Think Twice Before Adaptation: Improving Adaptability of DeepFake Detection via Online Test-Time Adaptation

1 Introduction

Recently, Generative Artificial Intelligence (GenAI) has been used to generate DFs for malicious purposes, such as impersonation 1 and disinformation spread 2 , raising concerns about privacy and security. Several DF detection approaches have been proposed to mitigate these negative impacts [NguyenLe et al., 2024a]. Despite advances, deploying these systems in real-world environments presents two critical challenges. First, in practice, adversaries can strategically apply previously unknown postprocessing techniques to DF samples at inference time, completely obscuring the generation artifacts [Corvi et al., 2023] and successfully bypassing detection systems. Second, real-world applications are frequently exposed to test samples drawn from distributions that deviate substantially from the training data distribution [Pan et al., 2023], leading to performance degradation. To mitigate these challenges, existing approaches require access to source training data and labels for complete re-training [Ni et al., 2022; Shiohara and Yamasaki, 2022], continual learning [Pan et al., 2023] or test-time training [Chen et al., 2022], which is costly and time-consuming.

1 Finance worker pays out $25 million after video call with deepfake 'chief financial officer'

2 AI-faked images of Donald Trump's imagined arrest swirl on Twitter

In this work, we address these limitations by introducing a novel TTA-based method, namely Think Twice before Adaptation (T2A), which enhances pre-trained DF detectors without requiring access to source training data or labels. Our approach achieves two key objectives: (1) enhanced resilience through dynamic adaptation to unknown postprocessing techniques; and (2) improved generalization to new samples from unknown distributions. While current TTA approaches commonly employ Entropy Minimization (EM) as the adaptation objective, solely relying on EM can result in confirmation bias caused by overconfident predictions [Zhang et al., 2024] and model collapse [Niu et al., 2023]. To this end, in T2A, we design a novel Uncertainty-aware Negative Learning adaptation objective with noisy pseudo-labels, allowing the model to explore alternative options (i.e., other classes in the classification problem) rather than becoming overly confident in potentially incorrect predictions. For better adaptation, we incorporate Focal Loss [Ross and Doll´ar, 2017] into the negative learning (NL) objective to dynamically prioritize crucial samples and propose a gradients masking technique that updates crucial model parameters whose gradients align with those of BatchNorm layers.

Our contributions. To the best of our knowledge, we are the first to present a novel TTA-based method for DF detection. Our contributions include:

• We provide a theoretical and quantitative analysis (Sec. 3) that demonstrates the impacts of postprocessing techniques on the detectability of DF detectors.
• We introduce T2A, a novel TTA-based method specifi-

cally designed for DF detection. T2A enables models to explore alternative options rather than relying on their initial predictions for adaptation (Sec. 4.3). We also theoretically demonstrate that our proposed negative learning objective exhibits complementary behavior to EM. Additionally, we introduce Uncertain Sample Prioritization strategy (Sec. 4.4) and Gradients Masking technique (Sec. 4.5) to dynamically focus on crucial samples and crucial model parameters when adapting.

• We evaluate T2A under two scenarios: (i) Unknown postprocessing techniques; and (ii) Unknown data distribution and postprocessing techniques. Our experimental results show superior adaptation capabilities compared to existing TTA approaches. Furthermore, we demonstrate that integration of T2A significantly enhances the resilience and generalization of DF detectors during inference, establishing its practical utility in real-world deployments.

2 RelatedWork

2.1 Deepfake Detection

DF detection approaches are often formulated as a binary classification problem that automatically learns discriminative features from large-scale datasets [Nguyen-Le et al., 2024b]. Existing approaches can be classified into three categories based on their inputs: (i) Spatial-based approaches that operate directly on pixel-level features [Ni et al., 2022; Cao et al., 2022], (ii) Frequency-based approaches that analyze generation artifacts in the frequency domain [Liu et al., 2021; Frank et al., 2020], and (iii) Hybrid approaches that integrate both pixel and frequency domain information within a unified method [Liu et al., 2023b]. Recent advances have improved the cross-dataset generalization of DF detectors by employing data augmentation (DA) strategies [Ni et al., 2022; Yan et al., 2024], synthesis techniques [Shiohara and Yamasaki, 2022], continual learning [Pan et al., 2023], metalearning and one-shot test-time training [Chen et al., 2022].

Compared to existing methods, our T2A offers advantages: (1) T2A enables DF detectors to be adapted to test data without access to source data (e.g., OST [Chen et al., 2022] requires source data for adaptation); (2) T2A does not rely on any DA or synthesis techniques to extend the diversity of data; (3) Not only enhance the generalization, T2A also improves the resilience of DF detectors to unknown postprocessing techniques.Additionally, our method is orthogonal to these works [Fang et al., 2024; Liu et al., 2024; He et al., 2024], which require pre-training on joint datasets (physical and digital attacks) and do not adapt during inference.

2.2 Test-time Adaptation (TTA)

TTA approaches only require access to the pre-trained model from the source domain for adaptation [Liang et al., 2024]. Unlike source-free domain adaptation approaches [Li et al., 2024], which require access to the entire target dataset, TTA enables online adaptation to the arrived test samples.

TENT [Wang et al., 2020] and MEMO [Zhang et al., 2022] optimized batch normalization (BN) statistics from the test batch through EM. LAME [Boudiaf et al., 2022] adapted only the model's output probabilities by minimizing Kullback-Leibler divergence between the model's predictions and optimal nearby points' vectors. Several methods have studied TTA in continuously changing environments. CoTTA [Wang et al., 2022] implemented weight and augmentation averaging to mitigate error accumulation, while EATA [Niu et al., 2022] developed an efficient entropy-based sample selection strategy for model updates. Inspired by parameter-efficient fine-tuning, VIDA [Liu et al., 2023a] used high-rank adapters to handle domain shifts. However, these methods solely rely on EM as the learning principle, which can present two issues: (1) Confirmation bias: EM greedily pushes for confident predictions on all samples, even when predictions are incorrect [Zhang et al., 2024], leading to overconfident yet incorrect predictions; and (2) Model Collapse: EM tends to cause model collapse, where the model predicts all samples to the same class, regardless of their true labels [Niu et al., 2023]. The model collapse phenomenon is particularly problematic in DF detection, where the inherent bias toward dominant fake samples in training data [Layton et al., 2024] can exacerbate the collapse.

Focusing on the problem of EM, our T2A method allows the model to consider alternative options rather than completely relying on its initial prediction during inference through NL with noisy pseudo-labels.

2.3 Negative Learning

Supervised learning or positive learning (PL) directly maps inputs to their corresponding labels. However, when labels are noisy, PL can lead models to learn incorrect patterns. Negative learning (NL) [Kim et al., 2019] addresses this challenge by training networks to identify which classes an input does not belong to. Several loss functions have been proposed by leveraging this concept: NLNL [Kim et al., 2019] combines sequential PL and NL phases, while JNPL [Kim et al., 2021] proposes a single-phase approach through joint optimization of enhanced NL and PL loss functions. Recent work has further integrated NL principles with normalization techniques [Ma et al., 2020] to transform active losses into passive ones [Ye et al., 2023].

Inspired by these advances, we introduce a NL strategy with noisy pseudo-labels to our T2A method to enable the model to think twice during adaptation, avoiding confirmation bias and model collapse caused by EM.

3 Generation Artifacts Analysis

Artifacts in DFs generated by Generative Adversarial Examples (GANs), which emerge from the upsampling operations in the GANs pipeline, can be revealed in the frequency domain through Discrete Fourier Transform (DFT) [Frank et al., 2020]. In this section, we demonstrate postprocessing techniques can completely obscure these artifacts presented in DF samples, leading to performance degradation of DF detectors.

Definition 3.1. Let an image x(·, ·) of size M ×N, its DFT X(·, ·) is defined as:

where x(m, n) represents pixel values at spatial coordinates and X(u, v) denotes the corresponding Fourier coefficient in frequency domain.

Lemma 3.2. For two images x1(·, ·) and x2(·, ·), their convolution in the spatial domain is equivalent to multiplication of their spectra in the frequency domain:

This property (Proof in Appendix A) is particularly important for understanding why the upsampling operation leaves artifacts in the frequency domain [Ojha et al., 2023]. For an image x(·, ·) convolved with a kernel c(·, ·), the output y(·, ·) in the spatial domain and its frequency domain form can be expressed as:

When image x(·, ·) is upsampled by a factor of 2 in both dimensions, the upsampled image ˜x(·, ·) can be expressed as:

where k = 0, . . . , M - 1 and l = 0, . . . , N - 1. The DFT of the upsampled image is:

This upsampling operation creates a characteristic periodic structure in the frequency domain, showing that the original image's frequency components appear multiple times in the frequency domain:

These duplicated components create distinctive artifacts as checkerboard patterns in the frequency domain that distinguishes GAN-generated images from real ones.

However, these spectral artifacts exhibit vulnerability to various postprocessing operations [Corvi et al., 2023]. As shown in Figure 1(b), the GAN-generated image displays distinctive checkerboard artifacts in its frequency spectrum, but they undergo substantial modifications when subjected to different postprocessing operations (Figures 1(c)-(d)). The magnitude of these artifacts' obscurity correlates directly with the intensity of the applied postprocessing operations, as demonstrated in Figure 3 (Appendix B). Furthermore, the empirical analysis presented in another Figure 2 of Appendix B shows that the performance of existing DF detectors tends to drop significantly when encountering unseen postprocessing techniques with increasing intensities.

4 Methodology

The core principle of T2A lies in its deliberate approach to decision-making, encouraging models to explore alternative options rather than solely relying on their initial predictions. The key steps of T2A are summarized in Algorithm 1.

4.1 ProblemDefinition

Given a DF detector f : X → R2 parameterized by θ is welltrained on the training data Dtrain = {(xi, yi)}N train i=1 ∼ P train (x, y), where x ∈ X is the input and y ∈ Y = {0, 1} is the target label, our goal is to online update parameters θ of f on mini-batches {B1, B2, . . . } of the test stream Dtest = {(xj, yj)}N test j=1 ∼ P test (x, y). Note that, in the online TTA setting, P train (x, y) and {yj} are unavailable, and the knowledge learned in previously seen mini-batches could be accumulated for adaptation to the current mini-batch [Liang et al., 2024]. In this work, we consider online TTA in two challenging scenarios of DF detection:

1. Unseen postprocessing Techniques: While the test data distribution remains similar to the training distribution P train (x, y) = P test (x, y), the test samples are applied unknown postprocessing operations Ψ : X → X . Specifically, given a test sample xj ∼ P test , f takes Ψ(xj) as input, where Ψ ∈ P with P denotes a set of unseen postprocessing techniques during training.
2. Unseen Data Distribution and postprocessing Techniques: This is a more challenging setting in which test samples come from a different distribution P test ̸= P train and are also subjected to unknown postprocessing operations.

Algorithm 1: T2A Algorithm

Input : trained model fθ, test samples

Define: batch size B; loss balancing hyperparameters α, β, gradients alignment threshold ψ; learning rate η

1 for mini-batches {xi}Bi=1 ⊂ Dtest do

• 2 Obtain pseudo-label ˆ yi from Eq. 8
• 3 Calculate noisy pseudo-label by Eq. 9
• 4 Calculate entropy of model predictions LEM follow Eq. 7
• 5 Calculate noise-tolerant negative loss LNTNL(xi, ˜ yi) = αLnn(xi, ˜ yi) + βLp(xi, ˜ yi) follow Equations (11) and (12)
• 6 Optimize the adaptation objective function: LNTNL + LEM to obtain the gradient matrix ∇θL
• 7 PerformGradient Masking on ∇θL by keeping the parameters of those gradients aligned with gradients of BN layers by Eq. 15
• 8 PerformGradient Descent to adapt the model: θ ← θ - η∇θL

4.2 Revisitting EntropyMinimization (EM)

EM is commonly used to update model parameters by minimizing the entropy of model outputs on test sample x during

where p(y = c|x) is the predicted probability for class c, computed as the softmax output of the model: p(y = c|x) = exp(fc(x)) ∑c∈C exp(fj(x) , where fc(x) is the logit for class c from the model's forward pass on input x. As discussed in Sec 2.2, EM causes two issues: Confirmation bias and Model collapse. Therefore, besides EM, our T2A method introduces a NL strategy with noisy pseudo-labels (described in Sec. 4.3), allowing models to re-think other potential options before making the final decision.

4.3 Uncertainty-aware Negative Learning

Uncertainty Modelling with Noisy Pseudo-Labels

Given the DF detector f, the pseudo-label ˆ y = ˆ y(x) ∈ {0, 1} of input x is defined as:

where τ ∈ [0, 1] denotes the classification threshold. Rather than implicitly trusting the model's initial predictions, we enable the model to "doubt" its predictions by introducing noisy pseudo-labels.

We model the uncertainty in pseudo-labels using a Bernoulli distribution. For each input x with pseudo-label ˆ y, we generate a noisy pseudo-label ˜ y for input xi as follows:

where pxi represents the prediction probability. This indicates that higher confidence predictions have a lower probability of being flipped. When the Bernoulli trial equals 1 (with probability 1-pxi ), the pseudo-label is flipped to the opposite class; otherwise (with probability pxi ), it remains unchanged. However, directly adapting to noisy pseudo-labels presents two limitations during test-time updates: (1) Without access to source data for regularization, errors from noisy labels can accumulate rapidly; and (2) The stochastic nature of noisy gradients can lead to unstable updates.

Noise-tolerant Negative Loss Function

The goal of the noise-tolerant negative loss (NTNL) is to enable the model to think twice through NL with noisy pseudolabels.

From Positive to Negative Learning. Negative learning (NL) enables the model to be taught with a lesson that "this input image does not belong to this complementary label" [Kim et al., 2019]. In our work, converting from pseudolabels to noisy versions is equivalent to transforming from positive to negative learning, facilitating the DF model to re-think that "this input image might not belong to this real (fake)/fake (real) label".

Noise-tolerant Negative Loss Function. Inspired by existing works [Zhou et al., 2021; Ma et al., 2020; Ghosh et al., 2017], we start from the fact that any loss function can be robust to noisy labels through a simple normalization operation:

Theorem 4.1. In the binary classification with pseudo-label ˆ y ∈ {0, 1}, if the normalized loss function Lnorm has the local extremum at x∗ , the entropy minimization function LEM also has the local at x∗ , and vice versa.

From Theorem 4.1 (Proof in Appendix A), we demonstrate that simply using pseudo-labels in the normalized loss function could drive the model toward maximizing confidence in its initial predictions ˆ y. This behavior aligns with the EM objective presented in Eq.7. However, we seek to enable the model to explore another option rather than uncritically trusting its initial predictions, which may be incorrect. To do that, we introduce noisy pseudo-labels ˜ y in place of the original pseudo-labels ˆ y within the normalized loss function, in which ˜ y is generated by the flipping procedure described previously, effectively transforming normalized loss function (Eq. 10) to a negative one. This normalized negative loss Lnn for adapting with noisy pseudo-labels is defined as:

As shown in Figure 4 (Appendix C.2), given a normalized loss function with pseudo label Lnorm(x, ˆ y), our normalized negative loss function Lnn(x, ˜ y) with noisy pseudo-label is the opposite of Lnorm(x, ˆ y).

Prior research by [Ma et al., 2020; Ye et al., 2023] has indicated that the normalized loss function suffers from the underfitting problem. This problem is particularly critical in the TTA context where the model only "sees" a few samples during inference. To address this challenge, we incorporate the passive loss function Lp [Ye et al., 2023] into TTA, leading to our NTNL which can effectively help the model to adapt to noisy pseudo-labels:

Definition 4.2. (Passive loss function). Lp is a passive loss function if ∀(x, y) ∈ D, ∃k ̸= y, ℓ(f(x), k) ̸= 0.

4.4 Uncertain Sample Prioritization

To identify which samples should be prioritized during adaptation, we propose a dynamic prioritization strategy that focuses on uncertain samples (i.e., low confidence). Our intuition here is that lower-confidence samples require the model to be considered more carefully. Specifically, we incorporate Focal Loss [Ross and Doll´ar, 2017] into the NTNL function (Eq. 12). Formally, the loss function ℓ(x, ˜ y) is now defined:

where γ controls the rate at which high-confident samples are down-weighted.

The proposed NTNL with Focal Loss enables the model to explore alternative options beyond its initial predictions while dynamically focusing on uncertain samples during adaptation. When combined with EM, we formulate our final adaptation objective function to enhance the adaptation of DF detectors as follows:

where LEM is the entropy of model predictions defined in Eq. 7. By optimizing this objective, our approach achieves robust adaptation that can effectively handle both unknown postprocessing techniques and distribution shifts during inference.

4.5 Gradients Masking

BatchNorm (BN) adaptation [Schneider et al., 2020] is widely used in existing TTA approaches [Niu et al., 2022; Wang et al., 2020]. BN is a crucial layer that normalizes each feature z during training: y = ϱ ∗ ( (z-µb ) σb ) + ϑ, where µb and σb are batch statistics, and ϱ, ϑ are learnable parameters. After training, µema and σema , which are estimated over the whole training dataset via exponential moving average (EMA) [Schneider et al., 2020], are used during inference. When P train (x, y) ̸= P test (x, y), BN adaptation replaces EMA statistics (µema , σema ) with statistics computed from test mini-batches (ˆµb , ˆσb ). However, this approach is limited by only updating BN layer parameters.

To overcome this limitation, we propose a gradient masking technique that identifies and updates parameters whose gradients align with those of BN layers. Let θBNi be the parameter of i-th BN layer, and all BN parameters' gradients are concatenated into a single vector: u = [∇θBN1 L,∇θBN2 L, ...,∇θBNL L], where N is the number of BN layers and ∇θBNi L represents the gradient vector of the loss L with respect to parameters in the i-th BN layer. For each non-BN parameter's gradient vi = ∇θi L in the model, we compute its cosine similarity with the concatenated BN gradients: sim(u, vi) = ⟨vi,u⟩ ||vi||·||u|| .

Note that, since parameter gradients and BN gradient vectors have different dimensions, zero-padding is applied to align dimensions before computing similarity. The final gradient masking is then applied as:

where ψ is a threshold to control the selection of parameters for updating. This technique brings more capacity for adaptation as more model parameters are updated compared to approaches that only update BN parameters during inference [Niu et al., 2022; Wang et al., 2020].

5 Experiments

In this section, we demonstrate the effectiveness of our T2A method when comparing it with state-of-the-art (SoTA) TTA approaches and DF detectors. We also provide an ablation study for our method in Appendix D.1 and an analysis of running time compared to other TTA methods in Appendix D.4.

5.1 Setup

Datasets and modeling

We use Xception [Chollet, 2017] as the source model, which as commonly used as the backbone in DF detectors. The training set is FaceForensics++ (FF++) [Rossler et al., 2019]. To evaluate the adaptability of our T2A method, we use six more datasets at inference time, including CelebDF-v1 [Li et al., 2020b], CelebDF-v2 [Li et al., 2020b], DeepFakeDetection (DFD) [Google, 2019], DeepFake Detection Challenge Preview (DFDCP) [Dolhansky, 2019], UADFV [Li et al., 2018], and FaceShifter (FSh) [Li et al., 2020a]. The dataset implementations are provided by [Yan et al., 2023] and more details are described in Appendix C.

Metrics

We use three evaluation metrics: accuracy (ACC), the area under the ROC curve (AUC), and average precision (AP). For each metric, higher values show better results. Notably, in the DF detection context, datasets inherently exhibit significant class imbalance with fake samples substantially dominating real ones [Layton et al., 2024], the AUC metric is more important as it remains robust to this problem.

Postprocessing Techniques

Following [Chen et al., 2022], we employ four postprocessing techniques: Gaussian blur, changes in color saturation, changes in color contrast, and resize: downsample the image by a factor then upsample it to the original resolution. At the inference time, test samples are applied to these operations with the intensity level increasing from 1 to 5. Details of postprocessing techniques and intensity levels are provided in Appendix C. Note that these postprocessing techniques are unknown to all models.

Baselines

For TTA, we compare our T2A method with SOTA methods, including TENT [Wang et al., 2020], MEMO [Zhang et al., 2022], EATA [Niu et al., 2022], CoTTA [Wang et al., 2022], LAME [Boudiaf et al., 2022], ViDA [Liu et al., 2023a], and COME [Zhang et al., 2024]. For DF detection, we employ the following DF detectors: EfficientNetB4 [Tan and Le, 2019], F3Net [Qian et al., 2020], CORE [Ni et al., 2022], RECCE

[Cao et al., 2022]. Details are provided in Appendix.

Implementation

For adaptation, we use Adam optimizer with learning rate η = 1e - 4, batch size of 32. Other hyperparameters, including loss balancing ones α, β and gradient masking threshold ψ are selected by a grid-search manner from defined values in Table 5 (Appendix). The γ hyperparameter in Eq. 13 is set to 2.0. Details are provided in Appendix C.2.

5.2 Experimental Results

We design the experiments to assess the effectiveness of our method under two real-world scenarios: (i) unknown postprocessing techniques, and (ii) both unknown data distributions and postprocessing techniques. The primary distinction between these scenarios lies in the underlying data distribution assumptions. In the first scenario, we assume that test samples are drawn from a distribution similar to the training data and focus specifically on evaluating our method's resilience when adversaries intentionally employ unknown postprocessing techniques. The second scenario presents a more challenging setting where test samples stem from unknown distributions, allowing us to evaluate not only the method's resilience to postprocessing techniques but also its broader generalization across different data domains.

Comparison with SoTA TTA Approaches

We compare our T2A method with existing TTA approaches, with results presented in Table 1 and Table 2. Table 1 reports results when tested with unknown postprocessing techniques. Each technique is tested across five intensity levels, with the results showing averaged performance metrics. Detailed results for individual intensity levels are provided in Appendix D. The Average column denotes the mean across all postprocessing techniques, providing a holistic view of adaptation capability. We test our method and other TTA approaches on FF++ samples exposed to unseen postprocessing operations. From Table 1, we can observe that our method outperforms existing TTA approaches. On average, T2A improves the source DF detector by 2.93% on AUC. For the more challenging scenario - unknown data distributions and postprocessing techniques, Table 2 shows that T2A achieves SoTA results on 5 out of 6 datasets, including CelebDF-1, CelebDF2, FSh, DFDCP, and UADFV, and the second-best result on DFD dataset.

Adaptability Improvement over Deepfake Detectors

To further demonstrate the effectiveness of our T2A method, we evaluate its capability to enhance the adaptability of DF detectors. We test the performance of DF detectors with and without the T2A method under two scenarios. For the first scenario, Table 3 indicates that: When integrated with T2A, the performance of DF detectors measured by AUC is significantly improved, enhancing the resilience of these detectors against unseen postprocessing techniques. Particularly, our method shows substantial improvements of 4.25% for CORE, 3.86% for EfficientNet-B4, 3.89% for F3Net, and 4.17% for RECCE. Under the more challenging scenario, Table 4 presents results that T2A consistently enhances the generalization capability of DF detectors over unseen data distributions while maintaining robustness against postprocessing manipulations. For example, on the real-world DF benchmark DFDCP, our method improves the performance of RECCE to 8.26%, EfficientNet-B4 to 8%, F3Net to 4.33%, and CORE to 1.46%.

6 Conclusion

In this work, we introduce T2A, which improves the adaptability of DF detectors across two challenging scenarios: unknown postprocessing techniques and data distributions during inference time. Instead of solely relying on EM, T2A enables the model to explore alternative options before decision-making through NL with noisy pseudo-labels. We also provide a theoretical analysis to demonstrate that the proposed objective exhibits complementary behavior to EM. Through experiments, we show that T2A achieves higher adaptation performance compared to SoTA TTA approaches. Furthermore, when integrated with T2A, the resilience and generalization of DF detectors can be significantly improved without requiring additional training data or architectural modifications, making it particularly valuable for real-world deployments. However, since our method is based on backpropagation for updating parameters at inference time, it only works with end-to-end DF detectors that allow gradient flow throughout the model.

Acknowledgments

This publication has emanated from research conducted with the financial support of Science Foundation Ireland under Grant number 18/CRT/6183.