Interpreting Detection Results

A detailed guide to reading and acting on deepfake detection results — from verdict outcomes and risk scores to per-layer analysis and session status impact.

Where Results Appear

Deepfake detection results are included in the session’s analysis_data object. You can access them through three channels:

Retrieve Session API — call the Retrieve Session endpoint to programmatically access detection data for any completed session.
Webhook events — session.status.verified, session.status.rejected, and session.status.submitted payloads include the full deepfake_detection_data object.
Admin Console — navigate to a session in the Admin Console to view detection results alongside all other verification data.

Response Structure

When Deepfake Detection is enabled in a workflow, the session’s analysis_data object includes a deepfake_detection_data field:

{
  "deepfake_detection_data": {
    "verdict": "LIVE",
    "risk_score": 18,
    "confidence": 92,
    "avg_layer_confidence": 91,
    "layer_results": {
      "liveness": {
        "passed": true,
        "checks": {
          "landmark_detection": true,
          "blink_detection": true,
          "head_movement": true,
          "frame_timing": true
        }
      },
      "vision": {
        "risk_score": 22,
        "confidence": 90,
        "signals": []
      },
      "voice": {
        "risk_score": 13,
        "confidence": 88,
        "word_match": true
      }
    },
    "analyzed_at": "2025-01-15T10:43:00.000Z"
  }
}

Top-Level Fields

Field	Type	Description
`verdict`	string	Final determination: `LIVE` (authentic), `DEEPFAKE` (synthetic content detected), or `INCONCLUSIVE` (insufficient confidence for a definitive call).
`risk_score`	number (0–100)	Combined risk score across all analysis layers. Higher values indicate greater likelihood of synthetic content.
`confidence`	number (0–100)	Overall confidence in the verdict. Higher values indicate more certainty in the determination.
`avg_layer_confidence`	number (0–100)	Average confidence across the AI analysis layers (vision and voice).
`layer_results`	object	Per-layer breakdown of the analysis. Contains `liveness`, `vision`, and `voice` sub-objects.
`analyzed_at`	string	ISO 8601 timestamp indicating when the analysis was performed.

Layer Results

The layer_results object provides granular results from each of the three analysis layers that run in parallel during detection.

Liveness Layer

The liveness layer validates that a physically present person performed the required actions. It acts as a binary gate — if any check fails, the verdict is immediately DEEPFAKE regardless of other layer results.

Field	Type	Description
`passed`	boolean	Whether all liveness checks passed.
`checks.landmark_detection`	boolean	Valid facial landmarks detected across all captured frames.
`checks.blink_detection`	boolean	A real blink was confirmed through eye aspect ratio variance.
`checks.head_movement`	boolean	Real left/right head turns detected through positional shifts.
`checks.frame_timing`	boolean	Frame capture timing falls within expected parameters.

Vision Layer

The vision layer analyses the captured frames for visual deepfake artifacts using AI-powered inspection.

Field	Type	Description
`risk_score`	number (0–100)	Vision-specific risk score. Higher values indicate more visual deepfake signals detected.
`confidence`	number (0–100)	Confidence in the vision analysis based on clarity of signal detection.
`signals`	array	List of specific visual anomalies detected. Empty when no anomalies are found.

Voice Layer

The voice layer analyses the audio clip captured during the session, including verification that the applicant spoke the challenge phrase correctly.

Field	Type	Description
`risk_score`	number (0–100)	Voice-specific risk score. Higher values indicate more synthetic voice signals detected.
`confidence`	number (0–100)	Confidence in the voice analysis based on audio quality and clarity of signals.
`word_match`	boolean	Whether the applicant correctly spoke the challenge phrase. A `false` value (wrong phrase or no speech) results in a `DEEPFAKE` verdict.

Vision Signals

When visual anomalies are identified, the vision.signals array contains one or more signal identifiers:

Signal	Description
`TEXTURE_SMOOTHING`	Face region appears unnaturally smoother than surrounding skin (neck, ears) — a characteristic artifact of neural network face generation.
`BOUNDARY_ARTIFACTS`	Visible seam or boundary detected where the face meets the head/background — indicates a face-swap blend region.
`BLINK_FAILURE`	Eyes did not fully close during the blink frame. Face-swap models struggle to render complete eye closure.
`MOUTH_ANOMALY`	Mouth not visibly open during the speaking frame, suggesting audio was played over a static or minimally animated face.
`TEETH_RENDERING`	Unnatural teeth appearance — face-swap models typically render teeth as a blurry white mass rather than distinct, detailed teeth.
`FLAT_ROTATION`	Head rotation appears flat without natural 3D parallax. Face swaps rotate the face as a 2D texture rather than a three-dimensional object.
`TEMPORAL_INSTABILITY`	Facial features are inconsistent across frames. Face-swap models regenerate features per-frame rather than maintaining persistent geometry.
`SKIN_TONE_MISMATCH`	Face skin tone does not match the neck/body skin tone — a colour temperature mismatch caused by the source face having different lighting conditions.

Verdict Logic

The verdict engine evaluates results in priority order:

Priority	Condition	Verdict
1	Liveness check failed (any `checks` value is `false`)	`DEEPFAKE`
2	Word mismatch — applicant did not speak the correct challenge phrase	`DEEPFAKE`
3	Vision risk score exceeds the deepfake threshold	`DEEPFAKE`
4	Voice risk score exceeds the synthetic speech threshold	`DEEPFAKE`
5	Average layer confidence is below the minimum confidence threshold	`INCONCLUSIVE`
6	None of the above conditions are met	`LIVE`

DEEPFAKE verdicts trigger regardless of confidence level — the system is calibrated to prioritize preventing deepfake fraud over avoiding false positives. In the rare case of a false positive, applicants can retry the verification session.

Impact on Session Status

The deepfake detection verdict directly influences the session’s final status:

DEEPFAKE → Session REJECTED — The session automatically transitions to REJECTED. This prevents deepfake-based fraud from progressing through the verification pipeline.
INCONCLUSIVE → Manual review — The session remains in SUBMITTED status, flagged for manual review in the Admin Console. This occurs when the system does not have sufficient confidence to make a definitive determination (e.g., low webcam quality, poor lighting). A compliance analyst can examine the layer results and make a final call.
LIVE → Normal processing — The session continues through normal verification processing. Other workflow steps (ID Verification, PEP & Sanctions, etc.) proceed as configured.

Example: Deepfake Detected

The following response illustrates a session where a face-swap deepfake was identified with high confidence:

{
  "deepfake_detection_data": {
    "verdict": "DEEPFAKE",
    "risk_score": 78,
    "confidence": 91,
    "avg_layer_confidence": 90,
    "layer_results": {
      "liveness": {
        "passed": true,
        "checks": {
          "landmark_detection": true,
          "blink_detection": true,
          "head_movement": true,
          "frame_timing": true
        }
      },
      "vision": {
        "risk_score": 82,
        "confidence": 90,
        "signals": [
          "TEXTURE_SMOOTHING",
          "BOUNDARY_ARTIFACTS",
          "TEETH_RENDERING",
          "SKIN_TONE_MISMATCH"
        ]
      },
      "voice": {
        "risk_score": 13,
        "confidence": 88,
        "word_match": true
      }
    },
    "analyzed_at": "2025-01-15T14:22:31.000Z"
  }
}

In this case, the liveness checks passed (the deepfake software successfully replicated basic movements), but the vision layer detected four distinct artifact signals — texture smoothing, boundary seams, unnatural teeth, and a skin tone mismatch between the face and neck. The vision risk score of 82 exceeded the deepfake threshold, resulting in a DEEPFAKE verdict. The voice layer showed no synthetic indicators, confirming this was a face-swap attack rather than a fully synthetic session.

Example: Inconclusive Result

When the system cannot make a definitive determination, typically due to poor capture conditions:

{
  "deepfake_detection_data": {
    "verdict": "INCONCLUSIVE",
    "risk_score": 41,
    "confidence": 55,
    "avg_layer_confidence": 55,
    "layer_results": {
      "liveness": {
        "passed": true,
        "checks": {
          "landmark_detection": true,
          "blink_detection": true,
          "head_movement": true,
          "frame_timing": true
        }
      },
      "vision": {
        "risk_score": 45,
        "confidence": 50,
        "signals": []
      },
      "voice": {
        "risk_score": 36,
        "confidence": 60,
        "word_match": true
      }
    },
    "analyzed_at": "2025-01-15T16:05:12.000Z"
  }
}

The average layer confidence of 55 fell below the minimum threshold, so the system returned INCONCLUSIVE rather than making a potentially incorrect determination. This session would be flagged for manual review.

Deepfake detection data is included in webhook event payloads when session status changes. Configure your webhook endpoint under Settings > API Keys to receive real-time notifications. See Webhooks for setup details.

Overview

Live Session Detection

File Analysis API

DeepEye Browser Extension

Interpreting Detection Results

Where Results Appear

Response Structure

Top-Level Fields

Layer Results

Liveness Layer

Vision Layer

Voice Layer

Vision Signals

Verdict Logic

Impact on Session Status

Example: Deepfake Detected

Example: Inconclusive Result

​Where Results Appear

​Response Structure

​Top-Level Fields

​Layer Results

​Liveness Layer

​Vision Layer

​Voice Layer

​Vision Signals

​Verdict Logic

​Impact on Session Status

​Example: Deepfake Detected

​Example: Inconclusive Result

Where Results Appear

Response Structure

Top-Level Fields

Layer Results

Liveness Layer

Vision Layer

Voice Layer

Vision Signals

Verdict Logic

Impact on Session Status

Example: Deepfake Detected

Example: Inconclusive Result