Securitylab•November 14, 2026•🇷🇺Translated from Russian

Detecting Deepfakes: Tools, Signs, and Verification Methods for Video, Photos, and Voice

Calls from a boss requesting urgent money transfers via video link or voice messages from relatives asking for help are no longer reliable indicators of authenticity. A well-known politician making controversial statements on camera may also be fabricated. The face looks real, the voice sounds familiar, and lip movements match the speech, yet none of these elements now guarantee that the person is genuine.

Neural networks have learned to convincingly reproduce human appearance, voice, and movements while creating entire video scenes from scratch. Older advice about counting extra fingers or unnatural blinking works less effectively today. This article examines the signs that help detect deepfakes, the services available for verification, and why even professional detectors sometimes fail.

What Is a Deepfake and Which Fakes Are Common

A deepfake is an image, audio, or video created or substantially altered using neural networks. The term combines deep learning and fake. Algorithms can replace a person’s face in an existing video, make them say words they never spoke, or generate an entirely fictional scene.

Early mass deepfakes were often produced with GAN adversarial networks. Modern systems employ more varied technologies, including diffusion models and transformers. Generation quality now aligns facial expressions, lip movements, lighting, and speech, making detection significantly harder.

In practice, several types of fakes appear:

  • Face swap. A different person’s face is overlaid on existing video while preserving body and head movements.
  • Speech replacement. Lip movements and expressions are altered so the person appears to say different words.
  • Voice cloning. The neural network reproduces timbre, pronunciation, and intonation from speech samples.
  • Fully synthetic video. Characters, objects, and environments are generated without any real footage.
  • Combined fakes. Face, voice, and individual video elements are altered simultaneously.

Not every fake video is created by neural networks. Real footage can be misrepresented, interview segments rearranged, or false subtitles added. Verification must therefore examine both technical file authenticity and the circumstances of recording.

Signs That Reveal a Deepfake

Even high-quality generation sometimes leaves noticeable errors. Defects become especially visible during movement, object interaction, and lighting changes. Suspicious footage should be viewed at reduced speed with pauses on complex scenes.

The following details most often deserve attention:

  • Face and hair. Head turns alter chin, ear, or nose shape. Hair blurs and glasses or jewelry deform in individual frames.
  • Lips and teeth. Articulation does not fully match speech. Teeth change shape or momentarily disappear.
  • Lighting. Shadows on the face do not match surrounding objects and highlights move without clear reason.
  • Hands and objects. Fingers pass through items, proportions break, and clothing details shift position.
  • Background and text. Text becomes unreadable, signs change content, and objects suddenly appear or vanish.
  • Sound. Strange stresses, intonation breaks, unnatural pauses, or acoustic mismatch between voice and environment occur.

For photographs, examining related details helps. A person’s reflection in a mirror must match their pose, shadows must align with lighting, and signs must retain meaning. If a photo supposedly shows a known street, buildings and object positions can be compared with other images of the same location.

However, these signs do not prove forgery. Video compression, poor lighting, and unstable connections produce similar defects. A well-generated recording may contain no obvious errors at all.

How to Verify Suspicious Video or Photographs

Finding the original source is often more effective than pixel-level analysis. If a clip supposedly shows today’s statement by a public figure but the original recording exists in an archive from years ago, the deception can be uncovered without specialized detectors.

For most cases, five sequential actions suffice:

  • Locate the original source and confirm the event through official channels or independent witnesses.
  • Perform reverse image search using Google Images, Yandex Images, or TinEye. Extract key frames from video for separate checks.
  • Compare circumstances including date, location, signs, clothing, and other details.
  • Examine the original file’s metadata and editing traces when available.
  • Apply a detector if needed and cross-reference results with other evidence.

The free InVID-WeVerify browser extension assists with extracting keyframes, running reverse searches, studying metadata, and performing visual analysis, especially useful for social-media videos.

Services and Tools for Deepfake Detection

Specialized services search for statistical generation artifacts, image anomalies, frame inconsistencies, and synthetic speech features. Notable tools include:

  • DeepFake-o-Meter – research platform supporting multiple algorithms for photos, video, and audio.
  • Reality Defender – commercial platform analyzing files, voice calls, and video conferences.
  • Sensity AI – combines image, voice, file structure, and metadata analysis with enterprise deployment options.
  • InVID – helps locate original sources and examine materials rather than acting as a universal AI detector.

Before uploading files to any service, review data-processing terms, as personal photographs and recordings may contain confidential information.

How Detectors Work and Why They Fail

Automatic systems analyze color distribution, textures, spatial frequencies, and inter-frame inconsistencies. Some approaches, such as Intel FakeCatcher remote photoplethysmography, detect subtle skin-color changes linked to blood flow. Poor lighting, movement, and compression can mask these signals even in genuine video.

The main limitation is the detectors’ ability to recognize fakes produced by unknown generators. Performance often drops on real-world social-media content compared with laboratory datasets such as Deepfake-Eval-2024.

Standards such as C2PA and technologies like SynthID embed cryptographically signed metadata or invisible watermarks. These methods have limitations because metadata can be stripped during transmission and not all generators support watermarks.

Recognizing Fake Voices and Protecting Against Fraud

Voice deepfakes are especially dangerous because people instinctively trust familiar voices. Modern synthesis reproduces timbre, intonation, pace, and emotional nuance. A real-world example involved an employee at the Hong Kong division of engineering firm Arup who was deceived by a deepfake video conference and authorized 15 transfers totaling approximately 200 million Hong Kong dollars.

Recommended protective measures include refusing urgent financial requests without independent verification, contacting the supposed sender through a known trusted channel, and maintaining pre-agreed family code phrases. Companies should enforce formal approval procedures for large payments regardless of how authentic the video or voice appears.

No universal method exists for detecting deepfakes. The most reliable approach combines source verification, technical analysis, and independent confirmation of content.

Related articles

Habr•AI Security

Can Open-Source AI Agents Replace Pentesters? Strix and PentAGI Tested on Real 200-Host Perimeter

An independent researcher evaluated two open-source LLM-based pentesting agents, Strix and PentAGI, against a live external perimeter containing roughly 200 active hosts. Both tools autonomously planned tasks, executed CLI utilities, generated proofs of concept, and produced reports while running inside isolated Docker sandboxes. Strix delivered only 15 findings with almost no false positives yet consistently overstated severity, while PentAGI reported 296 vulnerabilities including 42 critical issues, none of which proved exploitable. Real critical vulnerabilities on the same scope, including an RCE chain, were discovered only by a commercial autonomous scanner. The experiment highlighted fundamental limitations in scope control, context management, and risk assessment that still require human oversight. Token consumption reached 145.1 million for Strix and 31.4 million for PentAGI, illustrating the cost of maintaining long-running autonomous operations.

安全客•AI Security

Thousands of Grok-Generated Apps Expose Sensitive Corporate Data Through Default Public Access

Security firm Claroc scanned 43,551 Grok-built application addresses and found 37,571 still online, with 94.7 percent requiring no login. Approximately 650 to 800 of these apps contained sensitive internal data belonging to SpaceX, X, Tesla, and 30 other organizations, including six Fortune 500 companies. Exposed records included ICU patient reports with lab results and ventilator status, contractor timesheets containing plaintext passwords, and Tesla service-center performance evaluations listing employee names, efficiency metrics, and bonuses. Researchers demonstrated that Grok sometimes inverts permission-check logic, allowing unauthorized Google accounts to view and modify data after login. In contrast, ChatGPT-generated apps default to private settings, preventing access even when URLs are discovered via passive DNS. The incident highlights how AI coding tools lower the barrier to publishing internal applications while weakening the review processes that traditionally protected sensitive data.

Habr•AI Security

Enterprise Security Requirements Push Russian Developer to Deploy 125B MoE LLM Locally on Consumer Hardware

A cybersecurity journalist and platform developer detailed his transition from cloud-based AI agents to a fully local 125B-parameter MoE model after enterprise clients raised strict data-exfiltration concerns. The move was driven by the need to keep task statements, source code, configuration files, logs, and regulated personal data inside the corporate perimeter. After testing multiple inference engines, he settled on the Strata engine running a Qwen3.8-Flash-Next model quantized to IQ3_S, achieving 22-25 tokens per second generation and over 500 tokens per second prefill on an RTX 5060 Ti 16 GB GPU paired with a Xeon E5-2640 v3 and 128 GB DDR4. Extensive calibration of expert caching, PCIe fraction, KV streaming, and speculative decoding proved critical to reaching production-grade performance. The resulting setup now handles real agentic workloads such as incident investigation from traces, backlog grooming, and code generation without any data leaving the workstation. The author concludes that hybrid cloud-local workflows will become standard for development teams handling sensitive information within the next one to two years.

AntiMalware•AI Security

VK Tech Releases Offline-Capable VK AI Space 26.3 for Secure Enterprise AI Agents

VK Tech has launched version 26.3 of its corporate AI platform VK AI Space, enabling organizations to deploy generative AI agents that operate entirely without internet access. The update integrates seven modules for model connectivity, knowledge base management, and multi-agent orchestration while supporting full on-premises installation on customer hardware. Key security controls include role-based access management, usage quotas, comprehensive audit logging, and configurable checkpoints that pause agent actions for human approval when required. Agents can interact with internal APIs, databases, and file systems through multi-step workflows, with built-in validation against test datasets and restrictions on tool usage. The platform also provides multi-level memory, ready-to-use component libraries, and hooks for fine-tuning agent behavior. VK Tech confirmed that version 26.3 successfully passed testing under an approved program that specifically verified operation in air-gapped environments.