Abstract
Humanoid face robots can now move their lips in sync with speech and show detailed facial expressions. Give such a robot the face of a real person and drive it with generated speech, and you get a new kind of presentation attack: a face that talks and reacts in front of the camera, recorded as a real object with no edited pixel. We call this a RoboFake and ask whether current defenses are ready for it. We test three public face presentation attack detection (PAD) models and six public deepfake detectors on video of a physical lip-syncing face robot, on a synthesized video of the same robot, and on rendered robot faces. Thresholds are fixed on human data (BPCER 5% on FaceForensics++), and every result is compared with real human faces processed the same way as the robot videos and turned to the same head angle. A small mobile PAD model detects every physical robot frame (APCER 0%) and is not affected by compression, but its BPCER on processed human video rises to 14%; the two PAD models trained on CelebA-Spoof miss the robot in the direct capture, and one of them also misses most panel frames. Among the deepfake detectors, three flag almost every robot frame and two fewer than 7%; masking shows that the response comes from the face but does not track synthesis, and JPEG compression pushes most robot frames below the threshold for some detectors. Our results suggest that current models catch today's robots because their faces do not look human, not because they recognize the attack. We state three testable hypotheses about realistic, interactive RoboFakes.
Abstract (translated)
URL
https://arxiv.org/abs/2610.14269
