Image Deepfake Detection Architecture: How to Analyse Still Images for Manipulation

What are the stages of an image deepfake detection architecture?

A still image looks like the simplest input a detector can get, but the pipeline around it decides whether the model sees useful evidence. The design below separates intake, view construction, analysis and fusion so each can be tested and changed on its own.

Intake decodes the file, records its hash, format, dimensions and compression level, and reads any embedded provenance. View construction prepares the inputs each analyzer needs without overwriting the original. Analysis runs specialised models in parallel. Fusion combines their outputs with quality information into a unified score and a set of region-level findings, and the original plus every derived view is linked to the result for later review.

Why does preprocessing make or break image detection?

Generators leave statistical fingerprints, many of them in fine detail. Frank and colleagues showed in 2020 that GAN-generated images carry strong artefacts in the frequency domain that are consistent across architectures. Diffusion models leave different traces. Corvi and colleagues (2022) examined how detectors built for GAN images perform on diffusion-generated images, with particular attention to the compression and resizing that social networks apply.

The engineering consequence is simple. Do not downscale every upload to a fixed size before analysis, and do not re-encode to JPEG to save storage. Pass native-resolution views to analyzers that need detail, crop rather than resize where a model needs a fixed input, and record the compression level so a low-confidence result on a heavily recompressed file can be labelled as such rather than read as genuine.

Can detectors catch partially edited or inpainted images?

Often, if the architecture includes a localisation analyzer and the edit is large enough to leave traces. A whole-image classifier asks whether the picture as a whole came from a generator, and a mostly real photo with one inpainted region can score as real. Localisation models answer a different question: where in the image does the signal depart from what a camera would produce?

TruFor, published by Guillaro, Cozzolino and colleagues in 2022, is a well-known example. It combines the RGB image with a learned noise fingerprint trained only on real data, treats forgeries as deviations from that pattern, and outputs a pixel-level localisation map, a whole-image integrity score and a reliability map that marks where its own output is less trustworthy. That third output is valuable in production because it tells a reviewer when not to rely on the map.

Limits remain. Very small edits, edits followed by heavy recompression, and screenshots of edited images all weaken local traces. Changing a single digit on a receipt or removing a small object may leave too little signal. AI photo edits are one of the eight edge-case families in the VendorBench-100 corpus precisely because they are hard.

How do provenance and detection work together for images?

Content Credentials, defined in the C2PA Technical Specification, attach a signed manifest to a file that records how it was captured and edited and binds that record cryptographically to the content. When a valid manifest is present, the pipeline can show its history to reviewers and weight detection results accordingly.

Most images in fraud and moderation workflows carry no manifest, and metadata is easily stripped. Detection therefore remains the default for unlabelled content. A manifest that fails validation, or claims camera capture for an image with strong generative traces, is worth routing to review.

How should an image detection pipeline be tested?

Test with the transformations your channels actually apply. A detector that performs well on clean benchmark files can degrade badly on what users really send.

• Re-run labelled fakes and genuine images after JPEG recompression at several quality levels, resizing, cropping and screenshotting.
• Include partial edits and inpainting at different region sizes, not only fully generated images.
• Include images from generators released after the model's training data was collected.
• Check that every derived view links back to the original hash and that results are reproducible on re-analysis.

How Neural Defend analyses images

NeuroVerify runs six signals in one request, several of which map directly to the analyzers above: Face Manipulation Detection, AI Generative Model Analysis and AI Pixel-Level Manipulation, alongside Visual Safety Screening, Live Presence Verification and AI Content Compliance. It returns a unified risk score with signal-level evidence in under 200 ms p95 on eligible image requests under defined test conditions. NeuroDetect presents the same analysis for investigators, with the original image, explainability heatmaps and attention views down to individual regions.

On the public VendorBench-100 benchmark, 36 systems were tested on 100 adversarial still images covering face swaps, text-to-video stills, AI photo edits, avatar compositing, opaque-provenance images and compressed research frames. Neural Defend ranked first with an MCC of 0.876 and recall of 0.987; the next vendor scored an MCC of 0.646. The ARCAS 1B paper reports pooled accuracy of 99.99% on GenImage, 99.09% on AIGIBench and 97.65% on OpenFake.