Architecture as evidence.
The mechanisms that produce synthetic media are also where the seams are. Understand the model, and you understand where to look. Below: the architectures, the forensic methods that exploit their seams, the benchmark datasets, and the open problem that prevents this from being a solved field.
A generator and a discriminator, locked in a two-player game.
Goodfellow et al. (2014) framed image synthesis as a minimax game between two networks: a generator G that maps noise to candidate samples, and a discriminator D that estimates the probability a sample came from the training distribution rather than G. The two are updated alternately until D can no longer tell them apart. This is the conceptual lineage of every modern image and audio generator, including modern diffusion models (which replace the explicit discriminator with a learned denoising objective).
Source: Goodfellow et al., Generative Adversarial Nets, NeurIPS 2014. arXiv:1406.2661
Latent diffusion: synthesis as iterative denoising.
Rombach et al. (CVPR 2022) showed that diffusion models could be run in the latent space of a pretrained autoencoder rather than in pixel space, cutting compute by an order of magnitude while preserving quality. This is the architecture behind Stable Diffusion and most modern open-weight image generators. Diffusion outputs leave subtly different forensic signatures than GAN outputs — particularly in the frequency domain near upsampling boundaries — and detectors trained on one family transfer poorly to the other.
VAE-decoder upsampling produces predictable spectral artifacts near image boundaries. Detectable via DCT or Fourier analysis on residual maps.
Detectors trained on GAN-family upsampling fingerprints frequently fail on diffusion-family outputs. See the cross-generator generalization gap below.
Three families of evidence: spectral, biosignal, semantic.
Frank et al. (ICML 2020) demonstrated that GAN-generated images carry severe artifacts in the frequency domain, caused by upsampling operations common to all current GAN architectures. The artifacts are consistent across networks, datasets, and resolutions.
Ciftci, Demir, Yin (IEEE TPAMI 2020) showed that real portrait videos contain photoplethysmographic signals — subtle skin-tone shifts from blood circulation — that are neither spatially nor temporally preserved in synthetic content. Reported accuracies in the paper: 96% on the original FaceForensics dataset (2018), 94.65% on FaceForensics++, 91.50% on Celeb-DF; degrades on compressed video.
Real cameras under portrait lighting produce strong agreement between corneal specular highlights of the two eyes. Inter-eye symmetry analysis gives a robust GAN-detection signal — extending Farid's classical forgery work into the synthetic-face era (Wang, Tondi, Barni, Frontiers in Signal Processing, 2022).
What the field actually trains and evaluates on.
1,000 source sequences manipulated with four pipelines (Deepfakes, Face2Face, FaceSwap, NeuralTextures). The de facto starting benchmark for face-manipulation detection.
Rössler et al., ICCV 2019 · arXiv:1901.08971
100,000+ face-swap clips sourced from 3,426 paid actors using several deepfake, GAN, and non-learned methods — released by Meta AI for the Kaggle DeepFake Detection Challenge.
Dolhansky et al., 2020 · arXiv:2006.07397 · dataset
Logical-access, physical-access, and (new in 2021) deepfake-speech tracks. Evaluation data uses lossy codecs typical of media storage; 54 teams submitted to the eval phase.
Yamagishi et al., 2021 · ISCA archive
A detector that works yesterday may not work tomorrow.
Wang et al. (CVPR 2020) gave the field its most-cited result on this axis: with careful pre-processing and augmentation, a classifier trained on outputs of one CNN generator (ProGAN) generalized surprisingly well to ten unseen architectures including StyleGAN2. But the generators have moved on. Detectors trained on GAN-family outputs frequently fail on diffusion-family outputs and vice versa, and accuracy drops further on compressed, recompressed, or screen-recorded media. Cross-generator generalization remains the discipline's central open problem.
If detection always trails generation, can we sign the output instead?
Fernandez et al. (ICCV 2023) fine-tune a latent-diffusion image generator conditioned on a binary signature. A pre-trained extractor recovers the hidden bits from any sample; a statistical test then decides whether the image was produced by that model. They report detection at 90%+ accuracy after cropping to 10% of the original content, at a false-positive rate below 10⁻⁶.
Fernandez et al., ICCV 2023 · arXiv:2303.15435
Google DeepMind's SynthID-Image is a post-hoc, model-independent encoder/decoder system that has been used to watermark over ten billion images and video frames across Google services. The technical paper documents the threat model, robustness goals, and deployment trade-offs for invisible watermarking at production scale.
Google DeepMind, 2025 · arXiv:2510.09263
Untrained eyes perform near chance.
Groh, Epstein, Firestone, and Picard ran two large online studies (n = 15,016) comparing ordinary observers, the leading computer-vision deepfake detector of the time, and "machine-informed crowds" that saw the model's prediction before judging. Humans and the model were similarly accurate, made different kinds of mistakes, and were most accurate when combined — but inaccurate model predictions actively decreased human accuracy, an alignment-cost finding worth sitting with.
Groh et al., PNAS 2022. doi:10.1073/pnas.2110013119
Twelve papers that anchor this page.
Each links to a publisher canonical PDF (arXiv preferred where available). All citations independently verified.
- 001Goodfellow, I. et al. (2014). Generative Adversarial Nets. NeurIPS.
- 002Rombach, R., Blattmann, A., Lorenz, D., Esser, P., Ommer, B. (2022). High-Resolution Image Synthesis with Latent Diffusion Models. CVPR.
- 003Rössler, A. et al. (2019). FaceForensics++: Learning to Detect Manipulated Facial Images. ICCV.
- 004Wang, S.-Y., Wang, O., Zhang, R., Owens, A., Efros, A. A. (2020). CNN-Generated Images Are Surprisingly Easy to Spot... for Now. CVPR.
- 005Frank, J. et al. (2020). Leveraging Frequency Analysis for Deep Fake Image Recognition. ICML.
- 006Dolhansky, B. et al. (2020). The DeepFake Detection Challenge (DFDC) Dataset. arXiv preprint.
- 007Yamagishi, J. et al. (2021). ASVspoof 2021: accelerating progress in spoofed and deepfake speech detection. ASVspoof Workshop.
- 008Ciftci, U. A., Demir, I., Yin, L. (2020). FakeCatcher: Detection of Synthetic Portrait Videos using Biological Signals. IEEE TPAMI.
- 009Groh, M., Epstein, Z., Firestone, C., Picard, R. (2022). Deepfake detection by human crowds, machines, and machine-informed crowds. PNAS.
- 010Fernandez, P., Couairon, G., Jégou, H., Douze, M., Furon, T. (2023). The Stable Signature: Rooting Watermarks in Latent Diffusion Models. ICCV.
- 011Google DeepMind (2025). SynthID-Image: Image watermarking at internet scale. arXiv preprint.
- 012Wang, J., Tondi, B., Barni, M. (2022). An Eyes-Based Siamese Neural Network for the Detection of GAN-Generated Face Images. Frontiers in Signal Processing.
Research-lab FAQ.
What is a GAN?
A Generative Adversarial Network is a pair of neural networks — a generator that produces candidate samples and a discriminator that judges them — trained against each other in a minimax game. Goodfellow et al. introduced the framework in 2014 (arXiv:1406.2661); it underpinned the first wave of high-fidelity face synthesis.
What is a latent diffusion model?
A diffusion model that operates in the compressed latent space of a pretrained autoencoder rather than in pixel space. Introduced by Rombach et al. at CVPR 2022 (arXiv:2112.10752), this is the architecture behind Stable Diffusion and most modern open-weight image generators.
Why do detectors fail on new generators?
Detectors trained on outputs from one generator overfit to that generator's specific spectral and structural artifacts. Applied to images from an unseen architecture, accuracy can drop sharply. This cross-generator generalization gap is the central open problem in synthetic-media forensics.
What is the cleanest forensic signal for GAN-generated images?
Frank et al. (ICML 2020, arXiv:2003.08685) showed that GAN images carry severe artifacts in the frequency domain caused by upsampling operations common to all current GAN architectures. Spectral-residual analysis remains a strong baseline, though robustness to compression and to diffusion-family generators is an active question.
Can humans tell deepfakes apart from real video?
Often barely. Groh et al. (PNAS 2022, doi:10.1073/pnas.2110013119) ran the largest study to date and found ordinary observers performed at roughly the level of leading detection models, with both making different kinds of mistakes. Crowds combined with model predictions outperformed either alone.
Is watermarking a solution?
It is a solution to a specific problem: identifying media produced by cooperating generators. It does not address adversarial uses of non-cooperating models, watermark removal attacks, or content that was never watermarked in the first place. Detection and provenance are complementary, not substitutes — see /provenance.