AI lie detection and the problem of data leakage

Humans are not good at detecting lies. We apparently have about 54% accuracy¹. Polygraphs are not a good solution either. Their performance varies a lot². Luckily AI might have some potential to accurately spot lies. That is, according to this paper³ that got accepted at ICCV, a model trained on voice and facial expressions gets about 67% accuracy. Another paper⁴ that uses the same deception detection benchmark even gets ~80% accuracy!!

This is an amazing result. First, humans with 54% accuracy only do slightly better than random guessing. Second, it is only based on audio and video. There's no need to measure heart rate or skin conductivity, which means that if it is accurate enough we could look back at videos in history and see who lied and who told the truth. Finally, it's amazing because it was achieved using a tiny tiny dataset. Less than 2000 samples of lies/truths were used. This is very little for anything to do with non-tabular data like voice and face recognition.

Imagine what would happen if we were to 100x this dataset. Could we get to 90% accuracy? Maybe even 99%? What if we 1000x the dataset? That is what I wanted to find out.

Luckily, with the amount of lying-based games on the internet, it is possible to, relativeley cheaply, create a new dataset that is 100 times larger than DOLOS. So after reaching the same size as DOLOS (less than 1% of the actual goal) I wanted to see how well the baseline classifier would do. Because it is a similar size I expected roughly the same accuracy. But no, my model got ~50% instead of the expected ~70%. It was no better than random guessing. But according to that paper it should be possible with such a tiny dataset. So then what was different?

The difference was in the test set. I tested on different people from different games. Their test set repeats some of the same people from the same episode as in training! In fact 1,060/1,152 (92.0%) of the test clips share a person-episode pair in training. To be clear: none of the test clips are the same as the training clips. They just often share the same person and episode. This is a red flag because they assigned the lie/truth label per story per episode. So as an example, imagine you have three training clips and a test clip all from the story from the same episode. If that story is labelled as a lie, recognizing the person and episode can be enough to predict the label.

We can test how bad this is by creating a leakage model. This model is not trained on audio or video at all. It just predicts the most common training label from that person-episode pair. Unfortunately, this leakage model gets 84% accuracy... So if the neural network can just recognize who is speaking and from which episode it is, it could potentially get a high score on the benchmark without any learned deception detection.

So we now know that there exists a shortcut that the model can use to reach a high accuracy without learning deception detection. The question then is, could a neural network actually find this shortcut with the audio and video as input? In theory, this should be possible. After all it could learn to recognize the person based on voice and the episode based on the lighting or specific clothes. I tested this by building a small model whose job was to recognize the person-episode pair. As you can see from Figure 2, a model that uses averaged features from just four frames per clip - so not even voice or all frames like the full model would have access to - already correctly recognizes 75.7% of the person-episode pairs in the test set. I also ran this with a crop around the detected face to see whether removing most of the scene would harm the classification significantly. Finally, there is a version with random labels to the pairs (that have nothing to do with deception detection) and it could identify those random labels with 88% accuracy. If the small model I used here can easily recognize the pairs and corresponding labels, then the much larger model from the paper should be capable of this as well. (See appendix for the technical details)

For the next test, I trained a classifier on the truth/lie labels and compared different test sets. This answers what happens when we "fix" the deception detection benchmark, that is what happens when we make sure that the test set has unseen person-episode pairs. As you probably guessed, the accuracy falls to just random guessing. Based on the figure (Figure 3), you can see that the highest performance comes from the face-crop model (56.7%) but always prediciting the majority label gets 56.8% so this is not an improvement over that simple baseline.

We now know that there is a shortcut in the benchmark. The model can find the shortcut and if we remove access to the shortcut, the accuracy plummets. It is safe to say that a high score on this benchmark does not mean that the model has learned deception detection. It probably means that it has learned to recognize which person from which episode it is. DOLOS is therefore not a deception detection benchmark, but closer to a person-episode classification benchmark.

Don't be an idiot like me.When I first read this paper, I thought the results were amazing. I believed that, because the dataset was so small, there was a lot of untapped potential. So after reading the paper, I decided to expand the dataset using the hundreds of thousands of lying-based games that were streamed on the internet. After months of work (most of it was scraping youtube while still complying with their ToS) and 2% of grant money already spent, I noticed the red flag and verified the rest of this post. All of this could have been avoided if I had thoroughly scrutinized the code beforehand. I naively assumed that because it got accepted at ICCV, it wouldn't do something as silly as not testing on unseen participants... That was wrong and it led to wasted time and money.

Appendix

A. Exact prediction rules

Let T be a training fold, y_i ∈ {0,1} the annotation (1=deception), and g_i the person–source pair. Compute:

G_T = {g_i : i ∈ T}
μ_g = sum(y_i for i ∈ T with g_i=g) / count(i ∈ T with g_i=g)
μ_T = sum(y_i for i ∈ T) / |T|

s_j = μ_(g_j) if g_j ∈ G_T, else μ_T
ŷ_j = 1[s_j ≥ 0.5]

For the visual recognizer, z_j is the frozen averaged image representation and p_θ(g | z_j) is a softmax over training pairs:

Fit θ on training representations and pair IDs using cross-entropy. No truth/deception labels enter this recognition training objective.

s_j = sum(p_θ(g | z_j) * μ_g for g ∈ G_T)
ŷ_j = 1[s_j ≥ 0.5]

ĝ_j = argmax_g p_θ(g | z_j)
correct_j = 1[ĝ_j = g_j]

For the artificial-label control, one independent Bernoulli(0.5) label r_g is assigned to each eligible pair. (Replace μ_g with r_g in the transfer formula and evaluate against r_(g_j))

B. Results

Historical overlap and metadata results

Recognition, transfer, and nearest-clip retrieval

Direct classifier and matched split differences

C. AI-generated implementation notes

Everything written in the section below was written by AI after I asked it to write a concise report on how to reproduce the code used for obtaining the above results. Let me know if you have any question or want to see the original code.

Source and cohort accounting

Official historical metadata/protocol commit: 899c42ac2b086492b49e5bbee198895fb2c4c4dc.

Released code audit commit: 21f4ad78dd77544550d0067ce476b0138d386d29.

Historical annotations: 1,678 rows; 1,677 distinct filenames; two rows share one filename but different intervals. Exclude both ambiguous rows, leaving 1,676.

Historical protocol: 1,152 unique clips, no ambiguous filename, 660 deception / 492 truth labels. The test folds partition this cohort exactly. No metadata-join failures or protocol/annotation label disagreements.

Media: 1,058 decoded protocol clips; 94 absent. Thirteen fail timing consistency, leaving 1,045 (594 deception / 451 truth), 52 source videos. No exact duplicate hashes. Eight eligible clips lack Haar detections and use full-frame fallback in the face view.

Model and evaluation details

Generic ImageNet ResNet-18 (V1 weights) is frozen in evaluation mode. OpenCV samples frame indices floor(n × [0.125,0.375,0.625,0.875]). Full frames are resized to 224×224, then passed through the torchvision weight transform (resize 256, center crop 224 and ImageNet normalization). This resizes aspect ratio and is an acknowledged preprocessing choice. Features are averaged over frames. For faces, a Haar detector runs at a maximum width of 640 pixels; the largest detection is cropped with a 10% margin, resized and encoded identically. Face features average only successfully detected frames, falling back to full frames only when no frame has a detection. No detector is fine-tuned.

Features have 512 dimensions. A StandardScaler is fitted to training clips only, followed by Linear(512,256), ReLU, Dropout(0.2), Linear(256,K). K is 2 for direct classification or the number of distinct training pairs for recognition. Cross-entropy, AdamW, batch size 64, fixed 100 epochs. All training clips participate each epoch; no class weighting, validation tuning, or test-based selection. Seeds are 17, 29 and 43; NumPy and PyTorch seeded, CPU deterministic algorithms enabled. There are 90 fits: 18 recognizers and 72 binary classifiers. The exact nearest-neighbor baseline uses cosine similarity on unstandardized frozen features and copies the nearest training clip's binary label.

The synthetic control samples one Bernoulli(0.5) label per pair, once using NumPy seed 20261017 and sorted eligible pair IDs. It transfers those labels through each trained recognizer's posterior. It neither trains a deception detector on those labels nor measures actual deception. Only one synthetic label assignment is used; the three runs vary recognition training seed. Its majority baseline uses synthetic training labels only.

Grouped folds use StratifiedGroupKFold(3, shuffle=True, random_state=20261017) on the 1,152-clip cohort, separately grouping by pair, source ID, or name string. Stratification uses labels to balance partitions; predictive fitting does not use held-out labels. The 1,045-clip media cohort is an intersection with these saved folds, not a new split. A new partition can change training composition as well as overlap; the observed performance difference is not an isolated causal estimate of identity dependence.

Metrics and uncertainty

Deception=1, truth=0. Threshold is always 0.5, including ties. Lookup fallback is the training mean. Results include accuracy, balanced accuracy, deception-class F1, probability ROC-AUC, hard-prediction ROC-AUC and Brier score. Fold-level AUCs are preferred to a pooled cross-fold AUC, since scores from different fitted models need not be calibrated comparably. The headline metadata score is pooled out-of-fold accuracy. Neural headline scores average the three seeds' pooled accuracies; they do not ensemble probabilities or select the best seed.

For each plotted interval, average correctness over seeds for each clip (where applicable), aggregate correct totals and clip counts within source video, sample source videos with replacement 10,000 times (seed 20261017), and take the 2.5th and 97.5th percentiles of the clip-weighted accuracy. The paired split comparison resamples source videos after differencing the same clips' seed-averaged correctness. These are descriptive intervals conditional on the fitted models and cohort, not a complete sampling theory for cross-validation. They do not incorporate training-set uncertainty or remove possible dependence between recordings containing the same person. Metadata results also include pair-cluster intervals in audit_summary.json.

The training-label randomization shuffles labels independently within each fold's training set, re-fits the lookup and evaluates the original test labels, 1,000 times. Its empirical exceedance fraction is not reported as a formal hypothesis-test p-value because training sets overlap and the control is not a joint exchangeable-label permutation test.

Neural run settings

{
  "seeds": [
    17,
    29,
    43
  ],
  "epochs": 100,
  "hidden": 256,
  "dropout": 0.2,
  "optimizer": "AdamW",
  "lr": 0.001,
  "weight_decay": 0.01,
  "batch_size": 64,
  "device": "cpu",
  "test_selection": false,
  "elapsed_seconds": 66.23621773719788,
  "views": [
    "full",
    "face"
  ],
  "feature_dim": 512
}

All neural summary rows

Intervals below are source-video cluster bootstrap intervals; seed range is the range of pooled accuracy across runs. Metadata baselines and nearest-neighbor retrieval are deterministic and use one run.