Conflict-Suppressed Deepfake Detection

• The paper introduces CS-DFD, a training framework that addresses gradient conflict by reconciling antagonistic updates from original and online synthesized forgeries.
• It employs two modules—Update Vector Search (UVS) and Conflict Gradient Reduction (CGR)—to align gradient directions and refine feature embeddings.
• Empirical results on datasets like FaceForensics++ and Celeb-DF demonstrate state-of-the-art performance, effectively breaking the '1+1<2' joint training anomaly.

Conflict-Suppressed Deepfake Detection (CS-DFD) is a training framework for generalizable deepfake detection that addresses a specific failure mode arising when detectors are trained jointly on original source-domain forgeries and online synthesized forgeries. In the formulation introduced in “Suppression Gradient Conflict for Generalizable Deepfake Detection,” the central claim is that this joint training can degrade either source-domain accuracy or target-domain generalization because the two fake data sources induce antagonistic gradients during backpropagation. CS-DFD therefore treats deepfake detection as a conflict-aware optimization problem and mitigates gradient interference through two coupled modules: Update Vector Search (UVS), which alters the parameter update direction, and Conflict Gradient Reduction (CGR), which regularizes the projection-layer feature space toward aligned gradients (Liu et al., 29 Jul 2025).

1. Definition and problem formulation

CS-DFD is defined for binary deepfake detection, where an image $x_i$ is classified as real $(y_i=0)$ or fake $(y_i=1)$ by a detector $f_\theta$. The baseline training objective is binary cross-entropy: $$\mathcal{L}_{\rm bce} = -\frac{1}{N}\sum_{i=1}^{N}\big[ y_i \log p_i + (1-y_i)\log(1-p_i)\big],$$ with $p_i$ denoting the predicted probability that $x_i$ is fake (Liu et al., 29 Jul 2025).

The framework distinguishes three training regimes. In the Original only regime, training uses real images $x_r$ and original fake images $x_f$, written as $X=[x_r,x_f]$; this setting gives excellent source-domain performance but poor generalization. In the Online only regime, original forgeries are replaced by online synthesized fake images $(y_i=0)$0, so training uses $(y_i=0)$1; this improves cross-domain generalization but weakens performance on the original manipulations because the detector never sees them. In the Original + Online regime, training uses $(y_i=0)$2, which might be expected to be best, yet empirically often performs worse than either of the first two regimes. This empirical anomaly is termed the “1+1<2” phenomenon (Liu et al., 29 Jul 2025).

The source-domain training set is thus partitioned into two streams. Stream 1 uses $(y_i=0)$3 with loss $(y_i=0)$4, and Stream 2 uses $(y_i=0)$5 with loss $(y_i=0)$6. The total loss is written as

$(y_i=0)$7

At training step $(y_i=0)$8, with parameters $(y_i=0)$9, vanilla gradient descent updates parameters via

$(y_i=1)$0

where $(y_i=1)$1, $(y_i=1)$2, and $(y_i=1)$3 (Liu et al., 29 Jul 2025).

The framework’s diagnosis is that the degradation under joint training is caused by gradient conflict or gradient interference. In the ideal case, a single update should decrease both $(y_i=1)$4 and $(y_i=1)$5. In practice, the update based on $(y_i=1)$6 can decrease one loss while increasing the other, producing antagonistic loss curves and oscillatory optimization behavior around a saddle region. The paper characterizes this as intra-task gradient conflict, because both losses belong to the same real/fake classification task but correspond to heterogeneous fake sources (Liu et al., 29 Jul 2025).

2. Optimization principle and training pipeline

CS-DFD is a training-time framework, not a new network architecture. It is applied to standard deepfake detectors, including EfficientNet as the main CNN backbone, Xception, and the vision transformers ViT-L and ViT-B. The detector backbone produces a feature $(y_i=1)$7, a projection layer $(y_i=1)$8 maps $(y_i=1)$9 to $f_\theta$0, and a classifier $f_\theta$1 maps $f_\theta$2 to logits (Liu et al., 29 Jul 2025).

The per-iteration pipeline consists of two minibatches, one sampled from $f_\theta$3 and one from $f_\theta$4. A forward pass computes

$f_\theta$5

The gradients $f_\theta$6 and $f_\theta$7 are then computed. UVS replaces the vanilla gradient $f_\theta$8 by an alternative update vector $f_\theta$9, while CGR computes an auxiliary gradient for the projection layer $$\mathcal{L}_{\rm bce} = -\frac{1}{N}\sum_{i=1}^{N}\big[ y_i \log p_i + (1-y_i)\log(1-p_i)\big],$$0. The resulting parameter updates are

$$\mathcal{L}_{\rm bce} = -\frac{1}{N}\sum_{i=1}^{N}\big[ y_i \log p_i + (1-y_i)\log(1-p_i)\big],$$1

UVS therefore operates on the global parameter update, whereas CGR acts specifically on the projection layer (Liu et al., 29 Jul 2025).

This division of labor is central to the framework. UVS addresses conflict at the level of the optimization step itself; CGR addresses conflict at the level of learned representation geometry. The paper states that the two are synergistic: UVS seeks a conflict-free update vector near the original gradient, and CGR enforces a low-conflict feature embedding space through a novel Conflict Descent Loss (Liu et al., 29 Jul 2025).

Implementation details reported for the main setup include batch size 16, single RTX 3090, face extraction with Dlib, image resizing to $$\mathcal{L}_{\rm bce} = -\frac{1}{N}\sum_{i=1}^{N}\big[ y_i \log p_i + (1-y_i)\log(1-p_i)\big],$$2, UVS radius factor $$\mathcal{L}_{\rm bce} = -\frac{1}{N}\sum_{i=1}^{N}\big[ y_i \log p_i + (1-y_i)\log(1-p_i)\big],$$3, and CGR variance scale $$\mathcal{L}_{\rm bce} = -\frac{1}{N}\sum_{i=1}^{N}\big[ y_i \log p_i + (1-y_i)\log(1-p_i)\big],$$4. The paper further notes that both $$\mathcal{L}_{\rm bce} = -\frac{1}{N}\sum_{i=1}^{N}\big[ y_i \log p_i + (1-y_i)\log(1-p_i)\big],$$5 and $$\mathcal{L}_{\rm bce} = -\frac{1}{N}\sum_{i=1}^{N}\big[ y_i \log p_i + (1-y_i)\log(1-p_i)\big],$$6 exhibit a sweet spot: values that are too small insufficiently suppress conflict, whereas values that are too large either move too far from the original gradient or over-smooth the embedding (Liu et al., 29 Jul 2025).

3. Update Vector Search (UVS)

UVS is designed to replace the naïve update direction $$\mathcal{L}_{\rm bce} = -\frac{1}{N}\sum_{i=1}^{N}\big[ y_i \log p_i + (1-y_i)\log(1-p_i)\big],$$7 with a conflict-free update vector $$\mathcal{L}_{\rm bce} = -\frac{1}{N}\sum_{i=1}^{N}\big[ y_i \log p_i + (1-y_i)\log(1-p_i)\big],$$8 that remains in a neighborhood of $$\mathcal{L}_{\rm bce} = -\frac{1}{N}\sum_{i=1}^{N}\big[ y_i \log p_i + (1-y_i)\log(1-p_i)\big],$$9 while maximizing simultaneous descent for both losses. For each loss $p_i$0, the descent rate is defined as

$p_i$1

Using a first-order Taylor expansion for small $p_i$2,

$p_i$3

so the descent rate is approximated by

$p_i$4

UVS therefore solves

$p_i$5

Equivalently, with an auxiliary variable $p_i$6,

$p_i$7

The constraint parameter $p_i$8 controls how far the modified update is allowed to deviate from the original gradient (Liu et al., 29 Jul 2025).

The Lagrangian is written as

$p_i$9

with $x_i$0, $x_i$1, and $x_i$2. Defining

$x_i$3

the problem yields stationary points

$x_i$4

Substitution gives the dual objective

$x_i$5

and the optimization becomes

$x_i$6

under the simplex constraints $x_i$7, $x_i$8 (Liu et al., 29 Jul 2025).

The paper uses a projected gradient method for $x_i$9: $x_r$0 where $x_r$1 denotes projection onto the simplex. Once $x_r$2 is found,

$x_r$3

This $x_r$4 is the unique update vector used in place of $x_r$5 (Liu et al., 29 Jul 2025).

The reported computational overhead is small. Computing gradient norms and inner products has complexity $x_r$6, the dual optimization is only two-dimensional, and the overall additional training time is reported as about 2% (Liu et al., 29 Jul 2025).

4. Conflict Gradient Reduction (CGR)

Where UVS addresses update conflict globally, CGR aims to make the feature space itself less conflict-prone. The framework introduces a lightweight projection layer

$x_r$7

with $x_r$8 implemented as several linear layers. The classifier then operates on $x_r$9. The authors state that only the projection layer is directly regularized by the conflict loss, which is intended to avoid harming discriminative power in the backbone (Liu et al., 29 Jul 2025).

Let $x_f$0 and $x_f$1 denote the gradients at the projection-layer parameters $x_f$2 induced by $x_f$3 and $x_f$4. After normalization,

$x_f$5

The Conflict Descent Loss is defined as

$x_f$6

Minimizing this loss encourages positive cosine similarity between the gradients generated by the original and online-forgery streams. Gradient alignment is therefore promoted explicitly in the projection-layer parameterization (Liu et al., 29 Jul 2025).

The total loss affecting $x_f$7 is

$x_f$8

with gradient

$x_f$9

The derivative of $X=[x_r,x_f]$0 contains Hessian terms: $X=[x_r,x_f]$1 where $X=[x_r,x_f]$2. Because full Hessians are expensive, the paper approximates them via the Fisher Information Matrix using gradient outer products. For a gradient vector $X=[x_r,x_f]$3,

$X=[x_r,x_f]$4

Applying this approximation yields

$X=[x_r,x_f]$5

Defining

$X=[x_r,x_f]$6

the projection-layer gradient becomes

$X=[x_r,x_f]$7

The paper interprets this as subtracting a term that becomes large where both gradients are strong but misaligned, thereby pushing the projection layer toward aligned directions (Liu et al., 29 Jul 2025).

A plausible implication is that CGR does not merely repair a single optimization step; it gradually reshapes the embedding space so that the raw gradients of the two streams become more compatible over time. That interpretation follows the paper’s distinction between UVS as step-wise conflict mitigation and CGR as representation-level conflict reduction (Liu et al., 29 Jul 2025).

5. Empirical performance and observed behavior

CS-DFD is trained on FaceForensics++ (FF++), which contains 1000 real videos and 5000 fake videos generated by Deepfakes (DF), FaceSwap (FS), Face2Face (F2F), FaceShifter (Fsh), and NeuralTextures (NT). Online synthesized forgeries $X=[x_r,x_f]$8 are generated during training using self-blending or blending-based methods. Evaluation is reported on FF++ test split, Celeb-DF, DFDC, DFDC preview (DFDCp), and UADFV. Faces are detected and cropped by Dlib and resized to $X=[x_r,x_f]$9. The evaluation metric is AUC (%) (Liu et al., 29 Jul 2025).

The main results reported for CS-DFD with EfficientNet are summarized below.

Dataset	AUC (%)	Setting
FF++	98.88	in-domain
Celeb-DF	95.32	cross-domain
DFDC	74.97	cross-domain
DFDCp	85.86	cross-domain
UADFV	95.92	cross-domain

The average over cross-domain datasets is 88.02. The paper states that CS-DFD achieves state-of-the-art performance in both in-domain detection accuracy and cross-domain generalization, and specifically that it breaks the “1+1<2” limit by making joint use of original and online forgeries outperform either source alone (Liu et al., 29 Jul 2025).

The backbone robustness study applies the framework to Xception, ViT-L, and ViT-B under four regimes: (O) for original-only, (S) for synthesized-only, (O+S) for naïve combination, and CS-DFD for combination with conflict suppression. For ViT-B, the reported results across FF++, Celeb-DF, DFDC, DFDCp, and UADFV are:

• ViT-B (O): 98.38, 89.63, 68.00, 80.04, 80.17
• ViT-B (S): 89.64, 93.54, 73.63, 84.87, 92.04
• ViT-B (O+S): 98.17, 91.28, 71.11, 82.68, 90.21
• ViT-B (CS-DFD): 98.44, 93.66, 76.92, 85.30, 94.85

Similar patterns are reported for Xception and ViT-L: naïve O+S is worse than O or S on at least some domains, whereas CS-DFD improves performance across domains (Liu et al., 29 Jul 2025).

The ablation study with EfficientNet shows the cumulative benefit of the two modules:

• Backbone only: FF++ 96.67, Celeb-DF 64.59, DFDC 65.43, DFDCp 80.27, UADFV 63.19
• +UVS only: 97.98, 94.45, 73.65, 84.73, 93.32
• +CGR only: 98.00, 94.92, 74.64, 84.44, 94.09
• UVS + CGR: 98.88, 95.32, 74.97, 85.86, 95.92

Both modules provide large gains independently, and the combination is सर्वोच्च in all reported conditions (Liu et al., 29 Jul 2025).

The qualitative analyses are consistent with the optimization diagnosis. The paper reports antagonistic loss trajectories under naïve joint training, more synchronized and smooth descent under CS-DFD, unstable and inconsistent attention maps for naïve O+S, and more stable, broad, semantically meaningful focus under CS-DFD. Quiver plots are also reported to show more consistent gradient directions across original and synthetic examples under the proposed framework (Liu et al., 29 Jul 2025).

6. Related conflict-oriented directions in deepfake detection

CS-DFD belongs to a broader family of methods that treat deepfake detection as a problem of suppressing destructive interactions between heterogeneous cues, domains, or objectives. Several adjacent works develop related mechanisms, though not under the same formal name.

Incremental domain conflict suppression is exemplified by “DFIL: Deepfake Incremental Learning by Exploiting Domain-invariant Forgery Clues,” which addresses continual adaptation to new deepfake datasets while preventing overfitting to sparse new data and catastrophic forgetting of previous domains. DFIL combines supervised contrastive learning for domain-invariant representation, feature-level and label-level distillation, and replay with central and hard samples, reporting an average forgetting rate of 7.01 and average accuracy of 85.49 on FF++, DFDC-P, DFD, and CDF2 (Pan et al., 2023). This suggests a conflict-suppression interpretation at the level of old-domain versus new-domain knowledge.

Quality-aware ambiguity management appears in “DeepFidelity: Perceptual Forgery Fidelity Assessment for Deepfake Detection,” which replaces strict binary labels with a continuous perceptual forgery fidelity score. Real faces are mapped into [0.6, 1.0] and fake faces into [0.0, 0.4], leaving an unused gap [0.4, 0.6] that functions as an ambiguity margin. The method reports 98.89 / 99.67 on FF++ (HQ), 88.34 / 92.33 on WildDeepfake, and 100 / 100 on Celeb-DF (v2) in terms of Acc / AUC (Peng et al., 2023). A plausible implication is that CS-DFD can be interpreted not only as gradient suppression but also as controlled handling of prediction-space conflict.

Identity-conflict modulation is the focus of “SELFI: Selective Fusion of Identity for Generalizable Deepfake Detection.” That work argues that identity is informative but context-dependent and proposes Forgery-Aware Identity Adapter (FAIA) plus Identity-Aware Fusion Module (IAFM), which fuses identity and visual features using a relevance-guided scalar $(y_i=0)$00. On FF++, CDFv2, DFD, DFDC, and DFDCP, SELFI reports 0.980, 0.839, 0.907, 0.796, and 0.840 AUC, with C-Avg. 0.846, outperforming prior methods by an average of 3.1% AUC and exceeding the previous best on DFDC by 6% (Kim et al., 21 Jun 2025). This is a cue-selection analogue of conflict suppression: identity is neither fully discarded nor uniformly trusted.

Semantic decoupling of conflicting clues is developed in “Decoupling Forgery Semantics for Generalizable Deepfake Detection,” which separates irrelevant content semantics $(y_i=0)$01, unique forgery semantics $(y_i=0)$02, and common forgery semantics $(y_i=0)$03, then performs inference using only $(y_i=0)$04. On FF++, Celeb-DF, DFD, and DFDC, the method reports AUCs of 98.58, 76.94, 83.02, and 62.55, respectively (Ye et al., 2024). This suggests a structural form of conflict suppression in which method-specific and content-specific cues are explicitly quarantined from the final detector.

Multimodal conflict balancing is formalized in “Multiscale Adaptive Conflict-Balancing Model For Multimedia Deepfake Detection,” which addresses both modality imbalance and gradient conflict between audio and video objectives. MACB-DF introduces contrastive cross-modal fusion and an Orthogonalization-Multimodal Pareto module, achieving 96.8 / 98.7 on DefakeAVMiT, 91.7 / 93.2 on FakeAVCeleb, 97.9 / 98.8 on DFDC, and 95.5 / 96.9 average ACC / AUC (Xiong et al., 19 May 2025). A plausible broader interpretation is that CS-DFD constitutes one instance of a more general conflict-aware learning paradigm spanning image, video, and audio-visual deepfake detection.

Fusion-based robustness against detector disagreement was explored earlier in “Adversarially robust deepfake media detection using fused convolutional neural network predictions,” which averages predictions from VGG16, InceptionV3, and XceptionNet. The fusion model achieves 96.5% accuracy on DFDC, 99% on lower quality DeepFake-TIMIT, and 91.88% on higher quality DeepFake-TIMIT, while the authors argue that ensemble fusion is more robust to adversarial attacks because compromise of one model does not determine the final decision (Khan et al., 2021). Although that method does not optimize gradients explicitly, it embodies a decision-level form of conflict suppression through model diversity and averaging.

Taken together, these lines of work indicate that “conflict suppression” in deepfake detection has acquired multiple technical meanings: suppressing antagonistic gradients during joint optimization, suppressing old–new domain interference in continual learning, suppressing ambiguity via calibrated score spaces, suppressing harmful identity cues through adaptive fusion, suppressing method-specific semantics through disentanglement, and suppressing modality imbalance in multimodal detection. Within that landscape, CS-DFD in the narrow sense refers specifically to the UVS+CGR framework for reconciling original and online synthesized forgeries during training (Liu et al., 29 Jul 2025).