Can humans or their brain signals reliably tell deepfake videos from real ones?

Testing the viewer as the attack target

Most deepfake research asks whether a machine detector can flag a manipulated video. This paper asks a different question: if a deepfake is aimed at a person, does the person's conscious judgment, or the perceptual processing underneath it, register that something is wrong? The authors frame deepfakes as adversarial payloads, meaning candidate manipulations that are tested against human observers and kept if they get through.

That framing produces two success criteria. Behavioral compromise means a viewer accepts a manipulated clip as authentic. Subconscious evasion means the viewer's EEG and gaze measurements show no distinct response to fake versus real footage. A payload that clears both is treated as effective against an unaided viewer. The authors also state plainly that behavioral compromise alone decides whether an attack works in practice; the neural measure answers a separate question about whether any latent signal remains that a defense could surface.

Real, deepfake, and look-alike clips in one design

The experiment showed participants real videos, deepfake videos, and look-alike videos while recording behavioral judgments, EEG, and eye movements. Stimuli came from Celeb-DF and a curated celebrity set. The look-alike condition consists of real, unmanipulated footage of people who resemble the target identity, so it separates an identity mismatch from a synthetic manipulation.

Familiarity was manipulated rather than held constant: some identities were familiar, some briefly familiar, and some were look-alikes. EEG was collected from five channels and summarized as cognitive-state metrics over one-second epochs, with power spectral density examined across theta, alpha, beta, and gamma bands. Eye-tracking recorded fixations, gaze duration, and saccades, with areas of interest defined on the actors' eyes, mouth, and head.

The final EEG analysis included 20 participants after four were excluded for noisy signals; eye-tracking and behavioral data from 24 participants were retained. Participants were not told the study focused on deepfakes, and 97.4% of clips were new to them, which limits prior-exposure effects.

No neural or gaze signal separated fake from real

The central result is a null: no statistically significant neuro-physiological differences emerged between real and deepfake videos. This ran against the authors' expectation, which drew on predictive-coding work and earlier findings that paintings and phishing websites can produce implicit neural responses even when people misjudge them.

The look-alike condition is what makes that null interpretable. EEG measures distinguished look-alike from familiar and briefly familiar conditions at p = 0.017, 0.04, and 0.025, and distinguished video trials from rest. Gaze measures resolved significant differences across areas of interest within videos at p < 0.001. In other words, the instruments detected differences where differences existed, so the absence of a real-versus-deepfake effect is unlikely to be a measurement failure.

The authors are careful about the timescale. Their cognitive-state measures aggregate over one-second epochs and cannot resolve transient, time-locked components. A brief error-related negativity around 1.3 seconds, of the kind another study reported, would not be visible in this analysis. The null therefore concerns sustained differential engagement, not every possible neural response.

Familiar faces produced more false acceptance

Behaviorally, participants accepted 26.68% of manipulated clips as authentic, and that figure rose to 31.94% for familiar identities. In the discussion the authors report that familiar deepfakes yielded a 32% false positive rate and only 23.15% accuracy, while participants identified human impostors in the look-alike condition with 95.24% accuracy.

The familiarity comparison needs care. Participants also shifted their response criterion toward rejection for unfamiliar faces: genuine briefly familiar clips were rejected at 28.24%, against 9.61% for familiar ones. Overall accuracy was actually lower for the briefly familiar condition, 75.69%, than for the familiar condition, 79.22%. The authors therefore describe the familiarity effect as a shift in the direction of errors rather than a uniform loss of sensitivity.

They also consider an alternative: generators may have been trained on more footage of widely recognized people, making those deepfakes technically better rather than their viewers more susceptible. The Celeb-DF portion holds generator exposure roughly constant because all identities come from the same pool and a single synthesis pipeline, and the false positive rate still differed substantially, 31.94% versus 20.37%. The authors do not treat the alternative as excluded, because the curated celebrity material was sourced externally and confounds prominence with generation quality, and per-clip technical fidelity was not measured.

Why a missing signal limits viewer-based defenses

The two-level design matters because it changes which defenses remain plausible. If a deepfake is accepted behaviorally but still produces a distinct neural or ocular response, that signal exists inside the observer and could in principle be surfaced, either by instrumenting the viewer or by directing attention to the regions already producing the response. If no such response occurs, there is nothing latent to surface, and defenses that depend on reading human perception cannot succeed regardless of sensor quality.

The authors connect this to consumer EEG and eye-tracking hardware becoming inexpensive enough for large-scale deployment, and to proposals for gaze-aware or neuroadaptive protective interfaces that assume human perception yields a usable signal. For the content examined here, they conclude it does not. Their stated implication is that mitigation must come from automated detection, provenance and watermarking standards, and platform-level controls rather than from the viewer.

The framework is explicitly dual-use. An adversary with equivalent measurements could iterate on candidate manipulations and retain those that evade human detection, which is the authors' argument for open, defensive evaluation. Measuring which deepfakes defeat human perception sets a realistic bound on attacker capability against which detection tooling, provenance mechanisms, and user-facing protections can be assessed.

Where the conclusion stops

The stimuli were silent, so the findings speak to visual deception alone and may understate susceptibility to multimodal deepfakes that combine manipulated video with synthesized speech. The laboratory setting may not capture real-world encounters, and the sample lacked broad demographic diversity, precluding analysis by age, gender, cognitive ability, or technical familiarity.

The comparison with a superficially similar eye-tracking and EEG study is also framed as a scope condition rather than a contradiction. The authors list methodological differences that could explain the divergent findings: a transient component at roughly 1.3 seconds that their aggregated measures cannot resolve, gaze effects that depend on a wider scene than head-and-shoulders footage offers, and an explicit real-versus-fake forced choice rather than their identity judgment, which may not engage the same error-monitoring process.

Confidence did not substitute for discrimination: 22 of 24 participants knew the term deepfake and were confident in detecting them, yet no consistent neuro-physiological differentiation appeared. The authors read this as evidence that self-assessment is a poor proxy for objective detection.

The priority the paper establishes

The paper's most decision-relevant split is not real versus fake in general but familiar versus unfamiliar identities under a criterion shift. Familiar deepfakes drew the highest false acceptance, 31.94%, while unfamiliar faces drew more rejection of genuine clips, 28.24%, and lower overall accuracy, 75.69%. A defense that assumes viewers will be more careful with people they do not recognize is therefore not supported by these numbers; the errors move rather than shrink.

The second priority is the look-alike benchmark. Human impostors were caught at 95.24% accuracy while synthetic manipulations of familiar identities produced a 31.94% false positive rate, which locates the vulnerability in synthesis rather than in identity mismatch. Combined with the absent neural and ocular signal, that comparison is the paper's strongest argument that protection has to sit in detection tooling, provenance, and platform controls, and that any viewer-side interface promising to surface an implicit cue has to show that a cue exists first.

Sources used in this answer