Partial deepfake edits slip past both detectors and human viewers

We tend to picture deepfakes as clips that are synthetic end to end. What actually turns up in the wild, more and more often, is the careful partial swap: not the whole video, but a small piece of it — a gesture, a face, an object on the table, a few frames in the middle. Edits that precise do not catch the eye, and they hide perfectly inside genuine footage. The authors of FakeParts argue that these partial manipulations are the dangerous case right now: they fool people and algorithms alike, and there is almost nowhere to test against them honestly. The team's answer is a new class of deepfakes, FakeParts, and a large benchmark, FakePartsBench.

Why this is a problem now

Current video generators no longer leave the familiar traces. In the authors' experiment, people who had been told the clip might be AI-generated were markedly worse on partial edits than on classic deepfakes — a drop of more than a third. The best detectors slipped too: some latch onto low-level artifacts and fall apart on diffusion models; others read semantics but miss a neatly executed piecewise swap.

What the authors propose

FakePartsBench is more than 25,000 short clips, assembled from real video and from generated sources. The set is balanced between fully synthetic clips and three kinds of partial manipulation:

• spatial: face swaps, removing regions and filling them back in;
• temporal: frame interpolation;
• style: changes to color and texture that leave the structure of the scene intact.

All of it carries fine-grained annotation at the frame and pixel level. One detail matters: high resolution and current models, including closed systems such as Sora and Veo2 — those are what set the real threat landscape, not just lab examples.

How the set was built

Real video came from public datasets (DAVIS, YouTube-VOS and others). Full deepfakes were generated in several modes — text-to-video, image-to-video, and the TI2V hybrid; prompts were extracted by the vision-language model PaLI-Gemma 2, with the source frames and captions kept alongside.

Partial manipulations were built modularly:

• FaceSwap on top of InsightFace;
• inpainting and outpainting, with masks selected through Grounded-SAM-2, filling by DiffuEraser/ProPainter and consistent boundary completion by AkiRA;
• motion interpolation with Framer;
• style edits with RAVE — recoloring an animal, say, while the motion of the scene stays intact.

That coverage gives a realistic spread of attacks, from micro-edits to elaborate composites.

What the tests showed

The team compared frame-level and video-level detectors alike: classic CNNs and frequency-domain models, CLIP-based approaches, and current video architectures (DeMamba, AIGVDet, for example). Here is where things stand:

• failure across the board on the hard cases: accuracy falls sharply on full deepfakes and on FakeParts alike;
• older CNN detectors lose the signal almost entirely on diffusion video;
• models that lean on semantics (the CLIP family) are better at catching subtle local edits, but worse on whole clips produced by strong T2V systems;
• hybrids that combine spatial features with motion (optical flow) win on face swaps, but are still vulnerable to careful inpainting and outpainting.

Put differently, today you have to choose between sensitivity to artifacts and understanding of meaning. FakePartsBench makes that trade-off measurable on honest terms, and pushes toward combining the two strengths.

People get it wrong too

In a user study run through an online interface, about 80 participants rated 20 clips each, roughly 1,600 judgements in all. Mean accuracy was 75.3%. Participants did best on loud style edits and worst on micro-edits to objects and on interpolation. High-quality fully synthetic clips — consistent motion, stable lighting — were also often taken for real.

What this changes

The work opens up a blind spot cleanly: partial edits are treacherous precisely because they keep the context and swap the meaning. What is needed are detectors that at the same time:

• are sensitive to local inconsistencies and small spatial errors,
• account for motion and for the consistency of light and shadow over time,
• do not depend on a particular generative model or resolution.

The authors show that combining semantics and dynamics genuinely helps, but a lot of engineering work lies ahead. The limitations are stated honestly: generating a set like this is expensive, the effect of the size of the edited region is worth studying, and misuse risks need to be managed. Even so, the community now has a realistic proving ground for the next generation of detectors.

💾 Code