Can Deepfakes Fool Deepfake Detectors? How Adversarial Evasion Works

Can Deepfakes Fool Deepfake Detectors?

Deepfakes can fool deepfake detectors, and researchers have measured how easily. In a 2020 paper, Nicholas Carlini and Hany Farid took a forensic classifier that reached an AUC of 0.95 at telling real images from synthetic ones and attacked it. Flipping the lowest bit of every pixel, a change invisible to people, pushed its AUC down to 0.0005. Perturbing just 1% of the image area brought it to 0.08, and adding a single noise pattern in the generator's latent space brought it to 0.17.

Those were white-box attacks, where the attacker can see inside the model. The same paper ran a black-box attack with no access to the target classifier and still reduced its AUC to 0.22. An AUC of 0.5 is a coin toss, so every one of those results left the detector worse than guessing.

Video detectors fare no better against a determined attacker. Shehzeen Hussain and colleagues, publishing at WACV 2021, adversarially modified deepfake videos so that neural network detectors classified them as real, in both white-box and black-box settings, and showed the perturbations survived video compression.

How Does Adversarial Evasion Work?

Adversarial evasion works by finding the changes that move a file across a detector's decision boundary while leaving it persuasive to a person. Attackers use four families of technique, and real attacks often combine them.

Perturbation attacks add carefully computed noise. With access to the model, the attacker follows its gradients; without access, they train a substitute model and rely on the noise transferring, or they query the real detector repeatedly and keep the changes that lower the score. Laundering attacks are cruder: they compress, resize, blur, re-encode or re-record a fake, deleting the fine traces many detectors rely on. Generator-side attacks train or fine-tune the generator with the detector in the loop, so its outputs are built to score as real. Pipeline attacks avoid the detector altogether, for example by injecting a stream through a virtual camera into a system that only checks liveness.

What separates evasion from ordinary degradation is intent. A news clip that loses detail after three rounds of messaging-app compression is a quality problem. A clip that was compressed at exactly the level that defeats a particular model, after dozens of test submissions, is an attack.

Why Are Deepfake Detectors Vulnerable in the First Place?

Detectors are vulnerable because most of them are neural networks that learned statistical shortcuts from training data, and small input changes can produce large output changes. A model that learned to spot the faint grid pattern left by one generator's upsampling layers has no defence when that pattern is removed, whether by an attacker or by a new generator that does not produce it.

This overlaps with the generalisation problem. On the Deepfake-Eval-2024 benchmark of media that circulated online in 2024, open-source detectors lost about 50% of their AUC on video, 48% on audio and 45% on images compared with earlier academic benchmarks. That loss came from ordinary distribution shift, not deliberate attack, and it shows how narrow the margin can be before an adversary starts working on it.

NIST's November 2024 report AI 100-4 recommends that detector evaluations include adversarial modifications and content specifically designed to fool detectors, alongside benign distortions such as compression. Few published benchmark results meet that standard.

How Do You Make Deepfake Detection Harder to Evade?

You make detection harder to evade by removing the conditions attacks depend on: a single model, unlimited queries, precise feedback and no other evidence. The following controls each address one of those conditions:

None of these makes evasion impossible. Together they raise its cost, shorten the window in which a working attack stays useful, and increase the chance that a successful fake is caught by a different control.

• Combine several independent signals, such as face manipulation, generative-model traces, pixel-level edits and presence, so an attacker has to suppress all of them at once.
• Return decisions or coarse risk bands to end users instead of raw scores, and rate-limit repeated submissions from the same account, device or network.
• Watch for strategic behaviour: many near-threshold attempts, unusual preprocessing, or sudden score shifts concentrated on one channel.
• Retrain and re-evaluate on new generators and on laundered, compressed and re-recorded media, and run red-team tests with adaptive attacks.
• Check capture integrity so injected streams are caught before they reach the detector, and compare results with provenance, source history and independent evidence.

What Can No Detector Promise?

No detector can promise to resist every future adaptive attack. An attacker who obtains a copy of a model, or unlimited query access, can usually find inputs that defeat it, and publishing detailed scores or heatmaps for every user gives them a map. Vendors who claim immunity to evasion are claiming something the research does not support.

Neural Defend's own ARCAS 1B paper is explicit about this: its authors write that the reported results describe performance on the evaluated records and do not establish universal reliability or resistance to future adaptive attacks. That is the right way to read any detector benchmark, including the ones that rank Neural Defend first.

How Neural Defend Approaches Evasion

Neural Defend's NeuroVerify runs six signals in one request, visual safety screening, live presence verification, face manipulation detection, AI generative model analysis, AI pixel-level manipulation and AI content compliance, and returns one risk score with signal-level evidence. Because the signals read different properties of the file, an evasive edit that hides one kind of trace still has to get past the others. Customers decide through policy what reaches end users, so raw scores need not be exposed to the people submitting media.

Deployment choices also matter. NeuroVerify can run in a private cloud, as a secure container, on-premises or air-gapped, which keeps the model away from outside probing. For files that look deliberately processed, NeuroDetect lets an analyst open a case and inspect explainability heatmaps and attention views down to regions, frames and audio segments, with model version recorded and a forensic report that states uncertainty.

On the public VendorBench-100 benchmark, whose 100 still images include face swaps, AI photo edits, opaque-provenance images and compressed research frames, Neural Defend ranked first of 36 systems with an MCC of 0.876 against 0.646 for the next vendor. One VendorBench author also co-wrote the ARCAS 1B paper, the corpus is public, and the benchmark does not test adaptive attacks, video or audio.