Introduction
The increasing availability of synthetic media generated by generative adversarial networks (GANs) and related models has made deepfake detection a practical necessity for fact-checkers, technology providers, and regulators. A number of effective detection approaches apply methods originally developed for steganalysis — the analysis of media to identify hidden information. This article reviews key steganalysis techniques that have been adapted for deepfake detection.
What is steganography?
Steganography is the practice of embedding hidden information into digital media in a way that is not visible to the human eye. For example, in an image, a simple method of steganography might encode a sequence of ones and zeroes by modifying pixel values so that:
- a pixel encodes a 1 if its value is made odd
- a pixel encodes a 0 if its value is made even
The original pixel values are adjusted slightly to achieve this, in a way that does not produce a visually noticeable change. As any message can be encoded as a series of ones and zeroes, any message can be included in an image, or series of images, in this way. However, this process introduces small statistical anomalies. For instance, the natural distribution of even and odd pixel values in authentic images tends to follow predictable patterns. Modifying pixel values to encode hidden data disturbs these patterns.
Steganalysis methods are designed to detect these anomalies. They do so by analyzing statistical properties of the image and comparing them to the distributions expected in unaltered media. The same principle applies when detecting deepfakes: although the modifications are made for synthesis rather than for hiding data, they often result in detectable statistical irregularities.
Why steganalysis is relevant to deepfake detection
Steganalysis focuses on detecting small statistical or structural anomalies introduced when digital media is modified to conceal information. These techniques are designed to identify changes that are imperceptible to humans but detectable through statistical analysis. Deepfake generation introduces similar anomalies. Although the output is designed to look natural, it often contains artifacts that can be identified using steganalysis.
Both steganalysis and deepfake detection involve analyzing media for deviations from the statistical properties expected in authentic content.
Steganalysis techniques applied to deepfake detection
Statistical feature extraction
Steganalysis often relies on high-dimensional feature representations that describe relationships between pixels, residuals, or transform coefficients. One well-known example is the rich model proposed by Fridrich and Kodovsky (2012), which extracts thousands of features capturing co-occurrence patterns and higher-order dependencies.
In deepfake detection, similar features are used to characterize the statistical structure of authentic images. Synthetic images often disrupt these structures, enabling classifiers to separate real and fake media. Verdoliva et al. (2020) describe how steganalysis-based feature extraction contributes to media forensics, including deepfake detection.
Residual and noise analysis
Steganalysis methods often apply filters to separate an image’s content from its noise component. Modifications from hidden data change the statistics of these residuals.
Deepfake detectors use similar approaches. GANs frequently produce high-frequency artifacts or noise patterns that differ from those found in natural images. By extracting and analyzing residuals, detectors can identify images generated by GANs or similar models.
Frequency domain analysis
Steganalysis commonly examines media in the frequency domain, for example using the discrete cosine transform (DCT). Embedding hidden data often changes the distribution of frequency coefficients.
In deepfake detection, frequency domain features are useful because synthetic images frequently fail to replicate the frequency statistics of real images. Durall et al. (2020) demonstrated that GAN-generated images often have distinctive frequency spectra, which can be used for reliable detection.
Texture and local co-occurrence features
Steganalysis makes extensive use of local texture descriptors, such as local binary patterns (LBPs) and Markov models of pixel or residual dependencies.
In deepfake detection, these methods help identify small-scale inconsistencies that are difficult for GANs to model accurately. Local patterns in regions such as hair, skin pores, or eyes often reveal artifacts that are not apparent at a global level. Matern et al. (2019) showed that these features can expose manipulated or synthetic faces.
Calibration techniques
Calibration is used in steganalysis to identify hidden data by recompressing or re-encoding media and analyzing the differences in feature statistics before and after calibration. Hidden data often alters these differences in detectable ways.
Deepfake detectors sometimes apply similar strategies. By recompressing or resizing media and observing how feature statistics change, they can detect synthetic content that is more sensitive to such operations than authentic data.
Combining steganalysis with deep learning
Many modern deepfake detection systems combine steganalytic pre-processing with deep learning models. For example, residual maps, frequency transforms, or other representations that emphasize artifacts are provided as inputs to convolutional neural networks (CNNs). This combination takes advantage of both domain-specific feature engineering and data-driven learning.
Li et al. (2020) proposed a method called Face X-ray that detects blending artifacts at the boundaries of manipulated regions in facial images. Although not directly developed as a steganalysis method, the approach applies similar principles by analyzing local statistical irregularities.
Limitations and ongoing challenges
Steganalysis-based methods have proven valuable in deepfake detection, but they face several limitations:
- Generalization to new synthesis methods remains a challenge. Many detectors perform well on deepfakes created using known architectures but are less reliable on content generated by novel or fine-tuned models.
- Detection performance can degrade when media is subjected to common post-processing operations such as compression or resizing.
- Deepfake generation techniques are improving and can increasingly minimize detectable artifacts, reducing the effectiveness of steganalysis-based approaches.
Current research is focused on addressing these challenges by combining steganalysis techniques with other detection methods, including multimodal analysis, provenance tracking, and causal inference.
Conclusion
Steganalysis has provided many of the foundational techniques now used in deepfake detection. Methods developed to detect hidden data in digital media are well suited to identifying artifacts left by synthetic content. As synthetic media generation methods continue to evolve, detection systems are expected to integrate steganalysis-based approaches with additional forensic and machine learning techniques to improve reliability.
References
Fridrich, J., & Kodovsky, J. (2012). Rich models for steganalysis of digital images. IEEE Transactions on Information Forensics and Security, 7(3), 868–882. Find this paper here.
Verdoliva, L., Poggi, G., & Cozzolino, D. (2020). Media forensics and deepfakes: an overview. IEEE Journal of Selected Topics in Signal Processing, 14(5), 910-932. Find this paper here.
Durall, R., Keuper, M., & Keuper, J. (2020). Watch your up-convolution: CNN-based generative deep neural networks are failing to reproduce spectral distributions. CVPR Workshops 2020. Find this paper here.
Matern, F., Riess, C., & Stamminger, M. (2019). Exploiting visual artifacts to expose deepfakes and face manipulations. WACV 2019. Find this paper here.
Li, Y., Yang, X., Sun, P., Qi, H., & Lyu, S. (2020). Face X-ray for more general face forgery detection. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 5001–5010. Find this paper here.