Project · Generative Model Forensics

Deepfake Detection via Diffusion Reconstruction Error

Using a diffusion model's own inversion error as an engineered feature that turns a hard non-linear problem into a nearly linearly separable one

Harishwar Rao J.

IISER Bhopal · Nov 2025

Code & weights

DIRE maps for real and generated faces — DIRE maps. Top row: real faces, bright and structured, with high reconstruction error. Bottom row: generated faces, near-black, with almost no error. The classifier's job is now close to trivial.

Overview

A diffusion model reconstructs its own outputs far better than it reconstructs the real world. That asymmetry is the detection signal, and it is strong enough that most of the work goes into the feature rather than the classifier.

The core hypothesis, following DIRE[1], is that a partially-trained, "brittle" diffusion model can faithfully reconstruct images it generated itself, but will fail on real images that lie outside its learned manifold. The DIffusion Reconstruction Error (DIRE) exploits that failure directly: invert an image to its latent, sample back, and take the per-pixel absolute difference.

96.65% Test accuracy
on 2,000 held-out images

3 blocks CNN trained
from scratch

10,000 DIRE maps
5k real / 5k generated

The DIRE Signal

For an image x₀, the DIRE map is the per-pixel absolute error between the image and its reconstruction after a full inversion-and-sampling cycle:

D(x₀) = | x₀ − x₀^recon |

Inversion (0 → T). The image is deterministically inverted through the DDIM[3] process (100 steps) to recover its corresponding latent x_T. DDIM's determinism is what makes this well-defined. A stochastic sampler would inject noise into the round trip and destroy the signal.
Reconstruction (T → 0). That latent is sampled back to an image with deterministic DDIM (η = 0).
Difference. The absolute per-pixel error becomes a new 64×64×3 image.

Real faces come back with high, structured error, giving bright maps. Faces generated by the same DDPM come back with near-zero error, giving almost black maps.

Data

Real: CelebA[4], resized to 64×64.
Generated: images sampled from a DDPM[2] I trained myself on 64×64 CelebA.
10,000 images total (5k real, 5k generated), processed into DIRE maps and split 80/20 into an 8,000-image train/val pool and a 2,000-image held-out test set.

Why This Works: The EDA

Before building any classifier, the exploratory analysis had already made the case. Pixel-intensity histograms of raw real vs. generated faces overlap almost perfectly, so global colour and brightness statistics carry essentially no signal. On DIRE maps the same histograms separate cleanly, with real images concentrated at high error and generated images decaying exponentially toward zero.

PCA makes it starker. Projected onto their first two principal components, raw images form one overlapping blob: the real/fake distinction is real but highly non-linear and subtle. The same projection on DIRE maps shows remarkable near-linear separability.

PCA of raw pixels vs PCA of DIRE maps — PCA projection of real vs. generated faces. Left: raw pixels, where classes overlap heavily. Right: DIRE maps, where the generated class collapses into a tight cluster, well separated from the real one.

Why the classifier is small. A large pretrained backbone like ResNet-50 is trained to find natural image features (fur, eyes, edges), not the abstract artefact patterns in a DIRE map. Given how separable the features already are, the right move is a lightweight 3-block CNN trained from scratch, whose only job is to distinguish "artefact-filled" from "near-black". The features did the work, so the model could stay simple.

Results

The DireClassifier: three conv/batchnorm/pool blocks (16 → 32 → 64 channels) into a 256-unit FC layer with dropout, was trained from scratch with BCEWithLogitsLoss and Adam. Validation accuracy held steadily in the 95–97% range with no significant overfitting.

Class	Precision	Recall	F1	Support
Real	0.96	0.98	0.97	1000
Generated	0.98	0.95	0.97	1000
Overall accuracy	96.65%			2000

Confusion matrix: 979 true negatives and 21 false positives on real images; 954 true positives and 46 false negatives on generated ones, which is balanced performance across both classes.

Limitations

Two problems are intrinsic to the approach, and both matter more than the headline accuracy:

The detector needs a mediocre generator. The signal exists because the reference DDPM is imperfect. A fully converged model that generates faces perfectly would reconstruct real images well too, and the DIRE maps would stop being distinguishable. So the method gets weaker as generators get better.
Poor cross-generator transfer. Images produced by a model other than the one used to construct the DIRE maps are frequently misclassified. The feature encodes distance from one specific model's manifold, not a universal "syntheticness".

Future work would start with augmentation applied to the DIRE maps themselves (flips, rotations) to stabilise validation and reduce the minor overfitting observed.

References

Z. He, et al. DIRE: Diffusion-based Representation for Deepfake Detection. ICCV, 2023.
J. Ho, A. Jain, P. Abbeel. Denoising Diffusion Probabilistic Models. NeurIPS, 2020.
J. Song, C. Meng, S. Ermon. Denoising Diffusion Implicit Models (DDIM). ICLR, 2021.
Z. Liu, P. Luo, X. Wang, X. Tang. Deep Learning Face Attributes in the Wild (CelebA). ICCV, 2015.

DDIM Inversion Deepfake Detection Feature Engineering PCA Forensics