Error Level Analysis
Re-saves the image as JPEG and compares it to the original: a spliced or edited region carries a different compression history and so changes differently from the rest. The residual is read relative to local edge content, because edges and text are naturally high-residual, so only blocks whose residual is not explained by their edges are flagged. It works on the pixels alone, with no model.
Technical description
I1 is a deterministic, generator-agnostic screen for localized manipulation based on Error Level Analysis (ELA). When a JPEG is re-encoded, each region moves toward the fixed point of the quantisation it already carries, so a region with a different compression history, a splice, a paste, a retouch, releases a different recompression residual than its surroundings. The raw ELA map is notoriously hard to read, because edges, text, and high-contrast boundaries produce high residuals whether or not they were edited, and because an image that was never compressed shows a high residual everywhere. I1 addresses both by working in 16 by 16 blocks and judging each block's residual relative to its own edge content rather than in absolute terms, flagging only blocks whose residual exceeds what their edges predict. The result is a 0 to 5 score. It requires the image to be at least 16 by 16 pixels.
How it works
The indicator runs deterministically at Layer 1. It converts the image to RGB, re-encodes it as JPEG at quality 90 to obtain a recompressed copy I', and forms the per-pixel residual averaged over the three channels, D(x, y) = (1/3) Σ_{c in {R,G,B}} |I_c(x, y) − I'_c(x, y)|. A region that was spliced or edited carries a different compression history from the rest of the image and so releases a different residual under this single recompression.
Because edges, text, and high-contrast boundaries produce a high residual whether or not they were manipulated, the residual is interpreted relative to local edge content rather than in absolute terms. The luminance L = (R + G + B) / 3 is taken and its gradient magnitude is computed with the Sobel operator as G(x, y) = sqrt(G_x² + G_y²), where G_x and G_y are the horizontal and vertical Sobel derivatives. The image is tiled into 16 by 16 blocks, and for each block the mean residual M_b and the mean edge magnitude E_b are recorded.
A block is judged anomalous when its residual is not explained by its edges. The edge-normalised ratio is r_b = M_b / (E_b + 8), where the constant 8 keeps the ratio finite in near-flat blocks. The baseline is taken over the content blocks only, those whose residual M_b exceeds the floor of 6, so that the flat background of a figure does not bias the statistics and ordinary text does not get flagged. With med and MAD the median and the median absolute deviation of r over the content blocks, the robust scale is s = max(1.4826 · MAD, 0.15 · |med|), and a content block is flagged when r_b > med + 3.5 · s. Using a ratio, rather than a least-squares fit of residual against edge content, keeps the test robust to the very outliers it is meant to find, since a least-squares line bends toward a lone anomaly.
Let c be the number of flagged blocks out of T total blocks. The score is min(5.0, (c / T) · 40), raised to at least 2.0 when c >= 3, so that a clear localized cluster of edit-consistent blocks reaches a warning while a single noisy block does not. The metadata records the overall mean and standard deviation of the residual, the number of flagged blocks, the total block count, and the recompression quality.
Score thresholds
| Score | Meaning |
|---|---|
| 0 to 1 | No block has a residual beyond what its edge content predicts. Consistent with a uniform compression history. |
| 2 to 3 | A localized cluster of blocks carries residual inconsistent with their edges, a possible local edit or splice. |
| 4 to 5 | Many such blocks, or a large region, with anomalous residual. Consistent with substantial editing. |
Why this matters
Error Level Analysis, introduced by Krawetz, has been a front-line tool for spotting edits since a single recompression makes regions with different compression histories release different residuals, which exposes splicing, copy-paste, and retouching [1]. Its well-documented weakness is interpretation: edges, text, and textures naturally produce high residuals, and a recent evaluation found pure ELA reaching only modest splice-detection accuracy on standard datasets precisely because natural textures mimic the artifact, so raw ELA alone is unreliable and is best combined with content-aware cues [3]. The modern line of work confirms the direction: learned models that read JPEG compression artifacts directly localise manipulation far better than the raw residual [2], and edge-weighted networks improve splicing localisation by reasoning about where edges do and do not explain the evidence [4]. I1 brings that lesson into a deterministic screen by normalising the residual by local edge content, so a high residual at a text boundary, which is expected, is not confused with a high residual in a region whose edges do not justify it, which is the trace of an edit.
Limitations
ELA is a screen, not proof, and several limits bound it. It needs a compression history to read: an image saved once losslessly, or one recompressed many times, carries little differential signal, and screenshots or heavily re-saved figures weaken it. The edge-normalisation removes the most common false positives from edges and text but cannot create signal where there is none, so a flat pasted region, which compresses to near-zero residual regardless of origin, is invisible to it, and copy-move within the same image, where the source and target share a compression history, is by construction outside its reach. The thresholds are directional, and a genuinely composited figure assembled from panels of different origin can show benign block-to-block differences. Whole-image frequency fingerprints, noise-residual consistency, copy-move detection, and JPEG-ghost analysis of multiple recompression qualities live in the sibling image-forensics indicators, and chart-text-localized editing lives in the chart-forensics module, so I1 stays on single-quality, edge-normalised ELA to remain complementary.
Theoretical background
I1 rests on the fixed-point behaviour of lossy compression. JPEG quantises the discrete cosine transform of each 8 by 8 block, so re-encoding an already-compressed region changes it little, while a region encoded under a different quantisation, or never quantised at all, changes more, and the magnitude of that change is the error level. The confounder is that the change also grows with local high-frequency content, because sharp edges carry energy in the high-frequency coefficients that quantisation rounds. I1 separates the two by modelling the residual as proportional to edge content and flagging the part that is not, which is the contribution of an inconsistent compression history. The ratio statistic and the content-only baseline make this robust to the sparse, strong anomalies that an edit produces. The signal is a physical property of how the pixels were encoded rather than a learned fingerprint of a generator, which keeps the screen independent of how the image was produced.
References
- Krawetz N. A Picture's Worth: Digital Image Analysis and Forensics (Error Level Analysis). Black Hat USA Briefings. 2007. https://www.hackerfactor.com/papers/bh-usa-07-krawetz-wp.pdf
- Kwon MJ, Nam SH, Yu IJ, Lee HK, Kim C. Learning JPEG Compression Artifacts for Image Manipulation Detection and Localization. International Journal of Computer Vision. 2022. arXiv:2108.12947. https://arxiv.org/abs/2108.12947
- Nagm AM, Moussa MM, Shoitan R, Ali A, Mashhour M, Salama AS, AbdulWakel HI. Detecting image manipulation with ELA-CNN integration: a powerful framework for authenticity verification. PeerJ Computer Science. 2024;10:e2205. DOI: 10.7717/peerj-cs.2205
- Akram A, Jaffar MA, Rashid J, Boulaaras SM, Faheem M. CMV2U-Net: A U-shaped network with edge-weighted features for detecting and localizing image splicing. Journal of Forensic Sciences. 2025. DOI: 10.1111/1556-4029.70033