What AI Deepfake Detection Can and Can't Do About Scraping

A friend who scores mobile games sent me a link last spring: a thirty-second clip on a video app, a stranger's name in the corner, built around a vocal hook that was unmistakably hers — the same breathy alto, the same small crack on the high note she can never quite hide. She never recorded it. A model did, from stems she'd posted to a portfolio site years earlier. This is exactly the scene AI deepfake detection is supposed to prevent, and the story of why it so often doesn't starts about three decades before anyone trained a voice clone.

The polite request we mistook for a lock

In 1994, a Dutch engineer named Martijn Koster proposed a small text file that would sit at the root of a website and tell automated crawlers which paths to leave alone. It came out of a mailing-list discussion among people running early search robots that kept hammering fragile servers. There was no standards body, no penalty, no enforcement. A crawler read the file and chose to obey, or it didn't. That was the whole design, and for a working web of cooperative search engines, it was enough.

The file was robots.txt, and thirty years later it is still the backbone of how most creators imagine their work is protected online. Somewhere along the way a convention hardened into a belief: that publishing rules meant those rules were binding. They never were. A scraper reads your robots.txt the way a driver reads a hand-lettered please don't park here — the information is real, the obligation is optional. When AI training crawlers arrived hungry for audio, text, and faces, the gap between the polite request and the actual lock stopped being academic. The convention had a source, and the source was thinner than the confidence built on top of it.

That matters because the same shape of belief repeats one layer up. When prevention visibly failed, the field reached for detection instead — and detection carries its own thin source under a very confident surface.

What AI deepfake detection actually checks

AI deepfake detection does not scan the internet for stolen work and flag it. It looks at a specific piece of media and estimates the probability that a machine, rather than a person, produced it. For audio, that means analyzing spectral artifacts, phase inconsistencies, and the unnaturally smooth transitions that generative models tend to leave behind — the sonic equivalent of six-fingered hands. For a likeness or a voice match, a second class of system compares the sample against a reference of the real person and scores the similarity.

So it is a classifier, not a fence. It answers does this look synthetic or does this sound like her, after the fact, on one file at a time. It does nothing to stop the scrape that produced the training data in the first place, and it only runs on content that reaches a platform willing to check it. Detection is a smoke alarm, not a locked door — useful, worth having, and frequently mistaken for the thing that keeps intruders out.

How detection became the plan B

The pivot to detection was not a bad decision. It was the honest response to watching prevention fail in the open. Publishers added crawler directives; the crawlers that mattered most ignored them. Platforms sitting on years of creator uploads realized their robots.txt had been, for some operators, a directory of exactly what to take. When the wall turns out to be a suggestion, you stop guarding the perimeter and start inspecting what comes through the door.

Detection also fit the moment culturally. It is demo-friendly: a synthetic clip goes in, a red likely AI-generated banner comes out, and everyone in the room nods. It gives a platform something to announce and a product leader something to ship. Likeness-matching in particular reframed the problem in a way people could feel — not the abstract violation of a scraped dataset, but the concrete horror of your own face or voice saying words you never said. The industry consensus formed fast: detection is how we handle AI misuse now. But a consensus that forms because a defense is announceable is not the same as a defense that works, and the evidence underneath was doing less than the enthusiasm on top of it implied.

The source is thinner than the belief

Here is the part that gets quoted less. Detection accuracy is usually measured against known generators on clean, uncompressed files in a lab. The real world serves compressed, re-encoded, remixed audio from models the detector has never seen — and every point of published accuracy is an invitation to the people building the next generator to route around it. It is an arms race in which the attacker moves last and cheaply, and the defender has to be retrained.

Watermarking, the cousin defense, leans on the same thin footing. A watermark survives until someone resamples, pitch-shifts, adds noise, or runs the file through a second model, and much of that damage happens as a side effect of ordinary editing. None of this makes detection worthless. A smoke alarm that misses one fire in five is still worth installing. The failure is not in the tool; it is in the sentence detection will keep your work safe, which the tool was never built to support. The belief outran its source — exactly the way please don't crawl outran a file that could only ask.

What actually holds: a working checklist

The defenses that survive contact with a non-cooperative scraper are the ones that don't depend on anyone choosing to behave, or on a classifier guessing right after the fact. If you produce audio or voice work, these carry more weight than a detection banner:

• Register the work, don't only publish it. A dated deposit or a timestamped rights record gives you standing that no detector provides. It is boring and it is what a takedown or a claim actually runs on.
• Layer network-level blocking under robots.txt. Rate limits, bot fingerprinting, and blocking known training-crawler IP ranges are enforcement, not requests. Treat the text file as documentation of intent, not as the barrier.
• Keep your masters and stems off open portfolios. Ship watermarked, lower-fidelity previews; release the 48kHz WAV and separated stems through gated delivery. A model can only learn from what it can reach.
• Read the license box before you upload. Many platforms claim a broad right to your content the moment you post; some now let you opt out of AI training. That toggle is worth more than any downstream detector.
• Save provenance you control. Session files, project timestamps, and raw takes are the reference a likeness-matching system needs — and the proof you need if the match ever has to be argued.

None of this is glamorous, and none of it will show up in a launch announcement. It holds precisely because it doesn't rely on catching the offender in the act.

Detection has a place in this stack. It shortens the distance between a violation and a response, and for likeness abuse that response can matter enormously to the person on the receiving end. Treat it as the last line, not the wall — the alarm that tells you the door you actually locked was worth locking.

The myth is that AI deepfake detection is a shield that keeps your work from being scraped and cloned in the first place. The more accurate version is that detection is a smoke alarm bolted to a door you still have to lock yourself — it narrows the gap between the theft and your answer, and the defenses that truly hold are the ones that never depended on catching anyone.