Nose-Blind: Why AI Deepfake Detectors Keep Missing the Bigger Picture
In February 2024, an employee at engineering firm Arup joined a video call with people who looked, sounded and moved exactly like the company’s CFO and several colleagues. All of them were deepfakes. Over the course of the call, the employee authorised 15 wire transfers totalling US$25.6 million to accounts controlled by scammers, a case later confirmed by Hong Kong Police. The FBI’s Internet Crime Complaint Center recorded more than US$893 million in adjusted losses from AI-related fraud complaints in 2025, according to a report the agency published in April 2026.
Detection software exists precisely to catch cases like this before the money moves. New research from NUS Computing suggests a good deal of that software has been trained to look in the wrong place.
A Model That Only Ever Looks at the Nose
Deepfake detectors work by hunting for the small errors a synthesis model leaves behind: an odd blend around the jaw, a texture that does not quite belong near the eyes, a seam where a swapped face meets the original.
Provost’s Chair Professor Mohan Kankanhalli wanted to know exactly where in the face these models were actually looking when they made a call, so he and his team, CS Research Fellows Harry Cheng, Yangyang Guo, and Tianyi Wang, working with Professor Liqiang Nie of Harbin Institute of Technology who is an alumnus of NUS Computing, went looking.
“We kept seeing detectors that looked flawless on paper fail the moment you showed them a forgery technique they hadn’t trained on. We wanted to know what they were actually looking at when they got it right,” said Prof Kankanhalli.
Using attention maps, a technique that traces which pixels drive a model’s decision, the team found that a typical detector draws on a small slice of the image. Across their tests, more than 80% of the pixels in a face barely registered in the model’s final judgement. Train a detector on FaceSwap footage and it settles on the nose. Train the same architecture on NeuralTextures footage, where the manipulation mostly happens around the mouth, and it settles on the lips. One baseline model in the study reached 99.82% accuracy on the FaceSwap subset it was trained on, the researchers report, and then struggled badly on forgery techniques that left their traces elsewhere on the face.
The team names this the “primary region” problem: a detector locks onto whichever patch of the face gave it the clearest signal during training, and stops looking anywhere else.
Covering the Answer Key
The fix the team built, a method called PRLE, short for Primary Region Localisation and Exploitation, leaves a detector’s architecture untouched. What it changes is what the detector gets to see while it learns.
A panel of differently built detectors each flags the region it relies on most, and those individual maps get merged into one picture of the face’s primary region. During training, that region is then masked out of a portion of the images, at a size that shifts every cycle, so the detector has to keep finding new evidence elsewhere on the face rather than settling on a fixed workaround.
The method adds no new machinery to a detector itself. It sits ahead of the usual training process, works alongside existing techniques, and leaves the model exactly as fast once training ends.
Putting It to the Test
The team trained detectors on one set of forged footage, then tested them on five separate collections the models had never seen. On these unfamiliar forgeries, the untouched baseline detectors were often barely better than a coin toss. Xception, one of the field’s standard architectures, scored an accuracy of just 48% on one dataset it hadn’t trained on, and averaged 65% across all five, according to the study. With PRLE added, that average rose to 72%. EfficientNet showed a similar pattern: its accuracy on one dataset climbed from 59% to 75% once PRLE was applied, a 16-point recovery on a test the model had previously been failing outright.
That is the number worth sitting with. A detector’s headline accuracy, the 99% figure a vendor might quote, is usually measured against forgeries it already knows. Against something new, several of these models were closer to guessing than detecting, and PRLE is what pulled them back into usable territory.
The extra training time PRLE required was under 3%, and it changed nothing about how fast the finished detector runs.
Where Humans Ran Into the Same Wall
The team also tested whether people rely on the same regions a detector does. 86 participants took part in a study generating 4,300 individual judgements, classifying face images as real or fake. Masking the primary region out of the test images cut human accuracy by about 10%, and accuracy kept dropping as more of that region was hidden. The same shortcut that misleads a machine, it turns out, misleads the eye looking over its shoulder.
What This Changes
PRLE is a training-time addition, not a new detector. Its value, according to the authors, lies in how little it asks of the systems already in use: no redesign of the detector architecture, no added inference-time cost, a method that can be layered onto an existing pipeline in a single offline pass. The team also points to a further use for the same technique, in localising exactly where within an image a manipulation has occurred, a task closely related to detection but distinct from it.
The Arup fraud worked because everyone on that call trusted what they were looking at. The systems built to catch that kind of deception carry their own version of the same trust problem: a detector’s reported accuracy reflects the fakes it was shown during training, not the ones a scammer will build next. Forgery techniques keep shifting, and each new one arrives untested against whatever is currently guarding the door. PRLE does not close that gap for good. It gives existing detectors a way to hold up longer against whatever comes next.
Further Reading: Cheng, H., Guo, Y., Wang, T., Nie, L. and Kankanhalli, M. (2026) “Towards Generalizable Deepfake Detection by Primary Region Regularization,” ACM Transactions on Multimedia Computing, Communications, and Applications, 22(2), Article 42, February, https://doi.org/10.1145/3777474
