DevFD : Developmental Face Forgery Detection by Learning Shared and Orthogonal LoRA Subspaces
Authors: Tianshuo Zhang
Li Gao
Siran Peng
Xiangyu Zhu
Zhen Lei
Venue: NeurIPS 2025 poster ()
Keywords: Face Forgery Detection
Face Forensics
Continual Learning
Primary area: applications

Abstract: The rise of realistic digital face generation and manipulation poses significant social risks. The primary challenge lies in the rapid and diverse evolution of generation techniques, which often outstrip the detection capabilities of existing models. To defend against the ever-evolving new types of forgery, we need to enable our model to quickly adapt to new domains with limited computation and data while avoiding forgetting previously learned forgery types. In this work, we posit that genuine facial samples are abundant and relatively stable in acquisition methods, while forgery faces continuously evolve with the iteration of manipulation techniques. Given the practical infeasibility of exhaustively collecting all forgery variants, we frame face forgery detection as a continual learning problem and allow the model to develop as new forgery types emerge. Specifically, we employ a Developmental Mixture of Experts (MoE) architecture that uses LoRA models as its individual experts. These experts are organized into two groups: a Real-LoRA to learn and refine knowledge of real faces, and multiple Fake-LoRAs to capture incremental information from different forgery types. To prevent catastrophic forgetting, we ensure that the learning direction of Fake-LoRAs is orthogonal to the established subspace. Moreover, we integrate orthogonal gradients into the orthogonal loss of Fake-LoRAs, preventing gradient interference throughout the training process of each task. Experimental results under both the datasets and manipulation types incremental protocols demonstrate the effectiveness of our method.

DevFD: Developmental Face Forgery Detection by Learning Shared and Orthogonal LoRA Subspaces
Tianshuo Zhangl: 12
Li Gao Siran Peng 1.2 Xiangyu Zhu Zhen Lei 12,4,
1 School of Artificial Intelligence, University of Chinese Academy of Sciences, Beijing, China MAIS, Institute Automation, Chinese Academy of Sciences, Beijing, China China Mobile Financial Technology Co., Ltd., Beijing, China CAIR, HKSIS, Chinese Academy of Sciences, Hong Kong, China
5 School of Computer Science and Engineering, the Faculty of Innovation Engineering, M.U.S.T, Macau, China
t tianshuo. www.geaaannnn..neeeeee ia........iaa.....m..m.......... cn, gaol weellidsshhinnnee caweeihinnmmmleee com pengsiran20236 cr. xiangyu. zhuê ia acc en, zhen. lei@ia ac. on
Abstract
The rise of realistic digital face generation and manipulation poses significant social risks. The primary challenge lies in the rapid and diverse evolution of generation techniques, which often outstrip the detection capabilities of existing models. To defend against the ever-evolving new types of forgery, need to enable our model to quickly adapt to new domains with limited computation and data while avoiding forgetting previously learned forgery types. In this work, we posit that genuine facial samples are abundant and relatively stable in acquisition methods, while forgery faces continuously evolve with the iteration of manipulation techniques. Given the practical infeasibility of exhaustively collecting all forgery variants, we frame face forgery detection continual learning problem and allow the model to develop as new forgery types emerge. Specifically, we employ a Developmental Mixture of Experts (MoE) architecture that uses LoRA models as its individual experts. These experts are organized into two groups: Real-LoRA to learn and refine knowledge of real faces, and multiple Fake-LoRAs to capture incremental information from different forgery types. To prevent catastrophic forgetting, we ensure that the learning direction of Fake-LoRAs orthogonal to the established subspace. Moreover, integrate orthogonal gradients into the orthogonal loss of Fake-LoRAs, preventing gradient interference throughout the training process each task. Experimental results under both the datasets and manipulation types incremental protocols demonstrate the effectiveness of our method.
Introduction
The swift evolution of generative models, including Generative Adversarial Networks (GANs) 233 (62) and Diffusion models [17 18 61), along with the rise of large models 4 25 50
[ 7
propels the rapid advancement of face forgery technology, which introduces significant security risks and contributes to crisis of public trust. These manipulation methods leave unique traces of forgery. Existing detectors perform well with known forgery types but struggle identify novel ones. When new manipulation types arise, a trivial method is to add new forgery data to the primary dataset and retrain a binary model. However, the rapid evolution of forgery techniques necessitates new learning strategy that can quickly adapt to new forgeries using limited computation and data.
CCorresoonding Authors.
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

Evolving Forgery Samples
Rapidly Evalving Fargery Types
Stable and Sufficient
Real Face Data
Real
Fale Type2
Fale Type2
Fale Typea
Fake
Pretrained Backbone
TypeN
FFtr Roal
Dewefilless
Real Samples
Face2Face
Orthogonal LoRAs
Label-guided Locallize Balancing
Classifier
CD12_ Fake
COF2 Real
Real
Fake
Developmental MoE
(a) 1-SNE visualization FF+e and
(b) Developmental McE Forgery Detection Framework
Figure 1: (a) The t-SNE visualization of features extracted from the baseline on FF++ [88 and CDF2 27 shows that real faces exhibit close distribution, while fake faces form five distinct clusters. This observation inspires to (b) propose a developmental mixture of experts model the continuous emergence of unknown fake faces using a set of orthogonal LoRA subspaces, while concurrently employing a dedicated LoRA to preserve the commonalitics of authentic faces. A label-guided localized balancing strategy employs the LoRA sequence to separately model the common real faces and the incremental fake types information.
In contrast to the rapidly evolving fake faces, real faces possess distinct characteristics. Genuine facial data is relatively abundant, stable, and acquired through single modality, such as camera imaging. In the context of forgery detection, it typically does not introduce bias. These properties, which remain invariant as forgery techniques evolve, endow real faces with commonalities that may easily be overlooked. Fig. aa) presents a simple t-SNE
(57) visualization experiment, using the baseline (8] model to extract features from both the FF++ [48] and CDF2 [27] datasets. The results reveal two key observations: (1) Real face samples from both datasets exhibit close distributions, while (2) forged samples form five distinct clusters. These observations inspire us to enable the model to adapt to emerging manipulation methods while learning the commonalities of real faces.
In this paper, we approach face forgery detection as a continual learning problem and make the model "developmental," enabling it to adapt to new forgery types continuously. As shown in Fig. (b), we propose a developmental Mixture of Experts (MoE) architecture, DevFD, which employs Low-Rank Adaptation (LoRA) models as individual experts to fine-tune pre-trained models within different subspaces. As illustrated in Fig. 2 the model expands a new LoRA branch when adapting to an unknown forgery type. However, adapting to new forgery types can disrupt the knowledge in established subspaces, leading to catastrophic forgetting. To address this, we use an orthogonal loss to constrain the learning direction of new LoRAs to be orthogonal to all previously established LoRAs, thereby preserving the learned knowledge. This part of the LoRAs ultimately forms an orthogonal sequence termed Pake-LoRAs, For real faces that are stable and exhibit common properties, modeling them with the same sequence overlooks their overall distribution. Therefore, we introduce a separate shared expert, termed Real- to fine-tune and refine knowledge about real faces. To enable the Real-LoRA and Fake-LoRAs to align with their assigned roles and avoid disrupting the orthogonality of Fake-LoRAs, we design label-guided localized balancing strategy that softly constrains the experts through a weighted response matrix. For unknown forgery images, the router aggregates the outputs of all LoRAs make a joint decision, thereby maintaining collaboration among the experts.
Additionally, we theoretically analyze that the subspace orthogonal loss still causes forgetting due to the early stages of optimization not satisfying the orthogonality condition, where learning new tasks disrupts the established knowledge of other subspaces. To avoid this, we integrate orthogonal gradients into the orthogonal loss and propose LoRAs. Experiments demonstrate that our method achieves trate-ofthhe- average accuracy and the lowest average forgetting rate in continual learning experiments on both the datasets incremental protocol and the manipulation types incremental protocol
integrated orthogonal loss to constrain the Fake-
Contributions. We summarize contributions follows:

---

We propose developmental MoE architecture to address the continuous emergence of new forgery types. We use label-guided localized balancing strategy to allocate Real-LoRA model the real face information, while Ls capture the incremental fake face information.
Based theoretical analysis, we integrate orthogonal gradients into the subspace orthogonal loss and form a new integrated orthogonal loss to mitigate the interference of gradients on the knowledge of established subspaces during the entire stages of training.
Extensive experiments demonstrate that our proposed method achieves the highest average scores and the lowest average forgetting rate among all comparison methods.
2 Related Works
2.1 Face Forgery Detection
Face forgery detection requires the model to classify input images or videos as either real or fake. focus on identifying forgery cues present the forged media and can be categorized into two major groups. The first category designs models that incorporate wavelet [36), graphics 772 773, language descriptions [54), and audio-vidco consistency 339 The second cate- gory [23 26 51 data-driven, utilizzig only real faces and training models through a self-supervised approach. With the continuous evolution of forgery methods, continual learning is applied to forgery detection. DFIL 40) and HDP (55) treat the learning of forgery datasets as sequence of sub-tasks, requiring the model to learn sequentially across these tasks, achieving satisfactory performance. In this work, we design a Developmental MoE to address the challenges of continual learning in face forgery detection.
Related methods 6 10 33 58
additional information aid detection, such as frequency analysis 13
24
35 42
2.2 Continual Learning
Continual learning typically models the task as sequence of sub-tasks, requiring the model adapt to dynamic data distributions incrementally. The goal is to achieve high performance on newly learned tasks while avoiding catastrophic forgetting of information from previous tasks. Related approaches
can be broadly divided into three categories: Regularization- based Approuches [7 49
53
59
65 70
Replay-based Approaches [22] 34 45 46 (2], and Optimization- Approaches II 21 31 32
41]. Among the latest methods, OrCo I enhances generalization in caassinncremenall learning through orthogonality and contrast. Meanwhile, MoECL [68] adapts new tasks by introducing an MoE. DFIL [40] and SUR-LID 7 achieve satisfactory results using replay mechanisms. In this work, treat the iteration of fake faces incremental learning problem and employ a developmental architecture to facilitate continual learning.
2.3 Mixture of Experts
The Mixture Experts (MoE) a set of sparse models with multiple experts and a routing network. By training MoE in parallel, methods [4] 37 (4) enable efficient fine-tuning of large models with minimal computational cost. MoECL 68 introduces MoE to continual learning, employing an intuitive trainable- freezinn strategy reduce the model's forgetting rate. Low-rank Adaptation (LoRA) [15] further decreases parameter and computational cost by mapping inputs into a low- rank subspace. O-LoRA (60] utilizes LoRAs experts and constrains the orthogonality of LoRA subspaces. InfL 330 further applies orthogonal LoRA to vision tasks, improving the performance of multiple sub-tasks through pre-defined orthogonal subspaces. MoEFFD 20 integrates MoE and LoRA into face forgery detection, allowing each expert to specialize in extracting features related to different forgery techniques. We the LoRA module construct MoE architecture address continual face forgery detection.
3 Methodology
We cast forgery detection as continual learning problem D = (Di,..., where T is the total number of tasks. For any task D., let x,,, be the sample and Vi,t corresponding label, and n, represent the number of samples in the current task. The model sequentially lears each task
3

---

Real
Fake
Deviopmental MoE
Lilb
Real
Fake
Classifier
Real- LoRA
Feed Forward
Devlopmental
Low
(FFN)
MoE
Label-guided Localized Balancing
Fake- LoRAs
High
Coefficient
Multi-Head Self Attention
Crt Previous LoRA Subspace
Orthngoona
Shared Subspace
Orthogonal
Orthagonal
Layer Norm
Subspace
X
Patch Embedding
T
T2
Gradient Space
Expand
Current LoRA
Input Faces
Subspace
The proposed DevFD framework employs a Developmental MoE architecture fine-tune FFN layer in each transformer block. The architecture establishes a developmental LoRA sequence, which adds new branches as the number of tasks increases, enabling the model to handle emerging new types of forgeries. A new label-guider localized balancing strategy allocates the LoRA sequence into two purposes: the Real-LoRA fine-tune and refine knowledge about faces, while Fake-LoRAs compose an orthogonal sequence to model the unique cues fake faces. integrate orthogonal gradients into orthogonal loss alleviate interference of gradients on previously learned tasks during the training phase when orthogonality is not yet achieved, thereby achieving lower rate of forgetting.
Figure 2:
D. (x..,, ) V4 the characteristics of the face forgery detection task, we provide the following descriptions:
} in the task sequence D to adapt to new types of forgery. Based on
y = >) = Fake for + j. { ( >.
(I)
Real for i + J.
where p (-) is the sample distribution, X' is the samples and y is the labels. For fake faces, different forgery types belong different domains but share the same label y = "Fake", presenting domain incremental problem. In contrast, due to the uniform acquisition methods and the stable and abundant samples of real faces, real faces across datasets exhibit similarity. We aim to model and align them into a unified distribution, i.e., p (X;) (Xz). We strictly isolate training data across tasks.
3.1 Developmental MoE Architecture
We propose a novel developmental MoE architecture using LoRAs as individual experts to fine-tune pre-trained models within different subspaces; the overview is shown in Fig. First, we employ Vision Transformer (ViT) pre-trained on real faces as the backbone, denoted as go (fe(-)), where Se represents the pre-trained VIT network, and ge denotes the classifier. We freeze the parameter O of the ViT backbone f and introduce LoRA to fine-tune the Feed Forward Network (FFN) weights in each transformer block. For a parameter matrix of any FFN layer W 1ddoxd, with input dimension dj and output dimension do, LoRA decomposes the parameter change matrix AW into the multiplication two low-rank matrices:
AW AB,
(2)
where Rd x is the dimensionality reduction matrix and A Txx is the dimensionality expansion matrix. Generally, the ranks of the two matrices are equal and satisfy the condition: r & min dy). To enable model to adapt to each task, as illustrated in Fig. 2 we design developmental LoRA sequence as MoE adapters:
FFN(x) + MoE(x)
(3)
FFN((X) + Σ LL,(A,,,x).
1=

---

Here, X is the input, while is the output. The LoRA modules in the sequence (A, are assigned by label-guided localized balancing strategy (LLB) for two purposes: the Real- LoRA Ao is designed to learn and refine the common information of real faces modeled by the backbone, while the Loke-LoRAs {A, compose an orthogonal sequence for learning fake face information specific to each task.
3.2 Learning LoRA Subspaces enhanced by Orthogonal Gradients
The reason for catastrophic forgetting is that parameter adjustments while learning the current task disrupt the knowledge acquired from previous tasks [30]. The subspace established by LoRA can approximately represent the information acquired for a new task [60]. As a developmental structure, DevFD constrains the learning direction of the expanded branches for the new task to prevent interference with previously established subspaces by using an integrated orthogonal loss enhanced with orthogonal gradients. First, the learning of the t-th task can be modeled as follows:
e Wx+ Σ A, WI-I AB, WXX, j=1
where W is the parameter matrix of the FFN layer, e and x represent the output and input of the network, respectively. Existing methods attempt of LoRA to be orthogonal to the established subspaces in order to prevent forgetting. However, the forgetting remains severe. We demonstrate that relying solely the subspace orthogonal loss is insufficient and present an orthogonal gradient solution to further mitigate forgetting.
orthogonal loss control the learning direction
Why Orthogonal LoRA Subspaces are Still Forgetful?? The adaptation of LoRA to new tasks involves fine-tuning the weight matrices within their respective subspaces. LoRA maps the input to the subspace: span {bi.... ) where the row vectors [bí ...... b,}
of the dimensionality reduction matrix B, serve as a basis for this subspace. O-LoRA [60] enforces the orthogonality between the basis (bi..... ....... by) subspaces of the LoRA sequence are mutually orthogonal. Let Oj, be the dot product of two hases of these subspaces. The orthogonality optimization objective can then be expressed as:
and the basis {bi.... by} of the forward LoRAs' subspace, ensuring that the
arg min [b}
||0,,e11= = arg min {bi....b:}
||B B: i 1.., 1.
(5)
Notably, the orthogonality condition exists in the form of an optimization objective. We will
demonstrate that preventing the disruption of the information in the previous subspaces depends on the strict B when the model learns the t-th task, fine-tuning A, is equivalent to fine-tuning the original parameter matrix W within the subspace span (bj. ........ b denoted as:
throughout the training process. We begin with a proven proposition [30]
A W. = Aw W,B?B, B,,
(6)
where AA, W. is the increment of the composed matrix W, caused by the change of A,, and Aw W. is the increment of the composed matrix W, caused by the change of the original parameter W. Thus, a projection matrix B, B, projects each row vector A Aw W, into the subspace span (bi,... b,}, it follows that the increment AA, W, due to the fine-tuning of A₁ is equivalent mapping Aw W, into span (bí, ...., b. In summary, the increment A A. W, will not affect the subspace established by previous LoRA, under the assumption that span (bí- ... b; meaning that the orthogonality condition B B, = 0 needs to hold strictly during the entire training process. Therefore, we argue that catastrophic forgetting occurs in the early stages of training on new tasks when the bases B, and B, are not perfectly orthogonal. The gradients of the new tasks can disrupt the established subspaces.
is orthogonal to these subspaces,
Integrate Orthogonal Gradients into Orthogonal Loss. To address the issues discussed above, choose to directly constrain the gradient space while optimizing the orthogonality of subspaces, resulting in a new integrated orthogonal loss. First, it is proven that the gradient update of a linear or convolution layer lies within the span of the input vectors (2). We place the proofs in the Appendix B This proposition allows us to transform the constraints on the gradient space into one on the input space. Let the input matrix be H Rdixn where n is the batch size. Due to the inconsistency in matrix dimensions, we first perform Singular Value Decomposition (SVD) on H.
H V.
(7)
5

---

We then choose the rows of V? corresponding to the top-r singular values and compose (V?), Brxdi We use (VT), as an estimate of the gradient space and constrain it to be orthogonal to the previously established subspace. Let G1.t represent the dot product between the estimated gradient space and the previous subspace basis. The gradient constraint can then be expressed as:
arg min bf}
|G,,e|l arg min (b.....b!.)
((V.),...I i- 1,...
(8)
In summary, we integrate the orthogonality of LoRA's subspace and the gradient space, designing the integrated orthogonal loss as follows:
EAI 11 122 +12 Xo Σ IIG.,ll²). Son Σ
A
(9)
Here, Σ represents the sum of the squares of the matrix elements, A and A2 are hyperparameters. Con constrains the subspace and the gradient space of the current LoRA to be orthogonal to those of the previous LoRAs, thereby alleviating forgetting.
3.3 Label-guided Localized Balancing Strategy
To model the commonalities of real faces and continuously refine the real face knowledge represented by the backbone in continual learning sequence, establish an additional LoRA Expert Bo referred to as Real-LoRA, and make it learnable across all tasks. However, the Real-LoRA introduces two issues. First, the additional Real-LoRA disrupts the orthogonality of the LoRA sequence, leading to interference with the Fake-LoRA sequence. Second, it cannot be guaranteed that the Real-LoRA will learn real-face information. To address these issues, we propose label-guided localized balancing strategy. This strategy dynamically adjusts the responses of experts to different types of samples based on the labels during training. Specifically, it enables Real-LoRA to focus more on real faces, while Fake-LoRAS concentrate on learning forged faces in an orthogonal manner, preventing Real-LoRA from disrupting the orthogonality of Fake-LoRAs. The proposed strategy first takes the inputs from all LoRAs and sets response matrix I E R(++1)xn where + indicates the total number of experts. An element Ig,7 indicates the response of the k-th expert to the I-th sample in the batch. It is defined as follows:
T
exp (WEL/T
I
(10)
Ei exp (W(,/T)
Here, wh, represents the output of the k-th expert for the j-th token in the I-th sample, Tin denotes the number of tokens in the 1-th sample. All outputs of LoRA can be defined as vector matrix O E (((+))xxx,, where each element is defined as the output of the k-th expert for the (-th sample. Based on the response matrix and the output matrix O, the forward process computes the final output E Raxd. where the output vector e, Rd for the 1-th sample is defined as:
e Σ IR.1 Oz
(11)
To allocate Real-LoRA and Fake-LoRAs for modeling the information of real and fake faces, respectively, we utilize labels to define a balancing coefficient matrix C E ((++))xn, An element C2,1 represents the balancing weight applied to the response at the corresponding position I
5, Type, (k) Type, (1) C₂.1 = 1 Type, (k) # ())
(12)
where (k) Type, (1) indicates that the expert matches the category label corresponding to the sample, such as Real-LoRA for real faces, the coefficient matrix C decreases the balancing coefficient for this item; otherwise, C increases the balancing coefficient. The increment 8 of the coefficient falls within the range of [O. 1]. Based on the response matrix I and the balancing coefficient matrix C, the LLB loss constrains the dispersion of the weighted response matrix I o C:
a² PIo C) Lub
(13)
n1I o C)

---

where o² (-) and pa-)) represent the variance and mean, respectively, and o is element- multipli- cation. This loss function forces the weighted responses (I o C) to become as balanced as possible. By optimizing this loss function, the model is thus compelled to generate greater original response Ig.t for the matching pairs (to compensate for their small 8 balancing coefficients) and smaller original response for the mismatched pairs. Additionally, this router does not select specific LoRAs but encourages collaboration among all LoRAs
When the model begins to learn a new task, DevFD establishes a new LoRA branch and freeze the other Fake-LoRAs in the orthogonal sequence [A,B, allowing only the newly added LoRA A, and the Real-LoRA A, to be trainable. During inference, it aggregates the outputs of all LoRA experts to make a joint decision, fostering collaboration among them.
In summary, we define the total loss as the weighted sum of the binary cross-entropy loss Cekss the orthogonal loss Lon, and the label-guided localized balancing loss Lib:
L = Lets + Lont + AaLiib,
(14)
where A is a hyperparameter. This loss allows real faces and fake faces from different forgery manipulation types be modeled by distinct LoRAs without mutual interference and encourages collaboration among all LoRAs in this MoE architecture.
Experiments
4.1 Experimental Setup
Datasets. To facilitate comparisons, we select multiple datasets, employing different forgery methods to manipulate and generate faces from distinct domains. FaceForensics** (FF++) 48 contains IK real face videos. These faces are manipulated by four forgery methods, resulting in a total of 4K fake videos. The Deepfake Detection (DFD) [12] dataset comprises over hundred real face samples and more than IK forged face samples. For the Deepfake Detection Challenge (DFDC) [9] dataset, utilized the Preview version (DFDC-P), which includes 5K videos and two forgery methods. Celeb-DF v2 (CDF2) (27) comprises 590 real and 5,639 fake videos. DF40 [66] is a large-scale dataset comprising 40 types of forgery methods and over 100K fake videos. We select [FF++, DFDC-P, DFD, CDF2] as our dataset-incremennal testing protocol. From DF40, we choose three forgery methods corresponding Rece-Reenattment (FR): MCNet, and Entire Face Synthesis (EFS): StyleGAN3. The datasets of selected forgery methods and a base dataset with hybrid forgery types FF++ jointly compose our Dorgeyy-yypeinncemment testing protocol: [Hybrid, FR, FS, EFS].
different forgery types: Pace-Swapping (FS): BlendFace,
Implementation Details and Metrics. We utilize pre-trained ViT model as the initial backbone. The pre- vreetraining data is sourced from real faces in the FF++ dataset. We conduct self-supervised pre-training through data augmentation approach (51). Regarding data utilization, we strictly isolate data across tasks, including real and fake faces. Similar to DFIL [40], we randomly sample 100 videos from the current dataset and train for 20 epochs in each task, maintaining balance between real and fake samples. The hyperparameter settings are adjusted according to the number of training epochs, and detailed information is provided in Appendix C22 We employed the Adam optimizer with parameters set to 31 = 0.9, .3-- = 0.999. The learning rate is set to le - 4, and the batch size set to 128. The rank (subspace dimension) for LoRA was determined using a grid optimization algorithm similar to InfLoRA (30] We utilize Accuracy (Acc) and Area Under the Curve (AUC) to evaluate the overall performance of the model. Average Forgetting (AF) indicates the model's ability to retain information from previously learned tasks. Let a,, denote the evaluation Score (Acc or AUC) on task after the model has been trained up to task t. The AFr (for T > 1) is defined as:
AFT T -
Σ (ars-wn WT,))
(15)
where dr is the score on task i after learning the final task T.
4.2 Comparison Experiments
Experiments on Dataset Incremental Protocol. To comprehensively evaluate the performance of the proposed method, we conduct comparative experiments with general continual learning
7

---

Table 1: Left: Experiments on dataset incremental protocol. Right:
Experiments on manipulation types incremental protocol. The best performer is highlighted in boldface, while the second-hest result is underlined. Shadowed lines indicate the results from our method.
Dataset Incremental Protocol
Manipulation Types Incremental Protocol
Mani.
AUC($))
Method
Dataset
Avgt
ARI
Method
Avgt
AF
FF++
DFDCP DED CDF2
Type Hybrid
FR
FS EFS
FF++
95.52
95.52
Hybrid
96.53
96,53
LWF
DFDCP
87.83
81.57
84.70 7.69
iCaRL
FR
67.36
99.89
83.63 29.17
28
DFD
76.16
41.78
96.36
71.43 29.58
FS
73.79
66.24
97.54
79.19 28.20
CDF2
67.34
67.43
84.05
87.90
76.68 18:21
EES
52.98
55.38
64.74
100.0
68.28 40.29
FF++
95.52
95.52
Hybrid
97.00
97.00
ER
DFDCP
92.25
88.53
90.39 3.27
DER
FR 59.03
99.73
79.38 37.97
DFD
84.69
80.59
94.00
86.42 9.39
FS
68.15
19.68
97.94
61.93 54.45
CDF2
71.65
69.40
92.98
83.26
79.32 14.67
EFS
56.79
59.83
65.36
100.0
70.49 37.56
FF++
95.51
95.31
Hybrid
96.65
96.65
SI
DFDCP
90.88
88.38
89.63 4.63
CoReD
FR
93.55
79.88
86,72 3.10
69
DFD
45.46
27.02
96.67
56.38 55.71
19
FS
89.07
79.29
86.05
84.80 4.09
CDF2
36.67
42.04
44.83
78.88
50.60 52.34
84.54 RFS
64.29
84.17
92.63
81.41 9.86
FF++
95.50
95,50
Hybrid
96.46
96.46
CokeD
DFDCP
92,94
87.61
90.28 2.56
DFIL.
FR
55.74
99.75
77.75 40.72
19
DFD
86.84
81.07
95.22
87.71 7.60
40
FS
60.71
66.49
99.03
75.41 34.51
CDF2
74.08
76.59
93.41
80.78
81.22 11.42
EFS
50.83
95.56
70.81
99.96
79.29 26.01
FT++
95.67
95.67
Hyhrid
96.71
96.71
DFIL
DFDCP
93.15
88.87
91.01 2.52
HDP
FR
67.41
95.45
81.43 29.30
40
DFD
90.30
85,42
94.67
90.13 4.41
55
FS
63.00
71.35
95.09
76.48 28.91
CDP2
86.28
79.53
92.36
83.81
85,49 7.01
EFS
59.89
70.06
89.34
93.73
78.26 22.65
FT++
95.96
95.96
Hybrid
96.85
96.85
DMP
DFDCP
92.71
89.72
91.22 3.25
SUR-LID
FR
82.91
92.42
87.66 13.94
86
DFD
92.64
86.09
94.84
91.19 3.48
i
FS
90.50
96,26
97.94
94.90 1.26
CDF2
91.61
84.86
91.81
91.67
89.99 4.08
EFS
87.90
96.79
93.56
99.07
94.33
2.99
FF++
98.41
98.41
Hyhrid
97.63
97.63
DevFD
DFDC-P
97.06
89.90
93.48
1.35
DevFD (Ours)
FR
94.69
93.07
93.88
2.94
(Ours)
DFD
92.44
89.07
97.91
93.14
3.40
FS
90.97
92.76
97.05
93.59
3.49
CDF2
90.71
90.31
93.12
85.15
89.82
4.03
EFS
90.86 94.35 95,23
99.16 94.90
2.44
ER 3 and SI 69 and specialized continual face forgery detection methods (e.g., CoReD 19] DFIL 440 and DMP (56). We ensure that the improvements stem from the new strategy and maintain the fairness of the experiments, as detailed in Appendix [ Under the dataset incremental protocol, the model is sequentially trained on task sequences constructed from [FF++, DFDC-P, DFD, CDF2). After completing each task's ' training phase, we evaluate model accuracy on both the current and previously learned tasks. Quantitative results are organized in a lower triangular accuracy matrix, accompanied by two key metrics; average accuracy (Avg) and average forgetting (AF), as detailed in Table Leett. The results reveal that general continual learning methods initially achieve satisfactory accuracy but suffer severe performance degradation on previous tasks as training progresses, resulting in higher forgetting rates. In contrast, continual forgery detection approaches exhibit more stable performance but still suffer from forgetting. It is worth noting that many of the compared methods 40) utilize a replay set, while our method strictly isolates all subtask data and still achieves superior anti-forgetting and state-of-the-art performance.
approaches (e.g.. LWF [28
Experiments on Manipulation Types Incremental Protocol. The dataset incremental protocol tested above demonstrates our method's superior performance and anti-forgetting capability. Consid- cring potential issues the dataset incremental protocol, such as the domain gaps between different datasets and the possibility of shared manipulation methods across datasets, we perform experiments under the manipulation types incremental protocol [Hybrid, FR, FS, EFS], employing AUC as the primary metric for comparison. The experimental results are presented in Table T Right. The results show general continual learning approaches (LwF (28). iCaRL 44. DER (64) exhibit unstable performance with high forgetting rates. Even specialized forgery detection methods demonstrate initial training instability- - DFIL 40 shows a 40.72% performance drop on previous tasks during FR-type training. Our method maintains stable learning throughout the entire training sequence, achieving both the highest final performance and the lowest forgetting rate. Comparative analysis reveals significant advantages: our approach surpasses SUR-LID 77] by 0.57% in average AUC, with
8

---

Awerage Accuary
Average forgetting (AF)
50
Nethods
HDP
DRL
GolleD
(16)
80
AF (96)
30
70
HDP
DFLL
CoRoD
10
Gurs
2
10
Figure 3: The Task10 long-sequence continual learning experiment based on DF40, the proposed method
achieves the highest average accuracy and the lowest forgetting rate.
2.0
Orthogonal Grad ents Loss
LoRA Sequence
Fake LoRA Sequence
1.5
1.0
0.5
FF++
DFDCP
DFD
CDF2
Figure 4: Motivation Validation. We track the variation range of the orthogonal gradient loss during the training process for orthogonal sequences, modeling real faces and the other modeling forged faces. For each sequence, two lines represent the upper and lower bounds of the loss, and shaded area between them indicates its range of variation. We observe that real faces exhibit an obvious smaller orthogonal gradient loss.
0.55% lower forgetting rate, and outperforms HDP (55) by 16.64% AUC margin while reducing forgetting rate by 20.21%. %. These results validate our method's performance against manipulation-type shifts continual learning scenarios.
4.3 Long-sequence Continual Learning Experiments
To further validate the effectiveness of our proposed method on more manipulation types and extended task sequences, we selected 10 datasets from DF40 and completed long-sequence continual learning experiments under the 10 protocol. We provide more details in the Appendix [.3] The average AUC metric and forgetting rate are plotted as shown in Fig. 3 The experimental results indicate that
in long-sequence learning, both DFIL. (40) and HDP (55) exhibit unstable catastrophic forgetting. At
the same time, our method achieves the highest average AUC and the lowest forgetting rates.
4.4 Motivation Validation Experiments
Our proposed method is based on a key observation: abundant and unbiased real faces exhibit more compact distribution across datasets than forged faces created by various methods. Building upon t-SNE experiment that validates this observation, we further confirm that real faces occupy more similar input space than forged faces within our proposed framework. We first theoretically demonstrate that more similar input space corresponds to a smaller orthogonal gradient loss. Specifically, when new orthogonal LoRA is configured model highly similar domain, this domain will possess a highly similar input space H, E Bddxxn From Eqn. 7 it can be deduced that the resulting V will also be highly similar. Consequently, in Eqn. and Eqn. the term Σ || ,,, yields zero value because its components are approximately orthogonal.
Based on this, we design a new experiment consisting of two separate orthogonal LoRA sequences: one for modeling real faces and the other for modeling forged faces. These sequences learn from the task series [FF++, DFDCP, DFD, CDF2]. We record the range of orthogonal gradient loss values for the two sequences during the training process to investigate the cross-dataset similarity their respective input spaces. The experimental results are presented in Fig. 4 Starting from the second task, the orthogonal gradient induced by the real face data for new LoRA is smaller than that induced by the forged face data. The results suggest that real faces from different datasets share

---

Table 2: Ablation study the loss functions. AA represents the average accuracy, while AF indicates the average forgetting.
Table 3: Ablation study on the LoRA modules. The best performer is highlighted in boldface. Shadowed lines indi- cate the results from our method.
FF++
DFDC-P P
DED
CDF2
Module
Loss
FF++
DFDC-P
DFD
CDF2
AAT
AAT AF
AAT
AFL
AAT AF]
Real-LoRA Fake-LoRA
Las
98.
90.49 9.33
15.79
78.82 23.93
Num.
Num.
AA1
AA1
AFI
AA1
AF]
AA1
AF]
Cas + Loten.
97.30 91.08 4.53 89.71 9:01
87,66 10.06
94.02
98,94
11.44
79.05
19.51
75.69
Las + Lon
97.35
93.59
92.08
90.66
97.06
91.31
88.39 6.42
Las + Li
98.09
94,20
11.19
83.00
98.41
4.03
98.41 93.48 1.35 93.14 3.40
89.82 4.03
98.2299..25
93.25
93.00
90.58
similar input space H,, leading to an orthogonal gradient loss that an order of magnitude smaller. Moreover, the orthogonal LoRA sequence introduces additional computational overhead compared to single Real-LoRA. This experiment mutually validates our initial t-SNE results, demonstrating that using a single, shared Real-LoRA to model real faces is both reasonable and necessary.
4.5 Ablation Study
Effect of Cort and Lub- We employ orthogonal loss Lon constrain both the subspace and gradient space of the currently learned LoRA and use Lub to allocate the Real-LoRA and Fake- LoRAs. We conduct ablation studies on both losses, with the experimental results presented in Table [ Cotera denotes the use of orthogonal subspaces without orthogonal gradients to validate the effectiveness of orthogonal gradients; "All" represents the model's performance incorporating all three losses. The results reveal that the fon significantly enhance the model's anti-forgetting capability. Meanwhile, Lub primarily improves the model's Average Accuracy (AA) by facilitating task-specific allocations among LoRAs and maintaining weighted response matrix for collaboration.
Effect of Real-LoRA and Fake-LoRAs. To study the effectiveness of the designed LoRA modules, we separately isolate the two types of LoRA and report the results in Table 3 We differentiate our models based the number of different types of LoRAs used. Specifically, '4' indicates the use of an orthogonal LoRA sequence (with a sequence length of 4 tasks) '1' indicates the use of a single global LoRA. and '-' indicates that LoRA module is used. The Lum is introduced only when both types of LoRAs As are used simultaneously. To investigate whether the global Real-LoRA would lead to catastrophic forgetting of real faces, we add an additional experiment shown in the last row by expanding the shared Real-LoRA into a sequence identical to that of Fake-LoRAs, i.e., using two orthogonal LoRA sequences learn real and fake samples separately. The experimental results show that Fake-LoRAs have a sigmificant effect on mitigating catastrophic forgetting. After incorporating both types of LoRA, the addition of Real-LoRA improves both accuracy and the forgetting rate. Moreover, replacing Real-LoRA with an orthogonal sequence does not bring significant improvements in forgetting rate or accuracy. Therefore, the Real-LoRA does not cause catastrophic forgetting.
5 Conclusion
In this paper, we propose DevFD, Developmental MoE architecture for continual face forgery detection. By utilizing LoRA models as experts, DevFD expands with new LoRA branches adapt to emerging types of forgery. We employ label-guided localized balancing strategy to allocate all experts for two purposes: the Real-LoRA refines the real face knowledge modeled by the backbone continuously, while the Fake-LoRAs capture incremental forgery cues from different types. To prevent catastrophic forgetting, we use an orthogonality loss to constrain the learning direction of the learning LoRA to be orthogonal to the existing subspaces. Additionally, we integrate orthogonal gradients into the subspace orthogonal loss to mitigate the interference of gradients on the established subspace knowledge during the entire training phase. Experimental results demonstrate that our approach achieves the best performance.
Acknowledgement
This work was supported in part by Chinese National Natural Science Foundation Projects U23B2054, 62276254, 62176256, Beijing Natural Science Foundation L242092, the Science and Technology Development Fund of Macau Project 0140/2024/AGJ.
10

---

References
[1] Noor Ahmed, Anna Kukleva, and Bernt Schiele. Orco: Towards better generalization via orthogonality and contrast for few-shot class-incremental learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Puttern Recognition, pages 28762-28771, 2024.
[2] Stella Bounareli, Christos Tzelepis, Vasileios Argyriou, loannis Patras, and Georgios Tzimiropoulos. Stylemask: Disentangling the style space of stylegan2 for neural face reenactment. In 2023 IEEE 17th international conference automatic face and gesture recognition (FG), pages 1-8. IEEE, 2023.
[3] Arslan Chaudhry, Mareus Rohrbach, Mohamed Elhoseiny, Thalaiyasingam Ajanthan, Puneet Dokania, Philip HS Torr, and Marc' Aurelio Ranzato. On tiny episodic memories continual learning. arXiv preprint arXiv: 1902. 10486, 2019.
[4] Jun Chen, Deyao Zhu, Xiaoqian Shen, Xiang Li, Zechu Liu, Pengchuan Zhang, Raghuraman Krishnamoor- thi, Vikas Chandra, Yunyang Xiong, and Mohamed Elhoseiny. Minigpt-v2: v2: large language model as unified interface for vision- laiiual multi-task learning. arXiv preprint arXiv:2310.09475 2023.
[5] Liang Chen. Yong Zhang, Yibing Song. Lingqiao Liu, and Jue Wang. supervied learning of adversarial example: Towards good generalizations for deepfake detection. In Proceedings of the IEEE/CVF conference computer vision and paltern recognition, pages 18710-18719 18,19, 2022.
[6] Haonan Cheng, Hanyue Liu, Juanjuan Cai, and Long Ye. Clformer: cross-lingual transformer framework for temporal forgery localization. Visual Intelligence, 3(1):1-13, 2025.
[7] Jikang Cheng, Zhiyuan Yan, Ying Zhang, Li Hao, Jiaxin Ai, Qin Zou, Chen Li, and Zhongyuan Wang. Stacking brick by brick: Aligned feature isolation for incremental face forgery detection. arXiv preprint arXiv:2411.1 113966, 2024.
[8] François Chollet. Xception: Deep learning with depthwise separable convolutions. In Proceedings of the IEEE conference computer vision and pattern recognition, pages
2017.
[9] Brian Dolhansky, Joanna Bitton, Ben Pflaum, Jikuo Lu, Russ Howes, Menglin Wang, and Cristian Canton Ferrer. The deepfake detection challenge (díde) dataset. arXiv preprint Xiv:20066007999 2020.
[10] Xiaoyi Dong, Jianmin Bao, Dongdong Chen, Ting Zhang, Weiming Zhang, Nenghai Yu, Dong Chen, Fang Wen, and Baining Guo. Protecting celebritics from deepfake with identity consistency transformer. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 9468-9478, 2022.
[11] Arthur Douillard, Matthieu Cord, Charles Ollion, Thomas Robert, and Eduardo Valle. Podnet: Pooled outputs distillation for small-tasks incremental learning. In Computer vision-FCCC 2020: 16th European conference, Glasgow, UK, August 23-28, 2020, proceedings, port XX 16, pages 86-102. Springer, 2020.
[12] Nick Dufour and Andrew Gully. Contributing data to deepfake detection research. Google Al Blog. 1(2):3 2019.
[13] Joel Frank, Thorsten Eisenhofer, Lea Schönherr, Asja Fischer, Dorothea Kolossa, and Thorsten Holz. Leveraging frequency analysis for deep fake image recognition. International conference on machine learning, pages 3247-3256 PMLR, 2020.
[14] Jiaao Hc, Jidong Zhai, Tiago Antuncs, Haojic Wang, Fuwen Luo, Shangfeng Shi, and Qin Li. Fastermoe: modeling and optimizing training of large-scale dynamic pre-trained models. In Proceedings of the 27th ACM SIGPLAN Symposium on Principles and Practice of Parallel Programming, pages 120-134, 2022.
[15] Edward Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu Yuanzhi Li, Shean Wang, Wang, and Weizhu Chen, Lora: Low-rank adaptation large language models. arXiv preprint 10Xiv:2106.0000 09685, 2021.
[16] Gabriel Ilharco, Mitchell Wortsman, Ross Wightman. Cade Gordon, Nicholas Carlini, Rohan Taori, Achal Dave, Vaishaal Shankar, Hongscok Namkoong, John Miller, Hannanch Hajishirzi, Ali Farhadi, and Ludwig Schmidt. Openclip, 2021.
[17] Gyeongman Kim, Hajin Shim, Hyunsu Kim, Yunjey Choi, Junho Kim, Eunho Yang. Diffusion video autoencoders: Toward temporally consistent face video editing via disentangled video encoding. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 2023.

---

[18] Kihong Kim. Yunho Kim, Seokju Cho. Junyoung Seo, Jisu Nam, Kychul Lee. Seungryong Kim. and Kwangllee Lee. Diffflac:: Diffusion-based face swapping with facial guidance. arXiv preprint urXiv:2212.1334, 2022.
[19] Minha Kim, Shahroz Tariq. and Simon S Woo. Cored: Generalizing fake media detection with continual representation using distillation. In Proceedings of the 29th ACM International Conference on Multimedia, pages 337-346, 2021.
[20] Chenqi Kong, Anwei Luo, Song Xia, Yi Yu, Haoliang Li, and Alex C Kot. Moe-ffd: Mixture of experts for generalized and parameter-effiient face forgery detection. arXiv preprint arXiv:2404.0845 2024.
[21] Yajing Kong, Liu Liu, Zhen Wang, and Dacheng Tao. Balancing stability and plasticity through advanced null space in continual learning. European Conference on Computer Vision, pages 219-236. Springer, 2022.
[22] Vinod K Kurmi, Badri Patro, Venkatesh K Subramanian, and Vinay Namboodiri. Do not forget to attend to uncertainty while mitigating catastrophic forgetting. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, pages 736-745, 2021.
[23] Nicolas Larue, Ngoc-Son Vu, Vitomir Struc, Peter Peer, and Vassilis Christophides. Seeable: Soft discrepancies and hounded contrastive learning for exposing deepfakes. In Proceedings of the IEFF/CVF International Conference on Computer Vision, pages 21011-21022 2023.
[24] Jiaming Li, Hongtao Xie, Jiahong Li, Zhongyuan Wang, and Yongdong Zhang. Frequency-awart discrimi- native feature learning supervised by single-center loss for face forgery detection. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 6458-6467, 2021.
[25] Junnan Li, Dongxu Li, Silvio Savarese, and Steven Hoi. 22ip-2: Bootstrapping language image pre-training with frozen image encoders and large language models. In International conference machine learning, pages 17730-19742. PMLR, 2023.
[26] Lingzhi Li, Jianmin Bao, Ting Zhang, Hao Yang, Dong Chen, Fang Wen, and Baining Guo. Face x-ray for more general face forgery detection. In Proceedings of the IEFF/CVF conference on computer vision and pattern recognition, pages 5001-5010, 2020.
[27] Yuezun Li, Xin Yang. Pu Sun, Honggang Qi, and Siwei Lyu. Celeb-df: A large-scale challenging dataset for deepfake forensics. Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 3207 3216, 2020.
[28] Zhizhong Li and Derek Hoiem. Learning without forgetting. IEEE transactions on puttern analysix and machine intelligence, 40( 40(12):2935 2947,227222 2017.
[29] Yan-Shuo Liang and Wu-Jun Li. Adaptive plasticity improvement for continual learning. In Proceedings of the IEFF/CVF Conference on Computer Vision and Pattern Recognition, pages 7816-7825, 2023.
[30] Yan Van-Shuo Liang and Wu-Jun Li. Inflora: Interference free low-rank adaptation for continual learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 23638- 23647, 2024.
[31] Sen Lin, Li Yang, Deliang Fan, and Junshan Zhang. Trgp: Trust region gradient projection for continual learning. arXiv preprint arXiv:2202.0293: 2022.
[32] Hao Liu and Huaping Liu. Continual learning with recursive gradient optimization. arXiv preprint 2tii:2201.12522. 2022.
[33] Honggu Liu, Xiaodan Li, Wenbo Zhou, Yuefeng Chen, Yuan He, Hui Xue, Weiming Zhang, and Nenghai Yu. Spatial phase shallow learning: rethinking face forgery detection in frequency domain. In Proceedings of the IEEF/CVF conference on computer vision and pattern recognition, pages 772-781, 2021.
[34] David Lap and Mare' Aurelio Ranzato, Gradient episodic memory for continual learning. Advances in neural information processing systems, 30, 2017.
[35] Yuchen Luo, Yong Zhang, Junchi Yan, and Wei Liu. Generalizing face forgery detection with high- frequency features. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. pages 16317-16326, 2021.
[36] Changtao Miao, Zichang Tan, Qi Chu, Huan Liu, Honggang Hu, and Nenghai Yu. F 2 trans: High- frequency fine- fineigrined transformer for face forgery detection. IEEE Transactions on Information Forensics and Security, 18:1039- 1051, 2023.
12

---

[37] Basil Mustafa, Carlos Riquelme, Joan Puigcerver. Rodolphe Jenatton, and Neil Houlsby. Multimodal contrastive learning with limoe: the language-image mixture of experts. Advances in Neural Information Processing Systems, 35:9564-995 9576, 2022.
[38] Trevine Oorloff and Yaser Yacoob, Robust one-shot face video re-enactment using hybrid latent spaces of stylegan2. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 20947-20995 2023.
[39] Trevine Oorloff, Surya Koppisetti, Nicolò Bonettini, Divyaraj Solanki, Ben Colman. Yaser Yacoob, Ali Shahriyari, and Gaurav Bharaj. Avff: Audio-visual feature fusion for video deepfake detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 27102- 27112, 2024.
[40] Kun Pan. Yifang Yin, Yao Wei, Feng Lin, Zhongjie Ba, Zhenguang Liu, Zhibo Wang. Lorenzo Cavallaro, and Kui Ren. Díl:: Deepfake incremental learning by exploiting domain-invariant forgery clues. In Proceedings of the 31st ACM International Conference on Multimedia, pages 8035-8046, 2023.
[41] Pingbo Pan, Siddharth Swaroop, Alexander Immer, Runa Eschenhagen, Richard Turner, and Mohammad Emtiyaz Khan. Continual deep learning by functional regularisation of memorable past. Advances in neural information processing systems, 33:4453-4464, 2020.
[42] Yuyang Qian, Guojun Yin, Lu Sheng, Zixuan Chen, and Jing Shao. Thinking frequency: Face forgery detection by mining frequency-aware clues. In European conference on computer vision, pages 86-103. Springer, 2020.
[43] Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, al. Learning transferable visual models from natural language supervision. In International conference on machine learning, pages 8748-8763, PMLR, 2021.
[44] Sylvestre-Alvis Rebuffi, Alexander Kolesnikov, Georg Sperl, and Christoph H Lampert. icarl: Incremental classifier and representation learning. In Proceedings of the IEEE conference on Compuder Vision and Puttern Recognition, pages 2001-2010, 2017.
[45] Sylvestre-Alvise Rebuffi, Alexander Kolesnikov, Georg Sperl, and Christoph H Lampert. icarl: Incremental classifier and representation learning. In Proceedings of the IEEE conference on Computer Vision and Pattern Recognition, pages 2001-2010, 2017.
[46] Matthew Riemer, Ignacio Cases, Robert Ajemian, Miao Liu, Irina Rish, Yuhai Tu, and Gerald Tesauro. Learning to learn without forgetting by maximizing transfer and minimizing interference. arXiv preprint 1rXiv:1810.11910 2018
[47] Hippolyt Ritter, Aleksandar Botev, and David Barber. Online structured laplace approximations for overcoming catastrophic forgetting. Advances in Neural Information Processing Systems, 31, 2018.
[48] Andreas Rossler, Davide Cozzolino, Luisa Verdoliva, Christian Riess, Justus Thies, and Matthias NieBner. Faceforensics+#:: Learning to detect manipulated facial images. In Proceediings of the IEEE/CVF interna- tional conference on computer vision, pages 1-11, 2019.
[49] Jonathan Sehwarz, Wojeiech Czarnecki, Jelena Luketina, Agnieszka Grabska-Barwinske Yee Whye Teh, Razvan Pascanu, and Raia Hadsell. Progress & compress: A scalable framework for continual learning. In International conference on machine learning, pages 4528 4537. PMLR, 2018
[50] Yichen Shi, Yuhao Gao, Yingxin Lai, Hongyang Wang. Jun Feng, Lei He, Jun Wan, Changsheng Chen, Zitong Yu, and Xiaochun Cao. Shield: An evaluation benchmark for face spoofing and forgery detection with multimodal large language models. Visual Intelligence, 3(1):9 2025.
[51] Kaede Shiohara and Toshihiko Yamasaki. Detecting deeplakes with self blended images. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages
2022.
[52] Christian Simon, Piotr Koniusz. and Mehrtash Harandi. On learning the geodesic path for incremental learning. In Proceedings of the IEEE/CVF conference on Computer Vision and Pattern Recognition, pages 1591-1600, 2021.
[53] Pravendra Singh, Pratik Mazumder, Piyush Rai, and Vinay P Namboodiri. Rectification based knowledge retention for continual learning. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 1222-15291, 2021.
13

---

[54] Ke Sun, Shen Chen, Taiping Yao, Haozhe Yang. Xiaoshuai Sun, Shouhong Ding, and Rongrong Ji. Towards general visual-linguistic face forgery detection. arXiv preprint AxKi:2307711644. 2023.
[55] Ke Sun, Shen Chen, Taiping Yao, Xiaoshuai Sun, Shouhong Ding, and Rongrong Ji. Continual face forgery detection via historical distribution preserving. International Journal of Computer Vision, pages 1-18, 2024.
[56] Jiahe Tian, Cai Yu, Xi Wang, Peng Chen, Zihao Xiao, Jizhong Han, and Yesheng Chai. Dynamic mixed- prototype model for incremental deepfake detection. In Proceedings of the 32nd ACM International Conference on Multimedia, pages 8129-8138, 2024.
[57] Laurens Van der Maaten and Geoffrey Hinton. Visualizing data using t-sne. Journal of machine learning reseurch, 9(11), 2008.
[58] Lantao Wang and Chao Ma. Adapting pretrained large-scale vision models for face forgery detection. In International Conference on Multimedia Modeling, pages 71-85. Springer, 2024.
[59] Liyuan Wang, Mingtian Zhang, Zhongfan Jia. Qian Li, Chenglong Bao, Kaisheng, Ma. Jun Zhu, and Yi Zhong. Afec: Active forgetting of negative transfer in continual learning. Advances in Neural Information Processing Systems, 34:22379-222 22391, 2021.
[60] Xiao Wang. Tianze Chen, Qiming Ge. Han Xia, Rong Bao, Rui Zheng, Qi Zhang, Tao Gui, and Xu- anjing Huang. Orthogonal subspace learning for language model continual learning. arXiv preprint WrXiv:231014115: 2023.
[61] Mingwang Xu, Hui Li, Qingkun Su, Hanlin Shang. Liwei Zhang. Ce Liu, Jingdong Wang, Lue Van Gool, Yao Yao, and Siyu Zhu. Hallo: Hierarchical audio-driven visual synthesis for portrait image animation. arXiv preprint arXiv: 088011 2024.
[62] Zhiliang Xu, Hang Zhou, Zhibin Hong, Ziwei Liu, Jiaming Liu, Zhizhi Guo, Junyu Han, Jingtuo Liu, Errui Ding, and Jingdong Wang. Styleswap: Style-based generator empowers robust face swapping. In European Conference on Computer Vision, pages 661-677. Springer, 2022.
[63] Le Xue, Manli Shu, Anas Awadalla, Jun Wang. An Yan, Senthil Purushwalkam, Honglu Zhou, Viraj Prabhu, Yutong Dai, Michael Ryoo, et al. xgen-mm (blip-3); family open large multimodal models. arXiv preprint axXiv:2488.08877 2024.
[64] Shipeng Yan, Jiangwei Xie, and Xuming He. Der: Dynamically expandable representation for class incremental learning. In Proceedings of the IEEE/CVF conference on computer vision and puttern recognition, pages 3014-3023. 2021.
[65] Shipeng Yan, Jiangwei Xie, and Xuming He. Der: Dynamically expandable representation for class incremental learning. In Proceedings of the IEFF/CVF conference computer vision and pattern recognition, pages 3014-3023, 2021.
[66] Zhiyuan Yan, Taiping Yao, Shen Chen, Yandan Zhao, Xinghe Fu, Junwei Zhu, Donghao Luo, Li Yuan, Chengjie Wang. Shouhong Ding, et al. Df40: Toward next-generation deepfake detection, arXiv preprint arXiv:2406. 13495, 2024.
[67] Zhiyuan Yan, Yandan Zhao, Shen Chen, Mingyi Guo, Xinghe Fu. Taiping Yao, Shouhong Ding, Yunsheng Wu, and Li Yuan. Generalizing deepfake video detection with aang-and-play. Vidco-level blending and spatiotemporal adapter tuning. In Proceedings of the Computer Vision and Pattern Recognition Conference, pages 12615-12666 2025.
[68] Jiazuo Yu. Yunzhi Zhuge, Lu Zhang, Ping Hu, Dong Wang, Huchuan Lu, and You He. Boosting continual learning of vision-language models via mixture-of-expertt adapters. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 23219-23230. 2024.
[69] Friedemann Zenke, Ben Poole, and Surya Ganguli. Continual learning through synaptic intelligence. In International conference on machine learning, pages 3987-3995. PMLR, 2017.
[70] Chi Zhang, Nan Song, Guosheng Lin, Yun Zheng, Pan Pan, and Yinghui Xu. Few-shot incremental learning with continually evolved classificrs. Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 12455-12464, 2021.
[71] Deyao Zhu, Jun Chen, Xiaogian Shen, Xiang Li. and Mohamed Elhoseiny. Minigpt-4: Enhancing vision-language understanding with advanced large language models. arXiv preprint arX4v:2304.10592 2023.
14

---

[72] Xiangyu Zhu, Hao Wang, Hongyan Féi, Zhen Lei, and Stan Li. Face forgery detection by 3d decompo- sition. In Proceedings of the IEEE/CVE conference on computer vision and pattern recognition, pages 2929-2939, 2021.
[73] Xiangyu Zhu, Hongyan Fei. Bin Zhang. Tianshuo Zhang. Xiaoyu Zhang. Stan Z Li, and Zhen Lei. Face forgery detection by 3d decomposition and composition search. IEEE Transactions on Pattern Analysis and Machine Intelligence, 45(7):8342- 8357, 2023.
[74] Barret Zoph, Irwan Bello, Sameer Kumar, Nan Du, Yanping Huang, Jeff Dean, Noam Shazeer, William Fedus. St-moe: Designing stable and transferable sparse expert models, arxiv preprint arXiv:2202.08900 2022.
15

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: We clearly state the proposed claims and motivations in the abstract and introduction, and list our contributions at the end of the introduction.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include aspirational goals as motivation long is clear that these goals are not attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: We provide a detailed discussion of the limitations of this work in Appendix Section: Limitations, including the potential increase model scale with training.
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (c.g.. independence assumptions, noiseless settings, model sellsspeciiiationn asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-tex, system might not be used reliably to provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimesss.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community, Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
16

---

Answer: [Yes]
Justification: In Section: Methodology of the paper, we provide the full set of assumptions and complete (and correct) proof for each theoretical result, such the reasons why orthogonality constraints cause forgetting, the derivation of orthogonal gradients, and the derivation of the label-guided localized balancing strategy.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: In the Experimental Setup section of Section: Experiments, we present all experimental details for reproducibility. including the datasets used, the backbone network, training details, hyperparameters, and the unique task settings and task sequences specific continual learning. In Section: Methodology, provide a detailed description of all aspects of our method and the loss functions. Furthermore, we will make all training code and training details publicly available.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how replicate the results, access to hosted model (e.g., s., in the of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurlPS does not require releasing code, the conference does require submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how reproduce that algorithm.
(b) If the contribution is primarily the architecture clearly and fully.
model architecture, the paper should describe
(c) the contribution a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
17

---

(d)
We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
Justification: We will release all our training code, inference code, experimental settings, and trained models for public availability. The datasets used in the paper may require additional application and access, such FaceForensics*+ We will provide the official link these datasets, as well as our preprocessing code for handling them, to ensure full reproducibility of the results.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips: cc/
public quides//////eg /tw.eeee/ooeSuummii ssn.iissssoooooooooooooooooooooo ssionPolicy for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (c.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run reproduce the results. See the NeurIPS code and data submission guidelines (https
/ //nips cc/ publ cc/publccpppppp c/ iee CCodeSubbe ss onPol icy) for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: In the Experimental Setup section of Section: Experiments, we present all experimental details for reproducibility, including the datasets used, the backbone network, training details, hyperparameters, and the unique task settings and task sequences specific to continual learning.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to a level of detail that is necessary appreciate the results and make sense of them.
The full details can be provided either with the code, appendix, or as supplemental material.
7. Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
18

---

Answer: [No]
Justification: The experiments are based on two metrics: accuracy and AUC. First, due our limited experimental resources, conducting repetitive experiments is impractical. Second, in the field of Face Forgery Detection, error bars or statistical significance tests are not required. None of the compared Face Forgery Detection methods provide statistical significance tests or eπror bars in their papers.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the enror bars capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall
with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula. call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
It is OK to report I-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables figures symmetric error bars that would yield results that are out of range (e.g. negative rates).
If error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed reproduce the experiments?
Question:
Answer: [Yes]
Justification: In the Experimental Setup section of Section: Experiments, we provide the computational resources required for the experiments, and in the appendix. we present information related to computational resource consumption, including the total number of model parameters, the number of backbone parameters, and the trainable parameter count.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethics http://tpwss.e.......pppppp/aaaa
Answer: [Yes]
Justification: the paper, we carefully adhere to the NeurIPS Code of Ethics in every respect.
Guidelines:
19

---

The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g.. there a special consid- eration due to laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: Undoubtedly, the work presented in this paper has positive societal impacts, such as preventing fraud and identifying fake information, which we discuss in detail in the introduction.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility of MI...
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
The paper does release any pretrained language models, image generators, or scraped datasets that could potentially be misused, thereby ensuring that there are no such risks associated with the paper.
Justification:
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
20

---

12. Licenses for existing assets
Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification: We have provided citations and application conditions for the datasets and methods used.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset. For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should provided.
assets are released, the license, copyright information, and terms of use the package should be provided. For popular datasets, paper sewerssiie thooce com/ datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information is available online, the authors are encouraged to reach out the asset's ' creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: We do not propose any new dataset-related assets, and the trained models as well all code will be open-sourced.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the datasct/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification: There are crowdsourcing experiments research involving human subjects in the paper.
Guidelines:
The answer NA means that the paper does involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
21

---

According to the NeurlPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/teview based on the requirements of your country institution) were obtained?
Answer: [NA]
Justification: There crowdsourcing experiments research involving human subjects in the paper.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with
human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent)
may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such the institution conducting the review.
16. Declaration of LLM usage
Question: Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the core methodology. scientific rigorousness, or originality the research, declaration is not required.
Answer: [NA]
Justification: The core method in the paper does not involve LLMs as any important, original, or non-standard components.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, or non non-standard components.
Please refer to our LLM policy (https: /tte:r////urrrs// ctc Scc//onfeeeecss 2025/
LLM) for what should should not be described.
22

---

Appendix
A
Limitations
First, the first limitation lies in the linear increase of our method's model scale as the training sequence progresses. Although the number of parameters in LoRA is very small, this growth may have an impact on extremely long sequence continual learning, Second, our method fine-tunes the pre- tr-irri weights within subspaces using LoRA, and thus may rely on strong general pre-trained model that already possesses some general knowledge before training, We will address these limitations in our future research.
B Details of Orthogonal Gradient
To estimate the gradient space of LoRA and orthogonalize it with the subspace of LoRA, rely on a key proposition (29] that the gradients of linear layers will lic within the input space. Here, we provide proof of this proposition. For a linear layer, let its weight matrix be denoted as W xdo Its forward process can be expressed as:
e
Wx +
(16)
where x E Rdr and e E Ro are the input and output vector, respectively. By applying the chain rule, we compute the gradient of W:
ac OC de
Oc x de
(17)
ow
de
W
Assuming the vector Be
8C is given by: [1, 12, ldol
then the gradient
ac x De
can be represented as:
l,,
Txx7
0c
12,
1xx
x"
x"
(18)
de
[do_
Idox
can be observed that each row the gradient ac is multiplication the input vector x with a BW certain value 4 (1 < k S do). Hence, the gradient shares the same subspace the input vector x, meaning the gradient lies within the input space.
C More Experimental Details
C.1 Experimental Fairness
First, at the data level. we use the same amount of subtask data as the compared methods, i.c., 100 videos with 20 sampled frames per video, which is identical methods such DFIL 40 and SUR-LID 77. Second, at the model level, we employ backbone with similar order of magnitude of parameters as the compared methods: ViT-B/16, thus avoiding the use of larger model to ensure experimental fairness. It is worth noting that our trainable parameters consist only of the parameters of two LoRAs, which is approximately 1/10 of the trainable parameters of the compared methods. Third, in terms of training strategies, many methods such DFIL 40 and SUR-LID (7] utilize Replay Set, which allows access to data from previous tasks-a practice that is prohibited in many continual learning scenarios. The proposed DevFD method completely isolates any data between subtasks. This not only demonstrates that we achieve the best results under stricter constraints but also indicates the broader applicability of method. Finally, the comparative metric data used are the best results extracted directly from the original papers. We achieve an undeniably leading position in absolute performance.
C.2 More Implementation Details
provide our detailed hyperparameter settings here. For the label-guided localized balancing strategy, we use fixed hyperparameter setting, We set ó to 0.15 and A3 to 0.2. For the integrated
23

---

Parameter Analysis
Total Params
Zoom 20x Parains
120
104
Params
Backbone Params
Prezeen
100
103
Trairable LoRk Params
103
40-
100
DFSCPP
DTD
CDF2
-F++
DTDC-P
CDF?
Figure 5: Expanded parameter analysis. The parameter expansion of the proposed developmental MoE is fully controllable, and the trainable parameters will remain constant throughout the task sequence.
orthogonality loss, since our goal is to prevent the gradients in the current LoRA from interfering with the subspaces established by previous tasks during the entire training phase, we dynamically adjust the hyperparameters the orthogonal subspace loss to the orthogonal gradient loss for each epoch. Specifically, from epoch [0,5), we set ò to 0.5 and X2 to 0.5. From epoch [5,10), we set λ to I and X2 to 0.1. From epoch [10,20), we set A to and X2 to 0.01.
C.3 More Details of Task10 Long Sequence Experiment
Existing continual learning methods for forgery detection typically employ task sequences with only four subtasks. We provide results for a continual learning task sequence with 10 subtasks based on DF40 [66] and reproduce three high-performing continual learning methods for comparison: CoReD 19). DFIL (40), and HDP (55). We start with the original task sequence [Hybrid, FR, FS, EFS]. where Face-Swapping (FS): BlendFace, Face-Reenactment (FR): MCNet, and Entire Face Synthesis (EFS)) StyleGAN3 are used as our initial learning sequence and expand it to 10 tasks. We carefully select the remaining six methods while maintaining diversity. Specifically, for Face- Swapping (FS), we choose SimSwap and InSwapper; for Piice-Rennactment (FR), we select Wav2Lip and SadTallerr and for Entire Face Synthesis (EFS), we choose StyleGAN2 and StyleGAN-XL. We then randomly shuffle the last six methods to form the complete task sequence with 10 subtasks: (FFpp, MCNet, BlendFace, StyleGAN3, StyLeGAN-XI, Wav2Lip. SadTalker, StyleGAN2, SimSwap, InSwapper]. Analysis reveals that EFS methods may have significant differences from FS and FR methods, leading to sharp increases forgetting rates during transitions between learning EFS methods and FS & FR methods, such as 5->6 and 7->8.
D More Experimental Results
D.1 Parameter Analysis
We introduce a Developmental Mixture of Experts: DevFD to tackle the challenge of detecting new types of face forgeries. As tasks integrated, the parameters of the DevFD model expand in a specific manner. To illustrate that our developmental MoE can handle long-sequence tasks without suffering from parameter explosion. we perform experiments to track the expansion in parameter volume, as depicted in Fig. 5 By employing Purameter-Efficien Fine-Tuning (PEFT) technology, our DevFD model can learn in long-sequence tasks with minimal increase in parameter volume. The experimental results show that when the model is fine-tuned for the first task in the sequence, the trainable parameters constitute only 1.18% of the total parameters. Even after training on all four tasks, the additional parameters account for just 2.89% of the total. Furthermore, since only the Real-LoRA and the final LoRA in the Fake-LoRA sequence are trainable, the number of trainable parameters remains stable throughout the task sequence and does not expand with the overall parameter volume. Consequently, the parameters of our proposed developmental MoE are fully manageable, making it well-suited for learning in long-sequence tasks.
24

---

Average Accuary (AA)
Average Forgetting (AF)
90
25
Losa
88
86
15
4A
84
2
10
Lons
100 200 500 10002000 50 100 200 500 10002000
Figure 6: Effect of subspace and gradient constraint, O represents the scenario with only subspace constraints, while O+G indicates the presence of both subspace and gradient constraints. The gradient constraints improve in both accuracy forgetting rate.
D.2 Effect of orthogonal Subspace and Orthogonal Gradients
The proposed method introduces additional gradient constraints to ensure that even when the sub- spaces are not entirely orthogonal, the gradient space remains orthogonal to the established subspaces. This prevents the gradient from interfering with the established subspaces. We simulate the early stages of the training process using fewer training samples to evaluate whether these constraints on the gradient space can prevent interference and the results shown in Fig. 6 Here, O represents the scenario with only subspace constraints, while O+G indicates the presence of both subspace and gradient space constraints. The experimental results demonstrate that the orthogonal gradients significantly reduces the average forgetting in the early stages training. Additionally, can improve the average accuracy by constraining the early learning direction, confirming the effectiveness of orthogonal gradients.
D.3 Effect of ViT Backbone
We employ Vision Transformer (ViT) pre-trained by CLIP + as our initial backbone for training. To explore how different backbones affect model performance, we test various ViT models [16 with varying sizes of parameters. The results of these experiments are detailed in Table
Table Effect backbones in proposed
lines indicate backbone used our method.
FF++
DFDC-P
DFD
CDF2
Backbone
Params
AA
AF
AA
AF
AF
ViT-B/16
86M
98.41
93.48
1.35
93.14
3.40
89.82 4.03
ViT-B/32
86M
98.03
91.24
2.88
93.29
4.52
88.25
7.63
ViT-I/14
304M
99.07
93.75
1.36
93.37
3.79
90.55
5.86
Our experiments reveal that a patch size of 16x16 performs better than 32x32, with the ViT-B/16 model demonstrating superior overall performance compared the ViT-B/32 model. When considering the effect of increasing the parameter scale, the ViT-L/14 model, which adds 218M parameters to the
Table 5: Performance comparison of different task orders.
Dataset
FF++
DFDC-P
CDF2
DFD
AA
AF
FF++
98.41
98.41
DFDC-P
96.95
90.88
93.92
1.46
CDF2
93.42
88.37
92.33
91.37
3.75
DFD
90.86
84.35
89.81
95.91
90.23
4.15
Dataset
FF++
DFD
DFDC-P
CDF2
AA
AF
FT4+
98.41
98.41
DFD
94.13
97.25
95.69
4.28
DFDC-P
92.88
94,91
85.94
91.24
3,94
CDF2
90.05
94.39
87.28
90.43
90.54
3.29
25

---

ViT-B/16, only saw modest improvement in average accuracy but slight increase in the average forgetting rate when trained on all four tasks. We attribute this marginal gain the limited dataset size, which makes model performance less sensitive to parameter scale increase. Based on these findings, we choose the ViT-B/16 as our backbone model for its optimal balance of performance and efficiency.
D.4 Effect of Task Orders
To determine if the high accuracy and resistance forgetting in our proposed method are independent of the specific order in which tasks are presented, we conducted a series of experiments varying the task sequences. The outcomes of these experiments are detailed in Table Our findings indicate that our method consistently delivers high detection accuracy and resistance forgetting across different task sequences. For instance, when the tasks are sequenced as [FF++, DFDC-P, CDF2, DFD], the model achieves an average accuracy of 90.23% and an average forgetting rate of 4.15%. In another sequence, [FF++, DFD, DFDC-P, CDF2], the model's average accuracy is 90.54% with an average forgetting rate of 3.29%. These results suggest that the order of tasks does not significantly impact model's performance.
26


Reviews:
[{"review_id": "HbVRvRiKux", "reviewer": "Reviewer_gTcD", "summary": "This submission tries to integrate continual learning into the detection of generated faces. It uses a mixture of expert model architecture with some modifications, i.e., a real LoRA and a set of orthogonal LoRAs for fake faces. Besides, orthogonal gradient loss was formulated to alleviate inference. Experimental results showed the proposed method had effecive detection scores and low forgetting rates.", "questions": "Please see Weakness.", "limitations": "NA.", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 3, "originality": 2, "strengths_and_weaknesses": "Strength:\n\n1) Continual learning was integrated into the synthetic face detection task, and was showed effective to alleviate forgetting encountered with unseen types of fake faces.\n\n2) LoRAs were split into real LoRA and a set of fake LoRAs, where fake ones were designed to be orthogonal to each other to capture incremental fake face information. Optimization strategies were designed to improve its training. \n\nWeakness:\n\n1) The proposed method should be compared with more state-of-the-art deepfake video detectors, e.g. [1].\n\n2) MoE has been used in existing deepfake image detection, e.g., [2,3], and the orthogonal gradient optimization has been used in [4] for deepfake audio detection. These works should be discussed regarding the major differences. \n\n\nReferences.\n[1] Generalizing Deepfake Video Detection with Plug-and-Play: Video-Level Blending and Spatiotemporal Adapter Tuning, https://arxiv.org/abs/2408.17065.\n\n[2] Liu, Zihan, Hanyi Wang, Yaoyu Kang, and Shilin Wang. \"Mixture of low-rank experts for transferable ai-generated image detection.\" arXiv preprint arXiv:2404.04883 (2024).\n\n[3] Cao, Huangsen, Yongwei Wang, Yinfeng Liu, Sixian Zheng, Kangtao Lv, Zhimeng Zhang, Bo Zhang, Xin Ding, and Fei Wu. \"HyperDet: Generalizable Detection of Synthesized Images by Generating and Merging A Mixture of Hyper LoRAs.\" arXiv preprint arXiv:2410.06044 (2024).\n\n[4] Chen, Yujie, Jiangyan Yi, Cunhang Fan, Jianhua Tao, Yong Ren, Siding Zeng, Chu Yuan Zhang et al. \"Region-based optimization in continual learning for audio deepfake detection.\" In Proceedings of the AAAI Conference on Artificial Intelligence, vol. 39, no. 22, pp. 23651-23659. 2025.", "was_revised": true, "final_justification": "The authors included the experimental comparisons with the suggested one, which helped resolve my concerns in part. Thus, I slightly raised my rating accordingly.", "rebuttal": "**Thank you for your thoughtful and constructive review. Our responses to your questions are as follows:**\n### W1: Comparison with more state-of-the-art deepfake video detectors, e.g. [1].\n\nWe provide a comparison following the same experimental settings as DFIL, using the AUC as the evaluation metric. The results are presented in the table below:\n\n| Dataset  | DFDC-P | DFD   | CDF2  |\n| :------- | ------ | ----- | ----- |\n| VB-StA   | 90.9   | 96.5  | 94.7  |\n| **Ours** | 96.21  | 98.71 | 94.93 |\n\nThe results demonstrate that our method outperforms the VB-StA[1] method. We will incorporate an additional experiment in the main paper to provide a more detailed comparison. It is crucial to highlight that the method you have requested for comparison is a non-continual learning approach, which is trained on a fixed dataset and evaluated on other datasets. In contrast, our method follows a continual learning paradigm, where the model is sequentially trained and tested on a stream of tasks, emphasizing its ability to mitigate catastrophic forgetting. The training methodologies and objectives of these two approaches are fundamentally different. To ensure a fair comparison, we strictly adhere to the unified testing protocol established in the published DFIL paper, which is designed to evaluate both continual and non-continual learning methods under the same benchmark.\n\n### W2: Major differences between our method and prior works that utilize Mixture-of-Experts (MoE) and orthogonal optimization.\n\nFirst, concerning the MoE-based methods in [2,3], the fundamental differences from our approach are as follows:\n\n1. **These methods employ static, pre-defined Mixture of Experts (MoE) architectures that are unsuitable for continual learning settings.** For instance, [2] pre-defines a set of LoRAs as experts to extract and fuse diverse image features, while [3] uses a similar pre-defined LoRA structure to enhance model generalization. In these frameworks, the LoRAs are trained synchronously and cannot be specialized for individual forgery types, leading to poor scalability when encountering continually emerging manipulation techniques. Consequently, performance degrades significantly when a forgery type appears that is beyond the scope of the pre-defined experts.\n\n   In contrast, our proposed MoE architecture is an extensible framework designed for continual learning. When a new forgery type is introduced, our framework dynamically adds a new LoRA to adapt to it. To preserve previously acquired knowledge, we enforce an orthogonality constraint between the new and existing LoRAs.\n\n2. **These methods lack designs and priors specifically tailored for continual face forgery detection.** Our approach, however, leverages a key characteristic of this task: real faces exhibit high similarity due to consistent acquisition methods, whereas forged faces show significant variance across different manipulation techniques. Based on this prior, we devise a label-guided LoRA assignment strategy. A shared LoRA is used to model the common features of real faces, while a unique, orthogonal LoRA is assigned to model each specific type of forgery. As demonstrated in Section 4.3, \"Ablation Study: Effect of Real-LoRA and Fake-LoRAs,\" and Table 3, the configuration with Real-LoRA=0 and Fake-LoRAs=4 represents the baseline performance when applying LoRA and MoE directly, without our Real-LoRA and label-guided assignment strategy. The results show that with our innovations, the average task forgetting rate is reduced by 2.39%. We will include the two aforementioned methods in our performance comparison if they become open-source in the future.\n\nTo the best of our knowledge, our work is the first to apply an MoE framework to continual face forgery detection.\n\nSecond, regarding the orthogonal gradient optimization method in [4], the key distinction is:\n\n1. **The gradient optimization in [4] is applied to the entire model and the full gradient space. However,our method confines the optimization to the LoRA subspaces.** We aim to use an orthogonal gradient constraint to prevent the new LoRA from interfering with the subspaces of previous tasks during training. Therefore, instead of simply applying an orthogonal loss to the entire gradient space, we introduce an SVD-based decomposition to align the dimensions of the gradient space with the LoRA subspace. This technique preserves the principal components of the gradient and orthogonalizes them with respect to the subspaces of previous tasks.\n\nSimilarly, we will provide a detailed discussion in the Related Works section to differentiate our proposed method from these three approaches."}, {"review_id": "cC0qF6fCIz", "reviewer": "Reviewer_soP2", "summary": "The paper aims to tackle the ever-evolving new types of forgery issues. It frame face forgery detection as a continual learning problem and allow the model to scale in complexity as new forgery types emerge. Specifically,  it employs a Developmental Mixture of Experts (MoE) architecture, utilizing LoRA models as the individual experts. To prevent catastrophic forgetting, the paper ensures that the learning direction of Fake-LoRAs is orthogonal to the established subspace.", "questions": "The authors should clarify whether extending LoRA modules specifically for the real data branch could further enhance performance, and provide a more thorough analysis of the current routing distribution.", "limitations": "The authors should clearly state the limitations of their method, such as which types of attacks it can address and which types it cannot.", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 4, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths\n1. The motivation of the paper is clear, and the proposed solution is straightforward.\n\nWeaknesses\n1. How do you define an \"expert\"? In practice, it is often difficult to accurately determine the specific attack method for an attack image. Would such hybrid or ambiguous attack types affect the performance of the current MoE (Mixture of Experts) framework?\n2. Since real data can have a wide distribution and may include new scenarios (e.g., images from different cameras, people of different ethnicities, etc.), would introducing an additional adapter specifically for real data further improve performance?\n3. The paper lacks an in-depth analysis of the routing distribution. Is there a difference in routing behavior for different types of attacks?\n4. Why does the proposed method outperform previous approaches even on a first dataset (for example, achieving 98.41% on FF++)?\n5. The method itself is essentially an extension using multiple LoRA modules, which may not be particularly novel.", "was_revised": true, "final_justification": "The author's explanation has satisfactorily addressed my main concerns. Therefore, I have decided to change my rating to borderline accept.", "rebuttal": "**Thank you for your thoughtful and constructive review. Our responses to your questions are as follows:**\n### W1: Definition of \"expert\" and the framework's robustness against ambiguous or hybrid attack types.\n\n   Thank you for your insightful feedback. We acknowledge that precisely defining specific attack types is challenging in practice. Our model is designed with this consideration in mind, and its performance is **not adversely affected by hybrid or ambiguous attack types.** We explain the reasons from both the training and testing perspectives below:\n\n   1. **During the training phase:** The training data typically includes known dataset labels and forgery type labels. We leverage this information to extend the MoE framework, allowing one expert to correspond to a specific dataset or forgery type. In fact, our experiments on the FF++ dataset, which is a composite of four different manipulation methods, support this. In our dataset-incremental protocol, we use a single LoRA to model the forged data from this mixed-type dataset and still achieve state-of-the-art results. This outcome empirically demonstrates that our framework is robust to hybrid or ambiguous attacks.\n   2. **During the testing or inference phase:** At this stage, dataset and type labels are unavailable. Our framework does not require the forgery type to be known. Instead, it makes a joint decision by summing the outputs of all experts for a comprehensive judgment.\n\n### W2: Discussion on the introduction an additional adapter specifically for real facial data.\n\n   We address the practical concern that real-world data can have a wide distribution and include novel scenarios in Section 4.3 (\"Effect of Real-LoRA and Fake-LoRAs\") and Table 3. Our findings indicate that **expanding a shared Real-LoRA into a sequence of Real-LoRAs, with each module corresponding to the real faces of a specific dataset, yields inferior performance compared to using a single Real-LoRA.** This suggests that real faces exhibit high similarity across datasets, and maintaining a unified distribution for them is more effective than modeling the real faces of each dataset separately.\n\n### W3: Analysis of the routing distribution. \n   Our MoE framework does not employ an explicit routing strategy. Instead, **it utilizes a form of soft routing constrained by an orthogonality loss, where the final output is generated by directly summing the outputs of the different experts.**\n\n   Due to the time constraints of the rebuttal period, we will add a detailed analysis to the main  paper. This analysis will investigate the behavior of the experts within our proposed framework by examining the output of each expert for different types of attacks and analyzing the orthogonality among them.\n\n### W4: The reason why the proposed method outperform previous approaches even on a first dataset.\n\n   Our use of a MoE architecture to fine-tune the Feed-Forward Networks (FFN) necessitates the adoption of a Vision Transformer (ViT) framework. During the learning phase on the first dataset (FF++), the strong fitting capability of ViT enables the method to achieve an accuracy of 98.41%. However, models with strong fitting capabilities are prone to overfitting in subsequent tasks and consequently suffer from more severe catastrophic forgetting.\n\n   In continual learning, the forgetting rate is the most important evaluation metric and is relatively less dependent on the backbone architecture. As shown in **Section 4.3, titled \"Effect of Lort and Lllb,\" and in Table 2**, the first row presents the results of using only the baseline. The results indicate that the baseline can achieve a comparable performance (98.18%) on the first task. However, in subsequent tasks, its average accuracy drops sharply, and the forgetting rate increases rapidly, ultimately reaching an Average Accuracy (AA) of only 78.82% and an Average Forgetting (AF) of 23.93%, which is significantly lower than our method's 89.92% AA and 4.03% AF. This finding further isolates the influence of the backbone and demonstrates the effectiveness of our proposed method.\n\n### W5: The novelty of our framework.\n\n Although our framework utilizes LoRA as its experts, our core innovations are not LoRA itself, but rather:\n\n   1. Our method for managing the LoRA subspace and the gradient space. This approach prevents interference with the subspaces established for previous tasks throughout the entire training process.\n   2. A label-guided localized balancing strategy. We leverage the key insight that authentic faces exhibit high similarity across datasets, whereas forged faces have significant distributional gaps arising from different manipulation techniques. Our strategy uses this prior to softly assign a shared \"Real-LoRA\" to model the common features of authentic faces, and a sequence of orthogonal LoRAs to model different forgery types independently and without interference.\n\n### Limitations.\nWe provide a detailed discussion of our framework's limitations in **Appendix A.**"}, {"review_id": "h77wjhApgA", "reviewer": "Reviewer_BQKM", "summary": "This paper proposes DevFD, a Developmental Mixture of Experts (MoE) architecture designed for continual face forgery detection. Addressing the challenge of rapidly evolving forgery techniques, DevFD frames face forgery detection as a continual learning problem. The core of the method involves utilizing Low-Rank Adaptation (LoRA) models as individual experts, allocating them into two groups: a Real-LoRA to refine the understanding of genuine facial features, and a sequence of Fake-LoRAs to incrementally capture information from various, emerging forgery types. A key innovation is the integration of orthogonal gradients into the orthogonal loss for Fake-LoRAs, aiming to prevent catastrophic forgetting by ensuring that learning new forgery types does not interfere with established knowledge. Furthermore, a label-guided localized balancing strategy is introduced to appropriately allocate expert responses during training.", "questions": "See the weakness.", "limitations": "Yes", "rating": 4, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 4, "clarity": 4, "significance": 4, "originality": 4, "strengths_and_weaknesses": "1. The paper introduces a well-conceived Developmental MoE architecture specifically tailored for the unique challenges of continual face forgery detection, where real faces are stable and abundant, while fake faces continuously evolve. This frames the problem effectively within a continual learning paradigm.\n2. The theoretical analysis identifying the limitations of pure subspace orthogonality for preventing forgetting, and the subsequent proposal of integrating orthogonal gradients into the orthogonal loss (L_ort), is a significant technical contribution. This mechanism directly addresses the issue of early training interference, crucial for robust continual learning.\n3 .The design to explicitly model real faces via a dedicated Real-LoRA and evolving fake faces via orthogonal Fake-LoRAs, coupled with the label-guided localized balancing strategy (L_llb), allows for efficient and targeted knowledge acquisition without mutual interference, while also fostering overall expert collaboration.\n4.DevFD demonstrates state-of-the-art average accuracy and, critically, the lowest average forgetting rates across comprehensive experiments on both dataset-incremental and manipulation-type-incremental protocols, including challenging long-sequence tasks. This provides robust evidence of its practical effectiveness. The utilization of LoRA modules as experts ensures that the model grows in a highly parameter-efficient manner as new tasks are learned, keeping the number of trainable parameters minimal compared to the backbone, which is important for scalability in long-sequence learning.\n\nWeakness:\n\n1. While the orthogonal gradient contribution is somehow novel, the fundamental concept of using LoRA with MoE for continual learning has been explored in recent works like MoECL, O-LoRA, and InfLoRA. The paper could articulate more explicitly how DevFD’s architectural design and mechanisms fundamentally differ from these existing methods, beyond just the gradient constraint, especially in how it leverages the unique asymmetry of real vs. fake data in FFD.\n\n2 .Although the paper highlights parameter efficiency, it lacks a comprehensive analysis of the computational cost (e.g., training time per task, inference time per image) compared to baseline methods. The added complexity of computing and enforcing orthogonal gradients, and the overall MoE routing, warrants a discussion on the trade-off between performance gain and computational overhead, which is critical for real-world deployment.\n\n3.The method introduces several hyperparameters (e.g.,delta,lambda3,and the dynamically adjusted lambda1, lambda2). While settings are provided, a more in-depth analysis of their sensitivity and how robustly these optimal values were determined across different tasks or initial conditions would strengthen the paper.\n\n4.While LoRA parameters are small, the long-term implications for extremely prolonged continual learning sequences (e.g., 50+ tasks) regarding total model size and memory footprint are not fully explored.", "was_revised": true, "final_justification": "The author's rebuttal addresses some of my questions, but the generalization to specific environments is not well demonstrated experimentally. Therefore, I maintain my recommendation of \"borderline reject\".", "rebuttal": "**Thank you for your thoughtful and constructive review. Our responses to your questions are as follows:**\n### W1: Clarification on our architectural novelty for the forgery detection task, in contrast to general-purpose continual learning methods.\n   Yes, we appreciate your suggestion. First, we will elaborate on the key distinctions between our method and MoECL, O-LoRA, and InfLoRA:\n\n   1. **MoECL** employs conventional MoE Adapters for Class-Incremental Learning. It uses a traditional router with a top-k mechanism to select experts, which necessitates T separate routers for T tasks. In contrast, our method utilizes a soft routing mechanism, which reduces the parameter count and emphasizes cooperation among experts. Furthermore, MoECL's activate-freeze strategy can only preserve knowledge by freezing experts; it cannot prevent the experts being trained on the current task from interfering with the knowledge acquired by previous experts.\n   2. **O-LoRA** first proposed using subspace orthogonality to prevent catastrophic forgetting. However, it enforces this orthogonality via a loss function. During the training process, when this loss value is large and the orthogonality condition is not yet met, the learning process can still disrupt previously acquired knowledge. Our approach mitigates this by orthogonalizing the gradients themselves, preventing such interference throughout the entire training process.\n   3. **InfLoRA** uses a pre-defined dimensionality reduction matrix, Bt, which restricts the learning capacity of LoRA as an adapter. In contrast, our use of orthogonal gradients and subspaces ensures that LoRA can effectively adapt to new tasks while simultaneously preventing catastrophic forgetting.\n\n   Second, we wish to emphasize our **label-guided localized balancing strategy**, which is specifically designed for continual face forgery detection—an aspect unexplored by the aforementioned methods. We leverage the key insight that authentic faces exhibit high similarity across datasets, while forged faces have significant distributional gaps due to different manipulation techniques. Our strategy uses this prior to softly assign a shared \"Real-LoRA\" to model authentic faces, and a sequence of orthogonal LoRAs to model different forgery types independently and without interference.\n\n   Third, we provide experimental evidence for our method's effectiveness. In **Appendix C.4**, we present the results of our framework using only the orthogonal subspace constraint (the core mechanism of O-LoRA). The results demonstrate that our complete method significantly outperforms O-LoRA.\n\n### W2: Analysis of the computational cost (e.g., training time per task, inference time per image) compared to baseline methods. \n\n   Thank you for your attention to our model's efficiency. We provide the details of the computational cost below.\n\n   | Method              | training time per batch | inference time per dataset（1000 images） |\n   | :------------------ | ----------------------- | ----------------------------------------- |\n   | Baseline | 9.93                    | 10.23                                     |\n   | DevFD (Ours)        | 9.94                    | 10.23                                     |\n\n   1. First, regarding the training cost, we use two A6000 GPUs with a batch size of 64. **For a typical task, the training time per batch is 9.94 seconds**. **Without the orthogonal space and orthogonal gradient computation, the time is 9.93 seconds, which is nearly identical.** Furthermore, in our training process, the number of learnable parameters remains constant as tasks increase. This means that an increase in the number of tasks in the sequence does not significantly extend this training time.\n\n   2. Regarding inference, the **pure inference time** for a typical dataset of approximately 1,000 images at a 224x224 resolution is about 10 seconds. This time also shows **negligible increase as the training sequence lengthens.** The reason is that the added computational load from the multiplication of the two low-rank matrices in each new LoRA expert is minimal.\n\n   3. Furthermore, we will add a detailed analysis of the computational cost to the main paper. This analysis will include an ablation study, where we progressively remove components of our model to investigate the trade-off between performance gains and computational cost.\n\n### W3: Analysis of hyperparameters sensitivity.\n\n   Thank you for your suggestion on refining our method. We present an ablation study for the different loss components in **Table 2**, where each loss is removed by setting its corresponding hyperparameter to zero. Furthermore, we will add a comprehensive experiment on hyperparameter values and their sensitivity to the main text of the paper.\n\n### W4:  Total model size and memory footprint.\n\n   We provide a parameter count analysis for sequential learning in **Appendix C.7.** The number of our training-related learnable parameters remains constant throughout the task sequence, without increasing as new tasks are added. This number is very small, **accounting for only 1.18% of the backbone's parameters**. After completing all four tasks, our total parameter **count increases by only 2.89% compared to the initial state**. This growth in parameters is almost negligible."}, {"review_id": "v00aNr0t8d", "reviewer": "Reviewer_1J7u", "summary": "This work proposes to address the challenge of continual face forgery detection. The authors assume that the real faces are more stable and singular compared to fake ones. The proposed framework incorporates LoRA-based experts split into two groups: one for refining real face features and others for learning different forgery types incrementally. To avoid catastrophic forgetting, Fake-LoRAs are trained with orthogonal constraints on their learning directions. Experiments conducted on various datasets and forgery types show the method’s effectiveness.", "questions": "See weaknesses.", "limitations": "Yes", "rating": 3, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 2, "originality": 2, "strengths_and_weaknesses": "Strengths\n- The paper is well-structured and easy to follow. \n\n- The dataset-incremental and manipulation-incremental results are promising, and the ablation studies well demonstrate the effectiveness of the designed components.\n\nWeaknesses\n- The novelty of this work appears to be limited. Adapting MoE to continual learning has been studied in [A], and the MoE learning scheme for  face forgery detection has been explored in [B]. Moreover, applying SVD for deepfake detection has been previously studied [C].\n\n- This work is based on a strong assumption that real faces are stable and can be modeled by one single Real-LoRA, which appears to be a key contribution of this work. However, this assumption is only supported by one t-SNE map of two datasets. More preliminary studies are expected to supprot this assumption. \n\n- Although the proposed method demonstrates good performance on continual face forgery detection benchmarks, the model architecture lacks design specifically tailored to the task of face forgery detection. As such, the work offers limited insight into the reasons behind the achieved performance gains. \n\n- The experiments are conducted on four datasets, including FF++ and three Deepfake datasets: DFDCP, DFD, and CDF2. Additional experiments focusing on continual learning across unseen manipulation types would better demonstrate the generalizability of the proposed method. For manipulation-incremental experiments, it is unclear why the authors only pick three manipulation types from DF40. \n\n[A] Boosting continual learning of vision-language models via mixture-of-experts adapters, CVPR, 2024.\n\n[B] Moe-ffd: Mixture of experts for generalized and parameter-efficient face forgery detection, ArXiv, 2024.\n\n[C] Orthogonal Subspace Decomposition for Generalizable AI-Generated Image Detection, ICML 2025.", "was_revised": true, "final_justification": "I appreciate the authors’ effort and time in providing detailed explanations and justifications. However, my major concerns regarding the novelty, the underlying assumptions, and the contributions to the community remain unaddressed.  I concur with reviewers gTcD and BQKM that the use of MoE for continual learning, deepfake detection, and AIGC detection has been extensively explored in prior work. Although the authors attempt to highlight the differences between their approach and existing methods, I still find this work to be a relatively straightforward combination of existing techniques applied to the task of continual face forgery detection.  Furthermore, the authors have not provided additional experiments to validate their strong assumption that real faces (regardless of source or domain) are stable and can be modeled by a single Real-LoRA.  I also find that the method lacks task-specific innovations for face forgery detection, resulting in limited contributions to the community. While the proposed label-guided localized balancing strategy is interesting, it is a general technique that could be applied to some other binary classification tasks and is not uniquely tailored to face forgery detection. Given these concerns, I am inclined to keep my rating unchanged.\n\nI carefully reviewed the authors' response and the manuscript. The additional experiments partially addressed my concerns. However, I still believe the quality of this work is below the standard of NeurIPS.", "rebuttal": "**Thank you for your thoughtful and constructive review. Our responses to your questions are as follows:**\n### W1: The novelty of our contribution in contrast to prior works [A, B, C].\n\n   We will now elaborate on the differences between our method and three related approaches:\n\n   1. **[A]** employs conventional MoE Adapters for Class-Incremental Learning. First, it uses a traditional router with a top-k mechanism to select experts, which necessitates T separate routers for T tasks. In contrast, our method utilizes a soft routing mechanism, which reduces the parameter count and emphasizes cooperation among experts. Second, MoECL's activate-freeze strategy can only preserve knowledge by freezing experts; it cannot prevent the experts being trained on the current task from interfering with the knowledge acquired by previous experts. Third, [A] is intended for general-purpose continual learning, while our method is specifically designed for the characteristics of the face forgery detection task and includes a mechanism to balance the experts, significantly improving model performance.\n   2. **[B] is an MoE framework for static models.** The experts in this MoE are pre-defined, whereas ours are dynamically expanded. Consequently, this method cannot adapt to continual learning scenarios that involve various emerging forgery types.\n   3. **[C]** utilizes SVD to decompose CLIP weights, with the intent of preserving CLIP's general-purpose knowledge. **In our work, SVD serves as a dimensionality reduction operation to project the orthogonal gradient into the LoRA subspace**. Thus, the methodological objective and the implementation path are fundamentally different. Furthermore, [C] is also a static method and is not applicable to continual learning scenarios.\n\n   To the best of our knowledge, our work is the first to apply a combination of MoE and orthogonal gradients to the task of continual face forgery detection.\n\n### W2: The assumption of modeling real faces with a single, stable distribution.\n\n   This is a **key observation** that serves as a motivation for our work: real faces tend to be more compactly distributed in the feature space, while different types of forged faces exhibit greater variance among themselves. **This makes it reasonable to model real faces and different types of forgeries with separate, dedicated LoRA modules.** The final results validate the effectiveness of our method. We will add more detailed experiments with different backbones in the main text to further substantiate this point.\n\n### W3: On how our architectural design is specifically tailored to the face forgery detection task.\n\n   We must emphasize our **label-guided localized balancing strategy**, which is specifically designed for continual face forgery detection and has not been explored in papers on general-purpose continual learning. We leverage the key insight that authentic faces exhibit high similarity across datasets, whereas forged faces have significant distributional gaps arising from different manipulation techniques. Our strategy uses this prior to softly assign a shared \"Real-LoRA\" to model the common features of authentic faces, and a sequence of orthogonal LoRAs to model different forgery types independently and without interference. \n\n   As demonstrated  in Section 4.3, titled \"Effect of Lort and Lllb,\" and in Table 2, the third row presents the results of using only the orthogonal loss without the label-guided localized balancing strategy. The results indicate that the label-guided localized balancing strategy reduces the forgetting rate by 3.88% (from 7.91 to 4.03), significantly improving model performance.\n\n### W4: Additional experiments focusing on continual learning across unseen manipulation types.\n\n   We did not limit our selection to only three forgery methods from DF40. On the contrary, **we conducted more extensive, long-sequence experiments on this dataset, as shown in Figure 3.** We selected 10 forgery types from DF40, ensuring that our selection covers all major forgery categories as evenly as possible. Using these 10 selected types, we conducted a standard 10-task long-sequence continual learning experiment. The results demonstrate that our method achieves the best performance and the lowest forgetting rate, even in long-sequence scenarios and when evaluated against multiple unseen manipulation types."}]

Author rebuttal:

Meta-review: This submission integrates continual learning into the detection of fake faces, using an MoE architecture with one Real-LoRA for real faces and a set of orthogonal Fake-LoRAs for fake faces. Orthogonal gradient loss was formulated to alleviate inference. Experimental results showed the proposed method has higher detection scores and lower forgetting rates.

The main strengthens of the work include: the motivation of the paper is clear, and the proposed solution is simple and effective; integrating orthogonal gradients into the orthogonal loss is a sound technical contribution; the paper is well-structured and easy to follow; the dataset-incremental and manipulation-incremental results are promising; and the ablation studies well demonstrate the effectiveness of the designed components. 

The main weaknesses lie in the moderate novelty (LoRA with MoE for CL is not brand new), strong assumption that real faces are stable and can be modeled by one single Real-LoRA. The AC notices that not all the concerns were completely solved. However, compared to the many strengths of the work, the weaknesses can be ignored for the time being, thus deserving public to the community.
Decision: Accept (poster)