Generalizable Deepfake Detection via Frequency-Domain Enhancement and Feature Disentanglement

Abstract

Existing deepfake detectors often perform well on in-domain data but generalize poorly to unseen datasets or manipulation methods. This limitation is largely attributed to their reliance on dataset-specific semantic cues rather than transferable forgery patterns. To address this limitation, we propose a generalizable deepfake detection framework that combines frequency-domain enhancement with feature disentanglement. A Phase-Amplitude Frequency Enhancement (PAFE) module enhances subtle spectral artifacts introduced during deepfake generation. We then feed the enhanced representations into an asymmetric dual-branch architecture that separates content-related information from forgery-related features. The content branch models facial semantics, while the forgery branch extracts discriminative forgery features with reduced content interference. A spatial self-attention module further refines the forgery features. We optimize the framework using image-level reconstruction loss, feature-level contrastive loss, and classification loss. Together, these objectives encourage effective feature disentanglement and improve the discriminability of the learned forgery features. Extensive experiments on several widely used deepfake benchmarks show that the proposed framework achieves competitive detection performance and improved cross-domain generalization compared with existing methods.

1. Introduction

Recent advances in generative models, particularly Generative Adversarial Networks (GANs) [1] and diffusion-based generation frameworks [2], have significantly improved the realism and diversity of synthesized visual content. Modern deepfake technologies can generate highly realistic forged faces and videos that are difficult for human observers to distinguish from authentic media. Although these technologies have facilitated the development of digital entertainment and virtual content creation, they have also introduced serious risks to identity authentication, misinformation dissemination, public opinion manipulation, and multimedia credibility. Therefore, developing robust and reliable deepfake detection methods has become an important research topic in multimedia forensics and cybersecurity [3,4,5].

Despite their good in-domain performance, existing deepfake detectors often generalize poorly to unseen datasets and manipulation methods. One reason is that they may rely on dataset-specific shortcut cues associated with content-related information, such as identity, pose and illumination conditions, rather than transferable forgery evidence [6,7]. Reducing interference from content-related information is therefore important for learning generalizable forgery features. Feature disentanglement can reduce content interference by separating content-related information from forgery-related representations [8,9]. Nevertheless, its effectiveness may remain limited when the forgery cues are too subtle to be discriminative for detection. In addition, frequency-domain information can provide important forgery cues because image synthesis operations may leave spectral artifacts that are difficult to observe in spatial-domain images [10,11]. However, subtle spectral artifacts may be obscured by dominant facial content, while different forgery mechanisms may exhibit different spectral characteristics.

Building on these observations, we propose a generalizable deepfake detection framework that combines frequency-domain enhancement with feature disentanglement, as illustrated in Figure 1b. Figure 1 compares the learning paradigms of conventional spatial-domain detectors and the proposed framework. As shown in Figure 1a, conventional spatial-domain representations may entangle subtle forgery cues with content-related information, which can limit their generalization to unseen domains. In contrast, the proposed framework first employs a learnable PAFE module to adaptively enhance subtle spectral forgery artifacts. An asymmetric dual-branch architecture then separates content representations from forgery-related representations. By reducing interference from content-related information, the learned forgery features contribute to improved generalization under cross-dataset and cross-manipulation settings. To further improve the learned forgery representations, which is critical for feature disentanglement in this work, we incorporate several optimization strategies, including attention-based refinement and multi-task loss optimization, which are detailed in the following sections.

2. Related Work

2.1. Spatial-Domain Deepfake Detection

Spatial-domain analysis represents one of the earliest directions in deepfake detection. Face manipulation techniques, such as face swapping and facial reenactment, often involve local editing, cross-source blending, resampling, and boundary refinement. These operations may disrupt the spatial consistency of authentic images. They can leave pixel-level artifacts, including abnormal boundaries, texture discontinuities, and local structural distortions. Early studies therefore focused on extracting such spatial cues directly from RGB images. Li et al. [12] proposed Face X-ray, which captures foreground–background blending boundaries commonly introduced by face manipulation and detects tampering through statistical discrepancies across these boundaries. Zhao et al. [13] developed a multi-attentional network that uses multiple spatial attention heads to localize forged regions and a texture enhancement block to amplify subtle artifacts in shallow features. To capture spatial inconsistencies without pixel-level annotations, Zhuang et al. [14] proposed UIA-ViT, which uses a Vision Transformer to learn inconsistency-aware representations. Cao et al. [15] developed RECCE, an encoder–decoder framework that models common representations of genuine faces and uses reconstruction differences to guide the detector toward forged regions. As synthesis techniques evolve, these spatial artifacts become less conspicuous, calling for more effective forgery cues.

2.2. Frequency-Domain Deepfake Detection

Frequency-domain deepfake detection aims to identify synthesis traces that are difficult to observe directly in spatial-domain images. Durall et al. [10] found that up-convolutional operations can introduce discrepancies between the spectral distributions of generated and natural images. Frank et al. [11] further showed that these frequency artifacts can help distinguish synthetic images from authentic ones. Representative methods have explored frequency information from different perspectives. Qian et al. [16] proposed F3Net, which combines DCT-based frequency decomposition with local frequency statistics to capture manipulation-related patterns. Masi et al. [17] designed a two-branch network in which a Laplacian-of-Gaussian (LoG) bottleneck suppresses high-level facial content and emphasizes multi-band frequency artifacts. Liu et al. [18] proposed SPSL to combine spatial features with phase-spectrum information, while Luo et al. [19] used SRM high-pass filters and cross-modality attention to capture multi-scale high-frequency noise. Recent studies have also combined spatial and frequency information. Gong et al. [20] fused multi-scale spatial and frequency features, whereas Qi et al. [21] progressively enhanced spatial and frequency-aware cues. Despite this progress, many frequency-based detectors still construct spectral representations using predefined transforms or handcrafted filter priors, such as DCT, phase transforms, LoG, and SRM filters [16,17,18,19]. Some methods introduce learnable parameters over predefined frequency bands. However, their spectral partitioning or initial feature extraction remains constrained by the underlying operators. Therefore, the adaptive enhancement in weak forgery cues distributed across different frequency bands before feature extraction remains underexplored.

2.3. Generalizable Deepfake Detection

Generalizable deepfake detection aims to maintain reliable performance on unseen datasets and manipulation methods. Unlike in-domain detection, it requires models to learn transferable forgery patterns rather than dataset-specific correlations. Existing methods mainly follow two directions: increasing the diversity of training forgeries and learning representations that transfer across domains. LGrad [22] uses a pretrained convolutional neural network to transform input images into gradient maps, which serve as generalized representations of manipulation artifacts. Other methods improve generalization by synthesizing diverse training samples. SBI [23] generates self-blended images from pristine faces to reproduce common blending artifacts, while SLADD [24] dynamically generates challenging samples using different facial regions and blending configurations. Recent face-specific methods have also explored anomaly modeling and texture discrepancies. Zhang et al. [25] formulated generalized face forgery detection as a supervised anomaly detection problem and used artifact-map scores to identify forged videos. Liu et al. [26] proposed AIM-Bone to generate and localize texture discrepancies for detecting unseen forgeries. The development of diffusion models has further expanded the range of unseen image generators. Corvi et al. [27] analyzed the forensic properties of images generated by generative adversarial networks and diffusion models. Ojha et al. [28] used features extracted from a pretrained vision-language model to detect images produced by unseen generative models. Despite this progress, existing methods may still depend on training-specific artifacts, synthesis strategies, or general-purpose visual representations. Learning task-specific representations that capture transferable forgery cues while reducing content-related interference therefore remains important for generalizable deepfake detection.

2.4. Feature Disentanglement

Feature disentanglement aims to separate forgery-related evidence from content information, such as facial identity, appearance, and background, which may introduce dataset bias. Liang et al. [8] proposed a content information removal framework. They used a content consistency constraint and a global representation contrastive constraint to reduce content interference and guide the detector toward manipulation traces. UCF [9] further decomposed image representations into forgery-irrelevant features, method-specific forgery features, and common forgery features. Multi-task supervision and contrastive regularization were used to separate these components, while only the common forgery features were retained for detection. Recent studies have extended feature disentanglement to different learning settings. Yan et al. [29] constructed self-supervised training samples through image self-mixing. Their framework separated forgery-irrelevant content features from forgery-related features using conditional reconstruction and orthogonal constraints. FTA-DFI [30] combined feature separation with frequency-domain trace amplification and adversarial learning. It aimed to suppress identity information and method-specific patterns while identifying differences between authentic and forged faces. These studies indicate that feature disentanglement can reduce content-related interference. However, preserving sufficiently discriminative forgery evidence during feature encoding remains challenging.

3. Method

3.1. Overview of the Proposed Framework

We propose a generalizable deepfake detection framework that combines frequency-domain enhancement with feature disentanglement, as shown in Figure 2.

The framework consists of three main components: the Phase-Amplitude Frequency Enhancement (PAFE) Module, the Dual-branch Feature Disentanglement Module, and the Multi-task Loss Optimization Module. The PAFE Module applies learnable amplitude modulation while preserving phase information. It produces frequency-enhanced inputs for subsequent feature learning. The Dual-branch Feature Disentanglement Module employs a content encoder and a forgery encoder to extract content features and forgery features, respectively. Spatial self-attention is further applied to the forgery features to highlight manipulation-related regions. The Multi-task Loss Optimization Module jointly optimizes image reconstruction, feature-level contrastive learning, and forgery classification. For image reconstruction, content and forgery features are combined through AdaIN mixing and fed into a shared decoder. Self-reconstruction and cross-reconstruction promote the separation of content and forgery information. Meanwhile, the contrastive and classification objectives improve the discriminability of the forgery features. During inference, the input image is processed by the PAFE Module, the forgery encoder, and the spatial self-attention module. The resulting forgery features are then fed into the classifier for real/fake prediction. The following sections describe each component in detail.

3.2. Phase-Amplitude Frequency Enhancement Module

A Phase-Amplitude Frequency Enhancement (PAFE) module is introduced to enhance subtle forgery artifacts in the frequency domain. For each input image $x_i\in {\mathbb{R}}^{C\times H\times W}$, where $i\in \{0,1\}$, a two-dimensional Fourier transform is applied independently to each channel to obtain its amplitude and phase spectra as follows:

$$F_i=\mathcal{F}\left(x_i\right),A_i=\left|F_i\right|,P_i=\arg \left(F_i\right),$$

(1)

where $\mathcal{F}(·)$ denotes the channel-wise two-dimensional Fourier transform, $F_i$ is the resulting complex-valued frequency spectrum, and $A_i$ and $P_i$ denote its amplitude and phase spectra, respectively. Since the phase spectrum generally preserves more structural information of the image, PAFE retains the original phase spectrum $P_i$ and adaptively modulates only the amplitude spectrum $A_i$. $A_i^{\mathrm{en}}$ denotes the enhanced amplitude spectrum of the i-th input image, obtained by modulating $A_i$ with the learnable matrix M, as follows:

$$A_i^{\mathrm{en}}=A_i\odot M,$$

(2)

where ⊙ denotes element-wise multiplication. The modulation matrix $M\in {\mathbb{R}}^{H\times W}$ has the same spatial dimensions as each channel of the amplitude spectrum. It is initialized with ones, shared across channels, and jointly optimized with the remaining network parameters. During training, M is continuously updated through backpropagation with respect to the overall loss, whose components are described in a subsequent section. This optimization enables the network to assign larger weights to frequency components containing more pronounced manipulation traces while suppressing uninformative low-frequency background variations. The enhanced spatial image $x_i^{\mathrm{en}}$ is reconstructed from the modulated amplitude and the original phase.

$$x_i^{\mathrm{en}}={\mathcal{F}}^{-1}\left(A_i^{\mathrm{en}}\exp \left(\mathrm{j}{P}_i\right)\right),$$

(3)

where ${\mathcal{F}}^{-1}(·)$ denotes the channel-wise inverse Fourier transform and $\mathrm{j}$ is the imaginary unit. Finally, the enhanced spatial image is concatenated with the original spatial-domain image along the channel dimension:

$$x_i^{\mathrm{PAFE}}=\mathrm{Concat}\left(x_i,x_i^{\mathrm{en}}\right),$$

(4)

where $\mathrm{Concat}(·)$ denotes channel-wise concatenation. $x_i^{\mathrm{PAFE}}$ is the final output of the PAFE module. It preserves the information in the original image while emphasizing informative frequency-domain cues through learnable spectral enhancement. Therefore, it will provide a more informative input for subsequent feature disentanglement.

3.3. Dual-Branch Feature Disentanglement

3.3.1. Dual-Branch Feature Extraction

As illustrated in Figure 2, an asymmetric dual-branch framework is introduced to encourage the disentanglement of content features from forgery features. The framework consists of a content encoder $E_c$ and a forgery encoder $E_f$. Given a real/fake image pair $(x_0,x_1)$, where $x_0$ and $x_1$ denote the real/fake samples, respectively. The content encoder $E_c$ directly extracts the content feature of $x_i$ denoted as $F_c^i$ from the original spatial-domain image, as follows:

$$F_c^i=E_c\left(x_i\right),i\in \{0,1\},$$

(5)

The content encoder mainly focuses on semantic information, such as facial structure, identity, and expression. In contrast, the forgery encoder processes the frequency-enhanced $x_i^{\mathrm{PAFE}}$ generated by the PAFE module:

$$F_f^i=E_f\left(x_i^{\mathrm{PAFE}}\right),i\in \{0,1\},$$

(6)

where $F_f^i$ denotes the forgery features of $x_i$. The forgery encoder is designed to capture manipulation-related patterns from the frequency-enhanced input. In our implementation, both $E_c$ and $E_f$ use Xception backbones initialized with ImageNet-pretrained weights. The content and forgery features have the same dimensions $F_c^i,F_f^i\in {\mathbb{R}}^{D\times H^{\prime }\times W^{\prime }}$, where $D=728$ denotes the number of feature channels, and $H^{\prime }$ and $W^{\prime }$ denote the height and width of the feature maps, respectively. By assigning different inputs and learning objectives to the two encoders, the asymmetric architecture guides $E_c$ toward semantic content and $E_f$ toward forgery-related evidence. During training, the two encoding branches are jointly optimized using the image-level reconstruction loss, feature-level contrastive loss, and classification loss to promote the separation of content and forgery features.

3.3.2. Spatial Self-Attention Enhancement

Deepfake artifacts often appear in localized regions, such as facial boundaries and areas with inconsistent textures. We therefore insert a spatial self-attention module into an intermediate block of the forgery encoder $E_f$ to emphasize manipulation-sensitive regions and reduce interference from irrelevant semantic information. Given an intermediate feature map $F\in {\mathbb{R}}^{D\times H^{\prime }\times W^{\prime }}$, three independent $1\times 1$ convolutional projections generate the query Q, key K, and value V, where Q and K have channel dimension $D/8$ to reduce computational cost, and V maintains dimension D. The spatial dimensions are flattened into $N=H^{\prime }\times W^{\prime }$ positions. The attention weight between positions i and j is computed as follows:

$$S_{ij}={\displaystyle \frac{\exp \left(\frac{Q_i^{\top }{K}_j}{\sqrt{D/8}}\right)}{{\sum }_{k=1}^N\exp \left(\frac{Q_i^{\top }{K}_k}{\sqrt{D/8}}\right)}},$$

(7)

where $Q_i$, $K_j$, and $V_j$ denote the query, key, and value vectors at the corresponding spatial positions, and $S_{ij}$ is the normalized attention weight from position i to position j. The attention-enhanced feature at position i is obtained by aggregating the value vectors over all spatial positions.

$$F_{\mathrm{a}}\left(i\right)={\displaystyle \sum _{j=1}^N}{S}_{ij}{V}_j.$$

(8)

The resulting vectors are rearranged into $F_{\mathrm{a}}\in {\mathbb{R}}^{D\times H^{\prime }\times W^{\prime }}$. A residual connection is then applied to preserve the original feature information.

$$F_{\mathrm{s}}=F+\alpha F_{\mathrm{a}},$$

(9)

where $\alpha$ is a learnable scaling parameter that controls the contribution of the attention-enhanced feature. The output $F_{\mathrm{s}}$ is passed to the subsequent layers of $E_f$ to obtain the final forgery feature $F_f$. By modeling dependencies across spatial positions, the module helps $E_f$ capture spatially distributed manipulation cues.

3.4. Multi-Task Loss Optimization

The proposed framework is optimized in an end-to-end manner. To facilitate effective feature disentanglement and learn discriminative forgery features, the overall optimization objective is formulated with three complementary loss terms, including the image-level reconstruction loss, the feature-level contrastive loss, and the classification loss.

3.4.1. Image-Level Reconstruction Loss

To encourage the content and forgery features to retain complementary information, we introduce a conditional decoder $\mathcal{D}$ for image-level reconstruction. An AdaIN-inspired forgery-guided feature modulation operation is adopted to combine the content feature $F_c$ and the forgery feature $F_f$, enabling the decoder to reconstruct images with controlled authenticity attributes. For each sample $i\in \{0,1\}$, the content feature is normalized as ${\widehat{F}}_c^i$ to eliminate statistical biases and facilitate subsequent forgery-driven modulation:

$${\widehat{F}}_c^i={\displaystyle \frac{F_c^i-\mu \left(F_c^i\right)}{\sigma \left(F_c^i\right)}},$$

(10)

where $\mu (·)$ and $\sigma (·)$ denote the mean and standard deviation computed over the spatial positions of each channel. An MLP maps the forgery feature $F_f^j$ from sample $j\in \{0,1\}$ to the modulation parameters $\gamma \left(F_f^j\right)$ and $\beta \left(F_f^j\right)$. The content feature from sample i and the forgery feature from sample j are combined as follows.

$$F_{\mathrm{mix}}^{i,j}=\gamma \left(F_f^j\right)\odot {\widehat{F}}_c^i+\beta \left(F_f^j\right),$$

(11)

where $i,j\in \{0,1\}$ indicate the source samples of the content and forgery features, respectively, and ⊙ denotes element-wise multiplication. Here, 0 and 1 denote the real/fake samples, respectively.

Unlike simple feature concatenation or addition, the proposed modulation operation preserves the distinct roles of content and forgery information. This design supports controlled feature exchange during reconstruction. We therefore feed $F_{\mathrm{mix}}^{i,j}$ into the decoder $\mathcal{D}$ and define two complementary reconstruction paths: self-reconstruction and cross-reconstruction. As illustrated in Figure 2, self-reconstruction combines the content and forgery features from the same sample, as follows:

$${\widehat{x}}_i^{\mathrm{self}}=\mathcal{D}\left(F_{\mathrm{mix}}^{i,i}\right).$$

(12)

Cross-reconstruction retains the content feature of $x_i$ while replacing its forgery feature with that of $x_{1-i}$.

$${\widehat{x}}_i^{\mathrm{cross}}=\mathcal{D}\left(F_{\mathrm{mix}}^{i,1-i}\right).$$

(13)

Thus, ${\widehat{x}}_i^{\mathrm{cross}}$ is expected to preserve the facial content of $x_i$ while acquiring the authenticity attribute of $x_{1-i}$. Its target authenticity label, $1-i$, is supervised by the classification loss introduced in a subsequent subsection. Since both reconstruction paths use $F_c^i$ as their content source, $x_i$ serves as the pixel-level reference for content preservation. The image-level reconstruction loss is defined as follows:

$$L_{\mathrm{rec}}={\displaystyle \sum _{i=0}^1}\left({∥{\widehat{x}}_i^{\mathrm{self}}-x_i∥}_1+{∥{\widehat{x}}_i^{\mathrm{cross}}-x_i∥}_1\right).$$

(14)

The self-reconstruction term minimizes the reconstruction error between the reconstructed and original images. This encourages the disentangled features to preserve the information needed to reconstruct the input image. In cross-reconstruction, the forgery feature is extracted from the other input image. It may contain identity, appearance, or background information from that image. This information may change the content of the reconstructed image and increase the pixel-level reconstruction error. Minimizing this error helps reduce content leakage into the forgery feature. It therefore promotes the disentanglement of content and forgery features.

3.4.2. Feature-Level Contrastive Loss

Although the image reconstruction constraint promotes the disentanglement of content and forgery information to some extent, relying solely on reconstruction may still allow content information to leak into the forgery feature. To further separate the two representations, we introduce a feature-level contrastive loss. The content and forgery features extracted from the same input image are treated as a negative feature pair, and their distance in the feature space is enlarged to reduce semantic coupling. Specifically, the content encoder produces the content feature map $F_c$, while the forgery encoder produces the final forgery feature map $F_f$ after spatial self-attention enhancement and subsequent encoding layers. Global average pooling is first applied to compress the two feature maps into the content feature vector ${\mathbf{v}}_c$ and the forgery feature vector ${\mathbf{v}}_f$, respectively.

$${\mathbf{v}}_c=\mathrm{GAP}\left(F_c\right),{\mathbf{v}}_f=\mathrm{GAP}\left(F_f\right).$$

(15)

The Euclidean distance between the two feature vectors $d_{cf}$ is then computed as follows:

$$d_{cf}={∥{\mathbf{v}}_c-{\mathbf{v}}_f∥}_2.$$

(16)

Accordingly, the feature-level contrastive loss $L_{\mathrm{con}}$ is formulated as follows:

$$L_{\mathrm{con}}=\max \left(0,m-d_{cf}\right),$$

(17)

where m denotes a predefined margin. When the distance between the content and forgery features is smaller than m, the loss penalizes the network and pushes the two representations apart. When their distance is greater than or equal to m, the loss becomes zero. This constraint does not require the construction of additional cross-sample pairs and directly reduces the coupling between content information and forgery-related cues within the same image, thereby promoting more effective feature disentanglement.

3.4.3. Classification Loss

The classification loss directly supervises the authenticity prediction of both the original and cross-reconstructed samples. Let ${\widehat{y}}_i$ and ${\widehat{y}}_i^{\mathrm{cross}}$ denote the predicted probabilities of the original image $x_i$ and the cross-reconstructed image ${\widehat{x}}_i^{\mathrm{cross}}$ being fake, respectively. The binary cross-entropy loss is defined as follows.

$$\mathcal{l}(y,\widehat{y})=-y\log \left(\widehat{y}\right)-(1-y)\log (1-\widehat{y}).$$

(18)

Since $x_0$ and $x_1$ denote the real/fake samples, respectively, their labels satisfy $y_i=i$. The cross-reconstructed image ${\widehat{x}}_i^{\mathrm{cross}}$, which combines $F_c^i$ with $F_f^{1-i}$, is assigned the authenticity label $1-i$. Accordingly, the classification loss $L_{\mathrm{cls}}$ is as follows:

$$L_{\mathrm{cls}}={\displaystyle \sum _{i=0}^1}\left[\mathcal{l}\left(i,{\widehat{y}}_i\right)+\mathcal{l}\left(1-i,{\widehat{y}}_i^{\mathrm{cross}}\right)\right].$$

(19)

3.4.4. Overall Training Objective

The overall training objective $L_{\mathrm{total}}$ combines the classification loss, reconstruction loss, and feature-level contrastive loss:

$$L_{\mathrm{total}}=L_{\mathrm{cls}}+{\lambda }_1{L}_{\mathrm{rec}}+{\lambda }_2{L}_{\mathrm{con}},$$

(20)

where ${\lambda }_1$ and ${\lambda }_2$ balance the contributions of the reconstruction loss and feature-level contrastive loss, respectively. The classification loss provides direct supervision for real/fake classification. The reconstruction loss encourages the two branches to preserve complementary information for image reconstruction. The feature-level contrastive loss reduces the coupling between content and forgery features in the latent space. Joint optimization of these losses promotes effective feature disentanglement and preserves discriminative forgery cues for robust deepfake detection.

4. Experiments

4.1. Experimental Settings

4.1.1. Datasets

Extensive experiments were conducted on several widely used public deepfake benchmark datasets to evaluate the effectiveness and cross-domain generalization capability of the proposed framework. The evaluated datasets include FaceForensics++ (FF++) [31], Celeb-DF and Celeb-DF-v2 [32], the DeepFake Detection Dataset (DFD) [33], the DeepFake Detection Challenge Preview dataset (DFDCP) and the DeepFake Detection Challenge dataset (DFDC) [34]. FaceForensics++ is one of the most commonly used benchmark datasets for deepfake detection. It contains multiple forgery manipulation methods, including DeepFakes (DF), Face2Face (F2F), FaceSwap (FS), and NeuralTextures (NT). Celeb-DF is a challenging deepfake dataset that contains high-quality forged videos with significantly reduced visual artifacts. Celeb-DF-v2 is an improved version of Celeb-DF, containing a larger number of high-fidelity forged videos generated using advanced synthesis techniques. DFDCP and DFDC contain large-scale real-world forged videos generated by diverse manipulation pipelines. These datasets provide more realistic evaluation scenarios for generalizable deepfake detection. The DeepFake Detection Dataset (DFD), released by Google Jigsaw, is an independent benchmark containing real and manipulated videos generated from consented actor footage. It covers diverse acquisition conditions and is widely used to evaluate the robustness of deepfake detection models against unseen forgery patterns.

4.1.2. Implementation Details and Evaluation Metrics

For data preprocessing, Dlib was used for face detection, extraction, and alignment. All extracted face images were resized to a uniform resolution of $256\times 256$ pixels. The medium-compression version (c23) of FF++ was used for training to simulate image quality in real-world online environments. For each video, 32 frames were sampled at equal temporal intervals. Several commonly used data augmentation operations were applied during training. Horizontal flipping was performed with a probability of 0.5. Random rotation was applied with a probability of 0.5, with rotation angles ranging from $-{10}^{\circ }$ to ${10}^{\circ }$. Image blurring was applied with a probability of 0.5, using kernel sizes ranging from 3 to 7. Brightness and contrast were randomly adjusted with a probability of 0.5, with both adjustment ranges set to $[-0.1,0.1]$. JPEG compression artifacts were introduced by randomly sampling the quality factor from $[40,100]$. The proposed framework was implemented using the PyTorch (1.11) deep learning library. During training, the Adam optimizer was adopted for end-to-end optimization, with the exponential decay rates for the first- and second-moment estimates set to ${\beta }_1=0.9$ and ${\beta }_2=0.999$, respectively. The initial learning rate was set to $1\times {10}^{-4}$ and gradually decayed using a cosine annealing strategy. The batch size was set to 32, and the network was trained for 50 epochs. The balancing coefficients in Equation (20) were empirically set to ${\lambda }_1=1.0$ and ${\lambda }_2=0.1$ to balance the contributions of the reconstruction and feature-level contrastive losses during joint optimization. The margin m in Equation (17) was set to $1.0$. All experiments were conducted on NVIDIA RTX 4090 GPUs. The inference model contains approximately 45.2M parameters and requires 9.8 GFLOPs to process a single image.

Detection performance was evaluated using the Area Under the Receiver Operating Characteristic Curve (AUC). The AUC is a widely adopted evaluation metric for deepfake detection [9], which measures the discriminative capability of a detector across different decision thresholds. A higher AUC value indicates better forgery detection performance. Under cross-dataset evaluation settings, it also reflects stronger cross-domain generalization capability.

4.2. Cross-Dataset Evaluation

To evaluate model generalization across different data distributions, we conduct cross-dataset experiments. The model is trained on FF++ and evaluated on datasets from multiple sources, including Celeb-DF, Celeb-DF-v2, DFDCP, DFDC, and DFD. These datasets differ in manipulation methods, video compression levels, and acquisition conditions. This setting introduces diverse distribution shifts and provides a more realistic assessment of model generalization in practical scenarios. The results are reported in

Table 1. Cross-dataset evaluation results in terms of AUC. All models are trained on FF++ and evaluated on unseen datasets without additional fine-tuning. The best and second-best results are highlighted in bold and underlined, respectively.

Method	Celeb-DF	Celeb-DF-v2	DFDCP	DFDC	DFD
Face X-ray [12]	0.709	0.679	0.694	0.633	0.766
RECCE [15]	0.768	0.732	0.742	0.713	0.812
F3Net [16]	0.777	0.735	0.735	0.702	0.798
UCF [9]	0.779	0.753	0.759	0.719	0.807
CORE [35]	0.780	0.743	0.734	0.705	0.802
FFD [36]	0.784	0.744	0.743	0.703	0.802
FWA [37]	0.790	0.668	0.638	0.613	0.740
SRM [19]	0.793	0.755	0.741	0.700	0.812
SPSL [18]	0.815	0.765	0.741	0.704	0.812
Ours	0.807	0.773	0.798	0.752	0.813

.

As shown in Table 1, most methods exhibit considerable performance variation across the unseen datasets. For example, Face X-ray achieves AUC values of 0.709 on Celeb-DF and 0.633 on DFDC. This variation implies that its performance is sensitive to shifts in the target distribution. In comparison, methods based on frequency-domain features or high-level semantic representations show stronger cross-domain performance. SPSL and SRM maintain relatively consistent performance across several test datasets. In particular, SPSL achieves the highest AUC of 0.815 on Celeb-DF.

Compared with these methods, our method achieves competitive results across the evaluated datasets. It obtains the highest AUC on Celeb-DF-v2, DFDCP, DFDC, and DFD, with scores of 0.773, 0.798, 0.752, and 0.813, respectively. The advantages are more pronounced on DFDCP and DFDC. On Celeb-DF, our method ranks second with an AUC of 0.807. These results imply that our method captures relatively stable forgery cues across different data distributions. It also adapts to variations in manipulation methods and complex distribution shifts, demonstrating relatively good cross-dataset generalization and detection stability.

4.3. Cross-Manipulation Evaluation

To further evaluate the generalization capability of the proposed framework to unseen manipulation types, leave-one-manipulation-out experiments are conducted on FaceForensics++ (FF++). In each setting, one of the four manipulation types is excluded from training. The remaining three types are used to train the model. The trained model is then evaluated on the external benchmark datasets Celeb-DF and DFDC. This setting approximates the detection of manipulation types that are unavailable during training. The results are reported in

Table 2. Cross-manipulation evaluation results in terms of AUC under the leave-one-manipulation-out setting. The best and second-best results are highlighted in bold and underlined, respectively.

Method	No-DF		No-F2F		No-FS		No-NT
	Celeb-DF	DFDC	Celeb-DF	DFDC	Celeb-DF	DFDC	Celeb-DF	DFDC
Xception [38]	0.660	0.651	0.716	0.646	0.737	0.665	0.709	0.647
CORE [35]	0.706	0.630	0.724	0.671	0.718	0.661	0.667	0.659
RECCE [15]	0.644	0.636	0.708	0.641	0.771	0.653	0.759	0.633
FWA [37]	0.711	0.625	0.716	0.701	0.752	0.659	0.731	0.670
Face X-ray [12]	0.678	0.636	0.717	0.734	0.753	0.685	0.744	0.631
SLADD [24]	0.645	0.738	0.726	0.675	0.715	0.729	0.734	0.759
F3Net [16]	0.745	0.749	0.739	0.745	0.699	0.664	0.778	0.797
SRM [19]	0.736	0.725	0.757	0.737	0.694	0.728	0.791	0.813
SPSL [18]	0.787	0.743	0.737	0.759	0.699	0.669	0.829	0.807
UCF [9]	0.749	0.767	0.782	0.765	0.800	0.711	0.808	0.800
Ours	0.783	0.782	0.792	0.781	0.812	0.736	0.824	0.836

.

As shown in Table 2, most baseline methods exhibit considerable performance variation across the leave-one-manipulation-out settings. Xception and CORE obtain AUC values ranging from 0.63 to 0.74. This variation suggests that conventional single-encoder classifiers may overfit to the manipulation types observed during training. Face X-ray, which detects blending boundaries, also shows considerable variation across the evaluation settings. This result shows that reliance on a fixed forensic cue may limit generalization to unseen manipulation types.

In comparison, the proposed framework achieves the best results in most leave-one-manipulation-out settings and the second-best results in a small number of settings. It therefore shows competitive and relatively consistent overall performance. These results suggest that the proposed framework is less dependent on manipulation-specific patterns. They are also consistent with learning forgery-related representations shared across different manipulation types. The proposed framework therefore shows relatively good generalization to the unseen manipulation types considered in this experiment.

4.4. Ablation Study

To investigate the contribution of each component, detailed ablation studies have been conducted. The experiments are performed on FaceForensics++ (FF++) and Celeb-DF. FF++ is adopted to evaluate the in-domain detection performance, while Celeb-DF is used as an unseen benchmark to assess cross-domain generalization capability. This evaluation protocol provides a comprehensive analysis of both detection effectiveness and generalization ability. The experimental results are reported in

Table 3. Component-wise ablation results in terms of AUC. The baseline uses Xception as the backbone. D, F, and A denote the Dual-branch Feature Disentanglement Module, PAFE module, and the spatial self-attention module, respectively. The best results are highlighted in bold.

Experiment	Core Modules	FF++	Celeb-DF
1	Baseline	0.901	0.672
2	Baseline + D	0.954	0.654
3	Baseline + D + A	0.958	0.696
4	Baseline + D + F	0.967	0.764
5	Baseline + D + F + A	0.972	0.807

.

The baseline model Xception consists only of the backbone feature extraction network, without incorporating the proposed feature enhancement and representation learning strategies. As shown in Table 3, the baseline model achieves competitive performance on the in-domain FF++ dataset. However, its performance on Celeb-DF is relatively limited. This verifies that directly learning representations from RGB images may not be sufficient to handle the distribution variations in unseen datasets. After introducing the feature disentanglement module, the performance on FF++ is improved. This improvement shows that separating content features from forgery features helps the network focus on more discriminative forgery-related information. However, the cross-domain performance shows a slight decline at this stage. This observation suggests that feature disentanglement alone may not fully address the distribution differences between datasets. With the further integration of the spatial self-attention module, the model achieves improvements in both FF++ and Celeb-DF. The results show that spatial self-attention enhancement provides additional guidance for forgery feature learning and helps capture more informative forgery-related regions. After incorporating the proposed PAFE module, the model obtains further performance improvements, particularly on the cross-domain Celeb-DF benchmark. This result shows that frequency-domain enhancement can provide complementary spectral forgery cues and improve the robustness of the learned features. Finally, the complete model combining all proposed components achieves the best performance under both in-domain and cross-domain evaluation settings. These results indicate that frequency-domain enhancement, feature disentanglement, and spatial self-attention enhancement provide complementary advantages. Their joint optimization enables the model to learn more robust and transferable forgery features.

To further evaluate the contribution of each constraint in the multi-task loss optimization, we conduct a loss-function ablation study, as shown in

Table 4. Loss-function ablation results in terms of AUC. $L_{cls}$, $L_{rec}$, and $L_{con}$ denote the classification loss, image-level reconstruction loss, and feature-level contrastive loss, respectively. The best results are highlighted in bold. The check mark indicates that this loss term is adopted in the current optimization strategy.

Exp.	${\mathit{L}}_{\mathit{cls}}$	${\mathit{L}}_{\mathit{rec}}$	${\mathit{L}}_{\mathit{con}}$	FF++	Celeb-DF
1	✓			0.956	0.685
2	✓	✓		0.963	0.772
3	✓		✓	0.970	0.759
4	✓	✓	✓	0.972	0.807

.

The results show that the three loss constraints contribute differently to feature disentanglement. In Experiment 1, the classification-only setting using $L_{cls}$ appears to be more susceptible to domain overfitting. Since $L_{cls}$ mainly optimizes the decision boundary on the training data, the absence of explicit disentanglement supervision may cause the forgery branch to retain dataset-specific content cues, such as facial backgrounds and illumination conditions. In Experiment 2, adding the image-level reconstruction loss $L_{rec}$ leads to a modest improvement in FF++ and a clearer gain on Celeb-DF. This implies that $L_{rec}$ helps reduce interference from identity-related content in unseen domains. In Experiment 3, the feature-level contrastive loss $L_{con}$ provides a larger improvement in FF++, although its performance on Celeb-DF remains slightly below that of the reconstruction-based setting. This result implies that $L_{con}$ helps reduce the entanglement between forgery and content features and improves feature discriminability. In Experiment 4, jointly optimizing $L_{cls}$, $L_{rec}$, and $L_{con}$ yields the best results, with AUC scores of 0.972 on FF++ and 0.807 on Celeb-DF. Overall, these objectives appear to provide complementary supervision for in-domain detection and cross-domain generalization.

4.5. Visualization Analysis

To provide a more intuitive assessment of feature disentanglement, the disentangled content features $F_c$ and forgery features $F_f$ are visualized using t-SNE, as shown in Figure 3. In Figure 3a, the content features of real/fake samples overlap considerably. This indicates that the two classes have similar distributions of semantic information, such as facial content and backgrounds. These content features may therefore interfere with real/fake classification. In contrast, Figure 3b shows a clear separation between the forgery features of real/fake samples. This result indicates that the disentangled forgery features are highly discriminative between the two classes. Moreover, the forgery features of fake samples form multiple clusters. The number of clusters matches the number of manipulation types in the dataset, suggesting a potential direction for fine-grained manipulation type detection.

To further analyze the effect of the proposed frequency-domain enhancement strategy, we visualize the Fourier spectra of authentic and manipulated faces, as shown in Figure 4.

For authentic faces, the spectral energy is mainly concentrated in the low-frequency region and gradually decreases as the frequency increases. This distribution is generally consistent with the statistics of natural images. Complex backgrounds may introduce additional spectral variations, as illustrated by the third authentic image in the first row and its corresponding spectrum in the second row. In contrast, manipulated faces often exhibit frequency patterns that deviate from natural image statistics. Several examples in the fourth row show anomalous responses in the mid-to-high-frequency regions. These responses include abrupt changes in spectral energy and spectral discontinuities (e.g., the first, fourth, and fifth spectra), as well as cross-shaped or regularly distributed bright patterns (e.g., the first, second, and third spectra). These anomalous spectral patterns provide potentially useful forgery-related cues for forgery feature learning.

To further analyze the spatial cues used for forgery detection, the model responses are visualized using Grad-CAM, as shown in Figure 5. Strong responses are mainly observed around the eyes, mouth, facial contours, and hairline, whereas most background regions produce relatively weak responses. The periocular region contains rich edges and fine-grained textures. Face alignment, warping, and blending may introduce local texture anomalies or geometric distortions in this region. This may partly explain the strong responses around the eyes. The responses around the mouth may be associated with local structural changes introduced by facial expression manipulation. Those along the facial contours and hairline may reflect discontinuities caused by boundary blending. Overall, this response distribution suggests that the model relies more on local manipulation-related anomalies than on irrelevant scene content such as backgrounds. These observations provide some qualitative support for the effectiveness of feature disentanglement and the interpretability of the learned forgery features.

5. Conclusions

In this work, we propose a generalizable deepfake detection framework that combines PAFE with dual-branch feature disentanglement architecture. We introduce spatial self-attention into the forgery encoder to refine forgery-related representations. Classification loss, image-level reconstruction loss, and feature-level contrastive loss jointly guide the training of the disentanglement encoders. Experiments on multiple deepfake benchmarks validate the effectiveness of the proposed components and demonstrate competitive performance under cross-dataset and cross-manipulation settings.

The current framework primarily targets manipulation-based deepfakes, while its performance on fully-synthetic content (e.g., diffusion-generated faces) remains to be further evaluated. Future work will extend learnable frequency-domain modeling to capture artifacts produced by diverse forgery mechanisms. We will also explore self-supervised representation learning and domain generalization to improve robustness to unseen manipulation types and generative models.