Deepfakes, explained.
How synthetic video and cloned voices actually get made, why "watch for the blinking" is a fading defense, and what a more durable answer looks like.
"Deepfake" gets used loosely for almost anything AI-generated, but the term has a specific lineage: synthetic or manipulated audio or video, produced with machine learning, that depicts a real person doing or saying something they never did — convincingly enough to be mistaken for genuine footage. What used to require a visual-effects studio and weeks of manual compositing now runs on a consumer GPU in minutes. That collapse in cost and skill is the entire reason deepfakes moved from an academic curiosity to a mainstream security concern in under a decade.
This piece covers, at a conceptual level and without the underlying math, how the two dominant generation techniques actually work, why classic detection advice like "look for unnatural blinking" is losing ground as models improve, and the more durable direction the field is moving toward instead: proving where content came from, rather than trying to spot fakes after the fact.
What "deepfake" actually covers
The word is an umbrella term for several distinct techniques, unified only by the fact that a model, not a person, produced the illusion:
- Face swap — replacing one person's face with another's inside existing footage, frame by frame.
- Face reenactment (puppetry) — driving a target face's expressions, mouth movements, and head pose from a separate source performance, without changing whose identity is shown.
- Fully synthetic generation — a face or a person that doesn't correspond to any specific real individual, often used to manufacture a fake persona or a fabricated "witness."
- Voice cloning — synthesizing audio in a specific person's voice, which is a separate technical problem from anything involving video and is covered in its own section below.
Video and voice deepfakes get lumped together constantly in coverage of the topic, but they're solved with related — not identical — model families, and they have meaningfully different practical implications, which is why this article treats them separately.
How synthetic video actually gets made
Two model families account for nearly all deepfake video in circulation today, and understanding the shift between them is the key to understanding why detection has gotten harder.
Generative adversarial networks (GANs)
A GAN trains two neural networks against each other. A generator produces synthetic images; a discriminator tries to tell those synthetic images apart from real ones. Every training round, the generator gets a little better at fooling the discriminator, and the discriminator gets a little better at catching it — an adversarial back-and-forth that, over enough iterations, converges on a generator capable of producing faces a human struggles to distinguish from photographs. Most of the deepfake tools that first drew public attention in the late 2010s — autoencoder-based face-swap software, the StyleGAN family of face generators — were built this way.
Diffusion models
Diffusion is the approach behind most of today's leading image, video, and audio generation systems, and it works on a different principle entirely. The model is trained to reverse a noise process: given an image that's been progressively corrupted with random noise until it's pure static, learn to predict, step by step, how to remove that noise and recover something coherent. At generation time, you start from actual random noise and run that learned denoising process forward, guided by conditioning input — a source face, a reference performance, a text description — until a finished frame emerges from what began as static.
The practical consequence matters more than the mechanism: diffusion models are typically trained on far larger and more varied datasets than earlier GAN pipelines, and they tend to leave behind fewer of the tell-tale visual artifacts — blurred hairlines, inconsistent backgrounds, waxy skin texture — that older detection heuristics were built around. That single shift is a major reason artifact-based detection, covered below, is getting less reliable over time rather than more.
| Approach | Conceptual mechanism | Typical era / artifacts |
|---|---|---|
| GAN | Generator and discriminator trained against each other until the generator's output fools the discriminator | First wave of public deepfake tools; more prone to visible blending seams and texture artifacts |
| Diffusion | Model learns to reverse a noise process, denoising step by step toward a coherent output guided by conditioning input | Most current state-of-the-art generators; fewer of the classic tells, harder to catch by eye |
Video deepfakes vs. voice cloning: two different pipelines
Voice cloning doesn't touch a video model at all. It relies on neural text-to-speech or voice-conversion systems trained to reproduce a target's timbre, pitch, and speech patterns. The practical difference that matters most for security purposes is how little source material each pipeline needs, and how close each can get to real time:
- Voice cloning can produce a convincing likeness from a small amount of reference audio — in some published research and commercial demos, well under a minute — and modern systems can run close to real time, which is exactly what makes live, phone-based voice-cloning fraud practical during an actual call rather than only in pre-rendered clips.
- Video deepfakes generally need more source footage of the target and meaningfully more compute to produce convincingly, especially live, during a video call, where the model has to track head movement, lighting changes, and occlusion in real time. Real-time face-swap tools for video calls exist and have improved quickly, but pulling one off convincingly in a live, improvised conversation remains technically harder than producing a pre-rendered or semi-scripted video clip in advance.
That asymmetry is one reason voice cloning shows up disproportionately in scams targeting individuals — a distressed-sounding phone call is cheap and fast to fake — while it's why deepfake video-call fraud tends to have a slightly more spectacle. We cover the individual-victim version of this in detail, including how to verify a suspicious call before acting, in AI voice cloning scam: is the call real? — the practical, victim-facing companion to this article.
Detection: the fading value of visual artifacts
For years, "how to spot a deepfake" guidance centered on a fairly consistent set of visual tells, and they were genuinely useful against the first generation of GAN-based tools:
- Unnatural or absent blinking — early face-generation datasets underrepresented closed eyes, so generated subjects sometimes blinked too rarely, or not at all.
- Lighting and shadow inconsistencies — a synthesized face lit differently than the background or the rest of the body.
- Blurred or warped edges — especially around hair, ears, glasses, and jewelry, where GAN-based blending tended to struggle.
- Temporal flicker — subtle frame-to-frame inconsistency in skin texture or facial geometry, visible mostly in slow motion.
- Audio-lip sync drift — mouth movements that don't quite line up with the audio, most noticeable on plosive sounds.
These heuristics are becoming less reliable, not more, as generation quality improves — and that trend line matters more than any individual tell. Diffusion-based generators, trained on larger and more diverse datasets and iterated on constantly by a large open community, have progressively closed the gaps that made earlier tells visible. Detection research has responded in kind, with its own machine-learning classifiers trained to spot statistical fingerprints — patterns invisible to the eye — left behind by specific generation pipelines. But that turns detection into an arms race: every improvement in generators erodes the detectors trained against the previous generation, and there is no guarantee detection keeps pace, or even stays close. Treating "I can usually tell" as a durable personal defense is a bet against a trend that has been moving in one direction for years.
The more durable approach: content provenance
Because after-the-fact pixel analysis is structurally on the losing side of an arms race, a different strategy has gained real traction: instead of asking "does this look fake," attach verifiable information about where a piece of media actually came from, at the moment it's created. That's the goal of C2PA — the Coalition for Content Provenance and Authenticity — a technical standard, backed by a broad coalition that includes Adobe, Microsoft, and the BBC among others through the Content Authenticity Initiative, for attaching cryptographically signed, tamper-evident metadata to media at the point of capture or edit. Content Credentials is the consumer-facing label and icon meant to surface that data to an ordinary viewer.
The metadata a C2PA-compliant file can carry includes which device or software captured or modified it, what edits were applied and when, and a signed chain of custody linking those events together. Tampering with the file after the fact — cropping it, re-encoding it, or splicing in generated content — either breaks the cryptographic signature or is recorded as a new entry in the edit history, rather than silently disappearing.
The important conceptual distinction is that this is not a deepfake detector. It doesn't analyze pixels or waveforms and output a probability that something was generated. Instead, it lets a viewer verify a positive claim — "this file was captured by this camera at this time" or "this specific software made this edit" — rather than relying on a negative, after-the-fact guess. That's precisely why it's considered the more durable direction: an arms race between generators and artifact-detectors favors whoever has more compute at a given moment, while a cryptographically signed provenance record doesn't degrade just because generation models get better.
It is not a complete fix, and it's worth being honest about the gap. Adoption is still partial — most cameras, phones, and social platforms don't yet universally attach or preserve C2PA metadata end to end. Credentials can be stripped by a screenshot or a naive re-encode. And provenance does nothing for the enormous volume of content, real and fake alike, that was never signed with credentials in the first place. It's infrastructure being built for the next decade of the problem, not a switch that solves the current one.
Why this matters for security
Fraud. Synthetic voice and video are now genuinely useful tools for social engineering, because they attack exactly the channel people have historically trusted as hard to fake: hearing or seeing someone they know. A well-documented, widely reported category of incidents since 2024 involves attackers using synthetic video and voice to impersonate a senior executive on a video call, or a series of calls and messages, instructing finance staff to authorize an urgent wire transfer — exploiting authority and urgency the same way a classic business-email-compromise scam does, but with a visual and vocal channel added that used to make people more confident a request was real, not less. The technique, not any single incident, is the durable lesson: the extra confidence a video call used to provide is exactly the channel now also being spoofed.
Disinformation. Fabricated statements attributed to public figures — ahead of elections, during breaking news events, or targeting a company's stock price — are the most discussed use case, but there's a subtler second-order effect known as the "liar's dividend": once deepfakes are widely known to exist, genuine, unaltered footage can be dismissed as "probably fake" by anyone motivated to deny it. That erosion of trust in real evidence is a security and information-integrity problem independent of whether any deepfake was actually used in a given case.
Impersonation. At the individual level, the same techniques enable nonconsensual synthetic imagery, targeted harassment, and fraud against ordinary people, not just corporations — including the "distressed relative" phone scam covered in our companion guide on AI voice cloning scams, where a cloned voice is used to simulate a family member in an emergency and pressure a quick, panicked payment.
What actually helps
Given that visual detection is getting harder and provenance infrastructure is still maturing, the defenses that hold up best right now are procedural, not perceptual:
- Out-of-band verification. For any request involving money movement, credential changes, or access, verify through a separate, previously known channel — a callback to a number you already had on file, not one provided in the suspicious message or call — regardless of how convincing the video or voice sounded.
- Pre-agreed verification phrases. A simple shared code word, agreed on in advance between family members or between finance staff and executives, is cheap to set up and defeats impersonation regardless of how good the synthetic media gets.
- Multi-person approval for high-stakes actions. Requiring a second, independent approver for large transfers or sensitive changes removes the single point of failure that a convincing impersonation is designed to exploit.
- Treat urgency and secrecy as the actual red flag. Almost every reported deepfake fraud pattern leans on pressure to act immediately and quietly. That combination is a far more reliable signal than trying to personally spot generation artifacts in real time on a call.
None of this requires becoming a personal deepfake detector, which is good, because that's an increasingly losing bet. It requires building verification steps into the moments that actually matter — money, credentials, access — so that even a flawless fake runs into a process it can't talk its way around.