A deepfake is synthetic media created with deep learning that realistically depicts a real person saying or doing something they never said or did, most often by swapping or reanimating a face in video or by cloning a voice. In AI safety, deepfakes are a central example of generative AI misuse, because they can deceive individuals, damage reputations, enable fraud and erode trust in authentic recordings.
The term, a blend of deep learning and fake, emerged in 2017 from an online community that shared face-swapped videos. Since then, autoencoders, GANs and diffusion models have made convincing fakes cheaper, faster and accessible without expertise, while defenses have developed along three lines: detection, provenance and policy.
How deepfakes are created
Most deepfake techniques learn a compact representation of a person’s appearance or voice from example recordings and then generate new material from it. The classic face swap trains an autoencoder with a shared encoder and two decoders, one per person; encoding a frame of person A and decoding it with person B’s decoder places B’s face onto A’s expressions and head pose.
The table below summarizes the main technique families and what each requires.
| Technique | Underlying method | Typical input needed |
|---|---|---|
| Face swap | Autoencoder or GAN-based identity transfer | Minutes of video of both people |
| Face reenactment and lip sync | Models that drive facial motion from audio or another face | A single photo to a short clip |
| Voice cloning | Neural text-to-speech conditioned on a speaker sample | Seconds to minutes of clean speech |
| Fully synthetic faces | GAN or diffusion image generation | No real source person |
| Text-to-video with a real likeness | Diffusion video models with identity conditioning | Reference images of the person |
The amount of required data has fallen sharply. Early face swaps needed hours of footage and days of training on a GPU, whereas current voice cloning and one-shot reenactment tools can produce a usable result from a few seconds of audio or a single photo, often in real time.
Harms and risk categories
Deepfake harms fall into several categories that differ in who is targeted and how damage occurs. Risk assessment in AI safety considers both the direct harm and the broader loss of trust in genuine media.
| Category | Typical scenario | Main harm |
|---|---|---|
| Non-consensual intimate imagery | Sexual content showing a real person | Severe personal and psychological harm |
| Fraud and impersonation | Cloned voice of an executive or relative requests money | Financial loss |
| Political disinformation | Fabricated statement by a candidate before an election | Manipulation of public opinion |
| Identity verification attacks | Synthetic face defeats a video check | Account takeover and fraud |
| The liar’s dividend | Real evidence dismissed as fake | Erosion of accountability |
The liar’s dividend is a less obvious but serious effect: once fakes are widespread, people can deny authentic recordings by claiming they are synthetic. Defenses must therefore help prove what is real, not only expose what is fake.
Detection, watermarking and provenance
Defenses against deepfakes work at different points in the media life cycle. No single method is sufficient, so robust strategies combine several of them.
| Approach | How it works | Main limitation |
|---|---|---|
| AI content detection | Classifiers look for artifacts and inconsistencies | Accuracy drops on new generators and compressed media |
| AI watermarking | Generators embed a hidden signal in output | Only covers cooperating tools; can be weakened by editing |
| C2PA content credentials | Signed metadata records origin and edits | Metadata can be stripped; needs wide adoption |
| Liveness and challenge checks | Real-time tests during identity verification | Advanced real-time fakes can pass weak checks |
| Out-of-band verification | Confirming requests through a separate channel | Depends on consistent human procedure |
Detection is an adversarial arms race: each published detector gives creators a target to evade, and detectors trained on one generation of fakes often generalize poorly to the next. Provenance through C2PA content credentials reverses the logic by attaching verifiable origin information to authentic media at capture or creation.
Deepfakes compared with related forms of synthetic media
Not every manipulated or generated image is a deepfake. The defining features are the depiction of a real, identifiable person and the use of deep learning to make the result convincing.
| Concept | Real person depicted | Deception intended |
|---|---|---|
| Deepfake | Yes | Often, though not always |
| Cheapfake | Yes | Yes, using simple edits such as slowing or cutting video |
| Synthetic media in general | Not necessarily | Not necessarily |
| Licensed digital replica | Yes, with consent | No, use is disclosed and agreed |
Consent and disclosure separate legitimate uses, such as film dubbing, accessibility voices and authorized digital replicas, from abusive ones. Many regulatory frameworks, including the EU AI Act, require that synthetic content depicting real people be clearly labeled as artificial.
Practical safeguards and common mistakes
Organizations reduce deepfake risk mainly through process controls rather than technology alone. The following points summarize what experienced security teams emphasize.
- Verify unusual requests through a second channel, especially payment or credential requests made by voice or video.
- Agree on internal verification phrases or callback procedures for executives and finance staff.
- Do not rely on visual glitches: modern fakes rarely show obvious blinking or lighting errors.
- Treat detector scores as evidence, not proof, and combine them with context and provenance.
- Limit public voice and video samples of high-risk individuals where practical.
In everyday language
A deepfake is a fake video, photo or voice recording made by a computer. It is built to look and sound like a real person. It can show someone giving a speech they never gave. It can also copy the voice of a family member on the phone.
These fakes can be very convincing. The safest habit is to check surprising messages another way. For example, call the person back on a number you already know.
Seen in the real world
An employee in the finance department of a manufacturing company joins a video call that appears to include the chief financial officer and two colleagues. The CFO asks for an urgent transfer to a new supplier account. The faces and voices look and sound right, but every other participant on the call is a deepfake built from public conference videos.
Because the company has a rule that every new payment account must be confirmed by a callback to a number in the internal directory, the employee calls the real CFO, who knows nothing about the request. The transfer is stopped, the incident is reported, and the security team adds deepfake scenarios to its regular fraud awareness training. The procedure, not a detection tool, prevented the loss.