DEF CON 27 AI Village, 2019 — Watch on YouTube
Key themes
How deepfakes are generated: Lyu breaks down the technical pipeline: detect and align a face → extract its identity-invariant features (expressions, head pose) using an encoder → apply those features to a different person's face using a decoder → transform and blend the synthetic face back into the original video. The encoder-decoder architecture is analogous to machine translation: the encoder discards identity (language) while preserving expression (meaning); the decoder projects that expression into a different identity's appearance.
Training is the bottleneck: Training a deepfake model takes 24–36 hours on powerful GPU servers. First-generation deepfakes trained on internet photos (where portraits show closed eyes) had a telltale bias: they rarely blinked, a simple artifact enabling early detection.
Three detection methods:
-
Eye-blinking detection (naive, now obsolete): Early deepfakes couldn't generate realistic blinking because training data lacked images of closed eyes. A simple CNN monitoring eye blinks can detect these artifacts. However, deepfake creators quickly adapted by augmenting training data with closed-eye images or training on video instead of photos.
-
Face transformation artifacts (more fundamental): Deepfake generation requires mapping a generated face (which neural networks understand only in a canonical, frontal orientation) back onto the original video frame (where faces appear at various angles and distances). This geometric transformation leaves traceable artifacts: visible as smooth skin or jagged boundary errors if severe, or detectable through a specialized neural network if post-processed smoothly. These artifacts are more intrinsic to the generation pipeline than eye-blinking bias.
-
Head-pose geometry inconsistencies (most robust): A real person's face moves with their head. When reconstructing a deepfake, creators apply a 2D image transformation instead of simulating 3D head rotation, creating a measurable mismatch between head orientation estimated from the face alone vs. from the whole head. This geometric inconsistency is detectable even when the face itself appears natural and is harder to correct without complete re-synthesis.
Audio deepfakes are advancing rapidly: Beyond video, voice-synthesis technology can now convincingly recreate specific speakers. Lyu demonstrates a synthesized podcast host's voice indistinguishable from the original to casual listeners. Audio deepfakes present a complementary threat if combined with video deepfakes.
Obfuscation through adversarial perturbations (a proactive defense): Rather than only detecting deepfakes after creation, Lyu proposes defending against deepfake creation itself. Since automatic face detection is foundational to deepfake generation, he developed an algorithm that adds imperceptible adversarial noise to images. When a user uploads a photo to social media, an optional privacy checkbox applies this perturbation: the image remains visually identical to human eyes, but face detectors either fail to locate any face or return false positives. This forces deepfake creators to manually extract faces—tedious, exhausting work that slows industrialized deepfake production from seconds to hours per dataset. The strategy is: not to eliminate deepfakes (impossible—Pandora's Box already open) but to raise the barrier sufficiently that only well-resourced actors can produce them.
A cat-and-mouse dynamic: Lyu acknowledges that as detection techniques advance, generation techniques follow. His published papers enable adversaries to understand and counter his defenses. However, detection and obfuscation research serves society: even if countermeasures eventually exist, each round of defense buys time and raises costs for malicious actors.
Notes
A technically sophisticated talk that explains deepfake generation clearly for a general audience. Lyu's emphasis on attacks that are intrinsic to the synthesis pipeline (rather than surface-level heuristics) is valuable: eye-blinking detection was quickly defeated, but head-pose geometry is harder to correct without complete re-synthesis. The adversarial perturbations section is particularly novel—shifting from purely defensive (detection) to proactive (obfuscation) and raising the barrier to deepfake creation. Lyu's acknowledgment of the arms race dynamic and the eventual erosion of any single detection method is honest about the limitations of technical defenses alone. The talk makes clear that media forensics, platform design, legislation, and media literacy must work together to mitigate deepfakes' harms.