What a deepfake detector score does not tell you

What a detector score actually measures

When a paper reports that a deepfake detector reaches 98 percent AUROC on FaceForensics++ [5], that figure is a ranking measure, not a percentage of videos correctly classified. It describes how well the detector ordered a set of known real and fake examples relative to each other, on a particular collection of examples. Reading it as "98 percent accurate" overstates what was measured, and the gap between those two readings is where most misplaced confidence in detection lives.

In-distribution results look strong

Evaluated on the data distribution it was trained on, detection looks close to solved. Mean AUROC on FaceForensics++ is reported between 98.0 and 98.9 percent [1]. Those results come from testing against the same generation methods present in training, which is the condition under which detection is easiest.

Cross-dataset results are substantially weaker

Across 14 benchmarks spanning 2019 to 2025, average cross-dataset AUROC is reported between 91.2 and 91.6 percent, and the spread behind that average is wide: the best benchmark result is 99.8 percent and the weakest is 77.7 percent [1]. A single average conceals the range, and the range is the part that matters when the generator is unknown.

The same pattern appears as benchmarks get harder. Detectors trained on FaceForensics++ are reported at 81.6 percent video-level AUC on Celeb-DF v1, 80.9 percent on v2, and 73.8 percent on Celeb-DF++, which incorporates 22 generation methods across face-swap, face-reenactment and talking-face [3].

Performance on generators released after training

The most consequential measurement is forward transfer, meaning performance on generators that appeared after the training data was assembled. Work that reframes detection as a continual-learning problem, simulating the chronological evolution of generators across seven years, introduces a Forward Transfer AUC metric for exactly this and reports that generalisation to future generators without additional training remains near-random, at roughly 0.5 [2]. The explanation the authors give is the unique imprint characterising each generator [2].

That finding sets the terms for everything else. A detector is not learning what a manipulated video is in general. It is learning what the specific tools in its training set leave behind.

An open question about what the benchmarks measure

There is also reason to be careful about the benchmark figures themselves. A frozen self-supervised probe, meaning a general-purpose feature extractor not trained for forensics at all, reached 88.51 AUC on a video benchmark against 89 to 90 AUC for specialised detectors, and 79.72 AUC on an image benchmark against 83.0 for a specialised detector, a gap of about 3.3 points [4]. That image benchmark is Celeb-DF++ again, but scored a different way: these are frame-level figures for detectors trained on Celeb-DF [4], where the 73.8 above is a video-level figure for detectors trained on FaceForensics++ [3]. Different training set, different scoring unit, so the two Celeb-DF++ numbers are not comparable to each other. The authors argue that much of the signal these benchmarks capture reflects general understanding of the medium rather than forensic evidence of manipulation [4].

If a general-purpose model nearly matches a purpose-built one, then part of what the leaderboard rewards is not detection skill. That is an argument in the literature rather than a settled conclusion, and it is worth treating as such.

Questions to ask before a detector output goes in a report

None of this means detection is worthless. It means a bare score is not interpretable on its own. Before relying on one, establish:

• Which generation methods the detector was trained on, and when that training set was assembled.
• Whether the quoted figure is in-distribution or cross-dataset, since the published gap between those conditions is large [1].
• Whether any forward-transfer evaluation exists for the tool, given that measured forward transfer is reported as near-random in the work cited here [2].
• What the score is being asked to support. A ranking measure over a labelled test set is not a probability that one particular video is synthetic.

A figure of 98 percent AUROC is a real result about a specific benchmark [1]. It is not a statement about the file in front of you, and the published cross-dataset and forward-transfer numbers are the reason to keep those two things apart.

---

• Why deepfake detectors fail on new generators , the mechanism behind the numbers here
• Detector results on deepfakes found in the wild , the in-the-wild figures this post refers to
• When audio deepfake detectors fail on new voice generators , the same question for synthetic speech

---

Sources

1. [1]
   Yermakov et al. Deepfake Detection that Generalizes Across Benchmarks. arXiv:2508.06248.arxiv.org
2. [2]
   Revisiting Deepfake Detection: Chronological Continual Learning and the Limits of Generalization. arXiv:2509.07993.arxiv.org
3. [3]
   Celeb-DF++: A Large-scale Challenging Video DeepFake Benchmark for Generalizable Forensics. arXiv:2507.18015.arxiv.org
4. [4]
   What Do Deepfake Benchmarks Measure? An Audit Using Frozen Self-Supervised Representations. arXiv:2606.26384.arxiv.org
5. [5]
   Rössler et al. FaceForensics++: Learning to Detect Manipulated Facial Images. arXiv:1901.08971.arxiv.org