{"id":"29b489d5-af86-4272-a1ea-effcd26e97ab","arxiv_id":"2506.11477","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":6,"one_line_summary":"FAME, a 2.61M-parameter VGG-19 plus attention LSTM network, attributes face-swap deepfake videos to their generating models with reported accuracies of 79.7% on DFDM, 97.5% on FF++, and 96.8% on FakeAVCeleb.","lead":"This paper presents FAME, a small neural network that watches short video clips and identifies which face-swap tool created a deepfake video. The authors report high accuracy on three video datasets while running fast enough for real-time forensic use.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Attribution claim rests on unvalidated label semantics: Tables 9–10 assign non-face-swap classes (F2F, NT, Wav2Lip, SV2TTS) as 'models,' and the DFDM FS class is near-chance, so the strongest evidence for decoder-specific attribution is the DFDM gain on LW/IAE/DFL.","rationale":"The reader's verdict is CONDITIONAL and I agree with that outcome. The paper has real positive evidence: a compact architecture, consistent accuracy gains on DFDM, and a plausible attention-based design. However, the strongest, cleanest result — DFDM 79.69% vs. CapST 75.54% — is not robustly established because the reported comparison lacks error bars, repeated runs, and an identity-disjoint split, and the per-class gains that generate the margin (LW and IAE) are exactly the classes where spurious cues would be hardest to rule out. This is a correctness-risk issue, not a novelty objection. I also agree with the reader that Tables 9–10 mix non-face-swap manipulation classes into the 'attribution' evaluation, so the FF++ and FakeAVCeleb accuracies support a broader manipulation-classification claim rather than a face-swap-model-attribution claim. My concern is slightly narrower than the reader's weakest_assumption: I focus on whether the decisive DFDM margin is a real decoder-signature signal, and I propose a concrete identity-disjoint, multi-seed test. The recommended verdict remains CONDITIONAL, since the issues are addressable with additional analysis and code release rather than being fatal to the architecture. I did not find evidence of fraud or misrepresentation; the paper is internally inconsistent in places (architecture description vs. Algorithm 1, 'simulated' ROC curves) but those are fixable reporting issues. The 'simulated ROC' and 'estimated AUC' labels deserve explicit flagging: the paper never explains how Figure 4 curves were produced, so they should not be cited as evidence until the procedure is documented or code is released. My agreement_with_reader is 'partial' because the reader centers the label-semantics problem while I center the need to validate the DFDM per-class margin under a stricter protocol; both point to the same conditional verdict. If the proposed test passes, the paper could be upgraded to ACCEPT with a minor rewrite of the FF++/FakeAVCeleb interpretation; if it fails, the central comparison collapses to 'comparable to CapST' and REJECT would be appropriate.","tokens_in":16879,"tokens_out":2432,"duration_ms":20670,"concrete_test":"On the DFDM dataset, retrain FAME and CapST under an identity-disjoint split (ensure the same source identities never appear in both train and test) and run 5 seeds, reporting mean±std per class. If the LW and IAE margins over CapST persist (≥4 points) and per-class standard deviations are small (<2 points), the decoder-specific attribution claim survives; if the margin collapses or overlaps with noise, the headline claim should be downgraded to 'comparable to CapST.' Additionally, recompute the FakeAVCeleb accuracy excluding SV2TTS and Wav2Lip classes; if the five-class accuracy drops materially, the face-swap-only generalization claim should be reworded.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The central claim is that FAME attributes face-swap videos to the generating model via decoder-specific artifacts, with the strongest quantitative evidence being 79.69% on DFDM vs. 75.54% for CapST (Table 7). This evidence has a load-bearing weakness: the comparison protocol. Table 6 shows FAME is below CapST on FS (66.92 vs. 77.69) and below or tied on DFaker; the average gain of 4.15% comes almost entirely from LW (+14.62) and IAE (+18.47), with FAME at 68.46/79.23. The paper nowhere shows that LW and IAE are distinguishable from each other by decoder architecture rather than by training/identity leakage or dataset artifacts. No error bars, no repeated runs, and no held-out identity protocol are reported, so a 4-point gap on two classes could reflect noise or a spurious cue. Second, Tables 9–10 break the face-swap attribution frame: FF++ F2F and NT are not face-swap autoencoders, and FakeAVCeleb includes SV2TTS (voice cloning) and Wav2Lip (lip sync), and class names (RTVCB, FSDW2L) are never defined. Reporting 97.50% and 96.77% on these as 'model attribution' overstates generalization, because the classifier may be separating manipulation families or audio-related identities. Third, the reported metrics are not independently checkable: AUC values in Table 11 are labeled 'estimated,' and Figure 4 describes 'simulated' ROC curves, with no procedure for deriving them; the '0.7 sec' runtime and 2.61M parameters are not backed by a released runnable artifact (code link is generic). The reader's weakest_assumption identifies the label-semantics risk; my concern adds that even on DFDM, where labels are clean, the decisive per-class gains are not accompanied by variance or identity-held-out analysis. The load-bearing condition is thus: FAME's advantage on DFDM is a genuine decoder-signature effect and not dataset noise or identity bias; without that, the central attribution claim is unsupported even though the architecture may be competent.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces FAME, a lightweight spatio-temporal network for attributing face-swap deepfake videos to the generative model that produced them. The architecture combines a truncated VGG-19 spatial feature extractor with a bidirectional LSTM and spatial/temporal attention modules, trained with a weighted combination of frame-level and sequence-level cross-entropy losses. The authors report state-of-the-art attribution accuracies of 79.69% on DFDM, 97.50% on FF++, and 96.77% on FakeAVCeleb, with about 2.61M parameters and sub-0.7-second inference per video, and they include comparisons with several baselines, a reproduced DMA-STA baseline, ablation studies, runtime/parameter analysis, and Grad-CAM visualizations. The central claim is that FAME captures decoder-specific artifacts that enable practical, efficient model attribution of face-swap deepfakes.","tokens_in":17288,"tokens_out":5663,"duration_ms":56749,"significance":"If the empirical claims hold, FAME would be a practically valuable lightweight attribution tool, with a clear application in forensic media analysis. The paper has notable strengths: it evaluates on three datasets, reports parameter counts and inference times, includes an ablation study, attempts a reproduced baseline comparison, and releases code and pretrained models. However, several load-bearing evaluation issues currently prevent the headline claim from being fully established: the attribution label semantics are questionable for two of the three datasets, the reported average gains over the closest baseline are driven by two classes without statistical support, the ROC/AUC results are presented as 'simulated' or 'estimated' without a derivation, and a key baseline comparison mixes resolutions. These are fixable within the manuscript's scope, but they are not merely presentational.","major_comments":[{"comment":"The attribution frame is broken by the class labels used on FF++ and FakeAVCeleb. As the paper's own Tables 2 and 3 state, Face2Face and NeuralTextures in FF++ are not face-swap autoencoders, and the FakeAVCeleb subset includes SV2TTS (voice cloning) and Wav2Lip (lip sync). High accuracy on these classes (97.50% and 96.77%) may reflect coarse discrimination among manipulation families rather than fine-grained model attribution, which is the paper's central claim. Additionally, the FakeAVCeleb class names FSDW2L, FSGANC, FSGAND, RTVCB, and W2LC are never defined or mapped to the techniques listed in Table 3; the reader cannot tell which generative model each class corresponds to. The paper should either restrict the attribution claim to face-swap models, or justify why non-face-swap classes support a face-swap attribution conclusion.","section":"§4.4, §4.5; Tables 9 and 10"},{"comment":"The DFDM per-class results do not yet establish a decoder-specific advantage. FAME's average gain over CapST (79.69% vs. 75.54%) comes almost entirely from two classes, LW (+14.62) and IAE (+18.47), while on FS FAME is 10.77 points below CapST (66.92 vs. 77.69) and on Dfaker the two are tied. No error bars, no repeated runs, and no identity-disjoint split are reported, and Table 12 itself notes a large DFDM train/test gap (95.2% training vs. 79.69% test) that the authors call 'potential dataset-specific overfitting.' Without variance estimates or a protocol that controls for identity/content leakage, a four-point average improvement on two classes is not sufficient evidence that the classifier exploits stable decoder-specific generative signatures.","section":"§4.3, Tables 6 and 7"},{"comment":"The ROC and AUC evidence is not independently checkable. Figure 4 is captioned 'Simulated ROC curves' and Table 11 lists AUC values as 'estimated,' but the paper gives no procedure for how these curves or AUCs were derived from classifier scores. There is no description of how multi-class scores were reduced to a single ROC curve, whether curves are macro-averaged, or whether the values come from held-out test sets. The AUC claims (e.g., DFDM macro AUC 0.84, FF++ 0.99, FakeAVCeleb 0.99) should be replaced with empirical ROC analysis from the actual softmax or logit outputs, including a confidence interval or standard error.","section":"Figure 4 and Table 11"},{"comment":"The DMA-STA comparison is confounded by resolution and compression. The 'original' DMA-STA results use 224×224 inputs while FAME uses 112×112, so the comparison in the first three rows does not isolate model quality. The reproduced DMA-STA row uses the authors' settings, but this still does not provide a controlled resolution ablation. Moreover, in the Low-Low compression condition FAME (47.53%) is actually below the original DMA-STA (51.63%), which contradicts the text's claim in Section 4.3.3 that FAME 'consistently outperforms' DMA-STA. The authors should report same-resolution comparisons for all compression levels and temper the 'consistently outperforms' wording accordingly.","section":"§4.3.3, Table 8"}],"minor_comments":[{"comment":"There is a notation inconsistency: Eq. (6) defines the clip representation as a weighted sum of LSTM hidden states, z = sum_t alpha_t h_t, while Algorithm 1 lines 8–12 apply attention weights to the spatial feature matrix R after the BiLSTM. Section 3.2.3 similarly defines Rta = Attn:Map ⊙ R. Please align these formulations so the reader knows whether attention is applied to hidden states or to frame embeddings.","section":"Algorithm 1 and Section 3.2.2"},{"comment":"The acronym FAME is expanded inconsistently: 'Fake Attribution via Multilevel Embeddings' in the Abstract, 'Feature Attribution via Multilevel Embeddings' in the Algorithm 1 caption, and 'Fine-Grained Attribution via Multi-level Attention' in Section 3.2 and Table 14. Please use one expansion throughout.","section":"Title, Abstract, Algorithm 1, Table 14"},{"comment":"The figure caption lists subplots as '(a) FF++, (b) FakeA VCeleb, and (c) DFDM,' but the text refers to Figure 4(a) as DFDM, Figure 4(b) as FF++, and Figure 4(c) as FakeAVCeleb. The caption and text should be made consistent.","section":"Figure 4"},{"comment":"The row 'Real / Fake Ratio' is unclear for a multi-class attribution task that does not include a real class. For DFDM the stated 1:5 ratio is also not obviously meaningful when only 6,450 deepfake videos are listed. Please clarify what this row represents.","section":"Table 4"},{"comment":"The abbreviation 'Nol-Nol' for the no-compression condition is inconsistent with 'Hq-Hq' and 'Low-Low'; use 'No-No' or spell out the condition.","section":"Table 8"},{"comment":"Baseline parameter counts are given as approximate values ('~2.30', '~2.40', '~2.50'); please report exact parameter counts for all ablated variants so the reader can verify the claimed efficiency trends.","section":"Table 14"}],"recommendation":"major_revision","confidential_remarks":"The closest baseline, CapST, is the authors' own prior work. This is not circular because FAME is evaluated on external datasets and against a reproduced DMA-STA baseline, but the paper should make the exact evaluation protocol, class mappings, and code version available so reviewers and readers can verify the DFDM advantage. The main scientific risk is that the headline 'model attribution' claim is broader than what the current label semantics and experimental design can support."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"FAME is a competent, incremental follow-on to the authors' own CapST paper. The new bit is a specific, lightweight configuration — truncated VGG-19 + BiLSTM + two attention modules — that reports real gains on the DFDM benchmark (79.69% vs 75.54%) with 2.61M parameters and sub-0.7s per video inference. The ablation in Table 14 is clean, and I appreciate that they reproduced DMA-STA under their own setup rather than only quoting published numbers. The train/test gap on DFDM (95.2/79.7) is disclosed, which is more honest than most papers on this topic.\n\nThe soft spots are real, but mostly addressable. There are no error bars or repeated runs anywhere, so the 4-point average gain over CapST is not yet statistically distinguishable from noise; the gain is driven by LW and IAE, which might be easier classes rather than a general decoder-signature effect. The paper's own Table 8 shows FAME below the original DMA-STA on Low-Low compression (47.53 vs 51.63), which undercuts the \"consistently outperforms\" summary line. The ROC curves are called 'simulated' and the AUCs 'estimated' without any procedure; those figures are not independently checkable. And Tables 9–10 mix face-swap models with Face2Face, NeuralTextures, Wav2Lip, and SV2TTS, so the FF++ and FakeAVCeleb results are really about manipulation-type attribution, not fine-grained model attribution. The table labels in FakeAVCeleb (FSDW2L, RTVCB, etc.) are never defined. There is also an internal inconsistency in the architecture description: Algorithm 1 applies attention to the spatial features R after the LSTM, while Section 3.2.2 and Figure 2(b) describe softmax attention over LSTM hidden states; these are not the same operation.\n\nNone of this is fatal. The core DFDM high-quality result is plausible, and the efficiency angle is genuinely useful. If I were refereeing, I'd ask for variance estimates, a released runnable artifact, a defined ROC protocol, and a rewrite that scopes the FF++/FakeAVCeleb claims to manipulation attribution. As it stands, I'd treat the headline numbers as promising but not conclusive.","headline":"Incremental but useful lightweight attribution model; evaluation gaps keep it short of conclusive.","tokens_in":17917,"tokens_out":2723,"would_cite":true,"duration_ms":25522,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Lightweight network attributes face-swap deepfakes to their source model","keywords":["face-swap deepfakes","model attribution","spatio-temporal network","attention mechanism","deepfake forensics","lightweight model","VGG-19","LSTM"],"falsifier":"Train FAME on videos from a subset of source identities and test on held-out identities within the same generative models; if accuracy collapses, the model is learning identity or content cues rather than model signatures. Alternatively, retrain with class labels collapsed to manipulation families and compare accuracy; if FAME matches that family-level baseline, the method is not performing fine-grained model attribution.","tokens_in":16616,"feed_emoji":"🎭","tokens_out":3670,"duration_ms":34636,"temperature":0.7,"pith_summary":"This paper claims that model attribution of face-swap deepfakes—identifying which generative model produced a fake video—can be done accurately and cheaply by a compact spatio-temporal network. The proposed FAME model combines a truncated VGG-19 spatial encoder with attention-weighted bidirectional LSTM temporal aggregation. It is reported to reach 79.69% average accuracy on DFDM, 97.50% on FaceForensics++, and 96.77% on FakeAVCeleb, with only 2.61M parameters and under 0.7 seconds inference per video. If true, this makes source attribution practical for real-time forensic screening. The paper frames attribution as distinct from binary detection because face-swap autoencoders produce subtle decoder-specific artifacts that global classifiers miss.","feed_headline":"Lightweight net traces face-swap deepfakes to source model","feed_subtitle":"FAME reports 79.7–97.5% accuracy with 2.6M parameters and under 0.7 seconds per video.","key_machinery":"The central object is the FAME architecture: a truncated VGG-19 (layers 0–26) extracts mid-level spatial features per frame, a spatial attention module (global average and max pooling through a shared MLP with sigmoid) highlights artifact-bearing regions, and a bidirectional LSTM with softmax temporal attention aggregates frames into a video-level representation classified by a fully connected layer. A hybrid loss $\\alpha L_{\\text{spatial}} + \\beta L_{\\text{temporal}}$ forces the model to learn both frame-level and sequence-level discriminative cues. This integration carries the claim: the dual attention is the proposed mechanism for isolating decoder-specific traces that binary detectors or global classifiers lose.","core_discovery":"On its own terms, FAME demonstrates that a lightweight CNN+LSTM with two complementary attention modules can capture fine-grained generative signatures of face-swap models and outperform existing methods in fine-grained model attribution across three benchmarks. The central result is the accuracy-efficiency combination: state-of-the-art attribution accuracy at a fraction of the parameter count and inference cost of competing approaches. The paper further shows via ablation that both spatial and temporal attention contribute, with the full model achieving the best accuracy on every dataset.","pith_inferences":["If the classifier is separating manipulation families rather than individual models—for example, on FF++ the four classes are very different pipelines—the reported 'model attribution' may partly reflect coarse manipulation-type classification; a test on multiple variants of the same pipeline would clarify this.","The DFDM per-class accuracy spread (66.92% for FaceSwap versus 93.07% for DFL-H128) suggests attribution difficulty scales with architectural similarity, which could be probed by training on pairs of models with controlled architectural perturbations.","The spatial and temporal attention maps could be reused as a localizer for where generative artifacts live in a face, potentially informing attribution of unknown future models via anomaly localization.","A natural extension is open-set attribution: reporting not only which known model produced a video but also when no known model matches, which FAME's softmax head does not currently address."],"forward_implications":["Forensic tools could attribute a suspected deepfake to a specific open-source face-swap tool in near real time on modest hardware.","Lightweight attribution models could be embedded in social media or content-moderation pipelines where transformer-scale models are infeasible.","The DFDM performance gap suggests fine-grained decoder artifacts are learnable at 112×112 resolution, motivating lower-resolution forensic processing.","Near-perfect results on FF++ and FakeAVCeleb indicate the approach extends beyond pure face-swap autoencoders to reenactment, neural textures, and GAN-based lip-sync methods, though this also raises the question of what exactly is being attributed.","The low parameter count and fast inference open the door to on-device or edge deployment for media provenance verification."],"supporting_citations":[{"why":"Introduces the DFDM dataset of five encoder-decoder face-swap models and the DMA-STA attribution baseline that FAME compares against and outperforms.","marker":"[28]"},{"why":"CapST is the closest prior attribution method, combining capsule networks with temporal attention; FAME reports higher average accuracy with fewer parameters.","marker":"[4]"},{"why":"FaceForensics++ provides the FF++ benchmark with four manipulation pipelines, the dataset on which FAME reports 97.50% average attribution accuracy.","marker":"[46]"},{"why":"FakeAVCeleb supplies the multimodal deepfake dataset from which FAME uses five visual classes for its 96.77% average attribution result.","marker":"[31]"},{"why":"Supplies the premise that autoencoder-based face-swap pipelines smooth high-frequency artifacts, motivating the need for specialized spatio-temporal attribution models.","marker":"[16]"}],"fun_headline_variants":["FAME net names the face-swap model behind deepfakes","Lightweight model traces deepfakes to source in seconds","2.6M-param net beats larger models at deepfake attribution","Spatio-temporal attention improves deepfake model tracing","Efficient attribution: FAME outperforms on face-swap benchmarks"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The evaluation assumes that the class labels in DFDM, FF++, and FakeAVCeleb correspond to stable, decoder-specific generative signatures that the classifier learns, rather than dataset-specific biases, identity leakage, or broader manipulation-family differences.","fun_headline_variants_meta":{"raw":{"variants":["FAME net names the face-swap model behind deepfakes","Lightweight model traces deepfakes to source in seconds","2.6M-param net beats larger models at deepfake attribution","Spatio-temporal attention improves deepfake model tracing","Efficient attribution: FAME outperforms on face-swap benchmarks"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000189,"raw_usage":{"total_tokens":1273,"prompt_tokens":817,"completion_tokens":456,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":433,"completion_tokens_details":{"reasoning_tokens":369}},"tokens_in":433,"tokens_out":456,"duration_ms":4694,"temperature":1.0,"reasoning_tokens":369,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T04:04:25.630219+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train FAME on videos from a subset of source identities and test on held-out identities within the same generative models; if accuracy collapses, the model is learning identity or content cues rather than model signatures. Alternatively, retrain with class labels collapsed to manipulation families and compare accuracy; if FAME matches that family-level baseline, the method is not performing fine-grained model attribution.","supporting_citations":[{"cited_title":"Model attribution of face-swap deepfake videos","cited_arxiv_id":null,"evidence_quote":"Introduces the DFDM dataset of five encoder-decoder face-swap models and the DMA-STA attribution baseline that FAME compares against and outperforms."},{"cited_title":"Capst: Leveraging capsule networks and temporal attention for accurate model attribution in deep-fake videos","cited_arxiv_id":null,"evidence_quote":"CapST is the closest prior attribution method, combining capsule networks with temporal attention; FAME reports higher average accuracy with fewer parameters."},{"cited_title":"Faceforensics++: Learning to detect manipulated facial images","cited_arxiv_id":null,"evidence_quote":"FaceForensics++ provides the FF++ benchmark with four manipulation pipelines, the dataset on which FAME reports 97.50% average attribution accuracy."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"FakeAVCeleb supplies the multimodal deepfake dataset from which FAME uses five visual classes for its 96.77% average attribution result."},{"cited_title":"The deepfake detection challenge (dfdc) dataset","cited_arxiv_id":null,"evidence_quote":"Supplies the premise that autoencoder-based face-swap pipelines smooth high-frequency artifacts, motivating the need for specialized spatio-temporal attribution models."}],"review_version":1}