Why Do Deepfake Detectors Fail on New Media, and Can They Keep Up With New Generators?

What Is Deepfake Detection Generalization?

Generalization is the gap between how a detector performs on the data it was built with and how it performs on everything else. A model can score 99% on a test set drawn from the same generators, codecs and faces as its training data and still miss most fakes from a tool released last month.

Buyers care about generalization because the media they receive never matches a benchmark exactly. New generators appear every few months, platforms change their compression, customers use different phones, and attackers deliberately choose the tools a detector has not seen. A detector's real accuracy is its accuracy under those conditions.

Why Do Deepfake Detectors Fail on New Media?

Deepfake detectors fail on new media because they learn shortcuts. A classifier trained to separate real photos from one generator's output will latch on to whatever separates them most easily, such as a faint upsampling pattern or a colour quirk. Those cues belong to that generator, not to synthetic media in general, so a newer generator that does not leave them passes as real.

Ojha, Li and Lee described a second problem in their 2023 paper: in a standard real-versus-fake classifier, the real class becomes a sink for anything that does not look like the fakes it was trained on. A diffusion image that looks nothing like a GAN image falls into the real bucket by default.

Generators are only one source of shift. The table lists the others that most often break deployed detectors.

What Does Research Show About Generalization?

The record is mixed and moving. In 2020, Sheng-Yu Wang and colleagues found at CVPR that a classifier trained only on ProGAN images generalized surprisingly well to other CNN-based generators, including StyleGAN2, provided training used careful pre-processing and data augmentation. Their title added a warning: CNN-generated images were surprisingly easy to spot, for now.

The warning held. By 2023, Ojha and colleagues reported that classifiers trained on GAN images failed on diffusion and autoregressive models. Using nearest-neighbour and linear-probe classification on features from a large pretrained vision-language model, they improved on the prior state of the art for unseen diffusion and autoregressive generators by 15.07 points of mean average precision and 25.90 points of accuracy.

The starkest evidence comes from outside the lab. Deepfake-Eval-2024 collected 45 hours of video, 56.5 hours of audio and 1,975 images that circulated on 88 websites in 52 languages during 2024. Compared with earlier academic benchmarks, open-source detectors lost about 50% of their AUC on video, 48% on audio and 45% on images. Commercial detectors did better but, in the authors' assessment, did not yet match expert forensic analysts.

Are Deepfakes Getting Harder to Detect?

For people, yes. Visible flaws such as warped hands, mismatched earrings and flickering edges are rarer with each generation of tools, and studies of human judgment find accuracy near chance. In iProov's February 2025 study of 2,000 adults, only 0.1% identified every real and fake image and video correctly.

For machines, it depends on whether the detector keeps pace. Each new generator family resets part of the problem, and laundering through compression or screen recording removes traces. At the same time, detectors built on broad pretrained features and trained on many generators have shown much better transfer than the narrow classifiers of a few years ago. The honest summary is that detection is a maintenance task: a detector that is not updated gets worse every quarter.

Can Deepfake Detection Keep Up With New AI Generators?

Detection can keep up with new generators when it is engineered and evaluated for change. NIST's AI 100-4 report notes that detectors often perform best on content from the generators they were trained on but are expected to generalize to novel models, so evaluations are most informative when they include outputs of models not seen in training. In practice that means:

Ask vendors how often they retrain, how they test on held-out generators, and what happened to their accuracy the last time a major generator was released.

• Build on broad representations, such as large pretrained vision or audio models, rather than generator-specific artefacts.
• Train on many generator families and on degraded copies, and keep some generators entirely out of training to test transfer.
• Combine several independent signals so that a new generator has to defeat all of them.
• Monitor score distributions in production and sample flagged and unflagged cases for review, so drift is noticed before losses.
• Re-run a held-out test whenever a major new image, video or voice model is released.

How Neural Defend Addresses Generalization

Neural Defend's detection runs on ARCAS 1B, its proprietary foundation model. The ARCAS 1B paper evaluates the model across several benchmark families without benchmark-specific parameter updates and reports pooled accuracy in its Table 1 of 99.99% on GenImage, 99.92% on WildFake, 99.82% on AIGC-Detect, 99.09% on AIGIBench, 97.74% on Community Forensics and 97.65% on OpenFake. The authors state that these results describe the evaluated records and do not establish universal reliability or resistance to future adaptive attacks.

On the public VendorBench-100 benchmark, a corpus of 100 adversarial still images built from edge cases such as text-to-video stills and opaque-provenance images, Neural Defend ranked first of 36 systems with an MCC of 0.876 against 0.646 for the next vendor. One VendorBench author also co-wrote the ARCAS 1B paper; the corpus and results are public, and the benchmark does not cover video or audio.

In production, NeuroVerify applies six signals in one request, and NeuroDetect records the model and version behind every analysis, so a team can tell which model produced a past result when generators and models change.