Deepfakes

A deepfake is an image, video or audio recording, made or altered with machine learning, that shows a real person saying or doing something they did not say or do, realistically enough to pass as genuine. The best-known kind replaces one person’s face with another’s in a video, but the word now also covers changing a person’s expressions or mouth movements, editing their visible attributes, synthesizing a face from scratch and cloning a voice. The term is written as deepfake, DeepFake or deep fake; research papers usually speak of facial manipulation or face forgery, and policy documents of synthetic content.

Deepfakes matter to computer vision in two ways. They are a product of its methods: the pipelines combine face detection, 3D face models and generative models of several families. And they are one of its clearest cases of dual use, since the same methods serve film production, dubbing, telepresence and privacy protection. This article explains what counts as a deepfake, the families of methods at the level at which their papers describe them, the history, the uses and harms that official and scholarly sources document, consent, and the main legal responses as of November 2026. Telling deepfakes apart from authentic media, deepfake detection, is a task of its own and appears here only in outline. The article describes; it gives no instructions for making deceptive media of real people.

Definition

The word has several layers of meaning, and sources differ in which they use.

• A specific method. Rössler et al. (2019, §3), the authors of the FaceForensics++ benchmark, note that “Deepfakes” is both a general term and the name of one face-replacement method spread through online forums, built on two autoencoders that share an encoder. They write DeepFakes for the method.
• Learning-based face replacement. The same authors observe that the term has widely become a synonym for face replacement based on deep learning. Li et al. (2020, §1), who built the Celeb-DF dataset, use it the same way: a video in which a target’s face is replaced by a synthesized face of a donor while the target’s expressions and head poses are kept.
• Realistic falsification of any medium. Chesney and Citron (2019, p. 1757), writing on law and policy, use deep fake as shorthand for the full range of hyper-realistic digital falsification of images, video and audio.
• Legal definitions. The EU Artificial Intelligence Act defines deep fakes as AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and “would falsely appear to a person to be authentic or truthful” (Article 3(60), as quoted in the European Commission’s 2026 guidelines, paragraph 113). The US TAKE IT DOWN Act of 2025 uses digital forgery for an intimate visual depiction of an identifiable individual created by software, machine learning or other technological means that a reasonable person would find indistinguishable from an authentic depiction of that individual (47 U.S.C. 223(h)(1)(B), as added).

Three elements recur: content that depicts or resembles a real person; generation or alteration by a learned model; and realism enough to mislead. The EU definition, as the Commission’s guidelines interpret it, is wider than the research usage in three respects: it covers objects, places, entities and events as well as people; it is enough for a simulated subject to resemble something that exists or could plausibly exist, so that realistic AI-generated avatars or personas count as persons; and it does not require any intention to deceive (paragraphs 113–114). It is narrower in another: content that its foreseeable audience would not take for authentic falls outside it, and the guidelines’ examples of non-deep fakes include a sphinx flying over the Eiffel Tower and an AI-generated cartoon of a historical event.

Intuition

A face in a video carries several kinds of information at once: who the person is (identity: the shape and appearance of the face), what the face is doing (expression, mouth movement, gaze, head pose), how it looks today (hair colour, age, glasses, make-up), and where it is (lighting, background, camera). Faces are hard to fake well because people are expert at reading them: Zakharov et al. (2019, §1) note the acuteness of the human visual system to even small errors in rendered heads, the uncanny valley.

Most manipulation methods change one of these factors and keep the rest. Rössler et al. (2019, §1, Fig. 2) divide facial manipulation into two categories: identity manipulation, which replaces the face of a person with someone else’s (face swapping), and expression manipulation, which transfers the expressions of a source person to a target (facial reenactment). The US National Institute of Standards and Technology (NIST, 2024, §3.2.2.2) lists four kinds of face deepfakes in video: an identity swap; an expression swap, or “puppet master”; an attribute manipulation, such as a change of skin or hair colour, age or eyewear; and entire face synthesis, of a real or a non-existent person, possibly from a text prompt.

Rössler et al. (§1) give two reasons why faces became the target: reconstructing and tracking faces is a well-studied field of computer vision, which supplies the building blocks, and faces play a central role in how people communicate. The first reason is why the pipelines below begin with the same steps as face recognition: detect the face, find its landmarks, align it.

Formal Definition

There is no single mathematical definition, but the families can be stated compactly. The following notation is our own framing of the categories above, not a model from any one paper. Write a video frame of a person $p$ as rendered from three groups of factors,

$$x = R(a_p,\, m,\, b),$$

where $a_p$ is the identity of $p$, $m$ the motion (expression, mouth shape, head pose) and $b$ everything else in the frame (background, lighting, camera). Given a frame $x_t = R(a_t, m_t, b_t)$ of a target person $t$ and material from a source person $s$:

• face swapping produces $\hat{x} = R(a_s, m_t, b_t)$: the source’s identity with the target’s motion, in the target’s frame;
• facial reenactment produces $\hat{x} = R(a_t, m_s, b_t)$: the target’s identity driven by the source’s motion;
• lip sync, or audio-driven reenactment, produces $R(a_t, m(u), b_t)$, where the mouth motion $m(u)$ is predicted from an audio track $u$;
• attribute editing changes a visible attribute, writing $a_t'$ for the edited appearance, and keeps the rest;
• full synthesis draws $\hat{x}$ from a generative model with no target frame at all; whether the result counts as a deepfake depends on the definition used: research usage asks whether it depicts a real person, the EU guidelines whether it is realistic enough to pass as authentic.

No method has $R$ or the factors explicitly; each approximates them in its own way. The method that gave the phenomenon its name is a concrete case. Li et al. (2020, §2.1, Fig. 3) and Rössler et al. (2019, §3) describe it as one encoder $E$ shared by all identities and one decoder $D_i$ per identity, trained as autoencoders to reconstruct aligned face crops of each person, with an $\ell_1$ reconstruction loss in Li et al.’s description:

$$\min_{E,\, D_s,\, D_t} \; \sum_{i \in \{s, t\}} \; \sum_{x \in \mathcal{X}_i} \big\lVert x - D_i(E(x)) \big\rVert_1 ,$$

where $\mathcal{X}_i$ is the set of face crops of person $i$. Li et al. explain the single shared encoder as a way to make the code capture identity-independent attributes such as facial expression, while each decoder supplies its person’s appearance. A swapped face is then $D_s(E(x_t))$: the target crop encoded and decoded as the source. The synthesized face is warped back into the frame, masked and blended with the surrounding image (Li et al., §2.1). The two decoders are trained on two specific people, so each pair needs its own training (Rössler et al., §1).

Method Families

The methods below are described as their papers report them, at survey level. Many of them were published with stated applications in film, telepresence and dubbing, and several were later used to build the datasets on which deepfake detectors are trained.

Face swapping

• Graphics-based swapping. The FaceSwap method that FaceForensics++ uses extracts the face region from sparse facial landmarks, fits a 3D template model with blendshapes, renders it into the target frame and blends it with colour correction; it is light enough to run on a CPU (Rössler et al., §3). Earlier systems of this kind, which Rössler et al. survey (§2), reconstructed 3D models of both faces and warped one onto the other.
• Pair-specific autoencoders, the shared-encoder method described above.
• Subject-agnostic swapping. FSGAN (Nirkin, Keller & Hassner, 2019) swaps faces between pairs it was never trained on. It combines a recurrent reenactment generator that adjusts the source face to the target’s pose and expression, a network that completes occluded regions, and a blending network trained with a Poisson blending loss. Its authors write that removing subject-specific data collection and training makes face swapping accessible to non-experts (§6).
• Identity embeddings. Later swapping methods extract an identity feature from the source face and inject it into a generator (Zhao et al., 2023, §1). The identity feature typically comes from a pretrained face recognition network: DiffSwap uses one to condition its model (§3.2), and evaluates by checking whether a different recognition model retrieves the source person from the swapped face (§4.1). The face recognition embedding that decides “same person or not” thus serves both to guide and to score a swap.
• Diffusion-based swapping. DiffSwap reformulates face swapping as conditional inpainting of the face region by a latent diffusion model, conditioned on the identity feature and on 3D-aware facial landmarks (Zhao et al., 2023, abstract). Its authors note that face swapping has no ground-truth image pairs, so models are trained with weak supervision from losses on fidelity, identity and attributes (§1).

Facial reenactment

• Model-based reenactment. Face2Face (Thies et al., 2016) reenacts a monocular target video, such as a YouTube clip, from a source actor filmed live with a commodity webcam, in real time. It fits a multi-linear PCA face model to recover the target’s facial identity, tracks the expressions of both people, transfers the source’s expression deformations to the target, retrieves a matching mouth interior from the target video, and re-renders the face to blend with the target’s lighting (abstract, §3).
• Neural rendering. NeuralTextures, a reenactment method that FaceForensics++ also uses, learns a neural texture of the target person together with a rendering network, trained with a photometric reconstruction loss and an adversarial loss; Rössler et al. modified only the mouth region (§3). Facial reenactment is among the applications of neural rendering that its surveys list.
• Few-shot talking heads. Zakharov et al. (2019) meta-learn on a large corpus of talking-head videos (they train on VoxCeleb1 and VoxCeleb2) so that a model of a new person can be fitted from a few images, or one, and then driven by facial landmarks. They list telepresence, video conferencing, multi-player games and special effects as applications (§1).

Lip sync and audio-driven reenactment

Lip-sync methods drive the mouth from sound rather than from another face. Rössler et al. (§1–2) cite Video Rewrite (Bregler et al., 1997) as an early image-based system that generated new mouth movements for a person in video, and “Synthesizing Obama” (Suwajanakorn et al., 2017) as follow-up work that animated a face from audio. Neural Voice Puppetry (Thies et al., 2020) maps an audio stream to the expression coefficients of a 3D face model with a temporal network and renders the result with a person-specific neural renderer trained on a short target video of a few minutes; because the audio network generalizes across speakers, the input voice can be anyone’s, including a synthetic voice from text-to-speech (abstract, §1). Its authors present it for digital assistants and video dubbing. DiffTalk (Shen et al., 2023) models talking-head generation as an audio-driven denoising process in a latent diffusion model, conditioned also on reference images of the face and on landmarks, and reports that it generalizes to new identities without further fine-tuning (abstract).

Attribute editing

Attribute editing changes how a person looks rather than who they are or what they do. StarGAN (Choi et al., 2018) trains a single generator to translate face images between several domains, such as hair colours (black, blond, brown), gender and age on CelebA, and facial expressions on another dataset (§5.2). It is an instance of image-to-image translation. Editing a real photograph through the latent space of a pretrained face generator, after GAN inversion, and instruction- or text-based editing with diffusion models, covered in image editing, do the same with more control.

Full-face synthesis

Unconditional generators sample faces of people who do not exist. Rössler et al. (§2) note that most early deep-learning face synthesis had low resolution until progressive growing of GANs produced high-quality faces; StyleGAN and its successors, trained on the FFHQ faces, followed. A synthesized face of no real person is not a deepfake of anyone, but the same generators can be steered towards a real person by inversion and editing, and NIST’s category of entire face synthesis includes generating a real person’s face from a text prompt (2024, §3.2.2.2). Text-to-image generation and video generation models, fine-tuned on a few photographs of a subject by personalization methods such as DreamBooth, extend this to whole scenes.

Voice

Voice cloning lies outside vision, but it is part of the phenomenon and is often combined with the methods above. NIST (2024, §3.2.2.3) distinguishes text-to-speech generators, which speak written text in some speaker’s voice, speech-to-speech generators, and imitation-based generators, which make source speech sound like a target voice while keeping its words. Chesney and Citron (2019, pp. 1761–1762) discuss synthetic audio among the technical foundations of deep fakes.

History

Period	Development	Source
1997–2015	Image-based mouth resynthesis (Video Rewrite), 3D-model face replacement and dubbing systems	Rössler et al. (2019, §2)
2016	Real-time reenactment of monocular video from a webcam (Face2Face)	Thies et al. (2016)
2017	Face animation from audio (“Synthesizing Obama”)	Rössler et al. (2019, §1–2)
2018	High-resolution GAN faces by progressive growing (Karras et al., ICLR 2018); learning-based face swaps of celebrities into pornographic videos, spread through forums and reported in the press from January 2018, give the phenomenon its name	Rössler et al. (2019, §2); Chesney & Citron (2019, pp. 1757, 1763, 1772)
2018–2019	First deepfake datasets: UADFV, DeepFake-TIMIT, FaceForensics++; then DFD, the Deepfake Detection Challenge set and Celeb-DF	Li et al. (2020, Table 1)
2019	Subject-agnostic swapping and few-shot talking heads remove per-pair training	Nirkin et al. (2019); Zakharov et al. (2019)
2023	Diffusion-based face swapping and talking-head synthesis	Zhao et al. (2023); Shen et al. (2023)
2024–2026	Legislation: UK offence of sharing intimate images that appear to show a person (January 2024); EU AI Act (Regulation (EU) 2024/1689, transparency rules from August 2026); US TAKE IT DOWN Act (May 2025); UK offence of creating purported intimate images (February 2026)	Official texts cited below

Chesney and Citron date the wave of attention to a Reddit user who posted a tool for inserting celebrities’ faces into pornographic videos, and they cite press reports from January to March 2018 on how quickly a consumer application spread (pp. 1763, 1772). Pornographic use, in their account, gave rise to the label (p. 1757). The dataset timeline in Li et al.’s Table 1 runs from UADFV (released November 2018) to Celeb-DF (November 2019).

A trend runs through the method papers: each needed less material of the person depicted. FaceForensics++’s DeepFakes models had to be trained for each pair of videos (Rössler et al., §1); Neural Voice Puppetry needs a short video of the target; Zakharov et al. fit a talking head from a few images or one; FSGAN and DiffTalk work for people they were not trained on. Chesney and Citron (pp. 1762–1763) argued that the capability would diffuse because it depends on knowledge rather than scarce materials.

Uses

Chesney and Citron (2019, pp. 1769–1771) group the beneficial uses under education (for example, historical figures addressing students), art (satire, parody and film, including performances of deceased actors) and individual autonomy, including synthetic audio that could let people with certain forms of paralysis, such as ALS, speak with their own voice. The method papers state their own applications: entertainment, privacy and training-data generation (Nirkin et al., §1); telepresence, video conferencing, games and special effects (Zakharov et al., §1); digital assistants and dubbing (Thies et al., 2020, §1); and digital twins, film-making and privacy protection (Zhao et al., §1). NIST (2024, §2) notes that much synthetic content is not inherently harmful.

Deepfake methods also produce training data for their own detection. FaceForensics++ generated 1,000 manipulated videos with each of four methods (DeepFakes, Face2Face, FaceSwap and NeuralTextures) from 1,000 YouTube videos, more than 1.8 million manipulated images, and released the trained DeepFakes models with the dataset (Rössler et al., §1, §3). Nirkin et al. (§6) argue that publishing such methods is necessary to drive the development of countermeasures and to compel lawmakers to set clear policies, and that suppressing publication would leave the methods to a select few.

Harms

Chesney and Citron (2019, pp. 1771–1786) give a broad survey of harms. To individuals and organizations they list exploitation, such as extortion, fraud and the insertion of a person’s face, voice and body into pornography, and sabotage of reputations and opportunities. To society they list the distortion of democratic discourse, manipulation of elections, eroded trust in institutions, deeper social divisions, threats to public safety, diplomacy and national security, and damage to journalism. They expect most victims of fake sex videos to be women, as with cyber stalking and non-consensual pornography (p. 1773).

They also name the liar’s dividend (pp. 1785–1786): as the public learns that video and audio can be faked, people caught on genuine recordings can more credibly dismiss them as deep fakes. The harm is to authentic evidence, and it grows with public awareness rather than with the quality of any fake.

NIST (2024, §2) lists the harms that synthetic content can accelerate as problems of information integrity, synthetic child sexual abuse material (CSAM), non-consensual intimate imagery (NCII) and fraud, including identity theft, and notes that synthetic images, voices or video may be used to fool biometric authentication or to mislead people into authorizing fraudulent transactions, for example by voice cloning. Its §5 reports that face and body swap apps, and websites for building image generators commonly trained on non-consensual intimate images, are spreading and resulting in sextortion, monetization schemes and the targeting of women and minors, and that AI-generated intimate images of political and public figures disproportionately target women. Fooling a face recognition system with a synthetic face fed directly to its software is a digital injection attack; NIST’s 2023 evaluation of presentation attack detection, described in the face recognition article, left such attacks out of scope.

People are poor judges of these manipulations. In the FaceForensics++ user study, 204 participants, mostly computer science students, labelled single frames shown for 2 to 6 seconds; their accuracy averaged 68.7% on uncompressed images, 66.6% on light compression and 58.7% on strong compression, where 50% is chance on the balanced set (Rössler et al., §4.1, Fig. 4). The two expression manipulations were the hardest: per-method accuracy was 44–50% on Face2Face frames and 31–39% on NeuralTextures frames across the three quality levels, below chance for NeuralTextures throughout (supplement, Table 5). NIST (2024, §3.2) cites a 2024 study that found human performance near chance on audio, visual and audiovisual deepfakes.

Consent

Consent is the line that most legal and ethical treatments draw. Chesney and Citron (2019, p. 1758) note that deep fakes can be made with the consent of the people shown, but expect that more often they will be made without it. NIST (2024, §5.1.1) points out a technical difficulty: consent, the defining feature of NCII, is not typically evident or decipherable from the image itself.

Consent also concerns the data of the research field. Of the datasets that Li et al. (2020, §2.3) compare, the Google/Jigsaw DeepFake Detection dataset was built from 363 videos of 28 consented individuals, and the first-round release of the Deepfake Detection Challenge from 1,131 videos of 66 consented individuals. FaceForensics++ was built from YouTube videos and Celeb-DF from YouTube interviews of 59 celebrities, chosen, its authors write, because viewers know their faces well and because celebrities are anecdotally the main targets of deepfakes (Li et al., §3.1); neither paper, in the copies read, reports asking the people shown. The CelebA and FFHQ articles describe the same question for the face datasets on which many generators are trained.

Legal Responses

The following outline is drawn only from official texts that could be read in November 2026, and it gives no legal analysis. It covers three jurisdictions; many others have their own rules, which are not covered.

European Union. The Artificial Intelligence Act, Regulation (EU) 2024/1689, was not read in its own text for this article; what follows is taken from the European Commission’s guidelines on its Article 50, communication C(2026) 7702 (dated 5 November 2026 in the copy read; the Commission’s library page gives 20 July 2026 as its publication date and 5 November 2026 as its last update), and the Commission’s Quick Facts page. Article 50(2) requires providers of AI systems that generate synthetic audio, image, video or text to mark the outputs in a machine-readable way and make them detectable, with exceptions such as assistive functions for standard editing (guidelines, §4). Article 50(4) requires deployers who use an AI system for professional purposes to generate or manipulate content that constitutes a deep fake to disclose that it has been artificially generated or manipulated, with labels that people can perceive without technical tools; the machine-readable marking of Article 50(2) does not satisfy it (paragraphs 112, 117). For evidently artistic, creative, satirical or fictional works the disclosure is limited to one that does not hamper the display or enjoyment of the work (paragraph 119). Article 50 applies from 2 August 2026; the guidelines describe a transitional period to 2 December 2026 for marking by generative systems placed on the market earlier, under an amending regulation, and no obligation to label retroactively deep fakes made before 2 August 2026 (paragraphs 153–154). The Quick Facts page gives fines of up to €15 million or 3% of worldwide annual turnover for companies.

United States. The TAKE IT DOWN Act (Public Law 119-12, of 19 May 2025) makes it a federal offence to knowingly publish, through an interactive computer service, a digital forgery of an identifiable adult without that person’s consent, where what is depicted was not voluntarily exposed in a public or commercial setting, is not a matter of public concern, and the publication is intended to cause harm or causes it. Parallel offences cover authentic intimate depictions and depictions of minors, with penalties of up to two years’ imprisonment for offences involving adults and three for those involving minors (section 2). Section 3 requires covered platforms to set up, within one year of enactment, a process through which an identifiable individual can request removal of a non-consensual intimate depiction, and to remove it, and make reasonable efforts to remove known identical copies, within 48 hours of a valid request; the Federal Trade Commission enforces this duty.

United Kingdom (England and Wales). Section 66B of the Sexual Offences Act 2003, inserted by the Online Safety Act 2023 and in force since 31 January 2024, makes it an offence to share intentionally a photograph or film that “shows, or appears to show” another person in an intimate state, without that person’s consent and without a reasonable belief in it, and section 66D(4), applying section 66A(5), extends photograph or film to images made or altered by computer graphics that appear to be one. Section 66E, inserted by the Data (Use and Access) Act 2025 and in force since 6 February 2026, makes it an offence to create intentionally a purported intimate image of an adult without their consent and without a reasonable belief in it. As of 8 November 2026, legislation.gov.uk lists further amendments to these sections, made by an Act of 2026, that it had not yet applied to the revised text.

Detection and Provenance

Two families of countermeasures exist, and neither is complete.

Detection classifies content as authentic or manipulated from the content itself. Rössler et al. (2019, §4) cast it as per-frame binary classification on face crops and found that learned detectors, trained on their dataset, clearly outperformed the human observers of their study, even under strong compression. Li et al. (2020) built Celeb-DF because the visible artefacts of earlier datasets made them unrepresentative of deepfakes circulating online, and reported that it was challenging to most existing detectors, many of which had reached high, sometimes near-perfect, accuracy on the earlier sets (§1); the ROC-AUC article describes how they scored detectors. NIST (2024, §3.2) describes automated detection as a cat-and-mouse game between detection and generation, notes that detectors often perform well only on the generators they were trained on, and reports substantial error rates when detectors face new generators after compression and resizing (§3.2.2.1). Detectors, their datasets, their cues and their evaluation are the subject of deepfake detection as a task.

Provenance records how content was made instead of inferring it. The C2PA specification for Content Credentials, summarized in the image editing and video generation articles and covered with watermarking in the Deepfake Detection article, attaches signed assertions about an asset’s origin and edits, and invisible watermarks let generators mark their own outputs; the EU’s machine-readable marking duty asks providers for marks of this kind. NIST (2024, §1) cautions that such transparency may contribute to trust but does not guarantee it: content that appears legitimate by technical measures can still mislead, for example when it is shown out of context.

Common Misconceptions

• “Every AI-generated image of a person is a deepfake.” Research usage centres on manipulating real people. The EU definition is broader, covering realistic synthetic people, but it requires content that would falsely appear authentic to its foreseeable audience, so an evidently fictional or unrealistic depiction is not one (Commission guidelines, paragraphs 113–114).
• “Deepfakes are face swaps.” Expression and mouth manipulations keep the person’s identity and change what they appear to say or do, and in the FaceForensics++ study they were the hardest for people to spot.
• “A careful viewer can tell.” Accuracy in that study fell towards chance on compressed frames, and NIST cites a study with near-chance human performance.
• “If a detector says real, it is real.” Detectors trained on some generators generalize poorly to others, and, in our reading, a detector’s score is evidence to weigh rather than proof.
• “Consent can be checked by looking.” Whether the person shown agreed is not typically evident from the image itself (NIST, 2024, §5.1.1).
• “Exposing fakes only helps.” The liar’s dividend is the cost: the more people know that recordings can be faked, the easier it is to deny genuine ones (Chesney & Citron, 2019).

Where It Is Used

The concept connects several parts of computer vision:

• Face analysis. Face detection, facial landmark detection and alignment begin almost every pipeline above, and face recognition networks supply identity features and identity scores for swapping.
• Generative models. Autoencoders, GANs, StyleGAN, GAN inversion, image editing and video generation supply the generators, and neural rendering supplies person-specific renderers for reenactment.
• Forensics and evaluation. Detection benchmarks such as FaceForensics++ and Celeb-DF, scored with measures such as ROC-AUC, and provenance standards address the result.