Open Access

ARTICLE

Frequency-Aware Robustness Analysis of Deepfake Detection Models

Haoyang Xu^*

School of Computer Science and Engineering, University of New South Wales (UNSW), Sydney, NSW, Australia

* Corresponding Author: Haoyang Xu. Email:

(This article belongs to the Special Issue: Advances in Artificial Intelligence for Engineering and Sciences)

Journal on Artificial Intelligence 2026, 8, 153-167. https://doi.org/10.32604/jai.2026.078014

Received 22 December 2025; Accepted 10 February 2026; Issue published 11 March 2026

Abstract

This paper conducted a comprehensive study on the robustness of three widely used DFD deep learning models—namely, ResNet50, FreqNet, and Xception v1—to controlled perturbation attacks and frequency masking across a range of 12 different distortions. The study was performed on 254,166 ForenSynth test images, characterizing the distribution of FSI-drop values derived from over 3.05 million paired predictions. The distribution of FSI-drop values is sharply peaked around zero: 99.7% of the samples exhibit |Δ| < 0.1, and the maximum |Δ| ≈ 1.5 × 10⁻³, indicating high baseline stability. In terms of perturbation-wise comparison, Gaussian blur dominates, yielding a mean degradation 30 times greater than that induced by JPEG compression and twice that caused by rescaling. The frequency masking curves further illustrate unique sensitivities: FreqNet shows high-frequency dependence and rapid decay (i.e., >2 to >16 masking scale), Xception exhibits moderate attenuation, whereas ResNet50 remains statistically unchanged (median |Δ| < 10⁻⁴). All of these differences are statistically significant at the model level (p < 0.001). The experiments offer a concrete demonstration that CNNs effectively retain prediction invariance to small amounts of image deformation, but the frequency-sensitive design demonstrates readily interpretable high-frequency sensitivity, thereby providing a principled framework for designing detectors robust to image perturbations. It should be noted that FSI-drop measures score stability rather than absolute performance; §4.6 discusses the complementary AUC curves and leaves combined-distortion or adversarial stress tests to future work.

---

Keywords

---