Miffie: Schema Normalization & Deepfake Benchmark

• Miffie is a dual-domain term, denoting an automated relational schema normalization framework and a realism-oriented deepfake dataset in multimedia forensics.
• In databases, Miffie employs a dual-model self-refinement loop using GPT-4 for generation and o1-mini for verification, improving anomaly elimination up to 3NF.
• In multimedia forensics, Miffie (informally for MFFI) integrates 50 forgery methods with 1,024K images to evaluate deepfake detection under real-world, degradation-aware conditions.

Searching arXiv for the named works to ground the article in the cited preprints. “Miffie” denotes two distinct 2025 research artifacts that occupy different technical domains. In database systems, Miffie is a LLM–based framework for automated relational schema normalization up to Third Normal Form (3NF), using a dual-model self-refinement loop in which GPT-4 generates candidate schemas and o1-mini verifies them against 1NF–3NF criteria (Jo et al., 25 Aug 2025). In multimedia forensics, “Miffie” is an informal pronunciation of MFFI, the “Multi-Dimensional Face Forgery Image” dataset, a realism-focused benchmark for face forgery detection that integrates 50 forgery methods, 1,024K image samples, and a degradation-aware evaluation regime intended to simulate open-internet deployment conditions (Miao et al., 6 Sep 2025). The shared label is therefore a case of cross-domain homonymy rather than a single unified concept.

1. Terminological scope

In the current literature, the term has two established uses, one formal and one colloquial (Jo et al., 25 Aug 2025, Miao et al., 6 Sep 2025).

Usage	Domain	Meaning
Miffie	Database systems	An LLM-based framework for automated schema normalization up to 3NF
“Miffie”	Multimedia forensics	Informal pronunciation of MFFI, a face forgery image dataset

The database work uses Miffie as the formal name of the framework. The multimedia-forensics work uses MFFI as the official acronym and states that it is often spoken informally as “Miffie”; it does not specify an official pronunciation. This distinction matters because the two works differ not only in subject matter but also in methodological commitments: one addresses normalization anomalies in relational schemas, whereas the other addresses generalization and realism gaps in deepfake detection benchmarks.

2. Miffie as a database normalization framework

Miffie, in the database sense, is presented as a response to the expert-driven and manual character of relational schema normalization, which the paper describes as time-consuming and error-prone because it depends on domain-specific semantics and nuanced relationships among columns (Jo et al., 25 Aug 2025). The framework targets normal forms up to 3NF. The stated rationale is pragmatic: 3NF is usually sufficient in practice, whereas stricter forms such as BCNF and 4NF are not necessary in most real deployments.

The anomaly classes addressed are explicitly tied to 1NF, 2NF, and 3NF. For 1NF, Miffie aims to remove non-atomic columns. For 2NF, it aims to remove partial dependencies. For 3NF, it aims to remove transitive dependencies and non-key determinants that violate 3NF. The paper repeatedly emphasizes functional dependency violations as the structural source of these anomalies, while also noting that update, insert, and delete anomalies are implicitly encompassed by such defects.

The framework’s input is an initial relational schema description, including tables, attributes, and existing keys or relationships. Its output is a normalized schema satisfying the requested normal forms within the 1NF–3NF range. A notable design choice is that the framework does not require users to manually specify functional dependencies. This is central to its positioning against traditional normalization workflows, which often assume that functional dependencies are already available in explicit symbolic form.

At the same time, the formal scope is deliberately limited. The paper does not provide formal notation for functional dependencies, attribute closure, candidate keys, or prime attributes, and it does not implement FD-closure computation, 3NF synthesis, BCNF decomposition, lossless-join checks, or dependency-preservation guarantees. The verification procedure is instead criteria-based and binary with respect to 1NF, 2NF, and 3NF. This suggests a practical normalization system oriented toward human-effort reduction rather than a symbolic normalization engine with formal guarantees.

3. Dual-model self-refinement architecture and prompting

The core of Miffie is a dual-model self-refinement architecture in which schema generation and schema verification are assigned to different LLMs based on empirical role specialization (Jo et al., 25 Aug 2025). GPT-4 serves as the generation module. It proposes normalized schemas, performs decompositions and table splits, defines keys, and restructures tables so that the result satisfies 1NF–3NF requirements. The paper reports that GPT-4 was chosen because it delivered balanced and stable anomaly removal across the three target normal forms.

o1-mini serves as the verification module. It performs strict binary checks for each normal form in sequence. If it detects an anomaly at 1NF, 2NF, or 3NF, it rejects the candidate schema for that form and all higher forms. It also produces detailed feedback and resolution instructions, such as splitting a table or declaring a proper primary key. The authors selected o1-mini because it achieved near-perfect anomaly detection rates across 1NF–3NF.

Operationally, the framework follows an iterative loop. The generation module first proposes a normalized schema from the initial schema description. The verification module then evaluates the candidate against 1NF, then 2NF, then 3NF. If the candidate fails, the verifier emits feedback describing the anomaly and prescribing a correction. GPT-4 then revises the schema using that feedback. The loop continues until the verifier approves the schema or a maximum number of attempts is reached. In evaluation, the default try limit is 3, chosen as the cost/accuracy balance point, although the authors also tested longer loops, up to 20 iterations, to study convergence.

Prompt design is treated as a first-class methodological component. Miffie uses task-specific zero-shot prompts rather than few-shot prompting. The generation prompt spells out the requirements for 1NF, 2NF, and 3NF and instructs the model to identify and eliminate anomalies. The verification prompt enumerates the normal-form requirements and requires a binary judgment, precise anomaly descriptions, and actionable remediation steps. The paper explicitly avoids few-shot exemplars and chain-of-thought exemplars, arguing that carefully specified criteria are sufficient for high accuracy while reducing token use.

The reported prompt sizes are 325 tokens for the zero-shot prompt, 628 tokens for one-shot prompting, and approximately 1.1K tokens for few-shot prompting. Within this design, the verifier’s structured feedback is not merely diagnostic; it is the mechanism that drives subsequent refinement. The framework’s central claim is therefore not that a single powerful model can normalize schemas in one pass, but that decomposition into generation and verification, coupled with criteria-specific prompting, improves both accuracy and cost efficiency.

4. Evaluation, empirical behavior, and methodological limits

The evaluation uses three schemas of increasing complexity: Orders with 4 tables and 3 foreign keys, Advertising with 7 tables and 8 foreign keys, and AirportDB with 14 tables and 21 foreign keys (Jo et al., 25 Aug 2025). Orders is augmented with one synthetic table for 2NF and 3NF anomaly injection. For each normal form, the experiments inject five anomalies, and performance is averaged across 20 runs. Accuracy is defined as the average number of correctly eliminated anomalies out of five; detection rate is the proportion corresponding to that average; elimination rate measures the fraction of runs that remove all anomalies within at most three attempts.

Against a baseline consisting of a vanilla, naive zero-shot prompt without explicit normalization criteria, Miffie’s structured zero-shot prompting plus iterative feedback achieves roughly 1.2× higher normalization accuracy across all normal forms. The paper also reports that most normalization tasks converge within three iterations and that extending beyond three attempts yields little additional improvement.

Configuration	Normalization accuracy	Elimination rate within ≤3 tries
GPT-4 only	1NF 4.00; 2NF 3.90; 3NF 4.60	45%
o1-mini only	1NF 4.90; 2NF 3.35; 3NF 4.80	57%
Dual-model Miffie	1NF 4.75; 2NF 4.25; 3NF 4.95	72%

Ablation of the prompting strategy shows that the zero-shot design used by Miffie attains 1NF 4.60 (±0.49), 2NF 4.10 (±1.51), and 3NF 4.90 (±0.30) with a 325-token prompt. One-shot prompting yields 1NF 4.30 (±0.46), 2NF 4.20 (±0.98), and 3NF 4.80 (±0.40) with 628 tokens. Few-shot prompting yields 1NF 4.30 (±0.46), 2NF 4.80 (±0.40), and 3NF 4.50 (±0.67) at approximately 1.1K tokens. The authors interpret this as evidence that task-specific zero-shot prompting can match or exceed more elaborate prompting regimes while minimizing token usage.

A separate ablation isolates the effect of verification. Without verification, scores are 1NF 4.10 (±0.54), 2NF 4.10 (±1.48), and 3NF 4.30 (±0.95). With verification, they become 1NF 4.75 (±0.43), 2NF 4.25 (±0.83), and 3NF 4.95 (±0.22). This makes the verifier the dominant contributor to reliability, especially in higher-form anomaly removal.

The model-specific generation comparison further clarifies the role split. GPT-3.5-Turbo performs poorly, with 1NF 1.80 (±0.00), 2NF 0.00 (±0.00), and 3NF 1.05 (±0.97). GPT-4 yields 1NF 4.30 (±0.66), 2NF 4.70 (±0.71), and 3NF 4.35 (±0.91). GPT-4-Turbo, GPT-4o-mini, and o1-mini show stronger performance on some forms but less balanced behavior, especially on 2NF. The verifier comparison shows that o1-mini attains near-perfect anomaly detection across all normal forms, whereas other models are inconsistent, particularly for 2NF, and GPT-3.5-Turbo fails to detect anomalies across all normal forms.

The framework’s limitations are explicit. As schema complexity increases, the generation module may fail to define primary keys correctly or miss subtle partial dependencies that require intricate domain understanding. Hard cases, represented by AirportDB, show a slight decline in accuracy and increased variance, although 3NF anomalies remain nearly all resolved at 4.85 ± 0.36 because verification is strong at identifying transitive dependencies. The authors also acknowledge that the method does not perform formal FD computations, lossless-join tests, dependency-preservation checks, or BCNF verification. Relative to traditional normalization algorithms, this is a trade-off: Miffie reduces human effort and performs well empirically, but it does not supply the formal guarantees associated with symbolic normalization procedures.

5. “Miffie” as MFFI: a deepfake benchmark for real-world scenarios

In multimedia forensics, “Miffie” refers informally to MFFI, the “Multi-Dimensional Face Forgery Image” dataset (Miao et al., 6 Sep 2025). MFFI is introduced as a realism-focused benchmark for training and evaluating face forgery detectors under conditions intended to resemble the open internet. Its stated motivation is that existing deepfake datasets are insufficient in four respects: they underrepresent advanced and previously unseen forgery techniques, varied facial scenes, diverse authentic-image sources, and the degradations introduced by real-world propagation.

The dataset is organized around four strategic dimensions.

Dimension	Construction	Intended role
Wider Forgery Methods (WFM)	6 categories, 50 methods	Covers a broader manipulation family space
Varied Facial Scenes (VFS)	Ethnicity, age, pose, occlusion, background, lighting	Improves scene complexity and invariance
Diversified Authentic Data (DAD)	Four real-image sources	Broadens identity and domain coverage
Multi-level Degradation Operations (MDO)	Conventional corruptions and PatchAttack in Test-D	Models platform propagation and active perturbation

Under WFM, MFFI extends beyond the four common categories of Face Swapping, Face Reenactment, Entire Face Synthesis, and Face Editing by adding Face Super-Resolution and Face Manual Photoshop, reaching 6 categories and 50 distinct methods. Representative Face Swapping pipelines include SimSwap, FaceShifter, FSGAN, InfoSwap, Stable Diffusion 1.5 used for swap workflows, HiFiFace, IP-Adapter, MegaFS, MobileFaceSwap, FaceMerge, RAFSwap, e4s, AIM, I2G, and SBI. Face Reenactment includes FOMM, MCNet, ArticulatedAnimation, DaGAN, HyperReenact, MonkeyNet, AniPortrait, and Wav2Lip. Entire Face Synthesis includes StyleGAN2, StyleGAN3, InstantID, Stable Diffusion XL, and commercial systems such as Jimeng 2.0, Jimeng 3.0, Kling 1.6, Pika 1.5, PixVerse, Vidu 2.0, Vivago, and Wan 2.1. Face Editing includes HFGI, pSp, FaceInpainting, DualStyleGAN, SD-Inpainting, and SD-XL-Inpainting. Face Super-Resolution is represented by GPEN. Face Manual Photoshop includes Random Facial Component Swapping, Random Facial Component Excision, Full Face Swapping, Facial Artifact Injection, Random Region Erasure, Background Replacement, and Image-Filtering with Kuwahara, Bilateral, and Oil filters.

Under VFS, MFFI explicitly curates six scene axes: ethnicity, age, pose, occlusion, background, and lighting. Ethnicity includes Caucasian, African, Indian, and Asian. Age spans 0–85 years. Pose includes frontal, profile, downward, and upward views. Occlusion includes sunglasses, face masks, hoodies, and bangs. Backgrounds are indoor and outdoor. Lighting includes strong light, low light, and colored light. The paper’s argument is that such coverage reduces overfitting to narrow environments and better reflects surveillance-like viewpoints, selfies, and low-light captures encountered online.

Under DAD, MFFI integrates four distinct real-image sources: CelebA with 200K images and approximately 10K identities; RFW, plus BUPT-GlobalFace/BUPT-BalancedFace variants, with four balanced racial subsets and 10K images per subset and approximately 3K identities each; CASIA-WebFace with approximately 500K images and approximately 10K identities; and a self-collected Chinese Celeb set with 30K images and approximately 1.5K identities. The stated purpose is to break single-source dependency and reduce bias and domain gaps.

Under MDO, degradations are applied only to the Test-D split. Conventional disturbances include uniform blur, Gaussian blur, uniform noise, Gaussian noise, sharpening artifacts, compression, and geometric transforms. The adversarial component is PatchAttack, described as a reinforcement learning–based black-box method that overlays textured patches to induce misclassification. The paper does not provide explicit parameter ranges or formal definitions for these degradations.

MFFI is an image-level dataset rather than a full temporal benchmark; forged videos are processed by frame sampling. It provides binary real/fake labels, forgery-category labels, and method-type counts per split. Resolution and file formats are not specified. The total scale is 1,024K image samples, divided into Train 524K, Valid 140K, Test 180K, and Test-D 180K. The real class includes 100K CelebA images in Train, 110K RFW/BUPT images across Valid, Test, and Test-D, 50K CASIA-WebFace images across Test and Test-D, and 60K Chinese Celeb images across Test and Test-D. The fake class totals are 191K for Face Swapping, 128K for Face Reenactment, 37K for Entire Face Synthesis, 48.4K for Face Editing, 230.6K for Face Super-Resolution, and 69K for Face Manual Photoshop.

6. Benchmark behavior, challenge role, and ethical constraints of MFFI

MFFI is not only a dataset but also a benchmark regime designed to expose weaknesses in deepfake detection systems under deployment-like conditions (Miao et al., 6 Sep 2025). It served as the core benchmark for the Global Multimedia Deepfake Detection Challenge on Kaggle and is reported to have attracted 1,500 teams worldwide. The paper states that training and evaluation followed DeepfakeBench settings for reproducibility, and the official repository is hosted at https://github.com/inclusionConf/MFFI.

The benchmark defines three evaluation setups. The first is intra-dataset evaluation, in which a detector is trained on MFFI Train and evaluated on MFFI Test and Test-D. The second is cross-dataset evaluation, in which models trained on external datasets such as DF40-FS or FF++ C23 are tested on MFFI Test and Test-D. The third is zero-shot evaluation of multi-modal LLMs, specifically LLaVA-1.5, Qwen-2.5-VL, and InternVL-3, without fine-tuning.

Baseline detectors include Xception and RFM as spatial-domain CNNs, and SRM and SPSL as frequency- or spectrum-oriented models. Reported metrics are ACC, AUC, EER, and AP. On the standard Test split, Xception achieves ACC = 0.7683, AUC = 0.8522, EER = 0.2320, and AP = 0.8855, with RFM and SRM/SPSL described as comparable. On Test-D, performance drops across all models; spatial-domain detectors such as Xception and RFM are more robust than SRM and SPSL, and SRM shows the largest ACC drop, approximately $\Delta \mathrm{ACC} \approx -0.2095$. The paper emphasizes this as a difficulty gradient, with degradations disproportionately harming frequency-domain methods.

Cross-dataset transfer into MFFI is intentionally hard. Models trained on DF40-FS or FF++ C23 perform poorly on MFFI Test and Test-D; for Xception, the reported AUC is approximately 0.457–0.625 depending on train set and split. The interpretation offered in the paper is that broad forgery coverage alone is insufficient if authentic-data diversity and scene variability remain narrow. In the reverse direction, training on MFFI and testing on unseen benchmarks yields AUC 0.6933 on CDF-V1, 0.6695 on CDF-V2, 0.7117 on DFD, and 0.5523 on DFDC, for an average of approximately 0.6567. The authors treat this as evidence of competitive generalization from MFFI to other datasets.

The comparison with existing datasets is explicit. The paper states that FF++, Celeb-DF, DFDC, ForgeryNet, DF3, DeepFakeFace, DiffusionDeepfake, and DF40 each address parts of the problem but typically miss at least one of the four strategic dimensions. MFFI is reported to surpass these datasets across WFM, VFS, DAD, and MDO, owing to inclusion of newer methods such as Jimeng 3.0, explicit scene coverage, multiple independent real-image sources, and the dedicated degraded Test-D split containing both conventional corruptions and adversarial patches.

The paper also provides practical guidance. It recommends balanced sampling across FS/FR/EFS/FE/FSR/FMPS, augmentations that mirror MDO such as blur, noise, compression, and geometric transforms, and consideration of patch-based adversarial training. It further recommends domain generalization strategies that mix source data from CelebA, CASIA-WebFace, RFW, and Chinese Celeb, as well as curriculum learning that introduces Test-D-like corruptions later in training. For evaluation, the recommendation is to report both Test and Test-D results and to perform cross-dataset testing. For model design, the paper suggests combining spatial features with robust preprocessing and considering ensemble or multi-branch detectors that integrate spatial and frequency cues.

Ethical and governance considerations are integral to the dataset’s release. The paper notes that detailed forgery examples could be misused and states that the dataset is intended for defensive research and societal protection. It reports that real data collection adheres to source-dataset licenses and regulatory guidelines, and that usage agreements are required at release to safeguard privacy and standardize utilization. For demographic fairness, inclusion of RFW and BUPT variants is intended to mitigate racial bias, though users are advised to continue monitoring performance across ethnicities, ages, and other demographics. Licensing is described with ACM open-access notation and CC BY-NC-SA, with the repository designated as the source for dataset-specific license and usage agreements.

MFFI’s limitations are also explicit. The current version provides binary labels and lacks fine-grained text annotations or explanations for specific manipulated regions. Planned extensions include fine-grained forged text annotations to support interpretable detectors and better use of multi-modal large models. In that sense, the colloquial “Miffie” attached to MFFI designates not just a dataset name variant but a particular benchmark philosophy: broad forgery coverage, strong authentic-data diversity, explicit scene variability, and degradation-aware evaluation intended to approximate face forgery detection in the wild.