Deepfakes in the Foundation-Model Era

A Survey of Forensics, Generation and Distribution Across Social Media Lifecycle

Shaina Raza, Jessee Ho, Ahmed Y. Radwan, Mohamed Hafez
Vector Institute for Artificial Intelligence
The deepfake lifecycle from creation through platform upload, distribution, detection, provenance, and remediation, annotated with the forensic assumptions at risk at each stage

A deepfake passes through creation, upload, distribution, detection, provenance, and remediation. Each stage can remove the evidence a detector needs.

Abstract

Deepfake detection is usually measured on curated benchmarks, yet synthetic video often reaches audiences through social-media platforms that compress, resize, re-encode, crop, and repost it before downstream detection. The practical question is therefore not whether a detector separates real from fake under laboratory conditions, but whether the evidence it depends on still exists at the moment a decision must be made. This survey reviews 212 works on generative audio-video deepfakes across the full lifecycle of creation, platform distribution, detection, provenance, and remediation. We organize the review around five forensic assumptions that detectors implicitly rely on: that a manipulated region leaves a boundary, that a generator leaves a stable fingerprint, that test data resemble training data, that forensic signals survive processing, and that low-level clues are sufficient. Using these assumptions as a common lens, we present an evidence-based taxonomy of generation methods, review signal-driven, learning-based, reasoning-based, agentic, and adversarially robust detection, and examine provenance mechanisms including content credentials and watermarking alongside emerging disclosure and takedown regulation. Two findings recur. First, foundation-model generation can weaken several assumptions at once, since fully synthetic and jointly generated audio-video content may remove compositing boundaries and reduce exploitable cross-modal inconsistencies. Second, the literature is concentrated on creation and detection, with distribution, provenance, and remediation together accounting for 13% of the corpus. We close with evaluation protocols that report which assumptions a benchmark actually exercises.

Five Forensic Assumptions

A1

Boundary

A manipulated region leaves a boundary. Fails for fully synthetic video.

A2

Fingerprint

A generator leaves a stable fingerprint. Fails across versions and chained generators.

A3

Alignment

Test videos resemble the training data. Fails on unseen generators and domains.

A4

Survival

Forensic signals survive processing. Fails under platform compression and re-encoding.

A5

Sufficiency

Low-level clues are enough. Fails when audio and video are generated jointly.

The Evidence Gap

212
works reviewed
73%
peer-reviewed
75%
creation & detection
13%
distribution, provenance, remediation
Bar chart of lifecycle-stage coverage: creation 94, detection 85, foundations 32, provenance 16, remediation 8, distribution 4

The stages that determine what evidence survives to a detector are among the least studied.

Where the Evidence Comes From

Five-stage deepfake pipeline: data acquisition, preprocessing, generation, post-processing, and dissemination

The deepfake pipeline, from data acquisition to dissemination. Every stage adds, alters, or suppresses forensic traces.

Paper List

All 212 references, grouped by year and by the role each plays in the survey, are on GitHub.

Browse the list

BibTeX

@article{raza2026deepfakes,
  title     = {Deepfakes in the Foundation-Model Era: A Survey of
               Forensics, Generation and Distribution Across
               Social Media Lifecycle},
  author    = {Raza, Shaina and Ho, Jessee and Radwan, Ahmed Y. and
               Hafez, Mohamed},
  year      = {2026},
  month     = {August},
  publisher = {Preprints},
  url       = {https://www.preprints.org/manuscript/202608.1870}
}