I7Image forensicsGeneric ForensicsLayer 1 (Deterministic)

JPEG Ghost

Detects regions that were previously saved at a different quality level, revealing areas that were edited and re-saved separately from the rest of the image.

Technical description

Implements Farid's JPEG ghost method. The JPEG is recompressed at qualities 50, 55, ..., 95; for each quality the per-pixel difference between the original and the recompression is taken, and its mean over each 16x16 block gives every block a curve of difference against quality. A region previously compressed at quality Q dips to a minimum near Q, so each block's ghost quality is the quality minimising its curve. Only textured blocks are used (curve spread above 0.5), and a block is anomalous when its ghost quality differs from the consensus (the mode across textured blocks) by more than 10 quality units. The score is min(5.0, 25 * anomalous / textured), so a uniform compression history scores zero and a region with a different history scores high.

How it works

Layer 1 (deterministic, JPEG only). Recompresses at a sweep of qualities, forms per-block difference curves, estimates each textured block's ghost quality, takes the consensus mode, and flags blocks whose ghost quality deviates. Scores from the anomalous-block fraction and reports the estimated and consensus qualities, the per-quality global differences, the block diff coefficient of variation, and the textured and anomalous block counts.

Why this matters

Recompressing a JPEG at the quality it already carries barely changes it, so sweeping the quality and watching where the difference bottoms out localises regions whose prior quality differs from the host, the signature of a splice from another JPEG (Farid). The compression history is a rich, localisable cue: block-grained analyses of the quantisation traces map tampered regions, and learned models read the DCT coefficients to localise manipulation from the same evidence. Reading compression history is one of the strongest pixel-level forensic signals because it is a physical consequence of how the file was built rather than its content.

Score thresholds

0-1: All textured regions share one ghost quality, a single uniform compression history
2-3: A region of moderate size ghosts at a different quality than the rest
4-5: A large region with a different compression history, consistent with a splice from another JPEG

Limitations

Works only on JPEGs and only when the spliced region's prior quality falls within the sweep and differs enough from the host; a splice at nearly the same quality leaves no ghost, and re-saving the composite at low quality erases prior traces. Textured content is required, so the flat-block filter that prevents false positives also blinds the test in smooth areas. The block grid bounds spatial resolution and the thresholds are directional. Single-quality ELA, noise consistency, copy-move, and frequency fingerprints live in sibling indicators.