Deepfakes in 2026 are no longer a category that information-security analysts describe as a peripheral specialty of the broader digital-media operational environment. Beginning in early November 2025 and accelerating through December 2025, a coordinated Russian information warfare campaign progressively flooded TikTok, X, and other social media platforms with AI-generated videos depicting alleged “forced mobilization” of 22- and 23-year-old Ukrainian men supposedly being sent to the front line — many of the videos created using OpenAI’s Sora generative video model and displaying the “Sora” watermark identifying the content as artificial. The campaign — characterized by NBC News on December 13, 2025 as featuring “ultrarealistic AI videos attempting to portray Ukrainian soldiers in peril” — depicted Ukrainian soldiers appearing to weep and surrender on the front lines and Ukrainian soldiers apologizing to the Russian people and blaming their government for the war. The fabricated videos progressively claimed that 23-year-old Ukrainian citizens were being drafted — a claim that the Ukrainian government Center for Countering Disinformation progressively refuted by noting that Ukraine’s law sets the minimum mobilization age at 25 following the April 2024 lowering from 27. The cumulative deepfake propaganda development across the past several years has progressively transformed the operational definition of contested information space in the contemporary Battlefields of the Future operational environment, with one video featuring a deepfake soldier pleading “help me, I don’t wanna die, I’m just 23 years old” that the Kyiv Independent verified through Hive Moderation AI-based content detection as artificially generated audio and video, with the soldier’s face belonging to a Russian citizen rather than a Ukrainian.
The story of deepfakes in 2026 is the story of how multiple parallel state-actor information warfare campaigns have progressively built sophisticated synthetic-media operational frameworks while the cumulative counter-deception technology has progressively struggled to maintain operational pace. The Storm-1679 Russian disinformation network progressively expanded its operational sophistication across 2025 — with August 2025 operations impersonating ABC News, BBC, POLITICO, and Netflix through advanced deepfake technology, AI-generated voices of Tom Cruise and trusted journalists spreading false narratives about Ukraine, and Donald Trump Jr. and Elon Musk progressively sharing fabricated content to millions of American social media followers after being deceived by the Storm-1679 output. The cumulative Russian information warfare framework has progressively been supported by Operation Doppelganger — the Russian IT firm Social Design Agency (SDA)-operated disinformation campaign established in 2022 that has progressively targeted Ukraine, Germany, France, and the United States through copycat websites of Le Figaro, Le Parisien, Le Monde, 20 minutes, and the French Ministry of Foreign Affairs. The parallel counter-deepfake technology development has progressively expanded through DARPA’s Semantic Forensics (SemaFor) program (launched in 2020 and concluded in September 2024 with transition to the Digital Safety Research Institute (DSRI) of UL Research Institutes), the Coalition for Content Provenance and Authenticity (C2PA) Content Credentials specification (with version 2.3 released in January 2026 and the conformance program operationalized in early 2026), the Associated Press AP Verify newsroom verification platform (launched December 15 2025), the NIST Open Media Forensics Challenge (OpenMFC), and the broader category of synthetic-media detection and provenance frameworks. The cumulative counter-deepfake framework progressively positions synthetic propaganda as one of the most operationally consequential contemporary information-warfare categories, paralleling the broader contemporary electronic warfare operational framework that has progressively been organized around emerging strategic capabilities, and the broader contemporary autonomous-systems integration framework across the maritime domain that has progressively been integrating across multiple operational domains.
Deepfakes in 2026: The Current State
The contemporary deepfakes strategic landscape operates across four parallel program tracks that the broader information-warfare research community has progressively characterized.
The first track is the synthetic video generation mission category — the rapidly maturing AI-generated video capability that the broader generative AI development has progressively built across the past several years. The principal contemporary platforms include OpenAI’s Sora generative video model (released in late 2024 and expanded through Sora 2 in 2025-2026), Google’s Veo 2 and Veo 3 generative video models (operating through the broader Google DeepMind framework), Runway’s Gen-3 and Gen-4 generative video models, Pika Labs‘ generative video platform, Hailuo AI‘s generative video platform, Kling AI‘s Chinese generative video model, and the broader category of commercial generative video tools that the contemporary AI development has progressively been making accessible to broad populations of users. The cumulative platform availability progressively positions synthetic video generation as one of the most operationally consequential contemporary information-technology developments, paralleling the broader contemporary humanoid robotics and drones operational framework that has progressively been organized around emerging AI-powered strategic capabilities.
The second track is the state-actor synthetic propaganda operations mission category — the most operationally consequential contemporary information warfare application of synthetic media capability. The principal contemporary operations include the Russian Storm-1679 network (impersonating major Western news outlets through deepfake content as documented in August 2025), the Russian Operation Doppelganger (operated by the Social Design Agency since 2022 targeting Ukraine, Germany, France, and the United States), the Chinese Spamouflage operation (also known as Dragonbridge, operating across TikTok, YouTube, and other platforms to spread pro-China and anti-U.S. content), the Iranian APT42 operations targeting U.S. elections, Israel, and broader regional adversaries, and the North Korean Lazarus/Kimsuky operations using deepfake job interview videos in the IT-worker scheme. The cumulative state-actor synthetic propaganda framework represents one of the most operationally significant contemporary information warfare developments, paralleling the broader history of state-level intelligence and surveillance operations that has progressively informed the contemporary information warfare doctrine.
The third track is the counter-deepfake detection and forensics mission category — the broader technical and analytical capability progressively built to identify and characterize synthetic media after its creation and distribution. The principal contemporary frameworks include the DARPA Semantic Forensics (SemaFor) program (concluded September 2024, transitioned to DSRI), the NIST Open Media Forensics Challenge (OpenMFC) (the principal public media-forensics evaluation platform), the Reality Defender commercial deepfake detection platform, the Intel FakeCatcher detection tool, the Hive Moderation AI-based content detection platform (used by the Kyiv Independent to verify the Sora-generated Ukrainian soldier deepfakes), the Microsoft Video Authenticator detection tool, the Truepic verified-capture platform, and the broader category of commercial and government deepfake detection systems. The cumulative detection framework progressively addresses the synthetic media identification challenge though with substantial documented limitations — with the Deepfake-Eval-2024 benchmark showing that open-source state-of-the-art detectors lose roughly half their accuracy on in-the-wild 2024 deepfakes compared with older academic benchmarks.
The fourth track is the content provenance and authentication mission category — the alternative approach that establishes authenticity at the point of content creation rather than attempting to verify it after distribution. The principal contemporary framework is the Coalition for Content Provenance and Authenticity (C2PA) specification — operating through the Content Credentials 2.3 release in January 2026 and the broader conformance program operationalized in early 2026. The C2PA framework progressively embeds cryptographically signed metadata manifests into digital media files at the point of creation — establishing a verifiable chain of trust from the moment content is captured to the moment it is consumed. The cumulative provenance framework progressively sidesteps the broader detection arms race by establishing authenticity through hardware-secured digital signatures rather than through post-hoc analytical identification of synthetic-media artifacts. The C2PA framework progressively positions content provenance as one of the most operationally promising contemporary counter-deepfake approaches, paralleling the broader contemporary defense-technology environment that has progressively been organized around emerging strategic capabilities.
What “Synthetic Propaganda” Actually Means
The contemporary synthetic propaganda operational concept describes the broader category of information warfare operations that use AI-generated synthetic media to advance state-actor or non-state-actor political, military, or commercial objectives. The synthetic propaganda mission category has progressively evolved beyond the traditional disinformation framework — which historically relied on manually-fabricated photographs, miscaptioned authentic media, selectively-edited authentic media, and traditional propaganda techniques — into the contemporary framework that leverages fully-synthetic video, audio, and image generation at industrial scale.
The historical evolution of propaganda across the past century has progressively expanded the technical capability and the operational scale of state-level information warfare. The World War I propaganda doctrine progressively built around poster art, leaflet distribution, newspaper editorial control, and the broader category of mass-communication techniques targeting domestic and adversary populations. The World War II propaganda doctrine progressively expanded to incorporate radio broadcasting, film production, photographic propaganda, and the broader category of mass-media information warfare framework. The Cold War propaganda doctrine progressively integrated television broadcasting, active measures by the Soviet KGB, the broader information operations framework that U.S. Information Agency (USIA) and Radio Free Europe progressively built, and the cumulative ideological warfare framework. The post-Cold War propaganda doctrine progressively addressed the cable television environment, the internet-based information operations, and the broader social media information warfare framework. The cumulative historical evolution progressively positioned propaganda as one of the central strategic capabilities of state-level conflict, though the contemporary synthetic propaganda development progressively transforms the operational scale and the technical capability of the information warfare framework.
The contemporary synthetic propaganda environment has progressively rendered the traditional information warfare frameworks operationally inadequate across substantial portions of the contested information space. The proliferation of generative AI video tools at near-zero marginal cost has progressively enabled state-actor and non-state-actor information warfare campaigns to generate synthetic media at industrial scale — fundamentally compressing the production timeline and reducing the production cost from the substantial investment required by traditional propaganda techniques to the near-zero marginal cost of synthetic media generation. The proliferation of AI voice cloning technology has progressively enabled state-actor information warfare campaigns to generate synthetic audio impersonating any public figure — fundamentally enabling the production of synthetic audio impersonations of journalists, celebrities, and political figures at substantial operational scale. The cumulative synthetic propaganda environment has progressively forced the broader information warfare framework to incorporate content authentication, provenance verification, and broader counter-deception capabilities that the traditional information warfare framework was not designed to execute.
The “asymmetric advantage” structural dynamic of synthetic propaganda operates through a fundamentally favorable economic and operational framework for the attacker relative to the defender. The NewsGuard analyst McKenzie Sadeghi progressively characterized the dynamic by observing that “if even just one or a few of their fake videos go viral per year, that makes all of the other videos worth it” — fundamentally describing the operational logic in which the attacker requires only occasional success to achieve massive impact while the defender must respond to all credible synthetic media operations. The cumulative asymmetric advantage progressively positions synthetic propaganda as one of the most operationally consequential contemporary information warfare categories — paralleling the broader contemporary great-power competition environment that has progressively organized around emerging operational categories.
The November 2025 Sora Ukrainian Soldier Disinformation Campaign
The most operationally consequential single contemporary synthetic propaganda operation is the November-December 2025 Sora-generated Ukrainian soldier disinformation campaign — a coordinated Russian information warfare effort that progressively flooded TikTok, X, and other social media platforms with AI-generated videos fabricating Ukrainian military mobilization scenes. The campaign — characterized by NBC News in December 2025 as featuring “ultrarealistic AI videos attempting to portray Ukrainian soldiers in peril” — represents one of the most operationally significant contemporary state-actor synthetic propaganda operations.
The operational characteristics of the campaign reflect the underlying Russian information warfare doctrine that has progressively been built around the contemporary generative AI capability. The videos depicted Ukrainian soldiers appearing to weep and surrender on the front lines and Ukrainian soldiers apologizing to the Russian people and blaming their government for the war. Many of the videos were created using OpenAI’s Sora generative video model with several featuring the “Sora” watermark identifying the content as artificial — though the broader social media distribution progressively obscured the watermark visibility through cropping, video compression, and platform-level rendering. The cumulative campaign progressively reached millions of views across multiple social media platforms before fact-checking organizations could effectively respond — fundamentally demonstrating the operational scale that contemporary synthetic propaganda can achieve.
The specific narrative claims of the campaign progressively focused on alleged forced mobilization of 22- and 23-year-old Ukrainian men supposedly being sent to the front line. The narrative directly contradicted Ukrainian law — which clearly sets the minimum mobilization age at 25 following the April 2024 lowering from 27 that the Ukrainian government had progressively implemented. One video featured a deepfake soldier pleading “help me, I don’t wanna die, I’m just 23 years old” — directly leveraging the false 23-year-old mobilization narrative that the broader campaign progressively reinforced. The Ukrainian government Center for Countering Disinformation progressively refuted the campaign by identifying that the soldier’s face shown in one video belonged to a Russian citizen rather than a Ukrainian — further demonstrating the fabricated character of the broader campaign output.
The detection methodology that progressively identified the campaign content as synthetic operated through multiple analytical approaches. The Kyiv Independent progressively verified the synthetic character of the videos through Hive Moderation, an AI-based content detection tool that identified both the audio and video as artificially generated. The Hive Moderation detection progressively complemented the broader analytical approaches that the EU Digital Media Observatory and related fact-checking organizations have progressively been building. The November 12, 2025 Kyiv Independent reporting on the campaign — published as part of the Fighting Against Conspiracy and Trolls (FACT) project under the EU Digital Media Observatory (EDMO) umbrella — progressively positioned the European fact-checking infrastructure as one of the principal contemporary counter-synthetic-propaganda mechanisms.
The strategic objectives of the campaign progressively reflected the broader Russian information warfare doctrine that has progressively been built around the multi-front operational employment. The campaign progressively targeted both Ukrainian domestic and international audiences — designed to erode trust in Ukraine’s leadership, sow panic among Ukrainian populations, and weaken Western support for continued Ukrainian operations. The cumulative strategic objectives progressively positioned the campaign as one of the most operationally significant contemporary state-actor synthetic propaganda operations — paralleling the broader contemporary great-power strategic competition framework that has progressively been organized around emerging operational categories.
The August 2025 Storm-1679 News Outlet Impersonation Operation
The most operationally sophisticated contemporary state-actor synthetic propaganda operation is the August 2025 Storm-1679 Russian disinformation network impersonation of major Western news outlets. The Storm-1679 operation — extensively documented by Reality Defender, NewsGuard, and other counter-disinformation organizations — represents one of the most operationally consequential contemporary synthetic propaganda escalations.
The operational scope of the August 2025 Storm-1679 operation progressively extended across multiple major Western news outlet impersonations. The network successfully impersonated ABC News, BBC, POLITICO, and Netflix using advanced deepfake technology — fabricating apparent news segments and entertainment content that progressively spread Russian-aligned narratives across Western social media platforms. The operation produced AI-generated voices of Tom Cruise and trusted journalists that progressively spread false narratives about Ukraine, deceiving high-profile figures who progressively shared the fabricated content to broad audiences. The cumulative operation progressively demonstrated the operational sophistication that contemporary Russian information warfare has progressively built around the AI-generated synthetic media capability.
The high-profile amplification of the Storm-1679 output represents one of the most operationally consequential dimensions of the campaign’s effectiveness. The fabricated content was progressively shared by Donald Trump Jr. and Elon Musk — two figures with substantial social media reach who progressively amplified the synthetic propaganda to millions of Americans through their respective platforms. The cumulative high-profile amplification progressively positions the Storm-1679 operation as one of the most operationally significant examples of the broader influencer-amplification vulnerability that contemporary synthetic propaganda has progressively been exploiting — fundamentally demonstrating that the defender’s success in containing synthetic propaganda requires not only technical detection capability but also operational discipline among high-influence content distributors.
The February 2025 USAID celebrity narrative operation represented one of the most operationally illustrative earlier Storm-1679 campaigns. The operation progressively created a fabricated E! News segment claiming USAID paid celebrities to visit Ukraine — leveraging celebrity recognition to amplify a fabricated narrative about U.S. foreign assistance programs. The fabricated content progressively spread to millions of viewers before fact-checkers could respond — fundamentally demonstrating the temporal asymmetry between synthetic propaganda production and fact-checking response that the broader contemporary information environment has progressively been building around.
The broader Russian information warfare evolution that the Storm-1679 operation progressively represents has fundamentally transformed the contemporary information warfare doctrine. Russian intelligence services have evolved beyond crude photoshops and obvious fake accounts — progressively deploying AI tools that execute techniques once requiring elaborate production teams, creating content so convincing that it fools celebrities, politicians, and ordinary citizens alike. The cumulative Russian information warfare evolution progressively positions the contemporary Russian disinformation environment as fundamentally more sophisticated than the historical Soviet active measures framework — paralleling the broader contemporary arms-control framework breakdown that has progressively been characterizing the great-power competition environment.
Operation Doppelganger and the Russian SDA Influence Network
The most operationally documented contemporary Russian disinformation campaign is Operation Doppelganger — established in 2022 by the Russian IT firm Social Design Agency (SDA) and progressively expanded across multiple Western target countries. The Doppelganger operation — operating under the broader Kremlin information warfare framework — represents one of the most operationally sustained contemporary state-actor disinformation campaigns.
The operational targeting of Operation Doppelganger has progressively extended across Ukraine, Germany, France, and the United States — representing the principal Western states supporting Ukrainian operations. The operation’s strategic narrative progressively focuses on four principal themes: the inefficiency of sanctions against Russia, Western “Russophobia,” the failure of Western governance, and the inevitability of Russian strategic victory. The cumulative narrative framework progressively serves the broader Kremlin objective of weakening Western support for Ukrainian operations through the integrated multi-channel information warfare framework that the SDA progressively operates.
The French targeting operation that the French authorities exposed in June 2023 progressively illustrated the broader Doppelganger operational sophistication. The operation progressively created copycat websites of Le Figaro, Le Parisien, Le Monde, and 20 minutes — using the fabricated newspaper websites to promote pro-Russian content including a fake Le Monde article titled “French Minister supports the murder of Russian soldiers in Ukraine”. The operation also progressively created a fake French Ministry of Foreign Affairs website — featuring a fabricated announcement for a 1.5 percent tax on “every monetary transaction” to finance military support for Ukraine. The cumulative French operation progressively demonstrated the infrastructural sophistication that contemporary Russian disinformation has progressively built around — extending beyond synthetic media into the broader fabricated-institutional framework.
The post-discovery operational continuation that Operation Doppelganger has progressively exhibited represents one of the most operationally significant characteristics of contemporary state-actor disinformation. Despite its discovery and denunciation by French authorities in June 2023, Operation Doppelganger progressively continued operations across multiple subsequent disinformation campaigns. The continuation has progressively reflected the structural difficulty of disrupting state-sponsored disinformation operations — particularly when the originating state actor has progressively absorbed the operational cost of discovery through the broader strategic-competition framework. The cumulative continuation has progressively positioned Operation Doppelganger as one of the most operationally sustained contemporary state-actor disinformation campaigns.
The operational targeting of Ukrainian leadership tensions that Operation Doppelganger has progressively built represents one of the most operationally sophisticated dimensions of the broader Russian information warfare framework. According to Washington Post reporting, Operation Doppelganger has aimed to exploit tensions between Ukrainian President Volodymyr Zelensky and Valery Zaluzhny, the former commander-in-chief of the Ukrainian armed forces — leveraging fabricated content to drive wedges between Ukrainian leadership figures and progressively destabilize Ukrainian political cohesion. The cumulative Ukrainian-leadership targeting progressively positions Operation Doppelganger as one of the most operationally sophisticated contemporary state-actor disinformation operations, paralleling the broader contemporary defense procurement environment that has progressively been organized around emerging strategic capabilities.
The March 16 2022 Zelensky Surrender Deepfake
The most operationally consequential historical contemporary state-level deepfake operation is the March 16 2022 Zelensky surrender deepfake — the first publicly documented major state-level deepfake operation in the contemporary great-power conflict environment. The Zelensky deepfake operation — broadly characterized as the foundational case study in contemporary deepfake-based information warfare — represents one of the most operationally significant contemporary state-actor synthetic propaganda historical operations.
The operational characteristics of the March 2022 Zelensky deepfake reflect the underlying early-stage deepfake operational doctrine that Russian information warfare had progressively been building. Pro-Russian actors hacked a Ukrainian media website and uploaded a poorly made deepfake of Ukrainian President Volodymyr Zelensky — fabricating a Zelensky statement claiming he had resigned, fled Kyiv, and called on the Armed Forces of Ukraine to surrender and save their lives. The fabricated video progressively received significant amplification via Telegram — with the false surrender narrative subsequently boosted through a Russian hack of television channel Ukraine 24’s news chyron that was altered to repeat the same surrender message.
The technical characteristics of the March 2022 Zelensky deepfake progressively demonstrated the early-stage limitations of the contemporary synthetic media technology. The exceptionally poor quality of the video progressively made the fabricated character immediately apparent — with Zelensky’s face appearing unnatural and his movements not matching his actual gestures. The synthetic audio progressively contained inconsistencies that made the fabricated character technically detectable. Even pro-Kremlin Telegram sources progressively acknowledged the fabricated character of the video — while simultaneously bragging that it still succeeded in causing some Ukrainian troops to surrender despite the technical limitations of the synthetic media output.
The Zelensky pre-bunking strategy that progressively contributed to the rapid debunking of the deepfake represents one of the most operationally significant contemporary counter-synthetic-propaganda techniques. President Zelensky had progressively warned the world that Russia’s digital disinformation machinery would create a deepfake of him admitting defeat and surrendering — providing the broader Ukrainian and international audiences with the operational expectation that the subsequent deepfake would be encountered. The cumulative pre-bunking strategy progressively enabled the rapid public rejection of the March 16, 2022 deepfake despite the operational sophistication that the underlying Russian information warfare framework had progressively been building.
The Berkeley research response that the March 2022 Zelensky deepfake progressively generated represents one of the most operationally consequential contemporary counter-deepfake research developments. Hany Farid of the University of California, Berkeley and Matyáš Boháček of the Gymnasium of Johannes Kepler in Prague progressively developed a facial and gestural behavioral model that captures distinctive characteristics of Zelensky’s speaking style — trained on over eight hours of authentic video from four different settings. The behavioral model progressively enabled the distinction of authentic Zelensky from deepfake impersonations — providing one of the most operationally significant person-specific deepfake detection frameworks that the broader research community has progressively been building. The cumulative research response progressively informed the broader counter-deepfake research framework that the contemporary information warfare environment has progressively been driving, paralleling the broader contemporary autonomous-systems integration framework that the great-power competition has progressively been organizing.
The subsequent Ukrainian-targeting deepfake escalation that the broader Russian information warfare framework has progressively been building includes multiple operationally documented operations across 2023-2026. The November 2023 three videos of then-Ukrainian Commander-in-Chief General Valerii Zaluzhny supposedly blaming Zelensky for killing his aide represented one of the most operationally significant escalations — progressively demonstrating how deepfake technology had evolved since the initial Zelensky fake. The leaked Zoom call featuring an inauthentic version of former President Petro Poroshenko deceiving International Legion in Ukraine members into agreeing with inflammatory comments about Zelensky represented one of the most operationally innovative deepfake employment frameworks. The cumulative Ukrainian-targeting deepfake escalation progressively positions the contemporary Ukrainian theater as one of the most operationally significant contemporary deepfake operational environments.
DARPA SemaFor and the Semantic Forensics Framework
The most operationally significant contemporary U.S. counter-deepfake research program is the DARPA Semantic Forensics (SemaFor) program — launched in 2020 as the successor to the DARPA Media Forensics (MediFor) program that began in 2016. The SemaFor program — concluded in September 2024 with subsequent transition to the Digital Safety Research Institute (DSRI) of UL Research Institutes — represents the principal contemporary U.S. government research investment in counter-deepfake technology.
The operational mechanism of SemaFor operates through a fundamentally different analytical framework than the broader statistical-detection approaches that the contemporary commercial deepfake detection has progressively been building around. The traditional statistical-detection framework operates by identifying pixel-level inconsistencies, statistical fingerprints, and broader low-level artifacts that generative AI processes progressively leave in synthetic media output. The SemaFor framework progressively extends the analysis by scrutinizing semantic content and structural consistency — applying natural language processing and AI-driven analysis to detect anomalies in images, videos, and audio that traditional forensic methods overlook. The cumulative semantic forensics framework progressively addresses the broader limitation that purely statistical detection methods are quickly becoming insufficient for identifying falsified media assets as the underlying generative AI models progressively improve.
The semantic-error detection that SemaFor has progressively been built around operates through the recognition that automated media generation and manipulation algorithms are heavily reliant on purely data-driven approaches and are prone to making semantic errors. The classic example that DARPA has progressively highlighted is that GAN-generated faces may have semantic inconsistencies such as mismatched earrings — the kind of high-level structural inconsistency that the underlying generative AI model has not progressively been trained to maintain across the full image. The cumulative semantic-error detection progressively provides defenders with an asymmetric advantage — leveraging the structural limitations of generative AI to identify synthetic media that pixel-level statistical analysis would not progressively detect.
The DEF CON 32 AI Village demonstration that DARPA and SemaFor performers progressively conducted represents one of the most operationally significant contemporary public demonstrations of counter-deepfake detection technology. The demonstration progressively exposed the broader cybersecurity research community to the SemaFor detection technologies that can help people defend against threats posed by deepfakes. The cumulative DEF CON demonstration progressively expanded the counter-deepfake research ecosystem that DARPA has progressively been building across the broader research community.
The SemaFor Analytic Catalog that the program has progressively built represents one of the most operationally consequential contemporary open-source counter-deepfake research resources. The Catalog progressively serves as a centralized collection of open-source forensic tools and resources designed to accelerate the development of deepfake detection methodologies. By making these resources available to government agencies, academic researchers, and private-sector entities, DARPA has progressively been fostering a collaborative ecosystem where advancements in AI forensics can be rapidly deployed and iteratively improved. The cumulative Analytic Catalog progressively positions DARPA as one of the most operationally consequential contemporary counter-deepfake research organizations.
The transition to the Digital Safety Research Institute (DSRI) that occurred with the SemaFor program conclusion in September 2024 progressively ensured the operational continuation of the broader research framework. The DARPA-DSRI Cooperative Research and Development Agreement (CRADA) progressively positioned DSRI to sustain a media forensics research ecosystem — sponsoring forensics research challenges, encouraging global participation in open challenges, and supporting reporting of results at academic conferences. The cumulative DSRI transition progressively maintains the U.S. government research investment in counter-deepfake technology despite the formal conclusion of the SemaFor program, paralleling the broader contemporary defense procurement environment that has progressively been organized around emerging strategic capabilities.
C2PA Content Credentials 2.3 and the Provenance Solution
The most operationally promising contemporary alternative to the broader deepfake detection arms race is the Coalition for Content Provenance and Authenticity (C2PA) Content Credentials specification — operating through the Content Credentials 2.3 release in January 2026 and the broader conformance program operationalized in early 2026. The C2PA framework — frequently characterized as “nutrition labels for digital media” — represents one of the most operationally consequential contemporary counter-deepfake technical frameworks.
The fundamental insight that drives the C2PA framework operates through the recognition that detecting whether content is synthetic after the fact is an inherently adversarial problem. As deepfake generators progressively improve, detectors must progressively improve in response — creating an endless arms race. The C2PA framework progressively sidesteps this arms race by establishing authenticity at the point of creation rather than attempting to verify it after distribution. The cumulative framework progressively positions content provenance as one of the most operationally sustainable contemporary counter-deepfake approaches.
The technical mechanism of C2PA operates through the embedding of cryptographically signed metadata manifests into digital media files at the point of creation. The manifest progressively records the provenance of the content: what device captured it, what software processed it, what edits were applied, and whether any generative AI was involved in its creation or modification. The manifest structure progressively includes a manifest store, a standardized data structure embedded within the media file that contains one or more manifests — with each manifest representing a stage in the content’s lifecycle (capture, editing, export, publication) and manifests linked in a chain to preserve the full history of the content. Each manifest progressively contains a set of assertions — structured claims about the content at that stage including the capture device and its settings, the software used for editing, the specific edits applied, and broader provenance information.
The operational verification workflow that the C2PA framework progressively supports operates through the consumer-facing verification interface. When a creator or a tool (like a C2PA-enabled camera or editing software) interacts with a piece of content, it automatically creates a secure, standardized record of that action. The consumer can progressively click a small icon and immediately see the verification label — providing the operational provenance information that supports the broader content-authenticity verification. An example verification label might progressively read: “Captured by Acme Camera Model X on June 1, 2025. Edited using Adobe Photoshop (cropped and brightness adjusted). Signed by Acme Energy (Claim Verified).” The cumulative verification workflow progressively enables the consumer to distinguish authentic from synthetic content without requiring the consumer to evaluate whether the content “looks” real.
The principal industry adopters of the C2PA framework progressively span the major contemporary digital media production and distribution platforms. Adobe progressively integrated Content Credentials across the Creative Cloud product family. Microsoft progressively integrated the framework across multiple product lines. OpenAI progressively integrated Content Credentials into Sora and broader generative AI products. Google progressively integrated the framework across YouTube and broader digital media platforms. The BBC, CBC/Radio-Canada, AFP, Reuters, and the Associated Press progressively adopted the framework across their newsroom verification workflows. The September 26, 2025 CBC/Radio-Canada documentation of video authenticity with Content Credentials on AWS progressively represented one of the operationally significant adoption milestones. The cumulative industry adoption progressively positions C2PA as one of the most operationally consequential contemporary counter-deepfake industrial frameworks.
The structural limitations of the C2PA framework progressively constrain the operational effectiveness despite the substantial technical promise. The framework requires broad adoption across capture devices, editing software, and distribution platforms — limiting the operational effectiveness in environments where the broader ecosystem has not progressively been integrated. The framework does not progressively address the underlying problem of authentic media being maliciously recontextualized through false captions, misleading edits, or selective presentation — fundamentally addressing only the synthetic-media-creation problem rather than the broader information warfare framework. The October 27, 2025 Verge analysis progressively characterized the broader limitation with the headline “Sora is showing us how broken deepfake detection is” — fundamentally acknowledging that the cumulative counter-deepfake framework has progressively struggled to maintain operational pace with the underlying generative AI capability development.
The Liar’s Dividend and the Epistemic Collapse Risk
The most operationally consequential structural risk that the contemporary deepfake proliferation has progressively been creating is the “liar’s dividend” phenomenon — first characterized by University of Texas legal scholar Bobby Chesney and Boston University legal scholar Danielle Citron in 2019. The liar’s dividend describes the structural risk in which authentic media documenting real misconduct can be dismissed as synthetic by the subject of the documentation — fundamentally enabling powerful figures to escape accountability through plausible deniability of authentic media evidence.
The structural mechanism of the liar’s dividend operates through the broader public uncertainty about the authenticity of digital media in the contemporary information environment. As the broader public becomes progressively aware of synthetic media capabilities, the public progressively becomes less confident about distinguishing authentic from synthetic content. The cumulative epistemic uncertainty progressively enables bad-faith actors to falsely characterize authentic documentation of misconduct as synthetic — fundamentally raising the cost of authentic accountability and lowering the cost of plausible denial. The cumulative liar’s dividend progressively positions the structural risk as one of the most operationally consequential contemporary information environment transformations, paralleling the broader contemporary research environment characterizing ambiguous and incompletely-documented phenomena that the national security community has progressively addressed.
The historical documentation of the liar’s dividend progressively extends across multiple high-profile cases. The Donald Trump “Access Hollywood” tape — authentic 2005 footage of Trump making explicit comments about women — progressively faced post-2016 attempts by Trump and his allies to characterize the tape as fabricated, though the cumulative evidence supports its authenticity. The various authentic videos of political figures making controversial statements have progressively been characterized by their subjects as deepfakes — leveraging the broader public uncertainty about synthetic media to enable plausible denial of authentic documentation. The cumulative historical pattern progressively positions the liar’s dividend as one of the most operationally significant contemporary information environment risks.
The broader epistemic collapse risk that the cumulative deepfake proliferation has progressively been creating extends beyond individual cases of plausible denial into the structural transformation of contemporary information environments. As the broader public progressively encounters synthetic media indistinguishable from authentic media at scale, the broader public’s baseline of shared empirical facts progressively erodes — fundamentally challenging the cognitive infrastructure that democratic deliberation and public accountability have progressively been built around. The cumulative epistemic collapse risk has progressively been characterized by multiple research communities as one of the most operationally significant contemporary risks to liberal democratic governance frameworks.
The counter-strategies that the broader research and policy community has progressively been developing extend across multiple dimensions of the contemporary information environment. The content provenance framework that C2PA represents progressively addresses the authenticity-verification side of the broader epistemic challenge. The media literacy education efforts that multiple educational organizations have progressively been building progressively address the consumer-side competence in distinguishing synthetic from authentic media. The legal regulatory framework including the EU AI Act, the U.S. TAKE IT DOWN Act (2025), the DEFIANCE Act, the DEEP FAKES Accountability Act, the South Korean deepfake pornography laws, the Chinese deep synthesis regulation, and the UK Online Safety Act progressively addresses the legal and regulatory dimensions of the broader synthetic media governance framework. The cumulative counter-strategies progressively address the broader epistemic collapse risk though with substantial documented operational limitations, paralleling the broader contemporary great-power strategic competition framework that has progressively been organized around emerging strategic capabilities, with the broader contemporary neuroprosthetics and brain-computer interface framework raising parallel questions about cognitive liberty that the broader research community has progressively been addressing across multiple emerging-technology categories.
Chinese Spamouflage and the Multi-Source Disinformation Environment
The most operationally extensive contemporary non-Russian state-actor synthetic propaganda operation is the Chinese Spamouflage operation — also known as Dragonbridge — operating across TikTok, YouTube, Twitter/X, Facebook, and broader social media platforms to spread pro-China and anti-U.S. content. The Spamouflage operation — extensively documented by Google’s Mandiant subsidiary, Meta’s threat intelligence team, and broader counter-disinformation organizations — represents one of the most operationally significant contemporary non-Russian state-actor disinformation campaigns.
The operational scope of Spamouflage progressively extends across multiple operational objectives. The operation progressively targets Taiwan to influence Taiwanese public opinion against Taiwan independence and toward eventual reunification with mainland China. The operation progressively targets the United States to promote narratives critical of U.S. foreign policy, U.S. domestic governance, and broader U.S. strategic posture. The operation progressively targets Hong Kong to promote narratives supportive of the Hong Kong national security framework and critical of pro-democracy movements. The operation progressively targets broader Western audiences to promote narratives supportive of Chinese strategic interests across multiple global theater operations.
The operational scale of Spamouflage has progressively expanded across multiple years of operation. Meta’s threat intelligence team has progressively identified and removed thousands of Spamouflage-affiliated accounts across multiple platform takedowns since the operation’s initial public identification in approximately 2019. Google’s Mandiant subsidiary has progressively published comprehensive analyses of the broader Spamouflage operational framework. The cumulative operational scale progressively positions Spamouflage as one of the most operationally extensive contemporary state-actor disinformation operations.
The Iranian APT42 operation represents one of the most operationally significant additional contemporary state-actor synthetic propaganda operations. The Iranian operation — operating under the broader Iranian Revolutionary Guard Corps Intelligence Organization framework — has progressively targeted U.S. elections, Israel, and broader regional adversaries. The operation progressively conducted the 2024 hack of the Trump campaign that resulted in the disclosure of campaign internal communications. The cumulative APT42 operation progressively positions Iran as one of the most operationally significant contemporary state-actor synthetic propaganda developers, paralleling the broader contemporary great-power competition framework that has progressively been organizing.
The North Korean Lazarus/Kimsuky operations represent one of the most operationally innovative contemporary state-actor synthetic propaganda categories. The North Korean operations have progressively conducted deepfake job interview videos in support of the broader IT worker scheme — the systematic North Korean program to place North Korean operatives as remote IT workers in Western companies to generate revenue and exfiltrate intellectual property. The cumulative North Korean operational framework progressively positions North Korea as one of the most operationally innovative contemporary state-actor synthetic propaganda developers — fundamentally demonstrating that the contemporary synthetic propaganda operational environment extends beyond the traditional great-power competition framework into the broader category of state-actor cyber operations.
The multi-source disinformation environment that the cumulative Russian, Chinese, Iranian, and North Korean operational frameworks have progressively been creating represents one of the most operationally consequential contemporary information environment transformations. The convergence of multiple state-actor synthetic propaganda operations operating across overlapping target populations progressively creates the broader information environment in which synthetic media operations from multiple state actors progressively converge into a cumulative information warfare environment that no single counter-actor can fully address. The cumulative multi-source disinformation environment progressively positions synthetic propaganda as one of the most operationally consequential contemporary great-power competition categories, paralleling the broader contemporary defense-technology environment that has progressively been integrating across multiple operational domains, and the broader contemporary great-power competition environment that has progressively been organized around emerging strategic capabilities.
What Deepfakes in 2026 Actually Demonstrate
The cumulative weight of the contemporary deepfakes 2026 strategic context — the November-December 2025 Sora-generated Ukrainian soldier disinformation campaign with the December 13 2025 NBC News reporting on ultrarealistic AI videos attempting to portray Ukrainian soldiers in peril and the November 12 2025 Kyiv Independent reporting via the EU Digital Media Observatory Fighting Against Conspiracy and Trolls (FACT) project verified through Hive Moderation AI-based content detection, the false 22-and-23-year-old forced mobilization narrative directly contradicting Ukraine’s law setting minimum mobilization age at 25 following April 2024 lowering from 27, the Ukrainian Center for Countering Disinformation identification of the soldier face shown as belonging to a Russian citizen, the Sora watermark identifying artificial content, the August 2025 Storm-1679 Russian disinformation network impersonation of ABC News, BBC, POLITICO, and Netflix using advanced deepfake technology, the AI-generated voices of Tom Cruise and trusted journalists, the Donald Trump Jr. and Elon Musk amplification of fabricated content to millions of Americans, the February 2025 Storm-1679 fabricated E! News segment claiming USAID paid celebrities to visit Ukraine, the NewsGuard McKenzie Sadeghi characterization of the asymmetric advantage as “if even just one or a few of their fake videos go viral per year, that makes all of the other videos worth it,” the Operation Doppelganger established in 2022 by Russian IT firm Social Design Agency (SDA) targeting Ukraine, Germany, France, and the United States, the June 2023 French authorities exposure of Doppelganger copycat websites of Le Figaro, Le Parisien, Le Monde, 20 minutes, and the fake French Ministry of Foreign Affairs website with fabricated 1.5 percent transaction tax announcement, the Doppelganger continued operations despite discovery and denunciation, the Washington Post reporting of Doppelganger exploitation of tensions between Zelensky and former Ukrainian Commander-in-Chief Valery Zaluzhny, the March 16 2022 Zelensky surrender deepfake hacking of Ukrainian media website with fabricated resignation, flight from Kyiv, and surrender call, the Russian hack of Ukraine 24 television channel news chyron repeating the surrender message, the exceptionally poor video quality and unnatural face and gesture mismatches making the fabricated character immediately apparent, the Zelensky pre-bunking strategy warning of expected deepfake, the Berkeley University of California Hany Farid and Gymnasium of Johannes Kepler Matyáš Boháček facial and gestural behavioral model trained on eight hours of authentic video from four settings, the November 2023 three videos of Ukrainian Commander Valerii Zaluzhny supposedly blaming Zelensky published by pro-Russian Telegram @RadioTruha, the leaked Zoom call inauthentic Petro Poroshenko deceiving International Legion members, the DARPA Semantic Forensics (SemaFor) program launched in 2020 as successor to DARPA Media Forensics (MediFor) launched in 2016, the SemaFor September 2024 conclusion with transition to Digital Safety Research Institute (DSRI) of UL Research Institutes through Cooperative Research and Development Agreement (CRADA), the SemaFor semantic-error detection through GAN-generated face mismatched earrings example, the DEF CON 32 AI Village SemaFor demonstration, the SemaFor Analytic Catalog open-source forensic tools, the NIST Open Media Forensics Challenge (OpenMFC), the AI FORCE Challenge 2, the Coalition for Content Provenance and Authenticity (C2PA) Content Credentials 2.3 specification released January 2026 with conformance program operationalized early 2026, the C2PA “nutrition labels for digital media” framework, the cryptographically signed metadata manifest store with manifests recording content lifecycle stages including capture, editing, export, publication, the assertions structured claims about content at each stage, the September 26 2025 CBC/Radio-Canada Content Credentials on AWS documentation, the AP Verify newsroom verification platform launched December 15 2025, the principal industry adopters including Adobe, Microsoft, OpenAI, Google, BBC, AFP, Reuters, and Associated Press, the October 27 2025 Verge analysis “Sora is showing us how broken deepfake detection is,” the Deepfake-Eval-2024 benchmark showing open-source detectors lose roughly half accuracy on in-the-wild 2024 deepfakes, the liar’s dividend phenomenon first characterized by University of Texas Bobby Chesney and Boston University Danielle Citron in 2019, the Donald Trump Access Hollywood tape and broader authentic-media-dismissed-as-deepfake pattern, the epistemic collapse risk to liberal democratic governance frameworks, the legal regulatory framework including EU AI Act, US TAKE IT DOWN Act 2025, DEFIANCE Act, DEEP FAKES Accountability Act, South Korean deepfake pornography laws, Chinese deep synthesis regulation, and UK Online Safety Act, the Chinese Spamouflage / Dragonbridge operation targeting Taiwan, United States, Hong Kong, and broader Western audiences across TikTok, YouTube, Twitter/X, Facebook documented by Google Mandiant and Meta threat intelligence, the Iranian APT42 operations targeting US elections including 2024 Trump campaign hack, the North Korean Lazarus/Kimsuky deepfake job interview videos in IT worker scheme, the OpenAI Sora and Sora 2 generative video models, the Google Veo 2 and Veo 3 generative video models, the Runway Gen-3 and Gen-4 generative video models, the Pika Labs, Hailuo AI, and Chinese Kling AI generative video platforms, the Reality Defender, Intel FakeCatcher, Hive Moderation, Microsoft Video Authenticator, Truepic, and broader commercial deepfake detection ecosystem, the multi-source disinformation environment convergence of Russian, Chinese, Iranian, and North Korean operations, and the broader contemporary great-power strategic competition framework integrating synthetic propaganda across multiple operational categories — represents a strategic context that is, in its operational density and policy consequence, one of the most significant transformations of the contested information space operational environment in the history of state-level conflict.
The deepfakes of 2026 are no longer theoretical. The Sora-generated Ukrainian soldier disinformation campaign has flooded TikTok, X, and other platforms with millions of views. The Storm-1679 network has impersonated ABC News, BBC, POLITICO, and Netflix. Operation Doppelganger has progressively continued for four years despite discovery. The March 2022 Zelensky surrender deepfake is the documented foundational case. The DARPA SemaFor program has transitioned to DSRI. The C2PA Content Credentials 2.3 specification has been released. The AP Verify newsroom verification platform has launched. The Chinese Spamouflage operation has progressively expanded across multiple platforms. The Iranian APT42 operations have hacked the Trump campaign. The North Korean IT worker scheme has used deepfake job interviews. The liar’s dividend has progressively enabled authentic-media dismissal. The Deepfake-Eval-2024 benchmark has shown detector accuracy degradation by approximately half on in-the-wild deepfakes. The cumulative state of the deepfakes strategic environment in 2026 has progressively transitioned from theoretical to operational across the past several years of accelerating great-power competition in the contested information space.
The structural questions that the next several years of deepfake development will be addressing include whether the C2PA Content Credentials framework can be operationally scaled to address the cumulative synthetic media generation across the broader generative AI ecosystem, whether the DARPA-to-DSRI counter-deepfake research transition will sustain the operational pace required to match the underlying generative AI capability development, whether the broader detection-versus-provenance debate will resolve toward provenance as the more operationally sustainable counter-deepfake framework, whether the liar’s dividend phenomenon will be operationally addressed through legal regulatory frameworks before the broader epistemic collapse risk progressively undermines the cognitive infrastructure of liberal democratic governance, whether the Russian Storm-1679 and Operation Doppelganger frameworks will continue operations across the foreseeable strategic horizon despite continued discovery and exposure, whether the Chinese Spamouflage operation will be operationally expanded into broader synthetic-media operational categories beyond the traditional text-and-image disinformation framework, whether the Iranian APT42 and North Korean Lazarus/Kimsuky operations will progressively expand into broader synthetic-media operational categories beyond the current operational scope, whether the broader great-power strategic competition will produce operational scenarios in which synthetic propaganda is employed at scales and intensities beyond the current contested information environment, and whether the broader contemporary arms-control framework breakdown that the great-power competition has progressively produced will be extended into the synthetic propaganda mission categories through new international agreements or whether the cumulative collapse will continue across all major operational domains.
A Russian state-actor information warfare operator opens OpenAI’s Sora interface. He types a prompt: “Ukrainian soldier, age 23, weeping on the front line, pleading to be sent home, fiber-optic drone smoke in the background.” Sora generates a 10-second video. The operator removes the Sora watermark through video editing software. The operator translates the soldier’s voice into Russian, Ukrainian, Polish, German, French, and English using AI voice cloning technology. The operator distributes the video across multiple TikTok, X, Telegram, and Facebook fake accounts. The video receives 1.5 million views in 48 hours before fact-checkers can effectively respond. The Ukrainian government Center for Countering Disinformation identifies the video as synthetic. The Kyiv Independent verifies the video as synthetic through Hive Moderation. The European Union Digital Media Observatory Fighting Against Conspiracy and Trolls (FACT) project publishes the verification. The damage is already done. The cumulative Russian information warfare framework progressively launches the next deepfake campaign. The Storm-1679 network impersonates ABC News with an AI-generated voice of Tom Cruise. The Storm-1679 network impersonates BBC with an AI-generated voice of a trusted journalist. The Storm-1679 network impersonates POLITICO with a fabricated story about USAID and celebrity Ukraine visits. The Storm-1679 network impersonates Netflix with an AI-generated entertainment segment. Donald Trump Jr. and Elon Musk progressively share fabricated content to millions of Americans. The DARPA SemaFor analytical tools detect the semantic errors. The C2PA Content Credentials 2.3 verification interface shows the synthetic provenance. The AP Verify newsroom verification platform flags the synthetic content. The Reality Defender, Intel FakeCatcher, Hive Moderation, Microsoft Video Authenticator, and Truepic detection systems identify the synthetic content. The Russian Storm-1679 network progressively launches the next iteration. The cumulative state of the deepfakes strategic environment in 2026 represents one of the most consequential transformations of the contested information space operational environment in the history of state-level conflict — a transformation that has been progressively built around the recognition that the cumulative integration of generative AI synthetic media capabilities, state-actor information warfare operational frameworks, and broader social media distribution platforms has progressively rendered the traditional information warfare doctrine operationally inadequate across substantial portions of the contested information space, with the cumulative integration of synthetic video generation, synthetic audio generation, synthetic image generation, automated translation, automated distribution, and broader operational frameworks progressively rendering the traditional fact-checking framework operationally constrained across multiple state-actor operations, multiple platform categories, and multiple target population segments as the broader contemporary strategic environment progressively accelerates toward the multi-decade operational deployment that the technology and policy frameworks have been progressively preparing the cumulative information warfare infrastructure to support.