FaceForensics++ 2019: six forgery detectors and 204 human observers on 1.8 million manipulated face images

The record is the first face-video entry in the studies index built on a dataset paper rather than a challenge, a year before DFDC 2020. No product sold under a card in this index is a tested method.

Research methods, not products, are the detectors here: five learned classifiers from the literature and one hand-crafted steganalysis feature set with a linear SVM, each retrained by the authors on the FaceForensics++ training split (arXiv 1901.08971, Section 4.2, read 10 November 2026).

Methods as named in Table 1 of arXiv 1901.08971.

None of the image or video cards in this index, Hive, Sensity, Reality Defender, Intel FakeCatcher, Deepware, AI or Not or Sightengine, is a tested method. Deepfake-O-Meter hosts a later research detector, AltFreezing, trained on the lightly compressed FaceForensics++ data, and the Intel card quotes a 92.48% gaze-model figure on FaceForensics++ from Intel's own blog; neither is a result printed in this paper.

The dataset holds 1,000 pristine YouTube videos with near-frontal faces, 509,914 frames, manipulated by two face-swap methods (DeepFakes, FaceSwap) and two reenactment methods (Face2Face, NeuralTextures), for over 1.8 million manipulated images; each video is stored raw, with light H.264 compression at quantisation parameter 23 (HQ) and heavy compression at 40 (LQ). Videos were split 720, 140 and 140 into training, validation and test, and every figure below is on the 140 test videos (arXiv 1901.08971, Sections 3 and 4 and Table 3, read 10 November 2026).

Counts as printed in arXiv 1901.08971, Tables 3 and 7 and Sections 4.1 and 5, read 10 November 2026.

Detection is cast as a per-frame binary classification on a 128 by 128 or 256 by 256 face crop found by a tracker, with XceptionNet trained for three epochs on its new output layer and 15 more end to end; the human study showed participants frames of all four methods and pristine frames across the three quality levels (arXiv 1901.08971, Sections 4.1 and 4.2 and Appendix D, read 10 November 2026).

Every figure below is printed in Table 1 or 2 of the paper or Tables 4 to 7 of the appendix.

Values as printed in arXiv 1901.08971, Tables 1, 2 and 4 to 7, Fig. 4 and Appendix C, read 10 November 2026; all accuracies are per frame.

Two findings carry beyond the headline. First, compression is the variable that matters: every method is above 95% on raw frames and the hand-crafted features at 97.63%, but at the LQ setting the steganalysis features fall to 55.98%, below the 58.73% of human observers, while XceptionNet keeps 81.00%, and the authors attribute the gap to ImageNet pre-training and network capacity (arXiv 1901.08971, Section 4.2 and Table 1, read 10 November 2026). Second, the hidden benchmark is harder than the test split: XceptionNet's total falls from 81.00% on LQ test frames to 70.10% on the 1,000 benchmark images, with precision on pristine images at 52.40%, which the authors trace to randomised quality levels and tracking errors (arXiv 1901.08971, Section 5 and Table 2, read 10 November 2026).

The reenactment methods were the hard cases for people. Human observers scored 32.28% on NeuralTextures frames at raw quality, below chance, and 49.60% on Face2Face, against 77.60% on DeepFakes, because the reenactments "do not introduce a strong semantic change"; the detectors also scored lowest on NeuralTextures at every quality level (arXiv 1901.08971, Section 4.1 and Tables 5 and 7, read 10 November 2026).

The authors state that the manipulation methods required near-frontal faces, so clips were manually screened to exclude occlusions and profiles; that the detectors were evaluated per frame rather than per video; that the benchmark accepts one submission every two weeks to limit overfitting; and that compressed and low-quality data need "a large database" to train on (arXiv 1901.08971, Sections 3, 4 and 5 and Fig. 8, read 10 November 2026).

Evident from the paper: the four manipulation methods are 2018 and 2019 tools that swap or reenact a face in real footage rather than generate video; the user study population is mostly computer science students; no false positive rate is printed as such, with pristine-class accuracy and precision standing in; and nothing identifies a commercial product.

No card takes a result line from this record, because no indexed product is a tested method. The record counts toward the video column of studies by modality as a record with zero indexed detectors, and the content type view lists the cards that state video. No figure enters the false positive rate ranking, which ranks cards. The home page lists which AI detectors exist and who has tested them.

Related records: DFDC 2020 is the challenge that followed, where the winning entry reached 65.18% (accuracy) on unseen footage; RAID image 2025 is the index's adversarial image benchmark, with two indexed cards scored.