T²A: Think Twice before Adaptation for DeepFake Detection

Abstract

Deepfake detectors face significant challenges when deployed in real-world environments, particularly when encountering test samples that deviate from training data through postprocessing manipulations or distribution shifts. We demonstrate that postprocessing techniques can completely obscure generation artifacts present in deepfake samples, leading to severe performance degradation.

To address these challenges, we propose T²A (Think Twice before Adaptation), a novel online test-time adaptation method that enhances detector adaptability during inference — without requiring access to source training data or labels. Our key idea enables the model to explore alternative options through Uncertainty-aware Negative Learning rather than solely relying on initial predictions. We also introduce Uncertain Sample Prioritization and Gradients Masking to improve adaptation efficiency. Empirically, T²A achieves state-of-the-art results across multiple benchmarks.

Problem Definition

While deepfake detectors perform well in controlled settings, real-world deployment introduces two critical challenges that break their assumptions:

Why adapt at inference time?

First, adversaries can apply unknown postprocessing techniques, such as compression, resizing, blurring, color manipulation, which destroy the subtle generation artifacts detectors rely on. Second, test samples often come from distributions that differ substantially from training data, causing performance degradation. Retraining with new labeled data is costly and impractical when distribution shifts are continuous or unknown.

T²A addresses this by performing online test-time adaptation: adapting the detector on-the-fly using only the unlabeled test stream, with no access to the original training data or labels. We formalize two evaluation scenarios:

Uncertainty-aware Negative Learning

Existing TTA methods rely on Entropy Minimization (EM), which pushes the model toward its most confident prediction. But in deepfake detection, this causes two failure modes: confirmation bias (reinforcing incorrect confident predictions) and model collapse (predicting all samples as the same class).

T²A consists of three complementary components:

(a) Normalized loss with pseudo label $\mathcal{L}_{norm}(x, \hat{y})$ and noisy pseudo-label $\mathcal{L}_{nn}(x,\tilde{y})$. $\mathcal{L}_{nn}(x,\tilde{y})$ is the opposite of $\mathcal{L}_{norm}(x, \hat{y})$.

(b) Passive loss function with pseudo label $\mathcal{L}_{p}(x, \hat{y})$ and noisy pseudo-label $\mathcal{L}_{p}(x,\tilde{y})$. $\mathcal{L}_{p}(x,\tilde{y})$ is the opposite of $\mathcal{L}_{p}(x, \hat{y})$.

(c) Noise-tolerant negative loss (NTNL) functions with pseudo label $\mathcal{L}_{NTNL}(x, \hat{y})$ and noisy-pseudo label $\mathcal{L}_{NTNL}(x,\tilde{y})$. $\mathcal{L}_{NTNL}(x,\tilde{y})$ is the opposite of $\mathcal{L}_{NTNL}(x, \hat{y})$.

Main Results

We evaluate T²A under both scenarios using Xception trained on FaceForensics++ as the source model, comparing against seven state-of-the-art TTA methods and four deepfake detectors.

Citation

If you find this work useful in your research, please consider citing:

@inproceedings{nguyenle2025think,
  title     = {Think Twice before Adaptation: Improving
               Adaptability of DeepFake Detection via
               Online Test-Time Adaptation},
  author    = {Nguyen-Le, Hong-Hanh and Tran, Van-Tuan
               and Nguyen, Dinh-Thuc and Le-Khac, Nhien-An},
  booktitle = {Proceedings of the Thirty-Fourth International
               Joint Conference on Artificial Intelligence
               (IJCAI-25)},
  year      = {2025}
}

Acknowledgments

This publication has emanated from research conducted with the financial support of Science Foundation Ireland under Grant number 18/CRT/6183.