arXiv CSopen access

Deep-Fake CAPTCHA: Mitigating Next-Generation Social Engineering Attacks

JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021

1

Deep-Fake CAPTCHA: Mitigating Next-Generation Social Engineering Attacks

arXiv:2609.11404v1 [cs.CR] 10 Sep 2026

Guy Frankovits, Lior Yasur, Fred M. Grabovski, and Yisroel Mirsky

Abstract—This paper presents DF-CAPTCHA, an active defense against real-time deepfake impersonation in voice and video calls. Instead of passively searching for artifacts, DF-CAPTCHA prompts the caller to perform simple challenge-response tasks that are easy for humans but difficult for current real-time deepfake systems to generate convincingly. The framework verifies the response using four criteria: realism, identity consistency, task completion, and response time. We evaluate the approach across both audio and video modalities using user studies and experiments with real-time deepfake models. Results show that people often struggle to distinguish real-time deepfakes from authentic media, while DF-CAPTCHA substantially improves detection performance over passive methods, reaching high accuracy in both modalities. These findings suggest that active challenge-based verification is a practical and robust defense against next-generation social engineering attacks based on realtime deepfakes. Index Terms—Deepfakes, real-time deepfakes, active defense, challenge-response authentication, voice spoofing detection, face forgery detection

I. I NTRODUCTION Deepfakes, defined as media generated by deep neural networks that appear authentic to human perception [1], have rapidly evolved since their emergence in 2017. This technology has found applications across various domains, enhancing productivity, revolutionizing education, and providing novel forms of entertainment [2]–[4]. However, the same technological advancements that enable these positive applications also harbor a dark side, opening avenues for unethical and malicious exploitation. The ability to convincingly impersonate a target’s face and voice has empowered bad actors to conduct a range of nefarious activities. These include defamation campaigns [5], propaganda [6], blackmail attempts [7], the spread of misinformation [8], and sophisticated social engineering attacks targeting both individuals and organizations globally [9]. The misuse of deepfake technology has manifested in various forms, from the creation of non-consensual explicit content [10] to more insidious political manipulations. As deepfake technology continues to advance in quality and accessibility, the line between authentic and fabricated media becomes increasingly blurred. This technological progression presents a growing challenge to digital trust and information integrity, necessitating robust detection methods and ethical G. Frankovits, L. Yasur, F. M. Grabovski, and Y. Mirsky are with BenGurion University, 1 Ben-Gurion Ave., Beersheba 8410501, Israel (e-mail: [email protected]; [email protected]; [email protected]; [email protected]). Corresponding author: Yisroel Mirsky (e-mail: [email protected]).

frameworks to mitigate the risks associated with deepfake misuse. A. Real-time Deepfakes (RT-DF) Recent advancements in deepfake technology have significantly improved its efficiency, giving rise to real-time deepfakes (RT-DFs)1 . This evolution enables malicious actors to impersonate individuals during live voice and video calls, presenting an unprecedented threat to digital security and trust. The danger of RT-DFs is amplified by three key factors: (1) the unexpected nature of the attack vector, (2) the tendency to mistake familiarity for authenticity, and (3) the rapidly improving quality of RT-DF technologies. To conceptualize this threat, let’s perform the following thought experiment. Imagine someone receives a call from their mother who is in trouble and urgently needs a money transfer. The caller sounds exactly like her, but the situation seems a bit out of place. Under stress and frustration, she hands the phone over to someone who sounds like the victim’s father, who confirms the situation. Without hesitation, many would transfer the money even though they’re technically talking to a stranger. Now consider state-actors with considerable amounts of time and resources. They could target workers at power plants and other critical infrastructure by posing as their administrators. Over a phone call, they could convince the worker to change a configuration or reveal confidential information which would lead to a cyber breach or a catastrophic failure. Attackers could even pose as military officials or politicians leading to a breach of national security. These scenarios are plausible because some existing realtime frameworks can impersonate an individual’s face or voice using very little information. For example, some real-time methods can reenact a face with one sample image [11] and some can clone a voice with just a few seconds of audio [12]. Using these technologies, an attacker would only need to call the source voice for a few seconds or scrape the source’s image from the internet to perform the attack. Here is a more concise version in paragraph form, preserving the citations and covering both voice and video modalities: Real-time deepfakes (RT-DFs) have rapidly evolved from a theoretical risk into a practical threat, with documented harms across financial fraud, political deception, corporate espionage, 1 Examples of RT-DF tools: https://github.com/iperov/DeepFaceLive https://github.com/hacksider/Deep-Live-Cam https://apps.apple.com/us/app/real-deep-real-time-deep-fake/id1639829534 https://www.respeecher.com/

JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021

and extortion. In finance, attackers have used real-time voice cloning to impersonate executives and induce unauthorized transfers, including an early case in which scammers mimicked a CEO’s voice to steal $243,000 [13], as well as a 2024 incident in which a Hong Kong employee was deceived during a deepfake video call featuring fabricated likenesses of the company’s CFO and other staff, leading to a loss of roughly $25.6 million [14]. RT-DFs have also been used in large-scale theft, such as a $35 million bank heist carried out through fraudulent audio calls impersonating a company director [15]. Beyond direct financial theft, RT-DFs enable manipulation, infiltration, and intelligence gathering. Politically, they can be used to impersonate influential figures and interfere with diplomatic or public processes [16]; this vulnerability was exposed when senior European MPs joined Zoom meetings with individuals posing as Russian opposition figures [17]. In corporate settings, the FBI has warned that cybercriminals are using deepfakes in job interviews to obtain remote positions and gain access to sensitive systems and information [18]. RTDFs have also been deployed for executive targeting: in May 2024, attackers reportedly used a deepfake of WPP CEO Mark Read’s voice and likeness in a Microsoft Teams meeting to solicit money and personal information from other executives [19]. RT-DFs are also expanding into coercive scams designed to provoke panic and extract payment. One notable example involved an Arizona mother who received a call in which scammers used AI-cloned audio of her daughter’s voice to simulate a kidnapping and demand a $1 million ransom [20]. Taken together, these cases show that RT-DF threats now span both voice and video modalities and are becoming more diverse, scalable, and operationally sophisticated. Their progression from isolated fraud attempts to coordinated, highimpact attacks highlights the urgent need for stronger detection, authentication, and prevention mechanisms. B. The Gap in Current Defenses While numerous methods have been proposed for detecting deepfakes [1], [21], the rapidly evolving nature of this technology presents significant challenges to existing defense mechanisms. Current approaches typically rely on deep learning models to either (1) identify artifacts or inconsistencies in generated media, or (2) detect forensic evidence such as latent noise patterns. However, these methods face two fundamental problems that limit their long-term effectiveness: Longevity. Methods that identify semantic errors or artifacts operate under the assumption that deepfake quality will remain relatively stable. However, evidence clearly demonstrates that deepfake quality is rapidly improving [22]. Consequently, artifact-based methods face a high risk of obsolescence within a short timeframe, as deepfake technology outpaces their detection capabilities. Evasion. Methods relying on latent noise patterns are vulnerable to evasion through simple post-processing techniques. For instance, a deepfake can be passed through a low-pass filter, undergo compression, or be subjected to additive noise. Critically, these processes are common in audio

2

Victim

Deepfake

validate

real

Attacker

fake

Fig. 1: Overview of the proposed defense against fake calls: the victim requests the caller to perform a task that is difficult for deepfake models to execute accurately. If the response is distorted or fails to address the task, the caller is likely a deepfake. and video calls, potentially eliminating forensic evidence without additional effort from the attacker. These weaknesses are amplified in the real-time setting. The signal degradation that pervades a live call already mimics the post-processing an evader would otherwise have to apply, while the strict latency budget of an interactive conversation rules out the heavyweight forensic analysis that some defenses depend on. Detecting RT-DFs therefore demands a fundamentally different posture, one that does not wait for the attacker’s content to betray itself. II. R EAL -T IME DF-CAPTCHA Rather than wait for an artifact to appear, we flip the dynamic and force the adversary into the spotlight. We introduce Deepfake-CAPTCHA (DF-CAPTCHA): a system that automatically detects deepfake calls through challenge-response analysis (illustrated in Fig. 1). DF-CAPTCHA actively engages the caller by issuing a specific task (the challenge), deliberately chosen to be effortless for a human yet outside the operating envelope of a real-time deepfake pipeline. Our key insight is that, unlike general-purpose generative models, RT-DF pipelines are tightly constrained: every frame must preserve the target’s identity, geometry, and temporal coherence under a strict latency budget. This rigidity makes the pipeline brittle along many axes and exposes a rich attack surface for the defender to exploit. When a deepfake attempts the challenge, the resulting content (the response) collapses in ways that are conspicuous to an anomaly detector, a downstream classifier, or even the intended victim. In our previous work [23], we focused exclusively on RTDF attacks involving audio-based voice cloning. In this paper, we extend that framework to video-based attacks, enabling a comprehensive analysis of RT-DF threats across both audio and video modalities. Concretely, our extension contributes (1) a threat analysis of current RT-DF face-impersonation technologies supported by a user study, (2) the proposal and

JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021

in-depth evaluation of novel defensive challenges for realtime face impersonation, and (3) insights into the structural limitations of existing RT-DF face-impersonation pipelines. Together, these allow us to assess DF-CAPTCHA across a substantially broader range of real-time deepfake scenarios. Our results show that DF-CAPTCHA substantially improves the performance of state-of-the-art deepfake detectors in both modalities, offering a robust and adaptive defense against increasingly sophisticated RT-DF attacks. Beyond improving detection accuracy, it provides a scalable framework that can evolve alongside the underlying deepfake technology. A. Contributions In summary, this work makes the following contributions: • The first active defense against RT-DFs. Our approach (i) provides stronger detection guarantees than passive, artifact-based methods, and (ii) offers improved longevity through an extensible challenge set that can adapt as deepfake technology evolves. • A formal definition and analysis of DF-CAPTCHA. We define what constitutes a strong deepfake CAPTCHA, formalize the four constraints a challenge must impose on the adversary, and present an initial catalogue of CAPTCHAs together with a security and usability analysis. • The first comprehensive threat evaluation of RTDF technology with real users. We evaluate four RTDF face-replacement models with 38 volunteers and five voice-cloning models with 41 volunteers, providing the first user-study-grounded view of the current RT-DF threat landscape. • An end-to-end performance and robustness evaluation. We provide an in-depth analysis of how DFCAPTCHA performs in both the video and audio domains, and of its resilience against an evasive adversary. These contributions collectively advance deepfake detection by offering a novel, adaptable, and thoroughly evaluated approach to the evolving threat of real-time deepfakes. III. L ITERATURE REVIEW A. Audio Deepfake Detection Audio deepfake detection (ADD) systems typically follow a three-step pipeline: 1) Convert audio clip a into frames a(1) , ...a(n) 2) Extract feature representations x(1) , ...x(n) (e.g., STFT, MFCC, CQCC [24], [25], or raw waveform) 3) Pass frames through a detector to predict authenticity ADD systems use either classifiers [26]–[28] or anomaly detectors [29]. Classifiers are trained on labeled real and fake audio data, automatically identifying distinguishing features [30]. However, they assume all deepfake types are in the training set, requiring retraining for new technologies. Models range from classical machine learning [31] to deep learning architectures [32]–[35]. Anomaly detectors, trained only on real voice data, flag abnormal patterns. They use voice

3

recognition embeddings [36] or one-class models like OCSVMs and GMMs [29], [32], [37]. Despite efforts to improve generalization [38], ADD systems still struggle with new audio distributions and novel deepfake technologies [39]. A comprehensive review of modern ADD systems can be found in [21]. Fraudulent Call Prevention Services. Existing fraudulent call prevention services use blacklists and statistical information surrounding a caller’s phone number to identify and block suspicious calls (e.g., Truecaller, Robo Killer and Nomorobo). These approaches are only effective against general phishing attacks where many fraudulent calls are made from the same numbers or same telephony region. However, in our threat model, we focus on spear phishing attacks where specific victims are targeted and the attacks are crafted for those victims. In a spear phishing attack the caller only needs to make one call from a ’clean’ phone number once to achieve his or her goal, making existing prevention methods less effective. In contrast, our DF-CAPTCHA method (1) examines the content of the call (i.e., analyzes the caller’s voice) and (2) does not require any prior knowledge of potential callers (voice identities, phone numbers, etc.) making it a suitable defense against spear phishing attacks which use RT-DFs. B. Video Deepfake Detection Video deepfake detection (VDD) systems typically follow a four-step pipeline: 1) Convert video clip a into frames a(1) , ...a(n) 2) Detect and locate human faces in each frame 3) Extract features manually or automatically 4) Pass frames through a detector to predict authenticity Features extracted include facial landmarks [40], [41], movement patterns using optical flow [42], or deep learning embeddings [43], [44]. VDD approaches are broadly categorized into handcrafted features and deep learning techniques. Handcrafted methods include 3D head position estimation [41], multimedia stream descriptors [45], biological signals like heart rate [46], and eye-blinking analysis [47]. Deep learning approaches encompass CNN models for facial landmark analysis [48], CNNRNN architectures for frame-level detection [49], [50], multitask CNNs with RNNs [51], and temporal information learning [52]. Advanced techniques combine facial and behavioral biometrics [30], employ heart rate measurement with NeuralODEs [53], and utilize multi-scale self-texture attention [54]. These methods aim to distinguish between real and fake videos by analyzing various aspects of video content. However, challenges persist in generalizing to new types of deepfakes and handling different video qualities. For a comprehensive review of modern VDD systems, readers can refer to [22]. C. Limitations of Current Defenses Current deepfake detection methods in both video and audio domains primarily employ passive analysis, examining content

JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021

without engaging the caller. In contrast, our proposed DFCAPTCHA method introduces an active defense paradigm. By compelling the deepfake function to generate content beyond its capabilities, DF-CAPTCHA induces more pronounced artifacts, enhancing detection efficacy. DF-CAPTCHA’s active approach offers significant advantages over existing methods. It improves detection rates and ensures longevity against evolving attacks by targeting specific limitations of deepfake technologies. Moreover, the challenge-response nature of DFCAPTCHA enables precise localization of artifacts within media streams. This targeted analysis increases efficiency by focusing on specific segments rather than entire streams, overcoming limitations associated with fixed-size segment analysis methods [27], [32], [39], [49]. By actively probing deepfake limitations and leveraging precise artifact localization, DFCAPTCHA presents a more robust, efficient, and adaptable solution to the challenges posed by real-time deepfakes in both audio and video domains. IV. M ETHODOLOGY This section examines the limitations of RT-DFs and uses them to define how D-CAPTCHAs work. A. RT-DF Limitations Current RT-DF models generate only content within the scope of the task on which they were trained. For example, a model trained to reenact t’s face in a roughly frontal pose or generate t’s voice in a calm speaking style will generally fail on other content. This is evident in facial reenactment systems such as [11] and [55]: they perform well on frontal faces but cannot generate the back of the target’s head. Likewise, audio RT-DFs struggle to identify and reproduce sounds outside the regime emphasized by the training data, loss functions, and overall pipeline, such as when the system is optimized for normal speech. An ideal RT-DF would generate realistic, identity-faithful content of t performing an arbitrary task. Existing RT-DFs are not ideal because they are trained for narrower tasks, which allows ft to better preserve identity and realism in xg when driven by xs . Thus, even if out-of-domain tasks can be anticipated, ft cannot realistically be trained to reproduce them all. This limitation arises from both technology and practicality. 1) Technology: These limitations stem from the fact that current technology cannot yet realize the ideal RT-DF. Inference Speed. The rate of audio-frame generation depends on the efficiency of the deepfake pipeline and the model architecture. Supporting a broad range of tasks would require many more parameters2 and likely more complex feature extractors. For example, current RT-DFs would need higher-resolution STFTs and MFCCs to cover a wider frequency range. 2 For reference, the voice deepfake model StarGAN [56], a audio-based

RT-DF, has about 53 million parameters. In contrast, models that generate arbitrary content, such as DALL-E 2 and Imagen, use 3.5–4.6 billion parameters. Moreover, methods such as stable diffusion require multiple passes.

4

Feature Representation. To learn and reproduce patterns in xs , the model must extract meaningful representations from the media. In voice, salient patterns often lie in lower frequencies and have a relatively stable spectral envelope compared with sounds such as singing or clapping. Current pipelines often rely on compressed features such as MFCCs or STFTs sampled at relatively low rates (e.g., 16– 24 kHz [21]). Capturing a wider frequency range would require higher-resolution input, but this greatly increases model complexity and training difficulty. In face generation, preprocessing is also critical before the model sees the input. This often includes detecting, cropping, and aligning the driver’s face. Some pipelines reduce preprocessing to facial landmarks only, which may omit subtle cues such as muscle contractions and thereby limit nuanced generation. Training. Training requires a loss function to guide optimization. Modern RT-DF systems typically use at least two: one for realism (e.g., adversarial loss) and one for preserving the identity of t in xg (e.g., perceptual loss) [1]. Supporting additional tasks would likely require additional losses, but these objectives compete during optimization, so some aspects degrade. More losses can also make convergence harder. In addition, xs may contain multiple identities or irrelevant content, such as multiple faces and physical interactions in video, or multiple voices and background sounds such as music in audio. To use such a source signal, the model would need to isolate the relevant components and then recombine them correctly in xg ; otherwise, the output will be corrupted or the missing context will be noticeable to the victim. To the best of our knowledge, this remains an open problem. 2) Resources: These limitations arise when the desired output may be achievable with current technology, but obtaining it is prohibitively expensive or impractical. Data Collection. Producing a high-quality RT-DF of t requires substantial audio data from t (e.g., [56] requires 20–30 minutes). However, it is impractical for an attacker to collect audio of t performing many specific tasks beyond ordinary speech. Lower quality may be possible with zeroshot learning, but this still requires (1) a broad dataset covering many possible tasks and (2) a model that generalizes those samples to new identities. Knowledge. Building a system that can handle even a subset of arbitrary tasks requires significant expertise in generative deep learning. This raises the barrier for casual attackers, though not necessarily for advanced adversaries. Labeling. Annotating and labeling large datasets is expensive and time-consuming, and the burden increases with the number of classes (tasks). Assets. An ideal RT-DF capable of arbitrary tasks would likely be highly complex. Running such a model in real time would require a powerful GPU, which may be prohibitively expensive or may not yet exist. 3) Outlook on RT-DF Limitations: The limitations described here apply to current RT-DF systems. Although they are difficult to overcome, future RT-DF technologies may not share all of them. Still, we expect that some constraints,

JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021

especially data collection and training, will remain relevant for novel systems in the near future. Therefore, to gain an advantage over the adversary, defenses should exploit RT-DF limitations whenever possible. B. Defining DF-CAPTCHA The concept of CAPTCHA, as defined by Ahn et al. [57], is “a cryptographic protocol whose underlying hardness assumption is based on an AI problem.” This protocol traditionally follows a challenge-response procedure between a server A (the verifier) and a client B (the prover), structured as follows: 1) A → B : c (Server sends challenge c to client) 2) B → A : rc (Client sends response rc to challenge c) 3) A : V (rc ) ∈ {pass, f ail} (Server verifies if rc resolves challenge c) Conventional CAPTCHAs, such as reCAPTCHA, aim to differentiate humans from bots by presenting tasks that are simple for humans but challenging for automated systems (e.g., decoding distorted text). In contrast, our proposed Deepfake-CAPTCHA (DFCAPTCHA) introduces a paradigm shift by challenging the client to create content under specific constraints: 1) Realism: The generated content must appear authentic to both human perception and machine learning models. 2) Identity: The content must accurately reflect a given identity t. 3) Task Complexity: The content must depict identity t performing an arbitrary task that is difficult for current deepfake technologies to generate convincingly. 4) Real-Time Generation: The content must be produced in real-time, without significant delay. This novel approach leverages the current limitations of Real-Time Deepfake (RT-DF) technologies. While existing RT-DF systems struggle to satisfy these constraints simultaneously, humans can easily meet these requirements. The ’hardness’ of a DF-CAPTCHA is thus directly correlated with the current limitations of RT-DF technology. Importantly, like modern CAPTCHA systems, DFCAPTCHA is designed with extensibility in mind. As RT-DF technologies evolve, new challenges can be seamlessly integrated into the system, ensuring its effectiveness against future threats. This adaptability provides our system with a crucial advantage in the ongoing arms race between deepfake creation and detection technologies. By framing deepfake detection as a challenge-response protocol, DF-CAPTCHA not only offers a robust method for identifying synthetic content but also establishes a flexible framework that can evolve alongside advancements in deepfake technology. This approach represents a significant step forward in active defense strategies against real-time deepfakes in both audio and video domains. 1) Creating a Challenge: A challenge in the DFCAPTCHA system is designed to assess a caller’s ability to create content that simultaneously satisfies four key constraints: realism, identity, task complexity, and time. Each of these constraints serves a specific purpose in differentiating between genuine human responses and deepfake attempts:

5

Realism constraints are crucial for ensuring the absence of latent or semantic anomalies in the response. This helps in identifying synthetic content that may appear superficially convincing but contains subtle inconsistencies. Identity constraints are designed to push deepfake models beyond their current capabilities, exploiting known limitations in their ability to generate certain types of content. Task constraints are designed to push deepfake models beyond their current capabilities, exploiting known limitations in their ability to generate certain types of content. Time constraint ensure the use of real-time deepfake (RTDF) models, preventing attackers from switching to more sophisticated offline models. The core of each challenge is a specific task that the caller must perform. We denote a specific task as T , where, for example, T = hum might represent the task ”hum a specific song.” The set of all possible challenges for a given task T is denoted as CT . For instance, Chum would encompass all possible requests for different songs to be hummed. The challenge selection process follows a two-step randomization procedure: Two random seeds, z0 and z1 , are generated. z0 is used to select a random task T from the set of available tasks. z1 is then used to select a random challenge c from the set CT . This randomized selection process ensures unpredictability in the challenges, making it difficult for attackers to anticipate and prepare for specific tasks. By combining these carefully designed constraints with a randomized selection mechanism, the DF-CAPTCHA system creates challenges that are easily surmountable by genuine human callers but present significant obstacles for current RT-DF technologies. Table I presents a selection of tasks that can be employed in DF-CAPTCHA challenges. Our evaluation assumes that the Real-Time Deepfake (RT-DF) under test has been optimized for maximum performance on a single task: regular talking in audio and face video. This assumption allows us to assess the effectiveness of diverse challenges against a highly specialized RT-DF system. We conducted an assessment of these tasks based on observations from various RT-DF models. Our evaluation considers key factors: Effectiveness: This metric quantifies the difficulty for a modern RT-DF to successfully create a convincing deepfake of target identity t given the specific task constraints. Higher hardness indicates a more challenging task for the RT-DF system. Robustness: This factor identifies potential evasion strategies that an adversary might employ for each task. We consider two primary evasion tactics: Bypass: The attacker disables the RT-DF and directly interacts with our system. Mix: The attacker combines the RT-DF output (ag ) with additional audio sources. For example, to evade a ’talk & clap’ challenge, an attacker might create a′ g = ag +aclap , where aclap is captured from a separate microphone to avoid disrupting the RT-DF process (i.e., ft (as + am )). Sophistication: We evaluate the efficacy of each challenge against two levels of attackers: Naive Attacker: Uses existing datasets and limited samples of t to train ft , and

JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021

routes all audio through ft (e.g., using an unmodified library from GitHub). Advanced Attacker: Collects a practical amount of samples on t (e.g., 20 minutes) and can mix additional sources into ag . Our analysis reveals that a robust challenge is characterized by a random task T and a random challenge c drawn from CT , which collectively present significant difficulties for the adversary across all four constraints (realism, identity, task complexity, and time). This comprehensive evaluation framework enables us to systematically assess and refine the challenges used in the DF-CAPTCHA system, ensuring their effectiveness against a range of potential attack strategies. By considering both the limitations of current RT-DF technologies and the capabilities of different attacker profiles, we can design challenges that maintain a high level of security while remaining feasible for genuine human responses. 2) Verifying a Challenge: To determine whether V (rc ) = pass or f ail, we must verify if rc adheres to the realism, identity, task, and time constraints. While all four constraints can be verified by a human (either a moderator or the victim), human verification may be unreliable due to lack of confidence or susceptibility to social engineering. Therefore, we propose an automated verification method for each constraint that doesn’t require prior knowledge of the target identity t. The verification process for rc involves validating each constraint separately: Realism Verification (R). This check identifies distortions and artifacts in rc that may occur when an RT-DF operates outside its capabilities or when a low-quality RT-DF is used. We employ existing anomaly detectors and deepfake classifiers to assess the content’s realism. R outputs a score in the range [0, ∞) or [0, 1], indicating the degree of unrealism in rc . Identity Verification (I). To verify that rc maintains the claimed identity t, we: 1) Collect a short sample at of the caller before the challenge, with the victim confirming the identity. 2) Use a zero-shot recognition model to compare the identities in at and rc . This two-step process prevents identity switching after the challenge. I outputs a similarity score between at and rc . An alternative approach using continuous verification could be employed, although it would be more resourceintensive. Task Verification (C). This check ensures that rc contains the requested task, addressing scenarios where: 1) The model fails to generate the required content. 2) The attacker attempts to evade detection by performing a different task or no task at all. We employ a machine learning classifier for this verification. C outputs the probability that rc does not contain the specified task. Time Verification (T ). We verify the time constraint by ensuring that the first frame of rc is received within approximately 1 second after the challenge instructions are given. T outputs the measured time delay, denoted as d.

6

The overall validation of rc is determined by comparing the outputs of all four algorithms (T , R, I, C) against their respective thresholds (ϕ1 , ϕ2 , ϕ3 , ϕ4 ), each tuned appropriately. We consider rc valid if none of the algorithm outputs exceed their thresholds, and invalid if any threshold is exceeded. In summary, validation is performed as follows:   pass, T (d) < ϕ1 , R(rc ) < ϕ2 , V (rc ) = (1) I(rc , at ) < ϕ3 , C(rc , c) < ϕ4   f ail, else While the false reject rate can be adjusted by weighting the contribution of each constraint, it’s important to note that such adjustments may compromise the system’s security. Therefore, careful consideration must be given to balancing user experience with robust security measures. This comprehensive verification process ensures that the DF-CAPTCHA system can effectively distinguish between genuine human responses and sophisticated deepfake attempts across multiple dimensions of authenticity. C. Detection Framework DF-CAPTCHA protects users from fake callers through three stages: call forwarding, challenge creation, and response verification. 1: Call Forwarding. Calls can be routed to DF-CAPTCHA in several ways. In high-risk settings, all calls may be screened. Alternatively, screening can be triggered by blacklists, policies for callers outside the user’s address book, unexpected or unknown calls, suspicious conversations, unusual call behavior, or before sensitive discussions. 2: Challenge Creation. A random challenge c is sampled from the available challenge set, and instructions are generated describing the required action and its start cue. These instructions are delivered to the caller, e.g., via Text-to-Speech (TTS). At the start of the challenge, the caller states their name. This sample, denoted at , is shared with the victim for acknowledgment and used for identity verification.3 The instructions are then given, followed by a tone. The delay between the tone and the first response is measured and included in rc for time verification (T ). After a fixed interval, the response is recorded as rc and passed to the verification stage. 3: Response Verification. The response rc and its timing data are evaluated by T , R, C, and I. If all outputs are below their respective thresholds, at is played to the user. If the user accepts the claimed identity, the DF-CAPTCHA passes and the call is connected or resumed. If any component exceeds its threshold, the call is dropped and evidence is presented to the user. This may include which constraint(s) failed, by how much, and playback of at , c, and rc when appropriate. Although the execution order is not semantically important, we suggest T → R → C → I to reduce unnecessary computation. In higher-security settings, multiple DF-CAPTCHAs can be issued and verified to reduce the false negative rate. 3 This prevents an attacker from simply disabling the RT-DF during the challenge and responding with their real voice or face.

JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021

Deepfake

RT-DF Call

(2) Challenge Creation c ∈ 𝐶𝑇 seed 𝑧1 challenge 𝑐 + instructions

Select challenge

seed 𝑧0

𝑇

Select task

(1) Call Forwarding Get voice sample 𝑎𝑡 from caller

(3) Response Verification 𝑉 𝑟𝑐

response 𝑟𝑐

Time 𝒯 𝑑 < 𝜙1

Realism true

ℛ 𝑟𝑐 < 𝜙2

Task true

𝒞 𝑟𝑐 , 𝑐 < 𝜙4

Victim

yes

no

Call connected/resumed

Attacker

7

suspicious?

Ask victim if accept call from 𝑡 given 𝑎𝑡 ? true Identity true

ℐ 𝑟𝑐 , 𝑎𝑡 < 𝜙3

𝑎𝑡 acknowledged? true

drop call

evidence (𝑐, 𝑟𝑐 )

Fig. 2: An overview of the proposed DF-CAPTCHA system: (1) Calls are forwarded to the system using a blacklist, whitelist, policy or the victim’s intuition, (2) a random DF-CAPTCHA c with accompanying instructions is generated and send to the caller as a challenge, (3) the response rc is verified against the four constraints (time, realism, identity, task) and if all four pass then the call is connected/resumed. Otherwise, the call is dropped and evidence is provided to the victim.

D. Deployment The framework can be deployed either on-device, such as as a phone app, or in the cloud. This supports personal call screening as well as organizational settings, including call centers and online meeting rooms, where callers can be screened before being admitted to sensitive conversations such as confidential Zoom meetings [17], [58]. Usability & Limitations. DF-CAPTCHA provides a practical active defense against real-time impersonation, but it also has important limitations. It is designed specifically for RealTime Deepfakes (RT-DFs), making it effective against live impersonation attempts but not against pre-recorded deepfake content. As an active defense, it must also balance security with convenience: poorly calibrated challenges may become intrusive or time-consuming for legitimate callers. Nevertheless, this trade-off is often acceptable in high-security settings where call authenticity is critical, such as confidential business or sensitive personal communications. The system can operate either autonomously or manually, depending on the user’s needs and security requirements, which improves usability across a range of scenarios. A video demonstration of the system is available online.4 DFCAPTCHA also relies on deep learning models for realism (R), identity (I), and task (C) verification. Although such models are, in principle, vulnerable to adversarial attacks [59], several factors improve robustness. Calls typically pass through noisy and compressed channels, which can weaken adversarial perturbations; generating adversarial examples in real time substantially increases attack complexity and computational cost; and the verification models are likely black boxes from the attacker’s perspective, making them difficult to query or manipulate. Overall, while DF-CAPTCHA is limited in scope and may introduce some user friction, it remains a strong mechanism for protecting live call authenticity against increasingly sophisticated digital impersonation. Its flexibility and robustness 4 https://youtu.be/izSeINj53hg

make it especially suitable for high-security environments where the cost of a false acceptance outweighs the inconvenience of additional verification. V. T HREAT A NALYSIS In this chapter, we evaluate the threat posed by Real-Time Deepfakes (RT-DFs) by assessing the quality and capabilities of various RT-DF models through user studies. Our experimental study was designed to gauge both the performance of current RT-DF algorithms and the ability of humans to identify manipulated content in realistic settings. Participants were exposed to authentic and manipulated media in audio and video scenarios and were asked to judge realism, identity, trust, and authenticity. This allows us to characterize the present threat level of RT-DFs while also measuring how well human observers can detect them. All of our experiments were approved by our university’s ethics committee. Because this paper is an extension of our original audiofocused work, the audio results reported here summarize and build on our original findings, while the video results constitute the new experimental component introduced in this journal version. To present a unified view of the RT-DF threat landscape, we describe the audio and video evaluations in parallel. A. Audio and Video RT-DFs We evaluate RT-DFs in both the audio and video domains using separate user studies. In the audio domain, we assess the quality of five RT-DF voice cloning models from the perspective of 41 volunteers. In the video domain, we assess the quality of four different RT-DF face-manipulation models based on feedback from 38 volunteers. In both studies, the participants were university students with an average age of 25, and most were not studying computer science or related disciplines. In the audio study, 18 participants were women and 23 were men. In the video study, the group comprised 15 women and 23 men. To avoid bias in the video experiments,

JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021

8

TABLE I: Examples of video-based (top) and audio-based (bottom) tasks which can be used as challenges in a D-CAPTCHA. Strong challenges are hard for the adversary on all four constraints: realism, identity, complexity and time. Task (T ) Acronym Video-based Tasks Drop Object DO Bounce Object BO Fold Shirt FS Stroke hair SH Interact with Background IB Spill Water SW Pick Up Object PO Hand Expressions HE Tongue Motion TM Fold Ear FE Face Occlusions FO Remove Glasses RG Walking Out of Frame WOF Moving Close and Far MCF Turn Head TH Press Nose PN Pressing Cheek PC Show Teeth ST Toss Coin TC Shine Light on Face SF Drum on Table DT Display Items in Hand DI Turn Around TA Roll Head RH Puff Cheeks PC Mouth Shapes MS Eye Gestures VS Display Multiple Faces MF Audio-based Tasks Clear Throat CT Hold Musical Note HN Hum Tune HT Laugh L Mimic Speaking Style MS Repeat Accent R Sing S Speak with Emotion SE Yawn Y Blow Noises BN Blow on Mic BM Clap Cl Click Tongue Clk Cough Co Horse Lips HL Knock K Playback Audio PA Raspberry R Sound Effect SFX Touch Mic TM Type T Whistle W Talk & Clap T&C Talk & Knock T&K Talk & Playback P Talk with Tones TT Vary Speed VS Vary Volume V •: high, ◦: medium, −: low

Hardness Identity Task

Usability

Realism

• • • • ◦ ◦ • • ◦ • ◦ ◦ • • • • • • ◦ ◦ • • • • • ◦ ◦ −

• • • • • • • • • • • ◦ ◦ • • • • ◦ ◦ ◦ ◦ ◦ • • • ◦ ◦ ◦

• • • • ◦ • • • • • ◦ • − • ◦ • • • ◦ • • • − • • • • −

◦ ◦ • ◦ ◦ − ◦ ◦ − ◦ • • • • • ◦ ◦ ◦ − • • ◦ • ◦ ◦ ◦ − •

• • • • • • • • • • • • • • • • • • • • • • • • • • • •

• • • ◦ ◦ ◦ • • ◦ • ◦ • • • ◦ ◦ − • • ◦ ◦ − ◦ ◦ − • • •

• ◦ • • • • • • • • • ◦ • • • ◦ • • • • • • • • • • • •

◦ ◦ • • • • • • ◦ − − − − − − − − − − − − − • • • • • •

• • • • ◦ ◦ • ◦ • • • • • • • • • • • • • • • • • • ◦ ◦

• • • • • • • • • • • • • • • • • • • • • • • • • • • •

the volunteers were not informed that the study concerned deepfakes or cybersecurity until the end of the experiment. B. Experiment Setup 1) RT-DF Models: For the audio evaluation, we surveyed 25 voice cloning papers published over the last four years that can process audio in real time as a sequence of frames. Of these, we selected the four recent works that published source code: AdaIN-VC [60], MediumVC [61], FragmentVC [62], and StarGANv2-VC [56]. We also included ASSEM-VC [63] as an additional comparison. All audio clips in this experiment were generated using the pre-trained models provided by the

Time

Weakness Evasions

Effectiveness Naive Attacker Advanced Attacker

mix mix

• • • • ◦ ◦ • • • • • • ◦ • • • • • • • • • • • • • • •

• • ◦ • ◦ • ◦ • • • • ◦ − • • • • ◦ • ◦ ◦ ◦ • • • • ◦ −

bypass bypass bypass bypass bypass bypass bypass bypass bypass bypass bypass bypass bypass mix mix mix mix mix mix

• • • • ◦ ◦ • • • • • • • • • • • • • • • • • • • • • •

◦ • • • ◦ ◦ • • • − − − − − − − − − − − − − − − − • • •

bypass

bypass bypass

original authors. To simulate a realistic telephony setting, the clips were passed through a phone filter, i.e., a band-pass filter in the 0.3–3 KHz voice range [64]. For the video evaluation, we reviewed academic papers and popular GitHub community projects to identify the latest technologies that (1) operate in real time and (2) provide source code to ensure reproducibility. We selected four models: DeepFaceLab [55], FaceFusion [65], SimSwap [66], and Roop [67]. For our experiments, all video clips were generated using the pre-trained models provided by the original authors. 2) Experiments: To quantify the threat of RT-DFs, we conducted two experiments in audio and three in video.

JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021

a) Audio experiments.: Following our original audio evaluation, we performed two experiments on a group of 41 volunteers: EXP1a - Quality. The goal of the first experiment was to determine how easy it is to identify an RT-DF in the bestcase scenario, namely when the victim is already expecting a deepfake. EXP1b - Identity. The goal of the second experiment was to determine how well RT-DF models can clone identities. In EXP1a, volunteers were asked to rate the quality of the voices on a scale of 1–5 (1: fake, 5: real). There were 90 audio clips presented in random order: 30 real and 60 fake, with 12 clips from each of the five RT-DF models. The clips were approximately 4–7 seconds long each. In EXP1b, we selected the top two models from EXP1a. For each model, we repeated the following trial eight times. First, the volunteer listened to two real samples of the target identity as a baseline. Then we played two real and two fake samples in random order and asked the volunteer to rate how similar the speakers sounded compared to the speaker in the baseline. If a model has a positive mean opinion score (MOS) in both EXP1a and EXP1b, then it poses a considerable threat, since it can (1) synthesize high-quality speech, (2) that sounds like the target, and (3) do so in real time. The distribution of ratings across the five audio RT-DF models and real recordings is shown in Fig. 3. b) Video experiments.: To quantify the threat of RT-DFs in video, we performed three experiments on a group of 38 volunteers: EXP2a - Authenticity. The goal of the first experiment was to assess whether a victim would perceive a deepfake video as authentic without anticipating a deepfake. In other words, how likely would someone fall for this attack? EXP2b - Detection. This experiment aimed to assess participants’ ability to discriminate between deepfake-generated videos and authentic footage while anticipating that some of the videos would be fake. In other words, does an informed decision affect one’s susceptibility? EXP2c - Quality. This phase of the experiment aimed to evaluate the perceptual quality and believability of synthetically generated videos. In other words, which technology is the best? In EXP2a, participants were shown a video of a student introducing themselves using the standard script: “Hello, my name is [Name], and I study at [University Name].” The participants, who were unfamiliar with the identities in the videos, were asked to rate their trust in the person on a scale of 1–5. The participant pool was divided into two groups. For each identity, one group viewed the authentic recording and the other viewed a deepfake version of the same identity. At this stage, participants were unaware that some videos had been generated by deepfake algorithms or that the study was evaluating deepfake perception. The goal was to determine whether there is a significant difference in how people perceive and trust authentic versus deepfake videos. In EXP2b, participants were informed that the videos they were about to view contained both authentic and syn-

9

thetic content. The synthetic videos were generated using DeepFaceLab, the algorithm that produced the most convincing results in our earlier evaluation. Participants were then shown a mix of authentic and deepfake videos and were asked to rate authenticity on a 5-point Likert scale: (1) Certain the video is authentic, (2) Believe the video is authentic, (3) Uncertain about the video’s authenticity, (4) Believe the video is synthetic, and (5) Certain the video is synthetic. The objective was to test whether people could accurately distinguish between authentic and deepfake videos when explicitly primed to do so. In EXP2c, we compared the previously selected deepfake algorithms directly. Participants were shown five videos generated by each deepfake algorithm and five authentic recordings. For each video, they rated two attributes. The first was perceived authenticity on a 1–5 scale, where 1 indicated “easily identifiable as AI-generated” and 5 indicated “indistinguishable from a genuine recording.” The second was overall video quality, focusing on visual clarity and fidelity, again on a 1–5 scale, where 1 represented “low quality with noticeable distortions” and 5 represented “high quality with no apparent flaws.” This design allowed us to distinguish between an algorithm’s ability to generate convincing fakes and its ability to produce high-quality visual output. The distributions of ratings across the evaluated video RT-DF models and real videos are shown in Fig. 4.

C. Experiment Results a) Audio results.: The audio results reported here summarize our original findings and serve as the historical baseline for the multimodal threat analysis in this extension paper. EXP1a. To analyze the quality (realism) of the models, we compared the MOS scores of the deepfake audio to the MOS of the real audio, where both were scored blindly. In Fig. 3, we plot the distribution of each model’s MOS compared to real audio. Roughly 20–50% of the volunteers gave the RTDF audio a positive score, with StarGANv2-VC achieving the highest quality. Because opinion scores are subjective, we further normalized the MOS to estimate how often volunteers were actually fooled by an RT-DF. In principle, the range of scores given by volunteer k to real audio captures that volunteer’s trust range. k Let µkreal and σreal denote the mean and standard deviation of volunteer k’s scores on real clips. We estimate that a volunteer would likely be fooled by a clip if they assigned it a score k greater than µkreal − σreal . Using this measure, Fig. 5 presents the attack success rate for each RT-DF model. We found that StarGANv2-VC had the highest success rate, fooling 46% of the volunteers. This indicates that although current RT-DF models are not perfect, they can still fool people even under conservative conditions. We note that these results should not be interpreted as the likelihood of a real-world attack succeeding, since our volunteers were actively expecting deepfakes and therefore listened carefully for artifacts. A true victim under pressure would likely overlook at least some of these anomalies.

JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021

EXP1b. To analyze the ability of the models to copy identities, we normalized volunteer k’s scores on fake audio by computing score − µkreal . k σreal Figure 6 plots the distribution of the normalized scores on fake audio. We observe that the volunteers were mostly indecisive, rating some fake clips as more authentic and some as less. For the majority of cases (score > −1), volunteers felt that the identity had been captured well by the top two models. b) Video results.: EXP2a. To assess blind authenticity, we compared the MOS assigned to each identity in both its genuine and deepfake forms. Specifically, for each identity we computed the difference between the mean score given to the fake version and the mean score given to the real version, i.e., µkf ake − µkreal . A positive value indicates that the deepfake identity was perceived as more trustworthy than the genuine one, while a negative value indicates the opposite. Figure 8 presents the distribution of these values. The distribution is approximately centered around zero and is close to normal, with nearly 50% of the sample showing a positive difference. In other words, for about half of the identities, the fake video was perceived as more trustworthy than the real one. This suggests that the artifacts or distortions present in current RT-DF videos do not significantly reduce perceived trust and supports our hypothesis that real-time deepfake videos can effectively mislead victims. EXP2b. To analyze the detection ability of the volunteers, we calculated the MOS for each user across all videos. Figure 7 compares the resulting distributions for fake and real videos. Two main conclusions emerge. First, participants struggled to accurately identify fake videos, achieving only about 67% recall. Second, when explicitly asked to look for deepfakes, they became overly suspicious and misidentified genuine videos as fake in approximately 41% of cases. This high false positive rate indicates a tendency toward overdetection once participants are primed to suspect manipulation. These findings show that even after being informed that some videos are fake, people still cannot reliably distinguish authentic videos from real-time deepfake videos. More importantly, the combination of relatively low fake-video detection and high false-positive rates on real videos shows that human judgment alone is not sufficient to defend against this threat. EXP2c. To analyze the quality (realism) of the video models, we compared the MOS scores of the deepfake models to the MOS of the real videos, again under blind scoring. Figure 4 shows the distribution of ratings for each model relative to real video. Based on these results, we selected the best-performing model for the later DF-CAPTCHA evaluation. D. Takeaways for DF-CAPTCHA Taken together, the audio and video experiments paint a consistent picture. In audio, our original findings showed that even when users are expecting manipulation, modern RT-DF systems can still produce speech that is perceived as realistic and identity-consistent, with StarGANv2-VC fooling 46% of listeners under these conservative conditions (Figs. 3–6). In

10

1

2

100 90

80

70

60

0

20

30

40

3

4

5

50

40

30

20

10

0

50

60

70

80

90 100

Real StarGan Fragment Assem Medium Ada 10

Model

Fig. 3: RT-DF Quality - The distribution of ratings which the volunteers gave to each of the RT-DF models and real voice recordings (1: fake, 5: real). 100

1

90

80

70

60

10

20

30

40

2

50

3

40

4

30

5

20

10

0

80

90

100

Real DeepFaceLab FaceFusion Roop SimSwap 0

50

60

Model

70

Fig. 4: RT-DF Quality - The distribution of ratings which the volunteers gave to each of the DF models and real videos recordings (1: fake, 5: real).

video, the new experiments in this extension show that people often trust deepfake videos as much as real ones, and in many cases even more, while also performing poorly when explicitly asked to detect fakes (Figs. 8–4). This threat analysis motivates the need for an active defense. Passive perception is unreliable in both modalities, and RTDF quality is continuing to improve. Therefore, rather than waiting for artifacts to appear naturally, DF-CAPTCHA aims to induce them deliberately by forcing the model outside its stable operating regime. VI. DF-CAPTCHA E VALUATION We evaluate DF-CAPTCHA across both audio and video modalities, presenting them in parallel to highlight the generality of the active defense principle and to enable direct comparison. The audio pipeline extends our prior conference work [23], where the core challenge-response framework was first introduced and validated for voice-based RT-DFs. The video pipeline is the primary new contribution of this paper, extending the framework to face-based RT-DFs in video calls. By evaluating both modalities together, we aim to demonstrate that DF-CAPTCHA’s advantages are not modality-specific, while also surfacing meaningful differences in how the system behaves across the two domains.

JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021

11

Per model, on participants who are aware of deepfake possibility Model Ada Medium Assem Fragment StarGan 0

10

20

30

58.64%

41.36%

34.88%

65.12%

40

20

Count

StarGan Fragment Assem Medium Ada

fake

Model

Attack Success Rate

40

0

40

Success %

real

20

Fig. 5: RT-DF Quality - The percent of volunteers fooled by each RT-DF model, even though they were expecting a deepfake. 80 Fragment

60 40

Count

20 0 80

Stargan

60 40 20

0 −2

−1

0

1

2

Normalized Scores

Fig. 7: Histogram of real and fake video scores. Positive scores indicate the volunteer believed the video was fake. The graph shows a high false positive rate when participants were asked to detect fakes. There is no significant difference between fake and real scores, suggesting that current deepfake algorithms are challenging for humans to detect accurately.

0 −2

0

Median score

2

Normalized value density

Fig. 6: RT-DF Identity - A histogram of the normalized MOS scores for how similar RT-DF audio sounds like the target identity t. Positive scores are cases where volunteers thought a fake audio sounded more like t than an authentic recording of t.

0.9

0.6

0.3

0.0 −1.0

−0.5

0.0

0.5

1.0

Normalized value

Across both modalities, we report the area under the ROC curve (AUC) and equal error rate (EER). A higher AUC and lower EER both indicate better performance. An AUC of 1.0 indicates a perfect classifier; an AUC of 0.5 indicates random guessing. A. Experiment Setup 1) Datasets: Audio. To evaluate the audio pipeline, we recorded 20 English-speaking volunteers to create both speech and challenge-response datasets. It took each volunteer over an hour to record their data, and all volunteers were compensated for their time. This produced four datasets: (Dreal ) 2,498 samples of real speech (100–250 random sentences per volunteer). (Df ake ) 1,821 samples of RT-DF voice conversion using StarGANv2-VC, the top-performing model from EXP1a. The model was trained to impersonate 6 of the 20 volunteers, augmented with 14 additional voice actors from the VCTK dataset to improve generalization. (Dreal,r ) 3,317 samples of real challenge responses across nine tasks. Tasks performed approximately 30 times per volunteer: sing (S), hum tune (HT), coughing (Co), vary volume (V), and talk & playback (P). Tasks performed approximately 5 times per volunteer: repeat accent (R), clap (Cl), speak with emotion (SE), and vary speed (VS). (Df ake,r ) 16,123 deepfake samples produced by applying StarGANv2-VC to Dreal,r , excluding same-identity conversions (i.e., where s = t). For all train-test splits, identities were kept disjoint between train and test sets. In addition, the public ASVspoof-DF

Fig. 8: Histogram of the difference between real and fake identity scores in video. A score above 0 indicates the fake identity was perceived as more trustworthy than the real identity. Remarkably, 50% of fake identities were deemed more trustworthy than their real counterparts. These results demonstrate the significant challenge humans face in detecting deepfakes in videos.

dataset [68] (22,617 real and 15,000 fake samples) and the RITW dataset [39] (19,963 real and 11,816 fake samples) were used to train the realism models. 80% of the union of these datasets was used for training and 10% for validation (early stopping). Video. To evaluate the video pipeline, we recorded 20 volunteers to create both regular video samples and challengeresponse videos. Volunteers were compensated for their time. The total corpus spans 310 minutes of footage, averaging 15.5 minutes per volunteer, totaling 20.92 GB of data. This produced four datasets: (Dreal ) 20 samples of regular video per volunteer (105 minutes total; 5.25 minutes per sample). (Df ake ) 20 samples of RT-DF face replacement using DeepFaceLab, the top-performing model from EXP2c, fine-tuned on pairs from the collected dataset. (Dreal,r ) 1,000 samples of real challenge responses across ten tasks, each performed approximately 6 times per volunteer: far/close (FC), eyes move (EM), hand occlusion (HO), kiss shape (KS), open mouth (OM), press cheek (PC), puff cheeks (PCs), smile (SM), sunglasses (SG), and turn head

JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021

12

(TH). (Df ake,r ) 1,000 deepfake samples produced by applying DeepFaceLab to Dreal,r . 2) Models: Realism (R). For the audio pipeline, we evaluated five deepfake detection models. SpecRNet [26] is a lightweight neural architecture inspired by RawNet2 [27] that achieves competitive detection performance with significantly reduced computational cost. One-Class [32] is based on a ResNet-18 backbone adapted with One-Class Softmax activations for improved generalization. GMM-ASVspoof [68] is a Gaussian mixture model operating on LFCC features, used as the ASVspoof 2021 competition baseline. PC-DARTS [69] is a CNN that automatically learns its own architecture and has shown strong generalization to unseen attacks. Local Outlier Factor (LOF) is a density-based anomaly detector. For the video pipeline, we evaluated nine deepfake detectors drawn from DeepfakeBench [70], using their best-performing pretrained weights. RECCE [71] uses reconstruction-classification learning to build compact representations of genuine faces. FFD [72] applies attention mechanisms to enhance and localize manipulated facial regions. SRM [73] exploits high-frequency image noise through multiscale feature extraction, residual-guided spatial attention, and cross-modality attention. SPSL [74] combines spatial image information with phase spectrum features to capture artifacts from cumulative up-sampling. Xception [75] is a CNN based on depthwise separable convolutions with residual connections. Capsule-Forensics [76] applies capsule networks to detect a wide range of media forgeries. UCF [77] disentangles forgery-related features to address overfitting. F3Net [78] leverages frequency-aware clues via DCT decomposition to handle highly compressed manipulated video. CORE [79] regularizes the consistency of representations across augmentations to address overfitting in face forgery detection. Task Verification (C). For audio, a separate GMM classifier was trained per task on MFCC features, using the ASVspoof 2021 baseline model [68]. Each model classifies between genuine responses to that specific task and all other audio (other tasks or regular speech). A 70-30 train-test split was used. For video, a pretrained ResNet-3D model [80] was finetuned to predict which of the ten evaluated tasks is present in a given video clip. A 75-25 train-test split was used. Identity Verification (I). Both pipelines convert a pretrained recognition model into a zero-shot anomaly detector, using a reference sample at captured from the caller before the challenge is issued. This reference is used to verify that the RT-DF is not simply disabled during the challenge. For audio, we used the ECAPA-TDNN speaker recognition model from the SpeechBrain toolkit [81]. Identity consistency is measured as the squared L2 distance between speaker encodings: I(at , rc ) = ∥f ∗ (at ) − f ∗ (rs )∥2

(2)

where f ∗ is the speaker encoding from an inner layer of the model. Smaller scores indicate greater similarity between the pre-challenge voice and the challenge response.

For video, we used a pretrained ResNet-18 model [82]. Identity consistency is measured as the cosine similarity between frame encodings: S(at , rs ) =

f ∗ (at ) · f ∗ (rs ) ∥f ∗ (at )∥∥f ∗ (rs )∥

(3)

where f ∗ is the frame encoding from an inner layer of ResNet18. Higher scores indicate greater similarity. The use of cosine similarity for video (rather than L2 distance for audio) reflects the different embedding geometries of the two pretrained models. In both cases, we evaluate I using negative pairings from the same identity (ai , rc,i ) and positive pairings from different identities (ai , rc,j ), where ai , aj ∈ Dreal , rc,i , rc,j ∈ Dreal,r , and i ̸= j. 3) Experimental Protocol: For each modality, we conduct four parallel experiments: EXP-R (R) Comparison of passive deepfake detection (baseline) against active challenge-boosted detection across all realism models. EXP-C (C) Evaluation of the task verification model’s ability to confirm that the requested challenge was actually performed. EXP-I (I) Evaluation of the identity verification model’s ability to detect when a caller disables the RT-DF during the challenge. EXP-E (R, C, I) End-to-end evaluation of the full DFCAPTCHA pipeline with all three components operating together. We do not separately evaluate the timing constraint T in either modality. It is implemented as a simple binary check (whether the first frame of the response rc is received within approximately one second of the challenge start) and does not require a learned model. B. EXP-R: Realism Detection. Active vs. Passive The first experiment asks whether issuing a challenge improves the detectability of deepfake artifacts compared to passive detection of ordinary deepfake speech or video. Audio results. Table II reports the AUC and EER for each of the five audio detectors across the baseline scenario and each challenge type. With the exception of SpecRNet, all detectors benefit substantially from the challenge conditions. The best-performing combination overall is GMM-ASVspoof with challenges, reaching an AUC of 0.978 on the talk & clap (T&C) task compared to its baseline AUC of 0.949. The LOF detector shows the most dramatic single-task improvement, reaching an AUC of 0.982 on the cough (Co) task from a baseline of 0.678. SpecRNet is the notable exception: its AUC degrades under several challenge conditions (e.g., from 0.952 at baseline to 0.538 on T&C), suggesting it is not well-suited to the challenge-response setting. In terms of EER, GMMASVspoof again performs best with challenges, achieving an EER as low as 0.071 on T&C compared to its baseline EER of 0.122. Video results. Table III reports the AUC and EER for each of the nine video detectors. Every model shows improved

JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021

13

TABLE II: The AUC and EER of voice anomaly detectors/classifiers when used to detect deepfake voices (baseline) and when boosted using our challenges as R. Bold values indicate a case where the challenge improves the detectors ability to spot a deepfake. Model

Baseline

R

T&C

SE

P

VS

V

S

HT

Co

SpecRNet One-Class GMM-AsvSpoof PC-DARTS LOF

0.952 0.939 0.949 0.551 0.678

0.914 0.952 0.951 0.568 0.614

0.538 0.967 0.978 0.557 0.93

0.796 0.941 0.953 0.611 0.635

0.825 0.954 0.97 0.507 0.756

0.922 0.958 0.957 0.586 0.771

0.92 0.957 0.949 0.579 0.824

0.834 0.948 0.928 0.655 0.593

0.701 0.896 0.949 0.675 0.681

0.789 0.832 0.833 0.635 0.982

Model

Baseline

R

T&C

SE

P

VS

V

S

HT

Co

SpecRNet One-Class GMM-AsvSpoof PC-DARTS LOF

0.116 0.128 0.122 0.449 0.326

0.163 0.123 0.1 0.418 0.419

0.475 0.099 0.071 0.494 0.122

0.285 0.133 0.099 0.386 0.412

0.261 0.118 0.09 0.494 0.262

0.155 0.112 0.092 0.43 0.301

0.154 0.104 0.115 0.437 0.26

0.245 0.128 0.143 0.366 0.38

0.354 0.187 0.131 0.334 0.382

0.281 0.259 0.255 0.415 0.051

True Positive Rate

1.0 R auc: 0.864 T&C auc: 0.985 Co auc: 1.0 SE auc: 0.938 HT auc: 0.999 P auc: 0.998 S auc: 0.993 VS auc: 0.963 V auc: 0.974

0.8 0.6 0.4 0.2 0.0

0.0

0.2

0.4 0.6 False Positive Rate

0.8

1.0

Fig. 10: The performance of the audio task detection model C.

Fig. 9: A sample of video challenges showing their effect on stressing the limitations of modern deepfake pipelines.

than the best challenge-boosted result. This validates the core premise of DF-CAPTCHA: active elicitation is more reliable than passive observation. C. EXP-C: Task Verification

performance when challenges are introduced without exception because the challenges push the pipelines our of their capabilities causing large artifacts, as shown in Fig. 9. CORE demonstrates the most dramatic enhancement, improving from a baseline AUC of 0.777 to a peak of 0.987 on the eye movement (EM) task, and achieving an EER as low as 0.04 on the same task from a baseline EER of 0.40. SRM is the strongest model on the hand occlusion (HO) task (AUC 0.974, EER 0.09) and performs consistently well across tasks. UCF is the weakest overall, with several challenge conditions failing to improve substantially over its baseline (e.g., AUC of 0.610 on HO vs. a baseline of 0.694), though it does benefit on some tasks such as EM (AUC 0.880). Xception achieves a near-perfect AUC of 0.993 on the EM task. Shared insight. The pattern is consistent across both modalities: challenges force RT-DF models to operate outside their training distribution, amplifying artifacts that are otherwise subtle or absent in ordinary deepfake content. The improvement is broad, affecting most models in both domains, and the best passive baseline in each modality is substantially weaker

The second experiment evaluates whether the system can confirm that the caller actually performed the requested challenge, as opposed to staying silent, performing a different action, or producing a deepfake response that fails to replicate the requested task. Audio results. Figure 10 shows the AUC of the audio task detection model C across all nine tasks. The model performs well across most tasks, with several reaching near-perfect AUC: cough (Co) achieves an AUC of 1.0, hum tune (HT) achieves 0.999, playback (P) achieves 0.998, and sing (S) achieves 0.993. The weakest performer is the repeat accent (R) task, which achieves an AUC of only 0.864. This can be attributed to two compounding factors: the subtle acoustic differences between genuine and imitated accent modifications are inherently difficult to distinguish, and many volunteers struggled to produce convincing accent variation, resulting in responses that closely resembled normal speech and were therefore hard to classify. Video results. Figure 11 shows the AUC of the video task detection model C across all ten tasks. Performance is nearperfect across the board. Far/close (FC) and sunglasses (SG)

JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021

14

TABLE III: AUC and EER of the video anomaly classifiers/detectors when used as deepfake detectors (baseline) and when boosted using our proposed challenges as R. For AUC, bold values indicate improvement over the baseline; for EER, bold values indicate reduction relative to the baseline. Model

Baseline

PC

FC

EM

HO

AUC KS

EM

PCs

SG

TH

SM

Baseline

PC

FC

EM

EER HO KS

0.555 0.777 0.750 0.688 0.761 0.644 0.794 0.694 0.733

0.677 0.861 0.803 0.872 0.828 0.830 0.926 0.677 0.804

0.714 0.863 0.843 0.816 0.809 0.884 0.862 0.628 0.850

0.682 0.850 0.874 0.851 0.866 0.808 0.858 0.804 0.864

0.771 0.904 0.902 0.931 0.891 0.919 0.974 0.610 0.904

0.799 0.962 0.908 0.936 0.953 0.918 0.952 0.649 0.948

0.830 0.987 0.945 0.936 0.979 0.952 0.980 0.880 0.993

0.846 0.903 0.805 0.854 0.843 0.925 0.944 0.664 0.880

0.763 0.928 0.830 0.915 0.756 0.929 0.903 0.632 0.907

0.758 0.911 0.862 0.886 0.870 0.921 0.875 0.443 0.941

0.683 0.951 0.923 0.927 0.913 0.905 0.920 0.794 0.873

0.35 0.40 0.35 0.35 0.35 0.45 0.25 0.35 0.35

0.37 0.26 0.40 0.18 0.22 0.27 0.11 0.31 0.29

0.36 0.23 0.22 0.32 0.18 0.24 0.26 0.41 0.22

0.45 0.24 0.19 0.25 0.27 0.27 0.33 0.28 0.19

0.38 0.19 0.21 0.15 21 0.18 0.09 0.45 0.19

Capsule-net CORE F3NET FFD RECCE SPSL SRM UCF Xception

EM PCs

SG

TH

SM

0.27 0.04 0.13 0.19 0.07 0.10 0.07 0.16 0.03

0.29 0.18 0.26 0.00 0.33 0.13 0.16 0.45 0.25

0.30 0.15 0.19 0.12 0.18 0.18 0.25 0.58 0.13

0.41 0.11 0.23 0.18 0.17 0.14 0.15 0.23 0.19

0.25 0.12 0.21 0.26 0.34 0.19 0.07 0.32 0.17

1.0 PC auc: 0.995 FC auc: 1.000 EM auc: 0.989 HO auc: 0.964 KS auc: 0.982 OM auc: 0.996 PCs auc: 0.962 SG auc: 1.000 TH auc: 0.959 SM auc: 0.998

0.8 0.6 0.4 0.2 0.0 0.0

0.2

0.4 0.6 False Positive Rate

0.8

1.0

True Positive Rate

1.0 True Positive Rate

0.33 0.11 0.20 0.15 0.07 0.22 0.11 0.35 0.10

Co auc: 0.574 HT auc: 0.688 P auc: 0.831 SE auc: 0.846 S auc: 0.878 R auc: 0.89 T&C auc: 0.904 VS auc: 0.926 V auc: 0.942

0.8 0.6 0.4 0.2 0.0

0.0

0.2

0.4 0.6 False Positive Rate

0.8

1.0

Fig. 11: The performance of the video task detection model C.

Fig. 12: The performance of the unsupervised audio identity detection model I for different tasks.

both achieve an AUC of 1.000. Kiss shape (KS) achieves 0.982, open mouth (OM) achieves 0.996, press cheek (PC) achieves 0.995, eyes move (EM) achieves 0.989, puff cheeks (PCs) achieves 0.962, smile (SM) achieves 0.998, hand occlusion (HO) achieves 0.964, and turn head (TH) achieves 0.959. Even when adversaries attempt to evade by remaining motionless, or when the deepfake model fails to synthesize the required movement, C maintains strong detection efficacy. Tasks requiring coordinated and complex facial deformation, particularly puff cheeks and open mouth, are especially effective, likely because these movements impose particularly demanding constraints on real-time face manipulation models. Shared insight. Task verification is highly reliable in both modalities, and in both cases the weaker tasks are those that are either acoustically or visually ambiguous, or that humans themselves find difficult to perform consistently. This points to a key design principle: when selecting challenges for DFCAPTCHA, it is important to favor tasks that are both easy for genuine callers to perform and sufficiently distinct from baseline behavior to be robustly classifiable. In the video domain, complex facial deformations appear to satisfy both criteria particularly well.

Audio results. Figure 12 shows the AUC of the audio identity model I across all nine tasks. Performance varies considerably by task. The strongest results are achieved on tasks that preserve a clear speaker signature: vary volume (V) achieves an AUC of 0.942, vary speed (VS) achieves 0.926, talk & clap (T&C) achieves 0.904, and repeat accent (R) achieves 0.890. The weakest tasks are cough (Co) with an AUC of 0.574 and hum tune (HT) with an AUC of 0.688. This is expected: humming and coughing suppress or distort the spectral characteristics that distinguish speakers, providing insufficient identity signal for the model to work with. Video results. Figure 13 shows the AUC of the video identity model I across all ten tasks. Overall performance is strong and substantially more uniform than in the audio domain. The best results are achieved on smile (SM) at AUC 0.991, open mouth (OM) at 0.986, puff cheeks (PCs) at 0.982, sunglasses (SG) at 0.982, and eyes move (EM) at 0.978. The most challenging task is turn head (TH), which achieves an AUC of 0.930, which is still strong but the lowest across the ten tasks. This is because turning the head temporarily occludes discriminative facial features for several frames, reducing the reliability of frame-level identity encoding. Hand occlusion (HO) achieves 0.937 for similar reasons, with the hand partially covering the face during execution. Shared insight. The identity verifier performs well in both modalities when the challenge preserves sufficient identity signal, but reveals modality-specific weaknesses. In audio, tasks that suppress speaker-specific spectral content (humming, coughing) degrade performance significantly. In video,

D. EXP-I: Identity Verification The third experiment evaluates whether the system can detect a simple but important evasion strategy: the attacker disables the RT-DF during the challenge and responds as their real self, then re-enables the deepfake afterward.

JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021

15

1.0

Accuracy

0.4 0.2 0.0

0.0

0.2

0.4 0.6 False Positive Rate

0.8

0.95

100%

100%

93.2%

91.9%

99.6% 100%

91.3%

90%

89.2%

88.8%

0.80

Precision

FPR

100% 100% 99.2% 100% 99.4% 99% 99.3% 100% 98.9%

0.9 0.6 0.3 0%

0.0 t en

c Ac

tasks that occlude the face (turning the head, hand occlusion) pose the most difficulty, though the degradation is milder than in the audio case. In both domains, the practical implication is the same: DF-CAPTCHA should either avoid tasks that are known to obscure identity, or compensate by requiring the caller to complete additional tasks in sequence that collectively preserve enough identity signal for reliable verification.

100%

92.4%

91.7%

91%

0.90

1.0

Fig. 13: The performance of the unsupervised video identity detection model I for different tasks.

93.9%

TPR 99.3%

0.85

Value

True Positive Rate

0.6

Value

PC auc: 0.965 FC auc: 0.952 EM auc: 0.978 HO auc: 0.937 KS auc: 0.965 OM auc: 0.986 PCs auc: 0.982 SG auc: 0.982 TH auc: 0.930 SM auc: 0.991

0.8

99.6%

99.4%

1.00

0%

2%

0%

1.3% 2.2% 1.7%

0%

2.3%

p h n m nt ck ing eed me ap gh on um ack ing eed ume ce Cla oug otio Hu yba u S S Cl ou oti H yb Sp Vol Sp Vol C Em C Em Ac a a Pl Pl

Task

Fig. 14: The end-to-end performance of the DF-CAPTCHA system on audio (voice).

Accuracy 1.0

97.7% 95.5%

98.8% 96.1%

TPR 100%

95.5%

100%

100%

97.7% 96.6%

96.6%

96.6%

E. EXP-E: End-to-End System Performance

Value

93.3% 90%

0.9

87.7%

87.7%

86.6%

86.6%

0.8

76.6% 73.3%

0.7

Precision 1.00

Value

The final experiment evaluates the complete DF-CAPTCHA pipeline, with all three components (R, C, and I) operating in tandem. For each model, thresholds are set such that the false positive rate is FPR = 0.01. This conservative setting prioritizes minimizing disruption to legitimate callers. The compounding effects of each model’s individual successes and failures are reflected in the end-to-end metrics. Audio results. We passed 3,317 real responses and 8,758 deepfake responses through the full pipeline. As shown in Figure 14, the system achieves a TPR of 0.89–1.00 depending on the selected task, with FPR ranging from 0.0 to 2.3% and overall accuracy of 91–100%. The best-performing tasks include cough (Co) and sing (S), both reaching accuracy of 99–100% with TPR at or near 1.00. The weakest task is repeat accent (R), reflecting the lower performance of the task detector C on this challenge identified in EXP-C. By comparison, the best passive baseline (SpecRNet) achieves a TPR of only 0.66 and an accuracy of 71% at the same FPR constraint of 0.01. DF-CAPTCHA therefore represents a substantial improvement of approximately 20–29 percentage points in accuracy over the best passive method. Video results. We passed 3,317 genuine responses and 8,758 deepfake responses through the full video pipeline. As shown in Figure 15, the system achieves a TPR of 0.73–1.00 depending on the selected challenge, with FPR ranging from 0.0 to 6% and overall accuracy of 87–100%. The best-performing tasks are open mouth (OM) and smile (SM), both reaching accuracy of 98–100% with TPR at or near 1.00. The weakest task is puff cheeks (PCs), which achieves a TPR of 0.733 and accuracy of 87.7% which is still well above the passive baseline, but reflects that some challenge types place more simultaneous pressure on I and R together. The best passive baseline (CORE) achieves a TPR of only 0.55 and an accuracy

100%

93.8%

100% 100% 88%

90.3% 85.1%

FPR 100% 96.6% 100%

0.75 0.50 0.25 0.00

5% 0% 3.3%

0%

0%

3% 6.6% 0% 1.6% 0%

ve se ion pe uth ek ks ile es ad ve se ion pe uth ek ks ile es ad mo clo lus sha mo che hee Sm lass n he s mo r clo clus sha mo che chee Sm lass n he es Far occ iss en ess uff c e Fa oc iss en ess uff ng Tur ng Tur y u p r Ey E K K Op Pr S Su P P O P nd nd Ha Ha

Task

Fig. 15: The performance of the ensure DF-CAPTCHA system in video domain (end-to-end).

of 75% under the same FPR constraint. DF-CAPTCHA therefore achieves an improvement of 12–25 percentage points in accuracy over the best passive method, depending on the task. Cross-modal comparison. The audio pipeline achieves a higher floor on TPR (0.89 vs. 0.73), while the video pipeline exhibits a slightly wider FPR range under the same threshold setting, reflecting greater variance across video challenge types in the identity and realism components. In both cases, however, the improvement over passive baselines is large and consistent: DF-CAPTCHA outperforms the best passive detector by 20– 29 percentage points in audio and 12–25 percentage points in video. The best-performing tasks in each modality reach near-perfect accuracy, and the combination of R, C, and I is more powerful than any single component or any passive detector operating alone. These results confirm that the active challenge-response principle generalizes robustly across both modalities.

JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021

VII. D ISCUSSION A. Discussion of the Results The results confirm that active deepfake detection substantially outperforms passive detection alone. By requiring callers to perform unpredictable challenges, DF-CAPTCHA forces real-time deepfake pipelines outside their stable operating regime, amplifying artifacts that realism, task, and identity verifiers can exploit. Crucially, this benefit is not architecturespecific: multiple realism detectors improved under challenge conditions, indicating that the framework exposes general failure modes rather than detector-specific weaknesses. This robustness makes DF-CAPTCHA well-suited to practical deployments such as remote interviews, call centers, and online meetings, where conditions and attack pipelines vary. Several limitations remain. The framework targets real-time attacks and does not address pre-recorded deepfake media. As generative models improve, some challenges may lose effectiveness and require replacement. The protocol can introduce user friction if deployed too aggressively in low-risk settings, and false positives remain a concern when legitimate users perform challenges under poor recording conditions. Future work should expand the challenge library to stay ahead of generative advances, evaluate real-world usability (latency, accessibility, challenge selection policy), and improve robustness against adaptive adversaries by developing more challenges according to the present day’s deepfake pipeline limitations.

16

future challenges, since highly salient behaviors are likely to be particularly useful for active detection. Overall, the XAI results strengthen the argument that DF-CAPTCHA improves detection not merely by adding interaction, but by deliberately eliciting behaviors that expose structural weaknesses in current real-time deepfake pipelines.

Fig. 16: XAI in Video CAPTCHA Analysis. Attention of a face neural network for three CAPTCHA types vs. no CAPTCHA. Higher activation observed in frames with active challenges.

VIII. C ONCLUSION B. XAI in Video CAPTCHAs To better understand why challenge-based detection improves performance, we used explainable AI (XAI) techniques to analyze the behavior of a deepfake detection network when processing fake videos with and without the proposed CAPTCHA challenges (illustrated in Fig. 16). Using the FaceForensics++-based model in [75], we observed substantially stronger activation patterns in frames that contained an active challenge than in comparable frames without a challenge. This confirms that the challenges expose visual irregularities that the detector identifies as salient evidence of manipulation. More specifically, frames containing an executed challenge were assigned a substantially higher probability of being fake. This trend was consistent across multiple challenge types, indicating that the effect is not limited to a single gesture or motion pattern. The results therefore provide interpretabilitybased support for our main hypothesis: dynamic, challengeinduced behaviors make real-time deepfakes more detectable by revealing anomalies that may remain weak or ambiguous during ordinary conversation. The XAI analysis also helps clarify what the detector is attending to. The most salient regions were typically located around the challenged facial or motion-related areas, suggesting that these induced behaviors create localized inconsistencies in geometry, appearance, or temporal coherence. This finding is important for two reasons. First, it provides a qualitative explanation for the quantitative gains observed in the evaluation. Second, it offers a practical guide for refining

In this paper, we presented DF-CAPTCHA, an active defense against real-time deepfake impersonation attacks in live communications. Rather than relying on passive artifact detection alone, our method challenges callers with simple tasks that are easy for humans but difficult for current real-time deepfake systems to perform convincingly. Our results show that this challenge-response approach substantially improves detection in both audio and video settings, while also addressing the growing limitations of human judgment in identifying deepfakes. A central contribution is our expansion of DF-CAPTCHA from audio to video, enabling a broader defense against multimodal real-time impersonation. Through new threat analysis, user studies, and experiments on face-based real-time deepfakes, we show that the same active-defense principle generalizes effectively beyond voice cloning to video manipulation. Overall, DF-CAPTCHA offers a practical, extensible, and forward-looking framework for securing digital interactions against next-generation social engineering attacks. R EFERENCES [1] Y. Mirsky and W. Lee, “The creation and detection of deepfakes: A survey,” ACM Computing Surveys (CSUR), vol. 54, no. 1, pp. 1–41, 2021. [2] ReSpeecher, “Voice cloning software for content creators — respeecher,” https://www.respeecher.com/. [3] D. Lee, “Deepfake salvador dalı́ takes selfies with museum visitors,” The Verge, 2019. [4] BBC, “Shamook: Star wars effects company ilm hires mandalorian deepfaker - bbc news,” 2021.

JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021

[5] T. Kington, “Meloni sues deepfake porn creator ‘to protect women’,” https://www.thetimes.com/world/europe/article/meloni-sues-deepfakeporn-creator-to-protect-women-rxvjz08x7, 2024, (Accessed on 16/04/2026). [6] J. Wakefield, “Deepfake presidents used in russia-ukraine war - bbc news,” https://www.bbc.com/news/technology-60780142, March 2022, (Accessed on 16/04/2026). [7] J. Bahr, “Deepfakes, blackmail and heartbreak: This is what sextortion looks like — sbs news,” https://www.sbs.com.au/news/article/deepfakesblackmail-and-heartbreak-this-is-what-sextortion-looks-like/rejaipy9p, 2024, (Accessed on 16/04/2026). [8] S. Landrin, “India’s general election is being impacted by deepfakes,” https://www.lemonde.fr/en/pixels/article/2024/05/21/ india-s-general-election-is-being-impacted-by-deepfakes 6672168 13. html?utm source=chatgpt.com#, 2024, (Accessed on 16/04/2026). [9] J. Vijayan, “Reshaping the threat landscape: Deepfake cyberattacks are here,” 2022. [10] K. Hao, “Deepfake porn is ruining women’s lives. now the law may finally ban it. — mit technology review,” 2021. [11] A. Siarohin, S. Lathuilière, S. Tulyakov, E. Ricci, and N. Sebe, “First order motion model for image animation,” in Advances in Neural Information Processing Systems 32. Curran Associates, Inc., 2019, pp. 7135–7145. [12] B. Han, L. Zhou, S. Liu, S. Chen, L. Meng, Y. Qian, Y. Liu, S. Zhao, J. Li, and F. Wei, “Vall-e r: Robust and efficient zero-shot text-to-speech synthesis via monotonic alignment,” arXiv preprint arXiv:2406.07855, 2024. [13] C. Stupp, “Fraudsters used ai to mimic ceo’s voice in unusual cybercrime case - wsj,” August 2019. [14] J. Halpin, “Millions of brits warned over ai ’video calls’ duping employees into £20m deepfake scam — the irish sun,” https://www. thesun.ie/tech/12989965/ai-deepfake-scam-arup-hong-kong-video/ ?utm source=chatgpt.com, 2024, (Accessed on 16/04/2026). [15] T. Brewster, “Fraudsters cloned company director’s voice in $35 million bank heist, police find,” 2021. [16] D. Merica, “Sophistication of ai-backed operation targeting senator points to future of deepfake schemes — ap news,” https://apnews.com/article/deepfake-cardin-ai-artificial-intelligence879a6c2ca816c71d9af52a101dedb7ff, 2024, (Accessed on 16/04/2026). [17] A. Roth, “European mps targeted by deepfake video calls imitating russian opposition — russia — the guardian,” 2021. [18] FBI, “Internet crime complaint center (ic3) — deepfakes and stolen pii utilized to apply for remote work positions,” https://www.ic3.gov/Media/ Y2022/PSA220628, June 2022. [19] L. Hurst, “Binance executive says scammers created deepfake ‘hologram’ of him to trick crypto developers — euronews,” https://www.euronews.com/next/2022/08/24/binance-executive-saysscammers-created-deepfake-hologram-of-him-to-trick-crypto-developer, 2022, (Accessed on 16/04/2026). [20] E. Salam, “Us mother gets call from ‘kidnapped daughter’ – but it’s really an ai scam — arizona — the guardian,” https://www.theguardian.com/us-news/2023/jun/14/ ai-kidnapping-scam-senate-hearing-jennifer-destefano, 2023, (Accessed on 16/04/2026). [21] Z. Almutairi and H. Elgibreen, “A review of modern audio deepfake detection methods: Challenges and future directions,” Algorithms, vol. 15, no. 5, 2022. [22] M. Masood, M. Nawaz, K. M. Malik, A. Javed, A. Irtaza, and H. Malik, “Deepfakes generation and detection: State-of-the-art, open challenges, countermeasures, and way forward,” Applied intelligence, vol. 53, no. 4, pp. 3974–4026, 2023. [23] L. Yasur, G. Frankovits, F. M. Grabovski, and Y. Mirsky, “Deepfake captcha: a method for preventing fake calls,” in Proceedings of the 2023 ACM Asia Conference on Computer and Communications Security, 2023, pp. 608–622. [24] Z. Lei, Y. Yang, C. Liu, and J. Ye, “Siamese convolutional neural network using gaussian probability feature for spoofing speech detection.” in INTERSPEECH, 2020, pp. 1116–1120. [25] C.-I. Lai, N. Chen, J. Villalba, and N. Dehak, “Assert: Antispoofing with squeeze-excitation and residual networks,” arXiv preprint arXiv:1904.01120, 2019. [26] P. Kawa, M. Plata, and P. Syga, “Specrnet: Towards faster and more accessible audio deepfake detection,” arXiv preprint, 2022. [27] H. Tak, J. Patino, M. Todisco, A. Nautsch, N. Evans, and A. Larcher, “End-to-end anti-spoofing with rawnet2,” in ICASSP 2021-2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 2021, pp. 6369–6373.

17

[28] J. Khochare, C. Joshi, B. Yenarkar, S. Suratkar, and F. Kazi, “A deep learning framework for audio deepfake detection,” Arabian Journal for Science and Engineering, vol. 47, no. 3, pp. 3447–3458, 2022. [29] H. Khalid and S. S. Woo, “Oc-fakedect: Classifying deepfakes using one-class variational autoencoder,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition workshops, 2020, pp. 656–657. [30] S. Agarwal, H. Farid, O. Fried, and M. Agrawala, “Detecting deepfake videos from phoneme-viseme mismatches,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition workshops, 2020, pp. 660–661. [31] C. Borrelli, P. Bestagini, F. Antonacci, A. Sarti, and S. Tubaro, “Synthetic speech detection through short-term and long-term prediction traces,” EURASIP Journal on Information Security, vol. 2021, no. 1, pp. 1–14, 2021. [32] Y. Zhang, F. Jiang, and Z. Duan, “One-class learning towards synthetic voice spoofing detection,” IEEE Signal Processing Letters, vol. 28, pp. 937–941, 2021. [33] S. Camacho, D. M. Ballesteros, and D. Renza, “Fake speech recognition using deep learning,” in Workshop on Engineering Applications. Springer, 2021. [34] T. Liu, D. Yan, R. Wang, N. Yan, and G. Chen, “Identification of fake stereo audio using svm and cnn,” Information, vol. 12, no. 7, 2021. [35] T. Arif, A. Javed, M. Alhameed, F. Jeribi, and A. Tahir, “Voice spoofing countermeasure for logical access attacks detection,” IEEE Access, vol. 9, 2021. [36] A. Pianese, D. Cozzolino, G. Poggi, and L. Verdoliva, “Deepfake audio detection by speaker verification,” arXiv preprint, 2022. [37] M. Todisco, X. Wang, V. Vestman, M. Sahidullah, H. Delgado, A. Nautsch, J. Yamagishi, N. Evans, T. Kinnunen, and K. A. Lee, “Asvspoof 2019: Future horizons in spoofed and fake audio detection,” arXiv preprint arXiv:1904.05441, 2019. [38] P. Kawa, M. Plata, and P. Syga, “Attack agnostic dataset: Towards generalization and stabilization of audio deepfake detection,” arXiv preprint, 2022. [39] N. M. Müller, P. Czempin, F. Dieckmann, A. Froghyar, and K. Böttinger, “Does audio deepfake detection generalize?” arXiv preprint arXiv:2203.16263, 2022. [40] M. Li, B. Liu, Y. Hu, L. Zhang, and S. Wang, “Deepfake detection using robust spatial and temporal features from facial landmarks,” in 2021 IEEE International Workshop on Biometrics and Forensics (IWBF). IEEE, 2021, pp. 1–6. [41] X. Yang, Y. Li, and S. Lyu, “Exposing deep fakes using inconsistent head poses,” in ICASSP 2019-2019 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 2019, pp. 8261–8265. [42] I. Amerini, L. Galteri, R. Caldelli, and A. Del Bimbo, “Deepfake video detection through optical flow based cnn,” in Proceedings of the IEEE/CVF international conference on computer vision workshops, 2019, pp. 0–0. [43] D. Afchar, V. Nozick, J. Yamagishi, and I. Echizen, “Mesonet: a compact facial video forgery detection network,” in 2018 IEEE international workshop on information forensics and security (WIFS). IEEE, 2018, pp. 1–7. [44] D. Wodajo and S. Atnafu, “Deepfake video detection using convolutional vision transformer,” arXiv preprint arXiv:2102.11126, 2021. [45] D. Güera, S. Baireddy, P. Bestagini, S. Tubaro, and E. J. Delp, “We need no pixels: Video manipulation detection using stream descriptors,” arXiv preprint arXiv:1906.08743, 2019. [46] U. A. Ciftci, I. Demir, and L. Yin, “Fakecatcher: Detection of synthetic portrait videos using biological signals,” IEEE transactions on pattern analysis and machine intelligence, 2020. [47] T. Jung, S. Kim, and K. Kim, “Deepvision: Deepfakes detection using human eye blinking pattern,” IEEE Access, vol. 8, pp. 83 144–83 154, 2020. [48] Y. Li and S. Lyu, “Exposing deepfake videos by detecting face warping artifacts,” arXiv preprint arXiv:1811.00656, 2018. [49] D. Güera and E. J. Delp, “Deepfake video detection using recurrent neural networks,” in 2018 15th IEEE international conference on advanced video and signal based surveillance (AVSS). IEEE, 2018, pp. 1–6. [50] Y. Li, M.-C. Chang, and S. Lyu, “In ictu oculi: Exposing ai generated fake face videos by detecting eye blinking,” arXiv preprint arXiv:1806.02877, 2018. [51] D. M. Montserrat, H. Hao, S. K. Yarlagadda, S. Baireddy, R. Shao, J. Horváth, E. Bartusiak, J. Yang, D. Guera, F. Zhu et al., “Deepfakes detection with automatic face weighting,” in Proceedings of the IEEE/CVF

JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021

conference on computer vision and pattern recognition workshops, 2020, pp. 668–669. [52] O. De Lima, S. Franklin, S. Basu, B. Karwoski, and A. George, “Deepfake detection using spatiotemporal convolutional networks,” arXiv preprint arXiv:2006.14749, 2020. [53] S. Fernandes, S. Raj, E. Ortiz, I. Vintila, M. Salter, G. Urosevic, and S. Jha, “Predicting heart rate variations of deepfake videos using neural ode,” in Proceedings of the IEEE/CVF international conference on computer vision workshops, 2019, pp. 0–0. [54] J. Yang, S. Xiao, A. Li, W. Lu, X. Gao, and Y. Li, “Msta-net: Forgery detection by generating manipulation trace based on multi-scale selftexture attention,” IEEE transactions on circuits and systems for video technology, vol. 32, no. 7, pp. 4854–4866, 2021. [55] I. Perov, D. Gao, N. Chervoniy, K. Liu, S. Marangonda, C. Umé, M. Dpfks, C. S. Facenheim, L. RP, J. Jiang et al., “Deepfacelab: Integrated, flexible and extensible face-swapping framework,” arXiv preprint arXiv:2005.05535, 2020. [56] Y. A. Li, A. Zare, and N. Mesgarani, “Starganv2-vc: A diverse, unsupervised, non-parallel framework for natural-sounding voice conversion,” CoRR, vol. abs/2107.10394, 2021. [Online]. Available: https://arxiv.org/abs/2107.10394 [57] L. v. Ahn, M. Blum, N. J. Hopper, and J. Langford, “Captcha: Using hard ai problems for security,” in International conference on the theory and applications of cryptographic techniques. Springer, 2003, pp. 294– 311. [58] J. Vincent, “Binance executive claims scammers made a deepfake of him - the verge,” 2022. [59] N. Carlini and H. Farid, “Evading deepfake-image detectors with whiteand black-box attacks,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition workshops, 2020, pp. 658–659. [60] J.-c. Chou, C.-c. Yeh, and H.-y. Lee, “One-shot voice conversion by separating speaker and content representations with instance normalization,” 2019. [Online]. Available: https://arxiv.org/abs/1904. 05742 [61] Y. Gu, Z. Zhang, X. Yi, and X. Zhao, “Mediumvc: Any-to-any voice conversion using synthetic specific-speaker speeches as intermedium features,” 2021. [Online]. Available: https://arxiv.org/abs/2110.02500 [62] Y. Y. Lin, C.-M. Chien, J.-H. Lin, H.-y. Lee, and L.-s. Lee, “Fragmentvc: Any-to-any voice conversion by end-to-end extracting and fusing fine-grained voice fragments with attention,” 2020. [Online]. Available: https://arxiv.org/abs/2010.14150 [63] K.-w. Kim, S.-w. Park, J. Lee, and M.-c. Joe, “Assem-vc: Realistic voice conversion by assembling modern speech synthesis techniques,” 2021. [Online]. Available: https://arxiv.org/abs/2104.00931 [64] M. Terry, K. Bright, M. Durian, L. Kepler, R. Sweetman, and M. Grim, “Processing the telephone speech signal for the hearing impaired,” Ear and Hearing, vol. 13, no. 2, pp. 70–79, 1992. [65] FaceFusion, “Github - facefusion/facefusion: Industry leading face manipulation platform,” https://github.com/facefusion/facefusion, 2024, (Accessed on 16/04/2026). [66] R. Chen, X. Chen, B. Ni, and Y. Ge, “Simswap: An efficient framework for high fidelity face swapping,” in MM ’20: The 28th ACM International Conference on Multimedia, 2020. [67] s0mdv3, “Github - s0md3v/roop: one-click face swap,” https://github. com/s0md3v/roop, 2024, (Accessed on 16/04/2026). [68] J. Yamagishi, X. Wang, M. Todisco, M. Sahidullah, J. Patino, A. Nautsch, X. Liu, K. A. Lee, T. Kinnunen, N. Evans et al., “Asvspoof 2021: accelerating progress in spoofed and deepfake speech detection,” arXiv preprint arXiv:2109.00537, 2021. [69] W. Ge, J. Patino, M. Todisco, and N. Evans, “Raw differentiable architecture search for speech deepfake and spoofing detection,” arXiv preprint arXiv:2107.12212, 2021. [70] Z. Yan, Y. Zhang, X. Yuan, S. Lyu, and B. Wu, “Deepfakebench: A comprehensive benchmark of deepfake detection,” in Advances in Neural Information Processing Systems, A. Oh, T. Neumann, A. Globerson, K. Saenko, M. Hardt, and S. Levine, Eds., vol. 36. Curran Associates, Inc., 2023, pp. 4534–4565. [Online]. Available: https://proceedings.neurips.cc/paper files/paper/ 2023/file/0e735e4b4f07de483cbe250130992726-Paper-Datasets and Benchmarks.pdf [71] J. Cao, C. Ma, T. Yao, S. Chen, S. Ding, and X. Yang, “End-toend reconstruction-classification learning for face forgery detection,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2022, pp. 4113–4122. [72] H. Dang, F. Liu, J. Stehouwer, X. Liu, and A. K. Jain, “On the detection of digital face manipulation,” in Proceedings of the IEEE/CVF

18

Conference on Computer Vision and Pattern recognition, 2020, pp. 5781–5790. [73] Y. Luo, Y. Zhang, J. Yan, and W. Liu, “Generalizing face forgery detection with high-frequency features,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2021, pp. 16 317–16 326. [74] H. Liu, X. Li, W. Zhou, Y. Chen, Y. He, H. Xue, W. Zhang, and N. Yu, “Spatial-phase shallow learning: rethinking face forgery detection in frequency domain,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2021, pp. 772–781. [75] A. Rossler, D. Cozzolino, L. Verdoliva, C. Riess, J. Thies, and M. Nießner, “Faceforensics++: Learning to detect manipulated facial images,” in Proceedings of the IEEE/CVF international conference on computer vision, 2019, pp. 1–11. [76] H. H. Nguyen, J. Yamagishi, and I. Echizen, “Capsule-forensics: Using capsule networks to detect forged images and videos,” in ICASSP 20192019 IEEE international conference on acoustics, speech and signal processing (ICASSP). IEEE, 2019, pp. 2307–2311. [77] Z. Yan, Y. Zhang, Y. Fan, and B. Wu, “Ucf: Uncovering common features for generalizable deepfake detection,” in Proceedings of the IEEE/CVF International Conference on Computer Vision, 2023, pp. 22 412–22 423. [78] Y. Qian, G. Yin, L. Sheng, Z. Chen, and J. Shao, “Thinking in frequency: Face forgery detection by mining frequency-aware clues,” in European conference on computer vision. Springer, 2020, pp. 86–103. [79] Y. Ni, D. Meng, C. Yu, C. Quan, D. Ren, and Y. Zhao, “Core: Consistent representation learning for face forgery detection,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2022, pp. 12–21. [80] D. Tran, H. Wang, L. Torresani, J. Ray, Y. LeCun, and M. Paluri, “A closer look at spatiotemporal convolutions for action recognition,” in Proceedings of the IEEE conference on Computer Vision and Pattern Recognition, 2018, pp. 6450–6459. [81] M. Ravanelli, T. Parcollet, P. Plantinga, A. Rouhe, S. Cornell, L. Lugosch, C. Subakan, N. Dawalatabad, A. Heba, J. Zhong et al., “Speechbrain: A general-purpose speech toolkit,” arXiv preprint arXiv:2106.04624, 2021. [82] K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in Proceedings of the IEEE conference on computer vision and pattern recognition, 2016, pp. 770–778.

ACKNOWLEDGMENTS This work was supported by the Zuckerman STEM Leadership Program. Some figures were made with icograms.com. ChatGPT 5.2 has been used to improve the English quality of this paper and all edits have been reviewed by the authors. IX. B IOGRAPHY S ECTION Guy Frankovits is a researcher and master’s degree student in the Department of Software and Information Systems Engineering at Ben-Gurion University of the Negev. His research interests include machine learning, deep learning, and deepfake detection in both audio and video. Lior Yasur is a researcher and master’s degree student in the Department of Software and Information Systems Engineering at Ben-Gurion University of the Negev. His research interests include machine learning and adversarial learning. Fred Grabovski is a researcher and master’s degree student in the Department of Software and Information Systems Engineering at Ben-Gurion University of the Negev. His research interests include machine learning and adversarial learning. Yisroel Mirsky is a tenured Assistant Professor and Zuckerman Faculty Scholar at Ben-Gurion University, where he leads the Offensive AI Research Lab. He received his Ph.D. from BGU in 2018 and completed postdoctoral training at the Georgia Institute of Technology under Prof. Wenke Lee. His research spans AI safety, AI agent security, deepfakes, and adversarial machine learning. Dr. Mirsky is an ERC-STG 2025 recipient and serves on the board of COSAI (Coalition for Secure AI), an industry consortium whose members include Google, Microsoft, Amazon, and Intel. He has published at leading security venues including USENIX, CCS, NDSS, Black Hat, and DEF CON. His work has been covered by Wired, The Wall Street Journal, Forbes, and Scientific American, and has earned over $10,000 in bug bounties. Notable projects include exposing vulnerabilities in the US 911 emergency services and revealing the threat of deepfakes in medical imaging, both covered by The Washington Post.