Why Deepfake Detectors Fail: Four Failure Modes to Test For

A learned detector is trained on media produced by a particular set of generation methods. It learns to recognise those methods. When it meets output from a method absent from its training data, performance falls sharply — often to near chance.

This is not a defect that better training fixes permanently. Generation methods change faster than detectors can be retrained, so any learned detector is measured against a moving target and its published accuracy describes the past.

The test: ask what corpus the detector was trained on and evaluate it on material from a method not in that corpus. A vendor unable to answer the first question has told you something important.

This one is subtle and catches sophisticated teams. A detector's ranking ability — whether it scores fakes higher than real media — can survive a change in how inputs are prepared, while its actual probabilities shift dramatically.

Feed a face-crop classifier a tighter crop than it was trained on and the ordering may barely change while every score inflates. Ranking metrics look fine. The false-alarm rate at a fixed threshold can go from a few per cent to well over thirty.

The test: verify that the reported accuracy was measured through the exact preprocessing the system deploys, not through an idealised path. A validation figure that does not come from the deployed pipeline is not a validation figure.

Benchmark corpora consist of relatively clean media. Casework consists of files that have been re-encoded by several platforms, downscaled, screen-recorded, and forwarded repeatedly.

Each of those transformations removes evidence. Compression strips high-frequency content and suppresses sensor noise; downscaling destroys fine-scale structure; screen recording replaces the original capture entirely. Accuracy on this material is substantially lower than any benchmark figure, and the gap is widest on precisely the exhibits that matter most.

The test: evaluate on deliberately degraded material — re-encode the test set at realistic platform settings and measure again. Ask whether the system reports a quality assessment and lowers its own confidence accordingly, or whether it produces the same confident output regardless of input quality.

The most consequential failure, and the least discussed.

Most detection methods can only evidence manipulation. When such a method finds nothing, it has established that its particular artefact is absent — which is exactly what wholly generated media looks like, since nothing was composited or edited in the way that method looks for.

Systems that fuse detector outputs naively treat this silence as a vote for authenticity. Several such votes accumulate, and a genuinely synthetic exhibit is confidently cleared. The correct handling is asymmetric: methods of this kind may indicate manipulation, but must never assert authenticity, and a clean finding requires positive evidence of genuine capture.

The test: submit media you know to be wholly synthetic, of a type the system's artefact detectors would not fire on, and see whether it returns authentic or inconclusive. Returning authentic is disqualifying.

A procurement evaluation that surfaces these failures rather than confirming the sales figure: