GLID: Gated Local Intrinsic Dimension Repairs the Blind Spots of Face-Forgery Detectors
Guang Yang University of California, Los Angeles [email protected]
Fengchen Liu University of California, Berkeley [email protected]
arXiv:2607.18770v1 [cs.CR] 21 Jul 2026
Abstract Fine-tuned foundation-model detectors dominate face-forgery benchmarks, yet they stay blind to generator families absent from training. We present GLID, a detector that repairs this blind spot with geometry instead of data. GLID treats the patch tokens of a single image as a sample from a manifold and estimates their local intrinsic dimension (LID) at several depths of a frozen vision transformer. This 12-dimensional, training-free signal enters a fine-tuned detector through a confidence gate whose strength is calibrated purely in-distribution. On a 16-axis cross-generator benchmark, GLID reaches 0.805 mean AUC, first among retrained state-of-the-art baselines and never significantly behind the strongest of them on any axis. It lifts the generation axes by +0.084 AUC while moving reenactment by only -0.005. Two empirical laws explain the design. First, forged faces bend the token manifold at family-specific depths: GAN artifacts peak at the last layer, diffusion artifacts peak mid-network, and the pattern survives four backbones, three dimension estimators, and non-face imagery. Second, fine-tuning absorbs auxiliary gains exactly where training data covers: injecting 1% target-family images erases a +0.100 gain, so geometric signals matter precisely where data is unavailable. The deterministic signal also cuts the cross-seed spread of accuracy 5.5×. Code, preregistered analysis gates, and per-image scores accompany the paper.
1
Introduction
Face forgery has outgrown its detectors. Generators moved from GANs [1–3] to diffusion models [4–6], and a detector trained on classic face swaps meets diffusion portraits, one-shot reenactors, and GAN samples it has never seen. Fine-tuning a strong image backbone such as CLIP [7] on FaceForensics++ [8] remains the most reliable recipe [9], with frozen-backbone probes close behind [10], but the recipe has a structural weakness. The model learns the artifact families present in training and stays near chance on the rest. We call these unseen families the detector’s blind axes. This paper asks a simple question. Does a frozen foundation model already carry a signal that covers a blind axis, without any forgery labels? We answer yes, and we locate the signal in manifold geometry. The patch tokens of a single image are a sample from a low-dimensional structure inside the feature space. Generated faces perturb the local intrinsic dimension (LID) of that structure. The perturbation is invisible to a linear head but measurable with a classical estimator [11], it requires no training, and it lives at depths of the network that forensic fine-tuning barely reshapes [12]. We build this observation into GLID (Gated Local Intrinsic Dimension). GLID computes a 12dimensional LID profile per image, from four depths and three neighborhood sizes of a frozen DINOv3 [13]. A confidence gate injects the profile into a fine-tuned detector only where the detector is uncertain. A single scalar controls the injection strength, and we select it with an in-distribution rule that never touches evaluation data. Figure 1 summarizes the pipeline; Figure 2 details the signal. Preprint.
METHOD
one image, one gated score TRAINING-FREE GEOMETRY
LID profile
frozen ViT DINOv3 · no labels no training
wℓ · sℓ b₆
b₁₂
b₁₈
b₂₃
ℓ ∈ ℝ¹² · deterministic
signed geometry
× α*
GLID = z + α* · g · wℓ sℓ
GAN bends the deepest block · diffusion bends mid-network
one scalar α* · calibrated in-distribution
FINE-TUNED DETECTOR
CLIP-L fine-tune
input face 16×16 patches
logit z
trained on FF++ strong on seen axes
confidence gate g = 4p(1−p) base logit always bypasses to the sum
EXPERIMENTS 1
train once · freeze the protocol · measure
Train once
2
Calibrate α*
3
Frozen 16-axis benchmark
4
Two empirical laws
Outcome
5
+0.084 −0.005
FF++ c23 only · 11,296 frames identity-safe splits 720/140/140 same crops for every method
training frames only · no eval data largest α with in-dist. drop ≤ 0.002 α* = 0.1
generation · swap · reenactment · hard · wild all baselines retrained: same data, same crops 3 seeds · bootstrap 95% CI
family–depth: 4 backbones · 3 estimators absorption: adding 1% coverage (113 images) erases the +0.100 geometry gain
generation
base GLID
reenactment
0.805 mean AUC · first among retrained SOTA
Figure 1: GLID at a glance. Method (top): a frozen ViT yields a training-free, deterministic LID profile across four depths; a fine-tuned detector yields a logit and a confidence gate g = 4p(1 − p); the gated geometric term joins the always-present base logit as GLID = z + α∗ g wℓ sℓ . Experiments (bottom): train once on FF++ c23, calibrate α∗ purely in-distribution, evaluate on a frozen 16-axis benchmark with retrained baselines, and verify two empirical laws. Unseen generation axes gain +0.084 AUC while reenactment moves by -0.005.
A One image
B Local intrinsic dimension from cosine neighbours
one token manifold
boundary rk + 1
r1
q
d(ti , tj ) = 2 − 2 ti> tj "
dbk (ti ) = − 1k
input face, 16 × 16 patches
query token + 16 nearest neighbours (k = 16)
token manifold
frozen ViT-L/16, block b
(PCA view)
#
k X
log rkr+j (1t(it)i ) −1
j=1
LID (kb) = N1
N X
dbk (ti )
i=1
Figure 2: The GLID signal. (A) A frozen ViT maps the 16 × 16 patches of one face to N =256 tokens; within a single image these tokens form a manifold. The cloud is a PCA view for display only — every distance is measured in the original 1024-D feature space. (B) The Levina–Bickel estimator reads the local intrinsic dimension of that manifold from each token’s k cosine neighbors (rk+1 sets the local boundary; neighbor layout schematic); averaging over tokens gives one deterministic, training-free scalar per depth. No labels, no training, no reference set.
Two empirical laws make the design principled rather than heuristic. Law 1: family–depth signature. GAN-generated faces disturb the token manifold at the deepest layers. Diffusion-generated faces disturb it mid-network, and the disturbance collapses at depth. The split holds on 4 of 4 backbones, under 3 different dimension estimators, on held-out replication samples, and beyond faces (ProGAN on object imagery). No single “best layer” exists; the family decides the depth (Section 6.2). Law 2: absorption boundary. Fine-tuning absorbs an auxiliary signal’s gain exactly on the axes its training distribution covers. We prove the causal version by intervention: adding 1% (113 images) of generation-family data to training collapses the LID gain from +0.100 to -0.003, while the untouched 2
axes keep their gains (Section 6.1). The law tells a practitioner when to use data and when to use geometry: coverage is the cheap fix for known families, GLID is the fix for unknown ones. Our contributions: • Method. The first detector to use intra-image patch-manifold LID as a forgery signal, with a gated, in-distribution-calibrated injection (Section 3). • Two laws. A family–depth signature of generators, robust across backbones, estimators, and domains; and an interventionally verified absorption boundary for auxiliary signals. • Evidence. A 16-axis frozen benchmark with identical crops, training data, and schedules for every method; bootstrap and paired-bootstrap statistics; 72 verified references; preregistered analysis gates reported including the one that failed. • Honesty. GLID leads overall (0.805 vs. 0.790 for the best rival) and never loses significantly to it on any axis (3 wins, 0 losses), but SBI stays stronger on the T2I axis and in the wild. We report every such case.
2
Related work
Learned forgery detectors. The field moved from CNNs [8, 14] through frequency and blending cues [15–18] to foundation-model probes and fine-tunes [9, 10, 19], with self-blending augmentation [20] and temporal models [21–23] as strong specializations. Up-sampling traces [24] and reconstruction errors [25–28] target generated imagery. We retrain the strongest of these lines under one protocol. Training-free detection. RIGID [29] scores perturbation sensitivity of frozen embeddings; MINDER [30] tunes the perturbation per domain. Score-manifold curvature offers another geometric route [31]. DCA [32] measures cross-region dimension coactivation on frozen DINOv3 and is the setting closest to ours; its statistic is channel coactivation, not manifold dimension, and we show the two cover different blind axes. SPLIT [33] and token-selection methods [34] confirm that frozen patch tokens carry forensic signal. A recent audit questions the robustness of this family [35]; we answer with corruption sweeps. Intrinsic dimension. LID estimation goes back to maximum-likelihood [11] and TwoNN [36], with tight-locality guarantees for small samples [37]. Depth profiles of representation ID are known [38, 39]. LID has served adversarial-example detection across samples [40, 41] and text detection via persistent homology [42]. multiLID [43] applied inter-sample, supervised LID to generated images and was later retracted by its authors; its neighborhoods live across a reference batch, whereas ours live inside one image, unsupervised. A regularizer once aligned patch LID during inpainting [44]. To our knowledge no prior work scores forgeries by the intrinsic dimension of a single image’s token manifold. Layer choice. MoLD [45] observes with supervised probes that the best CLIP layer varies by dataset, and Huang et al. [46] searches for one optimal intermediate layer, explaining mid-layer strength with an ID hunchback. Related fine-tuning studies treat deep semantic layers as cross-domain stabilizers [47]. Our family–depth signature says the premise of a single best layer is wrong: the generator family sets the depth, so a detector should read several (Section 6.2).
3
Method
3.1
Intra-image patch-manifold LID
Let a frozen ViT-L/16 [13, 48] map a face crop (resized to the backbone’s 256-px input) to N =256 (b) patch tokens T (b) = {ti }N as a sample from a i=1 at block b, each ℓ2 -normalized. We treat T manifold and estimate its local intrinsic dimension with the maximum-likelihood estimator [11] on q ⊤ cosine geometry, d(ti , tj ) = 2 − 2 ti tj : k
1X rj (ti ) dbk (ti ) = − log k j=1 rk+1 (ti )
!−1
N
,
3
(b)
LIDk
=
1 Xb dk (ti ), N i=1
(1)
where rj (ti ) is the distance to the j-th neighbor within the same image and rk+1 defines the local boundary, matching our implementation. With 256 tokens the estimator sits in the tight-locality regime analyzed by Amsaleg et al. [37]; Section 5.1 shows our conclusions are estimator-independent. The signal is a deterministic function of the input: no labels, no training, no reference set. This is the core difference from inter-sample LID pipelines [40, 43], which need a batch of other images and a supervised head. (b)
We compute LIDk for blocks b ∈ {6, 12, 18, 23} and k ∈ {8, 16, 32}, giving a 12-dimensional profile ℓ ∈ R12 per image at 4.1 ms on one GPU. 3.2
Why several depths: the family–depth signature
A single LID scalar would be the natural choice, and it would be wrong. Generated faces do not raise or lower dimension uniformly (Figure 3A). GAN samples disturb the manifold at the deepest block, where the profile on StyleGAN faces reaches 0.863 AUC alone. Diffusion samples disturb it mid-network (0.892 at 50% depth) and the disturbance collapses at depth (0.581 at the last block). The two families are therefore mutually invisible at each other’s best depth. Section 6.2 establishes this signature across backbones, estimators, and domains. The 12-coordinate profile is our measurement instrument and drives every analysis in Section 6. The deployable score below pools only the deepest and mid blocks, one per family regime; Section 5.1 shows that pooling all four blocks dilutes the direction with near-chance shallow coordinates and lowers accuracy. 3.3
Gated injection into a fine-tuned detector
The base detector is a CLIP-L fine-tune (last six blocks and head) on FaceForensics++ [8]; Section 4 gives the recipe. For an image with detector logit B, let z = (B − µB )/σB with statistics from training frames, and p = σ(z). Standardize the LID profile the same way, ℓ̃ = (ℓ − µℓ )/σℓ , and pool ¯ ¯ ¯ ¯ ¯ the deep and mid coordinates: sℓ = ℓ̃23 + ℓ̃12 , wℓ = tanh (|ℓ̃23 | + |ℓ̃12 |)/2 , where ℓ̃b averages the three k values of block b. The score is GLID(x) = z + α 4p(1 − p) wℓ sℓ . | {z }
(2)
confidence gate g
The gate g opens only where the detector is unsure (Figure 3B). On covered axes the detector is confident and GLID reduces to the detector; on blind axes the geometry speaks. The magnitude weight wℓ keeps small-anomaly images quiet, and the signed pooling sℓ carries the family direction. 3.4
Calibrating α without touching evaluation data
The remaining scalar α trades blind-axis gain against interference. Choosing it on evaluation axes would be tuning on test data. We instead use the only distribution a deployer owns: training frames. As α grows, in-distribution AUC decays monotonically (from 0.9931 at α=0). We take the largest α whose in-distribution drop is at most 0.002, giving α∗ =0.1 (in-distribution 0.9920). Everything downstream uses this single value. Section 5.1 shows the full trade-off curve; the uncalibrated choice α=1 overshoots the knee and pays a reenactment cost, which explains why naive fusion attempts fail.
4
Benchmark and protocol
Training data. FaceForensics++ c23 [8], the standard cross-dataset training corpus: four manipulations plus real video. We partition the 1,000 identities 720/140/140 and keep a forged video only if both source and target identities fall inside one split, so no identity leaks across splits. Four frames per video give 11,296 training frames. Every face in the study is detected and cropped the same way (YuNet [49], margin 0.35, 224 px), because crop inconsistencies alone can move cross-dataset AUC by several points. Sixteen evaluation axes. Table 1 lists the axes in five groups. Generation: StyleGAN [2] and a mixed text-to-image pool [6, 50], against CelebA reals [51]. Swap: Celeb-DF v2 [52] with manually verified label semantics, FF++ FaceSwap, and four modern swaps from DF40 [53]: InSwapper, SimSwap [54], FaceSwap, and BlendFace [55]. Reenactment: FF++ NeuralTextures and five DF40 reenactors 4
oriented AUC (LID alone)
A Family sets the peak depth T2I peak
0.9
B Confidence-gated injection
GAN peak detector logit z
0.8
confidence gate
p = σ(z) g = 4p(1 − p)
×
0.7 T2I collapses
0.6
multi-depth LID ` ∈ 12
StyleGAN faces ProGAN (non-face) diffusion (T2I) faces
0.5 25%
50%
75%
network depth
+
signed geometry
w` s`
GLID score
z + α ∗ gw` s`
100%
Figure 3: Why several depths, and how the signal enters. (A) Measured LID-alone AUC across depth: diffusion (T2I) peaks mid-network and collapses at the last block, while GANs peak at the last block — StyleGAN faces and ProGAN non-face imagery share the same pattern (§6.2). No single layer covers both families, so GLID measures a multi-depth profile. (B) The profile enters a fine-tuned detector through the confidence gate g = 4p(1 − p): on covered axes g≈0 and the detector is preserved; on blind axes the gate opens and the signed geometry wℓ sℓ corrects the score. The base logit always bypasses to the sum.
[56–59]. Hard: DFDC faces [60]. In the wild: WildDeepfake [61]. DF40 axes use only videos whose appearance identity lies outside our training split. Up to 500 images per class per axis. Baselines, retrained. Every learned baseline uses the same backbone capacity, the same training frames, the same schedule, and the same crops: UnivFD (frozen CLIP-L probe) [10], NPR [24], SBI [20] on the same CLIP-L, and Effort-style orthogonal-subspace fine-tuning [9]. SBI, Effort, and our detector are trained with three seeds; we report per-seed spread and the mean of per-seed logits. Training-free baselines: RIGID [29] with the blur perturbation recommended for faces [30], our re-implementation of DCA [32] under identical crops (landmark-anchored regions replacing its parser), a raw SD ϵ-error scorer distilled from the reconstruction family [25–27], and LID alone. Metrics. Frame-level AUC per axis; 95% bootstrap intervals; paired bootstrap for head-to-head deltas; group means and the 16-axis mean. We use raw score orientation everywhere and mark direction failures rather than silently flipping them.
Table 1: The 16 evaluation axes. Only FF++ c23 is ever trained on; every other source is unseen. DF40 fake counts are small after identity filtering; confidence intervals reflect this. Axis
Group
Real
Fake
Source
StyleGAN T2I CelebDF-v2 FF-FS FF-NT FOMM HyperReenact SadTalker Wav2Lip TPSM InSwapper SimSwap FaceSwap-DF40 BlendFace DFDC WildDeepfake
GEN GEN SWAP SWAP REEN REEN REEN REEN REEN REEN SWAP SWAP SWAP SWAP HARD WILD
500 500 500 140 140 140 140 140 140 140 140 140 140 140 500 500
500 500 500 30 30 46 46 46 46 46 39 46 46 46 500 500
140k real–fake faces text-to-image pool / CelebA Celeb-DF v2 (label-verified) FF++ c23 FF++ c23 DF40 (FF domain) DF40 (FF domain) DF40 (FF domain) DF40 (FF domain) DF40 (FF domain) DF40 (FF domain) DF40 (FF domain) DF40 (FF domain) DF40 (FF domain) DFDC faces WildDeepfake
5
5
Results
Main comparison. Table 2 and Figure 4 give the headline. GLID reaches 0.805 mean AUC over 16 axes, ahead of the strongest retrained rival (Effort, 0.790) and of its own base detector (0.798). Per-axis paired bootstrap (Table 5) shows GLID beats Effort significantly on 3 axes and loses on 0. Against SBI it wins 8 and loses 4; the losses concentrate where self-blending is the right prior. The repair is not free everywhere: relative to its own base detector, GLID gives back small margins on the swap group (0.910 vs. 0.915) and on DFDC (0.636 vs. 0.647), the price of a gate that sometimes opens off-target (gate behavior in Figure 13). The base detector itself is a strong result. Across 8 training seeds its per-seed 16-axis mean is 0.788±0.009, which already tops several published mechanisms under equal data. Single-seed numbers of any method can mislead by several points, so all our comparisons are multi-seed. Blind-spot repair. The generation group moves from 0.731 (detector) to 0.816 (+0.084), while reenactment moves by -0.005 only. On StyleGAN the paired delta against SBI is [+0.188, +0.244] and against Effort [+0.086, +0.120], both excluding zero. On the T2I axis SBI remains significantly stronger ([-0.087, -0.049]); GLID still beats Effort there ([+0.063, +0.095]). We claim generationgroup repair, not per-axis dominance. Qualitative behavior. Figure 5 shows GLID scores across sources; Appendix A adds a larger success matrix and, importantly, the failure modes: lip-sync forgeries that edit a few mouth pixels, heavily compressed DFDC faces, and in-the-wild occlusions.
5.1
Ablations
Injection strength. Figure 6 and Table 3 sweep α. The trade-off has a sharp knee: at α∗ =0.1 the generation gain is nearly free, while α=1 buys 0.825 generation at a reenactment cost down to 0.610. All Pareto-optimal points lie in α ∈ [0, 0.3]. The in-distribution rule lands inside this range without evaluation access, which turns a hyperparameter into a calibration. Block pooling. The deployable score reads one block per family regime (Eq. 2). Pooling all four blocks instead dilutes the direction with near-chance shallow coordinates and drops overall AUC from 0.805 to 0.793. Single-block variants serve one family only: block 23 alone reaches 0.762 on generation, block 12 alone 0.795 (full numbers in Appendix C). Estimator choice. Replacing the MLE with TwoNN [36] or a persistent-homology-style MST estimator [42] preserves the family–depth signature on all three generation sources (Figure 7); the MLE is uniformly strongest, which justifies its use. Backbone choice. The signature and the signal survive DINOv2 [62], CLIP [7], and EVA-02 [63] (Appendix Figure 14); self-supervised backbones carry the strongest geometry, consistent with He et al. [29].
Table 2: Group-mean AUC on the 16-axis benchmark. GLID uses one deployable score (Eq. 2, α∗ =0.1). Bold marks the column best. The detector row is the 3-seed ensemble of logits that GLID builds on; the per-seed spread across 8 seeds (0.788±0.009 overall) is a different estimator and is reported in the text. Full per-axis values with intervals are in Table 4. Method
Gen.
Swap
Reenact
DFDC
Wild
All 16
GLID (ours)
0.816
0.910
0.720
0.636
0.830
0.805
CLIP-L fine-tune (3-seed ens.) SBI (3-seed) Effort (3-seed) UnivFD NPR RIGID (training-free) DCA (training-free) LID alone (training-free)
0.731 0.742 0.726 0.606 0.495 0.421 0.595 0.791
0.915 0.820 0.902 0.846 0.564 0.539 0.787 0.551
0.725 0.663 0.716 0.679 0.601 0.729 0.675 0.474
0.647 0.541 0.645 0.538 0.519 0.552 0.578 0.525
0.825 0.870 0.833 0.717 0.687 0.600 0.655 0.513
0.798 0.737 0.790 0.726 0.575 0.600 0.700 0.548
6
GEN
T2I StyleGAN FF-FS FaceSwap*
SWAP
InSwap CelebDF SimSwap BlendFace FOMM FF-NT
REEN
HyperR Wav2Lip TPSM SadTalker DFDC
HARD
WildDF
WILD
0.3
0.4
0.5 GLID (ours)
0.7 0.6 AUC (500/class caps, 95% bootstrap CI) CLIP-L FT
SBI
Effort
0.8
UnivFD
0.9
1.0
RIGID
Figure 4: Per-axis AUC with 95% bootstrap intervals for the six strongest methods. GLID (blue circles) repairs the generation axes without giving up the swap axes. DFDC stays hard for every method; WildDeepfake belongs to SBI. Real (FF++)
FF-NT
FF-FS
StyleGAN
T2I
InSwap
BlendFace
real p=0.17
fake p=0.85
fake p=0.86
fake p=0.87
fake p=0.78
fake p=0.83
fake p=0.85
real p=0.18
fake p=0.77
fake p=0.86
fake p=0.87
fake p=0.77
fake p=0.82
fake p=0.84
real p=0.18
fake p=0.76
fake p=0.86
fake p=0.86
fake p=0.76
fake p=0.82
fake p=0.82
Figure 5: GLID predictions on unseen-source faces (all correct; p is the predicted forgery probability). Columns: FF++ real, two FF++ manipulations, StyleGAN, text-to-image, and two DF40 swaps. Real examples come from consented FF++ actors; generated faces depict no real person.
7
A
2.5 injection strength α
α ∗ =0.1 (ours) α=1 (uncalibrated)
0.82
2.0
0.80
1.5
0.78
1.0
0.76 0.74
0.5
α=0 (detector alone)
α ∗ =0.1
0.95 0.90 0.85 0.80 0.75
0.0
0.70
0.60 0.65 reenactment AUC
0.55
1.00 in-distribution AUC (train frames)
0.84 generation AUC
B
3.0
selection rule (0.002 drop)
0.0
0.5
1.0
1.5
α
2.0
2.5
3.0
Figure 6: (A) Generation–reenactment trade-off as α sweeps; the knee sits near α=0.2, and the in-distribution rule picks α∗ =0.1 without seeing any evaluation axis. α=1 overshoots. (B) The selection rule: largest α with at most a 0.002 in-distribution drop.
Table 3: Gate-strength sweep (group AUC). The in-distribution rule selects α∗ =0.1. Gen.
Swap
Reenact
DFDC
Wild
All 16
0.0 (detector) 0.1 (α∗ ) 0.2 0.3 0.5 1.0 2.0
0.731 0.816 0.837 0.841 0.837 0.825 0.813
0.915 0.910 0.902 0.891 0.865 0.818 0.757
0.725 0.720 0.708 0.695 0.667 0.610 0.555
0.647 0.636 0.616 0.599 0.578 0.557 0.544
0.825 0.830 0.828 0.819 0.791 0.727 0.663
0.798 0.805 0.799 0.789 0.765 0.719 0.669
Levina-Bickel MLE
0.9 oriented AUC
α
TwoNN
PHD (MST)
0.8 0.7 0.6 0.5
25
50
depth (%)
75
100
25
StyleGAN (GAN)
50
depth (%)
T2I (diffusion)
75
100
25
50
depth (%)
75
100
ProGAN (non-face)
Figure 7: The family–depth signature is estimator-independent. Three intrinsic-dimension estimators on the same token clouds reproduce the split: diffusion peaks mid-depth and collapses at the last block, GAN and non-face ProGAN peak at the deepest block.
8
6
Analysis
6.1
The absorption boundary, established by intervention
Why does a 12-number signal beat retraining on blind axes, yet add nothing elsewhere? Our answer is a law about fine-tuning, not about faces. Prior work shows fine-tuning distorts pretrained features [64], that dominant features starve alternatives of gradient [65], and that forensic fine-tunes leave representations largely semantic [12]. We state the consequence for signal fusion and test it causally: A fine-tuned detector absorbs an auxiliary signal’s gain exactly on the axes its training distribution covers; on uncovered axes the gain survives. The interventional test injects a controlled dose of generation-family images into the training set and retrains (three seeds per dose). Figure 8A and Table 6 give the dose–response. At 0% coverage the LID gain on generation axes is +0.100±0.011. At 1% coverage (113 images) the gain is -0.003: gone. The detector’s own generation AUC jumps from 0.720 to 0.873 and reaches 0.988 at 20%. Reenactment gains stay flat within seed noise at every dose. Absorption is threshold-like, not gradual. The law has two practical corollaries. First, if you can name the family, buy data, not machinery: 1% coverage outperforms any auxiliary signal we measured. Second, auxiliary mechanisms must be evaluated on axes outside training coverage, or absorption will erase them and the evaluation will call them useless. The same law explains our own negative result: a preregistered variant that fused LID with a learned global head failed its gates because the head, fitted on covered data, learned the signal away (Appendix B). 6.2
The family–depth signature is a property of generators
Figure 8B overlays depth profiles for four backbones on three generation sources. The GAN profile rises monotonically to the last block (StyleGAN faces; ProGAN objects [66, 67]), the diffusion profile peaks at 50–75% and collapses at depth. Three estimators agree (Figure 7). Because ProGAN images contain no faces, the signature tracks the generator family rather than the face domain. This resolves the single-best-layer question raised by supervised layer studies [45, 46]: the optimum is family-conditional, so any single-layer detector is blind to one family by construction. It also mirrors depth profiles of representation dimensionality in classification [38, 39], now with a forensic direction attached. 6.3
Feature geometry at a glance
Figure 9 projects the 12-dimensional LID profiles with PCA fitted on real faces only. Generation families leave the real cloud along family-specific directions; swap and reenactment forgeries stay
B
∆AUC on generation axes
0.25 0.20 0.15
detector gain from coverage blind-axis gain from LID
0.10
collapses at 1% (113 images)
0.05 0.00 0%
1% 5% generation coverage added to training
oriented AUC (training-free LID)
A
20%
GAN diffusion GAN (non-face)
0.9 0.8 0.7 0.6 0.5
25%
50%
network depth
75%
100%
Figure 8: (A) The absorption boundary, interventionally. Adding generation coverage to training collapses the blind-axis LID gain at 1% already, while the detector’s own accuracy on that family rises. (B) The family–depth signature. Thin lines: four backbones; thick: mean. GAN families (face and non-face) peak at the deepest block; diffusion peaks mid-network and collapses at depth. 9
inside it. The picture explains both the power and the limit of the signal in one plot: geometry separates what generators synthesize, not what editors paste. 6.4
The training-free triangle and direction stability
Training-free detectors split the blind axes among themselves: DCA is swap-oriented (swap 0.787, generation 0.595; our re-implementation reaches 0.847 on Celeb-DF), LID is generation-oriented (generation 0.791, swap 0.551), and RIGID is reenactment-oriented (reenactment 0.729). Naive score or feature fusion of DCA and LID fails to dominate both parents; the fusion head, fitted on covered data, reproduces absorption in miniature. Covering multiple blind axes without labels remains open. Direction stability separates the geometric signal from the sensitivity family. RIGID’s raw direction inverts across axes (T2I raw AUC 0.043) and wanders under corruption, reaching 0.300 at JPEG-50 and 0.779 under strong blur. The raw SD ϵ-error inverts on T2I as well (0.102): generated images sit close to the generator’s own manifold. A signed scorer whose sign flips per axis cannot be deployed without per-axis knowledge. The LID direction is family-consistent and degrades smoothly (T2I 0.822 clean, 0.783 at JPEG-50; Figure 10), answering the robustness audit of Zhou and Wang [35] for this signal. 6.5
Deterministic signals stabilize seeds
Across 8 training seeds, the detector’s generation-axis AUC varies with standard deviation 0.0425. Adding the LID injection cuts it to 0.0078 (5.5×). A control that injects the same magnitudes with permuted image assignment also stabilizes (0.0096, 4.4×) but destroys accuracy (-0.146 vs. +0.118 for LID). Stabilization is therefore a generic property of deterministic injection; the contribution of LID is that gain and stability arrive together (Figure 11). Seed variance of fine-tuned detectors is rarely reported [68, 69]; at these magnitudes it can decide leaderboard order, which is why every learned method here is multi-seed. 6.6
Cost and calibration
The LID signal adds 4.1 ms per image to a 3.6 ms detector (batch 32, one GPU), cheaper than RIGID (8.0 ms) and DCA (18.7 ms). With temperature T =1.75 fitted on validation frames, expected calibration error is 0.051 in-distribution but 0.126 averaged across the 16 axes [70]: cross-generator probabilities remain miscalibrated even when ranking is good, a caution for downstream use.
real (3 sources) GAN fake diffusion fake swap/reenact fake
7.5 5.0 PC2 (17%)
2.5 0.0 2.5 5.0 7.5 10.0
5
0
5 PC1 (61%)
10
15
Figure 9: PCA of LID profiles (fitted on real faces). GAN and diffusion fakes exit the real cloud along distinct directions; swap and reenactment fakes remain inside, which is exactly where the fine-tuned detector is already strong. 10
StyleGAN
T2I
CelebDF
0.6 0.4 0.2
LID (ours)
RIGID
x
r2
wn 2 do
0
r1
blu
blu
0
0 g7
g5 jpe
jpe
x
an
g9 jpe
cle
r2
do
wn 2
r1
blu
blu
0
0
g5
g7
jpe
0 g9
jpe
jpe
x
r2 blu
wn 2 do
r1 blu
0
0
g5
g7
jpe
0 g9 jpe
jpe
an cle
an
inverted direction
0.0
cle
AUC (raw orientation)
0.8
DCA
Figure 10: Corruption sweeps for three training-free signals. LID degrades smoothly and never flips direction; RIGID’s direction is unstable on T2I (shaded region marks inversion); DCA is robust on its home axis (Celeb-DF).
A
B 0.80 mean AUC (GEN)
AUC std across 8 seeds
0.06 0.04 0.02 0.00
StyleGAN
0.70 0.65 0.60 0.55
T2I detector alone
0.75
+ LID (ours)
0.010 0.015 0.020 0.025 0.030 0.035 0.040 mean seed std (GEN) + permuted control
Figure 11: (A) Seed standard deviation on generation axes: detector, detector+LID, and a permuted deterministic control. (B) Mean accuracy against seed spread: only LID moves up and left.
7
Limitations
Face-domain generation sources are thin: one GAN corpus and one mixed T2I pool; the cross-domain and cross-estimator checks mitigate but do not remove this. On T2I, self-blending training remains significantly stronger than our repair, and in-the-wild data favors SBI (0.870). DFDC stays near 0.636 for every method we measured; heavy compression suppresses both semantic and geometric evidence. The 256-token estimator is biased at small k [37], which we absorb into direction conventions rather than correct. Our protocol is frame-level; video aggregation would lift absolute numbers. Finally, GLID repairs generation blind axes specifically; lip-sync micro-edits remain open (Appendix A).
8
Conclusion
GLID turns a classical quantity, local intrinsic dimension, into a deployable repair for the blind axes of fine-tuned face-forgery detectors. The method is one equation on top of a frozen backbone. Its justification is two laws with unusual evidential support for this field: a family–depth signature that survives backbones, estimators, and domains, and an absorption boundary verified by intervention. We hope the second law changes practice beyond this paper: auxiliary signals should be measured where training coverage ends, because that is the only place they can matter. 11
Acknowledgments We thank the Phi Lab Foundation for providing the computing infrastructure and the research funding that supported this work.
References [1] Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. In Advances in Neural Information Processing Systems, volume 27, 2014. [2] Tero Karras, Samuli Laine, and Timo Aila. A style-based generator architecture for generative adversarial networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2019. [3] Tero Karras, Samuli Laine, Miika Aittala, Janne Hellsten, Jaakko Lehtinen, and Timo Aila. Analyzing and improving the image quality of StyleGAN. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2020. [4] Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. In Advances in Neural Information Processing Systems, volume 33, 2020. [5] Prafulla Dhariwal and Alex Nichol. Diffusion models beat GANs on image synthesis. In Advances in Neural Information Processing Systems, volume 34, 2021. [6] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. Highresolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2022. [7] Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Gretchen Krueger, and Ilya Sutskever. Learning transferable visual models from natural language supervision. In International Conference on Machine Learning, 2021. [8] Andreas Rössler, Davide Cozzolino, Luisa Verdoliva, Christian Riess, Justus Thies, and Matthias Nießner. FaceForensics++: Learning to detect manipulated facial images. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2019. [9] Zhiyuan Yan, Jiangming Wang, Peng Jin, Ke-Yue Zhang, Chengchun Liu, Shen Chen, Taiping Yao, Shouhong Ding, Baoyuan Wu, and Li Yuan. Orthogonal subspace decomposition for generalizable AI-generated image detection. In International Conference on Machine Learning, 2025. [10] Utkarsh Ojha, Yuheng Li, and Yong Jae Lee. Towards universal fake image detectors that generalize across generative models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2023. [11] Elizaveta Levina and Peter J. Bickel. Maximum likelihood estimation of intrinsic dimension. In Advances in Neural Information Processing Systems, volume 17, 2004. [12] Chao Shuai, Shaojing Fan, Chenlin Zou, Bin Gong, Weichen Lian, Xiuli Bi, Zhenguang Liu, Zhongjie Ba, and Kui Ren. When detectors forget forensics: Blocking semantic shortcuts for generalizable AI-generated image detection. arXiv preprint arXiv:2603.09242, 2026. [13] Oriane Siméoni, Huy V. Vo, Maximilian Seitzer, Federico Baldassarre, Maxime Oquab, Cijo Jose, Vasil Khalidov, Marc Szafraniec, et al. DINOv3. arXiv preprint arXiv:2508.10104, 2025. [14] Darius Afchar, Vincent Nozick, Junichi Yamagishi, and Isao Echizen. MesoNet: A compact facial video forgery detection network. In IEEE International Workshop on Information Forensics and Security (WIFS), 2018. [15] Yuyang Qian, Guojun Yin, Lu Sheng, Zixuan Chen, and Jing Shao. Thinking in frequency: Face forgery detection by mining frequency-aware clues. In European Conference on Computer Vision (ECCV), 2020. 12
[16] Honggu Liu, Xiaodan Li, Wenbo Zhou, Yuefeng Chen, Yuan He, Hui Xue, Weiming Zhang, and Nenghai Yu. Spatial-phase shallow learning: Rethinking face forgery detection in frequency domain. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2021. [17] Lingzhi Li, Jianmin Bao, Ting Zhang, Hao Yang, Dong Chen, Fang Wen, and Baining Guo. Face X-ray for more general face forgery detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2020. [18] Lucy Chai, David Bau, Ser-Nam Lim, and Phillip Isola. What makes fake images detectable? Understanding properties that generalize. In European Conference on Computer Vision (ECCV), 2020. [19] Christos Koutlis and Symeon Papadopoulos. Leveraging representations from intermediate encoder-blocks for synthetic image detection. In European Conference on Computer Vision (ECCV), 2024. [20] Kaede Shiohara and Toshihiko Yamasaki. Detecting deepfakes with self-blended images. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2022. [21] Alexandros Haliassos, Konstantinos Vougioukas, Stavros Petridis, and Maja Pantic. Lips don’t lie: A generalisable and robust approach to face forgery detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2021. [22] Yinglin Zheng, Jianmin Bao, Dong Chen, Ming Zeng, and Fang Wen. Exploring temporal coherence for more general video face forgery detection. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2021. [23] Alexandros Haliassos, Rodrigo Mira, Stavros Petridis, and Maja Pantic. Leveraging real talking faces via self-supervision for robust forgery detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2022. [24] Chuangchuang Tan, Huan Liu, Yao Zhao, Shikui Wei, Guanghua Gu, Ping Liu, and Yunchao Wei. Rethinking the up-sampling operations in CNN-based generative network for generalizable deepfake detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2024. [25] Zhendong Wang, Jianmin Bao, Wengang Zhou, Weilun Wang, Hezhen Hu, Hong Chen, and Houqiang Li. DIRE for diffusion-generated image detection. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2023. [26] Ruipeng Ma, Jinhao Duan, Fei Kong, Xiaoshuang Shi, and Kaidi Xu. Exposing the fake: Effective diffusion-generated images detection. arXiv preprint arXiv:2307.06272, 2023. [27] Yunpeng Luo, Junlong Du, Ke Yan, and Shouhong Ding. LaRE2 : Latent reconstruction error based method for diffusion-generated image detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2024. [28] Jonas Ricker, Denis Lukovnikov, and Asja Fischer. AEROBLADE: Training-free detection of latent diffusion images using autoencoder reconstruction error. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2024. [29] Zhiyuan He, Pin-Yu Chen, and Tsung-Yi Ho. RIGID: A training-free and model-agnostic framework for robust AI-generated image detection. arXiv preprint arXiv:2405.20112, 2024. [30] Chung-Ting Tsai, Ching-Yun Ko, I-Hsin Chung, Yu-Chiang Frank Wang, and Pin-Yu Chen. Understanding and improving training-free AI-generated image detections with vision foundation models. arXiv preprint arXiv:2411.19117, 2024. [31] Jonathan Brokman, Amit Giloni, Omer Hofman, Roman Vainshtein, Hisashi Kojima, and Guy Gilboa. Manifold induced biases for zero-shot and few-shot detection of generated images. In International Conference on Learning Representations, 2025. 13
[32] Izaldein Al-Zyoud and Abdulmotaleb El Saddik. Dimensional coactivation for representational consistency in frozen vision foundation models. arXiv preprint arXiv:2605.08249, 2026. [33] Jongyeop Hyun and Hyounghun Kim. SPLIT: Training-free AI-generated and partially edited video detection via spatial patch-level incoherence and temporal roughness. arXiv preprint arXiv:2607.02886, 2026. [34] Zhenglin Huang, Jason Li, Haiquan Wen, Tianxiao Li, Xi Yang, Lu Qi, Bei Peng, Xiaowei Huang, Ming-Hsuan Yang, and Guangliang Cheng. Rethinking cross-generator image forgery detection through DINOv3. arXiv preprint arXiv:2511.22471, 2025. [35] Jingwen Zhou and Mingzhe Wang. How fragile are training-free AI-generated image detectors? A controlled audit of score direction, preprocessing, and compression. arXiv preprint arXiv:2606.20488, 2026. [36] Elena Facco, Maria d’Errico, Alex Rodriguez, and Alessandro Laio. Estimating the intrinsic dimension of datasets by a minimal neighborhood information. Scientific Reports, 7:12140, 2017. [37] Laurent Amsaleg, Oussama Chelly, Michael E. Houle, Ken-ichi Kawarabayashi, Miloš Radovanović, and Weeris Treeratanajaru. Intrinsic dimensionality estimation within tight localities: A theoretical and experimental analysis. arXiv preprint arXiv:2209.14475, 2022. [38] Alessio Ansuini, Alessandro Laio, Jakob H. Macke, and Davide Zoccolan. Intrinsic dimension of data representations in deep neural networks. In Advances in Neural Information Processing Systems, volume 32, 2019. [39] Phillip Pope, Chen Zhu, Ahmed Abdelkader, Micah Goldblum, and Tom Goldstein. The intrinsic dimension of images and its impact on learning. In International Conference on Learning Representations, 2021. [40] Xingjun Ma, Bo Li, Yisen Wang, Sarah M. Erfani, Sudanthi Wijewickrema, Grant Schoenebeck, Dawn Song, Michael E. Houle, and James Bailey. Characterizing adversarial subspaces using local intrinsic dimensionality. In International Conference on Learning Representations, 2018. [41] Peter Lorenz, Margret Keuper, and Janis Keuper. Unfolding local growth rate estimates for (almost) perfect adversarial detection. arXiv preprint arXiv:2212.06776, 2022. [42] Eduard Tulchinskii, Kristian Kuznetsov, Laida Kushnareva, Daniil Cherniavskii, Sergey Nikolenko, Evgeny Burnaev, Serguei Barannikov, and Irina Piontkovskaya. Intrinsic dimension estimation for robust detection of AI-generated texts. In Advances in Neural Information Processing Systems, volume 36, 2023. [43] Peter Lorenz, Ricard L. Durall, and Janis Keuper. Detecting images generated by deep diffusion models using their local intrinsic dimensionality. arXiv preprint arXiv:2307.02347, 2023. Retracted by the authors. [44] Ang Li, Jianzhong Qi, Rui Zhang, Xingjun Ma, and Kotagiri Ramamohanarao. Generative image inpainting with submanifold alignment. In Proceedings of the 28th International Joint Conference on Artificial Intelligence (IJCAI), 2019. [45] NaHyeon Park, Kunhee Kim, Junsuk Choe, and Hyunjung Shim. Rethinking the use of vision transformers for AI-generated image detection. arXiv preprint arXiv:2512.04969, 2025. [46] Zhenhan Huang, Pin-Yu Chen, Tejaswini Pedapati, and Jianxi Gao. Intermediate representations are strong AI-generated image detectors. arXiv preprint arXiv:2605.04358, 2026. [47] Beilin Chu, Weike You, Mengtao Li, Tingting Zheng, Kehan Zhao, Xuan Xu, Zhigao Lu, Jia Song, Moxuan Xu, and Linna Zhou. When semantics regulate: Rethinking patch shuffle and internal bias for generated image detection with CLIP. arXiv preprint arXiv:2511.19126, 2025. [48] Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x16 words: Transformers for image recognition at scale. In International Conference on Learning Representations, 2021. 14
[49] Wei Wu, Hanyang Peng, and Shiqi Yu. YuNet: A tiny millisecond-level face detector. Machine Intelligence Research, 20(5):656–665, 2023. [50] Dustin Podell, Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhorn, Jonas Müller, Joe Penna, and Robin Rombach. SDXL: Improving latent diffusion models for high-resolution image synthesis. arXiv preprint arXiv:2307.01952, 2023. [51] Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In Proceedings of the IEEE International Conference on Computer Vision (ICCV), 2015. [52] Yuezun Li, Xin Yang, Pu Sun, Honggang Qi, and Siwei Lyu. Celeb-DF: A large-scale challenging dataset for DeepFake forensics. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2020. [53] Zhiyuan Yan, Taiping Yao, Shen Chen, Yandan Zhao, Xinghe Fu, Junwei Zhu, Donghao Luo, Chengjie Wang, Shouhong Ding, Yunsheng Wu, and Li Yuan. DF40: Toward next-generation deepfake detection. In Advances in Neural Information Processing Systems, volume 37, 2024. [54] Renwang Chen, Xuanhong Chen, Bingbing Ni, and Yanhao Ge. SimSwap: An efficient framework for high fidelity face swapping. In Proceedings of the 28th ACM International Conference on Multimedia, 2020. [55] Kaede Shiohara, Xingchao Yang, and Takafumi Taketomi. BlendFace: Re-designing identity encoders for face-swapping. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2023. [56] Aliaksandr Siarohin, Stéphane Lathuilière, Sergey Tulyakov, Elisa Ricci, and Nicu Sebe. First order motion model for image animation. In Advances in Neural Information Processing Systems, volume 32, 2019. [57] Wenxuan Zhang, Xiaodong Cun, Xuan Wang, Yong Zhang, Xi Shen, Yu Guo, Ying Shan, and Fei Wang. SadTalker: Learning realistic 3D motion coefficients for stylized audio-driven single image talking face animation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2023. [58] K. R. Prajwal, Rudrabha Mukhopadhyay, Vinay P. Namboodiri, and C. V. Jawahar. A lip sync expert is all you need for speech to lip generation in the wild. In Proceedings of the 28th ACM International Conference on Multimedia, 2020. [59] Jian Zhao and Hui Zhang. Thin-plate spline motion model for image animation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2022. [60] Brian Dolhansky, Joanna Bitton, Ben Pflaum, Jikuo Lu, Russ Howes, Menglin Wang, and Cristian Canton Ferrer. The DeepFake detection challenge (DFDC) dataset. arXiv preprint arXiv:2006.07397, 2020. [61] Bojia Zi, Minghao Chang, Jingjing Chen, Xingjun Ma, and Yu-Gang Jiang. WildDeepfake: A challenging real-world dataset for deepfake detection. In Proceedings of the 28th ACM International Conference on Multimedia, 2020. [62] Maxime Oquab, Timothée Darcet, Théo Moutakanni, Huy V. Vo, Marc Szafraniec, Vasil Khalidov, Pierre Fernandez, Daniel Haziza, et al. DINOv2: Learning robust visual features without supervision. Transactions on Machine Learning Research, 2024. [63] Yuxin Fang, Quan Sun, Xinggang Wang, Tiejun Huang, Xinlong Wang, and Yue Cao. EVA-02: A visual representation for Neon Genesis. arXiv preprint arXiv:2303.11331, 2023. [64] Ananya Kumar, Aditi Raghunathan, Robbie Jones, Tengyu Ma, and Percy Liang. Fine-tuning can distort pretrained features and underperform out-of-distribution. In International Conference on Learning Representations, 2022. [65] Mohammad Pezeshki, Sékou-Oumar Kaba, Yoshua Bengio, Aaron Courville, Doina Precup, and Guillaume Lajoie. Gradient starvation: A learning proclivity in neural networks. In Advances in Neural Information Processing Systems, volume 34, 2021. 15
[66] Tero Karras, Timo Aila, Samuli Laine, and Jaakko Lehtinen. Progressive growing of GANs for improved quality, stability, and variation. In International Conference on Learning Representations, 2018. [67] Sheng-Yu Wang, Oliver Wang, Richard Zhang, Andrew Owens, and Alexei A. Efros. CNNgenerated images are surprisingly easy to spot... for now. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2020. [68] Marius Mosbach, Maksym Andriushchenko, and Dietrich Klakow. On the stability of finetuning BERT: Misconceptions, explanations, and strong baselines. In International Conference on Learning Representations, 2021. [69] David Picard. torch.manual_seed(3407) is all you need: On the influence of random seeds in deep learning architectures for computer vision. arXiv preprint arXiv:2109.08203, 2021. [70] Chuan Guo, Geoff Pleiss, Yu Sun, and Kilian Q. Weinberger. On calibration of modern neural networks. In International Conference on Machine Learning, 2017. [71] Jiankang Deng, Jia Guo, Yuxiang Zhou, Jinke Yu, Irene Kotsia, and Stefanos Zafeiriou. RetinaFace: Single-stage dense face localisation in the wild. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2020. [72] Yinglin Zheng, Hao Yang, Ting Zhang, Jianmin Bao, Dongdong Chen, Yangyu Huang, Lu Yuan, Dong Chen, Ming Zeng, and Fang Wen. General facial representation learning in a visuallinguistic manner. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2022.
16
A
Success and failure cases Real (FF++)
FF-NT
FF-FS
StyleGAN
T2I
InSwap
BlendFace
real p=0.17
fake p=0.85
fake p=0.86
fake p=0.87
fake p=0.78
fake p=0.83
fake p=0.85
real p=0.18
fake p=0.77
fake p=0.86
fake p=0.87
fake p=0.77
fake p=0.82
fake p=0.84
real p=0.18
fake p=0.76
fake p=0.86
fake p=0.86
fake p=0.76
fake p=0.82
fake p=0.82
real p=0.19
fake p=0.73
fake p=0.86
fake p=0.86
fake p=0.75
fake p=0.81
fake p=0.79
(A) Success cases
Real (FF++)
FF-NT
FF-FS
StyleGAN
T2I
InSwap
BlendFace
real p=0.67
fake p=0.25
fake p=0.22
fake p=0.28
fake p=0.29
fake p=0.23
fake p=0.24
real p=0.64
fake p=0.27
fake p=0.56
fake p=0.28
fake p=0.30
fake p=0.31
fake p=0.25
real p=0.63
fake p=0.29
fake p=0.57
fake p=0.29
fake p=0.31
fake p=0.34
fake p=0.26
(B) Failure cases
Figure 12: (A) Extended success matrix: four examples per source, all correctly scored by GLID. (B) Failure cases: the most confident mistakes per source. Three patterns dominate. (1) Reenactment and lip-sync forgeries that alter a small mouth region leave both the semantic features and the token manifold nearly intact. (2) Strong compression (DFDC-like) flattens the geometric evidence. (3) Occlusions, heavy makeup, and sunglasses push real faces toward the forged score region. Reading the failures through the method explains them. The LID signal measures how synthesis bends an image’s global token manifold, so forgeries that paste or warp a small region (Wav2Lip, some reenactors) barely move it; the gate then defers to the detector, which is also weak there. Compression removes the high-frequency support of the manifold measurement. These are the axes
17
where neither data coverage nor geometry currently helps, and we flag them as the open end of the problem.
B
Preregistered analysis gates
We fixed decision gates before running the corresponding experiments and report all of them. • Signal viability. Training-free LID must exceed 0.85 AUC on at least one generation source under our crops; below 0.75 the line is abandoned. Outcome: passed. • Unified learned fusion. A single learned head over detector and geometric features must gain on generation and reenactment simultaneously with in-distribution regression under 0.01. Outcome: failed; the head absorbed the geometric signal (Section 6.1), and we report it as a negative result rather than tuning past it. The gated form of Eq. 2 with in-distribution α replaced it. • Absorption intervention. Success defined as gain collapse to at most +0.01 at 20% coverage with reenactment unchanged within 0.02 and rising covered-axis accuracy. Outcome: passed in sharpened form; collapse completes at 1% (Table 6), and the strict monotonicity sub-check is moot because collapse is immediate. The reenactment-shift sub-check missed its threshold by 0.0013, which we report as-is. • Depth-signature breadth. The split must hold for at least 3 of 4 backbones and all 3 estimators on every valid source. Outcome: passed (the EVA-02 ProGAN peak and the CLIP StyleGAN peak sit at 75% depth with the last-block values close behind; all other combinations peak at the last block). • Replication. Direction of the depth split re-verified on disjoint, freshly sampled evaluation images before any comparison was finalized. Outcome: passed.
C
Protocol constants
Crops. YuNet detection with margin 0.35 at 224 px for every image in training and evaluation. The margin matches the training pipeline of the base detector; mixing crop styles across methods moved AUC by up to 0.03 in our checks, so we forbid it. Splits. Identities 720/140/140; forged videos kept only when both endpoint identities share a split. DF40 evaluation uses appearance identities outside the training split; this leaves 39–46 fake videos for the swap axes (Table 1) and widens their intervals. Detector. CLIP-L/14, last 6 blocks and a LayerNorm head trainable, AdamW, lr 10−5 backbone and 10−4 head, weight decay 0.01, batch 32, two epochs, class-balanced sampling, horizontal flips; best-validation checkpoint per seed. SBI and Effort use the same capacity and schedule. NPR trains its reference ResNet-18. UnivFD sweeps its regularizer on a held-out tenth of training. LID. Blocks {6, 12, 18, 23}, k ∈ {8, 16, 32}, cosine distances on ℓ2 -normalized tokens. Statistics µℓ , σℓ , µB , σB come from training frames only. Gate pooling. The deployable score pools blocks 23 and 12 (Eq. 2). At α∗ this choice gives 0.816 generation and 0.805 overall. Pooling all four blocks adds the near-chance shallow coordinates and drops to 0.810 generation (0.793 overall). Single-block pooling serves one family only: block 23 alone gives 0.762 generation, block 12 alone 0.795. Reading one depth per family regime is both necessary and sufficient. DCA re-implementation. Frozen DINOv3 block 18 at 448 px, per-dimension normalization from training frames, K=20 tokens per region, eye–mouth–nose pairs, logistic probe with C=0.1; regions anchored on detector landmarks, replacing the original RetinaFace-plus-parser stack [71, 72] so that every method consumes identical crops.
18
D
Full tables Table 4: Per-axis AUC with 95% bootstrap intervals.
Axis
GLID (ours)
CLIP-L FT
SBI
Effort
UnivFD
NPR
RIGID
DCA
StyleGAN T2I CelebDF-v2 FF-FS FF-NT FOMM HyperReenact SadTalker Wav2Lip TPSM InSwapper SimSwap FaceSwap-DF40 BlendFace DFDC WildDeepfake
0.783[0.75,0.81] 0.848[0.82,0.87] 0.898[0.88,0.92] 0.965[0.90,1.00] 0.876[0.80,0.94] 0.905[0.85,0.95] 0.702[0.62,0.78] 0.569[0.48,0.66] 0.644[0.56,0.72] 0.622[0.53,0.71] 0.912[0.85,0.96] 0.886[0.82,0.94] 0.952[0.89,0.99] 0.849[0.78,0.91] 0.636[0.60,0.67] 0.830[0.80,0.85]
0.706[0.67,0.74] 0.757[0.73,0.79] 0.903[0.89,0.92] 0.969[0.91,1.00] 0.878[0.81,0.94] 0.919[0.87,0.96] 0.709[0.62,0.79] 0.572[0.48,0.67] 0.646[0.56,0.72] 0.625[0.53,0.71] 0.917[0.86,0.96] 0.894[0.84,0.94] 0.952[0.89,0.99] 0.854[0.78,0.91] 0.647[0.61,0.68] 0.825[0.80,0.85]
0.568[0.53,0.60] 0.915[0.90,0.93] 0.927[0.91,0.94] 0.913[0.82,0.98] 0.834[0.75,0.90] 0.891[0.84,0.94] 0.582[0.49,0.67] 0.505[0.41,0.60] 0.405[0.31,0.49] 0.761[0.69,0.83] 0.781[0.70,0.85] 0.731[0.64,0.81] 0.915[0.85,0.97] 0.653[0.56,0.73] 0.541[0.51,0.58] 0.870[0.85,0.89]
0.681[0.65,0.71] 0.770[0.74,0.80] 0.902[0.88,0.92] 0.968[0.91,1.00] 0.871[0.79,0.95] 0.915[0.86,0.96] 0.671[0.58,0.75] 0.567[0.48,0.66] 0.639[0.55,0.72] 0.630[0.54,0.71] 0.896[0.83,0.95] 0.871[0.81,0.93] 0.943[0.89,0.99] 0.835[0.76,0.90] 0.645[0.61,0.68] 0.833[0.81,0.86]
0.670[0.64,0.70] 0.541[0.51,0.58] 0.770[0.74,0.80] 0.937[0.88,0.98] 0.833[0.75,0.90] 0.838[0.77,0.90] 0.799[0.73,0.86] 0.462[0.37,0.55] 0.504[0.41,0.60] 0.636[0.55,0.72] 0.895[0.84,0.95] 0.807[0.73,0.88] 0.904[0.85,0.95] 0.762[0.68,0.84] 0.538[0.50,0.57] 0.717[0.68,0.75]
0.534[0.50,0.57] 0.457[0.42,0.49] 0.699[0.67,0.73] 0.515[0.41,0.61] 0.499[0.39,0.61] 0.705[0.62,0.78] 0.571[0.48,0.66] 0.607[0.51,0.70] 0.522[0.42,0.61] 0.705[0.62,0.78] 0.588[0.48,0.68] 0.473[0.38,0.57] 0.481[0.38,0.57] 0.629[0.54,0.72] 0.519[0.49,0.56] 0.687[0.65,0.72]
0.799[0.77,0.83] 0.043[0.03,0.06] 0.535[0.50,0.57] 0.495[0.39,0.60] 0.470[0.37,0.58] 0.901[0.86,0.94] 0.806[0.73,0.89] 0.798[0.72,0.88] 0.571[0.48,0.67] 0.829[0.75,0.89] 0.571[0.46,0.67] 0.543[0.44,0.65] 0.533[0.44,0.63] 0.557[0.46,0.65] 0.552[0.51,0.59] 0.600[0.57,0.64]
0.565[0.53,0.60] 0.625[0.59,0.66] 0.847[0.82,0.87] 0.837[0.74,0.92] 0.774[0.68,0.86] 0.736[0.65,0.82] 0.703[0.61,0.78] 0.549[0.46,0.64] 0.686[0.60,0.76] 0.600[0.50,0.70] 0.726[0.64,0.82] 0.780[0.70,0.86] 0.812[0.73,0.88] 0.718[0.63,0.80] 0.578[0.54,0.61] 0.655[0.62,0.69]
Table 5: Paired bootstrap deltas of GLID against the two strongest retrained baselines. Asterisks mark intervals excluding zero. Axis
vs. SBI
StyleGAN T2I CelebDF-v2 FF-FS FF-NT FOMM HyperReenact SadTalker Wav2Lip TPSM InSwapper SimSwap FaceSwap-DF40 BlendFace DFDC WildDeepfake
vs. Effort ∗
[+0.188,+0.244] [-0.087,-0.049]∗ [-0.047,-0.010]∗ [+0.010,+0.115]∗ [-0.039,+0.130] [-0.035,+0.063] [+0.029,+0.212]∗ [-0.023,+0.166] [+0.146,+0.334]∗ [-0.226,-0.059]∗ [+0.063,+0.204]∗ [+0.082,+0.227]∗ [-0.008,+0.086] [+0.119,+0.280]∗ [+0.060,+0.128]∗ [-0.067,-0.014]∗
[+0.086,+0.120]∗ [+0.063,+0.095]∗ [-0.012,+0.004] [-0.009,+0.001] [-0.016,+0.026] [-0.026,+0.007] [+0.004,+0.059]∗ [-0.041,+0.041] [-0.039,+0.044] [-0.042,+0.024] [-0.013,+0.049] [-0.010,+0.041] [-0.001,+0.023] [-0.011,+0.040] [-0.027,+0.007] [-0.010,+0.004]
Table 6: Coverage dose–response (three seeds per dose). Coverage 0% 1% 5% 20%
Gen. gain from LID
Reenact gain
Detector Gen. AUC
All-16 AUC
+0.100±0.011 -0.003±0.020 -0.033±0.001 -0.017±0.002
-0.123±0.012 -0.103±0.014 -0.107±0.006 -0.101±0.007
0.720 0.873 0.965 0.988
0.792 0.799 0.806 0.822
Table 7: Inference cost per component. Component Detector (CLIP-L) LID signal RIGID DCA SD ϵ-error
ms/image
Notes
3.6 4.1 8.0 18.7 14.2
batch 32, H100 12-d, frozen ViT-L two forward passes 448 px, region pairs two timesteps
19
E
Additional figures
A
B in-distribution (FF-NT) blind axis (StyleGAN) blind axis (T2I)
injected term α ∗ gw` s`
density
15 10 5 0
0.7 0.8 0.9 gate value g = 4p(1 − p)
0.6
real fake
1.0 0.5 0.0
1.0
1.0
0.0 1.0 0.5 0.5 detector logit z (StyleGAN axis)
1.5
Figure 13: Gate behavior. (A) The confidence gate opens far more often on blind axes than indistribution. (B) Injected term against detector logit on the StyleGAN axis: the injection concentrates where the detector is uncertain and pushes fakes upward. DINOV3
DINOV2
CLIP
EVA-02
1.0
StyleGAN
0.9 0.8
ProGAN (non-face)
0.7
oriented AUC
T2I
0.6
CelebDF
0.5
FF-NT 25
50
75
depth (%)
100
25
50
75
depth (%)
100
25
50
75
depth (%)
100
25
50
75
depth (%)
0.4
100
Figure 14: Depth–axis AUC heatmaps for four backbones. The family–depth signature (GAN deep, diffusion mid) repeats in every panel; swap and reenactment stay near chance at every depth, as expected for a generation-oriented signal.
SD ²-error (raw)
0.4
C
dDF Wil
DFD
ace ndF
ap*
Ble
eSw
p
Fac
Swa Sim
wap InS
ip
M TPS
v2L
Wa
ker Tal Sad
erR Hyp
M FOM
NT FF-
F
FS FF-
ebD Cel
Sty
leG
0.0
T2I
0.2
AN
AUC (raw orientation)
0.6
Figure 15: Raw SD ϵ-error as a single scorer across the 16 axes. The direction inverts on T2I (values far below 0.5): images from the generator family of the scoring model reconstruct too well. Direction instability, not weak magnitude, is what disqualifies reconstruction scores as deployable single detectors.
20
F
Reproducibility
All experiments run in one container image with pinned library versions; training and evaluation scripts, preregistered gates, per-image score dumps, and the exact figure-generation code ship with the paper. Every number in the text and every figure is generated from one machine-readable extract of the result files; no value is typed by hand. Face examples in Figures 5 and 12 are shown under the FaceForensics++ terms of use (consented actors) and the CelebA research license; generated faces depict no real person. Total compute for the study, including all baselines, seeds, and interventions, is under six GPU-days on H100-class hardware.
G
Broader impact
Forgery detection is a defensive technology, and better blind-axis coverage directly serves platforms, journalists, and forensic analysts who face generators they have never seen. Two risks deserve statement. First, publishing the LID signal tells adversaries what to attack; a generator regularized toward real-face token dimensionality could evade it, which is one more reason to deploy geometric signals alongside learned detectors rather than instead of them. Second, detector scores are not calibrated across generator families (Section 6.6), so downstream users should not read the probabilities as evidence strength without recalibration. All face data in this study comes from public research datasets under their licenses, and no new personal data was collected.
21