Deepfake-Eval-2024 Benchmark

• Deepfake-Eval-2024 is a benchmark that evaluates deepfake detectors on real-world, user-sourced media, exposing a significant generalization gap from legacy datasets.
• It combines video, audio, and images from 88 sources and 52 languages, employing a forensic annotation pipeline to capture modern deepfake challenges.
• Baseline models see a performance drop of 45-50% off-the-shelf, while fine-tuning improves accuracy, underscoring the robustness issues in current detection systems.

Deepfake-Eval-2024 is a multi-modal in-the-wild benchmark introduced to evaluate deepfake detection on media actually circulated in 2024 rather than on older academic corpora. It was designed around the claim that commonly used datasets such as FaceForensics++, Celeb-DF, DFDC, and ASVspoof-based corpora are no longer representative of contemporary threats, because they are dominated by older manipulation methods, cleaner source material, narrower language coverage, and more constrained media formats than the deepfakes encountered on social platforms and in user submissions during 2024 (Chandra et al., 4 Mar 2025).

1. Motivation and benchmark scope

Deepfake-Eval-2024 was proposed as a response to a generalization gap: detectors that report very high accuracy on academic benchmarks can fail on contemporary, real-world media. The benchmark is explicitly framed as an “in-the-wild” collection of current deepfakes gathered from real user encounters rather than a synthetic test set assembled in the laboratory. Its stated aim is to cover video, audio, and image content, including media collected from social platforms and from users of a public deepfake detection service, with diversity in websites, languages, and media styles (Chandra et al., 4 Mar 2025).

A central feature of the benchmark is modality breadth. The benchmark paper describes it as the first in-the-wild benchmark spanning video, audio, and images. The dataset contains content from 88 different website or domain names and spans 52 languages overall; 78.7% of the full dataset is English, while the remainder is multilingual. The audio portion covers 42 languages, the video portion 49 languages, and the combined benchmark 52 languages. This design directly addresses a limitation of earlier deepfake datasets, which were often English-centric and face-centered, and frequently relied on short, centered, front-facing, single-person clips (Chandra et al., 4 Mar 2025).

The benchmark is relatively compact in absolute size when compared with synthetic mega-datasets, but it is intentionally biased toward difficult examples. The collection pipeline relied on items that users flagged because they suspected the media might be AI-manipulated. This means the benchmark over-represents ambiguous, high-stakes, or forensic-interest cases rather than easy negatives and obvious fakes. That choice is central to its role as an evaluation benchmark rather than a mass pretraining corpus (Chandra et al., 4 Mar 2025).

2. Dataset composition and collection pipeline

The benchmark includes video, audio, and image media, with most video items paired with aligned labeled audio. The detailed modality counts reported in the benchmark paper are as follows (Chandra et al., 4 Mar 2025).

Modality	Real / Fake counts	Scale
Video	1,072 / 964	45.1 hours total
Audio	1,110 / 710	56.5 hours total
Images	1,208 / 767	1,975 images

The collection process is what makes Deepfake-Eval-2024 “in the wild.” Media came from users of TrueMedia.org, a free deepfake detection platform first used by journalists and fact-checkers and later opened to the public. Users submitted social-media links or directly uploaded suspicious content. The authors also built a bot on X so users could tag media for review, and they imported some X posts flagged by Community Notes as potentially manipulated. The top sources were X, direct upload, TikTok, Instagram, and YouTube (Chandra et al., 4 Mar 2025).

Data filtering was conservative. Duplicates were removed using manual review and hash-based methods, although minor variations such as different crops of the same video could still be retained if they were meaningfully distinct. Cartoons, art, and scenes without humans were excluded because the benchmark targeted photorealistic, face-centric detection. For images, GPT-4o was used to identify non-photorealistic faces, and all GPT-marked negatives were manually reviewed. For videos, dlib face detection was used to find frames containing faces, and videos with no detected faces were manually checked (Chandra et al., 4 Mar 2025).

The benchmark paper notes a small reporting discrepancy in video duration: the abstract gives 44–45 hours, while the main table reports 45.1 hours. The intended scale is therefore the mid-40-hour range for video and 56.5 hours for audio (Chandra et al., 4 Mar 2025).

3. Annotation protocol, label semantics, and curation philosophy

Deepfake-Eval-2024 used a forensic annotation workflow rather than a purely synthetic ground-truth pipeline. Seven annotators participated: three experienced AI-generated-content labelers and four machine-learning interns. Their workflow included reverse image search, web search, verification of source trustworthiness, and inspection of the media itself for forensic cues. Professional fact-checking sources such as Snopes and AFP Fact Check were heavily used, and X Community Notes helped identify primary sources. The annotation scheme used three labels—“fake,” “real,” and “unknown”—with unknown items excluded from the released benchmark (Chandra et al., 4 Mar 2025).

The semantics of “fake” were modality-specific. For images and video, media could be labeled fake if it showed AI artifacts such as stylistic artifacts, anatomical implausibilities, sociocultural implausibilities, or functional implausibilities. Face-swaps and face morphs created in 2023 or later were labeled fake, while pre-2023 face-swaps were often treated as unknown unless stronger evidence existed. For video, lip-sync mismatch counted as an important cue, but only when paired with evidence from the original source. For audio, the authors were notably cautious: when direct sourcing was unavailable, they required both audible indicators and corroboration from at least two commercial audio detectors before labeling the sample fake (Chandra et al., 4 Mar 2025).

Quality control was explicitly reported. A team lead checked random 10% samples of each modality. Inter-rater disagreement was 6.6% for video, 7.9% for audio, and 9% for images, all under 10%. Disagreement on the real-versus-fake distinction was below 2.5% in all cases. The paper argues from these numbers that a competent detector should, in principle, be able to reach at least 90% accuracy if the benchmark were easy. The reported detector results show the opposite, which is part of the benchmark’s central claim (Chandra et al., 4 Mar 2025).

A common point of confusion is whether the audio labels are entirely independent of detector outputs. They are not. The benchmark paper explicitly acknowledges that the conservative audio-labeling rule may make the audio set somewhat more correlated with commercial detector behavior than the image or video sets. This is a limitation of the benchmark, but it is described openly rather than treated as hidden noise (Chandra et al., 4 Mar 2025).

4. Evaluation protocol and baseline findings

The benchmark paper evaluates three groups of systems: open-source detectors, commercial detectors, and open-source detectors fine-tuned on Deepfake-Eval-2024 itself. The representative open-source models are GenConViT, FTCN, and Styleflow for video; AASIST, RawNet2, and P3 for audio; and UFD, DistilDIRE, and NPR for images. The principal reported metrics are AUC, accuracy, precision, recall, and F1, with EER reported for audio in the supplement (Chandra et al., 4 Mar 2025).

The headline result is a sharp performance collapse for off-the-shelf open-source models when transferred from older academic datasets to Deepfake-Eval-2024. Average AUC decreases relative to prior benchmarks are reported as 50% for video, 48% for audio, and 45% for image models. The off-the-shelf AUCs on Deepfake-Eval-2024 are low enough to make the point concrete: GenConViT 0.63, FTCN 0.50, and Styleflow 0.51 for video; AASIST 0.43, RawNet2 0.53, and P3 0.58 for audio; and UFD 0.56, DistilDIRE 0.52, and NPR 0.53 for images (Chandra et al., 4 Mar 2025).

Commercial systems perform better but do not close the gap to the authors’ human-forensic reference point. The best reported commercial results are 0.78 accuracy and 0.79 AUC for video, 0.89 accuracy and 0.93 AUC for audio, and 0.82 accuracy and 0.90 AUC for images. No commercial model reaches 90% accuracy, which the benchmark paper treats as a rough lower bound for human forensic analysts based on inter-labeler agreement (Chandra et al., 4 Mar 2025).

Fine-tuning on Deepfake-Eval-2024 substantially improves performance, which indicates that the benchmark is learnable but distribution-shifted. The paper fine-tunes open-source models on 60% of the benchmark and evaluates on the remaining 40%. Average AUC improves by 57.6% for video, 80.6% for audio, and 15.6% for images. The best fine-tuned results are GenConViT with 0.82 AUC and 0.75 accuracy for video, P3 with 0.92 AUC and 0.86 accuracy for audio, and NPR with 0.73 AUC and 0.69 accuracy for images (Chandra et al., 4 Mar 2025).

The image track later became a focal point for baseline re-evaluation. “Revisiting Simple Baselines for In-The-Wild Deepfake Detection” reports that a tuned version of the simple pretrained-backbone baseline associated with Ojha et al. can reach 81% test accuracy on Deepfake-Eval-2024, close to the 82% reported for the leading commercial detector on that benchmark. The paper attributes the gain to full-network fine-tuning, CLIP-pretrained backbones, low learning rates, cosine annealing, and moderate regularization rather than to a bespoke forensic architecture (Castaneda et al., 4 Sep 2025).

5. Error patterns, robustness failures, and deployment relevance

Deepfake-Eval-2024 is informative not only because performance drops, but because the benchmark reveals which media properties break existing detectors. In video, diffusion-generated clips are especially difficult: GenConViT and FTCN perform about 21.3% worse on diffusion-like videos in off-the-shelf mode, though this gap shrinks to 5.4% after fine-tuning. Models also struggle with selective face manipulation, where only some faces are fake, and with non-facial manipulations involving altered objects, locations, or body parts. These cases challenge the implicit assumption that the entire clip is fake and that the manipulation is face-centered (Chandra et al., 4 Mar 2025).

In audio, performance degrades on non-English speech, silence, background noise, and especially music. The benchmark paper reports that background music causes a 17.94% accuracy drop and a 26.12% increase in false negatives for fine-tuned models. That result is important because many real social-media clips include music beds, ambient sound, or edited soundtrack layers that are absent from cleaner academic corpora (Chandra et al., 4 Mar 2025).

In images, text overlays reduce accuracy by about 9% and F1 by about 10.5%, although the authors note weaker statistical significance because of floor effects and small subset sizes. More generally, the paper emphasizes that some model failures cannot be explained by obvious visible traits. This suggests that a substantial portion of detector behavior depends on latent statistical cues or on spurious correlations that do not align cleanly with human forensic inspection (Chandra et al., 4 Mar 2025).

A related deployment-oriented study reinforces the same conclusion on a different evaluation setup. “Evaluating Deepfake Detectors in the Wild” constructs a dataset of more than 500,000 high-quality deepfake images using modern face-swapping pipelines and finds that fewer than half of tested detector–dataset combinations achieve ROC-AUC above 60%, with the lowest reported ROC-AUC at 50%. It also shows that JPEG compression, downscaling, and enhancement can sharply reduce performance, sometimes pushing detectors below 50% AUC. This does not define Deepfake-Eval-2024 itself, but it independently supports the benchmark’s broader claim that benchmark-era accuracy does not translate directly into deployment robustness (Pirogov et al., 29 Jul 2025).

6. Subsequent methods and the benchmark’s broader significance

Deepfake-Eval-2024 quickly became a target benchmark for method development, especially in audio deepfake detection. “Post-training for Deepfake Speech Detection” introduces AntiDeepfake post-trained SSL models and reports that, after fine-tuning on Deepfake-Eval-2024, XLS-R-1B achieves 8.29% EER at 50 seconds; the same paper treats Deepfake-Eval-2024 as a particularly difficult in-the-wild multilingual testbed (Ge et al., 26 Jun 2025). “WaveSP-Net” proposes learnable wavelet-domain sparse prompt tuning with a frozen XLSR backbone and reports 10.58% EER, 89.42% accuracy, 86.35% F1, and 94.26% AUC on Deepfake-Eval-2024 (Xuan et al., 6 Oct 2025). “Frustratingly Easy Zero-Day Audio DeepFake Detection via Retrieval Augmentation and Profile Matching” evaluates a training-free retrieval framework on Deepfake-Eval-2024 and reports, for example, 7.62% EER for its Hybrid + MV system at 4 seconds and 11.42% EER with 87.13 accuracy for Hybrid + Ratio at 30 seconds (Liu et al., 26 Sep 2025). “WST-X Series” uses wavelet scattering transforms for interpretable speech deepfake detection and reports that WST-X1 reaches 14.18% EER, 81.66% F1, 92.50% AUC, and 0.3408 minDCF on Deepfake-Eval-2024 (Xuan et al., 3 Feb 2026).

These follow-on results show that Deepfake-Eval-2024 functions as more than a static benchmark. It has become a stress test for generalization strategies: post-training between SSL pretraining and task fine-tuning, parameter-efficient prompt tuning, retrieval augmentation, and interpretable wavelet-based front ends. The benchmark’s multilingual, noisy, user-sourced character makes it particularly valuable for audio work, where older corpora are often cleaner and more English-specific (Ge et al., 26 Jun 2025).

The benchmark also sits within a broader 2024 shift toward realism-focused deepfake evaluation. Distinct but related efforts include the MultiFF-based Inclusion 2024 Global Multimedia Deepfake Detection Challenge, which targets unseen forgery generalization across image and audio-video tracks, and the inaugural SVDD challenge, which separates controlled and in-the-wild singing voice deepfake detection (Zhang et al., 2024, Zhang et al., 2024). A plausible implication is that Deepfake-Eval-2024 helped crystallize a field-wide transition away from narrow, closed-set benchmark success toward continual evaluation under unseen generators, multilingual conditions, platform artifacts, and modality-specific deployment constraints.

In that sense, Deepfake-Eval-2024 is best understood not as a claim that deepfake detection is impossible, but as a benchmark demonstrating that 2024-era deepfake detection is fundamentally a robustness problem. Its principal contribution is to show, with a forensic collection pipeline and multi-modal evidence, that high scores on legacy datasets can coexist with near-chance behavior on contemporary real-world media (Chandra et al., 4 Mar 2025).