Robust and Calibrated Detection of Authentic Multimedia Content

Generative models can synthesize highly realistic content, so-called deepfakes, that are already being misused at scale to undermine digital media authenticity. Current deepfake detection methods are unreliable for two reasons: (i) distinguishing inauthentic content post-hoc is often impossible (e.g., with memorized samples), leading to an unbounded false positive rate (FPR); and (ii) detection lacks robustness, as adversaries can adapt to known detectors with near-perfect accuracy using minimal computational resources. To address these limitations, we propose a resynthesis framework to determine if a sample is authentic or if its authenticity can be plausibly denied. We make two key contributions focusing on the high-precision, low-recall setting against efficient (i.e., compute-restricted) adversaries. First, we demonstrate that our calibrated resynthesis method is the most reliable approach for verifying authentic samples while maintaining controllable, low FPRs. Second, we show that our method achieves adversarial robustness against efficient adversaries, whereas prior methods are easily evaded under identical compute budgets. Our approach supports multiple modalities and leverages state-of-the-art inversion techniques.

💡 Research Summary

The paper tackles two fundamental shortcomings of current deep‑fake detection: (i) post‑hoc verification often fails, leading to unbounded false‑positive rates, and (ii) adversaries can evade detectors with minimal computation. To overcome these issues, the authors propose a calibrated “authenticity index” (A‑index) based on the ability of state‑of‑the‑art generative models—particularly diffusion models—to resynthesize a given sample. The central premise is that if a modern generator can faithfully reproduce an image, its authenticity cannot be confidently asserted; such content is labeled “plausibly deniable.” Conversely, images that resist accurate resynthesis are deemed “authentic” with a controllable, low false‑positive rate.

Technically, the method relies on reconstruction‑free inversion (RF‑Inversion), which maps an input image to a latent code of a diffusion model using a shallow encoder and feature‑space matching (e.g., Fourier magnitude, wavelet coefficients). This avoids costly pixel‑level optimization and enables large‑scale screening. Once an inverted latent is obtained, the original image and its regenerated counterpart are compared using four complementary similarity metrics: PSNR (pixel fidelity), SSIM (structural fidelity), LPIPS (perceptual distance, inverted as 1‑LPIPS), and CLIP cosine similarity (semantic consistency). These scores are linearly combined with learned weights α₁…α₄, then passed through a sigmoid scaling to produce a scalar A‑index in