Deepfakes and More: How Agents with New Tools Can Mitigate and Provide More Context

Note: the livestream joins roughly a minute into the talk; these notes start at 00:00:00 and the opening self-introduction is off-camera.

TL;DR

• The trend line is widely misread. Deepfakes have grown since 2018, but across the problematic imagery Google tracks, roughly half the cases involve pixels that were never touched — the lie is in the context (cheapfakes, out-of-context reuse). Run a deepfake detector on those and it will faithfully answer "real," which is worse than useless.
• Change the question. Not "is this fake or real" but "is this trusted, and what's the context?"
• Detection is an arms race, but not a lost one. The standard recipe (train a discriminator on Stable Diffusion output plus real images) demands a treadmill of retraining as new generators ship. Bregler's group also researches how to stay out of the race — e.g., reverse-engineering prompting and noise maps for zero-day invariance. Security theorists predicted eight years ago that the community would lose the race within six months; eight years on, he's still waiting.
• Two kinds of provenance, both needed. Inferred provenance (reverse image search over a full web index, which Google shipped 15 years ago) and asserted provenance (C2PA cryptographic ledgers, SynthID invisible watermarks). Asserted provenance is taking off but still covers a small slice, so detection that doesn't depend on provenance remains essential.
• Agents are how you stitch the signals together. Backstory — started a few years ago, v1 released last summer, v2 just released — pulls every source and signal to answer the context question, compressing an investigation that would take a journalist hours or days into seconds.
• The root causes are social-scientific. Bregler pointed at Berkeley's own sociology tradition (Arlie Hochschild's deep story fieldwork) and at AI-assisted reframing, bridging, and deliberation (the Habermas Machine, Polis), with the goal of improving societal health holistically rather than blocking one policy violation this hour.

Key Points

Google's position: information quality plus the AI safety frontier (~00:00–00:02)

Google's 1999 mission — organize the world's information and make it accessible to everyone — still holds, but it now runs on two tracks: the original information quality problem (surface the most accurate, trusted information on the web) and the new AI safety frontier.

A Reuters study he cited makes the uncomfortable point that trust in online media keeps declining even when you are accurate and even when you strive for quality. It varies sharply by country — Finland tops the trust ranking; Google's own position sits in the middle. He noted hearing that Finland teaches information literacy starting in kindergarten, while elsewhere audiences are simply less critical.

Google's answer rests on three pillars, the most foundational being media literacy: the little three-dot "about this" affordances shipped across products over the last decade, and now the "know more" surfaces inside AI Mode. The governing principle: "We don't arbitrate the truth." Give society the most powerful tools and let it form its own view.

The data: deepfakes are not the biggest problem (~00:02–00:03, 00:07–00:09)

Drawing on tracking work published by Nick Dufour and colleagues, who monitor visual and textual content that users flag as problematic:

• Deepfakes became culturally huge from 2018, but actual volume stayed modest until recently. On the chart, the blue curve is deepfakes; the yellow and red curves — the non-deepfakes — carry the mass.
• Example: Iranian outlets Photoshopping a fake missile in among real ones, a technique that predates GenAI by a decade.
• Rescaled to 100%, GenAI is still a small fraction. The dominant category is content where the pixels were never modified at all.

Three live examples:

1. An explosion video claimed to be from Iran, or from Gaza — actually a 2020 accident at a port fertilizer depot. Run a deepfake detector and it reports "real," because it is real.
2. "Russian aircraft over Kyiv" — actually a Moscow military parade ten years earlier.
3. A shark on a flooded street. His aside: "Whenever you see a dolphin or shark, you probably don't even need a deepfake detector — it's most likely fake." In fact the shark is a genuine photo taken by a shark researcher off the South African coast roughly twenty years ago, and the street is somewhere else entirely; the two were composited.

Unpicking each of these is what a well-trained investigative journalist spends hours or days doing. Doing it at scale is the hard part.

Detection research: escaping the arms race (~00:04–00:07)

The standard workflow — collect a pile of generated images and a pile of real ones, train a discriminator — breaks the moment a new generator ships next week, and ten thousand ship next year. That is a pure treadmill.

His group also researches how to stay outside the arms race, for instance by reverse-engineering the prompting and noise maps behind generated images, aiming for invariance to models nobody has seen yet (a "zero-day" property).

Security theoreticians predicted eight years ago that the community would lose this arms race within six months. Eight years later, the toolbox is still deep.

Operationally, many internal detectors and signals are deliberately unpublished so adversaries learn less, but every Google and YouTube surface has them running. Three further items:

• Identity protection: creators and everyday users worried about being deepfaked can now get an alert — "we think somebody just deepfaked you."
• Election policy: Google was first to set policy for GenAI use in election advertising.
• A detection API, announced at I/O with the Cloud team; nearly every company is trialling it, and you can apply for trusted-partner access to Google's internal detectors.

He flagged an academic misallocation along the way: deepfake-detection competitions absorb enormous PhD-student effort, but the battle is somewhere else.

Two kinds of provenance (~00:09–00:10)

• Inferred provenance: work backwards from the content to its origin and context. Google invented reverse image search 15 years ago and indexes the whole web. A friend sends you a "UFO" photo; you circle it, send it to Google, and the answer isn't "fake" or "real" — it's "this was also labeled as a cloud."
• Asserted provenance: over the last three years Google has led and partnered on C2PA (with Adobe, Microsoft, and the rest of the industry) and SynthID invisible watermarking. Google phones stamp captured images through a crypto ledger as real; touch up a glare afterwards and C2PA transparently records that a GenAI feature was applied on top of a real image.

Asserted provenance is lifting off, but coverage is still the smaller part, so provenance-independent detectors remain necessary. It is a big mix — you still have to look everywhere to know what's really going on. Which is where agents come in.

Backstory: handing every signal to an agent (~00:10–00:12)

Google started building this agent a few years ago, released v1 last summer, and just released v2. It ingests all sources and all signals.

Demo: a social post claiming Californian students went on spring break and polluted a lake. Backstory doesn't just run a generative detector — that isn't enough. It checks whether the students actually went to that lake (yes) and whether they polluted it (no).

Back to the shark: a GenAI detector says "not GenAI." Backstory says this is a real shark, photographed off the South African coast about twenty years ago by a shark researcher, and the street isn't Miami during a hurricane — the two images were overlaid.

Generative detection does nothing here, but the agent gives you the whole context, and together with it you can investigate in seconds instead of hours or days.

He invited the room to snapshot the slide and sign up as a trusted tester, mentioned worldwide information-literacy events demonstrating the tool, and teased forthcoming evaluations — "I'm not telling you what the other models are; of course we're the best."

Agent safety and Google's process (~00:13)

Echoing Dawn Song's keynote that morning, Google runs a defined workflow for agentic flows: agent-specific product policies → pre-launch testing → engineering for safety → continuous monitoring → external partnerships.

Mapping the overall posture: media literacy (highly proactive), responsible generation (highly proactive), AI safety (highly proactive), after-the-fact policy enforcement (reactive). He described reactive work as feeling like an emergency room or firefighting — you're treating symptoms — which is why the team also doubles down on root causes.

Root causes are social science, not just technology (~00:14–00:15)

The point he most wanted to make at Berkeley:

The root causes are not a technical problem alone, and it isn't just detecting "this is bad, this is good." The root causes are social science.

He cited a recent workshop held at UC Berkeley with Raka Ray, Caitlin Rosenthal, and other faculty, and named himself a fan of Berkeley sociologist Arlie Hochschild, who went from Berkeley down to Lake Charles, Louisiana to study a community with a different view of the world, of reality, and of what the American Dream is — and why people there don't achieve the version of it defined on the West Coast. That fieldwork produced her work on deep stories.

The forward-looking opportunity is social science × AI. Google has published papers and has systems running: if AI reframing, bridging, and deliberation mean something to you, that's the space — he named the Habermas Machine and Polis. The goal:

We want to improve holistically the health of the society, not just prevent some policy violation right now this hour.

He closed by pointing out team members in the room (Reena Jana, who leads the safety workflow from trust and safety; Amnes Sud, a co-author on the prompting/noise-map work), noting how heavily the team is invested in this safety track.

Quotes

"We don't arbitrate the truth." (~00:02)

Google's self-positioning: not the referee of truth, but the supplier of the strongest tools for the public to judge.

"Half of the cases are where the pixels are not modified at all. You're not lying with the pixels. You're lying with the context. And your deepfake detectors are completely useless." (~00:08)

The talk's central datum and central reversal.

"You should actually ask: is this trusted? What's the context?" (~00:07)

Change the question and the tooling has to change with it — from detector to investigating agent.

"Security theoreticians eight years ago already predicted we as a community will lose the arms race in six months. I'm still waiting for that. It's eight years later." (~00:06)

A gentle rebuttal to detection defeatism.

"The root causes is not a technical problem alone … the root causes is social science." (~00:14)

The closing appeal to a Berkeley audience: fixing the information ecosystem needs social science at the table.