---
title: Conflict-Suppressed Deepfake Detection
url: https://www.emergentmind.com/topics/conflict-suppressed-deepfake-detection-cs-dfd
type: topic
---

# Conflict-Suppressed Deepfake Detection

Conflict-Suppressed Deepfake Detection (CS-DFD) is a training framework for generalizable deepfake detection that addresses a specific failure mode arising when detectors are trained jointly on original source-domain forgeries and online synthesized forgeries. In the formulation introduced in “Suppression Gradient Conflict for Generalizable Deepfake Detection,” the central claim is that this joint training can degrade either source-domain accuracy or target-domain generalization because the two fake data sources induce antagonistic gradients during backpropagation. CS-DFD therefore treats deepfake detection as a conflict-aware optimization problem and mitigates gradient interference through two coupled modules: Update Vector Search (UVS), which alters the parameter update direction, and Conflict Gradient Reduction (CGR), which regularizes the projection-layer feature space toward aligned gradients [2507.21530].

## 1. Definition and problem formulation

CS-DFD is defined for binary deepfake detection, where an image \(x_i\) is classified as real \((y_i=0)\) or fake \((y_i=1)\) by a detector \(f_\theta\). The baseline training objective is binary cross-entropy:
\[
\mathcal{L}_{\rm bce} = -\frac{1}{N}\sum_{i=1}^{N}\big[ y_i \log p_i + (1-y_i)\log(1-p_i)\big],
\]
with \(p_i\) denoting the predicted probability that \(x_i\) is fake [2507.21530].

The framework distinguishes three training regimes. In the **Original only** regime, training uses real images \(x_r\) and original fake images \(x_f\), written as \(X=[x_r,x_f]\); this setting gives excellent source-domain performance but poor generalization. In the **Online only** regime, original forgeries are replaced by online synthesized fake images \(x_s\), so training uses \(X'=[x_r,x_s]\); this improves cross-domain generalization but weakens performance on the original manipulations because the detector never sees them. In the **Original + Online** regime, training uses \(X''=[x_r,x_f,x_s]\), which might be expected to be best, yet empirically often performs worse than either of the first two regimes. This empirical anomaly is termed the **“1+1<2”** phenomenon [2507.21530].

The source-domain training set is thus partitioned into two streams. Stream 1 uses \(X=[x_r,x_f]\) with loss \(\mathcal{L}_1\), and Stream 2 uses \(X'=[x_r,x_s]\) with loss \(\mathcal{L}_2\). The total loss is written as
\[
\mathcal{L}_{\rm bce} = \mathcal{L}_1 + \mathcal{L}_2.
\]
At training step \(t\), with parameters \(\theta^t\), vanilla gradient descent updates parameters via
\[
\theta^{t+1} = \theta^t - \alpha g_0,
\]
where \(g_0=\nabla_\theta \mathcal{L}_{\rm bce}=g_1+g_2\), \(g_1=\nabla_\theta \mathcal{L}_1\), and \(g_2=\nabla_\theta \mathcal{L}_2\) [2507.21530].

The framework’s diagnosis is that the degradation under joint training is caused by **gradient conflict** or **gradient interference**. In the ideal case, a single update should decrease both \(\mathcal{L}_1\) and \(\mathcal{L}_2\). In practice, the update based on \(g_0\) can decrease one loss while increasing the other, producing antagonistic loss curves and oscillatory optimization behavior around a saddle region. The paper characterizes this as **intra-task** gradient conflict, because both losses belong to the same real/fake classification task but correspond to heterogeneous fake sources [2507.21530].

## 2. Optimization principle and training pipeline

CS-DFD is a **training-time framework, not a new network architecture**. It is applied to standard deepfake detectors, including **EfficientNet** as the main CNN backbone, **Xception**, and the vision transformers **ViT-L** and **ViT-B**. The detector backbone produces a feature \(\mathbf{f}\), a projection layer \(\varphi_{\theta_p}\) maps \(\mathbf{f}\) to \(\hat{\mathbf{f}}\), and a classifier \(\phi(\cdot)\) maps \(\hat{\mathbf{f}}\) to logits [2507.21530].

The per-iteration pipeline consists of two minibatches, one sampled from \([x_r,x_f]\) and one from \([x_r,x_s]\). A forward pass computes
\[
\mathbf{f}=f_\theta(x),\quad \hat{\mathbf{f}}=\varphi_{\theta_p}(\mathbf{f}),\quad \hat{y}=\phi(\hat{\mathbf{f}}).
\]
The gradients \(g_1=\nabla_\theta \mathcal{L}_1\) and \(g_2=\nabla_\theta \mathcal{L}_2\) are then computed. UVS replaces the vanilla gradient \(g_0=g_1+g_2\) by an alternative update vector \(v^*\), while CGR computes an auxiliary gradient for the projection layer \(\theta_p\). The resulting parameter updates are
\[
\theta^{t+1} = \theta^t - \alpha v^*,
\qquad
\theta_p^{t+1} = \theta_p^t - \alpha \nabla\mathcal{L}_{\theta_p}.
\]
UVS therefore operates on the global parameter update, whereas CGR acts specifically on the projection layer [2507.21530].

This division of labor is central to the framework. UVS addresses conflict at the level of the optimization step itself; CGR addresses conflict at the level of learned representation geometry. The paper states that the two are **synergistic**: UVS seeks a conflict-free update vector near the original gradient, and CGR enforces a low-conflict feature embedding space through a novel Conflict Descent Loss [2507.21530].

Implementation details reported for the main setup include **batch size 16**, **single RTX 3090**, face extraction with **Dlib**, image resizing to \(256\times256\), **UVS radius factor \(c=0.5\)**, and **CGR variance scale \(\tau=0.01\)**. The paper further notes that both \(c\) and \(\tau\) exhibit a sweet spot: values that are too small insufficiently suppress conflict, whereas values that are too large either move too far from the original gradient or over-smooth the embedding [2507.21530].

## 3. Update Vector Search (UVS)

UVS is designed to replace the naïve update direction \(g_0=g_1+g_2\) with a **conflict-free** update vector \(v\) that remains in a neighborhood of \(g_0\) while maximizing simultaneous descent for both losses. For each loss \(\mathcal{L}_j\), the descent rate is defined as
\[
\Delta_j = \frac{1}{\alpha}\left[\mathcal{L}_j(\theta)-\mathcal{L}_j(\theta-\alpha v)\right],\quad j\in\{1,2\}.
\]
Using a first-order Taylor expansion for small \(\alpha\),
\[
\mathcal{L}_j(\theta-\alpha v)\approx \mathcal{L}_j(\theta)-\alpha g_j^T v,
\]
so the descent rate is approximated by
\[
\Delta_j \approx g_j^T v.
\]
UVS therefore solves
\[
\max_{v\in\mathbb{R}^P}\min_{j\in\{1,2\}} g_j^T v
\quad\text{s.t.}\quad
\|v-g_0\|^2 \le c^2\|g_0\|^2.
\]
Equivalently, with an auxiliary variable \(k\),
\[
\begin{aligned}
\max_{v,k}\quad & k \\
\text{s.t.}\quad & g_j^T v \ge k,\quad j=1,2,\\
& \|v-g_0\|^2 \le c^2\|g_0\|^2.
\end{aligned}
\]
The constraint parameter \(c\) controls how far the modified update is allowed to deviate from the original gradient [2507.21530].

The Lagrangian is written as
\[
\psi(v,k,\lambda,\mu) = k - \lambda\big(\|v-g_0\|^2-c^2\|g_0\|^2\big) - \sum_{j=1}^2 \mu_j(k-g_j^T v),
\]
with \(\lambda\ge 0\), \(\mu_j\ge 0\), and \(\sum_{j=1}^2\mu_j=1\). Defining
\[
g_w = \sum_{j=1}^2 \mu_j g_j,
\]
the problem yields stationary points
\[
v^* = g_0 + \frac{g_w}{2\lambda},
\qquad
\lambda^* = \frac{\|g_w\|}{2c\|g_0\|}.
\]
Substitution gives the dual objective
\[
\psi(\mu)=g_w^T g_0 + c\|g_0\|\|g_w\|,
\]
and the optimization becomes
\[
\min_{\mu}\left(g_w^T g_0 + c\|g_0\|\|g_w\|\right),
\]
under the simplex constraints \(\mu_j\ge 0\), \(\sum_j\mu_j=1\) [2507.21530].

The paper uses a **projected gradient method** for \(\mu\):
\[
\mu^{t+1}\leftarrow \Pi_\Delta\left(\mu^t-\beta\nabla_{\mu^t}\psi\right),
\]
where \(\Pi_\Delta\) denotes projection onto the simplex. Once \(\mu^*\) is found,
\[
g_w^*=\sum_j \mu_j^* g_j,\quad
v^*=g_0+\frac{g_w^*}{2\lambda^*},\quad
\lambda^*=\frac{\|g_w^*\|}{2c\|g_0\|}.
\]
This \(v^*\) is the **unique update vector** used in place of \(g_0\) [2507.21530].

The reported computational overhead is small. Computing gradient norms and inner products has complexity \(\mathcal{O}(P)\), the dual optimization is only two-dimensional, and the overall additional training time is reported as **about 2%** [2507.21530].

## 4. Conflict Gradient Reduction (CGR)

Where UVS addresses update conflict globally, CGR aims to make the feature space itself less conflict-prone. The framework introduces a lightweight projection layer
\[
\hat{\mathbf{f}}=\varphi_{\theta_p}(\mathbf{f}),
\]
with \(\varphi_{\theta_p}\) implemented as several linear layers. The classifier then operates on \(\hat{\mathbf{f}}\). The authors state that only the projection layer is directly regularized by the conflict loss, which is intended to avoid harming discriminative power in the backbone [2507.21530].

Let \(g_1\) and \(g_2\) denote the gradients at the projection-layer parameters \(\theta_p\) induced by \(\mathcal{L}_1\) and \(\mathcal{L}_2\). After normalization,
\[
\mathbf{e}_1 = \frac{g_1}{\|g_1\|},
\qquad
\mathbf{e}_2 = \frac{g_2}{\|g_2\|}.
\]
The **Conflict Descent Loss** is defined as
\[
\mathcal{L}_\varphi = - \mathbf{e}_1^T \mathbf{e}_2
= - \frac{g_1^T g_2}{\|g_1\|\|g_2\|}.
\]
Minimizing this loss encourages positive cosine similarity between the gradients generated by the original and online-forgery streams. Gradient alignment is therefore promoted explicitly in the projection-layer parameterization [2507.21530].

The total loss affecting \(\theta_p\) is
\[
\mathcal{L}_{\theta_p} = \mathcal{L}_1 + \mathcal{L}_2 + \mathcal{L}_\varphi,
\]
with gradient
\[
\nabla \mathcal{L}_{\theta_p}
= g_{1,\theta_p} + g_{2,\theta_p} + \nabla_{\theta_p}\mathcal{L}_\varphi.
\]
The derivative of \(\mathcal{L}_\varphi\) contains Hessian terms:
\[
\nabla_{\theta_p} \mathcal{L}_\varphi
=
-\frac{H_{1,\theta_p}g_{2,\theta_p}+H_{2,\theta_p}g_{1,\theta_p}}
{\|g_{1,\theta_p}\|\|g_{2,\theta_p}\|},
\]
where \(H_{j,\theta_p}=\nabla_{\theta_p}^2\mathcal{L}_j\). Because full Hessians are expensive, the paper approximates them via the Fisher Information Matrix using gradient outer products. For a gradient vector \(g\),
\[
H \approx \tau\,\mathrm{Diag}(G) = \tau\, g\otimes g.
\]
Applying this approximation yields
\[
H_{1,\theta_p}\approx \tau\,g_{1,\theta_p}\otimes g_{1,\theta_p},
\qquad
H_{2,\theta_p}\approx \tau\,g_{2,\theta_p}\otimes g_{2,\theta_p}.
\]
Defining
\[
\gamma=\frac{\tau}{\|g_{1,\theta_p}\|\|g_{2,\theta_p}\|},
\]
the projection-layer gradient becomes
\[
\nabla \mathcal{L}_{\theta_p}
=
g_{1,\theta_p}+g_{2,\theta_p}
-
\gamma\Big(
g_{1,\theta_p}\otimes g_{1,\theta_p}\otimes g_{2,\theta_p}
+
g_{2,\theta_p}\otimes g_{2,\theta_p}\otimes g_{1,\theta_p}
\Big).
\]
The paper interprets this as subtracting a term that becomes large where both gradients are strong but misaligned, thereby pushing the projection layer toward aligned directions [2507.21530].

A plausible implication is that CGR does not merely repair a single optimization step; it gradually reshapes the embedding space so that the raw gradients of the two streams become more compatible over time. That interpretation follows the paper’s distinction between UVS as step-wise conflict mitigation and CGR as representation-level conflict reduction [2507.21530].

## 5. Empirical performance and observed behavior

CS-DFD is trained on **FaceForensics++ (FF++)**, which contains **1000 real videos** and **5000 fake videos** generated by **Deepfakes (DF), FaceSwap (FS), Face2Face (F2F), FaceShifter (Fsh), and NeuralTextures (NT)**. Online synthesized forgeries \(x_s\) are generated during training using self-blending or blending-based methods. Evaluation is reported on **FF++ test split**, **Celeb-DF**, **DFDC**, **DFDC preview (DFDCp)**, and **UADFV**. Faces are detected and cropped by **Dlib** and resized to \(256\times256\). The evaluation metric is **AUC (%)** [2507.21530].

The main results reported for CS-DFD with EfficientNet are summarized below.

| Dataset | AUC (%) | Setting |
|---|---:|---|
| FF++ | 98.88 | in-domain |
| Celeb-DF | 95.32 | cross-domain |
| DFDC | 74.97 | cross-domain |
| DFDCp | 85.86 | cross-domain |
| UADFV | 95.92 | cross-domain |

The average over cross-domain datasets is **88.02**. The paper states that CS-DFD achieves state-of-the-art performance in both in-domain detection accuracy and cross-domain generalization, and specifically that it **breaks the “1+1<2” limit** by making joint use of original and online forgeries outperform either source alone [2507.21530].

The backbone robustness study applies the framework to **Xception**, **ViT-L**, and **ViT-B** under four regimes: **(O)** for original-only, **(S)** for synthesized-only, **(O+S)** for naïve combination, and **CS-DFD** for combination with conflict suppression. For **ViT-B**, the reported results across **FF++**, **Celeb-DF**, **DFDC**, **DFDCp**, and **UADFV** are:

- **ViT-B (O)**: 98.38, 89.63, 68.00, 80.04, 80.17  
- **ViT-B (S)**: 89.64, 93.54, 73.63, 84.87, 92.04  
- **ViT-B (O+S)**: 98.17, 91.28, 71.11, 82.68, 90.21  
- **ViT-B (CS-DFD)**: 98.44, 93.66, 76.92, 85.30, 94.85  

Similar patterns are reported for Xception and ViT-L: naïve **O+S** is worse than **O** or **S** on at least some domains, whereas CS-DFD improves performance across domains [2507.21530].

The ablation study with EfficientNet shows the cumulative benefit of the two modules:

- **Backbone only**: FF++ 96.67, Celeb-DF 64.59, DFDC 65.43, DFDCp 80.27, UADFV 63.19  
- **+UVS only**: 97.98, 94.45, 73.65, 84.73, 93.32  
- **+CGR only**: 98.00, 94.92, 74.64, 84.44, 94.09  
- **UVS + CGR**: 98.88, 95.32, 74.97, 85.86, 95.92  

Both modules provide large gains independently, and the combination is सर्वोच्च in all reported conditions [2507.21530].

The qualitative analyses are consistent with the optimization diagnosis. The paper reports antagonistic loss trajectories under naïve joint training, more synchronized and smooth descent under CS-DFD, unstable and inconsistent attention maps for naïve **O+S**, and more stable, broad, semantically meaningful focus under CS-DFD. Quiver plots are also reported to show more consistent gradient directions across original and synthetic examples under the proposed framework [2507.21530].

## 6. Related conflict-oriented directions in deepfake detection

CS-DFD belongs to a broader family of methods that treat deepfake detection as a problem of suppressing destructive interactions between heterogeneous cues, domains, or objectives. Several adjacent works develop related mechanisms, though not under the same formal name.

**Incremental domain conflict suppression** is exemplified by “DFIL: Deepfake Incremental Learning by Exploiting Domain-invariant Forgery Clues,” which addresses continual adaptation to new deepfake datasets while preventing overfitting to sparse new data and catastrophic forgetting of previous domains. DFIL combines supervised contrastive learning for domain-invariant representation, feature-level and label-level distillation, and replay with central and hard samples, reporting an **average forgetting rate of 7.01** and **average accuracy of 85.49** on **FF++**, **DFDC-P**, **DFD**, and **CDF2** [2309.09526]. This suggests a conflict-suppression interpretation at the level of old-domain versus new-domain knowledge.

**Quality-aware ambiguity management** appears in “DeepFidelity: Perceptual Forgery Fidelity Assessment for Deepfake Detection,” which replaces strict binary labels with a continuous **perceptual forgery fidelity** score. Real faces are mapped into **[0.6, 1.0]** and fake faces into **[0.0, 0.4]**, leaving an unused gap **[0.4, 0.6]** that functions as an ambiguity margin. The method reports **98.89 / 99.67** on **FF++ (HQ)**, **88.34 / 92.33** on **WildDeepfake**, and **100 / 100** on **Celeb-DF (v2)** in terms of **Acc / AUC** [2312.04961]. A plausible implication is that CS-DFD can be interpreted not only as gradient suppression but also as controlled handling of prediction-space conflict.

**Identity-conflict modulation** is the focus of “SELFI: Selective Fusion of Identity for Generalizable Deepfake Detection.” That work argues that identity is informative but context-dependent and proposes **Forgery-Aware Identity Adapter (FAIA)** plus **Identity-Aware Fusion Module (IAFM)**, which fuses identity and visual features using a relevance-guided scalar \(\rho\). On **FF++**, **CDFv2**, **DFD**, **DFDC**, and **DFDCP**, SELFI reports **0.980**, **0.839**, **0.907**, **0.796**, and **0.840** AUC, with **C-Avg. 0.846**, outperforming prior methods by an average of **3.1% AUC** and exceeding the previous best on **DFDC** by **6%** [2506.17592]. This is a cue-selection analogue of conflict suppression: identity is neither fully discarded nor uniformly trusted.

**Semantic decoupling of conflicting clues** is developed in “Decoupling Forgery Semantics for Generalizable Deepfake Detection,” which separates **irrelevant content semantics** \(C\), **unique forgery semantics** \(Fu\), and **common forgery semantics** \(Fc\), then performs inference using only \(Fc\). On **FF++**, **Celeb-DF**, **DFD**, and **DFDC**, the method reports AUCs of **98.58**, **76.94**, **83.02**, and **62.55**, respectively [2406.09739]. This suggests a structural form of conflict suppression in which method-specific and content-specific cues are explicitly quarantined from the final detector.

**Multimodal conflict balancing** is formalized in “Multiscale Adaptive Conflict-Balancing Model For Multimedia Deepfake Detection,” which addresses both modality imbalance and gradient conflict between audio and video objectives. MACB-DF introduces contrastive cross-modal fusion and an **Orthogonalization-Multimodal Pareto** module, achieving **96.8 / 98.7** on **DefakeAVMiT**, **91.7 / 93.2** on **FakeAVCeleb**, **97.9 / 98.8** on **DFDC**, and **95.5 / 96.9** average **ACC / AUC** [2505.12966]. A plausible broader interpretation is that CS-DFD constitutes one instance of a more general conflict-aware learning paradigm spanning image, video, and audio-visual deepfake detection.

**Fusion-based robustness against detector disagreement** was explored earlier in “Adversarially robust deepfake media detection using fused convolutional neural network predictions,” which averages predictions from **VGG16**, **InceptionV3**, and **XceptionNet**. The fusion model achieves **96.5% accuracy** on **DFDC**, **99%** on **lower quality DeepFake-TIMIT**, and **91.88%** on **higher quality DeepFake-TIMIT**, while the authors argue that ensemble fusion is more robust to adversarial attacks because compromise of one model does not determine the final decision [2102.05950]. Although that method does not optimize gradients explicitly, it embodies a decision-level form of conflict suppression through model diversity and averaging.

Taken together, these lines of work indicate that “conflict suppression” in deepfake detection has acquired multiple technical meanings: suppressing antagonistic gradients during joint optimization, suppressing old–new domain interference in continual learning, suppressing ambiguity via calibrated score spaces, suppressing harmful identity cues through adaptive fusion, suppressing method-specific semantics through disentanglement, and suppressing modality imbalance in multimodal detection. Within that landscape, CS-DFD in the narrow sense refers specifically to the UVS+CGR framework for reconciling original and online synthesized forgeries during training [2507.21530].

Source: https://www.emergentmind.com/topics/conflict-suppressed-deepfake-detection-cs-dfd