Intro
L1
·
Quiz
·
Lab
L2
·
Quiz
·
Lab
L3
·
Quiz
·
Lab
L4
·
Quiz
·
Lab
Module Test
Deepfakes and Synthetic Media · Introduction

When Seeing Can No Longer Be Believing

Because the most consequential media literacy crisis of our era is already here — and most people haven't noticed.

In 1878, when Eadweard Muybridge published his motion-sequence photographs of a galloping horse, many observers were convinced the images were fabricated — the frozen instants looked nothing like any painting they had ever seen. Within two decades, photography had become legally admissible evidence in American courtrooms, and within three it had become, culturally, synonymous with truth. That faith was premature. By 1917, two English schoolgirls named Frances Griffiths and Elsie Wright were photographing cardboard fairies in a Yorkshire garden and fooling Arthur Conan Doyle. By the 1930s, Soviet state photographers were airbrushing purged officials out of official pictures with routine professionalism. The photograph was never a neutral record; it was always a made thing.

Synthetic video is now arriving under almost identical conditions. Between 2017 and 2024, the cost of producing a convincing face-swap fell from tens of thousands of dollars in Hollywood post-production budgets to effectively zero, with consumer laptops and open-source code. In March 2022, a low-resolution deepfake of Ukrainian President Volodymyr Zelensky appeared on hacked television channels, calling on soldiers to surrender. In February 2024, a finance employee at a multinational firm in Hong Kong was tricked into transferring $25 million after attending a video call in which every other participant — including a person posing as the company's CFO — was AI-generated. These are not hypothetical scenarios; they are documented incidents with paper trails.

This course will not teach you that deepfakes are uniformly dangerous, nor that detection tools will save us. It will teach you how the technology actually works, what its documented uses and misuses look like, how detection succeeds and fails, and what legal and policy frameworks exist as of mid-2024. The goal is clear-eyed competence: understanding enough to reason carefully in ambiguous situations, neither paralysed by suspicion nor naively credulous. Four lessons, each grounded in real events and real techniques. Start when you're ready.

Deepfakes and Synthetic Media · Lesson 1

How Deepfakes Are Made: The Machinery Behind Synthetic Faces

Understanding the technology is the prerequisite for everything else in this course.
What exactly happens inside the machine that puts one person's face onto another person's body — and why did it take until 2014 for anyone to build it?

In November 2017, a Reddit account named deepfakes began posting short videos in which the faces of female celebrities had been transplanted onto the bodies of pornographic performers. The account used consumer graphics cards and freely available machine-learning libraries. Within weeks, hundreds of imitators had appeared. Reddit banned the subreddit in February 2018 — but by then the word "deepfake" had entered the language, and the code had spread across the internet irreversibly. The significant detail is not the content, which was straightforwardly abusive, but the mechanism: a single anonymous person with no formal AI training had built something that would have cost a film studio six figures just five years earlier. The underlying technique was a Generative Adversarial Network combined with an autoencoder, two ideas that had been published in academic papers in 2014 and were sitting in open-source repositories, waiting.

The question of how those papers became a harassment tool in three years tells you almost everything you need to know about the pace at which synthetic media technology travels from research lab to consumer desktop — and why understanding the machinery is not optional for anyone who intends to reason clearly about what they see.

1.1 — The Autoencoder: Learning to Compress and Reconstruct Faces

The foundational component of early deepfake systems is an autoencoder, a type of neural network trained to compress information into a compact representation and then reconstruct it. Think of it as a two-stage process: an encoder learns to strip a face down to its essential structure — the geometry of the eyes, the curve of the jaw, the proportions of the nose — discarding everything that isn't structurally necessary. A decoder then takes that stripped-down representation and rebuilds a face from it.

The deepfake trick is to train two decoders: one that reconstructs person A's face from the compressed representation, and one that reconstructs person B's face from the same representation. Once training is complete, you feed person A's face through the encoder and then through person B's decoder. The result is person A's expressions and head movements wearing person B's face. This is why early deepfakes looked most convincing in motion — movement is what the encoder is capturing — but often showed visible artifacts at the edges of the face, where the decoder struggled to blend the transplanted face with the original background and neck.

The training data requirement was initially the main bottleneck. Good early deepfakes required hundreds or thousands of images of the target face taken from multiple angles and under varied lighting — which is why celebrities with extensive public photo archives were the first targets. Politicians with large media footprints followed. The 2017 Reddit account estimated needing approximately 500 source images per subject to achieve passable results.

1.2 — GANs: Making the Fake Convincing Enough to Fool a Critic

Autoencoders produce plausible faces, but not necessarily convincing ones. The step change came with Generative Adversarial Networks, published by Ian Goodfellow and colleagues at the University of Montreal in June 2014. A GAN pits two neural networks against each other: a generator that produces synthetic images, and a discriminator that tries to identify which images are real and which are generated. Each network is trained on the other's failures. The generator gets better at fooling the discriminator; the discriminator gets better at detecting fakes; eventually the generator produces images that the discriminator — and, crucially, human observers — cannot reliably distinguish from real photographs.

Applied to face-swapping, GAN discriminators learn to flag artifacts like mismatched skin tones, unnatural blinking rates, and inconsistent lighting directions. The generator, trained against these signals, learns to eliminate them. By 2019, NVIDIA's StyleGAN2 could produce photorealistic human faces of people who do not exist, indistinguishable from photographs to most untrained observers. The website thispersondoesnotexist.com, launched in February 2019, made this capacity viscerally legible to a general audience: every refresh generated a new face from nothing, and the faces looked completely real.

The practical consequence is that the GAN arms race is structurally continuous. Each time detection improves, the generator can be retrained against better detection. This is not a problem that will be solved once and then remain solved.

1.3 — Diffusion Models: The Third Generation

By 2022, a different architecture had largely displaced GANs as the state of the art: diffusion models. Where GANs generate images in a single forward pass through the network, diffusion models work by learning to gradually remove noise from a random signal, iterating hundreds of times until a coherent image emerges. The analogy is developing a photograph in a darkroom: what starts as grain slowly resolves into recognisable structure.

Stable Diffusion, released publicly by Stability AI in August 2022, brought diffusion-based image synthesis to consumer hardware for the first time. Its successor systems — Midjourney, DALL-E 3, Adobe Firefly, and others — extended the technique to video. Runway ML's Gen-2, released in 2023, could generate short video clips from text descriptions alone. Sora, OpenAI's video model announced in February 2024, demonstrated 60-second photorealistic videos with consistent lighting, physics, and character continuity that would have been technically impossible eighteen months earlier.

The practical distinction from a detection standpoint is significant: diffusion-based synthetic media often lacks the specific frequency-domain artifacts that GAN detection tools were trained to find. Detection methods built for 2019-era deepfakes may fail entirely on 2024-era diffusion outputs. This is documented in academic literature — a 2023 paper by Gragnaniello et al. in IEEE Transactions on Information Forensics found that GAN detectors generalised poorly to diffusion-generated imagery.

1.4 — Audio Deepfakes: The Overlooked Channel

Visual deepfakes receive most of the public attention, but audio synthesis has developed in near-parallel and in some respects outpaced it. Voice cloning systems train on recordings of a target speaker and learn to reproduce their vocal characteristics: timbre, cadence, accent, and emotional register. ElevenLabs, launched in 2022, could clone a voice from as little as one minute of audio with results that most listeners cannot distinguish from the original speaker.

The first widely publicised misuse of voice cloning at scale occurred during the 2024 New Hampshire Democratic primary. In January 2024, registered Democratic voters in New Hampshire received robocalls in which a voice closely mimicking President Joe Biden's told them not to vote in the primary, saving their vote for November. The Federal Communications Commission banned AI-generated voices in robocalls the following month. The perpetrator was traced to a political consultant named Steve Kramer, working for a rival campaign, who had paid $500 to a vendor for the audio generation.

Audio deepfakes are operationally significant for two reasons: they are cheaper and faster to produce than video deepfakes, and they are effective in contexts where video would be suspicious — phone calls, voicemail, radio. The $25 million Hong Kong fraud described in the introduction combined both channels: the video call featured deepfake video of colleagues and deepfake audio of the CFO.

Key Distinction

Three generations of synthetic media technology are now simultaneously in use: autoencoder face-swaps (2017–2019), GAN-based synthesis (2019–2022), and diffusion-model generation (2022–present). Detection tools built for one generation often fail on the others. This generational overlap is one reason why "deepfake detection" is harder than it sounds.

Key Terms

AutoencoderA neural network trained to compress inputs to a latent representation and reconstruct them; the basis of early face-swap deepfakes.
GAN (Generative Adversarial Network)An architecture pairing a generator and discriminator in adversarial training, producing increasingly realistic synthetic outputs.
Diffusion ModelA generative architecture that learns to iteratively denoise random signals into coherent images or video; the current state of the art as of 2024.
Voice CloningAI synthesis of a target speaker's vocal characteristics from a reference recording, enabling production of new speech in that voice.
Latent SpaceThe compressed internal representation within an autoencoder or generative model where facial geometry is encoded before decoding.

Lesson 1 Quiz

How Deepfakes Are Made — check your understanding before moving to the lab.
1. What role does the encoder play in an autoencoder-based deepfake system?
Correct. The encoder strips a face to its geometric essentials — eye spacing, jaw curve, nose proportions — discarding lighting and texture detail. This latent representation is then fed to a different decoder trained on the target face.
Not quite. The encoder's job is compression: it maps a face to a compact internal representation. The decoder handles reconstruction, and output rendering is handled separately.
2. Ian Goodfellow's 2014 paper introduced GANs. What is the structural innovation that makes them effective at generating realistic images?
Correct. The adversarial setup is the key innovation: the generator improves by fooling the discriminator; the discriminator improves by catching the generator. This feedback loop drives both networks toward producing and detecting ever more realistic images.
That description better fits diffusion models, which are a later architecture. GANs use an adversarial two-network structure — a generator competing against a discriminator.
3. Why did the 2017 Reddit deepfake account primarily target celebrities rather than private individuals?
Correct. The data bottleneck was the limiting factor. Early systems needed roughly 500 images per target from multiple angles and lighting conditions — something celebrities' extensive public photograph archives provided, while most private individuals' social media did not.
The deciding factor was data availability. Early deepfakes needed hundreds of varied source images to train on. Celebrities had large public photo archives; private individuals typically did not.
4. The January 2024 New Hampshire robocall case is significant for which reason?
Correct. The case illustrated that the barrier to audio deepfake political manipulation had fallen to near-zero — $500 to a commercial vendor, executed by a domestic operative, not a sophisticated foreign intelligence service. The FCC banned AI-generated voices in robocalls the following month.
Review the lesson. The New Hampshire case involved domestic political operatives, audio (not video), and a price point of approximately $500 — illustrating how cheap and accessible voice cloning had become.
5. What does research by Gragnaniello et al. (2023) indicate about GAN-era detection tools applied to diffusion-model outputs?
Correct. The paper published in IEEE Transactions on Information Forensics documented that detectors trained on GAN outputs failed to reliably identify diffusion-model outputs. The artifact signatures are different enough that cross-generation generalisation breaks down — a major reason why detection is harder than it appears.
The research found the opposite: GAN detectors perform poorly on diffusion outputs. The different generative architectures leave different artifact signatures, so detection tools do not transfer cleanly across generations.

Lab 1 — Architecture Analyst

Apply your understanding of deepfake architectures to real scenarios.

Your Task

You are briefed on a synthetic media incident. Your job is to work with the AI analyst to identify which generation of deepfake technology was most likely used, explain your reasoning, and discuss what detection approaches would and would not apply.

Complete at least three exchanges to finish the lab. Ask follow-up questions — the AI will push back if your reasoning has gaps.

Start here: "A deepfake video from 2019 shows a politician delivering a fabricated speech. Reviewers note that the face edges look slightly blurred and the blinking rate is unnaturally low. Which architecture was most likely used, and why do those specific artifacts appear?"
AI Analyst — Deepfake Architecture
Lab 1
Welcome to Lab 1. I'm your deepfake architecture analyst. Describe a synthetic media scenario and I'll help you reason through which technology was likely used, why the artifacts appear, and what detection methods apply. Use the prompt above or start with your own scenario.
Deepfakes and Synthetic Media · Lesson 2

Documented Misuse: What Deepfakes Have Actually Done

Moving from technical mechanics to the real-world harm record — who has been targeted, how, and with what consequences.
The technology is real. The harm is real. But what does the actual documented record of deepfake misuse look like, category by category?

In October 2023, Spanish schoolgirls in the town of Almendralejo discovered that classmates had used an AI application called Clothoff to generate non-consensual nude images from ordinary clothed photographs taken from their social media accounts. Twenty-eight victims were identified, aged eleven to seventeen. The application ran on a smartphone. The perpetrators were their classmates. The images had been shared via WhatsApp groups. This was not an isolated incident: within months, similar cases had been documented in New Jersey, Washington state, South Korea, Australia, and the United Kingdom. The technology that enabled it had been available for less than two years.

Understanding deepfake misuse requires moving beyond spectacular scenarios — election interference, corporate fraud — to the more common, less visible harms. The harm profile is neither random nor uniform. It concentrates predictably among women, among public figures who cannot control their media footprint, and among individuals in relationships with people who have both motive and access.

2.1 — Non-Consensual Intimate Imagery: The Dominant Use Case

The largest documented category of deepfake misuse is non-consensual synthetic intimate imagery (NCII) — synthetic pornographic content generated without the subject's consent. A 2023 report by the cybersecurity firm Home Security Heroes found that NCII constituted approximately 98% of deepfake videos indexed online, with women comprising 99% of identified targets. The report catalogued over 244,000 NCII videos on the ten most prominent dedicated websites, representing growth of 464% since 2019.

The harm profile is well-documented through court cases and academic research: victims experience severe psychological distress, professional disruption, and ongoing harassment. A 2022 study by the Cyber Civil Rights Initiative found that 93% of NCII victims reported significant emotional distress, 51% had considered suicide, and many reported that the imagery continued to circulate years after initial publication despite takedown efforts. The near-permanence of content once distributed is a documented feature of the harm, not a contingent one.

Legislative response has been uneven. The UK's Online Safety Act 2023 criminalised sharing NCII and extended this to synthetic content. In the US, as of mid-2024, there was no federal law specifically addressing deepfake NCII, though approximately 20 states had passed relevant legislation. The EU's AI Act, finalised in 2024, requires labelling of AI-generated content but does not directly criminalise NCII production.

2.2 — Financial Fraud: The $25 Million Hong Kong Case

On 29 January 2024, Hong Kong police reported that a finance employee at an unidentified multinational company had transferred HK$200 million (approximately US$25.6 million) following a video conference call in which every other participant was AI-generated. The employee had initially been sceptical when first contacted by someone claiming to be the company's CFO via WhatsApp message — the message asked for confidential transactions and looked suspicious. But the subsequent video conference, which featured convincing digital replicas of known colleagues including the CFO, persuaded the employee that the request was legitimate.

The case is operationally significant in several ways. First, the attack used multimodal deception — combining deepfake video with deepfake audio simultaneously. Second, it exploited an existing relationship: the employee recognised the fabricated people because they were based on real colleagues. Third, the social pressure of a group context — multiple "colleagues" present simultaneously — made individual scepticism harder to exercise. The Hong Kong police noted this as the first confirmed case of its type in the territory, but cautioned that the technique was likely replicable with commercially available tools.

Voice-only fraud had been documented earlier and at lower cost. In 2019, the CEO of a UK energy company transferred €220,000 to a fraudster after a phone call in which the fraudster used voice synthesis to impersonate the German parent company's chief executive — an incident reported by the Wall Street Journal and confirmed by the victim's insurer, Euler Hermes.

2.3 — Political and Geopolitical Deepfakes

The Zelensky deepfake of March 2022 — in which a low-quality face-swap was broadcast on hacked Ukrainian television channels, depicting the president telling soldiers to surrender — was quickly identified as fake, partly because of visual artifacts and partly because Zelensky appeared in real video the same day. Its failure was instructive: a poorly executed deepfake deployed in a context where the subject is actively producing counter-evidence is much less effective than one deployed where the subject is unavailable to rebut it.

More subtle uses are documented. During the 2023 Slovak parliamentary elections, audio recordings circulated on Facebook two days before the vote, apparently capturing liberal candidate Michal Šimečka discussing plans to rig the election and raise beer prices. Slovak fact-checkers and AFP identified audio artifacts consistent with voice cloning. Meta's content moderators did not remove the audio before the election. Šimečka's party lost. Whether the audio had a decisive effect is unverifiable, but the timing — two days before the vote, within the legally mandated media silence period — was clearly strategic.

India's 2024 general election produced a documented proliferation of AI-generated political content. Researchers at the MIT Media Lab identified over 50 distinct deepfake videos of political figures circulating on Indian social media platforms in the months before the election, representing candidates across the political spectrum. Several were created and distributed by the candidates' own campaigns — a reminder that synthetic media is a campaign tool as well as a disinformation tool.

2.4 — The Problem of Unverifiable Deniability

An underappreciated consequence of widespread deepfake awareness is the liar's dividend — the ability of individuals to dismiss authentic evidence by claiming it is synthetic. Legal scholars Bobby Chesney and Danielle Citron coined the term in a 2019 paper in the Notre Dame Law Review. The mechanism: as synthetic media becomes more common and more convincing, the plausible deniability of claiming "that video is a deepfake" increases, even when the video is real.

Documented examples exist at multiple levels. In 2023, Gabonese authorities broadcast video of President Ali Bongo Ondimba, who had been largely absent from public view following a stroke, delivering a New Year's address. Opposition figures and some international commentators immediately alleged the video was AI-generated — claims that circulated widely and contributed to military coup plotters' stated justification for the coup that followed weeks later. Whether the video was genuine (as authorities maintained) or manipulated has not been definitively resolved by forensic analysis.

The liar's dividend creates an asymmetric incentive structure: it raises the costs of using authentic video evidence while lowering the costs of false denial. This dynamic is arguably as consequential as the deepfakes themselves.

Pattern to Retain

Deepfake harm is not uniformly distributed. The documented harm profile concentrates in three areas: non-consensual intimate imagery (by volume, the dominant category); financial fraud exploiting trusted relationships; and political manipulation, including both fabrication of statements and deniability of genuine ones. Understanding which category a given incident falls into determines which response frameworks apply.

Key Terms

NCIINon-consensual intimate imagery — synthetic or manipulated sexual content distributed without the subject's consent.
Liar's DividendThe ability to dismiss authentic evidence by claiming synthetic origin; increases as deepfake prevalence grows. Coined by Chesney and Citron (2019).
Multimodal DeceptionFraud or disinformation that combines synthetic video and synthetic audio simultaneously, as in the 2024 Hong Kong case.

Lesson 2 Quiz

Documented Misuse — verify your recall of real incidents and harm categories.
1. According to the 2023 Home Security Heroes report, what percentage of indexed deepfake videos online were non-consensual intimate imagery?
Correct. The report found approximately 98% of indexed deepfake videos were NCII, with women comprising 99% of identified targets. This proportion — which surprises many people who expect political deepfakes to dominate — reflects the actual documented distribution of the harm.
The figure is much higher. The report found approximately 98% of indexed deepfake videos online were non-consensual intimate imagery — the dominant use case by a wide margin, not political or financial deepfakes.
2. What made the January 2024 Hong Kong fraud case operationally novel compared to earlier voice-cloning fraud?
Correct. Multimodal deception — combining video and audio deepfakes simultaneously in a group call context featuring recognisable fabricated colleagues — distinguished this from earlier voice-only fraud. The group social dynamic also made individual scepticism harder to exercise.
The case's novelty was multimodal: video and audio deepfakes combined in a live group video call context, with fabricated replicas of known colleagues. Earlier documented fraud had used voice cloning alone, without video.
3. The concept of the "liar's dividend," as described by legal scholars Chesney and Citron, refers to which phenomenon?
Correct. The liar's dividend is the asymmetric benefit accruing to those who can plausibly deny authentic evidence. As deepfake awareness grows, "that video is a deepfake" becomes a more credible defence regardless of whether it is true. Chesney and Citron published the concept in the Notre Dame Law Review in 2019.
The liar's dividend is about deniability of authentic content, not profit. As deepfake prevalence grows, falsely claiming that authentic video is synthetic becomes more plausible — raising costs of using genuine evidence and lowering costs of false denial.
4. The 2023 Slovak election audio deepfake case illustrates which operational feature of effective political deepfakes?
Correct. The audio circulated two days before the vote, within Slovakia's legally mandated pre-election media silence period. This timing limited the ability of fact-checkers, platforms, and the targeted candidate to respond before polling. The strategic use of silence periods is an emerging operational pattern.
The key operational feature was timing: deployment two days before the election, within the legally mandated media silence period, limiting rebuttal before polling. The Zelensky case, by contrast, was rebutted quickly because Zelensky was actively producing counter-evidence.
5. The Almendralejo case in Spain (2023) is significant for which reason in the context of deepfake harm?
Correct. Almendralejo demonstrated the full democratisation of NCII deepfake harm: a smartphone app called Clothoff, used by minors against peers aged 11–17, generating content that circulated via WhatsApp groups. No special equipment, no technical knowledge, no adult perpetrators. The case prompted legislative responses in Spain and accelerated similar investigations in multiple countries.
The Almendralejo case illustrated accessibility: smartphone app, minor perpetrators, minor victims aged 11–17, distribution via WhatsApp. It showed that NCII deepfake generation had become trivially accessible to anyone with a phone — not just technologically sophisticated actors.

Lab 2 — Harm Classifier

Categorise real deepfake incidents and identify which response frameworks apply.

Your Task

You receive incident reports about deepfake cases. Work with the AI analyst to categorise each incident by harm type (NCII, financial fraud, political manipulation, liar's dividend, or other), identify what made the attack effective, and determine which legal or platform response frameworks are most relevant.

Complete at least three exchanges. The AI will challenge your categorisations if they're imprecise.

Start here: "A company's CFO receives a voice message — apparently from the CEO — authorising an urgent wire transfer of €180,000 to a new vendor. The CFO finds the voice convincing but the request unusual. What harm category is this, what made it effective, and what response protocols apply?"
AI Analyst — Harm Categorisation
Lab 2
Welcome to Lab 2. I'm your harm categorisation analyst. Present a deepfake incident and I'll help you classify it accurately, identify the mechanisms of effectiveness, and map the applicable response frameworks. Use the suggested prompt or describe a different scenario.
Deepfakes and Synthetic Media · Lesson 3

Detection: What Works, What Doesn't, and Why the Gap Keeps Moving

The forensics of synthetic media — and an honest account of the limits of what detection can currently achieve.
If you encountered a video you suspected was a deepfake, what would you actually look for — and which of those signals remain reliable in 2024?

In March 2023, researchers at the University of Buffalo published a system that claimed 93% accuracy at detecting GAN-generated faces by analysing the light reflections in the pupils of photographed subjects — real photographs, they found, show consistent light source reflections across both eyes; GAN outputs frequently do not. The paper received widespread coverage. Within months, at least one academic team had published a countermeasure: a GAN training modification that explicitly optimised for consistent pupil reflections. Accuracy of the Buffalo system on the improved GAN outputs dropped to near chance. This is not unusual. It is, instead, the characteristic dynamic of deepfake detection research.

Detection and generation are not symmetric problems. The generator needs only to fool the detector once; the detector needs to succeed every time. This asymmetry is structural, not incidental, and it shapes what detection can realistically achieve.

3.1 — Visual Artifacts: What Earlier Deepfakes Left Behind

Early autoencoder and GAN deepfakes left consistent visual artifacts that formed the basis of first-generation detection tools. These included: face boundary artifacts — visible blurring or colour mismatches at the edge of the transplanted face; abnormal blinking rates — early systems often produced subjects who blinked too infrequently or in irregular patterns; inconsistent lighting — the illumination direction on the synthetic face often failed to match the background environment; and gaze inconsistency — eyes that failed to track naturally with head movement.

Detection tools built between 2018 and 2021 trained classifiers on these artifact signatures and achieved high accuracy on contemporary deepfakes. MIT's MediaLab and DARPA's Media Forensics programme (MediFor), which ran from 2016 to 2021 with approximately $68 million in funding, produced detection systems achieving over 90% accuracy on benchmark datasets of that era. Facebook's Deepfake Detection Challenge, run in collaboration with Microsoft and academia in 2019–2020, drew 35,000 submissions and produced detectors with 65% accuracy on held-out test sets — notably lower than benchmark accuracy, reflecting the challenge of generalising to unseen deepfakes.

The practical problem is that artifact-based detection is retrospective: it detects artifacts that existing systems produce, not artifacts that future systems will produce. As generators improved specifically to eliminate the artifacts that detectors flagged, detection accuracy on new material degraded.

3.2 — Biological Signal Detection: Heartbeats and Micro-Expressions

A more robust class of detection approaches targets biological signals that deepfake generators do not explicitly model. Remote photoplethysmography (rPPG) detects the subtle colour changes in facial skin caused by blood flow — the skin lightens fractionally with each heartbeat in ways that are measurable from video. Synthetic faces, which are generated frame by frame without a biological cardiovascular system, do not produce consistent rPPG signals. Researchers at MIT's Computer Science and Artificial Intelligence Laboratory demonstrated in 2022 that rPPG signals could distinguish deepfakes from genuine video with over 85% accuracy on contemporary deepfakes.

Similarly, facial micro-expressions — the involuntary sub-second expressions that precede or follow deliberate expressions — are difficult for current generative systems to reproduce faithfully, because they require modelling the fine-grained interplay of dozens of facial muscles in real time. Detection systems that specifically analyse micro-expression consistency have shown promise in research settings.

The limitation is the same: once these signals are identified as detection vectors, they become targets for generator improvement. A 2023 paper from Carnegie Mellon University demonstrated a GAN training modification that produced more consistent rPPG-like signals by explicitly training against an rPPG detector. The accuracy of biological signal detection on these modified outputs dropped substantially.

3.3 — Provenance and Watermarking: Authenticating Rather Than Detecting

A distinct approach to the synthetic media problem focuses not on detecting fakes but on authenticating genuine content — building infrastructure that allows verified origin to travel with media. The Content Authenticity Initiative (CAI), launched in 2019 by Adobe, the New York Times, and Twitter, produced the C2PA standard (Coalition for Content Provenance and Authenticity), which embeds cryptographically signed metadata into media files at point of capture. A C2PA-compliant camera embeds a manufacturer signature and capture timestamp that propagates through editing software and can be verified by platforms or end users.

As of 2024, C2PA has been adopted by Canon, Nikon, Sony, Leica, Qualcomm (for mobile cameras), and Microsoft (for Bing Image Creator). The BBC and CBC joined as participating news organisations. The limitation is completeness: C2PA can verify that a piece of content has authentic provenance — but absence of C2PA metadata does not prove synthetic origin. A genuine video recorded on an older camera without C2PA will be indistinguishable from a deepfake that also lacks C2PA metadata.

AI watermarking — embedding imperceptible signals in generated content to identify it as synthetic — is a parallel approach. Google DeepMind's SynthID, announced in August 2023, embeds watermarks in images and video generated by Google's systems that survive moderate editing, compression, and screenshots. Meta announced a similar system in 2024 applying to outputs from its image generation tools. The limitation here is scope: watermarking only covers outputs from systems that implement it. Open-source models like Stable Diffusion can be run without any watermarking infrastructure.

3.4 — Human Detection: Worse Than You'd Expect

Studies of human ability to detect deepfakes without AI assistance consistently find performance near chance. A 2022 study published in iScience by researchers at the University of Sydney presented 280 participants with real and AI-generated faces (StyleGAN2 outputs) and found average detection accuracy of 48.2% — slightly below random chance. Counterintuitively, faces rated as more trustworthy were more likely to be synthetic: StyleGAN2 outputs had on average slightly more symmetrical, conventionally attractive features, leading participants to rate them as more trustworthy and therefore more likely to be real.

Short detection training improved performance modestly — briefing participants on which specific features to examine raised accuracy to approximately 59% in the same study, still well below reliable detection. The practical implication is clear: unaided human judgment is not a reliable deepfake detection mechanism for current-generation synthetic media, regardless of how confident the observer feels.

What This Means in Practice

No detection system currently achieves reliable generalisation across all deepfake types, and human detection alone is near chance on current-generation synthetic faces. The most robust current approach combines: contextual scepticism (is this claim plausible?), provenance verification (does this have C2PA or equivalent metadata?), and consultation of multiple independent sources — rather than relying on any single technical detection tool.

Key Terms

rPPG (Remote Photoplethysmography)Measurement of pulse-driven colour changes in facial skin from video; a biological signal that synthetic faces often fail to replicate consistently.
C2PACoalition for Content Provenance and Authenticity standard; cryptographic metadata embedded at capture to authenticate media provenance.
SynthIDGoogle DeepMind's imperceptible watermarking system for AI-generated images and video, announced August 2023.
Artifact-Based DetectionDetection methods that identify synthetic content by visual or frequency-domain artifacts left by specific generative architectures; retrospective and architecture-dependent.

Lesson 3 Quiz

Detection — confirm your understanding of what works, what doesn't, and why.
1. Why is artifact-based deepfake detection described as "retrospective" rather than robust?
Correct. Artifact-based detection is a moving target: detectors identify artifacts that current generators produce, but that identification itself becomes a training signal for improved generators to eliminate those artifacts. The University of Buffalo pupil-reflection detector reaching near-chance accuracy on modified GAN outputs within months is a concrete illustration of this cycle.
The retrospective problem is about the arms race dynamic, not speed or archiving. Detectors identify artifacts in current generators; those artifacts are then trained away in improved generators; the detector's accuracy on new outputs drops. The cycle repeats.
2. What made remote photoplethysmography (rPPG) an initially promising detection method — and what is its documented limitation?
Correct. rPPG exploits the fact that generators don't model blood flow. But once this is identified as a detection vector, it becomes a training target: a 2023 Carnegie Mellon paper demonstrated that explicitly training a GAN against an rPPG detector reduced the method's accuracy substantially — the same retrospective vulnerability as artifact detection, applied to biological signals.
The limitation is the same arms-race dynamic that affects artifact detection: once rPPG is identified as a detection vector, generators can be trained to produce rPPG-like signals. A Carnegie Mellon paper demonstrated this specifically for rPPG in 2023.
3. What is the key limitation of C2PA content authentication as a deepfake response?
Correct. C2PA solves the positive case — verified authentic content carries a cryptographic provenance trail. But it doesn't solve the negative case: genuine video from an older camera or smartphone without C2PA will lack metadata, just like a deepfake. Missing metadata cannot be interpreted as proof of synthetic origin.
The limitation is asymmetric coverage: C2PA verifies authentic content with provenance metadata, but cannot prove content is synthetic from absence of metadata alone. Authentic video from non-C2PA devices looks identical to deepfakes by this criterion.
4. The 2022 iScience study on human deepfake detection found which counterintuitive result?
Correct. StyleGAN2 outputs tended to be slightly more symmetrical and conventionally attractive than real faces — features humans associate with trustworthiness — leading participants to rate synthetic faces as more trustworthy and therefore more likely to be real. The practical implication: our intuitions about trustworthiness actively mislead us when evaluating synthetic faces.
The counterintuitive finding was that synthetic faces were rated as more trustworthy than real ones. StyleGAN2 outputs tended toward slight symmetry and conventional attractiveness, which humans associate with credibility — causing participants to actively misidentify synthetic faces as genuine at above-chance rates.
5. Google DeepMind's SynthID watermarking system has which documented limitation?
Correct. SynthID is a scope-limited solution: it works for content generated by Google's systems, and the watermarks are designed to survive editing and compression. But it provides no coverage for open-source generative models — Stable Diffusion and its derivatives can be run locally without any watermarking infrastructure whatsoever.
SynthID's limitation is scope, not durability. The watermarks are designed to survive moderate editing and compression. But they only exist in outputs from systems that implement SynthID — open-source models running locally produce synthetic content with no watermark at all.

Lab 3 — Detection Strategist

Design a detection approach for a specific deepfake scenario — and identify its failure modes.

Your Task

You work for a newsroom's verification team. Suspicious video has arrived. Work with the AI analyst to select detection approaches, evaluate their reliability for this specific content, and honestly map where your strategy might fail.

Complete at least three exchanges. The AI will challenge you to be specific about failure modes — vague answers won't pass.

Start here: "We've received a 90-second video of a foreign minister apparently announcing an immediate ceasefire. The video is compressed and arrived via Telegram with no provenance metadata. What detection strategy do you recommend, and which parts of that strategy are most likely to fail?"
AI Analyst — Detection Strategy
Lab 3
Welcome to Lab 3. I'm your detection strategy analyst. Describe a piece of suspected synthetic media and I'll help you build a verification approach, evaluate each method's reliability for that specific content type, and honestly assess where the strategy breaks down. Use the prompt above or describe your own scenario.
Deepfakes and Synthetic Media · Lesson 4

Legal Frameworks, Platform Responses, and the Limits of Regulation

The governance landscape as of mid-2024 — what law and policy currently cover, and where they don't reach.
Given what you now know about how deepfakes are made and what harm they cause, what does the current legal and regulatory response actually look like — and where are the gaps?

In July 2023, the US Senate Judiciary Committee convened a hearing on deepfakes titled "Deepfakes and Artificial Intelligence: The Threat to Democracy and National Security." Expert witnesses included a former FBI official, a civil liberties attorney, and the CEO of a deepfake detection company. The hearing produced no legislation. Six months later, in January 2024, the Biden administration announced a voluntary commitment from leading AI companies to label AI-generated content — a commitment with no enforcement mechanism. The same month, the $25 million Hong Kong deepfake fraud occurred. The regulatory landscape in 2024 is characterised by this gap between the pace of the technology and the pace of governance response.

What does exist is patchwork and fragmented: criminal statutes in some jurisdictions, state-level NCII laws in others, platform content policies, voluntary industry standards, and an evolving international framework still in early implementation. Understanding the current legal landscape means understanding a work in progress — one where significant harmful conduct remains in legal grey zones.

4.1 — United States: Fragmented State and Federal Law

The United States had no comprehensive federal deepfake law as of mid-2024. Legislative progress had been limited to specific sectors and use cases. The DEEPFAKES Accountability Act, first introduced in Congress in 2019 and reintroduced multiple times, had not passed as of June 2024. It would have required disclosure labels on deepfake content and created civil liability for non-consensual synthetic pornography. The DEFIANCE Act (Disrupt Explicit Forged Images and Non-Consensual Edits), passed by the US Senate in July 2024, created a federal civil cause of action for victims of non-consensual AI-generated intimate imagery — the first federal legislation directly addressing deepfake NCII.

State-level legislation was more advanced. As of mid-2024, approximately 20 states had laws specifically addressing deepfake content, with varying scope. California's AB 602 (2019) created civil liability for deepfake pornography. Virginia's law (2019) criminalised non-consensual deepfake intimate imagery as a Class 1 misdemeanour. Texas and Georgia had passed laws specifically targeting deepfakes in political advertising, requiring disclosure labels. Minnesota's 2023 legislation made production of deepfake political content without disclosure a gross misdemeanour within 90 days of an election.

The FCC's February 2024 ban on AI-generated voices in robocalls, following the New Hampshire primary incident, represented one of the faster regulatory responses to a specific deepfake incident — issued as a declaratory ruling under existing Telephone Consumer Protection Act authority within weeks of the incident.

4.2 — European Union: The AI Act and the DSA

The European Union's AI Act, finalised in March 2024 after three years of negotiation, includes provisions directly relevant to synthetic media. AI systems used to generate deepfakes are classified as "general purpose AI" and subject to transparency requirements. Specifically, Article 50 requires that AI systems generating synthetic content — including deepfake video and audio — must label outputs as artificially generated, and must implement technical measures to mark outputs in a machine-readable format. Providers of general-purpose AI models must publish summaries of training data used.

The AI Act's deepfake provisions have a narrow carve-out: content that is "evidently" artistic, creative, or satirical is exempt from mandatory labelling. The boundaries of "evident" satire are undefined in the legislation, which critics including the European Parliament's AI rapporteur have noted as a potential gap. The Act begins phasing into force from 2025, with most provisions applying from 2026.

The Digital Services Act (DSA), fully applicable from February 2024, imposes separate obligations on very large online platforms (those with over 45 million EU users). These platforms must assess and mitigate systemic risks associated with their services, including risks from synthetic media. Platforms must provide users with mechanisms to flag potentially manipulated content and must report on their risk mitigation measures. The European Centre for Algorithmic Transparency monitors compliance.

4.3 — Platform Policies: Inconsistent Enforcement

Major platforms had adopted deepfake-specific content policies by 2024, though enforcement consistency varied significantly. YouTube's policy, updated in 2023, requires creators to disclose AI-generated realistic content and allows removal of non-consensual synthetic intimate imagery. Meta's policy prohibits synthetic media that "manipulates, alters, or falsifies" political figures' statements in misleading ways — a definition that has proved difficult to enforce uniformly. TikTok requires AI-generated content to be labelled and has implemented automatic label application to content detected by its own classifiers.

The Slovak election case demonstrated the enforcement gap: AFP fact-checkers identified the audio deepfake of Šimečka as fabricated, but Meta did not remove it before the election. The platform's stated reason was that fact-checker input had not been received before the silence period expired. This raised questions about whether the review pipeline was calibrated for the political deepfake threat timeline.

X (formerly Twitter) removed its policy specifically targeting synthetic manipulated media in 2023 following ownership change, though it retained general misinformation policies. The policy reversal was widely noted by researchers as a regression in platform governance of synthetic content.

4.4 — Beneficial Uses and the Dual-Use Problem

Any governance framework for synthetic media must account for substantial legitimate uses. The film industry uses face-swapping and voice cloning for de-aging actors (used extensively in Marvel and Disney productions since 2019), recreating deceased performers (the late Paul Walker in Fast and Furious 7, 2015, predated modern deepfakes but established the practice), and dubbing foreign-language content. Accessibility applications use voice cloning to restore synthesised speech to individuals who have lost their own voice to illness.

In 2023, synthetic media company ElevenLabs partnered with the ALS Association to preserve the voices of patients diagnosed with ALS before they lost the ability to speak — producing personalised synthesised voices for future use. The same voice cloning technology used in the New Hampshire robocall fraud was used in this project. This is the dual-use problem in concrete form: the capability is identical; the consent and intent are different.

Journalism has begun using synthetic media for source protection — modifying voices and faces of interview subjects to protect identity while preserving the authenticity of their testimony. The BBC and Deutsche Welle have both piloted this approach. Legal frameworks that criminalise synthetic media production without adequately defining harmful use risk chilling these legitimate applications.

Where This Leaves Us

The governance landscape as of mid-2024 is best characterised as: robust on NCII in some jurisdictions, developing on political deepfakes, nearly absent on financial fraud deepfakes at the federal level in the US, and globally fragmented. The EU AI Act represents the most comprehensive framework, but its deepfake provisions begin applying in 2026. The gap between technological capability and governance capacity is real, documented, and unlikely to close quickly — which makes individual and institutional judgment more important, not less, than waiting for regulation to solve the problem.

Key Terms

DEFIANCE ActUS Senate legislation (July 2024) creating a federal civil cause of action for victims of non-consensual AI-generated intimate imagery — the first federal US law directly addressing deepfake NCII.
EU AI ActEuropean Union regulation finalised March 2024 requiring transparency labelling for AI-generated synthetic content, with most provisions applicable from 2026.
DSA (Digital Services Act)EU regulation fully applicable February 2024 requiring very large platforms to assess and mitigate systemic risks including those from synthetic media.
Dual-Use ProblemThe challenge that the same synthetic media capability enables both harmful applications (fraud, NCII) and legitimate ones (accessibility, journalism, film), making blanket prohibition impractical.

Lesson 4 Quiz

Legal Frameworks and Platform Responses — verify your understanding of the governance landscape.
1. What was the significance of the DEFIANCE Act, passed by the US Senate in July 2024?
Correct. The DEFIANCE Act was significant precisely because it was the first federal legislation directly addressing deepfake NCII — giving victims a federal civil (not criminal) cause of action. Prior to this, NCII victims relied entirely on state-level laws, which existed in only approximately 20 states and varied significantly in scope.
The DEFIANCE Act created a civil cause of action for NCII victims — the first federal law to specifically address deepfake intimate imagery. It did not criminalise deepfake production generally or address watermarking or political advertising.
2. What is the practical limitation of the EU AI Act's exemption for "evidently" satirical or artistic deepfake content?
Correct. The word "evidently" is doing significant legal work in Article 50 without being defined. Critics including the European Parliament's AI rapporteur noted that the undefined boundary creates a gap — producers of harmful synthetic content could claim satirical intent, and enforcement would depend on courts interpreting "evidently" case by case.
The limitation is definitional ambiguity: "evidently" satirical is undefined in the legislation. This creates enforcement uncertainty — harmful content producers can claim satirical intent, and the line between genuine satire and bad-faith claims will require case-by-case judicial interpretation.
3. The FCC's February 2024 ban on AI-generated voices in robocalls was issued under which legal mechanism?
Correct. The FCC moved quickly by using existing TCPA authority rather than waiting for new legislation — issuing a declaratory ruling that interpreted AI-generated voices as covered by the existing prohibition on artificial voices in robocalls. This was notably faster than the typical legislative timeline, demonstrating that regulatory agencies can sometimes act quickly using existing statutory tools.
The FCC used its existing authority under the Telephone Consumer Protection Act — issuing a declaratory ruling that AI-generated voices fell within existing TCPA prohibitions. This avoided the delay of new legislation and represented one of the faster documented regulatory responses to a specific deepfake incident.
4. ElevenLabs' partnership with the ALS Association to preserve patients' voices illustrates which concept from the lesson?
Correct. The ALS Association case is a textbook illustration of dual-use: the same ElevenLabs voice cloning system that produced the fraudulent Biden robocall preserves the voices of ALS patients facing loss of speech. The capability is identical; the consent and intent are categorically different. This is why blanket prohibition of voice cloning is difficult to defend on policy grounds.
This illustrates the dual-use problem: identical technology — voice cloning — enabling both harmful applications (political fraud robocalls) and clearly beneficial ones (preserving the voices of ALS patients). The difference is consent and intent, not the technology itself. This is a core challenge for any regulatory framework.
5. What happened to X (formerly Twitter)'s specific synthetic manipulated media policy in 2023?
Correct. Following the 2022 acquisition and 2023 policy changes under Elon Musk's ownership, X removed its specific policy targeting synthetic manipulated media. General misinformation policies remained, but the specific framework for deepfakes was gone — a documented regression in platform governance of synthetic content that researchers flagged at the time.
The policy was removed — not strengthened — following the ownership change. Researchers documented this as a regression in platform governance: the specific synthetic media policy was replaced only by general misinformation policies, which do not specifically address deepfakes and apply less precisely.

Lab 4 — Policy Analyst

Navigate a real governance gap — design a policy response and defend it against objections.

Your Task

You advise a national legislature considering deepfake legislation. Work with the AI analyst to design a policy proposal, anticipate dual-use objections, and identify which enforcement mechanisms are realistic.

Complete at least three exchanges. The AI will play devil's advocate — be prepared to defend your proposal against both civil liberties and industry objections.

Start here: "We want to address political deepfakes before the next election. A broad production ban seems too restrictive given legitimate uses. What narrower policy options exist, and what are their tradeoffs?"
AI Analyst — Policy Design
Lab 4
Welcome to Lab 4. I'm your policy analyst. You're advising a legislature on deepfake governance. Present your policy scenario and I'll help you evaluate options, anticipate objections from civil liberties advocates and industry, and identify realistic enforcement mechanisms. Use the prompt above or describe your own governance challenge.

Module 1 — Test

15 questions across all four lessons. 80% required to pass.
1. In an autoencoder deepfake system, the face swap is achieved by training two decoders but sharing which component?
Correct. One shared encoder learns to map facial geometry to a latent space; two decoders — one trained on each person — reconstruct faces from that shared representation. Feeding person A through the encoder and person B's decoder produces the swap.
The shared component is the encoder. One encoder compresses any face to a common latent space; two person-specific decoders reconstruct faces from that representation. The swap occurs when one person's latent encoding is decoded through the other person's decoder.
2. Ian Goodfellow published the GAN paper in which year?
Correct. Goodfellow and colleagues at the University of Montreal published the GAN paper in June 2014 — a landmark that sat in open-source repositories and was adapted for deepfake face-swapping approximately three years later.
The GAN paper was published in June 2014. The technology then spread from academic repositories to consumer deepfake applications within approximately three years — illustrating the pace at which research-to-misuse timelines have compressed.
3. Diffusion models differ from GANs in which fundamental way?
Correct. Diffusion models start from noise and iteratively denoise over hundreds of steps, learning the reverse of a noise-addition process. GANs generate outputs in a single forward pass through the generator network. This architectural difference means they produce different artifact signatures, which is why GAN detectors generalise poorly to diffusion outputs.
The key architectural difference is the generation process: diffusion models iteratively remove noise from a random signal over many steps; GANs generate in a single forward pass through the generator. This produces different artifact signatures, creating the detection generalisation problem documented by Gragnaniello et al.
4. The website thispersondoesnotexist.com, launched in February 2019, used which architecture?
Correct. The site used NVIDIA's StyleGAN2 to generate photorealistic faces of non-existent people on demand. Its cultural impact was significant: it made GAN capability viscerally legible to a general audience who had no prior exposure to synthetic media research.
The site used NVIDIA's StyleGAN2. It was significant culturally because it made GAN-generated face synthesis immediately legible to a general audience — each page refresh producing a new photorealistic face of a person who does not exist.
5. What percentage of indexed deepfake videos were non-consensual intimate imagery according to the 2023 Home Security Heroes report?
Correct. 98% — a figure that surprises many who expect political or financial fraud deepfakes to dominate. NCII is by far the largest documented deepfake harm category by volume, with women comprising 99% of identified targets.
The figure is 98%. NCII is the dominant deepfake use case by volume — not political manipulation or financial fraud. Women comprise 99% of identified targets in the same report.
6. What operational features made the January 2024 Hong Kong $25 million fraud effective? (Select the best answer.)
Correct. Three compounding factors: (1) multimodal — video and audio simultaneously, not just one channel; (2) relational — fabricated replicas of known, trusted colleagues; (3) social — a group call context that made individual scepticism socially difficult. Each factor amplified the others.
The effectiveness came from three compounding factors: multimodal deception combining video and audio deepfakes simultaneously, the use of fabricated replicas of known trusted colleagues, and the group call social dynamic that made individual scepticism harder to exercise. These factors compounded each other.
7. Legal scholars Chesney and Citron published "The Liar's Dividend" in which journal?
Correct. Chesney and Citron published in the Notre Dame Law Review in 2019, coining the term "liar's dividend" to describe the ability to dismiss authentic evidence by claiming synthetic origin — an effect that grows as deepfake awareness grows.
The paper appeared in the Notre Dame Law Review in 2019. The concept it named — the ability to dismiss authentic evidence by claiming it is a deepfake — is one of the more underappreciated consequences of widespread synthetic media awareness.
8. What was the detection accuracy of the University of Buffalo pupil-reflection method on the GAN outputs it was trained to detect?
Correct. 93% accuracy on original GAN outputs — then near chance on modified GAN outputs specifically optimised against the pupil-reflection detector. This is the canonical illustration of the detection arms race: a strong signal is identified, becomes a training target, is eliminated, and detection accuracy collapses.
The system achieved approximately 93% on the original GAN outputs it was designed to detect. But within months, a countermeasure was published — a GAN modification that optimised for consistent pupil reflections — and detection accuracy dropped to near chance on those outputs.
9. The C2PA standard works by embedding which type of data to authenticate genuine media?
Correct. C2PA uses cryptographically signed metadata — a manufacturer signature plus capture timestamp plus edit history — that propagates through C2PA-compliant editing software. The signature can be verified by platforms or end users. Its limitation is that absence of C2PA metadata does not prove content is synthetic.
C2PA embeds cryptographically signed metadata at point of capture. The camera manufacturer's signature plus timestamp is attached to the file and propagates through compatible editing software, enabling provenance verification. Visual watermarks are a different system — used by SynthID rather than C2PA.
10. The 2022 iScience study found that human detection of StyleGAN2 faces averaged which accuracy rate?
Correct. 48.2% — slightly below random chance. The counterintuitive mechanism: StyleGAN2 faces tended toward slight symmetry and conventional attractiveness, which humans associate with trustworthiness, leading them to judge synthetic faces as more likely to be real. Short training improved accuracy to approximately 59%, still far below reliable detection.
The accuracy was 48.2% — slightly below random chance. Synthetic faces scored higher on perceived trustworthiness, causing participants to actively misidentify them as real more often than expected. This undermines any reliance on human intuition as a deepfake detection mechanism.
11. The EU AI Act's deepfake transparency requirements fall under which article, and when do most provisions begin applying?
Correct. Article 50 of the EU AI Act requires transparency labelling for AI-generated synthetic content, with most provisions phasing in from 2026. The Act was finalised in March 2024 but has a staggered implementation timeline.
Article 50 covers deepfake transparency requirements. The AI Act was finalised in March 2024 but begins phasing into force from 2025, with most provisions — including the deepfake labelling requirements — applying from 2026.
12. The Slovak election deepfake audio case demonstrates which enforcement gap specific to political deepfakes?
Correct. AFP fact-checkers identified the audio as fabricated, but Meta did not remove it before the election. The stated reason was that fact-checker input arrived after the silence period had begun and platform review was not completed before polling. The deepfake was deployed strategically within the silence period specifically to exploit this gap.
The gap was timing: platform review pipelines were not fast enough to act on fact-checker input within the narrow window of a pre-election media silence period. The deepfake was deployed strategically two days before the vote, within the silence period, and platforms did not remove it before polling closed.
13. DARPA's Media Forensics programme (MediFor) ran from 2016 to 2021 and achieved which documented result on benchmark detection?
Correct. MediFor achieved over 90% accuracy on benchmark datasets — but the benchmark datasets represented deepfakes of the training era. The Facebook Deepfake Detection Challenge, run simultaneously, produced 65% accuracy on held-out test sets representing unseen deepfakes, illustrating the generalisation gap.
MediFor achieved over 90% on benchmark datasets of the era. But the Facebook Deepfake Detection Challenge — run with 35,000 submissions to test generalisation — produced only 65% accuracy on held-out test sets of unseen deepfakes. The gap between benchmark and real-world performance is a consistent pattern in detection research.
14. Google DeepMind announced SynthID watermarking in which month and year?
Correct. SynthID was announced in August 2023. It embeds imperceptible watermarks in images and video generated by Google's systems that are designed to survive moderate editing, compression, and screenshots — with the documented limitation that it only covers Google-platform outputs.
SynthID was announced in August 2023. It embeds imperceptible watermarks designed to survive editing and compression — but only in outputs from Google's own systems. Open-source models running locally produce synthetic content with no watermarking coverage.
15. Which statement best characterises the deepfake governance landscape as of mid-2024?
Correct. This characterisation accurately reflects the documented state of the landscape: patchwork state-level NCII laws in the US, the DEFIANCE Act as the first federal NCII law, state-level political deepfake disclosure laws in some states, no comprehensive federal AI deepfake law, and EU AI Act deepfake provisions not applying until 2026. The governance gap is real, documented, and consequential.
The accurate characterisation is fragmented and uneven: stronger on NCII in jurisdictions with specific laws, developing on political deepfakes, nearly absent at the federal level in the US for financial fraud, and with the EU AI Act's core deepfake provisions delayed until 2026. No comprehensive solution exists as of mid-2024.