Can We Leave Deepfake Data Behind in Training Deepfake Detector?
Authors: Jikang Cheng
Zhiyuan Yan
Ying Zhang
Yuhao Luo
Zhongyuan Wang
Chen Li
Venue: NeurIPS 2024 poster (2024)
Keywords: Deepfake Detection
Data Synthesis
Hybrid Training
Primary area: machine_vision

Abstract: The generalization ability of deepfake detectors is vital for their applications in real-world scenarios. One effective solution to enhance this ability is to train the models with manually-blended data, which we termed ''blendfake'', encouraging models to learn generic forgery artifacts like blending boundary. Interestingly, current SoTA methods utilize blendfake $\textit{without}$ incorporating any deepfake data in their training process. This is likely because previous empirical observations suggest that vanilla hybrid training (VHT), which combines deepfake and blendfake data, results in inferior performance to methods using only blendfake data (so-called "1+1<2"). Therefore, a critical question arises: Can we leave deepfake behind and rely solely on blendfake data to train an effective deepfake detector? Intuitively, as deepfakes also contain additional informative forgery clues ($\textit{e.g.,}$ deep generative artifacts), excluding all deepfake data in training deepfake detectors seems counter-intuitive. In this paper, we rethink the role of blendfake in detecting deepfakes and formulate the process from "real to blendfake to deepfake" to be a $\textit{progressive transition}$. Specifically, blendfake and deepfake can be explicitly delineated as the oriented pivot anchors between "real-to-fake" transitions. The accumulation of forgery information should be oriented and progressively increasing during this transition process. To this end, we propose an $\underline{O}$riented $\underline{P}$rogressive $\underline{R}$egularizor (OPR) to establish the constraints that compel the distribution of anchors to be discretely arranged. Furthermore, we introduce feature bridging to facilitate the smooth transition between adjacent anchors.  Extensive experiments confirm that our design allows leveraging forgery information from both blendfake and deepfake effectively and comprehensively. Code is available at https://github.com/beautyremain/ProDet.

Can We Leave Deepfake Data Behind in Training Deepfake Detector?
Jikang Cheng's ;Zhiyaan Yan', Ying Zhang Yuhao Luo², Zhongyuan Wang' Chen Li
1 School of Computer Science, Wuhan University
2 The Chinese University of Hong Kong, Shenzhen (CUHK-Shenzhen)
3 WeChat, Tencent Inc.
ChengJikang@uhu. edu. wzy_hope@163..m
Abstract
The generalization ability of deepfake detectors is vital for their applications in real- world scenarios. One effective solution to enhance this ability train the models with manually-blended data, which we termed "blendfake", encouraging models to learn generie forgery artifacts like blending boundary. Interestingly, current SoTA methods utilize blendfake without incorporating any deepfake data in their training process. This is likely because previous empirical observations suggest that vanilla hybrid training (VHT), which combines deepfake and blendfake data, results in inferior performance to methods using only blendfake data (so-called " "I+I<2"). Therefore, critical question arises: Can leave deepfake behind and rely solely on blendfake data to train an effective deepfake detector? Intuitively, as deepfakes also contain additional informative forgery clues (e.g., deep generative artifacts), excluding all deepfake data in training deepfake detectors seems counter-intuitive In this paper, we rethink the role of blendfake in detecting deepfakes and formulate the process from "real to blendfake to deepfake" to be a progressive transition. Specifically, blendfake and deepfake can be explicitly delineated as the oriented pivot anchors between "real-to-fake" transitions. The accumulation of forgery information should be oriented and progressively increasing during this transition process. To this end, we propose an Oriented Progressive Regularizor (OPR) to establish the constraints that compel the distribution of anchors to be discretely arranged. Furthermore, we introduce feature bridging to facilitate the smooth transition between adjacent anchors. Extensive experiments confirm that our design allows leveraging forgery information from both blendfake and deepfake effectively and comprehensively. Code is available https://gihab..cm//euuuut
Introduction
In recent years, the development of deepfake" has aroused significant concerns regarding privacy and security among the public. Deepfake detection aims identify whether a face from an unknown source has been manipulated by deepfake techniques. Most detection methods perform promis- ingly when trained and tested on identical manipulations. However, given the unpredictability and complexity of real-world scenarios, it is increasingly critical for these methods to generalize and identify previously unseen manipulations. One particularly effective and mainstream solution is data synthesis, which involves image blending to create new training forgery samples [7, 28, 39, 27, 55].
Work done during an internship at WeChat i Corresponding author.
'The term "deepfake" hereafter specifically refers to face forgery technology. The entire (or natural) image synthesis is not within our scope.
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

Real
Blendfake
Deepfake
Peffermace Deciied
AUC (%)
Neg. Trining
Erricted
Unorgamized (VHT)
Progressive (Ours)
Samples:
(a)
Figure I: la: The detection performance experiences an abnormal decline when naively combining deepfake and blendfake as the negative sample for training, even though the forgery information is enriched in this process. lb: Illustration Example for illustrating latent space organization. With progressively organized latent space (ours), information in both deepfake and blendfake is effectively leveraged, and deepfake samples become easier to distinguish from the real. See Fig. 4a and 9 for experimental results of actual latent-space distribution.
Specifically, these methods aim to synthesize pseudo-fake data that share forgery similarities with the actual deepfake data. The pseudo-fake data is generated by blending real face with near-landmark fake face [7], pear-landmark real face [55, or a real face itself [28, 39]. Considering the "deep" process is not involved during pseudo-fake data generation (without utilizing any deep network), we term these manually-blended pseudo-fake faces as blendfake faces to differentiate them from deepfake faces. The learned information from training on blendfake is similar to that on Deepfake: by simulating the blending operations in the Deepfake generation process, detectors trained on blendfake can identify generalized blending clues. In comparison to deepfake, blendfake necessitates the use of two images with closely matching landmarks (or with itself) for generation, thereby curtailing its practical utility. However, this also means that blendfake contains fewer forgery clues compared with Deepfake and its distribution is closer to that of real images, making blendfake a conveniently obtained hard sample for detector training.
In this paper, we commence with a question that many researchers may ponder: Can the blendfake face entirely substitute the actual Al-generated deepfake face in training deepfake detectors? As shown in Fig. la, considering the empirically inferior performance of using both deepfake and blendfake for training, exclusively utilizing blendfake as the negative sample becomes the mainstream scheme for data-synthesis methods [39, 27], where actual deepfake data is deliberately excluded. However, given that actual deepfake data is widely available in real-world scenarios, and it should contain extra forgery clues (e.g., generative artifacts in deep net) absent blendfake, training a deepfake detector without using any deepfake data seems intuuterintuitie. Therefore, argue that the significance of deepfake samples is underestimated due to insufficient exploration of how to appropriately utilize these samples. As illustrated in Fig. 1b, attribute the abnormal efficiency of VHT to the unorganized latent-space distribution, while a carefully organized latent-space distribution proven advantageous network performance [26, 53, 2J. Specifically, since deepfake and blendfake are entangled while also distinctly containing forgery clues, the direct VHT may fail to disentangle the learned representation in the latent space. Inspired by introducing inductive bias that can reflect the structure of the underlying data (i.e., real, blendfake, and deepfake in our case) is beneficial to feature robustness and generalization ability [19, 13, 23], we want to organize the latent space based on an inductive observation. As shown in Fig. 2, it can be observed that the transition from real to fake is progressive process. Based on the observation, we posit that the latent space distribution from real to blendfake to deepfake should also be conceptualized as progressive process, where real can gradually become deepfake through continuous transition. That is, in the latent feature space, the distribution of blendfake and deepfake can be regarded as "oriented pivot anchors" in the progressive transition from real to fake. Achieving this progressive organization can disentangle learned representations of blendfake and deepfake data, thereby enabling more effective use of forgery clues from both data types. Consequently, we propose ProDet (deepfake Detection with Progressive transition) to achieve the progressive transition in the latent space that we envisioned.

---

Blldding
Identity Inconsistency
Cenerative
Clues
Artifants
Real
Blendfake (SBI)
Blendfake (CBI)
D Deepfake
Feature
Progressive
Forgery
Bridging
Transition
Accumulation
Figure 2: The progressive transition from real to fake, where blendfake and deepfake explicitly delineated as the oriented pivot anchors according to their inherent forgery attributes.
As shown in Fig. 2, the oriented anchors used in this paper include four types: real, SBI [39], CBI [27]. and fake, where both SBI (self-blended image) and CBI (cross-blended image) represent blendfakes. Within our framework, the anticipated progressive transition can be concretely understood as progressive accumulation forgery information, encompassing three specific aspects: the presence of blending clues, identity inconsistency, and generative artifacts of deep neural nets. To implement the aforemmnnioned progressive effect, we consider ordering the distribution of these transition anchors by allocating different hard labels. Therefore, Regularizer (OPR) to fully utilize the forgery information in all oriented anchors. OPR contains a triplet one-hot classifier corresponding to the forgery attributes and a projector re-dimension the output auxiliary attention map, which aligned with the feature dimensions and serves to guide the final detection results. Based the inherent forgery attributes of different anchors, the label of the triplet one-hot output can be viewed as a cumulative three-bit binary number. Consequently, establish the constraints that compel the distribution of anchors be arranged in progressive manner. To "build bridges" between the distinct adjacent anchors, we propose feature bridging to simulate continuous transitions between adjacent anchors. Specifically, feature bridging conducts the mixup to the extracted features of two adjacent anchors at random ratios, predicting mixed labels for these blended features to facilitate a smooth and continuous transition process. Additionally, to enhance the progressive transition process between different anchor distributions, we further propose the transition loss, which constrains an extracted feature to transform into its adjacent distribution after undergoing noise addition and specific mapping.
introduce module named Oriented Progressive
2
Related Works
2.1 Deepfake Detection Toward Generalization Ability
Deepfake detection aims to determine the authenticity of images potentially manipulated by deepfake approaches. Various detection methods concentrate on distinct facial features, such as movements of the lips [22] and the consistency of facial action units [4]. In parallel, several studies aim to optimize neural network architectures, including MesoNet [1]. Xception [12], and CapsuleNet [34], elevate detection efficacy. Based on the observation of model bias in the detector, many methods [51, 30] are proposed to remove certain general biases found in the forgery samples. Moreover, Chen et al. [20] construct a test sample-specific auxiliary task to improve the detection performance. To capture local-to-gee local-to-global information, Guan al. [8] propose LTTD focus the temporal information within the local sequence. In the spectral domain, techniques like SPSL [31] and SRM [33] utilize phase spectra and tigh-frequency disturbances augment the forgery details used in training. These strategies [31, 20, 8, 33, 22, 4, 24, 30, 51, 10, 6] target particular weaknesses found in deepfake technologies, and are highly effective in identifying deepfake images characterized by these flaws.
2.2 Deepfake Detectors with Blendfake Faces
Blendfake refers to a series of forgery detection methods that employ data generation schemes. These methods [7, 28, 39, 27, 55] manually create new fake samples that imitate general forgery clues that are similar to deepfake based on real samples from the dataset. Specifically, SLADD [7] dynamically crops portion of fake image and blends it onto a real image, thereby generating a fake sample that more challenging distinguish. Both CBI [27] and I2G [55] involve randomly selecting real

---

Training
Feuluee Brikling&Taannii
Oriented Proeerosovve Regpalaiior
Hordiflee (591)
Deppile
Backloon
C. Allribute Clessiier
Allentione
Real/ Fake
Busi
C Fizal Classifier
Blending
Hinntr
Genvestive
Feeture
Fretfrm
Restures
Incorastincy
Artifacts
Blidging
Taassboo
Figure 3: Overall pipeline of our method.
image as the base image, and then searching for another source real image with closely matching facial landmarks. Following a color transfer, the face of the source real image is attached to the base image according the landmarks, ultimately producing a new fake sample. The resulting blendfake image is cross-face blended and exhibits inconsistencies in identity and also blending clues. FWA [28] and SBI [39] omit the landmark matching process, instead generating two different versions of a base real image through distinct transformations, and subsequently blending these two versions to create new fake image. The blendfake images generated this way contain only blending clues, causing their distribution to resemble real images more closely.
Owing their superior implementation designs, SBI and CBI have demonstrated advanced perfor- mance in deepfake detection. Notably, they chose to use the generated blendfake solely instead of deepfake during training, thereby completely excluding deepfake from the detector training process.
Methodology
In this paper, we aim devise appropriate scheme to simultaneously leverage the forgery information inherent in both deepfake and blendfake, thereby training a more effective detector termed ProDet. Firstly, consider constraining the oriented anchors, that is, the real, blendfake, and deepfake features, to be progressively distributed in a discrete manner. Then, we propose feature bridging simulate the continuous and progressive transition between adjacent anchors. Lastly, transition loss introduced further to enhance our simulation of the progressive transition process. As shown in Fig. 3, our method is simple yet effective in organizing the latent space in progressive manner.
3.1 Anchoring Oriented Distributions in Latent Space
To regularize progressive distribution in latent space, design module termed Oriented Progres- sive Regularizor (OPR) using multi-attribute classification constraints. Specifically, blendfake images generated by both SBI [39] and CBI [27] are introduced as oriented pivot anchors construct the process of progressive transition. Since SBI contains no clues ID inconsistency compared to CBI, is notably more difficult identify SBI as fake data. Consequently, in mini-batch during training, we incorporate four types of samples aligned with the same frame in the same video. They can be organized progressively from real fake as follows: real (I,). SBI (I,), CBI (I.), and deepfake (Ia), as depicted in Fig. 2. To facilitate progressive anchor organization, we employ an attribute classifier C, that introduces three two-class classification heads. Instead of independently discerning the oriented anchors, where lack of progressive relation is evident, three classification heads are tasked with the actual determination of forgery attributes, allowing for progressive forgery accumulation. The classified two-class forgery attributes A (ao. 01, 02} E [0. respectively represent the likelihood of containing 1) Blending clue in I., Ic, and I 2) Identity inconsistency in I., and La; 3) Generative artifacts in L.. As illustrated in Fig. 3, it is straightforward to assign the ground-truth attribute label groups A' {ao's aa', a2') E {0, 1 to these oriented anchors, thereby enabling the progressive forgery accumulation through multi-labeling. Therefore, each image I E RR H x3 will be first extracted feature F E Rxxxxx by the backbone encoder, then predicted with three forgery attributes:
A = C.
(I)
To effectively leverage information from OPR during inference and obtain a conclusive deepfake detection result, the outputs of multi-attribute classification are re-dimensioned to an auxiliary

---

attention map M E kxxxx as:
M P(A),
(2)
where P is projector that re-dimensions the classification results. M is aligned and integrated with the extracted feature and provides supplemental information that improves the final deepfake detection outcome y. Therefore, can be written as:
y = CF C M),
where @ denotes element-wise multiplication, Cy denotes the final classifier for deepfake detection.
In fact, several alternative strategies can also achieve similar multi-attribure classification for dis- tribution anchoring, including multi-class, multi-label, and triplet binary (ours) classification. The multi-class classification is actually detecting different types of negative data instead of perceiving their forgery accumulation. Therefore, it cannot organize the latent space a progressive manner we anticipate. The multi-label strategy with three classes can be interpreted as using one vector to represent three parallel forgery attributes, which may achieve a comparable progressive accumu- lation. However, it is constrained by the mapping capability of single detection head, limiting its effectiveness distinguishing among different forgery attributes. In contrast, the deployed triplet binary strategy effectively differentiate the distributions of the oriented anchor with progressive accumulation. The experimental results can be found in Sec. 4.3.
3.2 Simulating Continuous Transition via Feature Bridging
By assigning progressively multi-labels to different data distributions, we successfully placed discrete anchors for the real-to-fake progressive transition in the latent space. However, as analyzed in Sec. 1, the progressive transition from real to fake should be continuous rather than discrete. Therefore, consider simulating this continuous progressive transition by constructing bridges between adjacent anchors, thus further clarifying the orientation. Here, we propose feature bridging to fill the continuous latent space between oriented anchors. Specifically, given four extracted features {F,, F., F., F&} and their one-hot label groups (A,'s A,', , A,''" Ad') in aligned mini-batch, conduct mixup to each pair of adjacent features and labels. We take bridging real to SBI as an example:
Fr.s, A = Mix(F (Fr,, Fx), Mix(A,' A.'),
(4)
where M Mix a xxa+((-aa) xb, and a E [o, 1] is a random mixing ratio. It is important to note that, to ensure that the information mixed during the feature bridging process is the desired deepfake- related context and to exclude interference from deepfake-unrelate and pose), the images used for mixing should be aligned to the same video frame. Therefore, we can assign the forgery attribute label of Fr, F,.. as A to simulate the continuous transition between two adjacent anchors. Since feature bridging across skip-neighbox anchors introduces short-cut transition paths, thereby disrupting the oriented progressive transition in the SSB--BBI-IIeepffiii process, we only conduct feature bridging on two adjacent anchors instead of any arbitrary pair.
content (e.g., background, identity,
3.3 Loss Function
Transition Loss. Given that a real distribution can be progressively transitioned to a fake distribution, features augmented with noise should be mapped more fake distribution. Therefore, we take this noise-augmented transition as an additional constraint to further enhance the simulation of progressive transition. Specifically, shape as F. Subsequently, we introduce a group of convolutional layers to merge and transform F and N. producing a new feature F' e xxxx We named the above process as feature transition (T). Since F' = T (N, F) is expected to be transitioned to more fake anchor distribution, we introduce the following transition loss:
first randomly generate random noise N that has the same
L. Σ (T), -F+11l2.
where F, represents the i-th feature in the mini-batch (F,, F, F., Fa). thus F denotes the subsequent feature F,.
Oriented Loss. Oriented loss deployed to both discrete anchors and continuous bridging features. Given feature F and its ooe label groups A' {ao', a1', az either directly extracted or mixed,
5

---

its three attributes A = {ao, 02) predicted by C, are constrained respectively. Formally, the oriented loss can be written as:
Lo = - log(A A - Aog - A)),
(6)
where AT denotes the transpose matrix of A.
Detection Loss. We deploy detection loss on the discretely oriented anchors to constrain the final detection result used in both training and inference, which is formulated as:
La y log(y) + (1 - y²) log(1 y),
where y the label that takes both blendfake and deepfake as the negative samples.
Therefore, the overall loss function in our method is:
Loverall La + BL, 7L2,
(8)
where 3 and y are trade-off parameters. The algorithm of training the proposed deepfake detection with progressive transition in the latent space (ProDet) is summarized in Algorithm 1.
Algorithm 1: Training ProDet
Input: Dataset: S; Training epoch: E. Initialize with the pre-trained backbone;
for e 1 to & do
for mini-batch of aligned images and label groups I = {I, Ic,
y' = {yy' ,''',.'' 1// e' A' S do
extract features for each data
F= [F,,, Fe, Fa} (ackbone(()
conduct feature bridging (FB) between adjacent features
F,A' FB FB A')
anchor distributions via oriented loss
L. = BCELoss(Ca((FF (F), {A' A())
enhance transition simulation via transition loss
L, = E., I|T, (N, FiE ) - F jE
compute detection loss based on the projected auxiliary attention maps P(C, (F))),
= BCELssss
compute overall loss
Loverail = Ls + BL. + +
update 8 for minimizing Loverall via backpropagation
end end
Output: learned model parameter
4 Experiments
4.1
Experimental Setting
Datasets. To extensively explore the generalization ability of deepfake detectors, the most advanced and widely used deepfake datasets are applied in our experiments. FaceForensics+ (FF++) [37] is constructed by four forgery methods including Deepfakes (DF) [15], Face2Face (F2F) [44], FaceSwap (FS) [18], and NeurallTextures (NT) [43]. FF4+ with High Quality (HQ) is employed the training dataset for all experiments in our paper. The base images to generate blendfake images are also from FF++ (HQ) real. For cross-dataset evaluations, we introduce Celeb-DF-vl (CDFv1) [29], Celeb-DF-v2 (CDFv2) [29], DeepFake Detection Challenge Preview (DFDCP) [16], and DeepFake Detection Challenge (DFDC) [16].
Implementation Details. For preprocessing and training, we strictly follow the official code and settings provided by DeepFakeBench [52] to ensure fair comparison. EfficientNetB4 [42] is employed as the backbone of our detector. The trade-off parameters are set to 3 = 1 and ạ = 10. The Adam optimizer used with a learning rate of 0.0002, epoch of 20, input size of 256 x 256, and batch size of 24. Feature Bridging is deployed after a warm-up phase of two epochs. Frame-level Area Under
Curve (AUC) and Equal Error Rate (EER) [52] are applied as the evaluation metrics of experimental results. All experiments are conducted two NVIDIA Tesla V V100 GPUs.

---

Table 1: Cross-dataset evaluations (AUC) from FF++ [37] (in-dataset) to CDFv1 [29]. CDFv2 [29], DFDCP [17] and DFDC [17] (cross-dataset) C-Avg. denotes the average value of cross-dataset
results. The best results are highlighted in bold. Cross-dataset improvements compared with the previous best one are written in pink. See Appendix for comparisons with video-based methods.
Method
Venue
FF++
CDFv1
CDFv2
DFDCP
DFDC
C-Avg.
Xception [12]
CVPR'1 17
0,9637
0.7794
0.7365
0.7374
0.7077
0.7403
Meso4 [1]
WIFS' 18
0.6077
0.7358
0.6091
0.5994
0.5560
0.6251
FWA [28]
CVPRW' 18
0.8765
0.7897
0.6680
0.6375
0.6132
0.6771
EfficientB4 [42]
ICML'
0.9567
0.7909
0.7487
0.7283
0.6955
0.7408
Capsule [34]
ICASSP'19 19
0.8421
0.7909
0.7472
0.6568
0.6465
0.7104
CNN-Aug [46]
CVPR 20
0.8493
0.7420
0.7027
0.6170
0.6361
0.6745
X-ray [27]
CVPR 20
0,9592
0.7093
0.6786
0.6942
0.6326
0.6787
FFD [14]
CVPR 20
0,9624
0.7840
0.7435
0.7426
0.7029
0.7433
F3Net [36]
ECCV'20
0,9635
0.7769
0.7352
0.7354
0.7021
0.7374
SPSL [31]
CVPR 21
0.9610
0.8150
0.7650
0.7408
0.7040
0.7562
SRM [33]
CVPR 21
0.9576
0.7926
0.7552
0.7408
0.6995
0.7470
12G-PCL [55]
ICCV'21
0.9312
0.7112
0.6992
0.7358
0.6555
0.7004
CORE [35]
CVPRW' 22
0.9638
0.7798
0.7428
0.7341
0.7049
0.7404
Recce [6]
CVPR 22
0.9621
0.7677
0.7319
0.7419
0.7133
0.7387
SLADD [7]
CVPR 22
0,9691
0.8015
0.7403
0.7531
0.7170
0.7530
SBI [39]
CVPR 22
0.8176
0.8311
0.8015
0.7794
0.7139
0.7814
IID [24]
CVPR 23
0.9743
0.7578
0.7687
0.7622
0.6951
0.7462
UCF [51]
ICCV'23
0,9705
0.7793
0.7527
0.7594
0.7191
0.7526
0.9094
0.8448
0.8116
0.7240
0.8225
ProDet (Ours)
0.9591
(1 9.42%) ( 5.40%)
(f 4.13%)
(1 0.68%)
(1 5.26%)
4.2
Overall Performance on Comprehensive Datasets
In Tab. 1, we provide extensive comparison results with existing state-of-the-art (SoTA) deepfake detectors based DeepFakeBench [52], where all methods are trained on FF++ (HQ) and tested on other datasets. The methods provided in the table are within the benchmark with the exact same experimental setting data. X-ray (CBI) and SBI are the baselines of only using one specific type of blendfake data. Since effectively incorporate SoTA generative methods [39, 27] and actual deepfake data, method outperforms other detectors in all evaluated cross-data metrics.
method. EfficientB4 can be treated the baseline of only using deepfake
4.3 Ablation Study
In Tab. 2, provide the baseline results in the upper part. Specifically, Blendfakee-nly (BF-only) represents using only blendfake data (i.e., CBI [27] and SBI (39]) to train the deepfake detector. Vanilla Hybrid Training (VHT) represents simply incorporates all three data (i.e., Deepfake, CBI [27], and SBI (39]) into training. can be observed that VHT is outperformed by BF-only in all cross- dataset metries, which demonstrates the empirical basis of solely using blendfake data.
Overall Ablation. In the middle part of Tab. 2, we provide the results of removing each proposed component sequentially evaluate their effectiveness. L, can enhance the simulation of the progres- sive transition and thus improve the overall detection performance. Meanwhile, Feature Bridging (FB) plays crucial role filling the continuous space between discrete anchors. In the case w/o L.. OPR cannot constrain the anchors to organize progressively and can be treated as an operation of feature self-attention, while feature bridging functions simple manifold mixup. The inferior performances of w/o L, demonstrate the effectiveness of progressively organizing latent space, rather than relying on simple tricks that might coincidentally improve performance.
Effect of Classification Strategies. In Sec. 3.1, we analyze the effect of alternative strategies for autti-attribute classification in OPR. Here, we conduct experiments to validate the performance of three different strategies, that is, Multi-class (M-C), Multi-label (M-L), and Triplet Binary (TB) strategies. The results in the lower part of Tab. 2 show that M-C performs better when in-dataset while cross-dataset performance is only marginally improved. This is because the disentanglement of
7

---

Table Ablations for each network component (AUC) and EER(). All variants are trained on FF++ (in- (nn-ataset) and evaluated on other datasets (cross- crross-dttsset, BF-only represents using only blendfake data as the negative samples. M-C, M-I., and TB denotes Multi-Class, Multi-Label, and Triplet
Binary strategies, respectively.
FF+
CDFv1
CDFv2
DFDCP
C-Avg.
Variant
AUC
EER
AUC
EER
AUC
EER
AUC
EER
AUC
EER
BF-only VHT
0.8096
0.2811
0.8413
0.2171
0.8006
0.2804
0.7791
0.3019
0.8070
0.2665
0.9353
0.1435
0.8145
0.2603
0.7710
0.2768
0.7577
0.3026
0.7811
0.2799
w/o Lo
0.9311
0.1493
0.8401
0.2281
0.7959
0.2705
0.7901
0.2737
0.8087
0.2574
w/o FB
0,9601
0.0816
0.8696
0.2001
0.8278
0.2537
0.8037
0.2811
0.8337
0.2449
w/o Le
0,9535
0.1326
0.8890
0.1799
0.8356
0.2301
0.8174
0.2636
0.8473
0.2245
M-C
0.9677
0.0835
0.8630
0.2108
0.8092
0.2739
0.7965
0.2658
0.8229
0.2501
M-L
0,9576
0.0994
0.8757
0.1893
0,8229
0.2533
0.7939
0.2748
0.8308
0.2391
TB (Ours)
0.9591
0.1014
0.9094 0.1688
0.8448 0.2136
0.8116
0.2628
0,8553
0.2151
Table 3: Ablations on leveraging oriented anchors progressively (AUC). All variants are trained on FF++ (in-dataset) and evaluated on other datasets scross-dataseds
SBI SBI-FB CBI CBI-FB DF DF-FB
FF++
CDFv1
CDFv2
DFDCP
C-Avg.
0.8176
0,8311
0.8015
0.7794
0.8040
0.8343
0.8507
0,8136
0.7659
0,8101
0.8191
0.8439
0.7917
0.7910
0,8089
V
0.8210
0.8551
0,8151
0.8081
0,8254
0.9539
0.8891
0.8336
0.7947
0.8391
0.9591
0.9094
0.8448
0.8116
0.8553
one-hot values allows deepfake learning independently but does not utilize both datasets for cross- dataset generalization. M-L performs similarly to the proposed TB since it can achieve progressive transition. Still, our method exhibits superior effectiveness considering its improved capability in discerning different forgery attributes.
Progressively Leveraging Data. To further verify the superiority of the progressive transition distribution, we explore the effects of various hybrid training schemes from an experimental per- spective. As shown in Tab. 3, we consider progressively incorporating pivot anchor data into the training samples from real to deepfake, and augmenting anchors with feature bridging (FB). Overall, by learning a progressive transition process, our method is capable of effectively utilizing forgery information contained within both blendfake and deepfake data.
4.4 Robustness against Unseen Perturbations
To comprehensively evaluate the robustness against unseen perturbations our method, we conduct experiments from two perspectives, that is, feature robustness (mPD) and detection robustness (AUC). In Tab. 4, we provide the detailed performance on the three types of distinct unseen perturbations, that is, Blick-wise masking (Block-wise), Gaussian noise (Noise), and Shifting (Shift). All perturbations are applied with random intensity ten times. Namely, Block-wise is applied with a ratio of 0.1 and 4 x 4 grids. Noise is applied with random variance selected from the range of 10 50. Shift is applied with the range of -50 to 50 on both and y axes. Fig. 5, we further provide the robustness comparisons with multiple perturbation intensities. The superior robusiness of our method stems from the organized latent space, which allows the network to leverage the rich information in hybrid training more effectively.
4.5 Analysis of Learned Feature in Latent Space
To obtain features with dimensions that can be directly visualized, we cleverly construct toy models to facilitate our analysis of the learned feature distribution. The reasons for not applying clustering visualization methods (e.g., t-SNE [45]) are demonstrated in Appendix. Specifically, modify the
8

---

35
20
Red
10
(CII)
Mirettier (CS0))
mPD. 0.89
mPD. 1.37
Degildi
Dogidde
OLIS
VHI
Ours
VHT
(h)
Figure 4: 4a: Illustration of feature organization, where our method can organize different anchors in a progressive manner, while VHT is unorganized and fails to discern blendfake and deepfake. 4b: Illustration of feature regularity. The heatmap values represent the PD at each point, and mPD is the mean PD the distribution, while smaller mPD implies better feature regularity. The results show that our method has smaller mPD and superior regularity.
Xception
EfficientNet
Block-wise
Noise
Shift
0.-
29-
29-
0.6
05
25
Level
Level
Level
Figure 5: Robustness against unseen perturbation with different intensity levels.
architecture of the backbone to extract features from 512 to 2 dimensions. Subsequently, we train two toy models using VHT and our approach while keeping all other settings consistent. Based on these toy models, we can easily visualize the actual learned features directly the 2D space. Feature Organization. In Fig. 4a, it can be observed that the distribution of features extracted by our method is aligned with our anticipated progressive transition. Simultaneously, our method enhances the separation between real and fake features, leading to improved clustering and more effective detection. In contrast, the features from VHT are unorganized and highly entangled, which is detrimental to both decision-making and feature generalization ability.
Feature Regularity. Feature regularity measures the domain shifting issue in the latent space, while a better regularity implies that the learned features are more accurate, robust, and generalizable [41, 5, 54]. To analyze the regularity the latent space organization achieved by our progressive transition scheme, apply random unseen perturbations to each data point and calculate new metric named Perturbed Distance (PD). A smaller PD suggests that the image with its perturbed versions mapped more closely in the latent space, indicating superior feature regularity and smoothness. Subsequently, mPD denotes the mean PD in a distribution. See Appendix for the precise formulation and definition of PD and mPD. As shown in Fig. 4b, the result demonstrates that our scheme organize the latent space with enhanced regularity, which is beneficial for generalization. also indicates the improved robustness of our method against unseen perturbations.
4.6 Evaluation on Alternative Organized Distribution
To further establish the superiority of the proposed organization of latent space, we conduct com- parisons with other feasible latent space distributions, including 1) Real to Deepfake to Blendfake transition (R2D2B). 2) Like a circle, blendfake and deepfake surround real with similar distances (Surround). The proposed Real to Blendfake to Deepfake transition denoted by R2B2D. In Tab. 5, it can be observed that R2D2B performs the worst since it violates the inductive observation, that

---

Table 4: The mPD4 and AUCT for robustness against unseen perturbationn on FF++ test set.
Block-wiss
Noise
Shift
Avg.
Method
mPD
AUC
mPD
AUC
mPD
AUC
mPD
AUC
VHT
1.8124
0.7978
1,4802
0.8345
0.8317
0.8737
1.3748
0.8353
Ours
0.9153
0.8694
1.0355
0.8431
0.7106
0.9015
0.8871
0.8713
Table 5: Evaluation on different latent space organizations (AUC). All variants are trained on FF++
(in-dataset) and evaluated on other datasets across-datasely
Distribution Organization
FF++
CDFv1
CDFv2
C-Avg. DFDCP
Unorganized (VHT)
0.9353
0.8145
0.7710
0.7577
0.7930
R2D2B
0,9552
0,7935
0.8126
0.7736
0.8090
Surround
0.9631
0.8836
0.8297
0.7863
0.8332
R2B2D (Ours)
0.9591
0.9094
0.8448
0.8116
0.8553
is, the real-to-fake progressive transition. Surround may be treated as another improved distribution organization compared with VHT, while it is still empirically inferior to the proposed organization.
5 Conclusion and Discussions
In this paper, we commence with question that many researchers may ponder: Can we leave deepfake data behind in training deepfake detectors? We argue that the abnormal data efficacy of vanilla hybrid training may stem from the poor latent space organization. Hence, we propose to formulate the process of "real to blendfake to deepfake" to be a progressive transition. By progressively organizing blendfake and deepfake as oriented anchors and bridging them to simulate the continuous transition, the proposed ProDet effectively utilizes both data and exhibits superior detection performance. Limitations and future work. It is intuitive to observe that the current deepfake is easier to distinguish compared to blendfake. Naturally, we can organize them based on the "real-blendfake- deepfake" to improve the learned representation. However, with the advancement of deepfake techniques, all forgery attributes in deepfake data might be significantly reduced, thus making the intuitive argument that "deepfakes Nevertheless, to simultaneously utilize blendfake and deepfake data, rational organization of the latent space still plays a crucial role. Therefore, in future work, may identify more universally distinctive characteristics between blendfake and deepfake to effectively organize the latent space. Ethic Impacts. The proposed method strives minimize negative social impacts and provide stronger protection for privacy, including the societal harms introduced by AIGC and the implications and challenges posed by detection errors. Specifically, our method improves the effectiveness and generalization ability of the deepfake detector, which could be crucial for reducing errors and mitigating the negative impact of malicious deepfake content.
easier to distinguish than blendfakes" potentially inaccurate.
6 Acknowledgments and Disclosure of Funding
We would like to thank all the reviewers for their constructive comments, Our work was supported in National Natural Science Foundation of China (NSFC) under Grant No.62171324, No.62371350, and No.62072347.
References
[1] Darius Afchar, Vincent Nozick, Junichi Yamagishi, and Isao Echizen. Mesonet: a compact facial video forgery detection network. In IEEE International Workshop Information Forensics and Security, pages 1-7. IEEE, 2018.
[2] Sharjeel Ali and Oliver van Kaick. Evaluation of latent space learning with procedurally- generated datasets of shapes. In ICCV, pages 2086-2094, 2021.
10

---

[3] Sanjeev Arora, Wei Hu, and Pravesh K Kothari. An analysis of the t-sne algorithm for data visualization. In COLT, pages 1462. PMLR, 2018.
[4] Weiming Bai, Yufan Liu, Zhipeng Zhang, Bing Li, and Weiming Hu. Aunet: Learning relations between action units for face forgery detection. In CVPR, pages 24709-24719, 2023.
[5] Francesco Barbato, Marco Toldo, Umberto Michieli, and Pietro Zanuttigh. Latent space regularization for unsupervised domain adaptation in semantic segmentation. In CVPRW, pages 2835-2845, 2021.
[6] Junyi Cao, Chao Ma, Taiping Yao, Shen Chen, Shouhong Ding, and Xiaokang Yang. End-to-end eeconstruciioncllassffattt learning for face forgery detection. In CVPR, pages 1111-112,, 2022.
[7] Liang Chen, Yong Zhang, Yibing Song, Lingqiao Liu, and Jue Wang. Self-supervised learning of adversarial example: Towards good generalizations for deepfake detection. In CVPR, pages 18710-18719, 2022.
[8] Liang Chen, Yong Zhang, Yibing Song, Jue Wang, and Lingqiao Liu. Ost: Improving gen- eralization deepfake detection via one-shot test-time training. NeurIPS, 35:24597-24610, 2022.
[9] Zhongxi Chen, Ke Sun, Ziyin Zhou, Xianming Lin, Xiaoshuai Sun, Liujuan Cao, and Rongrong Ji. Diffusionface: Towards comprehensive dataset for diffusion-basee face forgery analysis. Xrxiv preprint 4rXiv:2403.18477 2024.
[10] Jikang Cheng, Ying Zhang, Qin Zou, Zhiyuan Yan, Chao Liang, Zhongyuan Wang, and Chen Li. Ed 4; Explicit data-level debiasing for deepfake detection. arXiv preprint arXiv:2408. 06777, 2024.
[11] Jongwook Choi, Tachoon Kim, Yonghyun Jeong, Seungryul Back, and Jongwon Choi. Ex- ploiting style latent flows for generalizing deepfake detection video detection. arXiv preprint 2rXiv:2403.06592, 2024.
[12] François Chollet. Xception: Deep learning with depthwise separable convolutions. CVPR, pages 1251-1258, 2017.
[13] Taco Cohen and Max Welling. Group equivariant convolutional networks. In ICML, pages 2990-2999, PMLR, 2016.
[14] Hao Dang, Feng Liu, Joel Stehouwer, Xiaoming Liu, and Anil K Jain. On the detection of digital face manipulation. In CVPR, 2020.
[15] DeepFakes. www.github. wwt.//eeepaaeee//aceeeaaaa Accessed 2021-04-24.
[16] Deepfake detection deepfake-detectonn
challenge.
https://wwxx http://wwwwwagl..cooooooo c/
Accessed 2021-04-24.
[17] Brian Dolhansky, Joanna Bitton, Ben Pflaum, Jikuo Lu, Russ Howes, Menglin Wang, and Cris-
tian Canton Ferrer. The deepfake detection challenge dataset. arXiv preprint arXiv:2006.07397, 2020.
[18] FaceSwap. www. wtw.ehub..oo//aaaaeooooooooo httpp//........aaaaoaaaa/aaaaaaa Accessed 2021-04-24.
[19] Marta Gamelo, Kai Arulkumaran, and Murray Shanahan. Towards deep symbolic reinforcement learning. arXiv preprins arXiv: 2016.
[20] Jiazhi Guan, Hang Zhou, Zhibin Hong. Errui Ding, Jingdong Wang, Chengbin Quan, and Youjian Zhao. Delving into sequential patches for deepfake detection. NeurIPS, 35:4517-4530, 2022.
[21] Alexandros Haliassos, Rodrigo Mira, Stavros Petridis, and Maja Pantic. Leveraging real talking faces via self-supervision for robust forgery detection. In CVPR, pages 14950-14990 2022.

---

[22] Alexandros Haliassos, Konstantinos Vougioukas, Stavros Petridis, and Maja Pantic. Lips don't t lie: A generalisable and robust approach face forgery detection. In CVPR, 2021.
[23] Irina Higgins, David Amos, David Pfau, Sebastien Racaniere, Loic Matthey, Danilo Rezende, and Alexander Lerchner. Towards a definition of disentangled representations. arXiv preprint arXiv:1812.02230,, 2018.
[24] Baojin Huang, Zhongyuan Wang, Jifan Yang, Jiaxin Ai, Qin Zou, Qian Wang, and Dengpan Ye. Implicit identity driven deepfake face swapping detection. In CVPR, pages 4490 4499, 2023.
[25] Davis E King. Dlib-ml: A machine learning toolkit. JMLR, 10:1755-1758, 2009.
[26] Hiroki Kojima and Takashi Ikegami. Organization of latent space structure in vac/gan trained by navigation data. Neural Networks, 152:234-243, 2022.
[27] Lingzhi Li, Jianmin Bao, Ting Zhang, Hao Yang, Dong Chen, Fang Wen, and Baining Guo. Face x-ray for more general face forgery detection. In CVPR, 2020.
[28] Yuezun Li and Siwei Lyu. Exposing deepfake videos by detecting face warping artifacts. arXiv preprint arXiv: 10X1vv8111.00655. 2018.
[29] Yuezun Li, Xin Yang, Pu Sun, Honggang Qi, and Siwei Lyu. Celeb-df:: A new dataset for deepfake forensics. In CVPR, 2020.
[30] Jiahao Liang, Huafeng Shi, and Weihong Deng. Exploring disentangled content information for face forgery detection. In ECCV, pages 128-145, Springer, 2022.
[31] Honggu Liu, Xiaodan Li, Wenbo Zhou, Yuefeng Chen, Yuan He, Hui Xue, Weiming Zhang, and Nenghai Yu. Spatial-phase shallow learning: rethinking face forgery detection in frequency domain. In CVPR, pages 772-781, 2021.
[32] Zhian Liu, Maomao Li, Yong Zhang, Cairong Wang. Qi Zhang, Jue Wang, and Yongwei Nic. Fine-grained face swapping via regional gan inversion. CVPR, pages 8578-8587, 2023.
[33] Yuchen Luo, Yong Zhang, Junchi Yan, and Wei Liu. Generalizing face forgery detection with figh-frrquency features. In CVPR, 2021.
[34] Huy H Nguyen, Junichi Yamagishi, and Isao Bchizen. Capsule-forensics: Using capsule networks to detect forged images and videos. In ICASSP, pages 2307-2311, IEEE, 2019.
[35] Yunsheng Ni, Depu Meng, Changqian Yu, Chengbin Quan, Dongchun Ren, and Youjian Zhao. Core: Consistent representation learning for face forgery detection. In CVPR Workshop, pages 12-21, 2022.
[36] Yuyang Qian, Guojun Yin, Lu Sheng, Zixuan Chen, and Jing Shao. Thinking in frequency: Face forgery detection by mining frequency-aware clues. In ECCV, pages 86-103. Springer, 2020.
[37] Andreas Rossler, Davide Cozzolino, Luisa Verdoliva, Christian Riess, Justus Thies, and Matthias Nießner. Faceforensics++: Learning to detect manipulated facial images. In ICCV, pages 1-11, 2019.
[38] Ramprasaath R Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedantam, Devi Parikh, and Dhruv Batra. Grad-cam: Visual explanations from deep networks via gradient-based localization. In ICCV, pages 618-626, 2017.
[39] Kaede Shiohara and Toshihiko Yamasaki. Detecting deepfakes with self-blended images. In CVPR, pages 18720-18729, 2022.
[40] Kaede Shiohara, Xingchao Yang, and Takafumi Taketomi. Blendface: Re-designing identity encoders for face-swapping. In ICCV, pages 7634-7644, 2023.
[41] Samarth Sinha and Adji Bousso Dieng. Consistency regularization for variational auto-encoders. NeurIPS, 14:12243-1295 2021.
12

---

[42] Mingxing Tan and Quoc Le. Efficientnet: Rethinking model scaling for convolutional neural networks. ICML, pages 6105-6114. PMLR, 2019.
[43] Justus Thies, Michael Zollhöfer, and Matthias Nießner. Deferred neural rendering: Image synthesis using neural textures. TOG, 38(4):1-12,
[44] Justus Thies, Michael Zollhofer, Mare Stamminger, Christian Theobalt, and Matthias Nießner. Face2face: Real-time face capture and reenactment of rgb videos. In CVPR, pages 2387-2395, 2016.
[45] Laurens Van der Maaten and Geoffrey Hinton. Visualizing data using t-sne. Journal of machine learning research, 9(11), 2008.
[46] Sheng- Yu Wang. Oliver Wang, Richard Zhang, Andrew Owens, and Alexei A Efros. Cnn- generated images are surprisingly easy to spot... for now. In CVPR, pages 8695-8704, 2020.
[47] Zhendong Wang, Jianmin Bao, Wengang Zhou, Weilun Wang, and Houqiang Li. Altfreezing for more general video face forgery detection. In CVPR, pages 4129 4138, 2023.
[48] Chao Xu, Jiangning Zhang, Yue Han, Guanzhong Tian, Xianfang Zeng. Ying Tai, Yabiao Wang, Chengjie Wang, and Yong Liu. Designing one unified framework for high-fidelity face reenactment and swapping. In ECCV, pages 54-71. Springer, 2022.
[49] Zhiliang Xu, Zhibin Hong, Changxing Ding, Zhen Zhu, Junyu Han, Jingtuo Liu, and Errui Ding. Mobilefaceswap: A lightweight framework for video face swapping. In Proceedings of the 2022.
AAAI Conference on Artificial Intelligence volume 36, pages
[50] Zhiyuan Yan, Taiping Yao, Shen Chen, Yandan Zhao, Xinghe Fu, Junwei Zhu, Donghao Luo, Li Yuan, Chengjie Wang, Shouhong Ding, et al. Df40: Toward next-generation deepfake detection. arXiv preprint urXiv:2406.13496 2024.
[51] Zhiyuan Yan, Yong Zhang, Yanbo Fan, and Baoyuan Wu. Ucf: Uncovering common features for generalizable deepfake detection. ICCV, 2023.
[52] Zhiyuan Yan, Yong Zhang, Xinhang Yuan, Siwei Lyu, and Baoyuan Wu. Deepfakebench: A comprehensive benchmark of deepfake detection. arXiv preprint arXiv:2307.0 2023.
[53] Fengyu Yang and Chenyang Ma. Sparse and complete latent organization for geospatial semantic segmentation. In CVPR, pages 1809-1818. 2022.
[54] Shufei Zhang, Zhuang Qian, Kaizhu Huang, Qiufeng Wang, Rui Zhang, and Xinping Yi. Towards better robust generalization with shift consistency regularization. In ICML, pages 12524-12534. PMLR, 2021.
[55] Tianchen Zhao, Xiang Xu, Mingze Xu, Hui Ding, Yuanjun Xiong, and Wei Xia. Learning self-consistency for deepfake detection. In ICCV, pages 15023-15033 2021.
[56] Wenliang Zhao, Yongming Rao, Weikang Shi, Zuyan Liu, Jie Zhou, and Jiwen Lu. Diffswap: High-fidelity and controllable face swapping via 3d-aware masked diffusion. In CVPR, pages 2023.
[57] Yinglin Zheng, Jianmin Bao, Dong Chen, Ming Zeng. and Fang Wen. Exploring temporal coherence for more general video face forgery detection. In ICCV, pages 15044-15054, 2021.
13

---

7 Appendix
Blendaale (SBD) (Cerd
Deepfalon
(SHI)
(CRI)
Deppfak
Figure 6: The examples for the real-to-fake progressive transition.
7.1 More Perceptual Examples for the Inductive Observation of real-to-fake Progressive Transition
Considering that this paper is primarily based on the observation of "progressive transition from real to fake", in Fig. 6, we present additional perceptual examples to provide a comprehensive impression. is evident that sequentially from real blendfake to deepfake, they become casier to distinguish as fake and the forgery information is accumulated. Therefore, it is intuitive to improve the latent space organization based on such inductive observation.
7.2 Detailed Experimental Environments for Reproducibility
In this paper, all experiments are conducted based on an open-source benchmark DeepfakeBench [52]. Specifically, for face extraction, we deploy an 81 facial landmarks shape predictor in Dlib [25] and select the detected rectangle with the biggest area one frame. We use 32 frames in each video for both training and testing. During training, various data augmentation techniques are deployed including JPEG compression, random brightness and contrast, rotation, and median blur.
Y/N
Y/NN
Multi- class dassification
Multi-laba dassification
Triplet hinary classification
Figure 7: Three different strategies for the multi-attriutt classifier OPR. The solid patterns signify the detected classes, whereas hollow patterns denote those that are not detected.
14

---

Table 6: Cross-dataset performance comparisons with video-based methods. We use video-level AUC
as the evaluation metric. All methods are trained on FF++ [37] and test on other datasets.
Venues
Celeb-DF-v2
DFDC
Avg.
LipForensics [22]
CVPR21
0.824
0.735
0.780
FTCN [57]
ICCV21
0.869
0.740
0,805
RealForensies [21]
CVPR22
0.857
0.759
0.808
AltFreezing [47]
CVPR23
0.895
Choi et al. [11]
CVPR24
0.890
Ours
0.925
0.770
0.848
7.3 Detailed Implementation of Classification Strategies
As shown in Fig. 7, provide the detailed implementation of three different strategies. For the multi-class strategy with four classes, labels appear to be progressively assigned from 0 to 3. Namely, can be treated classifying real, SBI, CBI, and deepfake, respectively. However, the positions of each one-hot value are disentangled and can be rearranged arbitrarily. Therefore, the multi-class strategy inherently unable to grant different anchors to organized in a progressive manner. The latter two strategies can achieve similar effects of accumulating forgery attributes, therefore, their experimental performances are relatively closer. Still, we attribute the superior performance of triplet binary classification to its enhanced ability in disentangling forgery attributes.
7.4 Precise Formulation and Definition of Mean Perturbed Distance (mPD)
As we discussed in the main paper, we designed new metric termed mean perturbed distance (mPD) to measure the feature robustness of each data point. Supposing the data point and its extracted feature as and F, applying perturbation on can be written as P(I,r), where P() is the perturbation function and r is a randomly generated value for the perturbation intensity. By performing r) with random P and r and extracting their features, we can obtain set of perturbed feature {Fi, F2 F. Then, we calculate the average Euclidean distances between the original features and ten perturbed features. Finally, we standardize the distances in distribution with different orders of magnitude. Therefore, the PD be written as:
FF + (F))
PD Σ
F.FF atd
where F Fand denotes the standard deviation of each dimension in one distribution. Finally, the mPD of one distribution {F1, F2 ..... Fm)) can be formulated
(F)) (F
mPD
(10)
mnF std
j=1=1
7.5 Generalization Assessment on Wider Scales
Comparison with Video-level Methods. Given that the proposed method makes decisions based on one single image frame, the main paper includes comparisons with other frame-level methods and measures their performance using frame-level AUC. Nevertheless, rideo-based deepfake detection methods can also achieve promising results. Therefore, in Tab. 6, we compare the cross- -rtssed generalization ability of our method with state-of-the-ar video-based methods, taking video-level AUC as the metric. The results of comparison methods are copied from their official papers. By leveraging both blendfake and deepfake effectively, our method achieves the best performance among those methods.
Evaluations on More Various and Advanced Datasets. We further enlarge the evaluation scope by considering several key aspects. Firstly, utilize nine different deepfake datasets to ensure the
15

---

Table 7: Generalization evaluations on comprehensive datasets.
Methods
DFD
DFL.0
FAVC
WDF
DiftSwap
UniFace
E4S
BlendFace
SobileSwap
DF-only 0.8144/0.862 0.7462/0.747 7474 0.804/0.9155 0,7275/0.6883 0, 0,7989/- 0,7775/0 8215 0,651470,6955
0,781340.88 340 0,8475/0.900 9053
BF-oaly 0.8378/0.890 0.7345/0.7811 0.8627/0.9237 0.7563/0.7965
0.8265/-
0.6745/0.600 6998 0.6797/0.713 0.8041/0.8522 0.88830092299
VIT 0.8215/0.8505 0.7702/0.8312 0.8402/0.9125
0.72630.7811
0.7961/-
0.844500.999 0.670490.100
0.831 IAU.800
0.8729099295
Ours
0.858190.9033 0.7902/0.8536
0,9077/0.9766
0.771800.2887
0.8459/-
0.8441/0.9077
0.7103/0.7711
0.8619/0.9277
0.9285/0.9748
(Sen)fake
Blendiake (CBI)
Deepfake
Hlendlakke (SBI)
Bleenffake
Deepfakk
Figure 8: Saliency map visualization for VHT (left) and method (right).
diversity and comprehensiveness of the testing data in our evaluation. Secondly, we include the latest synthesis methods by using testing data from newly released deepfake datasets 2024. These datasets incorporate advanced deepfake techniques such as UniFace [48]. E4S [32], BlendFace [40], and MobileSwap [49] from DF40 [50]. as well as DiffSwap [56] from DiffusionFaac [9]. Finally, our evaluation design involves different variants, including Deepfake-only (DF-only), Blendfake-only (BF-only), VHT, and our proposed method. These variants are used in ablation studies using both humee-leve/vvdee-lleee AUC. As shown in Tab. 7, we can observe that our method consistently exhibits superiority in almost every testing data, which empirically suggests an improved generalization result.
7.6 Analysis of Attention Regions
To analyze the regions of interest in the network, we used Grad-CAM [38] to generate saliency maps for visualization. As shown in Fig. 8, VHT consistently focuses on partial regions the face and fails to discern different fake data in aligned video frames. In contrast, our method can perceive forgery information from the broader regions face and the attention regions are more adaptive to different fake data.
7.7 Further experiments for learned feature representations.
7.7.1 Discussion on the t-SNE Visualization
Here, we demonstrate through experiments why we chose construct toy models rather than directly visualizing the features extracted from original models using t-SNE [45]. In Fig. 9, the t-SNE and the actual feature distribution (see Fig. 4a) of the toy model are highly similar in terms of clustering. However, unlike the actual distribution, the progressive transitions between anchors are not precisely presented by t-SNE. This indicates that t-SNE is good at clustering [3] but performs limited in visualizing the distribution of progressive transitions, which is crucial for estimating our method. We also provide the t-SNE results of the original model. Based on our prior analysis of the t-SNF-feature pair results the toy models, it can be anticipated that the progressive transitions in the t-SNE results
16

---

Red
Despiio
Ouis (toy)
VHI (loy)
Ouis (original)
VHT (odiinel)
Figure 9: The t-SNE visualization for both toy and original models.
DFDCP
Loght Dibiibution Rled and Fake Cheoss
Logel Dektibzikon of Gazer
014
014
010
010
0.50
Confiiccoo Disibbution Roal Falc
Conficoncc Desiitution Realland
Hea
Ours
VHT
Celeb- DF-D2FF-22
Logal Dbblbbubbn of Read und Fuke Chooss
Loge Dede of Real and Fater Cuzser
012
212
0.8
0.5
Confidpeco Disiibutoon Real and Falec Clossos
Conficince Dealbution of Real Fake Classes
Take
Ours
VHT
Figure 10: Distributions of the predicted confidence and logit outputs of Ours and VHT on DFDCP and Coleb-DF-v2. The y-value represents the probability of one sample falling within the corresponding x-value interval. Zoom in for better illustration.
will not be prominent. Nonetheless, it is still evident that our approach exhibits better clustering while exhibiting progressive transitions to certain extent.
7.7.2 Distributions of the predicted confidence and logit outputs.
In Fig. 10, we provide further investigation of the learned information of VHT and our method. Specifically, we summarize and analyze the distribution of logits output and confidence from VHT and Ours. We notice that VHT is less confident in both fake and real data. As we discussed, this
17

---

may be because naively combining DF and BF for training confuses the network, thus limiting its confidence in "understanding" the forgery representation of distinet BF and DF. In contrast, our model can predict both fake and real with high confidence since the model "understands" how real gradually becomes more and more fakes.
18

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: Our abstract and introduction have precisely and concisely summarized the contributions of this paper.
2. Limitations
Question: Does the paper discuss the limitations the work performed by the authors?
Answer: [NA]
Justification: Currently, we have discovered significant limitations of method.
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?
Answer: [NA]
Justification: This paper does not include theoretical results.
4. Experimental Result Reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Answer: [Yes]
Justification: We have fully disclosed the information for the reproduction experimental results in this paper.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
Justification: We will open-source the code shortly after publication.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: We have clearly demonstrated the experimental setting that is necessary to understand the reported results.
7. Experiment Statistical Significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [Yes]
Justification: We have considered the randomness that may occur in the experiments.
8. Experiments Compute Resources
Question: For each experiment, does the paper provide sufficient information the puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Answer: [Yes]
Justification: We have clearly illustrated the resources used for experiments.
19

---

9. Code Of Ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethics httpshsssh.////es......ppppppppp cttppscccccpbbleeciiiiiiiiiiiied
Answer: [Yes]
Justification: The research in this paper is conformed with the NeurIPS Code of Ethics.
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification:
We have discuss the potential societal impacts of the research this paper.
Safeguards
Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Answer: [NA]
Justification: Our research has no such risks.
12. Licenses for existing assets
Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification: Our code and data are properly credited with the proper license.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification: The paper does not release new assets.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification: The paper does not involve crowdsourcing nor research with human subjects. 15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: The paper does not involve crowdsourcing nor research with human subjects.
20


Reviews:
[{"review_id": "2MSilcigTq", "reviewer": "Reviewer_LWpa", "summary": "The paper explores the utilization of blendfake and pseudo-fake data in training deepfake detectors. It argues that the significance of deepfake samples has been underestimated due to insufficient exploration. To better exploit both pseudo-fake and deepfake data, the paper introduces a progressive transition from \"real to blendfake to deepfake\" and proposes a hybrid training scheme. This scheme includes an oriented progressive regularizer (OPR) to model the transition and a feature bridging strategy to simulate a continuous transition.The paper explores the utilization of blendfake and pseudo-fake data in training deepfake detectors. It argues that the significance of deepfake samples has been underestimated due to insufficient exploration. To better exploit both pseudo-fake and deepfake data, the paper introduces a progressive transition from \"real to blendfake to deepfake\" and proposes a hybrid training scheme. This scheme includes an oriented progressive regularizer (OPR) to model the transition and a feature bridging strategy to simulate a continuous transition.", "questions": "See in weakness", "limitations": "See in weakness", "rating": 7, "confidence": 4, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "1.The paper is well-motivated, and the proposed solution is both intuitive and effective.\n2.The experiments robustly demonstrate the rationality and effectiveness of the proposed design.", "weaknesses": "1. Choice of Blend Algorithms: The paper does not provide sufficient explanation or discussion on the choice of blendfake image algorithms (SBI and CBI). As mentioned in Section 2.2, there are many other methods for crafting blendfake images. Would these methods be effective as well?\n2. Interpolation Strategy: In Section 3.2, the paper introduces an interpolation strategy to achieve a smoother transition from real to deepfake. Why was interpolation performed at the feature level, and would setting multiple mixing parameters (alpha) for more interpolations further improve performance?\n3. Possible Typos: There might be a typo on line 149, $M_a$.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "# **Response to Reviewer LWpa**\nWe sincerely appreciate the reviewer's positive comments and rating on our paper, and the following are our point-to-point responses\n\n**Q1. Choice of Blend Algorithms： Why apply SBI and CBI instead of other Blendfake methods?**\n\n**R1.** Thanks for your thoughtful suggestion. Actually, the terms SBI and CBI in our paper **do not refer to two specific methods** (*i.e.*, SBI'22 [1] and X-ray), but a full set of methods with the **techniques of Self-Blended and Cross-Blended**. Therefore, we can surely take other Self-Blended methods or Cross-Blended methods in our current framework. To validate experimentally, we take FWA (another Self-Blended method) and I2G (another Cross-Blended method) to conduct a concise ablation study:\n| Methods | Blendfake Types | CDFv1 | CDFv2 | DFDCP | Avg. |\n|----------|----------|----------|----------|----------|----------|\n| VHT  | FWA, I2G   | 0.7894  | 0.6953   | 0.6575   | 0.7424   |\n| VHT  | SBI'22, X-ray   | 0.8145  | 0.7710   | 0.7577   | 0.7811   |\n| Ours   | FWA, I2G   | 0.8235   | 0.7746   | 0.7539   | 0.7990   |\n|Ours   | SBI'22, X-ray   |0.9094   | 0.8448   | 0.8116   | 0.8771   |\n\nIt is evident that our method can also **enhance the performance of FWA&I2G** trained VHT model, while using SBI'22&X-ary performs essentially better.\n\n\n**Q2. The reason for applying interpolation on feature-level, and could mixing parameters $\\alpha$ are set multiply for enhanced performance.**\n\n**R2.** We genuinely appreciate the consideration. \n- For the first question, the latent-space interpolation is performed to achieve **feature bridging** between two adjacent anchors (e.g., from SBI to CBI). This simulates the progressive and oriented transition of data becoming \"more and more\" fake starting from real. This process is illustrated intuitively in Figure 2 of the manuscript.\n- For the second question, $\\alpha$ is randomly sampled from $U(0,1)$, where $U(a,b)$ denotes the Uniform distribution with the bounds of $a$ and $b$. Therefore, for diversity and enhanced performance, $\\alpha$ is indeed a parameter with multiple values in our method.\n\n**Q3. Possible Typos**\n\n**R3.** Thanks. Please refer to **Common Responses R3**.\n\n[1] Kaede Shiohara and Toshihiko Yamasaki. Detecting deepfakes with self-blended images. In CVPR2022", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "R2H7yNcK6w", "reviewer": "Reviewer_t2ao", "summary": "This paper investigates the generalization ability of deepfake detectors and proposes a novel training approach using \"blendfake\" data to enhance the model's learning of generic forgery artifacts. The authors point out that existing state-of-the-art methods do not incorporate deepfake data in their training process, which contradicts previous empirical observations. The paper introduces an \"Oriented Progressive Regularizor\" (OPR) to establish constraints on anchor distribution and proposes feature bridging to facilitate smooth transitions. Experimental results indicate that the proposed method effectively utilizes forgery information from both blendfake and deepfake.", "questions": "- In ablation Table 2, the AUC of VHT is lower than that of BF-only in cross-dataset comparison, which is opposite to the statement in line 230.\n- Are all the training sets for the SOTA model comparisons the same? How do you control the blendfake and deepfake training datasets for different models?", "limitations": "The authors believe that the reason VHT performs worse than blendfake-only is due to the unorganized latent-space distribution. Although the results indicate that the proposed method is effective, there is a lack of detailed experimental validation for attribution.", "rating": 4, "confidence": 3, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "- Proposes a new training method that may enhance the generalization capability of deepfake detectors.\n- Introduces OPR and feature bridging techniques to improve the model's recognition of forgery features.", "weaknesses": "- The attribution of the unorganized latent-space distribution lacks comprehensive experiments.\n- There are some minor writing issues, such as the consistency of using SOTA and SoTA.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "# **Response to Reviewer t2ao**\nThanks for your comments. Below we provide a point-by-point response to address the concern from the respected reviewer.\n\n**Q1. The attribution of the unorganized latent-space distribution lacks comprehensive experiments.**\n\n**R1.** Thanks for the concern. Please refer to **Common Responses R2**, where we comprehensively clarified this concern.\n\n**Q2. Writing issues** \n\n**R2.** Thanks. Please refer to  **Common Responses R3**.\n\n**Q3. Results in Tab. 3 may be opposite to our statement in line 230.**\n\n**R3.** Thanks for the concern. Actually, in line 230 we stated: 'VHT is **outperformed by** BF-only', which is **consistent** with the experimental results in Tab. 3, that is the reviewer mentioned 'VHT is **lower than** that of BF-only'.\n\n**Q4. Concerns about the training dataset for different methods**\n\n**R4.** Thanks for your thoughtful consideration. Here, we redesign the structure of the table to clarify our training data settings. All results are extracted and summarized from the corresponding parts in Tab. 1, 2, and 3 in our manuscript. For fair comparisons, all methods are deployed with the same backbone, *i.e.*, EfficientB4. \n| Methods| Training set | Celeb-DF-v1 |Celeb-DF-v2 | DFDCP |C-Avg.|\n|----------|----------|----------|----------|----------|----------|\n| EfficientB4  | DF  | 0.7909   | 0.7487  | 0.7283   | 0.7560 |\n| SBI  | SBI   | 0.8311  | 0.8015   | 0.7794   |  0.8040 |\n| Face X-ray  | DF,CBI | 0.7093   | 0.6786   | 0.6942   | 0.6940 |\n| BF-only  | SBI, CBI  | 0.8413   | 0.8006   | 0.7791   |  0.8070 |\n| VHT  | SBI, CBI, DF   | 0.8145   | 0.7710   | 0.7577   | 0.7810  |\n| Ours  | SBI, CBI, DF    | 0.9094   | 0.8448   | 0.8116  | 0.8553|\n\n\nOur paper holds the view that naively hybridizing more training data may undermine the cross-dataset performance (validated by BF-only > VHT). Therefore, the difference in training set **is not a biased setting**, instead, it demonstrates the superiority of our method in leveraging multiple data effectively.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "J1zimi86zm", "reviewer": "Reviewer_Ssp1", "summary": "The authors introduced a method aimed at detecting deepfakes. Their approach, known as Oriented Progressive Regularizor (OPR), employs a progressive transition strategy. This strategy is designed to enable the model to effectively train on a combination of blendfake and deepfake data, ultimately leading to improved performance. The experimental results indicated that this method surpasses current state-of-the-art (SOTA) approaches when tested on deepfake datasets.", "questions": "See the above comments.", "limitations": "See the above comments.", "rating": 5, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "The paper provides a fresh perspective on the well-known problem of deepfake detection, which should be appreciated.\n\nThe paper is mostly well-written. The arguments and results presented are easy to understand.\n\nThe authors performed an extensive evaluation.", "weaknesses": "Argument on Blendfake: The argument that blendfake data alone is sufficient for training deepfake detectors is based on empirical observations on certain datasets or benchmarks with some particular deepfake detection models and may not hold universally. I would suggest toning down that claim or providing the exact conditions when this argument holds.\n\nCDFv1 vs CDFv2: I believe that using CDFv1 for evaluation may not be necessary. It would have been more beneficial to utilize a different deepfake benchmark dataset such as FakeAVCele, DFD from Google/Jigsaw, or RWDF-23 (please refer to this repository for additional information https://github.com/Daisy-Zhang/Awesome-Deepfakes-Detection). The same applies to DFDC and DFDCP. I advocate for incorporating more diversity in the selection of benchmark datasets. In essence, the authors compared against three datasets instead of five, which is still an acceptable number.\n\nDatasets: The authors utilized widely known deepfake datasets from 2019 in their research. However, considering the rapid advancements in deepfake technology since then, I believe these datasets may no longer accurately represent the current landscape. It would be valuable for the authors to include an assessment of their method using real-world deepfake videos sourced from social media and other online platforms. By doing so, they can demonstrate the effectiveness of their proposed solution in addressing contemporary and future iterations of deepfakes.\n\nProgressive transition: Currently, the Progressive transition goes like this \"Real --> Blendfake (SBI) --> Blendfake (CBI) --> Deepfake\". I could imagine it being further extended to have addition of compression or adversarial artefacts (i.e., \"Real --> Blendfake (SBI) --> Blendfake (CBI) --> Deepfake--> compression and other artefacts\"). That way one could really see a generalisable pipeline that could incorporate the variance in the types of deepfakes available on social media and will greatly increase the quality of the work.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "# **Response to Reviewer Ssp1**\nWe are thankful for the reviewer's positive comments and interest in our research. We hope that the following point-by-point responses will enable the respected reviewer to further recognize our work.\n\n**Q1. The argument of 'blendfake data is sufficient' is based on empirical observations on certain datasets, which may be not the universe.**\n\n**R1.** We appreciate the reviewer's insightful observation. Our main point is that *while BF-only might not always outperform DF-only across all datasets, our method still demonstrates non-trivial advantages.*\n- To comprehensively investigate the effectiveness of DF and BF (using more datasets, not limited to \"DF-series\"), we enlarge our original evaluations by using **9** distinct deepfake datasets (see **Common Responses R1**). The results show that the situation of 'BF-only<DF-only' indeed sometimes exists, which validates the scoping concern from the respected reviewer. \n- However, **this does not undermine the significance of our method**. Namely, it can be observed that the VHT still fails to consistently achieve the effect of \"1+1>2\" and *shows degradation compared to BF-only*. In contrast, our method *effectively leverages both DF and BF data* and achieves superior performance compared with VHT, and so does DF-only and BF-only.\n\n**Q2. More advanced and in-the-wild datasets (FakeAVCele, DFD, and RWDF-23) are recommended to be included.**\n\n**R2.** We have provided more experimental results including the datasets you've mentioned. Please refer to **Common Responses R1**.\n\n**Q3. The progressive transition pipeline could be promoted to be more generalizable, for instance, by incorporating compression.**\n\n**R3.** We appreciate the reviewer's interest in gaining deeper insights into the proposed progressive transition pipeline. We value this suggestion very much and carefully conduct an experiment based on the pipeline of **'Real->Real (Compression)->SBI->CBI->DF'**. Notably, we do not place the Real (Compression) after DF as mentioned by the respected reviewer since we believe Compression is *not a faker version of DF*, considering it has no id-inconsistency or DF artifacts. Instead, Compression can be closer to the SBI, which actually involves compression operations in its creation process. The *frame-level* AUC results are shown below:\n|Methods|CDFv2|DFDCP|DFD|Avg.|\n|-|-|-|-|-|\n|Ours|0.8448|0.8116|0.8581|0.8382|\n|Ours+Compression|0.8351|0.8019|0.8604|0.8325|\n\nIt can be observed that adding compression **exerts little effect** on experimental results, which may be due to the fact that random compression is already deployed as a data augmentation strategy for all training data. Still, we believe that this insight from the respected reviewer is **of great value**, which is very inspiring to us. For example, we may incorporate \"**Facial Beautification Algorithm**\" or \"**Photoshop Image**\" into the progressive pipeline to enhance the generalization and application scope. We are passionate about validating these ideas in our future works.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "Bz01k7m02V", "reviewer": "Reviewer_6DHe", "summary": "This study introduces a novel training strategy for Deepfake detection using real, blendfake, and deepfake datasets. By designing an oriented progressive regularizer and a feature bridging module, the proposed approach effectively extracts forgery information from the training data, resulting in enhanced generalizability.", "questions": "1. In Table 4, is R2B2D the same as D2B2R?\n2. What is the real/fake label of the mix of F_r and F_s?", "limitations": "N.A.", "rating": 4, "confidence": 5, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "The proposed method categorizes forgery faces into several types: SBI, CBI, and Deepfake faces, each containing distinct forgery artifacts, such as blending clues, identity inconsistencies, and generative fingerprints. The fine-grained learning scheme encourages the model to learn representative features from the training data, thus achieving robust and general face forgery detection.", "weaknesses": "1. The method employs a progressive transition from real to blendfake to deepfake samples. However, the necessity of continuity in these features remains unclear. The transition from real to fake faces, as depicted in Fig. 2, appears conceptually weird. The rationale behind the feature bridging and transition design is not well-explained. The progressive transition between adjacent anchors seems unusual, and the reasoning for a continuous rather than discrete transition is not justified.\n2. Despite the generative artifacts present in deepfake data, it remains ambiguous why directly incorporating blendfake and deepfake data during training degrades performance. The authors suggest that direct VHT may fail to disentangle the learned representation in the latent space, but no experiments support this claim.\n3. Fig. 1(b) does not appear to be an experimental result, which is crucial for validating the work's motivation.\n4. In Line 44-45, the authors raised a question “Can the blendfake face entirely substitute the actual AI-generated deepfake face in training deepfake detectors?” However, this question has already been addressed by Face X-ray and SBI, which successfully use blendfake data to train general models.\n5. The term A^T in Eq. (6) is not explained.\n6. It is unclear why features augmented with noise should be mapped to a more fake distribution.\n7. More Deepfake datasets, such as WildDeepfake and DeepForensics-1.0, should be included in cross-dataset evaluations.\n8. For robustness evaluations in Table 6, the method should be compared with recent state-of-the-art deepfake detection methods, and more severity levels for each perturbation type should be included to mimic complex real-world scenarios.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thanks for the insightful comments. Here, we carefully clarify each issue mentioned by the respected reviewer.\n\n**Q1. What is the motivation for conceptualizing real to fake as a progressive transition?  Why it should be continuous rather than discrete?**\n\n**R1.** Thanks for this concern.  We endeavor to address this with a systematic and comprehensive response: \n- **Motivation of Progressive Transition**: Our paper seeks to effectively utilize both DF and BF data by taking the SBI and CBI as the intermediate anchors, where we **conceptualize \"Real->SBI->CBI->DF\" as a process of getting more and more fake**. It is intuitively apparent (Fig. 2 and Fig. 5 in the manuscript) and could be emphasized as accumulating forgery attributes (*i.e.*, blending clue, ID-inconsistency, and generative artifacts). Hence, we leverage this 'inductive bias' to organize the latent-space distribution, and thus achieve utilizing both DF and BF data effectively.\n- **Continuous or Discrete**: Building continuous bridges between adjacent anchors is based on the **inherent natures** and realizations of SBI, CBI, and DF. **Here, we would like to illustrate these natures in detail.** \n    - Taking Real->SBI as an example: SBI is generated by blending two versions of one Real transformed by augmentations (*e.g.*, blur, compression, and landmark shifting) with different severity levels. It can be emphasized that the unalignment levels of two transformed versions are controlled by an abstract parameter $\\epsilon$, which represents the severity level of the blending clue. *Blending with a small $\\epsilon$ produces an image that can be treated as Real with little perturbations, while large $\\epsilon$ produces an SBI with severe blending clue*. Notably, we cannot assert a certain value of $\\epsilon$ that when below it, the transformed image is fake and above it is real. That is, **we cannot define a clear decision boundary between Real and SBI**. Therefore, we can conclude that **the transition between Real and SBI is Continuous** according to the increase of blending clues. \n    - Analogously, SBI to CBI might controlled by the increase of ID-inconsistency, and from CBI to Deepfake might controlled by the generative artifacts. Both can be subsequently treated as continuous transitions.\n\nTherefore, we conceptualize the process of 'Real->SBI->CBI->DF' as a **progressive and continuous transition**. The necessity of continuity and progress, as we analyzed above, explains the rationale behind deploying transition and bridging. That is, the motivation to apply bridging and transition loss to simulate the conceptualized continuous and progressive transition.\n\n**Q2&3. Lacks experimental validation to the claimed motivation, that is, the latent space of VHT is not organized.**\n\n**R2&3.** Please refer to **Common Responses R2**, where we carefully address this concern.\n\n**Q4. The successful results in Face X-ray and SBI have already addressed the issue that we raised about substituting DF with BF.** \n\n**R4.** Thanks for your thoughtful consideration.  We would like to clarify it as follows. \n- As mentioned by the reviewer, the results of Face X-ray and SBI empirically show that **BF *may* substitute DF** considering 'DF-only < VHT< BF-only'. However, **it is precisely the 'stereotype' that our paper actually seeks to break down**. \n- The contribution and conclusion of our work is: using both of them to organize the latent space progressively can be more effective than using BF only, and thus **BF cannot substitute DF**. We show detailed analysis and validation for this point in **R2 of the Common Responses**.\n- This new answer is validated by the results of 'DF-only < VHT < BF-only < Ours' (Tab. 2 in manuscript).\n\n**Q5. $A^T$ is not defined**\n\n**R5.** Thanks for the kind mention. The superscript $T$ is commonly used to represent **transpose matrix**. We will explicitly define $T$ in the updated manuscript.\n\n**Q6. The rationale behind augmented with noise should be mapped to a more fake distribution**\n\n**R6.** We are grateful for your insightful concern. The transition loss is applied to **simulate the progressive transition between two adjacent anchors**. Specifically, we leverage '**noise+swallow network mapping**' to build a less complex mapping path between adjacent anchors, simulating the path of progressive transition. Therefore, augmenting noise to feature actually represents the transition relationship between two adjacent anchors. Whereas in the case of Real->BF->DF, it represents getting more fake.\n\n**Q7. More datasets (WDF and DF-1.0) should be included.**\n\n**R7.** We have provided more experimental results including the datasets you've mentioned. Please refer to **Common Responses R1**.\n\n**Q8. Robustness comparisons with SoTA and multi-intensity.**\n\n**R8.** Thanks. In Author-Rebuttal-PDF-Fig. 1, we hereby provide robustness evaluation with multi-level unseen perturbations and comparing with SoTAs. The robust performance of our method indicates its **effectiveness in complex real-world scenarios**. We will **update our manuscript** with this more comprehensive robustness evaluation.\n\n\n**Q9. In Table 4, is R2B2D the same as D2B2R?**\n\n**R9.** Thanks for this insightful concern. From the perspective of implementation, the code of R2B2D should be the same as D2B2R except for inverting the attribute labels. Therefore, **their experimental results are also expected to be consistent**. Theoretically, D2B2R should be considered as the opposite of R2B2D, that is, the conceptualized progressive transition is **getting more and more REAL**.\n\n**Q10. What is the real/fake label of the mix of F_r and F_s?**\n\n**R10.** Thanks for your concern. As illustrated **in Eq. 4 and line 172 of our manuscript**,  the label after bridging is assigned based on the mixing ratio $\\alpha$. For example, the labels for $F_r$ is 0 and for $F_s$ is 1, and they are mixed with $\\alpha=0.3$, the label for their mixed results should be $0.3×0+0.7×1=0.7$.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
We sincerely thank all reviewers for their valuable time and constructive comments, and we are strongly encouraged by their recognition of several strengths of our submission, including:
- **Fresh perspective/Well-motivated**  (Reviewers LWpa, Ssp1) 
- **Extensive/Robust Evaluations** (Reviewers LWpa, Ssp1) 
- **Well Presentation and Writing** (Reviewers LWpa, t2ao, Ssp1,6DHe)

Meanwhile, reviewers also indicate several important concerns and suggestions, which we will give **detailed common and individual responses**. Followings are the common responses.

# **Common Responses**
**Q1.** (**From Reviewers 6DHe, Ssp1**) **Cross-dataset evaluation is encouraged to include more datasets, such as {FakeAVCeleb, DFD, RWDF-23} (6DHe) and {WildDeepfake,  DeeperForensics-1.0} (Sspl).**

**R1.** Thanks for the valuable suggestion. Following reviewers' suggestions, we further enlarge the evaluation scope from the following aspects:
- **9 different deepfake datasets are used**: Ensuring the diversity and comprehension of the testing data in our evaluation;
- **Latest synthesis methods are considered**: Using the testing data from those **just-released deepfake datasets** (in 2024) with advanced deepfake techniques, that is, {UniFace, E4S,  BlendFace, MobileSwap} from DF40 [1] and {DiffSwap} from DiffusionFace [2];
- **Evaluation Design**: Involving different variants (i.e., Deepfake-only, Blendfake-only, VHT, and ours) for the ablation studies using both ***frame-level/video-level*** AUC. 

Our results can be seen in the Table below.

| Methods| DFD |  DeeperForensics-1.0 | FakeAVCeleb | WildDeepfake| RWDF*| DiffSwap|UniFace| E4S|BlendFace | MobileSwap | 
|----------|----------|----------|----------|----------|----------|----------|----------|----------|-----------|-----------|
| DF-only| 0.8144/0.8621| 0.7462/0.7474| 0.8404/0.9150|0.7275/0.6883| - |  0.7959/-  |0.7775/0.8212| 0.6514/0.6955   | 0.7813/0.8296  | 0.8475/0.9053|
| BF-only| 0.8378/0.8901  | 0.7345/0.7811   | 0.8627/0.9237|  0.7563/0.7965 |-| 0.8265/-| 0.6745/0.6998|0.6797/0.7113   | 0.8041/0.8529   | 0.8883/0.9399   |
| VHT   | 0.8215/0.8505   | 0.7702/0.8312| 0.8402/0.9125| 0.7263/0.7811   |  -| 0.7961/-| 0.8445/0.8979   | 0.6704/0.7101   |0.8311/0.8930   | 0.8729/0.9295   |
| Ours   | 0.8581/0.9073| 0.7902/0.8536   | 0.9077/0.9766| 0.7718/0.8287|  -  | 0.8459/ -| 0.8441/0.9077| 0.7103/0.7711|0.8619/0.9287| 0.9285/0.9748  |

**\*** *We are requesting the RWDF dataset (as suggested by Ssp1) from its authors. Once we have obtained the data, we will update the results immediately.*

From the Table, we can observe that our method consistently exhibits superiority in almost every testing data, which empirically suggests an improved generalization result.

**Q2.** (**From Reviewers 6DHe, t2ao**) **Why VHT (*naively combining deepfakes and blendfakes for training*) with *unorganized* latent space achieves *inferior* results than ours (with *organized* latent space).**

**R2.** We sincerely appreciate the insightful concern. We would like to address these concerns as follows:
- **Ambiguous Feature Space in VHT:** In VHT, deepfake (DF) and blendfake (BF) data are naively combined for training deepfake detectors. This approach results in an unorganized latent space where DF and BF data are intermixed, creating an ambiguous feature space. 
- **Loss of Discriminative Features:** Due to the unorganized (mixed) latent space in VHT, the classifier tends to "regard" DF and BF as the same forgery type. This causes the classifier to "forget" the *discriminative characteristics of DF and BF*. However, DF and BF can be inherently different; DF contains more forgery information, such as generative artifacts produced by DNNs. Naively combing DF and BF for training (VHT) may result in the loss of these informative features, which can be crucial in detecting deepfakes.
- **Our Method's Advantages:**  Organizing latent space is a crucial topic that has been verified effective in many research domains [3,4]. In our case, the proposed method, which progressively organizes the latent space (real -> BF -> DF), can (1) help the model better 'understand' how real data gradually becomes fakes; (2) maintain more informative features to distinguish real from fakes. For these reasons, Ours should result in better generalization performance than VHT.
- **Experimental Validation:** For the claimed feature organization issue, we have verified this claim by visualizing the actual latent space (Fig. 4) and feature distribution (Fig. 6) in the manuscript. **Moreover**, in *Author-Rebuttal-PDF-Fig. 2*, we provide a further investigation of the learned information of VHT and our method. Specifically, we summarize and analyze the distribution of logits output and confidence from VHT and Ours. We notice that VHT is less confident in both fake and real data. As we discussed, this may be because naively combining DF and BF for training confuses the network, thus limiting its confidence in 'understanding' the forgery representation of distinct BF and DF. In contrast, our model can predict both fake and real with high confidence since the model "understands" how real gradually becomes more and more fakes.

**Q3.** (**From Reviewers LWpa and t2ao**) **Typos ($M_a$) and inconsistent spellings (SOTA and SoTA).**

**R3.** We are very grateful to the reviewers for their careful reading. We have carefully re-proofed our manuscript. We will continue to further optimize our writing and update our manuscript.

[1] Yan Z, Yao T, Chen S, et al. DF40: Toward Next-Generation Deepfake Detection. arXiv:2406.13495, 2024.

[2] Chen Z, Sun K, Zhou Z, et al. DiffusionFace: Towards a Comprehensive Dataset for Diffusion-Based Face Forgery Analysis. arXiv:2403.18471, 2024.

[3] Ali S and Kaick O. Evaluation of latent space learning with procedurally-generated datasets of shapes. ICCV 2021.

[4] Yang F and Ma C. Sparse and complete latent organization for geospatial semantic segmentation. CVPR 2022.

Meta-review: 1x A, 1x BA, and 2x BR. This paper proposes a novel training strategy for Deepfake detection using real, blendfake, and deepfake datasets. The reviewers agree on the (1) clear writing, (2) fresh motivation, and (3) novel and effective method. Most of the concerns, such as the insufficient recent datasets, insufficient experiments on latent distribution, and insufficient robustness evaluation, have been addressed by the rebuttal. The ethical concerns on the proposed deepfake detector's limitations have also been cleared. Therefore, the AC leans to accept this submission.
Decision: Accept (poster)