GB/T 45430-2025Forensic sciences - Forged video and image of a person - Deepfake examination (English PDF)

1 Scope

This document describes the examination equipment, the examination procedure and the types and wording of the expert opinion for the deepfake examination of forged video and images of a person in the field of forensic science.

This document applies to the deepfake examination of forged video and images of a person in the field of forensic science.

2 Normative references

The contents of the following documents constitute indispensable provisions of this document through normative reference in the text. For dated references, only the version corresponding to that date applies to this document; for undated references, the latest version (including all amendments) applies to this document.

GB/T 29360 Forensic sciences - Specifications for the forensic examination of electronic data recovery; GB/T 29362 Forensic sciences - Specifications for the forensic examination of electronic data search; GB/T 45429 Forensic sciences - Forged video and image of a person - General rules for examination; GB/T 45432 Forensic sciences - Forged video and image of a person - Source identification; GB/T 45433-2025 Forensic sciences - Forged video and image of a person - Feature set for interpretability examination.

3 Terms and definitions

The terms and definitions given in GB/T 45429 and the following apply to this document.

Deepfake video and image of a person: a false video or image of a person produced by artificial intelligence techniques, by means of replacement, editing, manipulation, generation or similar operations.

Deepfake characteristic: an indication in a video or image that relates to the deepfake platform, algorithm or model used.

Deepfake examination: the process of extracting and analysing the deepfake characteristics of a questioned item in order to determine whether the item is a deepfake video or image of a person.

4 Examination equipment

Routine examination equipment. The routine examination equipment includes computers, image scanners, video players, image viewers, hash calculation tools, metadata viewers, audio and video editing software, and compilers for programming languages.

Deepfake examination equipment. Hardware and software that assist in examining deepfake characteristics in the video or image as a whole and in parts of it, including but not limited to equipment for detecting forged areas, equipment for analysing forgery models, equipment for tracing forged faces to their source, equipment for authenticity examination, equipment for comparing images of persons, equipment for image measurement, equipment for image processing, equipment for image searching and equipment for image restoration.

5 Examination procedure

Securing and preserving the questioned item. Where the questioned item is a paper image, it is scanned with an image scanner at a resolution of not less than 1200 dpi and converted into a digital image. Where the questioned item is digital media, the appearance of the carrier holding it is recorded photographically and the storage location of the item within the carrier is recorded. The questioned item is given a unique number and its file attributes and hash value are recorded. Enquiry is made as to whether the questioned item has a suspected source in terms of the person in the picture, the time-and-place environment, the image file, the capture device or the forgery tool.

Collection of samples. Where conditions allow, the image file suspected to be the source of the questioned item may be collected as a sample. The appearance of the carrier holding the sample is recorded photographically and the storage location of the sample within the carrier is recorded. The sample is given a unique number and its file attributes and hash value are recorded. Where necessary, in accordance with the relevant provisions of GB/T 29362 and GB/T 29360, a data search or data recovery is carried out on the carrier of the questioned item in order to obtain samples.

Examination of metadata. The metadata of the questioned item and of the samples are inspected, including format, duration, resolution, frame rate, recording time, encoding time, marking time, software and copyright. Anomalies in the metadata of the questioned item are then sought out and analysed, including but not limited to: inconsistency between the information the metadata reflect and the file attributes; anomalous relationships between the metadata and the file attributes or metadata of other video or images from the recording device; anomalies in the file header, the file trailer and the data structure; and other suspicious information contained in the metadata.

Detection of deepfake characteristics. Deepfake examination equipment is used to detect the areas and passages of the questioned item suspected of being deepfaked, with attention to the characteristics of 6.2 to 6.8 of GB/T 45433-2025. The physiological characteristics of the person in the questioned item are detected, including but not limited to blinking, heart rate, the distribution of skin and hair colour, the geometry of the facial features, the continuity of the mouth shape and its consistency with expression and with movement of the chest, head pose including head pose angles, and the speed, amplitude and direction of body movement. The edge characteristics of persons, objects and the environment are detected, including but not limited to the edges of the picture as a whole, the outlines of the face and body of persons in the picture, and splicing characteristics such as feathering around the outlines of persons, objects and the environment. The illumination characteristics are detected, including but not limited to the variation in light intensity reflected in each colour channel, the direction of illumination reflected in different areas of the picture, and changes in colour temperature and contrast over the whole image or in local areas. The noise characteristics are detected, including but not limited to the noise of the picture as a whole, the photo-response non-uniformity noise of the lens sensor, and image noise arising from interference in the transmission of the video signal and similar causes.

Analysis of deepfake characteristics - static analysis. Single frames of the questioned item and of the samples are inspected with an image viewer. The facial characteristics in the frame are analysed, including but not limited to: whether the hair, beard and the like show anomalies, for example discontinuity in the texture of individual hairs; whether the light and shadow on the forehead, brows, eyes, lips, cheeks and chin are plausible; whether the spectacles show glare and whether the angle of the glare changes as they move; the consistency of the images reflected in the pupils and their agreement with the surroundings; whether the brightness and sharpness of the eye, nose, mouth and ear regions match the rest of the face; whether the size and colour of the lips match the rest of the face; whether there are anomalous textures or colour patches in the region of the teeth; whether the colour and sharpness of the facial hair differ from those of the hair of the head; anomalies of facial pigmentation, for example moles or freckles that do not look real; whether the sharpness of the fine detail of the facial features differs from that of other persons in the picture; whether there are anomalies where the facial region meets the background; whether the face shows anything else contrary to common sense, for example features that do not match the identity of the person in the picture; and whether there are traces of editing or alteration of the face.

Analysis of deepfake characteristics - static analysis of the body. The characteristics of the human body in the frame are analysed, including but not limited to: whether the visual effect of the head pose is realistic and natural; whether the proportions of head, trunk and limbs are consistent with one another; whether the posture of the body is plausible; whether the sharpness of detail differs between parts of the body, for example an inconsistent visibility of skin pores; whether the shadow of the person corresponds to the person's build and clothing; whether there are anomalies where the body region meets the background; whether the body shows other anomalies, for example bodily features that do not match the identity of the person in the picture; and whether there are traces of manual editing or alteration of the body.

Analysis of deepfake characteristics - static analysis of other features. Other characteristics of the frame are analysed, including but not limited to: whether the picture lacks plausible detail; whether there are anomalies of time, of place or of the wider environment; whether the scene the picture shows is real, continuous and consistent with the way images are formed, for example whether there are anomalous traces of occlusion or editing; whether the natural environment shown is anomalous, for example weather features such as wind direction, rain or mist that do not behave as they should; whether the shape, colour, proportions and detail of signs, buildings, furnishings and similar objects are plausible; whether persons and objects in the background show defects, for example anomalous textures or patterns; whether the light and shade shown are plausible; and whether the perspective of the picture is consistent with the way images are formed.

Analysis of deepfake characteristics - dynamic analysis. The video is played with a video player, and the successive frames into which it is decomposed are inspected with an image viewer in forward and in reverse order. The dynamic facial characteristics in the video or in the frame sequence are analysed, including but not limited to: whether the movements and expressions of the person are natural; whether the rotation of the eyeballs, blinking and other dynamic changes are anomalous; whether the dynamic changes in the forehead, eyes, nose, mouth and cheeks are plausible; whether blurring, ghosting or other anomalies appear around the mouth, lips and teeth when the person speaks; whether the skin, hair and features of the head and face change implausibly; whether changes of light and shade in the facial region correspond to facial movement; and whether the identity characteristics of the person change anomalously. The dynamic characteristics of the body are analysed, including but not limited to: whether body movements are natural and continuous; whether they are plausible, for example movements that do not match the identity of the person; whether head and body movements are out of keeping with each other; whether the visual effect or the outcome of a body movement is anomalous; and whether changes of light and shade in the body region correspond to body movement. Other dynamic characteristics are analysed, including but not limited to: whether clock watermarks and other information reflecting time are continuous; whether the picture lacks plausible change; whether the positions and shapes of persons and objects change implausibly; whether changes in the sharpness of the person and of the background, overall and in detail, are anomalous; whether changes of colour temperature, contrast and brightness follow objective laws; whether changes in the natural environment are continuous, for example weather features such as wind direction, rain, cloud and mist that do not change as they should; and whether repeated textures and patterns appear.

Analysis of deepfake characteristics - analysis of the relationship between sound and picture. Using a video player or similar equipment, the sound content of the video is listened to against the picture. The characteristics of the relationship between sound and picture in the questioned item are analysed, including but not limited to: whether the association between picture and sound is anomalous; whether the synchronisation between picture and sound is anomalous; whether the pitch, timbre and habitual expressions in the speech of the person in the video agree with that person's identity; and whether the noise floor of the sound in the video is anomalous.

Analysis of deepfake characteristics - source analysis. In accordance with GB/T 45432, the sources of the questioned item are analysed in terms of the person in the picture, the time-and-place environment, the image file, the capture device and the forgery tool.

Comparison of deepfake characteristics. Simulation experiments are carried out, samples being processed so as to show forgery effects close to those of the questioned item, and the characteristics of the questioned item and of the simulated forged images of a person are compared, including but not limited to: whether they show consistent source characteristics; whether they show the same file attributes or metadata characteristics; whether they show matching anomalous physiological characteristics, for example anomalous detail of the auricle or repeated movements; whether they show matching anomalous image characteristics, for example picture defects or anomalous noise characteristics; and whether they show matching anomalous characteristics in the relationship between sound and picture.

Evaluation of deepfake characteristics. The reliability of the deepfake characteristics of the questioned item is evaluated in the light of the sources of the item and of the samples. For the deepfake characteristics extracted, the following shall be excluded: false detections by the forged-image examination equipment; traces of forgery produced by manual operations such as splicing or compositing; changes of characteristics caused by operations such as beautification, colourisation or stylisation; image degradation caused by compression, deformation, degradation and noise; particular features of the person's appearance, for example a face and body of different skin colour or of different degrees of ageing of the skin; changes in the person's appearance from grooming or cosmetic work, for example ageing or facial filling; and light and shadow phenomena produced by a complex environment at the time of capture. Where no deepfake characteristics are found, the following shall be borne in mind: that the forged-image examination equipment may have missed them; that where characteristics inconsistent with deepfaking are present, the possible method of forgery should be argued together with an authenticity examination of the video or image; that the visual result of a deepfake image of a person is influenced by the algorithm and model, the training data and the parameter settings; that images of persons produced by generation have a random element; and that deepfake and non-deepfake forgery may be superimposed.

Integrated analysis. On the basis of the examinations of 5.3 to 5.7, an integrated analysis is made of whether the questioned item is a deepfake image of a person, including but not limited to: which method of deepfaking, that is replacement, editing, manipulation or generation of the person, the forgery characteristics in the picture correspond to; whether forgery by non-deepfake methods can be excluded; and whether other reasonable doubt can be excluded.

6 Expert opinion

Types of expert opinion. The expert opinion of a deepfake examination falls into the following five types: deepfaking affirmed; deepfaking denied; deepfaking inclined to be affirmed; deepfaking inclined to be denied; and no judgement possible. The type of opinion is determined and worded in accordance with 6.2.

Deepfaking affirmed. The questioned item has been examined in full, reliable deepfake characteristics have been extracted, and it is judged that the item was produced by deepfaking, that is by replacement, editing, manipulation or generation of the person. The opinion should be worded: the questioned item is a deepfake image of a person.

Deepfaking denied. The questioned item has been examined in full, no deepfake characteristics have been found, and it is excluded that the item was produced by deepfaking, that is by replacement, editing, manipulation or generation of the person. The opinion should be worded: the questioned item is not a deepfake image of a person.

Deepfaking inclined to be affirmed. The questioned item has been examined in full, fairly reliable deepfake characteristics have been extracted, and it is judged that the item was very probably produced by deepfaking, that is by replacement, editing, manipulation or generation of the person. The opinion should be worded: the questioned item is considered likely to be a deepfake image of a person.

Deepfaking inclined to be denied. The questioned item has been examined in full, no fairly reliable deepfake characteristics have been found, and it is substantially excluded that the item was produced by deepfaking, that is by replacement of the person, editing of the person, manipulation of the person or generation of the person. The opinion should be worded: the questioned item is considered unlikely to be a deepfake image of a person.

No judgement possible. The questioned item has been examined in full, but the information is insufficient. The opinion should be worded: it cannot be judged whether the questioned item is a deepfake image of a person.