AI & ML
Pulse or Provenance? What rPPG-Based Deepfake Detectors Learn
arXiv cs.CR0 views
arXiv:2611.13992v1 Announce Type: cross Abstract: Remote photoplethysmography (rPPG) has been proposed as a physiological cue for deepfake detection, based on the premise that synthesized faces lack a genuine cardiac signal. We examine what rPPG-style detectors learn on Celeb-DF++ (22 forgery methods) and FaceForensics++ (FF++), using one identically sampled window per real and fake video. On talking-face forgeries, simple chrominance traces reach an AUC of 0.998, exceeding a dedicated rPPG extractor (0.87). Controlled experiments indicate that this signal is not physiological in origin. On fully synthesized forgeries, it is equally discriminative when extracted from background regions or from full frames without face detection, and it is concentrated above the 0.7 to 4 Hz heart-rate band. It is largely removed by shuffling frame order but persists after normalizing resolution, frame rate and encoding, and an independent reimplementation reproduces these findings. Removing high-frequency content makes most synthesized videos appear real, adding it makes real videos appear fake, and injecting a synthetic pulse has little effect. In controlled self-reenactment experiments with two generators, animating a face from a single frame introduces the same high-frequency signal, whereas reconstructing each frame from its own source does not. Face-based chrominance detectors trained on Celeb-DF++ classify over 99% of real FF++ videos as fake, indicating that they largely encode video source rather than manipulation, and a CLIP-based detector exhibits the same behavior. A frozen CLIP backbone matches or exceeds fusions of CLIP with rPPG and frequency features. Finally, we show that the official Celeb-DF and Celeb-DF++ splits share identities and source-video content between training and test, and that custom protocols reusing test videos and identities in training inflate weaker detectors by up to 0.30 AUC.
Source:https://arxiv.org/abs/2611.13992PreviousNo finite rulebook can certify every safe program: an impossibility theorem for gatekeeping AI agentsNextSecure Information Flow in Quantum Programs
Related posts
SVP Is NP-Hard for Some Rank-2 Cyclotomic Modules
0arXiv cs.CR
Auditing Cross-Lingual Fairness in Language Model Watermarking
0arXiv cs.CR
Do Reasoning LLMs Refuse What They Infer in Long Contexts?
0arXiv cs.CR
Differential Privacy for Euclidean Jordan Algebra with Applications to Private Symmetric Cone Programming
0arXiv cs.CR
RoCoMark: Robust Code Watermarking Against LLM-Based Functionality-Preserving Rewriting Attacks
0arXiv cs.CR
Design and Evaluation of Secure Distributed Chaotic Image Encryption on ESP32-S3
0arXiv cs.CR