Deepfakes in the Foundation-Model Era: A Survey of Forensics, Generation and Distribution Across Social Media Lifecycle

1. Introduction

Over the past decade, synthetic media generation has progressed through successive waves of generative modeling, from variational autoencoders and generative adversarial networks (GANs) to diffusion models and, more recently, large-scale video foundation models, making fabricated content increasingly realistic and convincing [1]. At the same time, synthetic content is increasingly distributed through social media platforms, where recommendation algorithms, compression, moderation, and user interactions shape its visibility and spread. DataReportal [2] and Statista [3] estimate approximately 5.24 billion active social media user identities worldwide at the start of 2025, with major platforms such as Facebook, YouTube, Instagram, TikTok, and Telegram operating at billion-user scale. Once uploaded, a synthetic video may be transformed through platform-specific compression, algorithmic promotion, editing, and cross-platform reposting in ways that controlled laboratory evaluations do not fully capture.

A deepfake is, therefore, not simply a video to classify; it passes through a lifecycle of creation, upload, platform processing, recommendation, viewing, reporting, review, and eventual removal, labelling, or continued spread. Media transformations within this lifecycle, such as compression, re-encoding, cropping, and reposting, can weaken or alter the forensic traces on which detectors rely, including sensor noise, physiological inconsistencies, and generative artifacts [4,5]. Despite these real-world dynamics, deepfake detection research has largely evolved independently of how deepfakes are distributed online. The challenge therefore extends beyond high detection accuracy in controlled settings to whether forensic evidence remains reliable throughout real-world distribution.

Figure 1. Structure of this survey. Each leaf lists representative works and, where forensic (A1–A5) applies.

Figure 1. Structure of this survey. Each leaf lists representative works and, where forensic (A1–A5) applies.

The fragility of passive forensic cues under real-world distribution has also motivated proactive approaches based on watermarking and content provenance. For example, Anthropic has announced embedded text watermarks and C2PA-based signed provenance metadata for Claude-generated content1. Motivated by these challenges, this survey bridges the gap between laboratory-focused deepfake detection with real-world deployment. Rather than treating detection as an isolated classification problem, we examine the deepfake ecosystem across its full lifecycle.

Scope This survey examines deepfakes from generation to real-world social media deployment. We first review the deepfake production pipeline and generative foundations, then examine detection methods and the social media lifecycle, including creation, distribution, detection, provenance, and remediation. Throughout, we use five forensic assumptions to explain how generation and deployment conditions affect detector reliability.

Search Methodology We conducted a systematic literature search spanning January 2017 to August 2026 across IEEE Xplore, the ACM Digital Library, SpringerLink, ScienceDirect, OpenReview, PMLR, the AAAI Digital Library, and arXiv. Queries combined {deepfake, face forgery, synthetic media, AI-generated video} with {detection, generation, robustness, watermarking, provenance, evaluation, social media, in the wild}, supplemented by forward and backward citation tracking. We also included foundational pre-2017 methods, official regulatory and standards documents, and widely used open-source implementations.

Candidates were screened for relevance to deepfake generation, forensic detection, platform distribution, provenance, remediation, or evaluation, and duplicates were removed. Non-peer-reviewed works were retained only if they met a minimum citation threshold or introduced a post-2024 foundation-model generator or evaluation lacking a peer-reviewed account. The final corpus comprises 212 works, of which 74% are from peer-reviewed venues. The median publication year is 2024 and 52% appeared in 2024 or later. Figure 2 summarizes the screening process.

Within the corpus, we prioritized works that (i) introduce novel methods with empirical evaluation, (ii) address post-2022 generators, (iii) provide cross-dataset, cross-generator, or real-world evaluation, or (iv) contribute widely adopted datasets, protocols, or implementations. Figure 3 summarizes the corpus, which is concentrated on detection and generation, with comparatively few works addressing distribution, remediation, and provenance, revealing an important imbalance in the existing literature.

Relation to Prior SurveysTable 1 compares this survey with representative prior reviews. Existing surveys primarily focus on generation and detection taxonomies [112,113,114,116,117,118], reliability [115], proactive defense [1], modality-specific analysis [119], or model architectures [120]. Although some cover temporal and audio-visual evidence, few connect deepfake generation and forensic detection with the platform conditions under which synthetic media is processed, propagated, verified, and remediated. Agentic detection also remains largely absent. Our survey addresses this gap by integrating generative foundations and forensic detection with a social-media lifecycle perspective, including platform processing, provenance, agentic methods, and real-world audio-video deepfakes.

Contributions Our contributions are: (1) We introduce the A1–A5 framework to explain when and why detectors fail. (2) We develop a generation taxonomy linking manipulation types to the traces they leave. (3) We review detection methods spanning signal-based, learning-based, reasoning-based, agentic, and adversarial approaches. (4) We formalize the social-media lifecycle as transformations of forensic evidence and quantify a literature imbalance: creation and detection account for 75% of the corpus, versus 12% for distribution, provenance, and remediation. (5) We connect provenance and real-world evaluation to A1–A5, mapping benchmarks to these assumptions and outlining deployment requirements. To the best of our knowledge, this is the first survey to unify foundation-model-era generation, forensic detection, and the social-media lifecycle.

2. Background, Generative Modeling and Forensics

This section establishes the conceptual and technical foundations for this survey.

2.1. Deepfake Video Attack Pipeline

We formalize the deepfake video attack as a five-stage pipeline, as illustrated in Figure 4.

Data Acquisition. Attackers may gather target images or videos from social media, public appearances, and other web sources, making social platforms both a data source and a distribution channel. Traditional face-swap systems [15] typically require hundreds or thousands of identity-specific frames and per-target training. Recent methods reduce these requirements through training-free identity conditioning from a single reference image [43,44] (targeted synthesis), while text-to-video foundation models can generate realistic synthetic individuals without target-specific data [121] (untargeted synthesis).

Preprocessing. The collected media may undergo face detection, alignment, landmark extraction, and segmentation to produce normalized face crops suitable for identity-specific generation [122]. Cropping and alignment resample the source and overwrite capture-level regularities. The crop boundary can also determine where a compositing seam appears when the generated face is returned to the frame. In audio-driven pipelines, speech is converted into mel-spectrograms or learned embeddings that guide facial motion [123], limiting the visual signal to information preserved by that representation.

Generation. The synthesis stage uses generative models to produce the manipulated face, image, or video. Traditional pipelines relied mainly on autoencoders [15] and GANs, whereas modern systems increasingly use diffusion and flow-matching models [11,124], autoregressive transformers [12], and 3D-aware neural rendering [14]. This shift toward full-frame foundation-model generation reduces the localized artifacts and stable fingerprints exploited by earlier forensic detectors.

Post-Processing. The generated output may be refined through blending, alpha compositing, colour harmonization, resolution, temporal smoothing, and codec re-encoding [15]. In such deepfakes, these operations improve consistency between the manipulated region and the surrounding frame, whereas fully synthetic videos may undergo appearance and temporal enhancement. Adversarial perturbations may also target the features on which a detector relies [125].

Dissemination. The final video is distributed through online channels such as social media. Platform-specific processing, including transcoding, resolution reduction, cropping, overlays, and re-encoding, can alter high-frequency statistics, remove metadata, and weaken links to provenance manifests [6]. These operations can suppress generation traces while introducing platform artifacts. Repeated downloading and reuploading across platforms compound this effect, widening the gap between benchmark and real-world detection conditions.

2.2. Generative Modelling Foundations for Video Synthesis

We review the generative paradigms behind deepfake video in this section.

Autoencoders and Variational Autoencoders (VAE) Autoencoders map inputs to a lower-dimensional latent representation and reconstruct them through a decoder; VAEs instead regularize the encoded distribution toward a prior, trading reconstruction accuracy for a smoother, sampleable latent space. Early face-swapping systems such as DeepFaceLab [15] and FaceSwap [126] paired a shared encoder with identity-specific decoders, blending a reconstructed face into an authentic frame. VAEs persist as the encoders and decoders of modern diffusion models.

Generative Adversarial Networks (GANs) Based Video Synthesis GANs, which learn through competition between a generator and a discriminator, dominated face synthesis and manipulation before the shift toward diffusion. StyleGAN [9] improved controllable synthesis, FaceShifter [127] and SimSwap [16] enabled identity transfer, and FOMM [19] and StyleGAN-V [128] extended it to motion and time. Their convolutional upsampling leaves periodic frequency traces, which much of the early detection literature was built to read.

Diffusion-Based Video Generation Diffusion models generate video by reversing a noising process, usually in the latent space of a pretrained autoencoder [11]. Because the decoder is shared across outputs of a model family, its reconstruction bias becomes a forensic trace. Video diffusion extends image backbones with temporal modelling [129,130]; more recent diffusion transformers operate on space-time tokens, while flow-matching approaches learn continuous transformations between noise and data. Diffusion also supports localized editing and inpainting, which can leave boundaries absent from fully generated video.

Autoregressive (AR) and Transformer-Based Video Models AR models factorize the joint distribution of video tokens as a product of conditionals, so the discrete tokenizer sits between the model and the output and leaves quantization traces of its own. CogVideo [12] and VideoPoet [13] extend Transformer-based generation to video, editing, and multimodal synthesis, while hybrid systems increasingly combine autoregressive and diffusion components [131,132].

3D-Aware Neural Rendering: NeRFs and Gaussian Splatting 3D-aware approaches explicitly model geometry, appearance, and motion. Neural Radiance Fields represent scenes as continuous volumetric functions, whereas 3D Gaussian Splatting uses rasterized Gaussian primitives for efficient rendering [14]. Each leaves rendering artifacts: floaters and view-dependent inconsistency for NeRFs, and splat-edge visibility and popping for Gaussian Splatting. These representations suit controllable talking-head synthesis, while newer hybrid approaches combine audio or motion conditioning with diffusion.

2.3. Forensic Signals in Deepfake Videos

Digital media forensics2 predates deepfakes by nearly two decades [4]. Early studies showed that authentic media contain regularities introduced during capture and compression, while manipulation can disturb these patterns. Sensor noise, resampling artifacts, and compression statistics can reveal camera origin and processing history, while video forensics extends these cues to temporal edits such as frame duplication or deletion [4,133]. The same principle was later applied to synthetic media, where GANs were found to leave model-related fingerprints [55].

Framework for Forensic Assumptions Deepfake detectors rely on assumptions about the evidence available, such as the presence of an editing boundary, a recurring generator fingerprint, or similarity between training and test data. We group these expectations into five assumptions (A1–A5), which form the analytical spine of this survey.

A1: A manipulated region leaves a boundary. Many manipulations replace only part of the frame, such as a swapped face or an inpainted region, while leaving the rest unchanged. Compositing the generated content into the original frame may leave differences in texture, resolution, colour, or compression, and Face X-Ray detects such blending traces [53]. The assumption, therefore, holds only when manipulated content is composited against an authentic region and fails for fully synthetic video, where every pixel is generated.

A2: A generator leaves a stable fingerprint. A detector may assume that videos produced by the same model share recurring statistical patterns. Upsampling in GAN generators, for example, can leave frequency-domain traces that support detection or attribution [55]. However, these patterns may change across models, versions, fine-tuning methods, and post-processing. A detector trained on one generator’s fingerprint may therefore fail on another.

A3: Test videos resemble the training data. Detectors usually perform better when the videos seen during testing are similar to those used during training. In real-world deployment, however, they may encounter new generators, manipulation methods, identities, scenes, or recording conditions. This difference between training and deployment limits cross-generator and cross-dataset performance [51].

A4: Forensic signals survive processing. A detector may assume that relevant forensic detail survives processing. Benchmark videos are often original or only moderately compressed [47], whereas social-media videos may be resized, filtered, compressed, or re-encoded several times. These operations can weaken useful traces and introduce unrelated platform artifacts [6].

A5: Low-level clues are enough. Many detectors rely mainly on pixels, textures, frequencies, or frame-level motion. They may not examine whether the scene makes sense, whether the audio matches the speaker, or whether objects behave consistently. As generated videos become more realistic, semantic and multimodal reasoning may be needed to identify contradictions that low-level detectors miss [80].

In the generation table (Table 2) the symbols report whether an assumption holds for a method’s outputs. In the detection table (Table 3), they indicate whether a method depends on an assumption or mitigates its failure. In the dataset table (Table 4), they identify the assumptions a benchmark can stress-test. Fewer filled circles in the generation table therefore indicates a harder detection problem, not a more capable generator.

3. Taxonomy of Generative Deepfake Videos

This section organizes deepfakes by manipulation type and the forensic evidence available to detectors.3

3.1. Identity-Centric Deepfakes

Identity-centric deepfakes alter the appearance or behaviour of a person. Many early methods modified a localized facial region while preserving the surrounding frame. Recent systems can generate the full head or portrait, reducing the amount of authentic facial content available for comparison.

Face Swapping. Face swapping transfers a source identity onto a target video while preserving the target pose, expression, and scene context. Methods in this category span successive architectural generations: autoencoder-based systems such as DeepFaceLab [15], GAN-based methods such as FaceShifter [127] and SimSwap [16], and diffusion-based methods such as DiffFace [150], DiffSwap [151] and REFace [17]. Identity transfer through implicit 3D representations has also been explored [152]. Because the fake face (driver) is placed into a real frame (source), the manipulated region may be localizable through compositing seams(A1), while the generator family determines what else is recoverable (A2).

Facial Reenactment. Facial reenactment transfers driver expressions, gaze, or head pose while preserving the source identity. Face2Face [18] uses explicit facial reconstruction, FOMM [19] uses learned keypoints and motion representations, and LivePortrait [153] supports efficient portrait animation. Unlike face swapping, reenactment generally preserves much of the target appearance while altering facial dynamics. Detectors must therefore examine motion, expression, and identity dynamics rather than relying only on static appearance. The frame is authentic and nothing is pasted in, so A1 weakens and the evidence is motion rather than a seam.

Talking-Head Synthesis. Talking-head synthesis generates a speaking portrait from a reference image (source) and driver audio. Existing approaches include mesh-based systems such as SadTalker [154], neural-rendering methods such as ER-NeRF [155] and GaussianTalker [144], and diffusion-based methods such as EMO [20], Hallo 3 [147], and VASA-1 [21]. These methods may generate most or all facial motion from a single static image, so there may be no localized face-swap boundary. When the full portrait is generated, A1 does not apply and only temporal and audio-visual consistency remain.

Lip-Sync Manipulation. Lip-sync manipulation modifies mouth motion in a target video to match driver audio while preserving most of the original frame. Wav2Lip [22] is a widely used example, while Diff2Lip [156], and VideoReTalking [157] use diffusion or multi-stage processing to improve visual quality. Because edits may be confined to the mouth region, global video statistics can be dominated by authentic content, while compression further weakens local traces. Mouth-region analysis and audio-visual synchronization are therefore especially important. A1 holds only around the mouth, while A4 becomes particularly fragile because compression erases small-region traces first.

3.2. Body-Centric Manipulations

Body-centric methods modify human pose, gesture, movement, or appearance. They may preserve the original face, replace the full person, or synthesize the entire body within an existing or generated scene.

Pose and Gesture Transfer. Pose and gesture transfer animates a source person using motion extracted from a driver video or pose sequence. Everybody Dance Now [23] demonstrated pose-driven motion transfer, while MagicAnimate [24] and Animate Anyone [25] use diffusion-based generation to improve appearance consistency and temporal quality. These methods may leave inconsistencies around limbs, hands, clothing, occlusions, or interactions with the background. A1 holds only when the generated person is composited into an authentic scene.

Full-Body Puppetry and Attribute Editing. Full-body puppetry extends pose transfer by controlling a person movement, gesture, and appearance. DisCo [26] disentangles pose, background, and human appearance for controllable dance generation, Champ [27] conditions on a parametric 3D body model for improved shape and pose fidelity, and UniAnimate [28] extends generation to longer sequences. Attribute editing may instead modify clothing, body appearance, or other visual characteristics while preserving identity and motion. As the edit expands from a local seam to full-frame synthesis, A1 progressively weakens and may disappear entirely.

3.3. Audio-Centric Manipulations

Audio-centric deepfakes alter speech content, speaker identity, or vocal characteristics. Unlike visual manipulation, audio has no spatial boundary. Detection instead relies on acoustic, temporal, linguistic, and speaker-related evidence.

Speech Synthesis and Voice Cloning. Speech synthesis, commonly referred to as text-to-speech (TTS), generates an utterance from text, while voice cloning produces speech that imitates a target speaker. Neural codec language models such as VALL-E [29] synthesize speech from a few seconds of reference audio, YourTTS [30] supports zero-shot multilingual cloning, and diffusion and flow-matching systems such as NaturalSpeech 2 [31] and VoiceBox [32] improve prosody and speaker similarity. A2 is load-bearing here, since detection assumes that each model family leaves a stable acoustic fingerprint.

Voice Conversion and Speech Editing. Voice conversion changes the perceived speaker while preserving the linguistic content of an utterance, using disentangled content and speaker representations [158] or self-supervised speech features. Speech-editing methods instead modify selected words or temporal segments while retaining the surrounding authentic audio [35]. Partial editing creates the audio analogue of video inpainting, and pairing manipulated audio with authentic video defeats visual-only detectors. This violates A5 because a detector relying on only one modality may miss manipulation confined to the other.

3.4. Scene-Centric Deepfakes

Scene-centric methods generate or modify substantial portions of a video scene. Unlike localized identity manipulation, these methods may contain little or no camera-captured reference content. The detection task consequently shifts from locating an edited region to determining whether the full sequence was generated or substantially altered.

Text-to-Video (T2V) Generation. T2V models generate complete video sequences from natural-language prompts. Recent T2V systems such as Open Sora [36], CogVideoX [38], HunyuanVideo [159], and Wan 2.1 [39] generate coherent multi-second to minute-scale sequences. Because the full scene may be synthetic, no authentic-synthetic compositing boundary exists, invalidating A1. Unseen generators may also fall outside the training distribution, challenging A3.

Image-to-Video (I2V) Animation. I2V methods animate a static image using text, motion, or other conditioning signals. Stable Video Diffusion [40] generates video from an image, while AnimateDiff [41] introduces reusable motion modules. Although the conditioning image may provide an identity or appearance reference, the generated frames remain synthetic; forensic evidence therefore depends partly on whether the source image itself is authentic. A1 depends on the conditioning image: an authentic source gives a reference boundary, whereas a generated one does not.

Video-to-Video (V2V) Editing. V2V editing modifies existing footage through inpainting, instruction-guided editing, object replacement, or broader scene transformation. InstructVid2Vid [140] and Wan 2.1-VACE [39] support controllable video editing, while ProPainter [42] performs temporally consistent inpainting and object removal. The spatial extent of these edits can vary from a small object to most of the scene. Localized edits may leave boundaries, while global transformations such as changing weather, lighting, or visual style may have diffuse boundaries that are difficult to localize. A1 holds for local edits and fails for global transformations, where boundaries are diffuse.

3.5. Hybrid and Multimodal Pipelines

Modern deepfakes may combine several manipulation categories and model families within one workflow. These pipelines blur the boundaries between identity, body, audio, and scene manipulation and can modify the forensic traces introduced at earlier stages.

Joint Audio-Visual Manipulation. Joint audio-visual manipulation alters both the visible speaker and the accompanying voice. For example, a cloned voice may be combined with talking-head synthesis or lip-sync editing. Such content can remain consistent across both modalities, reducing the effectiveness of detectors that assume one channel is authentic. Detection must therefore examine not only synchronization but also whether the voice, facial behaviour, identity, and semantic content are mutually consistent. A5 fails here because cross-modal consistency alone may no longer distinguish authentic from manipulated content.

Multi-Stage Generation and Editing. A multi-stage pipeline may first generate a scene, inject a target identity using methods such as InstantID [43] or IP-Adapter [44], or align mouth motion using Wav2Lip [22] , add a cloned voice, and then apply video editing and post-processing. Each stage may weaken, replace, or add forensic signals. The final output therefore cannot always be attributed to a single generator or manipulation type. A detector trained on isolated face swaps, lip-sync edits, or text-to-video outputs may not generalize to their combination. A2 fails, because no single fingerprint survives a chain of generators.

3.6. Cross-Cutting Temporal and Partial Manipulations

Any manipulation category may affect only part of a video duration or spatial extent. Segment splicing, frame insertion or deletion, and short manipulated windows can produce sequences that remain predominantly authentic. Datasets such as LAV-DF [45] and AV-Deepfake1M [46] include temporally localized manipulations, often altering a short word, phrase, or corresponding visual segment. In this setting, a video-level label provides limited information; the task is to identify the manipulated interval or region. Temporal and partial manipulations therefore cuts across identity-, body-, audio-, scene-, and multimodal deepfakes. The forensic question therefore shifts from whether the video is manipulated to whether the manipulated interval or region can be localized.

3.7. Forensics Mapping

Across the taxonomy, A1 weakens as manipulation expands from localized edits to full-frame generation. A2 remains relevant but is challenged by chained generators that obscure fingerprints. A5 is weakened when jointly generated audio and video since cross-modal and semantic inconsistencies may be reduced. A3 and A4 are not properties of the manipulation at all. They are set by what a detector was trained on and by what the media has been through since, so they can fail for any row in Table Section 3.7, which is why the lifecycle in §5 is part of the same problem.

4. Detection, Localization, and Attribution of Manipulated and Fully Synthetic Videos

This section reviews methods for detecting, localizing, and attributing manipulated and fully synthetic videos.

4.1. Problem Formulation

Deepfake detection comprises several related tasks that differ in output granularity and operational purpose. Let $X=(V,A)\in {\mathcal{X}}_{AV}$ denote an audio-video sample, where ${\mathcal{X}}_{AV}=\mathcal{V}\times (\mathcal{A}\cup \{⌀\})$ and $A=⌀$ when audio is unavailable. We next formalize the main forensic tasks.

Binary Authenticity Verification. The most common formulation treats detection as binary classification. Given $X\in {\mathcal{X}}_{AV}$, a detector produces $f_{\theta }^{\mathrm{bin}}:{\mathcal{X}}_{AV}\to [0,1]$, where a higher value indicates stronger evidence of manipulation. The binary decision is ${\widehat{y}}^{\mathrm{bin}}=\mathbb{I}[f_{\theta }^{\mathrm{bin}}\left(X\right)\ge \tau ]$, where $\tau$ is a decision threshold selected for the intended operating conditions. This formulation underlies widely used benchmarks such as FaceForensics++ [47], Celeb-DF [48], and DFDC [49]. Binary verification provides a simple decision but does not identify the manipulation type, affected region, or likely generation process.

Fine-Grained Deepfake Classification. Fine-grained classification identifies the type of synthetic alteration present in a sample. Benchmarks range from manipulation-specific labels in FaceForensics++ to broader taxonomies such as ForgeryNet [50] and DF40 [51], while FakeAVCeleb [52] distinguishes visual, audio, and combined audio-video manipulations. For K deepfake categories and one authentic category, single-label classification produces ${\mathbf{p}}^{\mathrm{type}}=f_{\theta }^{\mathrm{type}}\left(X\right)\in {[0,1]}^{K+1}$, with ${\sum }_{k=0}^K{p}_k^{\mathrm{type}}=1$. Multi-label classification instead predicts ${\mathbf{p}}^{\mathrm{multi}}=f_{\theta }^{\mathrm{multi}}\left(X\right)\in {[0,1]}^K$. Naming a manipulation assumes that categories remain distinguishable, which a pipeline combining face swapping, lip-sync editing, and voice cloning no longer guarantees (A2).

Spatial and Temporal Localization. Localization methods identify where and when synthetic modifications occur. For a video with T frames of height H and width W, spatial localization produces ${\mathbf{P}}^{\mathrm{spa}}=f_{\theta }^{\mathrm{spa}}\left(X\right)\in {[0,1]}^{T\times H\times W}$, where each entry represents the probability that a pixel is manipulated. Temporal localization produces ${\mathbf{p}}^{\mathrm{temp}}=f_{\theta }^{\mathrm{temp}}\left(X\right)\in {[0,1]}^T$, where each entry represents the probability that a frame belongs to a manipulated segment. Face X-Ray predicts blending-boundary masks [53], ForgeryNet provides pixel-level annotations [50], and UMMAFormer localizes manipulated temporal segments using audio and visual streams [54]. For fully synthetic video, spatial localization may reduce to a full-frame mask because no authentic region remains (A1).

Generator Attribution. Generator attribution seeks to identify the model, model family, or generation pipeline responsible for a synthetic sample. For G known generators and one unknown-source category, attribution produces ${\mathbf{p}}^{\mathrm{attr}}=f_{\theta }^{\mathrm{attr}}\left(X\right)\in {[0,1]}^{G+1}$, with ${\sum }_{g=0}^G{p}_g^{\mathrm{attr}}=1$. The output assigns the sample to a known generator or an unknown source. GAN-generated media can contain model-specific fingerprints [55], but these traces may change across model variants, fine-tuning, and multi-stage pipelines (A2). Attribution systems should therefore support an “unknown” outcome. Unlike attribution, provenance relies on externally recorded information or credentials rather than media-internal evidence (Section 5.3).

Operating Points, Prevalence, and Calibration. The threshold $\tau$ is often treated as an implementation detail, while evaluation emphasizes threshold-independent measures such as AUC. In deployment, however, performance at the selected operating point is critical. Let $\pi$ denote synthetic-media prevalence, $\mathrm{TPR}$ the true-positive rate, and $\mathrm{FPR}$ the false-positive rate. Precision is

$$\mathrm{Precision}={\displaystyle \frac{\pi \mathrm{TPR}}{\pi \mathrm{TPR}+(1-\pi )\mathrm{FPR}}}.$$

(1)

For example, at $\pi =0.1\%$, $\mathrm{TPR}=0.90$, and $\mathrm{FPR}=0.01$, precision is only about $8.3\%$. Under low prevalence, even a small FPR can create substantially more false alarms than correct detections, a deployment burden not captured by AUC alone. Detection scores should therefore be calibrated so that confidence reflects observed correctness.

4.2. Signal-Driven Forensic Detection

Signal-driven methods target specific statistical, spatial, temporal, physiological, or compression properties of media. Some use handcrafted measurements, while others train neural networks to extract forensic evidence.

Spatial and Identity-Consistency Cues Spatial methods examine blending boundaries, texture discontinuities, facial geometry, and identity consistency. Face X-Ray estimates boundary maps produced by face compositing [53]. ID-Reveal compares facial identity representations with the surrounding spatio-temporal context using ArcFace embeddings [56,176]. Such boundary-based evidence may be absent in fully synthetic frames (A1).

Frequency-Domain and Reconstruction-Based Detection Frequency-based detectors exploit spectral patterns introduced by generation pipelines, including artifacts associated with convolutional upsampling [177]. However, diffusion and alias-free architectures can weaken these signatures [57]. Reconstruction-based methods instead measure differences after projecting media through a generative model’s latent representation; AEROBLADE [58], for example, uses reconstruction error from a latent diffusion autoencoder. Both approaches depend on generator-related traces that may change across architectures or processing pipelines (A2).

Temporal, Physiological, and Audio-Visual Cues Video detectors can use information unavailable in isolated frames, including physiological signals, facial motion, optical flow, and frame-to-frame consistency. Physiological cues such as blinking, gaze, and remote photoplethysmography were effective against earlier generators that modelled individual frames better than long-term facial behaviour. Their reliability decreases as temporal modelling improves and is affected by motion, illumination, resolution, and compression. AltFreezing [66] learns complementary spatial and temporal forgery features, while audio-visual approaches examine speech–mouth correspondence, as in LipForensics and self-supervised correspondence methods [178]. Such mismatch cues weaken when audio and video are generated jointly and synchronized by construction (A5).

Acoustic and Speech-Forensic Cues Audio deepfakes include text-to-speech synthesis, voice conversion, and localized speech editing. Detection uses spectral, temporal, phase, vocoder, neural-codec, or learned waveform representations, with representative systems including RawNet2 [60] and AASIST [61]. Performance can decline across unseen generators and after compression, resampling, noise, or platform transcoding; consequently, audio detection often depends on stable generator traces that survive subsequent processing (A2, A4).

Compression and Codec Forensics Codec analysis examines quantization, prediction, and compression-history inconsistencies. Double-compression traces may indicate that a video was edited and re-encoded. However, generated and authentic videos often use the same codecs, and social-media platforms routinely transcode uploaded content. Platform processing can therefore remove generation traces while introducing new compression patterns unrelated to manipulation. Codec traces primarily reflect processing history, which platform transcoding may overwrite before detection (A4).

4.3. Learning-Based Detection Architectures

Learning-based detectors infer discriminative representations directly from data. Their architectures have progressed from frame-level convolutional networks to temporal transformers, adapted foundation models, and multimodal systems.

CNN-Based Frame-Level Detection Early deepfake detectors adapted CNNs such as Xception, ResNet, and EfficientNet for frame-level classification, often achieving strong within-dataset performance but weaker cross-dataset transfer. Later approaches improve generalization through augmentation and localized forensic learning; for example, Self-Blended Images generates pseudo-forgeries without relying on a fixed generator [62]. Nevertheless, performance remains sensitive to differences between training and deployment distributions (A3).

Temporal and Transformer-Based Architectures Transformer-based detectors model long-range spatial and temporal relationships across video frames. Representative approaches include TALL [64], which compactly represents temporal information, and AltFreezing [66], which alternates spatial and temporal optimization. Although these architectures integrate broader evidence than frame-level CNNs, they do not eliminate distribution shift to unseen forgery types or fully synthetic video (A3).

Foundation-Model-Adapted Detectors Recent detectors adapt large pre-trained vision encoders to improve transfer across manipulation methods. UnivFD [67], for example, uses frozen CLIP representations for cross-generator detection, while newer approaches adapt pre-trained features through lightweight forensic modules or selective fine-tuning [179]. Face-specific pre-training provides a complementary direction [69,70]. However, broader pre-training can reduce rather than eliminate sensitivity to unseen deployment distributions (A3).

Multimodal Detection Frameworks Multimodal systems combine evidence from video, audio, text, metadata, or provenance. Audio-visual detectors measure temporal alignment, phonetic consistency, or correspondence between vocal and facial characteristics. SyncNet-based approaches estimate alignment between speech and mouth motion [180], while LipForensics and self-supervised audio-visual methods learn deviations from natural speech dynamics [178,181]. Joint audio-video generation presents a more difficult case, since synchronization may be internally consistent even when the whole event is synthetic. Multimodal detection must therefore extend beyond temporal alignment toward semantic, provenance, and source-based verification. Cross-modal mismatch cues are most informative when the modalities are generated or manipulated independently; their value may decrease when a single model jointly generates consistent audio and video (A5)

Detectors for Fully Synthetic Video T2V and I2V generation removes the compositing structure assumed by many facial-manipulation detectors because entire frames or clips may be synthetic. UNITE therefore classifies full-frame content using domain-agnostic vision features [71], while DeMamba applies a bidirectional state-space module over frozen encoder features and is evaluated across contemporary video generators [72]. Song et al. [182] instead learn multimodal representations targeting diffusion-generated video. Without compositing seams, these methods rely on statistical and temporal evidence that must remain stable across generators (A2), transfer beyond the training distribution (A3), and survive processing (A4).

4.4. Generalization and Adaptation

A major obstacle to deployment is performance loss under distribution shift. High scores on a benchmark do not imply comparable performance on contemporary social-media content. For example, Deepfake-Eval-2024 contains approximately 44 hours of video collected from 88 web sources and reports an average 50% AUC reduction for evaluated open-source video detectors relative to their original benchmarks [73].

Generalization strategies operate at three levels. Data-level methods increase diversity through multiple generators, manipulation types, domains, and realistic augmentations [53,62,74]. Model-level methods seek representations that separate transferable forensic evidence from identity, scene, or generator-specific characteristics [75,76,77]. Learning-level methods use domain generalization, meta-learning, continual learning, or test-time adaptation to respond to distribution shift [78,79]. These strategies broaden the conditions represented during training but cannot guarantee coverage of future generators (A3).

4.5. Reasoning-Based and Agentic Detection

Most detectors produce a score through a fixed inference procedure. Vision-language and agent-based systems, instead, formulate forensic analysis as evidence collection, interpretation, and decision-making. Their main potential lies in combining heterogeneous evidence and producing explanations rather than replacing specialized signal detectors.

Vision-Language and Knowledge-Grounded Detection Vision-language models extend forensic analysis from low-level artifacts toward semantic and contextual reasoning. GPT-4V can recognize some visible manipulation cues but remains less accurate than specialized detectors [80], while forensic systems such as FakeShield [81], Veritas [82], and Omni-Fake-R1 [83] combine authenticity assessment with localization or explanation. Such models can identify physical and contextual inconsistencies but may miss subtle statistical artifacts or provide plausible yet unfaithful explanations. They are therefore better treated as complementary evidence rather than definitive forensic judges (A5).

Knowledge-Grounded Forensic Reasoning Forensic adaptation and knowledge grounding can improve the relevance of VLM reasoning. Recent systems combine authenticity assessment with localization and explanation, including FakeShield [81], Veritas [82], and Omni-Fake-R1 [83]. Such approaches connect low-level perception with semantic interpretation and can identify physical or contextual inconsistencies. However, these cues may weaken as generation becomes more coherent, motivating their combination with signal-level and provenance evidence (A5).

Agent-Based Forensic Frameworks Agent-based systems coordinate several models, tools, or reasoning roles. AIFo combines forensic tools, evidence-gathering agents, reasoning components, and structured debate for AI-generated image detection [84]. Agent4FaceForgery uses LLM-based agents to simulate forgery creation and social interaction, producing more realistic multimodal training data [85]. It is therefore better understood as an agent-based data-generation and evaluation framework than as a direct multi-agent detector. Agentic systems require multiple inference calls and may be too expensive for platform-scale screening. Coordinating several tools aggregates their evidence and their assumptions, and the weakest component still sets the floor.

4.6. Adversarial Robustness and Evasion

In this section, we consider deliberate evasion, where an adversary intentionally modifies or suppresses the signals used for detection. Conventional white-box, black-box, and transferable attacks have been extensively studied in seminal literature. Here, we focus instead on two emerging forms of evasion that extend beyond conventional per-sample perturbations.

Learned anti-forensic evasion. Recent methods learn transformations specifically designed to suppress forensic traces in synthetic media. Deep-dithering models, for example, can reduce generative artifacts through a learned image-to-image transformation [86], while GANFR explicitly separates and suppresses GAN fingerprint features in spatial and frequency domains [87]. Such attacks directly challenge A2 by suppressing generator-specific fingerprints and may also challenge A3 when the resulting media falls outside the detector’s training distribution. However, current evidence is concentrated largely on generated images and GAN-based synthesis; the effectiveness of such approaches against modern audio-video and diffusion-based generators remains less established.

Attacks on reasoning-based detectors. The reasoning-based systems discussed in §4.5 introduce an additional attack surface because visual content can also carry natural-language instructions. Recent multimodal prompt-injection attacks show that text embedded within images can redirect the behaviour of vision-language models [88]. In a deepfake-detection setting, overlays, misleading authenticity claims, or other semantic distractors could therefore interfere with how a reasoning-based detector interprets forensic evidence. Agentic systems that retrieve external evidence may further enlarge this attack surface. Robustness evaluation should consequently assess not only prediction accuracy but also whether the model’s reasoning remains consistent with the forensic evidence on which its decision should depend.

Both forms of evasion may interact with platform processing. Transcoding and compression can weaken an adversarial signal, but they may also remove the forensic traces required by the detector. Attack success should therefore be evaluated after platform-representative processing [6], rather than only on the adversarial media produced directly by the attack. Evasion can deliberately suppress generator fingerprints (A2) or shift inputs outside the detector’s training distribution (A3).

4.7. Forensics Mapping

The A1–A5 framework summarizes the conditions underlying current detection methods. Boundary-based approaches depend on compositing evidence (A1); frequency, reconstruction, acoustic, and attribution methods depend on stable generator traces (A2); supervised detectors remain vulnerable to distribution shift (A3); signal-level evidence may be weakened by platform processing (A4); and increasingly coherent generation reduces low-level and cross-modal inconsistencies (A5). No single detector is therefore reliable across all conditions. Table 3 maps representative methods to these assumptions.

5. Deepfakes Across the Social Media Lifecycle

The pipeline in §2.1 covers deepfake creation; here, we examine how distribution, provenance, and remediation affect forensic evidence after content enters social media. These stages account for only 12% of the reviewed corpus, compared with 75% for creation and detection (Figure 3(a)), revealing a substantial gap in research on how forensic evidence survives deployment.

5.1. Distribution I: Platform Upload and Forensic Transformation

Platform processing, including resizing, compression, resampling, and re-encoding, can weaken manipulation traces in both the visual and audio streams. Compression weakens the compositing boundaries associated with A1, while resampling and re-encoding alter the spectral fingerprints associated with A2. These operations also introduce artifacts unrelated to synthesis, which complicates the distinction between generation and distribution traces [6]. Repeated downloading, reposting, cropping, overlays, and screen recording compound these effects. The forensic signal available at detection may therefore differ substantially from that present at generation, challenging A4.

5.2. Distribution II: Algorithmic Propagation and Cross-Platform Reposting

After upload, a deepfake becomes part of a time-varying propagation cascade shaped by sharing, recommendation systems, and cross-platform reposting. We represent the cascade observed up to time t as a directed graph ${\mathcal{G}}_t=({\mathcal{V}}_t,{\mathcal{E}}_t)$, where nodes represent observed posts and directed edges represent reposting, remixing, or cross-platform transfer. Each repost may undergo transformations such as transcoding, cropping, overlays, or re-encoding. The complete graph is rarely observable because platforms do not expose full provenance or engagement histories. Relationships between posts must therefore be inferred from perceptual matching, audio fingerprints, semantic similarity, or available provenance evidence. Propagation is also shaped by platform ranking, account popularity, network structure, and prior engagement [89]. Propagation-aware evaluation should consider not only whether a deepfake is detected but also how far it spreads. Let $t_0$ denote the earliest observed upload and $t_{\det }$ the detection time. Useful measures include

$$\Delta t_{\det }=t_{\det }-t_0,N_{\mathrm{pre}}=\left|{\mathcal{V}}_{t_{\det }}\right|,P_{\mathrm{reach}}=\left|\left\{p\left(v_i\right):v_i\in {\mathcal{V}}_{t_{\det }}\right\}\right|,$$

(2)

where $p\left(v_i\right)$ denotes the platform hosting post $v_i$, so that the three quantities represent time to detection, posts observed before detection, and platforms reached, respectively.

5.3. Provenance, Watermarking, and Content Authenticity

Passive detection infers manipulation from the observed media. Provenance instead records evidence at creation or editing time, reducing dependence on forensic traces that may later be weakened by platform processing. We consider signed metadata, in-generation watermarking, and post-hoc watermarking, including their robustness limits and relationship to A1–A5.

Signed Metadata and Content Credentials. The Coalition for Content Provenance and Authenticity (C2PA) specifies cryptographically signed manifests describing an asset, its ingredients, and the actions applied to it [91]. Verification establishes the integrity and signer of the manifest and whether the bound asset remains consistent with the signed record. Two limitations remain. First, provenance is only as trustworthy as its signer. Second, metadata may be stripped or invalidated during re-encoding. C2PA addresses the latter through durable credentials that use perceptual fingerprints or embedded watermarks to recover stripped manifests, thereby inheriting the robustness limits of those signals.

Watermarking During and After Generation. In-generation watermarking modifies the generator or sampling process so that outputs contain a recoverable signal. Representative methods include Stable Signature, which embeds a signature through the decoder [92]; Tree-Ring, which places a structured pattern in the initial noise [93]; and Gaussian Shading, which encodes information in the latent noise [94]. Model-level fingerprinting instead modifies the training process so that the resulting generator reproduces a predefined mark [200]. These approaches can support detection or attribution, but verification may require model-specific keys, decoders, or inversion procedures. They also depend on generator participation: a watermark designed for one model family may not transfer to another.

Post-hoc watermarking embeds a signal into finished media and can therefore be applied independently of the generator. For video, VideoSeal [95] are designed to remain detectable under transformations such as compression, frame loss, cropping, and temporal editing. For audio, AudioSeal [96] provides localized watermark detection, allowing short synthetic segments within otherwise authentic speech to be identified, while WavMark [97] embeds recoverable payloads in short audio windows. Across modalities, these methods trade payload capacity and imperceptibility against robustness to platform processing and resynthesis.

Removal, Forgery, and Evaluation Under Attack. Watermarks face two broad adversarial risks. Removal attacks aim to erase the mark while preserving perceptual quality. Regeneration through diffusion models can remove many imperceptible image watermarks, while optimization-based and universal attacks reveal similar weaknesses [98,99]. Forgery attacks create the opposite failure: an adversary estimates or copies a watermark pattern and applies it to authentic media, potentially creating false attribution [100]. This is particularly concerning when the presence of a watermark is treated as evidence of synthetic generation. Robustness claims should therefore be interpreted relative to a clearly stated attack model. WAVES evaluates image watermarks under distortion, regeneration, and adversarial attacks and reports substantial degradation compared with distortion-only evaluation [101]. Similar stress testing has been extended to audio [201], while evaluation of video watermarks under realistic platform transcoding chains remains comparatively limited.

Relation to the Forensic Assumptions. Signed provenance metadata sits largely outside the assumptions underlying passive forensic detection because its main failure modes are stripping and signer trust. Watermarking, however, remains subject to similar signal degradation. An embedded watermark must survive compression, resizing, cropping, and re-encoding, corresponding directly to A4. Recovery may also depend on a specific decoder, latent space, or generator family, creating a dependency similar to A2. Watermarks and passive forensic traces may therefore be degraded by many of the same platform transformations, particularly compression, resizing, cropping, and re-encoding (A4).

5.4. Platform Governance and Remediation

Deepfake governance is becoming more explicit in regulation. Articles 50(2) and 50(4) of the EU AI Act require synthetic content to be machine-readably marked and detectable, and deepfake content to be disclosed [102]. China similarly requires labeling of deep-synthesis content that may cause public confusion [103], and election-specific restrictions have emerged, as in South Korea’s regulation of AI-generated content in election campaigns [202]. Other measures target harmful applications rather than synthetic content in general. The U.S. TAKE IT DOWN Act addresses non-consensual intimate deepfakes and requires covered platforms to remove reported content within a specified period [104]. Australia criminalizes non-consensual distribution of technologically created or altered sexual material [105], while the UK and Canada have introduced comparable measures [106,107]. Governance is thus moving beyond detection toward disclosure, platform responsibility, and harm-specific remediation.

Marking obligations of this kind bind identifiable providers. Open-weight generators, forked checkpoints, and locally run pipelines may fall outside provider-based marking obligations and can be used to produce targeted non-consensual or political content. The reachable coverage of provenance is therefore bounded by the compliant share of the generator population rather than by the technical robustness of any watermarking scheme, leaving passive detection as the only available evidence for the remainder.

Human review often forms part of downstream platform moderation, yet it is rarely modelled in deepfake-detection research. Human identification accuracy can approach chance under some conditions and varies with content type, familiarity with the depicted person, and presentation conditions [108]. Human review therefore does not automatically resolve uncertainty left by upstream automated systems.

Lifecycle Summary.Figure 5 summarizes how forensic evidence changes across the lifecycle. Generation, platform processing, and reposting can progressively weaken media-internal signals, while provenance, contextual evidence, and human review provide complementary evidence. The lifecycle perspective therefore shifts deepfake analysis from a static-file problem to an evolving-evidence problem: the central question is not only whether content is fake, but what evidence remains when a decision must be made.

6. Datasets and Evaluation

This section reviews the evolution of deepfake benchmarks, evaluation tasks and metrics, and deployment-oriented protocols for stress-testing forensic assumptions.

6.1. Benchmark Evolution

Deepfake benchmarks have evolved alongside generation technology. Early datasets such as FaceForensics++ [47] and Celeb-DF [48] focused primarily on facial manipulation under relatively controlled conditions. Later benchmarks introduced greater manipulation diversity, additional generators, perturbations, localization annotations, and in-the-wild media, enabling evaluation beyond within-dataset binary classification [50].

The benchmark landscape has also expanded beyond visual face manipulation. Audio datasets cover synthetic speech, voice conversion, codec effects, and unseen spoofing attacks, while audio–visual datasets include audio-only, video-only, and joint manipulations, increasingly with temporal localization. Recent benchmarks such as AV-Deepfake1M [203] expand large-scale audio–visual evaluation, while Deepfake-Eval-2024 [73] evaluates contemporary media collected from online sources, exposing substantial gaps between benchmark and real-world performance.

6.2. Evaluation Tasks and Metrics

Evaluation metrics should match the forensic task. Binary detection commonly uses AUC, average precision (AP), accuracy, or equal error rate (EER), particularly for audio spoofing. Fine-grained manipulation classification and generator attribution benefit from class-balanced measures such as macro-F1 when class frequencies are unequal [52]. Spatial localization typically uses intersection over union (IoU) or Dice, whereas temporal localization commonly uses temporal IoU and mean average precision over manipulated segments [45,203].

Metric choice alone, however, does not determine whether an evaluation is realistic. High within-dataset performance may reflect similarity between training and test distributions rather than robustness to unseen generators or deployment conditions [204]. Results are also difficult to compare across studies when training sets, compression levels, sampling procedures, operating thresholds, or test protocols differ. These conditions should therefore be reported alongside headline metrics.

6.3. Recommended Evaluation Protocol and Forensic Assumptions

Deployment-oriented evaluation should extend beyond a single random train–test split. At minimum, evaluation should include an in-domain baseline and cross-dataset or cross-generator testing. Where relevant, robustness tests should introduce platform-representative transformations such as compression, resizing, re-encoding, noise, and cropping. Multimodal systems should additionally be evaluated separately on audio-only, video-only, and joint manipulations to identify modality-specific shortcuts.

The A1–A5 column in Table 4 indicates which forensic assumptions each benchmark can help stress-test. Controlled compositing datasets probe boundary evidence (A1); multi-generator benchmarks test dependence on generator-specific traces and train–test alignment (A2–A3); transformed and in-the-wild media test signal survival under processing (A4); and multimodal or fully synthetic benchmarks test whether low-level and cross-modal evidence remains sufficient as generation becomes more coherent (A5). Robust evaluation therefore requires complementary datasets and protocols rather than reliance on a single benchmark score.

Table 5. Representative datasets for deepfake detection and evaluation. Rows are selected to capture major shifts in manipulation diversity, modality, localisation, robustness, cross-generator generalisation, and foundation-model-era content. Mod.: I = image, A = audio, V = video, AV = audio–visual. The final column identifies forensic assumptions that each dataset can help stress-test: A1 = boundary availability; A2 = stable generator fingerprints; A3 = train–test similarity; A4 = survival through processing; and A5 = sufficiency of low-level cues.

Table 5. Representative datasets for deepfake detection and evaluation. Rows are selected to capture major shifts in manipulation diversity, modality, localisation, robustness, cross-generator generalisation, and foundation-model-era content. Mod.: I = image, A = audio, V = video, AV = audio–visual. The final column identifies forensic assumptions that each dataset can help stress-test: A1 = boundary availability; A2 = stable generator fingerprints; A3 = train–test similarity; A4 = survival through processing; and A5 = sufficiency of low-level cues.

7. Findings

Applying the A1–A5 coding scheme uniformly across the reviewed generation methods, detectors, platform transformations, and benchmarks yields six findings.

F1. Research emphasizes A3 more than A4. Of the 50 detectors coded in Table 3, 36 explicitly mitigate distribution shift (A3), whereas 39 depend on forensic signals surviving processing (A4) and only 10 mitigate its failure. Five of these ten are reasoning or agentic systems, whose multiple inference or tool calls may limit their suitability for platform-scale screening. Thus, although A4 is widely assumed by existing methods, comparatively few address its failure.

F2. Boundary evidence is becoming less central. In Table 3, 41 of 50 detectors neither depend on A1 nor explicitly mitigate its failure. Table 2 also shows residual boundary evidence declining from High for autoencoder- and GAN-based face manipulation to Low for diffusion, autoregressive, and flow-based full-frame generation. A1 therefore remains most relevant to localized manipulations such as compositing, lip-sync editing, body transfer rather than fully synthetic generation.

F3. Generalization is often evaluated through a narrow cross-dataset shift. Eighteen of the 50 detectors report FaceForensics++ → Celeb-DF v2 as a principal cross-dataset evaluation. Both benchmarks primarily represent pre-foundation-model facial manipulation, so this protocol measures transfer between related face-manipulation distributions rather than open-world generalization to contemporary generators. A3 is therefore the most frequently mitigated assumption, while its evaluation remains comparatively narrow.

F4. Foundation-model content remains under-evaluated. Of the 50 detectors, 34 report no evaluation on diffusion- or foundation-model-generated media, two provide partial evaluation, and 14 explicitly evaluate such content. This represents a gap in the evaluation record rather than evidence that earlier detectors necessarily fail. Existing methods should therefore be re-evaluated on contemporary generation paradigms before performance gaps are attributed solely to architectural limitations.

F5. Lifecycle effects are more often described than quantified. Of the nine entries in Table 4, three report quantitatively measured effects and one has partial evidence. Repost depth and screen recording lack reported degradation curves, and no work in the reviewed corpus reports time to detection, posts observed before detection, or platforms reached. This mirrors the broader corpus imbalance: only 12% of the 212 reviewed works address distribution, provenance, and remediation, compared with 75% covering creation and detection.

F6. Benchmarks emphasize generator and distribution diversity over signal survival. Across the 22 benchmarks in Table 4, generator diversity (A2) is exercised by 21 and train–test dissimilarity (A3) by 20, whereas signal survival under processing (A4) is exercised by 12 and boundary availability (A1) by 13; only three exercise all five assumptions. Current benchmark coverage therefore favors generator and distribution diversity, while substantially fewer benchmarks test whether forensic evidence survives realistic processing. This gap is consistent with the large performance degradation reported on contemporary circulated media [73].

Two consequences follow. First, provenance cannot fully compensate for this evaluation gap because its coverage depends on adoption by generators and platforms; open-weight, forked, or locally operated pipelines may remain outside participating provenance ecosystems regardless of watermark robustness. Second, the findings motivate greater emphasis not only on improving classifiers, but on measuring which forensic signals survive real distribution pipelines and reporting detector performance under those conditions.

8. Discussion

The findings in §7 describe where forensic evidence is lost and where the literature has looked for it. This section states what follows for how detectors are built, evaluated, deployed, and then sets out the questions the survey leaves open.

8.1. Impact of This Study

For method design. The A1–A5 framework replaces the question of whether a detector generalizes with the question of which evidence it requires. A method that depends on a compositing boundary, a stable fingerprint, or an uncompressed signal can state that dependency and be evaluated against the conditions that remove it, rather than against a single cross-dataset score that conflates all five. Combining detectors that share the same failed assumption does not, by itself, resolve that failure; ensembles and agentic pipelines should therefore report whether their components rely on independent evidence.

For evaluation. Benchmark results become comparable only when the conditions that produced them are reported. We recommend that a benchmark declare which of A1–A5 it exercises, and that a detector report its operating threshold, calibration, and performance after platform-representative processing alongside the headline metric. Under the prevalence conditions, a threshold-independent score does not determine deployed precision, so the reporting requirement is not a formality.

For platforms and governance. Treating a deepfake as an evolving evidence trail rather than a file to classify identifies where intervention is still possible. Evidence that generation never produced cannot be recovered downstream, evidence that platform processing removes cannot be recovered by a better classifier, and evidence that provenance records is available only for content whose producer chose to record it. Detection, provenance, disclosure, and remediation are therefore stages of one evidence chain, and a policy that assumes any one of them is sufficient inherits the failures of the others.

Figure 6 sketches what this looks like operationally. The addition is not a new architecture but a record of which evidence a prediction used and whether that evidence was reliable, which is the reporting requirement F1 and F5 imply.

8.2. Open Questions

Q1. How far does a fingerprint transfer across a model lineage (A2)? Attribution and frequency-domain detection assume a stable trace, yet fine-tuning, distillation, multi-stage chaining (§Section 3.5), and anti-forensic transformations each remove it, and both are evaluated almost only on base checkpoints. Attribution should be measured across checkpoint families and generation chains, and allowed to answer unknown. Q2. What evidence remains when nothing is composited (A1, A5)? Fully generated video leaves no authentic region for comparison, and jointly generated audio and video are synchronized by construction, so both cues fail together. The open task is to establish which of the remaining signals, such as decoder bias, temporal dynamics, or physical plausibility, transfer across generator families rather than within one. Q3. What should open-set detection look like (A3)? Generators are released faster than forensic datasets are rebuilt, so unseen architectures are the default deployment case rather than the exception. Generator-agnostic representations, authentic-media modelling, continual adaptation, and open-set recognition all need protocols in which the test-time generator, manipulation type, and domain are absent from training. Q4. How should weak and heterogeneous evidence be combined (A4)? When media-level signals are degraded, a decision must draw on provenance, context, calibrated uncertainty, and human review, but combining sources also combines their assumptions and the weakest one sets the floor. Deployment evaluation should therefore report calibration, abstention, and time to detection rather than accuracy alone. Q5. Can evaluation keep pace with generation? Static benchmarks age as generators are released, and Table 4 shows that existing ones exercise different subsets of A1–A5. A refreshed framework should admit new generators only after detector training and increasingly draw on circulated rather than curated media. Maintaining such evaluation requires continual data collection, annotation, and benchmark updating as generation technology evolves.

8.3. Limitations of This Review

Four scope decisions constrain this review. First, the search covers selected databases and English-language publications, which may under-represent work in other languages or regional venues. Second, the citation threshold applied to non-peer-reviewed work may exclude recent preprints that have not yet accumulated citations, biasing against newer methods apart from the 2025-2026 exceptions described above. Third, the review is video-centric; image-only and audio-only forensic methods appear only where they inform video analysis. Fourth, our treatment of distribution covers publicly observable platforms, so synthetic media circulating through private messaging and closed groups remains outside both this review and the available evidence base.

9. Conclusion

Deepfake detection depends on what evidence survives from generation to distribution. Our A1–A5 framework shows that foundation models weaken traditional forensic traces at creation, while social-media processing further removes them before detection. Modern generators may leave no clear boundary or stable fingerprint (A1, A2), differ from training distributions (A3), and generate synchronized audio and video that weaken cross-modal cues (A5). Distribution then adds compression, resizing, cropping, and reposting effects that further suppress forensic evidence (A4). Yet distribution, provenance, and remediation account for only 12% of the corpus. No single defense is sufficient: passive detectors face evasion and distribution shift, watermarks can be removed, provenance can be stripped or absent, and attribution becomes difficult in multi-stage pipelines. Detectors that perform near ceiling on curated benchmarks can lose roughly half their AUC on circulated media. Future benchmarks should therefore evolve with new generators and clearly state which A1–A5 assumptions they test.