I1Image forensicsGeneric ForensicsLayer 1 (Deterministic)

Error Level Analysis

Reveals manipulated areas in images by re-saving the image and comparing the differences. Edited regions stand out because they degrade differently than the rest of the image.

Technical description

Re-encodes the image as JPEG at quality 90 and forms the per-pixel residual averaged over the RGB channels, D = (1/3) Sum_c |I_c − I'_c|. A spliced or edited region carries a different compression history and so releases a different residual. Because edges, text, and high-contrast boundaries are naturally high-residual, the residual is read relative to local edge content: the luminance gradient magnitude is computed with the Sobel operator, the image is tiled into 16x16 blocks, and for each block the mean residual M_b and mean edge magnitude E_b are taken. The edge-normalised ratio r_b = M_b / (E_b + 8) is compared to a baseline built from the content blocks only (M_b above 6): a block is anomalous when r_b exceeds the median by more than 3.5 robust standard deviations (scale = max(1.4826*MAD, 0.15*|median|)). The score is min(5.0, (flagged/total)*40), raised to at least 2.0 for three or more flagged blocks.

How it works

Layer 1 (deterministic). Recompresses at JPEG quality 90, forms the per-pixel residual, and computes the luminance edge magnitude with the Sobel operator. Per 16x16 block it takes the mean residual and mean edge magnitude, forms the edge-normalised ratio, and flags content blocks whose ratio is a robust outlier among the content blocks. Scores from the fraction of flagged blocks, raised to a warning for a clear cluster, and reports the residual statistics, the flagged-block count, and the total block count.

Why this matters

ELA exploits the physics of JPEG compression: re-encoding moves each region toward the fixed point of the quantisation it already carries, so a region with a different compression history changes by a different amount, which exposes splicing, paste, and retouch. Its known weakness is that edges, text, and textures are naturally high-residual, so raw ELA is unreliable and best combined with content-aware cues. Reading the residual relative to local edge content separates a high residual at a text boundary, which is expected, from a high residual that the edges do not justify, which is the trace of an edit.

Score thresholds

0-1: No block has a residual beyond what its edge content predicts, consistent with a uniform compression history
2-3: A localized cluster of blocks carries residual inconsistent with their edges, a possible local edit or splice
4-5: Many such blocks, or a large region, with anomalous residual, consistent with substantial editing

Limitations

A screen, not proof. It needs a compression history to read: a losslessly saved or heavily re-saved image carries little signal. Edge-normalisation removes the common edge and text false positives but cannot create signal where there is none, so a flat pasted region (near-zero residual regardless of origin) is invisible, and copy-move within the same image, where source and target share a history, is out of reach. A figure legitimately assembled from panels of different origin can show benign differences. Frequency fingerprints, noise consistency, copy-move, and JPEG-ghost multi-quality analysis live in sibling image-forensics indicators, and chart-text-localized editing in the chart-forensics module, so I1 stays on single-quality edge-normalised ELA.