting results from prior papers could sometimes lead to discrepancies due to differences in experimental conditions and evaluation metrics. For instance, current studies often directly cite the results of Xception from the original paper [33], but different training settings used in different works can inevitably result in disparities.
29

---

Figure 20: Illustration and visualization of all testing results during the training process. The metric is EER. We compare Face X-ray and DSP-FWA different datasets using the EER metric.
DADEY
Tauckikke
Nauaffotar
ZuodSnup
Teecthie
Dospitio
Depofiosaio Pantiorcheactn
DEDe
DEDCY
Figure 21: Frequency analysis on each dataset. We present the average spectra of high-pass filtered images, focusing on both real and fake images. Our findings align with those reported in work [48]. observe that shown deepfake forgeries do not display obvious artifacts in the average spectra. This underscores the similarity of our results with [48].
Is it standard practice to use Adam optimizer for deepfake detection algorithms? our experiments, want to clarify it as follows:
30

---

BAGGAN
Figure 22: Frequency analysis on each dataset using the frequency analysis tool within our benchmark. We present the average spectra of high-pass filtered images, focusing both real and fake images.
Dataset
ResNet 34
ResNet 50
ResNet 152
CDF-v2
0.7027
0.7491
0.7514
DFDCP
0.6170
0.6658
0.7078
DFD
0.6464
0.7002
0.7005
FF++_c2. c23
0.8493
0.8928
0.9119
FF++_040 c40
0.7846
0.7933
0.8167
Average
0.7199
0.7602
0.7776
Table 9: Comparing the performance of different variants of ResNet. The models trained FF++_c25 and lested other datasets. The metric the frame-level AUC.
Using Adam as the optimizer can be considered a common setting, and a substantial number of deepfake detection methods in existing literature have adopted this configuration (paper [20, 27, 26, 3, 12]).
It important to note that our benchmark versatile and supports various optimizers, includ- ing three mainstream ones: Adam, SGD, and AdamW. In deepfakebench, ensure fairness and consistency across evaluations, detectors are trained using the Adam optimizer. Other hyperparameters, such learning rate, are also unified as much possible.
Overall, employing the Adam optimizer aligns with common practices in deepfake detection and serves facilitate consistent and equitable comparison of different algorithms.
31

---

Detector
Condition
FF++_c2
CDF-2
DED
DFDCP
Average
RECCE
Before Tricks
0,9811
0.6083
0,5894
0.5128
0,5792
0.6556
RECCE
After Tricks
0.9621
0.7319
0.8119
0.7419
0.8190
0.8134
RECCE
Improvement (%)
37.84%
44.72%
41.37%
24.08%
Xception
Before Tricks
0.5175
0.5870
0.4894
0.5420
0.6250
Xception
After Tricks
0.9637
0.7365
0.8163
0.7374
0.8261
0.8160
Xception
Improvement (%)
-2.99
42.31%
39.08%
50.67%
52.40%
30.56%
0.6029
0.5995
0.5754
0.6731
SRM
After Tricks
0.9576
0.7552
0.8120
0.7408
0.8114
0.8154
SRM
Improvement (%)
-3.10%
26.00%
34.74%
23.56%
40.99%
21.13%
Table Comparison of performance among three detectors: Naive detector (Xception), frequency detector
(SRM), and spatial detector (RECCE) under the conditions of without vs. with tricks. We demonstrate that the performance of the Naive detector can be effectively enhanced through the use of tricks: data augmentation and pre-training. The models trained on FF + c23. The metric is the frame-level AUC.
Training Conlig
Face X-ray & FWA
Other Detectors
Image Size
256, 256 ImageNet Pre-trained
256, 256
Weight Initialization
ImageNet Pre-trained Adam
Optimizer
Adam 2e-4
Base Learning Rate
2c-4
Weight Decay
5o4
Optimizer Momentum
B1, B2=0.9, 0.999
B1, B2=0.9, 0.999
Batch Size
16
Training Fpochs
Learning Rate Schedule
None, Constant
None, Constant
Probability
0.5
Rutate Probubility
0.5
0.5
Rotate Limit
[-10, 10)
[-10. 10]
Blur Probabilty
0.5
0,5
Blur Limit
[].
[3,
Brightess Probability
0.5
0.5
Brightness Limit
[-0.1, 0.1]
[-0.1 0.1]
Contrast Limit
[-0.1.0.1]
[-0.1,0.1] 0.1]
Quality Lower
40
40
Quality Upper
100
100
Table 11: The results of our main experiments (shown in Table, 2 and Figure. 2 of the manuscript) are generated using the following settings.
32


Reviews:
[{"review_id": "8ZOphCWWaJ", "reviewer": "Reviewer_Hoqi", "summary": "", "questions": "", "limitations": "The authors have adequately addressed the limitations.", "rating": 7, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "1. The paper provides a unified platform for comparing deepfake detection methods, which would facilitate the evaluation of future detection methods to be developed.\n\n2. The codebase has a modular design and looks easy to use.\n\n3. The evaluation is comprehensive.", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": ""}, {"review_id": "Uz5rx05XUK", "reviewer": "Reviewer_uRdm", "summary": "", "questions": "", "limitations": "Fine", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "Pros:\n1. This paper proposes a comprehensive benchmark on Deepfake Detection\n2. This paper proposes a useful toolkit for deepfake detection.\n3. This paper conduct solid experiments.", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": ""}, {"review_id": "aSqJxHXoAs", "reviewer": "Reviewer_fUyn", "summary": "", "questions": "", "limitations": "This paper analyzes the impact of data augmentation methods, backbone networks, pre-training techniques, and other factors on various methods. The experimental results reveal some noteworthy \"counterintuitive\" phenomena. The paper only describes these observations, hoping to stimulate further in-depth research in these areas. Additionally, in this paper, DeepfakeBench primarily focuses on providing algorithms and evaluations at the frame level, and it is expected that future work will extend the analysis, detection, and evaluation to the video level, thus forming a more comprehensive framework.", "rating": 6, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "This paper provides a unified, standardized, and comprehensive benchmark for deepfake detection, reducing unfair comparisons arising from different experimental setups, datasets, and data processing methods. It facilitates further in-depth research in this field and offers more comprehensive evaluation metrics.", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": ""}, {"review_id": "li2dHWVmZL", "reviewer": "Reviewer_ZyZY", "summary": "", "questions": "", "limitations": "The authors have provided discussions on how the proposed benchmark may facilitate the development of anti-deepfake methods. It would be appreciated if negative societal impact are also dicussed; e.g. how the collected datasets may be misused.", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "- Overall the submission is fairly solid. The paper is generally well-written and well-motivated. It would be a good contribution to the community.\n- The benchmark has considerable size (9 datasets and 15 baseline methods).\n- The authors considered a fairly comprehensive set of evaluation techniques and metrics.\n- The work also goes further and provide useful empirical analyses regarding implementation details such as the effect of the number of training frames and data augmentation.\n- The provided codebase seems to have a good degree of completeness and is generally well-documented.", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": ""}, {"review_id": "AprVFB0oiz", "reviewer": "Reviewer_oARM", "summary": "", "questions": "", "limitations": "Limitations were discussed in main text.", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "1. The codebase implemented 15 algorithms and supports 9 datasets, which look comprehensive.\n2. A systematic evaluation was performed.\n3. The analysis is detailed and contains figures for intuitive visualization.", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": ""}]

Author rebuttal:

Meta-review: Basically, most reviewers gave positive rating to this work. In the rebuttal, the issues raised by the reviewers have been well-addressed. Hence, I believe that this work can be accepted. The authors should modify the paper or possibly the project according to the comments, especially the ones common among multiple reviewers like the comparison with other codebases.
Decision: Accept (Poster)