Deepfakes and Verification: The Best Tools for Investigative Journalists
Detection models tell you a file is probably synthetic. Provenance tells you where it came from. Only one of those survives cross-examination, and it is not the one with the confidence score.
The instinct when a suspicious video appears is to run it through a detector and read the percentage. That instinct is the problem. A detector returns a probability produced by a model trained on yesterday's generation techniques, and it degrades quietly against anything newer. Verification that holds up is built the other way round: establish where the file came from, and treat detection as a tiebreaker.
The verification chain, in order
Working newsrooms follow a sequence rather than a tool. Each step is cheaper than the one after it, so the order matters more than the software.
- Find the earliest copy. Reverse image search on extracted keyframes, across multiple engines. Most "deepfakes" turn out to be authentic footage from another time or place — recontextualisation, not synthesis.
- Read the file, not the platform copy. Obtain the original from the source. Platform re-encoding strips metadata, so an uploaded copy tells you almost nothing about origin.
- Check provenance signals. C2PA content credentials, where present, record capture device and edit history in a cryptographically signed manifest. Absence proves nothing; presence is strong.
- Geolocate and chronolocate. Buildings, signage, shadows, weather records, vegetation. This is slow, and it is what actually stands up in a correction dispute.
- Interrogate internal consistency. Reflections, hands, lip sync at frame level, audio room tone, background loops.
- Run detectors last. As one input among several, never as the finding itself.
- Contact the source and the subject. Still the highest-yield step in the chain, and the one most often skipped under deadline.
The tools worth having
| Tool | Use | Limitation | Cost |
|---|---|---|---|
| InVID-WeVerify | Keyframe extraction, reverse search, metadata, magnifier | Browser-bound workflow | Free |
| Reverse image engines | Earliest-copy discovery across indexes | Coverage differs sharply by engine and region | Free |
| C2PA / Content Credentials | Signed capture and edit provenance | Only works if the chain preserved it | Free to verify |
| Forensically / FotoForensics | Error level analysis, clone detection, noise | Easy to over-read; suggestive only | Free |
| Detector platforms | Classifier scores for synthetic media | Degrade against new generators; false positives on compressed video | Commercial |
| Geolocation resources | Satellite, street imagery, terrain, sun position | Labour-intensive | Mostly free |
| Archiving services | Timestamped capture before deletion | Must be done immediately | Free |
Why detection is the weak link
Three structural problems limit classifier output as evidence. Detectors are trained on known generation methods and lose accuracy against techniques that appeared after training. Compression, re-encoding and platform processing introduce artefacts that resemble manipulation, producing false positives on entirely authentic footage shared through several apps. And the arms race is asymmetric: a generator only needs to defeat the detectors that exist, while a detector must generalise to generators that do not exist yet.
The editorial consequence is a rule worth writing into policy: a detector score is never the finding. It can justify further work, and it can support a conclusion reached by other means. It cannot carry a story on its own.
What provenance changes
Content credentials invert the question. Instead of asking a model whether pixels look synthetic, provenance asks what the file claims about itself and whether that claim is cryptographically intact. When a manifest survives, it records capture device, edits and the tools involved — a verifiable chain rather than a probability.
The limitation is honest and important: a missing manifest proves nothing. Most cameras do not sign, most platforms strip metadata, and any adversary can simply re-record a screen. Provenance is strong evidence when present and no evidence when absent, which means it complements the older techniques rather than replacing them.
Build the chain before you need it
The failure mode is predictable. A newsroom assembles a verification process during a breaking story, under pressure, with competitors publishing. Decide in advance who is authorised to declare material verified, what the minimum evidence standard is, and what the wording is when you publish something you cannot fully confirm. Practise on old material where the answer is known. The tools take an afternoon to learn; the editorial protocol is what actually prevents the mistake.
Note on data. Tool capabilities in this category change quickly and detector accuracy claims are typically measured against benchmark datasets rather than adversarial real-world material. Treat vendor accuracy figures with caution and re-test tools periodically against current generation techniques.
Sources
The claims in this article rest on the documents below. Each is linked to what it establishes, so you can check any statement against its origin rather than taking ours for it.
- C2PA, Content Credentials technical specification (v2.4) — the cryptographic provenance format itself — what a verification claim actually contains
- C2PA, specification explainer — the readable version, including the newsroom verification use case
- Content Credentials — the consumer-facing side: how a reader inspects an asset's history
- Coalition for Content Provenance and Authenticity — membership and governance — who is bound by the standard
Frequently asked questions
What is the best deepfake detection tool?
There is no reliable single detector, and treating any score as proof is the most common verification error. Commercial detector platforms are useful as one signal among several, but they degrade against generation techniques newer than their training data and produce false positives on heavily compressed video.
How do journalists verify a suspicious video?
By sequence, not by tool: extract keyframes and reverse image search for the earliest copy, obtain the original file from the source rather than a platform re-encode, check provenance credentials, geolocate and chronolocate the scene, examine internal consistency, and contact the source and subject. Detectors come last.
What are C2PA content credentials?
A cryptographically signed manifest attached to a media file recording capture device and edit history. Where the chain preserves it, it provides verifiable provenance rather than a probability estimate. Its absence proves nothing, since most capture devices do not sign and most platforms strip metadata.
Are most viral fakes actually AI-generated?
No. The large majority of misleading media in circulation is authentic footage stripped of context — real video from a different date, place or event. Reverse image search resolves more cases than any detector, which is why finding the earliest copy is the first step rather than the last.
What should a newsroom do before a crisis?
Write the protocol in advance: who can declare material verified, what minimum evidence is required, and the standard wording for publishing something not fully confirmed. Practise on archived material with known answers. The software is learnable in an afternoon; the decision rules are what prevent the error.