History of Deepfakes: From Darkroom Retouching to Real-Time Face Swaps

A timeline of deepfake history

Deepfake history is easiest to follow as a series of capabilities that each removed one barrier: controlling a face, generating a realistic one, swapping it in video, running the tools without expertise, and doing it live. The table below lists the milestones covered on this page and in the linked evolution pages.

Two threads run in parallel. Research groups published methods with clear dates and authors. Separately, communities and companies packaged those methods into tools, and that packaging, more than any single paper, decided when misuse became common.

How did media manipulation change before deep learning?

Before deep learning, media manipulation moved from physical retouching to digital compositing. The Library of Congress documents how early photographers changed images with cropping marks, graphite, etching, dyes and copy negatives, so a print could differ from the scene before anyone saw it. A photograph never guaranteed an untouched record.

Digital editing made the same work faster and reversible. Adobe Photoshop reached personal computers in 1990, and the layers feature added in 1994 let editors keep each source element separate, adjust masks and revise edges before flattening the result. In video, the 1997 Video Rewrite system from Christoph Bregler, Michele Covell and Malcolm Slaney reused recorded mouth images of a speaker to make them appear to say new words.

Those techniques still matter. Cropping, re-captioning, slowing a clip down or splicing audio can change meaning without any AI, which is why a review process that looks only for generation traces will miss many manipulations.

What changed between manual media editing and neural synthesis?

The change was in where new content comes from. A manual editor arranges pixels or recordings that already exist: a face cut from one photo, a word clipped from another speech. A neural model learns patterns from many examples and then infers appearance, motion or sound that was never captured, such as a face turned to an angle no camera recorded or a sentence the speaker never said.

That shift lowered the skill and source-material barrier. A convincing manual composite needs suitable footage for every inserted region and an expert to blend it. A trained model can fill gaps from learned statistics, so a few photos or seconds of audio may be enough. It also changed the evidence: manual edits leave boundaries and inconsistencies between sources, while synthesis can leave statistical traces across the whole image.

Why do 3D morphable face models matter to deepfake history?

3D morphable face models matter because they made a face controllable through parameters, the idea most later reenactment tools build on. Volker Blanz and Thomas Vetter presented "A Morphable Model for the Synthesis of 3D Faces" at SIGGRAPH 1999. They registered 3D face scans into a common shape, then described faces as combinations of average shape and texture plus learned variations. Fitting that model to a single photo recovered values for identity, pose and lighting that could be changed independently.

Face2Face, presented at CVPR 2016 by Justus Thies and colleagues, used a similar statistical face prior to track a person in ordinary video in real time and transfer another person's expressions onto them. The pipeline was explicit: track, transfer, re-render. Many neural systems still use 3D face parameters as controls or training signals, even when a network now draws the final pixels.

The model covered the face itself, not hair, teeth, neck or background, which is why early reenactment looked convincing in the centre of the face and weaker near the edges.

GANs, Reddit and the word "deepfake"

Ian Goodfellow and colleagues posted the generative adversarial network paper on 10 June 2014. A generator network learned to produce images while a discriminator learned to tell them from real ones, and the competition drove output toward realism. Within a few years, NVIDIA's Progressive GANs and StyleGAN were producing 1024-pixel faces of people who do not exist.

The word came from a person. On 11 December 2017, Samantha Cole reported for Vice's Motherboard that a Reddit user calling himself "deepfakes" was posting face-swapped pornographic videos of celebrities made with Keras and TensorFlow, trained on images from search results, stock photos and YouTube. The username became the generic term for AI-manipulated media, and the origin explains why non-consensual sexual imagery has been part of the deepfake problem from the start.

Detection research followed. Meta's Deepfake Detection Challenge drew 2,114 participants and 35,109 submitted models. When results were announced on 12 June 2020, the top entry scored 82.56% accuracy on the public test set but 65.18% on a black-box set of unseen videos, an early measurement of how much performance drops outside the training distribution.

What made generative AI models more accessible?

Generative AI models became more accessible through a stack of separate changes: published methods, working code, downloadable weights, faster inference and hosted apps. Each removed a different obstacle. A paper explains a method; code saves months of implementation; weights skip training that may cost hundreds of GPU days; an app removes installation entirely.

Stable Diffusion is the clearest example. Stability AI released it publicly on 22 August 2022 under the CreativeML OpenRAIL-M licence, saying it needed about 6.9 GB of GPU memory, within reach of consumer graphics cards. Narrower tools mattered as much: Wav2Lip's 2020 release handled lip sync for any face, and face-swap frameworks such as DeepFaceLab packaged the Reddit-era technique into a documented workflow.

Access is never total. Licences, hardware, dependencies and skill still limit what a given person can run, and local copies of a model can be fine-tuned into variants no detector has seen. That variety, more than raw quality, is what makes detection harder over time.

From novelty to fraud, and where detection stands now

By 2024, deepfakes were an established fraud tool. Arup confirmed in May 2024 that "fake voices and images were used" in an incident where a Hong Kong employee joined a video call with what appeared to be the company's CFO and colleagues, then made 15 transfers totalling HK$200 million, about US$25 million. In December 2024 the FBI's Internet Crime Complaint Center warned that criminals use generated images, cloned voices and real-time video calls with fake executives in fraud.

Neural Defend builds detection for this stage of the history. NeuroDetect gives investigators frame, region and audio-segment evidence for authorized media, with the model version recorded for each finding. NeuroVerify screens selfies and face media in one API call with six signals and under 200 ms p95 on eligible image requests. On the public VendorBench-100 benchmark of 100 adversarial still images, Neural Defend ranked first of 36 systems with an MCC of 0.876; one VendorBench author also co-authored Neural Defend's ARCAS paper, and the corpus is public.