Research map / Video / Video segmentation and tracking

Exposing and Mitigating Temporal Attack in Deepfake Video Detection

NeurIPS 2026 · Video › Video segmentation and tracking · approach: Deepfake video detection · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Shows spatiotemporal deepfake detectors rely on fragile temporal amplitude-spectrum shortcuts, and proposes SpInShield, which trains a VideoMAE V2 Siamese encoder against a learnable spectral adversary with spectral-blindness (GRL domain confusion) and symmetric KL invariance losses.

Problem

Spatiotemporal deepfake video detectors achieve high AUC but are vulnerable to evasion via perturbations of the temporal amplitude spectrum, which they overfit to as shortcuts.

Approach

A learnable generator synthesizes phase-preserving amplitude-spectrum deformations of facial temporal signals; a weight-shared Siamese VideoMAE V2 encoder is trained with adversarial domain confusion (GRL) on clean vs. perturbed features plus a symmetric KL prediction-consistency loss, so the detector discards amplitude shortcuts and keeps phase-based cues.

Key results

• Achieves 93.3% average cross-dataset AUC, versus 91.7% for the second-best (DFD-FCG) on the non-adversarial benchmark.
• Under four simulated amplitude spectral attacks, averages 89.35, 90.47, 88.47, and 87.43 AUC (random band mask, narrow-band notch, spectral tilt, SNR noise), claimed over 20 points above the strongest baselines.
• Under adaptive white-box attack, retains 66.01% average AUC versus 59.45% for the best baseline (DFD-FCG).

Surprising findings

• Plain VideoMAE(B) drops to near-random AUC (54.60%) under SNR-based noise, and phase-only inputs leave baselines at roughly 52-65% AUC.
• Naive Gaussian amplitude augmentation gives only a marginal OOD gain (57.83 to 63.22 average AUC), suggesting targeted learned perturbations matter.

Limitations

• Robustness is evaluated mainly against attacks the authors define themselves, and the adaptive white-box attack is only one form of evaluation.
• Adversarial results are reported on in-house-constructed attack sets with no released code or data.
• Reported results use a single training dataset (FF++ c23) and the paper omits details such as sample counts and compute.

Experimental setup

Datasets: FaceForensics++ (c23)

Benchmarks: FaceForensics++ (c23) Celeb-DF-v2 DeepFakeDetection DeeperForensics WildDeepFake DiffSwap (FFHQ) DaGAN (FFHQ)

Metrics: AUC

Baselines: FakeSTormer AltFreezing PTFD TALL SLF NACO AFW DFD-FCG FTCN VideoMAE(B)

Builds on: VideoMAE V2 gradient reversal layer maximum mean discrepancy AltFreezing

Closest papers by meaning

• Generalizing Deepfake Video Detection with Plug-and-Play: Video-Level Blending and Spatiotemporal Adapter Tuning (CVPR 2025 · similarity 0.84)
• Through the Lens: Benchmarking Deepfake Detectors Against Moiré-Induced Distortions (NeurIPS 2025 · similarity 0.83)
• Exposing the Deception: Uncovering More Forgery Clues for Deepfake Detection (AAAI 2024 · similarity 0.83)
• FreqDebias: Towards Generalizable Deepfake Detection via Consistency-Driven Frequency Debiasing (CVPR 2025 · similarity 0.82)
• Veritas: Generalizable Deepfake Detection via Pattern-Aware Reasoning (ICLR 2026 · similarity 0.82)
• FrameShield: Adversarially Robust Video Anomaly Detection (NeurIPS 2025 · similarity 0.82)