Deepfake Detection Is Measuring the Wrong Thing

Point a camera at a face and watch only the green channel. In a living person it carries a fluctuation well under one percent, a slow ripple that rises and falls with the heartbeat as blood moves through capillaries near the skin. That ripple is the basis of remote photoplethysmography, one of the more elegant ways to separate a synthetic talking head from a human one: a generator can copy skin texture, lighting, and lip motion, but nobody teaches it to fake a pulse.

The signal is faint enough that ordinary video compression treats it as noise and quantises it away. Detectors built on it score well on curated test sets and then fall apart once a file has been dragged through a messaging app, re-encoded, resized, and reposted. That small failure describes where deepfake technology actually stands in October 2026 more cleanly than any of the loud statistics, and it points somewhere different from where most people have arrived.

The dominant story says fakes are approaching perfect fidelity, that truth is collapsing, and that the answer is better AI detectors. I'd disagree with both halves of the diagnosis. The detection numbers quoted in press releases are measured on a distribution that doesn't exist in the wild, and the fraud doing real damage this year mostly doesn't leave a file behind for a detector to examine.

How a Face Gets Replaced in the First Place

The classic face swap is an autoencoder trick, and it's worth understanding because the artifacts it leaves behind shaped an entire generation of detectors. Two networks work in tandem: an encoder that compresses any face into a shared latent representation, and a decoder trained to reconstruct one specific identity from that representation. Train the encoder on both faces, attach a decoder per identity, and you can push person A through person B's decoder. The output gets warped onto B's facial landmarks, then blended at the edges with gradient matching so the seam doesn't flare.

Modern systems add a refiner, usually a GAN or a diffusion model, whose job is to clean up the low-resolution swap and re-render it with plausible pores and shadows. Real-time versions for video calls skip the expensive parts: a lightweight landmark tracker, a warped source frame, and a neural renderer running at thirty frames a second on a consumer GPU. Lip-sync is a separate module conditioned on the phoneme sequence of the audio, which is why the mouth shapes match the speech even when a human is driving the rest of the face.

Voice cloning followed the same cost curve. A text-to-speech stack or a voice-conversion model extracts a speaker embedding from a reference clip, then a vocoder renders a waveform carrying that person's timbre. What once required hours of clean studio audio now needs a handful of seconds lifted from a podcast or a voicemail greeting. The generative part is cheap, and the distribution part is free. That combination, rather than visual fidelity, is what changed the risk profile.

Detection Is a Physics Problem, Not a Vibe Check

Forensic detection doesn't look for the uncanny. It looks for evidence of the process that made the image, and every method in service today is a proxy for a specific mechanical cause. Generators upsample feature maps, and the interpolation leaves periodic traces in the frequency domain, so spectral analysis can flag a checkerboard signature no human eye will register. Camera sensors imprint a noise pattern from manufacturing imperfections, so a file with no sensor fingerprint at all is suspicious on that basis alone.

Video adds temporal tells. Optical flow between frames should be smooth and physically consistent, while swaps produce micro-jitter at the jaw and hair boundaries and blending masks leave a faint gradient discontinuity around the face. Blood-flow analysis works only when the signal survives compression. Audio leans on different physics: breath, room tone, and the micro-pauses of natural speech follow patterns that synthesis struggles to reproduce, and voice conversion often leaves spectral smearing and unnaturally stable pitch contours.

Read down the right-hand column and the pattern is obvious. Every forensic channel is defined by a generator's mistake, and a mistake only stays a mistake until someone ships a fix. A detector doesn't learn what a human face is. It learns what one family of models got wrong in the year its training set was assembled.

The Benchmarks Come From a Distribution That Doesn't Exist

Published vendor benchmarks in 2026 claim average accuracies of 95.8% on images, 98.2% on video, and 99.5% on audio. Those figures are usually measured against files produced by generators the model trained alongside, on datasets assembled by the same team that built the detector. A 2026 preprint on generalization reports what happens when you separate the two properly: the best general-purpose detectors, tested on identities never seen in training, land near an AUC of 0.806 with an equal error rate around 28%. At the threshold where false accepts and false rejects balance, that means roughly three decisions in ten are wrong.

The gap between those numbers is the entire story. Same model, same task, different test set. The 28% figure tells you far more about deployed detection than any 98% claim, because deployed detection runs on media that has been through a camera, an encoder, a platform, and three people's phones.

There's a second problem, and it's arithmetic rather than machine learning. Take a review queue of a thousand items containing ten fakes, a 1% base rate that is generous for most corporate intake. A human reviewer working at the 55.5% accuracy reported in a meta-analysis of 56 studies, split for argument's sake into 60% sensitivity and 55% specificity, catches six fakes and clears four. Against the 990 genuine items, the same reviewer raises 445 false alarms. Of the 451 items flagged, six are actually fake, so precision sits at about 1.3%. The filter that looks like it works on a balanced benchmark behaves like a machine for generating investigations at a realistic base rate.

That's the argument for pulling standalone classifiers out of the decision loop and wiring them to a hard rule, which is a workflow problem before it's a model problem. The same imbalance appears whenever a model's speed gains get pushed into an unchanged process, as in AI Made You 10% Faster. The 10x Hides in Your Workflow. A detector running at 72% attached to a human running at 55% produces a queue nobody can clear. Attached to a rule like "this payment does not move until the requester is verified on a second channel," it produces a control that holds.

The Fraud That's Landing Doesn't Produce a File

The FBI's Internet Crime Complaint Center added AI fraud as a standalone category for the first time in 2025 and recorded $893.3 million in losses across 22,364 complaints. Entrust's tracking puts deepfakes at roughly one in five biometric fraud attempts as of late 2025. A Gartner survey of 302 organizations, fielded in September 2025, found that 62% had experienced a deepfake attack in the previous twelve months.

Almost none of that traffic looks like a cinema-grade fake. It looks like a phone call from a voice that sounds like the finance director, or an identity check where a face is injected into a laptop camera feed. In both cases there's no file to seize and no metadata to inspect, because the synthetic content is generated live and consumed in real time. Detection products that classify uploaded media are structurally blind to the most common attack, and the same holds for provenance systems, which can only sign what was captured by a camera that signs.

The controls that work here are unglamorous and mostly procedural: callbacks to numbers already on file rather than numbers supplied by the requester, challenge-response where the person is asked to do something specific on camera, device binding so a login from a new machine takes a different path, and payment rules that treat any voice instruction as unverified by default. None of that requires a model. All of it requires someone to accept that the artifact can't be trusted, and to move the trust somewhere else.

Provenance Moves the Decision to the Sensor

C2PA is the most serious attempt to move trust upstream. The standard, founded in February 2021 by Adobe, Arm, the BBC, Intel, Microsoft, and Truepic, embeds a cryptographically signed manifest inside the file. The manifest carries assertions about who made the content and how, hashes of the asset and of its ingredients, and a signing certificate anchored in a trust list. Verify the signature and you learn where the file came from, not whether it depicts something true, a distinction the specification is careful to make and which most commentary glosses over.

Adoption has moved from press releases into firmware. Nikon, Sony, and Leica ship signing in camera bodies, which means a photojournalist can produce a file whose provenance is checkable at capture. Adobe writes credentials through its editing tools, and the Associated Press, Reuters, and the BBC sign inside editorial workflows. The UK's Department for Science, Innovation and Technology published research and analysis on deepfake detection technology in March that treats provenance and statistical detection as complementary layers rather than rivals, which is the right framing.

The gaps are structural. The overwhelming majority of the world's images and video are still captured on phones without hardware-level signing, then reshared through pipelines that strip metadata, screenshot the frame, or squeeze it to a few hundred kilobytes for a group chat. A formal-methods security analysis of the C2PA specification posted in April concluded that the current version fails to achieve its stated security goals and shouldn't carry high-stakes use yet. Watermarks and soft bindings are supposed to survive that abuse, and they degrade under compression in ways nobody has fully characterised.

Trusted Capture on Cheap Hardware Is Still Unsolved

Which leaves the open problem, and it's an engineering problem with a governance problem bolted to it. To sign a capture you need a key that lives somewhere the operating system can't read, an attested path from the sensor to that key so the signature describes actual photons, and a certificate that the platform on the other end will accept. That is shippable on a professional camera body. It is much harder on a $150 phone sold in markets where messaging apps rather than browsers are the primary distribution channel, and where the first thing that happens to any file is a re-compress.

Trust lists are the second half of it. Someone has to decide which signing certificates count, how they get revoked when a device is compromised, and what a platform does with a file carrying a valid signature but a false claim. No consortium currently holds the authority to make those calls binding across Apple, Google, Meta, and the Chinese handset makers at once, and a provenance system with four incompatible trust lists is a provenance system most viewers will ignore.

So the unresolved question is narrow and practical. Can anyone build a signed capture path that survives a screenshot, a re-upload, and a lossy transcode, on commodity hardware, under a trust list the major platforms will actually honour? Until that ships at scale, detectors will keep winning the benchmarks their makers build and losing the cases that cost money, because the moment that matters most is now a live call arriving with no file to examine.