GDE-071 |
Deepfake video detection | |||||||
AI-assisted investigation | ||||||||
October 2026 | ||||||||
01
What it is
A deepfake detector is a tool that estimates whether a video, or the face and voice in it, was generated or altered by AI. In OSINT it is one layer of a check that also tests provenance, earlier copies and the footage itself.
A deepfake is video or audio in which a person's face, voice or actions have been synthesised or swapped by a machine learning model. Detection works in two ways. Provenance checks look for signals a generator adds deliberately: C2PA Content Credentials, which are signed metadata describing how a file was made, and invisible watermarks such as Google's SynthID. Classifier detectors look for statistical traces of generation and return a probability rather than a finding.
Neither settles a clip alone. Journalists, fact-checkers and OSINT researchers combine both with keyframe searches and a frame-by-frame review to decide whether footage can be published.
| When to use this guide
|
02
How do you check if a video is a deepfake?
Preserve the file, read its provenance, trace earlier copies, then weigh detector scores against what the frames and audio actually show.
Seven tools cover the workflow. All have a free option, and only Gemini needs an account.
InVID-WeVerify plugin: Free Chrome extension, no login for core tools. Splits videos from YouTube, Facebook, Instagram, X and Dailymotion into keyframes for reverse search. Its beta synthetic image and voice cloning detectors are open to registered users.
yt-dlp: Free, open source, no login. A command-line downloader for thousands of sites that can also save the platform's metadata as JSON.
FFmpeg: Free, open source, no login. Command-line tools that extract frames and audio from a video; the companion ffprobe reports codec, duration and creation tags.
Content Credentials Verify: Free, no login. The Content Authenticity Initiative's inspector reads C2PA Content Credentials in MP4, MOV and AVI video, showing signer, creating tool and edit history.
Gemini: Free with a Google account. Checks videos shorter than 90 seconds and up to 100 MB for a SynthID watermark, reporting visuals and audio separately. It recognises Google AI content only, with about 10 video checks per 24 hours.
OpenAI Verify: Free, no login to upload; rate limits apply. Checks image and audio files, not video, for C2PA metadata and SynthID watermarks from OpenAI tools, so extract the soundtrack first.
Hive Detect: Free, no login to upload. A classifier for AI-generated and deepfake images, video and audio, with frame-by-frame analysis for video and audio files and probabilities for common generators such as Sora.
| Before you begin Stop at the login. Every check here except Gemini runs without an account. If a platform asks you to sign in to view a clip, use a dedicated research account, never your personal one, and log it. Legal considerations. Uploading to a detector sends a copy to a third party, so check its terms before using unpublished footage. Never upload intimate imagery or material involving children; route it to the platform's reporting channel and your legal adviser, as handling it can itself be an offence. |
Download the highest-quality version with yt-dlp, adding --write-info-json, and note the post URL, uploader and capture time in UTC. Hash it with sha256sum and test only copies.
Open the file in Content Credentials Verify for a C2PA manifest, then ask Gemini whether it was made with Google AI. Extract the soundtrack with ffmpeg -i clip.mp4 -vn audio.wav and check it in OpenAI Verify. A hit is strong evidence of origin; no hit proves nothing.
Run the post URL through the InVID-WeVerify plugin keyframe tool, or extract a frame at each shot change with ffmpeg -i clip.mp4 -vf "select='gt(scene,0.4)'" -fps_mode vfr frame_%03d.png. Keep frame numbers so each observation maps to a timestamp.
Search the clearest frames on Google Lens and TinEye, sorting TinEye by oldest. Many deepfakes are built on real footage, and finding the original interview with a different face or different words settles the question faster than any detector.
Upload the master copy to Hive Detect and record the score, the flagged frames and any generator named. Treat the result as a pointer, not a verdict.
Step through flagged sections at full size. Check mouth and teeth against the audio, the edges of hair, glasses and earrings, hands, eye reflections and shadows on the face. Listen for breathing and room tone. Screenshot each anomaly with its frame number.
Note which way each layer points: provenance, earliest copy, detector score and visual review. Call a clip synthetic only when two independent layers agree, authentic only on a positive trail to the original, and unresolved otherwise.
|
03
Where deepfake detector results mislead
Each layer answers a narrower question than it appears to, and most errors come from reading one signal as the whole answer.
Deepfake detector score treated as a finding: Classifiers return a likelihood, not a determination. Compression, beauty filters and upscaling can push genuine footage high, while newer generators can score low. Verifying check: re-run on the best copy you hold and require support from a non-classifier layer before concluding.
No watermark read as not AI: Provenance checks recognise only generators that add these signals, and many platforms strip metadata on upload. A clean result is common for genuine and synthetic clips alike. Verifying check: record which generators each tool covers and carry the clip through the keyframe and classifier layers.
Genuine video with a cloned voice read as authentic: Real footage can carry a cloned soundtrack that a visual check will pass. Verifying check: test the audio separately, compare lip movement with speech at reduced speed and look for the footage elsewhere with different sound.
Compression artefacts read as a deepfake seam: Blocking and smearing around fast movement are normal in re-encoded video and can look like the edge of a face swap. Verifying check: compare several copies; artefacts that shift between copies come from encoding, while a flaw fixed at the same frame in every copy needs a closer look.
A clip that passes every check read as accurately described: Old, real footage reposted with a false caption passes every synthetic-media test. Verifying check: establish the earliest copy, date and place, and report miscaptioned footage as miscaptioned.
Chain of custody: A deepfake verdict is only as strong as the record behind it. Detectors change and posts vanish, so keep enough for a colleague, editor or court to repeat each check.
Hash the master file and its metadata JSON with SHA-256 before any analysis.
Archive the original post and record the uploader, post time and capture time in UTC.
Save every detector and provenance result as a screenshot or export, with the tool name, date and file hash.
Keep extracted keyframes and audio with their frame numbers and timestamps.
Log every reverse search, the earliest match found and its date.
Record which layers supported, contradicted or could not test the finding.
04
Go deeper
Take the method further with the AI detection card and the verification tutorials.
CARD · AIV-002 · SIGNAL TIER
AI-generated image and video detection for OSINT investigators
Hive Moderation, Optic and ExifTool in sequence, with false-positive checks built in.
METHODS · SIGNAL TIER
Detecting deepfakes in video and audio verification
Provenance inspection, classifier scoring and perceptual analysis for a defensible verdict.
METHODS · SIGNAL TIER
Capstone: verifying crisis footage end-to-end
Geolocation, chronolocation, source tracing and satellite corroboration in one workflow.
Evidentiary standard
Signal & Shadow operates to the LST-001 evidentiary standard. All claims are graded against the LST-001 v1.0.3 confidence tiers (Confirmed, Corroborated, Reported, Alleged) per the canonical voice and structural specification.
About Signal & Shadow
Signal & Shadow is an independent forensic investigation and methodology practice publishing tutorials, reference cards, and forensic dossiers for working practitioners. Founded by Derek Bowler.