Domain-Augmented Meta-Learning for

Generalizable Deepfake Detection

[Link]. [Link]
Department of Science and Technology, Department of Science and Technology,
G H Raisoni Institute of Engineering and G H Raisoni Institute of Engineering and
technology, Nagpur, India technology, Nagpur, India
[Link]@[Link] [Link]@[Link]

Abstract: Deepfakes, media manipulated using deep learning techniques, pose a growing threat to the
integrity of digital content. These AI-generated forgeries are becoming increasingly sophisticated,
making them difficult to detect. Traditional detection methods often lag behind the rapid evolution of
deepfake techniques and are hampered by the limited variety of training data, making it hard for them
to generalize effectively to new types of deepfakes. This thesis introduces a novel deepfake detection
approach that combines meta-learning for domain generalization (MLDG) with selfblended images
(SBI) to address this challenge. MLDG, inspired by meta-learning principles, aims to improve the
model’s adaptability to new manipulation techniques by simulating domain shifts during training. The
model learns from various source domains representingdifferentdeepfakegenerationmethods.
Additionally, SBIs, syntheticimages created by blending real and manipulated faces, are incorporated
to further diversify the training data and promote the learning of features that generalize across
domains. This thesis focuses on detecting image-based deepfakes using the FaceForensics++ dataset, a
benchmark collection of real and manipulated videos, specifically designed for deepfake detection
research. The proposed method is evaluated with a leave-one-out cross-validation scheme on this
dataset, where each deepfake generation technique is used as a test case while the others are used
for training. The results consistently show that MLDG, when enhanced with SBIs, outperforms the
standard Empirical Risk Minimization (ERM) method, demonstrating its effectiveness in generalizing to
unseen manipulation techniques. The research offers a practical solution for deepfake detection,
highlighting how MLDG and SBI augmentation can create more effective and adaptable detection
systems. The findings emphasize the need for models that can adapt to evolving deepfake techniques
to protect the integrity of digital media.

I. INTRODUCTION
In recent years, the fast-paced development of deepfake generation technology have posed
considerable challenges to deepfake detection methods, necessitating the need for more resilient and
adaptable approaches. Deepfake detection typically relies on distinguishing patterns between
manipulated and authentic media using machine learning models trained on specific deepfake
techniques. However, these models struggle to generalize to new, unseen types of deepfakes (Malik et
al., 2022). Research into deepfake detection has started to focus on improving adaptability across
various manipulations (Sun et al., 2021; Z. Wang et al., 2023), aiming at robust detection even when
faced with novel deepfakes. Despite these efforts, there is still a significant gap in model performance
against the latest deepfake technologies, often evading current detection methods (Le et al., 2024).

One potential approach to address the limited generalizability of deepfake detectors to unseen
manipulation methods would be to leverage a meta-learning framework designed for domain
generalization, combined with data augmentation techniques. A meta-learning approach enhances
generalizability by mimicking exposure to new manipulations, helping the model learn features that are
consistent across different deepfake generation techniques. Furthermore, data augmentation
techniques can expand the diversity of training data, further improving the model’s generalizability.

The goal of this thesis is to evaluate the efficacy of a novel deepfake detection approach that integrates
Meta-Learning for Domain Generlization (MLDG) (D. Li et al., 2017b) with Self-Blended Images (SBIs)
(Shiohara & Yamasaki, 2022) augmentation strategy. This evaluation will focus on assessing the model’s
ability to generalize to unseen deepfake generation techniques and improve overall detection
robustness compared to a baseline method.

The evaluation will be conducted through a rigorous experimental setup using the

FaceForensics++ (Rössler et al., 2019) dataset. The performance of the proposed model will be assessed
using a leave-one-out cross-validation scheme, where it is trained on data from multiple deepfake
generation methods and tested on unseen ones. The results will be compared with a baseline model
trained with Empirical Risk Minimization (ERM) (Vapnik, 1999) to determine the effectiveness of the
proposed MLDG + SBI approach.

This thesis focuses only on the detection of video deepfakes, specifically those involving facial
manipulations. Audio deepfakes, while a growing concern, are beyond the scope of this work.
Moreover, the proposed detection strategy is primarily image-based, analyzing individual frames
extracted from videos rather than incorporating temporal information. This choice allows for a focused
exploration of domain generalization techniques applied to facial manipulation detection.

The remainder of this thesis is organized as follows. Chapter 2 defines meta-learning by formalizing the
concepts behind it and presenting different meta-learning algorithms. Chapter 3 introduces domain
generalization, discussing various techniques aimed at improving generalization of models to unseen
domains, together with detailing the MLDG algorithm. Chapter 4 explores deepfakes, detailing various
generation techniques, and surveys modern deepfake detection methods, discussing their strength and
limitations. Chapter 5 details the experimental part of this thesis by introducing the proposed deepfake
detection framework in detail, as well as detailing the experimental setup used.

II. RELATED WORK

 Traditional machine learning models have a few key limitations; notably, they require extensive
labeled datasets for effective learning. In many practical domains, such as deepfake detection against
novel generation methods, collecting extensive labeled datasets is challenging. It can be expensive, time
consuming, or sometimes impossible (Prince, 2023). Real-world scenarios often involve encountering
new or evolving tasks. Think of a facial recognition system that needs to adapt quickly to identify people
wearing masks (Batagelj et al., 2021), or a spam filter that learns to detect new types of phishing emails
(Alhogail & Alsabih, 2021). Even within the same task, the characteristics of the data can change subtly
over time. This could be due to factors such as changes in image style in image classification tasks or
variations in language used in natural language processing tasks, leading to performance degradation in
traditional models.

Formalization of Meta-Learning

Hospedales et al. (2020) formalizes meta-learning through two distinct views: taskdistribution view and
bi-level optimization view.

In Finn et al. (2017), a learning task is formalized in a flexible way to accommodate various learning
problems, such as supervised learning and reinforcement learning.
Each task T = {L(𝜃, D), 𝑝(x1), 𝑝(x𝑡+1|x𝑡, y𝑡), 𝐻}, where L is the loss function that takes the model
parameters 𝜃 and a dataset D as input, 𝑝(x𝑡+1|x𝑡, y𝑡) is the transition distribution, and 𝐻 is the episode
length. In supervised learning problems, such as classification, 𝐻 = 1 and the dataset D is composed of
labeled input and output pairs.

The task-distribution view conceptualizes the meta-learning process as optimizing the meta-knowledge
𝜔 which is the cumulative knowledge derived from multiple tasks. 𝜔 is often represented as a
multidimensional vector that holds the accumulated knowledge gained from the meta-training process.
This meta-knowledge can include models, initial parameters, hyperparameters, or learning algorithms
that allow effective learning on a variety of tasks T𝑖 drawn from a distribution of tasks 𝑝(T ). Compared to
Finn et al. (2017), Hospedales et al. (2020) defines a task more loosely. Each task T𝑖 comprises a dataset
D⟩ and a corresponding loss function ℓ𝑖. This view highlights the model’s ability to quickly adapt to new
tasks that come from the same distribution. The goal is to develop a generalized learning strategy
through meta-learning enabling the model to perform well on unseen tasks with minimal additional
training data. Importantly, the meta-knowledge must be carefully balanced: if it is too specific to the
source tasks, it can lead to meta-overfitting, hindering performance on new tasks (Hospedales et al.,
2020).
 Figure 2.1: Schema for meta-learning

Meta-learning methods
Meta-learning algorithms have traditionally been categorized into three categories: black-box or model-
based methods, metric-learning methods, and optimization-based methods (Hospedales et al., 2020).

Model-based meta-learning methods focus on building an internal representation of the learning

process for a task. This internal state, often referred to as an activation state, captures the essential
information extracted from the task’s dataset. Neural networks, particularly recurrent networks (RNNs)
or transformer networks, are used to process these data and generate the internal state. As highlighted
by Munkhdalai and Yu (2017) and Mishra et al. (2017), such networks allow training data to be fed
sequentially, making them well suited for this purpose. The key advantage of this approach lies in its
utilization of the internal state during adaptation to a new task. Unlike other methods, the adaptation
process is embedded within a single feed-forward pass through the network. The model retrieves
relevant information from the internal state, which is informed by the training data of past tasks, to
initialize its parameters, or to guide the learning process for the new task. This significantly simplifies the
outer-level optimization compared to approaches that require separate inner-loop updates (Hospedales
et al., 2020). While model-based methods offer advantages in data efficiency, particularly in few-shot
learning scenarios, a potential limitation lies in their ability to generalize to tasks significantly different
from those encountered during training. The internal representation, while powerful, may not be
flexible enough to adapt to entirely new learning distributions, as noted by Hospedales et al. (2020).
Furthermore, these methods might struggle to embed very large datasets into a rich representation,
potentially hindering their performance on complex tasks.

MAML
Unlike previous approaches that relied on training complex recurrent networks or task-specific feature
embeddings, the work by Finn et al. (2017) introduced a novel optimization based approach called
Model-Agnostic Meta-Learning (MAML). MAML stands out for its ability to train any standard model
architecture through meta-learning. This flexibility allows the model to be prepared for rapid
adaptation, regardless of its specific structure. The core concept behind MAML is the notion of
transferable internal representations (Finn et al., 2017). The goal is to encourage the model to learn
features that are broadly applicable to diverse tasks within a given distribution, rather than specific to
individual tasks. MAML aims to find an initialization 𝜃 that is highly responsive to task variations. This
means that small parameter adjustments, based on the gradients of the loss function, can significantly
enhance performance on new tasks from the same distribution (Finn et al., 2017). The power of MAML
lies in its simplicity and generality. It makes minimal assumptions about the specific model architecture,
requiring only that it be parameterized by some vector 𝜃 and employ a smooth loss function that allows
gradient-based optimization. The training process starts with drawing 𝑀 meta-training tasks, labeled T𝑖,
D
from a task distribution P(T ). Again, each task T𝑖 contains a dataset D𝑖 from which two disjoint sets 𝑖train
D test
and 𝑖 are

sampled. Each dataset contains 𝐾 input-output pairs such that D𝑖train/test = {(𝑥𝑖𝑘, 𝑦𝑖𝑘}𝐾𝑘=𝑖.

Given a sampled task T𝑖, the inner loop focuses on adapting the initial model parameters
𝜃 using the support set D𝑖train for that specific task. One or few gradient descent steps are performed to
obtain task-specific parameters (Finn et al., 2017).

𝑖′ ← 𝜃 − 𝛼∇𝜃LT𝑖 (𝜃, D𝑖train) (2.4)

𝜃

Here, 𝛼 is the inner-loop learning rate and LT𝑖 represents the loss function for task
T𝑖. Intuitively, the inner loop here aims to adjust the initial parameters towards a local minimum suitable
for the specific task at hand. In the case of discrete classification tasks using a cross-entropy loss, the
loss function for T𝑖 becomes (Finn et al., 2017).

(︃ )︃
∑︂ ( 𝑗) ( 𝑗) ( 𝑗) ( 𝑗)
𝐿T𝑖 ( 𝑓𝜙) = 𝑦 log 𝑓𝜙(𝑥 ) + (1 − 𝑦 ) log(1 − 𝑓𝜙(𝑥 )) (2.5)
𝑥(𝑗),𝑦(𝑗)∼T𝑖

The updated parameters (𝜃𝑖′) from each task are evaluated on the corresponding query set (D𝑖test) to
compute a meta-loss, which captures how well the model performs after the inner-loop adaptation on
each task. The outer layer leverages the meta-loss to update the initial parameters 𝜃 in such a way that
promotes good adaptation in all tasks. The update can be formulated as (Finn et al., 2017):

𝜃 ∑︂ 𝑖 𝑖′ 𝑖test) (2.6)
𝜃 ← 𝜃 − 𝛽∇ L T (𝜃 , D
T𝑖∼𝑝(T )

where 𝛽 is the meta-learning rate. The outer loop guides the learning process towards an initialization 𝜃
that allows efficient adaption with minimal inner-loop updates when encountering new tasks. The
choice of learning rates 𝛼 and 𝛽 is critical, as they significantly influence the adaptability of the model
and the overall performance in new situations (Finn et al., 2017).
Challenges in Meta-Learning
Meta-learning excels within well-defined task distributions. However, several challenges remain,
particularly in handling diverse task distributions, mitigating meta-overfitting and ensuring
generalizability to unseen scenarios.

Meta-learning frameworks often assume a unimodal task distribution, but real-world scenarios
frequently involve multimodal distributions where tasks may require distinct learning strategies
(Hospedales et al., 2020). The authors also identify two unique generalization challenges meta-learning
poses: generalizing to novel tasks from the same distribution and generalizing to tasks from different
distributions. In the former case, the limited number of meta-training tasks creates difficulties, and
techniques to prevent meta-overfitting in few-shot scenarios will become crucial. Meta-overfitting can
happen when the model performs well on meta-training tasks, but struggles to generalize to unseen
tasks. This can be caused by memorization (Yin et al., 2019) instead of learning a generalizable
adaptation strategy, the model memorizes how to solve meta-training tasks directly. The latter case is
an inevitable issue in many practical settings. For example, in a few-shot image classification task, the
model might struggle to generalize from ImageNet (Krizhevsky et al., 2012) images used in the training
data to a more specialized field like medical images. Approaches involving regularization, transfer
learning, and domain generalization have been explored to address this domain shift issue (Hospedales
et al., 2020).

Optimization-based meta-learning methods (Finn et al., 2017; Z. Li et al., 2017) can be computationally
intensive and memory-hungry. Research focuses on scaling these methods to many-shot learning and
larger parameter spaces. Strategies trying to solve the limitations include implicit differentiation
(Rajeswaran et al., 2019), forward-mode differentiation (Franceschi et al., 2017), and online methods (Y.
Li et al., 2019), each offering different trade-offs for efficiency and accuracy (Hospedales et al., 2020).

Despite these challenges, meta-learning offers a powerful paradigm for learning across a range of tasks.
Importantly, the challenges faced by meta-learning share common ground with the domain shift
problem encountered in traditional machine learning. In domain generalization, the goal is to train a
model on source domains that can perform robustly on target domains with potentially different
underlying data distributions. The next chapter introduces domain generalization more closely and
explores techniques that could potentially be used to address the generalization challenges in meta-
learning.
III. Domain Generalization
Even the most advanced machine learning models can struggle when faced with data that differ in
distribution from their training data: a phenomenon known as domain shift (Zhou et al., 2021).
Traditional machine learning methods usually assume that training and testing data are independent
and identically distributed (i.i.d.) from the same source. However, this assumption often does not hold
true in practical applications. For example, an image classifier trained on images of objects might
struggle to accurately classify cartoons or sketches of the same objects (D. Li et al., 2017a). Similarly, a
medical image segmentation model might perform poorly when used to analyze images taken with
different equipment (Liu et al., 2020) or a deepfake detection model trained on images created using
current deepfake generation methods that fail when encountering new manipulation techniques. This
highlights a key challenge: the performance of machine learning models degrades when they encounter
data that deviate from their training distribution (Hendrycks & Dietterich, 2019). In some cases, these
performance drops can have serious consequences. Miss-classification due to domain shift can create
cascading errors in complex systems or even amplify existing biases in the data, leading to unfair
outcomes (Pham et al., 2023). Obtaining data that anticipate every possible shift is impractical, if not
impossible, making it vital to explore alternative solutions.

Domain generalization tackles the problem of domain shift head on. The main objective of domain
generalization is to create models that perform well on unseen domains. Unlike transfer learning, meta-
learning, or domain adaptation, domain generalization seeks to accomplish this without using any data
from the target domains during training.

ERM

Empirical Risk Minimization (ERM) (Vapnik, 1999) is a key concept in machine learning, especially in
supervised learning, where the objective is to minimize the average prediction error over a given
dataset. This method has been widely adopted as a robust baseline in domain generalization research
due to its simplicity and effectiveness in handling diverse data distributions (Gulrajani & Lopez-Paz,
2020).

ERM involves minimizing the loss over a training dataset to identify the optimal predictor or model that
reduces the prediction error for unseen data. It seeks to minimize empirical risk, which is defined as the
average loss calculated over all training samples. Formally, for a predictor 𝑓 : 𝑋 → 𝑌, and a loss function
ℓ : 𝑌 × 𝑌 → [0, ∞], ERM can be expressed as:

𝑛
1 ∑︂

argmin ℓ( 𝑓 (𝑥𝑖), 𝑦𝑖) (3.1)

 𝑓 𝑛 𝑖=1 , where

(𝑥𝑖, 𝑦𝑖) are the training samples.

In domain generalization, the challenge is not only to perform well on the training data but also to
generalize effectively across various unseen target domains. ERM serves as a fundamental strategy in
this context, training a model on aggregated data from multiple source domains to minimize the overall

distributions follow an underlying hyper-distribution P, represented as 𝑃𝑋𝑌 ∼ P.

training loss. This approach assumes that both the potential target domain distributions and the source

Methodologies
J. Wang et al. (2021) categorizes domain generalization methods into three primary groups: data
manipulation, representation learning, and specific learning strategies.

Data manipulation
In the context of domain generalization, data manipulation involves modifying or generating new input
samples to increase the diversity of training domains (Zhou et al., 2021). The goal is to improve the
model’s ability to perform well on unseen domains by increasing both the diversity and the number of
data samples available during training.

Formally, the process can be represented as the transformation of the original data pairs
(𝑥, 𝑦), where 𝑥 is the input and 𝑦 is the label, into new pairs (M(𝑥), 𝑦), using a function M(·) to
manipulate the input data (Zhou et al., 2021). Data manipulation can be broadly categorized into two
main approaches: data augmentation and data generation. Both techniques are often computationally
efficient and straightforward to implement, making them a valuable tool for domain generalization (J.
Wang et al., 2021).

Data augmentation Data augmentation techniques have a long history in machine learning (I. J.
Goodfellow et al., 2016). Classical methods include applying a simple transformation function A(·), such
as flipping, rotating, scaling, cropping, adding noise, or altering color distributions (Shorten &
Khoshgoftaar, 2019). These transformations help simulate the natural variations that a model might
encounter in the real world. The choice of transformations should be tailored to the specific problem
and the task at hand. Object recognition (Wu et al., 2015) may focus on color and geometry changes,
while medical imaging L. Zhang et al. (2020) might focus on simulating device-related domain shifts.

Beyond basic transformations, domain randomization (Tobin et al., 2017) implements a wider range of
alterations. It can involve modifying the location and texture of objects within the images, changing
lighting conditions, and varying the camera perspectives used to capture the data (J. Wang et al., 2021).

Representation learning
J. Wang et al. (2021) divides representation learning-based methods into two subcategories: domain-
invariant representation and feature disentanglement methods.

Domain-invariant representation A significant portion of existing domain generalization approaches fall

under the category of domain alignment (Zhou et al., 2021). The core principle of domain alignment is to
minimize the discrepancy between representations extracted from different source domains, with the
goal of learning features that are invariant to domain shifts. The underlying logic is that features that
remain consistent despite variations within the source domains are more likely to be robust to unseen
target domains experiencing similar shifts (Zhou et al., 2021). To quantify the difference between
distributions and achieve alignment, various statistical distance metrics such as L2 distance or
Wasserstein distance can be utilized.

Learning strategy
Beyond data manipulation and representation learning, domain generalization can also be approached
through general machine learning strategies (J. Wang et al., 2021). Two prominent strategies are
ensemble learning and meta-learning. Ensemble learning takes advantage of the strengths of multiple
diverse models, aiming to create a robust and unified predictor. Meta-learning, on the other hand,
adopts a ’learning-to-learn’ approach. It simulates domain shifts within its training process to acquire
knowledge that is effectively generalized across different distributions (J. Wang et al., 2021).

Ensemble learning Ensemble learning aims to reduce the generalization gap between training and test
data (Prince, 2023). At its core, the method trains multiple models and combines their predictions. For
regression tasks, this could involve averaging outputs or taking the median, while for classification, the
process could involve averaging pre-softmax activations or finding the most frequently predicted class.
This approach uses the assumption that various models may make different errors, and combining their
predictions can reduce individual shortcomings and improve robustness (Prince, 2023).

Ensemble learning offers distinct advantages within domain generalization. It leverages the relationships
between different source domains through carefully designed network structures and training
strategies. This approach recognizes that a single sample might contain characteristics drawn from
multiple source domains. Consequently, combining predictions from models specialized in these
domains leads to more robust and generalizable results (J. Wang et al., 2021).

Zhou et al. (2020) introduce Domain Adaptive Ensemble Learning (DAEL), where domain-specific
classifiers are trained collaboratively with a shared feature extractor, promoting knowledge transfer and
adaptation to unseen domains. DAEL builds on the concept of domain-specific neural networks,
emphasizing efficiency through shared feature extraction layers (Zhou et al., 2021).

In another approach, Segu et al. (2020) propose an approach using domain-dependent batch
normalization (BN), where separate BN statistics are maintained for each source domain. During
inference, predictions are weighted based on how close the feature statistics of a test sample are to the
batch normalization (BN) statistics of the source domain. (Zhou et al., 2021).

Meta learning A key aspect of using meta-learning in domain generalization is its ability to simulate
domain shifts during the training process with the aim of learning parameters that encode generalizable
knowledge (Zhou et al., 2021). The design of effective meta-learning algorithms for domain
generalization is connected with two vital components: episode construction and meta-representation
(Zhou et al., 2021).
IV. Deepfakes
The ease of creating digital media and the widespread use of social media have led to an explosion of
images and videos online. While this offers unprecedented opportunities for communication and
expression, it has also opened the door to sophisticated deep learning-powered manipulation
techniques (Malik et al., 2022; Masood et al., 2021). A particularly alarming development is the
emergence of deepfakes—extremely realistic videos, images, and audio created using artificial
intelligence, which can persuasively portray people saying or doing things they have never actually done
(Yu et al., 2021). The term ’deepfake’ emerged around 2017, named after a Reddit user who used deep
learning to superimpose celebrities’ faces on videos (Malik et al., 2022). Since its inception, the range of
deepfakes has expanded to include both audio and image-based forgeries. These deepfakes pose a
serious threat, blurring the line between genuine and manipulated content, and potentially eroding
public trust in digital media (Masood et al., 2021).

The potential consequences of deepfakes are far-reaching. They can be used to spread disinformation
(Satariano & Mozur, 2023), manipulate political campaigns (Meaker, 2023) and damage reputations
(Mustak et al., 2023) (Masood et al., 2021; Yu et al., 2021). As deepfake generation techniques become
increasingly sophisticated, the challenge of distinguishing authentic media from manipulated content
only crows (Masood et al., 2021). This highlights the critical need for robust deepfake detection
methods to maintain the integrity of information in the digital space.

This chapter focuses on image- and video-based deepfakes, examining the various techniques used to
create deepfakes and the cutting-edge methods researchers are developing to expose these
manipulations.
Figure 4.1: Face Swapping using encoder-decoder pairs. Image from Thies et al. (2016)

Deepfake generation
Malik etal. (2022) conducted a comprehensive reviewofdeepfakes, outlining ataxonomy of various
generation techniques.

Face Swapping Deepfakes involving the replacement of one person’s face with another’s are often
referred to as face swapping or identity swapping. Deep learning architectures, such as autoencoders or
GANs, are commonly employed for this task, often utilizing two encoder-decoder pairs. The model
architecture involves training two separate autoencoders, each on a distinct dataset: one dataset
consists of images containing Face A, while the other comprises images containing Face B. During the
face swapping process, both encoders first extract latent representations from their respective input
sources. Then the latent representation of Face A is fed into the decoder trained on Face B. This forces
Decoder 2 to reconstruct an image using the features and structure of Face A, but with the learned style
and characteristics associated with Face B. The resulting output is a hybrid image in which the identity of
Face B is transposed onto the underlying structure, pose, and expressions of Face A, producing a
convincing deepfake (Masood et al., 2021).

Face Reenactment In face reenactment, the facial expressions and movements of a target person are
altered to mimic those of a source individual (Malik et al., 2022). Unlike face swapping, which replaces
the entire face, this method keeps the person’s original identity intact, changing only specific elements
like expressions or how their lips move. Face2Face (Thies et al., 2016) and Neural Textures (Thies et al.,
2019) are examples of video-based reenactment methods that can create convincing videos of
individuals performing actions or speaking words they never actually did.

Although face reenactment can be used for positive things in entertainment, such as dubbing or special
effects, it also has the potential for harm. This technology could be used to create misleading videos of
public figures, potentially fueling the spread of false information or propaganda. This can lead to
confusion and damage people’s trust in what they see online. In the future, as technology improves, we
might even see full-body reenactment videos, making it even harder to tell real from fake (Masood et
al., 2021).

Facial attribute manipulation Facial attribute manipulation is a technique that enables the alteration or
enhancement of specific features within images or videos of faces (Masood et al., 2021). These
modifications can range from straightforward adjustments like changing eye color or adding facial hair,
to more complex transformations involving alterations to perceived age, gender, or skin tone (Malik et
al., 2022).

Early methods, such as the work by Lample et al. (2017), focused on image-to-image translations that
utilized separate generators for each attribute pair. However, advances like StarGAN (Choi et al., 2017)
have introduced the ability to handle multiple attribute changes using a single generator, improving
efficiency and flexibility.

These tools find applications in the entertainment industry for tasks such as altering the appearance of
actors to fit different characters or ages (Masood et al., 2021). They have also become popular on social
media platforms, where users can playfully and creatively modify their appearance using various filters
and editing tools.

Facialsynthesis Unlikeothertechniquesthatmanipulateexistingfaces, facialsynthesis generates

completely new, lifelike images that can pass as real (Malik et al., 2022). Generative models, particularly
Generative Adversarial Networks (GANs), such as StyleGAN (Karras et al., 2019), are often employed to
achieve this. Rather than directly changing pixels, these models typically operate by manipulating a
latent space that controls various aspects of facial creation, including pose, expression, and identity
(Masood et al., 2021). This approach has found applications in fields like entertainment, where realistic
characters can be generated for films and video games. However, it

Figure 4.2: Example of Face Reenactment. Image from Masood et al. (2021)

also raises concerns about potential misuse, such as the creation of fake identities for deceptive
purposes on social media (Masood et al., 2021).

Deepfake detection
As deepfake technology has become more advanced, the quality and realism of manipulated content
has increased significantly (Malik et al., 2022). This poses ongoing challenges in detecting these
increasingly convincing deepfakes. It is crucial to develop more sophisticated detection methods that
can reliably identify various types of manipulations. This section examines various deepfake detection
strategies, focusing on the development of methods that are robust and adaptable to different deepfake
generation techniques and real-world scenarios.

Recent surveys on deepfake detection techniques (Le et al., 2024; Malik et al., 2022;

Yu et al., 2021) showcase a wide range of methods for detecting manipulated content. Le et al. (2024)
categorizes deepfake detection techniques into three main groups. The first group, spatial artifact-based
detection, focuses on analyzing individual image frames or video frames to identify inconsistencies
within them. The second group, temporal consistency-based detection, analyzes the relationship
between multiple frames to detect unnatural patterns in motion or facial expressions. The third group,
frequency artifact-based detection, examines the frequency domain of the image or video to identify
manipulation traces.
V. Experimental setup
Deepfakes are continuously evolving, with new methods capable of producing increasingly realistic and
varied results. This requires robust detection systems capable of handling previously unseen
manipulation techniques. This chapter details the experimental setup used to evaluate a new strategy
for detecting deepfakes. By framing the detection task as a domain generalization problem, where each
deepfake generation method represents a distinct domain, we can better explore the model’s ability to
learn and generalize to novel manipulation types.

The primary research question here is to test whether the Meta-Learning for Domain Generalization
(MLDG) (D. Li et al., 2017b) approach can outperform the standard Empirical Risk Minimization (ERM)
method that is commonly used as a baseline in domain generalization studies. Unlike typical meta-
learning or few-shot learning frameworks that require some data from new domains for adaptation, a
domain generalization method such as MLDG can be more suitable for settings where data from new
methods is unavailable. This reflects a more realistic scenario in which a deepfake detection pipeline
must maintain an adequate level of performance even when faced with new manipulation methods.

Furthermore, the thesis investigates the potential benefits of augmenting training data with Self-
Blended Images (SBIs) (Shiohara & Yamasaki, 2022). This technique is designed to introduce more
variability into the training data by dynamically creating more training domains from the existing data.
The underlying idea is that increasing the number of training domains the meta-learning process has
access to through SBI augmentation would improve the model’s ability to learn features that are not
specific to any single manipulation technique. This, in turn, would lead to better performance when
detecting deepfakes created with methods the model hasn’t seen before.

Figure 5.1: Examples of cropped facial images. Original videos from Rössler et al. (2019)

Dataset
TheexperimentsusethewidelyrecognizedFaceForensics++dataset(Rössleretal., 2019),
abenchmarkcollectionofvideosdesignedforstandardizeddeepfakedetectionevaluation. This dataset
includes 1,000 real videos from public sources and 5,000 deepfake videos created using five different
manipulation techniques: Deepfakes (DF) (Deepfakes, 2020), Face2Face (F2F) (Thies et al., 2016),
FaceSwap (FS) (MarekKowalski, 2020),
FaceShifter (FSH) (L. Li et al., 2020), and NeuralTextures (NT) (Thies et al., 2019). While the
FaceForensics++ dataset includes three compression levels for each video using the H.264 codec (non-
compressed (raw), light compression (c40) and heavy compression (c23)), the experiments carried out in
this thesis focus exclusively on the lightly compressed videos due to storage space and computational
constraints. This aligns with a realistic scenario for deepfakes found on social media platforms, where
videos generally undergo some degree of compression (Rössler et al., 2019).

Preprocessing
From each video, 32 frames were extracted at equidistant intervals to ensure a uniform representation
of the entire video length. Dlib (King, 2009) face detection algorithm was applied to each extracted
frame to identify and locate facial regions. The facial regions were then cropped from each frame and
saved as PNG images, forming the final base dataset used for training and evaluation. In addition, facial
landmarks for each detected facial area were saved during the detection process. The resulting dataset
consists of 32,000 unaltered facial images and 160,000 manipulated images, 32,000 for each of the five
included manipulation methods.

Figure 5.2: Dataset splitting schema. Each index 000-999 represents a source video from the dataset.

Data Splitting
To ensure data independence across training, validation and test sets, as well as a balanced
representation of manipulation methods, a structured splitting strategy was implemented. First, a list of
video indices (000 to 999) was randomly shuffled. This randomization minimizes potential biases that
could arise from systematic ordering within the dataset. The shuffled video indices were then divided
into segments using a 80/10/10 split resulting in training data consisting of 80% of the indices while
validation and test data each have 10%. This strategy ensures that there is ample data for training the
model, while still reserving enough samples to fairly assess its performance. Training and validation
videos are further divided among the deepfake generation methods to ensure that each method is
equally represented and to prevent data leakage. This strategic division treats each generation method
as a distinct domain, reinforcing the diversity and complexity of the training environment. By ensuring
that each video is exclusive to one domain, the model is encouraged to focus on recognizing general
patterns characteristic of different manipulation techniques, rather than memorizing video-specific
details. This approach is pivotal for learning to identify generalizable features across domains, thereby
enhancing the model’s robustness against novel deepfake methods
VI. Results
This chapter presents the experimental results aimed at answering the research questions: Can we train
a deepfake detection model that generalizes better to unseen generation methods by approaching the
problem as a domain generalization task to learn domaininvariant features from source domains?
Additionally, the experiments explore whether augmenting training data with domains generated via
the Self-Blended Images algorithm enhances the model’s performance and generalizability. As the
suggested method in the experiments utilizes meta-learning, the introduction of additional domains
aims to reduce meta-overfitting to the source domains. More diverse variations within the source
domains potentially leads to improved model performance on unseen manipulation techniques.

To rigorously evaluate the model’s ability to generalize to unseen deepfake generation methods, a
leave-one-out cross-validation scheme was employed. The approach involves five distinct folds (see
Table 6.1). The model undergoes training and validation using four out of the five manipulation methods
available in the FaceForensics++ dataset, with the remaining method held out as a test case to assess
the model’s ability to generalize to unseen manipulation techniques. This process is repeated for each of
the five methods, ensuring each serves as the unseen target domain in turn

The leave-one-out strategy is particularly well suited for assessing cross-manipulation detection ability
(Sun et al., 2021; Z. Wang et al., 2023) because it allows for the evaluation of a model’s performance on
entirely new manipulation methods that were not encountered during training. This mirrors the real-
world scenario, where new deepfake generation methods constantly emerge.

The model’s performance was evaluated using two key metrics: Area Under the Receiver Operating
Characteristic Curve (AUC) and Equal Error Rate (EER).

The AUC metric, calculated from the Receiver Operating Characteristic (ROC) curve, is a tool for
assessing classifier performance across varying thresholds. The ROC curve itself is a graphical
representation of the classifier’s ability to distinguish between classes Table 6.1: Experimental
configurations for deepfake detection models with variations in source and target domains using leave-
one-out method

Name Source Target domain

domains
Face2Face
FaceShifter
DF Deepfakes
FaceSwap
NeuralTextures

Deepfakes
FaceShifter
F2F Face2Face
FaceSwap
NeuralTextures
 Deepfakes
Face2Face
FSH FaceShifter
FaceSwap
NeuralTextures

Deepfakes
Face2Face
FS FaceSwap
FaceShifter
NeuralTextures

Deepfakes
Face2Face
NT NeuralTextures
FaceShifter
FaceSwap
(Bishop & Bishop, 2024). The ROC curve plots the true positive rate (TPR), which reflects how well the
model identifies actual deepfakes, against the false positive rate (FPR), indicating how often it
mistakenly classifies real images as deepfakes. The AUC, a single value ranging from 0 to 1, represents
the overall area under this curve. Higher AUC values indicate better discrimination between real and
fake images, while an AUC of 0.5 signifies random guessing.

In evaluating binary classifiers, it is crucial to consider both, the false positive and the false negative
rates (Altuncu et al., 2022). Since these rates often conflict, a commonly used measure to find a balance
is the Equal Error Rate (EER). The EER represents the operating point where the false positive and false
negative rates are balanced. In deepfake detection, this represents the error rate when the model is
equally likely to misclassify a real image as a deepfake and a deepfake as a real image. A lower EER value
signifies better overall accuracy. It is worth noting that EER might not be the most appropriate metric
when the costs of the two errors are unequal, such as in cases where missing a critical deepfake is far
more detrimental than raising a false alarm (Altuncu et al., 2022).

Table 6.2 summarizes the results of these experiments, reporting the mean and standard deviation of
the AUC and EER metrics for each of the model configurations (ERM, ERM + SBI, MLDG, MLDG + SBI)
across the five folds.

In the baseline condition with no additional augmented domains, MLDG underperforms compared to
ERM in terms of both AUC and EER across all five folds. For the SBI-augmented models, MLDG achieves
higher average AUC and lower average EER compared to the ERM. The addition of SBI augmentation
resulted in improved performance for both MLDG and ERM, although the effect was more pronounced
for MLDG. MLDG with SBI augmentation achieved the highest average AUC (0.7127) and the lowest
average EER (34.4%).

Table 6.2: Deepfake Detection Performance (AUC and EER (%)) with and without SBI Augmentation,
using ERM and MLDG.

ERM MLDG

AUC EER AUC EER

no aug.
 D 0.75 31.8 0.72 34.
F 4 1 6
F2 0.74 31.6 0.71 34.
F 9 8 5
FSH 0.53 46.9 0.54 46.
6 1 4
F 0.50 51.3 0.48 52.
S 4 3 6
N 0.70 35.0 0.69 36.
T 6 1 0
Mean, 0.650 39.3 (9.16) 0.631 40.82
SD (0.1205) (0.111) (8.24)
SBI-
aug.
D 0.82 25.8 0.86 22.
F 7 2 5
F2 0.75 31.7 0.74 32.
F 4 4 9
FSH 0.61 42.0 0.65 38.
1 3 9
F 0.56 47.1 0.62 42.
S 0 7 0
N 0.71 35.0 0.70 35.
T 2 8 8
Mean, 0.693 36.3 (8.40) 0.719 34.4
SD (0.108) (0.092) (7.48)

In summary, the results presented in this chapter demonstrate that the baseline ERM outperforms
the MLDG in terms of both AUC and EER across the majority of folds when only the original training
domains were used. The addition of SBI augmentation improves performance for both MLDG and
ERM, but the improvement is significantly more prominent for MLDG.
+
VII. Conclusions
In this thesis, I have explored the challenges of deepfake detection in the face of constantly evolving
manipulation methods. Recognizing the limitations of traditional methods that might struggle to
generalize to unseen generation methods, I investigated the potential of Meta-Learning for Domain
Generalization (MLDG) as a more robust approach.

By framing the detection task as a domain generalization problem, where each deepfake generation
method is treated as a distinct domain, I aimed to investigate the model’s
abilitytolearnandgeneralizetonovelmanipulationtypes. Aprimaryresearchquestionis whether MLDG can
outperform the standard baseline method for domain generalization, Empirical Risk Minimization
(ERM). Unlike typical meta-learning or few-shot learning frameworks that require some data from the
new domains for adaptation, a domain generalization method such as MLDG is more suitable for
scenarios where data from new methods are unavailable. This reflects a more realistic setting in which a
deepfake detection pipeline must maintain adequate performance even when faced with unseen
generation methods.

In addition, I investigated the potential benefits of augmenting training data by creating additional
source domains with Self-Blended Images (SBIs). This technique introduces more variability into the
training data by dynamically creating additional training domains from the existing data. The hypothesis
was that using more diverse training domains would help the model learn features that are consistent
across domains and better generalize to new deepfake generation methods.

In the baseline experiments in which the models were trained without any augmented domains, the
MLDG framework, despite its potential for improved generalization, did not outperform the ERM
baseline. One possible reason could be the specific challenges of deepfake detection, where there is
often a significant domain shift between the training and testing data. In such cases, the MLDG
algorithm might be limited in its ability to generalize effectively due to the lack of diversity in training
domains.

However, with the addition of SBI-augmented domains, MLDG consistently outperformed ERM across all
folds and metrics (Table 6.2). Furthermore, the average AUC score for MLDG with SBIs (0.719) showed
an improvement over the baseline ERM (0.693). Similarly, the average EER for MLDG with SBIs (34.4%)
was lower than that of the baseline ERM (36.3%). Here, the MLDG framework, with its inner-loop
adaptation and meta-optimization process, appears to provide several advantages over the standard
ERM approach.

VIII. References
Alhogail, A. A., & Alsabih, A. (2021). Applying machine learning and natural language processing to
detect phishing email. Comput. Secur., 110, 102414.

Altuncu, E., Franqueira, V. N. L., & Li, S. (2022). Deepfake: Definitions, performance metrics and
standards, datasets and benchmarks, and a meta-review.
Balaji, Y., Sankaranarayanan, S., & Chellappa, R. (2018). Metareg: Towards domain generalization using
meta-regularization. Neural Information Processing Systems.

Batagelj,B.,Peer,P.,Struc,V.,&Dobrisek,S.(2021).Howtocorrectlydetectface-masks for covid-19 from visual

information? Applied Sciences.

Bengio, S., Bengio, Y., Cloutier, J., & Gecsei, J. (1992). On the optimization of a synaptic learning rule.
Optimality in Artificial and Biological Neural Networks, 6–8.

Bishop, C. M., & Bishop, H. (2024). Deep learning: Foundations and concepts. Springer International
Publishing. [Link]

Choi, Y., Choi, M.-J., Kim, M. S., Ha, J.-W., Kim, S., & Choo, J. (2017). Stargan: Unified generative
adversarial networks for multi-domain image-to-image translation.

2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition, 8789–8797.

Coccomini, D. A., Messina, N., Gennaro, C., & Falchi, F. (2021). Combining efficientnet and vision
transformers for video deepfake detection. ArXiv, abs/2107.02612.

Deepfakes. (2020). Deepfakes. [Link]

Deng, J., Dong, W., Socher, R., Li, L.-J., Li, K., & Fei-Fei, L. (2009). Imagenet: A large-scale hierarchical
image database. 2009 IEEE Conference on Computer Vision and Pattern Recognition, 248–255.

Dong, S., Wang, J., Ji, R., Liang, J., Fan, H., & Ge, Z. (2022). Implicit identity leakage:
The stumbling block to improving deepfake detection generalization. 2023 IEEE/CVF Conference
on Computer Vision and Pattern Recognition (CVPR), 3994–4004.

Finn, C. (2022). Domain generalization [Part of the course CS 330: Deep Multi-Task and Meta Learning,
Fall 2022].

Finn, C., Abbeel, P., & Levine, S. (2017). Model-agnostic meta-learning for fast adaptation of deep
networks. ICML.