Zero-Shot Deepfake Detection Overview

• Zero-shot deepfake detection is a method that identifies manipulated or synthetic media without target-domain fine-tuning, relying on distributional separation.
• It employs pre-trained foundation models, prompt-based strategies, and cross-modal techniques to assess unseen attack patterns across visual, audio, and audio-visual modalities.
• Empirical evaluations reveal strong cross-domain performance, while also highlighting challenges such as adversarial attacks, domain mismatches, and the need for minimal adaptive fine-tuning.

Zero-shot deepfake detection denotes the identification of manipulated or synthetic media when the relevant manipulation techniques, generators, domains, or datasets are absent from training and no target-domain fine-tuning is allowed. In the visual setting, it is commonly formulated as training on a source distribution and evaluating on a disjoint target distribution with unseen manipulation families, datasets, or domains; in audio and audio-visual settings, the same principle extends to unseen vocoders, languages, channels, attack identities, or multimodal inconsistencies. Depending on the formulation, the task appears as binary real-versus-fake classification, one-class scoring from genuine data only, open-set rejection, generator attribution, or source tracing of previously unseen attacks (Lin et al., 2024, Bora et al., 27 Nov 2025, Li et al., 2024, Chhibber et al., 29 Sep 2025).

1. Problem setting and formal scope

In contemporary work, zero-shot deepfake detection is not merely “testing on new samples.” It typically requires a distributional separation between training and evaluation. In visual talking-head detection, one explicit formulation requires $D_{\mathrm{train}} \ne D_{\mathrm{test}}$ and $$\mathrm{supp}(M_{\mathrm{train}})\cap \mathrm{supp}(M_{\mathrm{test}})=\varnothing$$, where $M$ denotes the set of generation methods present in each distribution (Bora et al., 27 Nov 2025). In CLIP-based general deepfake detection, the standard setting is to train on one dataset or one subset of manipulations, freeze the backbone, and test on previously unseen datasets or manipulations such as CelebDF-v2, WildDeepfake, or DFDC without any CLIP fine-tuning (Lin et al., 2024).

The same principle appears in speech, but often with a stricter open-set interpretation. Zero-shot speech source tracing enforces that attacks used to train the embedding extractor are completely disjoint from those used to create fingerprint–trial pairs, so that verification or attribution is performed on attacks never observed during training (Chhibber et al., 29 Sep 2025). In synthesized-speech detection under distribution shift, zero-shot baselines are trained on ASVspoof 2019 LA and evaluated without further adaptation on ASVspoof 2021, ShiftySpeech, In-the-Wild, or CodecFake, thereby isolating unseen synthesis methods, languages, speakers, channels, and codecs (Garg et al., 18 Aug 2025).

A distinct line of work defines zero-shot detection as a one-class problem. In audio-visual fake video detection by content consistency, only genuine audio-visual data are used to train the recognition frontends, and deepfake detection is performed by measuring whether spoken audio and visible articulation remain consistent at test time (Li et al., 2024). This formulation treats forged examples as unnecessary during training and instead models intrinsic correlations in authentic data.

The task also separates binary detection from attribution. Binary detection asks whether content is real or fake. Attribution asks which generator or manipulation class produced the fake, and in open-set settings it may further require rejection of out-of-distribution attacks or assignment to higher-level attack families such as acoustic model or vocoder categories (Chhibber et al., 29 Sep 2025, Zhang et al., 19 Apr 2025).

2. Foundation-model and prompt-based visual detectors

A major research direction repurposes pretrained foundation models rather than training conventional forensic classifiers from scratch. One representative method, RepDFD, freezes CLIP and learns only two external components: a universal pixel-space perturbation placed in a masked border prompt and adaptive Face2Text prompts built from face embeddings. The prompted image is

$$T_p(I,\Delta)=\mathrm{Resize}_p(I)+M_p\odot \Delta,$$

and classification is performed by cosine similarity between the frozen CLIP image encoder and real/fake text prompts. With CLIP-ViT-L, MTCNN face detection, crop scale factor 1.3, input resolution $224\times224$, border width $p=34$, and asymmetric prompts $\{T_0,T_3\}$, the method trains only the visual prompt $\Delta$ and keeps both CLIP encoders frozen (Lin et al., 2024).

A related but video-oriented strategy uses pretrained visual speech recognition features rather than image-text alignment. FauxNet extracts a $96\times96$ mouth ROI, feeds the first 32 consecutive frames into a pretrained Auto-AVSR visual encoder, averages the temporal embeddings into a 768-dimensional clip representation, and applies a lightweight multi-task MLP with a binary detection head and a manipulation-attribution head. A different CLIP-based video detector keeps the CLIP ViT image encoder frozen and adds a side-network decoder with a temporal module plus Facial Component Guidance over lips, skin, eyes, and nose, using only about 250K trainable parameters (Bora et al., 27 Nov 2025, Han et al., 2024).

Language-guided detectors extend this pattern by making textual supervision part of representation learning. AuthGuard fine-tunes a ViT-L/14 vision encoder with a dual-branch design: a commonsense branch optimized by image-text contrastive learning on pseudo-text generated by Llama 3.2, and a statistical branch optimized by binary classification. A lightweight router then combines both branches into an adaptive embedding, while uncertainty-aware contrastive learning down-weights noisy image-text pairs (Shen et al., 4 Jun 2025).

Another family treats deepfake detection as visual question answering. In zero-shot VLM detection, a model is shown an image and asked a binary question such as “Is this photo real?”, and detection uses token-level probabilities rather than only the generated answer string. For binary scoring, the paper defines

$$\widetilde{P}_{\mathrm{fake}}=\frac{P_{\mathrm{no}}}{P_{\mathrm{no}}+P_{\mathrm{yes}}}, \qquad \widetilde{P}_{\mathrm{real}}=\frac{P_{\mathrm{yes}}}{P_{\mathrm{no}}+P_{\mathrm{yes}}},$$

where $$\mathrm{supp}(M_{\mathrm{train}})\cap \mathrm{supp}(M_{\mathrm{test}})=\varnothing$$0 and $$\mathrm{supp}(M_{\mathrm{train}})\cap \mathrm{supp}(M_{\mathrm{test}})=\varnothing$$1 aggregate first-step token probabilities for “no/No” and “yes/Yes.” A closely related training-free ensemble, MoA-DF, queries Qwen2.5-VL, InternVL2.5, and InternVL3 with the prompt “Is this a real image, a partially AI-edited image, or a fully AI-generated image? Just answer with A/B. A: real B: AI”, converts each agent’s log-probabilities to probabilities by softmax, sums them, and predicts real if $$\mathrm{supp}(M_{\mathrm{train}})\cap \mathrm{supp}(M_{\mathrm{test}})=\varnothing$$2 and fake otherwise (Pirogov, 30 Jul 2025, Wang et al., 3 Jun 2025).

3. Audio, speech, and audio-visual formulations

In audio-visual one-class detection, the detector need not model fake data directly. The proposed CCFD framework uses a Conformer ASR and a ResNet + LSTM VSR, both trained only on genuine data, to decode word sequences from the audio and lip streams. The Levenshtein distance between the ASR sequence $$\mathrm{supp}(M_{\mathrm{train}})\cap \mathrm{supp}(M_{\mathrm{test}})=\varnothing$$3 and the VSR sequence $$\mathrm{supp}(M_{\mathrm{train}})\cap \mathrm{supp}(M_{\mathrm{test}})=\varnothing$$4 defines the word error rate, and the content-consistency score is

$$\mathrm{supp}(M_{\mathrm{train}})\cap \mathrm{supp}(M_{\mathrm{test}})=\varnothing$$5

This score can be fused with semantic consistency from AV-HuBERT and temporal synchronization from VocaLiST by simple late averaging (Li et al., 2024).

Speech zero-shot detection has also been framed as verification against attack fingerprints. In zero-shot open-set speech deepfake source tracing, SSL-AASIST with AAM-softmax learns discriminative attack embeddings, fingerprints are constructed by averaging enrolled utterance embeddings, and verification uses cosine similarity between a trial embedding and an enrolled fingerprint. In open-set conditions, the system accepts or rejects a claimed source by thresholding the similarity score, and can optionally reject all enrolled attacks as unknown if the maximum similarity remains below threshold (Chhibber et al., 29 Sep 2025).

Cross-domain audio deepfake detection extends the same logic to held-out zero-shot TTS generators. A detector is trained on some generators and domains, then tested on a held-out generator such as Seamless Expressive under domain shifts and nine attack methods including additive noise, reverberation, bandlimiting, MP3, EnCodec at 12 kbps and 6 kbps, and noise reduction. Wav2Vec2-large and Whisper-medium are fine-tuned as binary real-vs-fake detectors, with attack-augmented training used to improve cross-model robustness (Li et al., 2024).

A contrasting result appears in Bengali deepfake audio detection. On the BanglaFake benchmark, several pretrained models are evaluated in a strict zero-shot mode without any training or threshold learning on BanglaFake labels. Wav2Vec2-XLSR-53 is the best such model, but its zero-shot performance remains limited, and fine-tuning yields substantial gains over all zero-shot baselines (Samu et al., 25 Dec 2025). This suggests that zero-shot transfer in low-resource languages is especially sensitive to language mismatch, attack family, and the pretraining objective.

4. Empirical behavior across datasets and modalities

Cross-dataset visual evaluation remains the central empirical test. In RepDFD, when training on FF++ HQ with the four FF++ manipulations, the reported video-level AUCs are 89.94% on CelebDF-v2, 88.05% on WildDeepfake, 95.03% on DFDCP, and 80.99% on DFDC. Even when training only on FF++/DF, the method still reports 88.41% on CelebDF-v2, 87.73% on WildDeepfake, 90.68% on DFDCP, and 80.53% on DFDC. In cross-manipulation settings, examples include 94.94% AUC for training on DF and testing on FS, and 98.31% for training on FS and testing on DF (Lin et al., 2024).

In talking-head video, FauxNet reports strong transfer in both directions of cross-dataset evaluation. Training on Authentica-Vox and testing on FF++ yields AUC 0.9143 and Accuracy 84.43%. Training on FF++ and testing zero-shot on Authentica-HDTF yields AUC 0.9969 and Accuracy 92.58% in the multi-task setting. The same model also reports 93.35% attribution accuracy on Authentica-Vox and 90.99% on Authentica-HDTF, indicating that the learned visual-speech features support both binary detection and generator discrimination (Bora et al., 27 Nov 2025).

Image-level VLM evaluation shows a different empirical profile. On a new 60,000-image deepfake dataset built from CelebA-HQ and SimSwap, zero-shot InstructBLIP reports AUC 81.3, ACC 75.3, and EER 26.9, while Idefics2 reports AUC 80.6 and ACC 74.3. On the same dataset, SBI remains stronger with AUC 93.6 and ACC 85.2. In DFBench, MoA-DF reports 98.41% accuracy on real images, 97.07% accuracy and 0.970 F1 on AI-edited images, and 99.92% accuracy and 0.998 F1 on AI-generated images under a training-free prompt-based protocol (Pirogov, 30 Jul 2025, Wang et al., 3 Jun 2025).

Several studies also document the collapse of conventional zero-shot transfer. In the empirical study of deepfake image detectors, XceptionNet1 trained on CELEB reports original accuracy 99.10% but only 54.60% on FS, 50.95% on NT, 57.00% on DF, and 54.80% on DFD, for an average unseen accuracy of 54.34%. MesoNet1 similarly drops from 97.60% original accuracy to an average unseen accuracy of 55.25% (Li et al., 2023). In synthetic video detection, image-trained detectors that perform strongly on images show average AUCs around 0.640 or 0.690 on synthetic videos, whereas video-trained MISLnet reaches average AUC 0.983 and source-attribution AUC 0.991 when trained directly on video traces (Vahdati et al., 2024).

Speech results are similarly dependent on the evaluation regime. In STOPA source tracing, few-shot MLP and few-shot Siamese are stronger in closed-set verification, but in open-set verification zero-shot cosine scoring reaches 21.70% EER, outperforming few-shot Siamese at 27.40% and few-shot MLP at 22.65% (Chhibber et al., 29 Sep 2025). By contrast, BanglaFake demonstrates that zero-shot audio detection can remain close to chance under cross-lingual mismatch: Wav2Vec2-XLSR-53 reaches 53.80% accuracy, 56.60% AUC, and 46.20% EER, while some pretrained baselines collapse more severely (Samu et al., 25 Dec 2025).

5. Robustness, attacks, and recurrent failure modes

A persistent misconception is that strong benchmark performance implies robust zero-shot deployment. Several papers directly challenge that assumption. In adversarial evaluation on FF++, LaDeDa’s ROC-AUC drops from 0.7963 to 0.2213 under a black-box genetic attack with ASR 0.7000, while CLIP+CoOp drops from 0.6382 to 0.5580 with ASR 0.3030. On Celeb-DF, GPT-4o used as a zero-shot deepfake detector with five-vote scoring reaches ROC-AUC 0.7318, but a typographic context attack still attains ASR 0.0664 (Levy et al., 2024). These results support the claim that high-level semantic detectors and low-level forensic detectors have complementary strengths rather than interchangeable robustness.

Compression and signal degradation are equally decisive. In cross-domain audio deepfake detection, EnCodec 6 kbps remains particularly damaging: with attack augmentation, the reported EERs are 18.5% on Libri and 28.9% on TED; without augmentation, they rise to 30.5% and 35.2% (Li et al., 2024). In synthetic video detection, robust H.264 augmentation allows MISLnet to maintain AUC $$\mathrm{supp}(M_{\mathrm{train}})\cap \mathrm{supp}(M_{\mathrm{test}})=\varnothing$$6 across CRF 0–40, and increasing the number of aggregated patches to $$\mathrm{supp}(M_{\mathrm{train}})\cap \mathrm{supp}(M_{\mathrm{test}})=\varnothing$$7 raises AUC from 0.953 to 0.984 on CRF 40 videos (Vahdati et al., 2024). In audio-visual one-class detection, late fusion of content, semantic, and temporal scores yields the strongest robustness under both video perturbations and audio perturbations (Li et al., 2024).

Failure modes are often modality-specific. RepDFD notes that adversarial perturbations remain possible because the method uses pixel-space prompts and CLIP encoders trained on internet-scale data; it also notes that distributional biases in CLIP pretraining may affect demographic fairness and content priors, and that semantic content in prompts had limited effect (Lin et al., 2024). FauxNet reports that VSR features are least informative in non-speaking segments and degrade under extreme mouth occlusions or very short clips (Bora et al., 27 Nov 2025). In BanglaFake, WavLM-Base-Plus collapses with 0% precision, 0% recall, and 0% F1 in zero-shot inference, illustrating the severity of domain mismatch between pretrained audio representations and Bengali VITS-based TTS artifacts (Samu et al., 25 Dec 2025).

A structured evaluation of proprietary VLMs reaches an even more cautionary conclusion. ChatGPT is the strongest model in that study, with average accuracy 0.77 on faceswap/reenactment and 0.67 on diffusion subsets, but Grok scores 0.00 average accuracy on faceswap/reenactment and on the GAN subset, and the study concludes that current VLMs are not dependable as standalone detection systems (Tariq et al., 12 Jun 2025). The broader implication, explicitly argued in several works, is that zero-shot interpretability and zero-shot reliability are not the same property.

6. Research trajectory and open directions

Recent work increasingly treats strict zero-shot deployment as an initial condition rather than a complete solution. FTNet reframes generalized deepfake detection as a few-shot, training-free problem in which one or a few failed fake samples from a new generator are cached as exemplars in frozen CLIP space. With a 4-shot cache, FTNet reports mAcc 90.7% on GenImage and 94.03% on UniversalFakeDetect, while FTNet-T reaches 97.14% mAcc on UniversalFakeDetect and average F1 82.68, Acc 83.16 on OpenSDI (Yao et al., 13 Aug 2025). In synthetic video detection, fine-tuning MISLnet with less than one minute of labeled video per new generator raises Sora from 0.530 to 0.982 AUC and Pika from 0.620 to 0.989 (Vahdati et al., 2024). In synthesized-speech detection under distribution shifts, the proposed few-shot adaptation yields up to 32% relative EER reduction on Japanese deepfakes and 20% relative reduction on ASVspoof 2021 Deepfake (Garg et al., 18 Aug 2025). This suggests that in many real deployments the decisive question is not whether adaptation is allowed, but how little adaptation can be made effective.

A second trajectory is hybridization. Multiple papers argue for combining low-level forensic cues, semantic or language-guided cues, and cross-modal consistency. AuthGuard explicitly integrates statistical and commonsense branches and connects the resulting encoder to an LLM for detection reasoning (Shen et al., 4 Jun 2025). The adversarial robustness study argues that low-level and high-level detectors should be fused because typographic overlays that bias VLMs are still pixel artifacts for forensic models, while bounded perturbations that fool forensic models may leave semantic cues intact (Levy et al., 2024). Audio-visual work already implements such fusion by averaging content, semantic, and temporal consistency scores (Li et al., 2024).

A third trajectory concerns evaluation infrastructure. DFBench expands zero-shot image benchmarking to 540,000 images across real, AI-edited, and AI-generated content from 12 generation models (Wang et al., 3 Jun 2025). Authentica-Vox and Authentica-HDTF provide approximately 38,000 real and fake talking-head videos built from six recent generation techniques (Bora et al., 27 Nov 2025). Survey-style analyses further emphasize the absence of standardized zero-shot benchmarks, the need for explainable AI, multimodal fusion, watermarking, federated learning, and integrated authenticity pipelines that combine detection with prevention and provenance mechanisms (Sar et al., 22 Sep 2025). A plausible implication is that future progress will be judged less by in-domain benchmark saturation than by cross-domain calibration, open-set rejection, attack resilience, and sample-efficient adaptation under continuous generator drift.