A Deepfake Detector That Listens to a Face
When a person speaks, the face gives the game away. A hard "b" presses the lips shut. A wide vowel drops the jaw. Surprise lifts the brows a beat before the word lands. We read those correspondences without thinking, which is part of why a good deepfake feels wrong before we can say why: the mouth is roughly in sync, yet the fine grammar of a speaking face has drifted a fraction out of true.
A detector called ExposeAnyone is built on exactly that intuition. Rather than searching a frame for the tell-tale seams and compression artifacts that most forensic tools chase, it asks a different question. Given this audio, does the face move the way it should? The work, from Kaede Shiohara and Toshihiko Yamasaki at the University of Tokyo with Vladislav Golyanik at the Max Planck Institute for Informatics, was accepted to the CVPR 2026 Findings track, the conference's secondary tier rather than its main program, and posted as a preprint on arXiv.
The timing matters. Pixel-hunting detectors were tuned against an earlier generation of face-swap tools, and the arrival of systems like Sora 2 has quietly broken many of them. A model trained to spot the specific fingerprints of yesterday's fakes has little to say about a video generated a completely different way. On the authors' Sora-2 test set, two well-regarded detectors landed near chance: AltFreezing scored 27.31% AUC and LipForensics 46.29%, where 50% is guessing. ExposeAnyone reached about 94.44% on the same clips. (AUC, or area under the curve, runs from 50 for random to 100 for perfect; it captures how cleanly a detector separates real from fake across every threshold.)
Teaching a model what a real face does
The method leans on a face model called FLAME, which compresses the movement of a human face into a small set of numbers: 53 parameters in this case, 50 for expression and three for the jaw. Instead of tracking millions of pixels, the system tracks that compact description of how a face is actually moving.
Training happens in two stages, both self-supervised, meaning no human labels a single clip as real or fake. First the model pretrains on a large pool of genuine talking-head video, roughly 445 hours of it, learning the statistical link between what a voice is doing and what the face does alongside it. Then, for a specific person, it personalizes on a short reference video, about 15 minutes of processing per subject, to pick up that individual's particular habits of speech and expression.
Detection is the last step. Feed the system a suspect clip and it tries to reconstruct the face's motion from the audio alone, using what it learned about that person. A genuine video reconstructs cleanly, because the real face and the real voice belong together. A deepfake leaves a larger gap, the "diffusion reconstruction distance" the authors use as their signal, because the synthetic face was never truly driven by that audio in the way a real one is.
Across four standard benchmarks, DF-TIMIT, DFDCP, KoDF and IDForge, the approach averaged 95.22% AUC, which the paper reports as 4.22 percentage points ahead of the previous best method. The authors also say it holds up under blur and compression, the kind of degradation a clip picks up as it is re-shared across platforms.
What the numbers do and don't show
A few caveats travel with the results, and they matter for how far to trust the headline figure. The eye-catching Sora-2 number rests on the team's own new benchmark, a set built from just three subjects. That is the authors' evaluation, not an independent audit, and a three-person sample is a proof of concept rather than a broad measurement. It is also, so far, a single team's result: no outside group has yet reproduced it, which is normal for a fresh preprint.
The practical constraints are just as real. The system is not real-time. Inference runs at roughly 45.8 seconds for an eight-second clip, and it needs that heavy pretraining plus a per-subject personalization pass, which means a reference video of the person you want to protect. That makes it a strong fit for guarding known public figures, whose authentic footage is abundant, and a poor fit for scanning arbitrary video from strangers on the fly.
Even with those limits, the shift in strategy is the interesting part. Deepfake detection has largely been an arms race of surfaces, each new generator forcing detectors to relearn a fresh set of visual seams. Anchoring the test to something a forgery has to get right, the physical correspondence between a voice and the face producing it, is a bet that this signal ages better than the artifacts do. Whether it holds as video generators keep improving is exactly the question the next round of work, from this team and others, will have to settle.