Format-Controlled Multi-Scale JPEG Compression Response Analysis for Image-Level Forgery Screening

Source: arXiv:2607.06615 · Published 2026-07-07 · By Sujith K Mandala

TL;DR

This paper addresses the problem of lightweight, interpretable, image-level forgery screening based on JPEG compression inconsistencies. Prior deep learning methods for image forgery detection often require expensive GPU acceleration, have millions of parameters, and lack interpretability, limiting practical forensic deployment. The authors propose a novel handcrafted feature engineering approach that leverages multi-scale Error Level Analysis (ELA) computed at seven JPEG quality levels, combined with cross-quality ELA ratio features and complementary handcrafted features spanning spatial entropy, frequency domain (FFT energy bands), edge density, SRM residuals, and DCT blockiness. These 405-dimensional features are classified using a gradient boosted tree method on CPU with sub-second inference times. Crucially, the paper identifies and controls a severe format confound in the popular CASIA v2.0 dataset, where 60% of tampered images are TIFF but authentic images are JPEG/BMP, enabling trivial format-based shortcuts. By focusing on a rigorously format-controlled JPEG-only subset (9,501 images), the proposed method attains a robust image-level forgery AUC of 0.990 and F1-score of 0.905 under 5-fold cross validation, and 0.976 AUC under source-aware splitting. An ablation study shows the dominant contribution comes from multi-scale ELA (+0.180 AUC gain over single-quality ELA), while cross-quality ratio features add complementary signal. External dataset transfer experiments delimit the method’s scope to compression-history inconsistency detection rather than generic manipulation. Overall, the work demonstrates that careful multi-scale handcrafted compression artifact analysis can achieve state-of-the-art forgery screening results on CPU with interpretable features and strong format bias control.

Key findings

• Multi-scale ELA across seven JPEG qualities (q∈{30,50,60,75,80,90,95}) improves AUC by +0.180 over single-quality ELA (0.806 → 0.986) on the CASIA JPEG-only subset.
• Cross-quality ELA ratio features (16 features) alone achieve 0.985 AUC, adding +0.003 AUC when combined with multi-scale ELA.
• The complete 405-dimensional feature set achieves 0.990 AUC, 0.905 F1, and 0.958 accuracy on the 9,501 image CASIA JPEG-only subset via 5-fold stratified cross-validation.
• Under a conservative source-aware group split preventing source overlap between train/test, AUC remains a high 0.976.
• Utilizing the entire mixed-format CASIA v2.0 dataset without controlling for format leakage inflates performance to 0.971 AUC due to TIFF/ JPEG confounds where 60% of tampered images are TIFF while authentic images are JPEG/BMP.
• File metadata features alone can achieve up to 0.924 AUC on mixed CASIA v2.0, demonstrating dataset bias.
• External zero-shot transfer results show moderate performance on Columbia splicing blocks (AUC = 0.708) but chance-level results on CoMoFoD same-image copy-move (AUC = 0.499), delimiting the method’s applicability to cross-source double-JPEG manipulations.
• The method runs in approximately 0.4 seconds per image on a single Apple M3 Pro CPU core, supporting efficient CPU-only deployment.

Threat model

The adversary modifies images through splicing or copy-move manipulations that induce heterogeneous JPEG compression histories within the image but cannot perfectly erase or mimic double-compression artifacts. The adversary cannot avoid leaving compression inconsistencies without either recompressing uniformly or applying heavy post-processing that destroys forensic traces. The defender assumes JPEG compression artifacts are present and accessible; the adversary is constrained by the structural compression residuals left by these JPEG operations.

Methodology — deep read

1. Threat Model & Assumptions: The adversary attempts to create forged images via splicing or copy-move manipulations that induce heterogeneous JPEG compression histories within the image. The attacker cannot perfectly harmonize compression artifacts to avoid double-compression signatures. The method assumes JPEG compression artifacts are present and detects inconsistencies from double JPEG compression. The adversary cannot remove or mimic these compression traces perfectly without resampling or heavy post-processing.

2. Data: The main dataset is CASIA v2.0, containing 12,614 images (7,491 authentic, 5,123 tampered). Tampered images include splicing and copy-move manipulations, with mixed image formats (JPEG, TIFF, BMP). A key insight is the presence of a format confound: 60% of tampered images are TIFF while authentic images are JPEG/BMP only. The authors isolate a JPEG-only subset (7,437 authentic JPEG + 2,064 tampered JPEG) for format-controlled evaluation.

3. Feature Extraction: The pipeline extracts handcrafted features in seven families totaling 405 features. The cornerstone is multi-scale ELA: The input image is recompressed at seven JPEG quality levels (30,50,60,75,80,90,95). ELA residual maps are computed by pixel-wise absolute difference between original and recompressed image for each color channel. From each residual map, global statistics (mean, std dev, 75th, 95th, 99th percentiles, and high-residual fraction) and spatial grid (4x4 cells, mean and std dev per cell) statistics yield 266 features.

Cross-quality ELA ratio features are computed by averaging residual maps across channels then taking pairwise ratios between selected quality pairs to capture double-compression signatures (16 features).

Complementary features include: entropy of ELA maps at q=50 divided on 4x4 grid (18 features), frequency-domain radial FFT energy bands (6 features), edge density statistics via Sobel gradients (20 features), SRM steganalysis residuals using high-pass filters (27 features), and DCT blockiness plus noise and color stats (52 features).

4. Classification: Features are fed into a HistGradientBoostingClassifier with 1,000 max iterations and early stopping (patience 50), learning rate 0.03, max tree depth 8, min 20 samples per leaf, L2 regularization 1.0, and 255 histogram bins. Inverse sample weighting compensates for class imbalance.

5. Training Regime: Evaluation uses stratified 5-fold cross-validation with fixed random seed 42 and median threshold selection based on validation folds. A source-aware group split prevents images sharing the same source from appearing in both train and test to avoid source correlation bias.

6. Evaluation Protocol: Primary metrics are AUC, F1-score, and classification accuracy reported per fold and averaged with 95% confidence intervals. Multiple evaluation protocols assess format leakage (mixed-format vs JPEG-only), source-awareness, and robustness to post-processing degradations (Gaussian blur, downscaling). Ablations dissect incremental feature contributions, and external zero-shot transfer tests probe generalization.

7. Computational Analysis: Feature extraction dominated by seven JPEG re-compressions (linear in pixel count). Classification cost negligible. Runtime measured on Apple M3 Pro CPU is ~0.4s per image single core, ~25 images/s at 10-core parallelization.

Example: For a test image, the pipeline resizes (max dimension 1024px), produces seven ELA residual maps from different JPEG qualities, extracts global and spatial statistics for each map, computes cross-quality ratios, and auxiliary feature families. The 405D vector is input to the gradient boosted model, resulting in a binary authenticity score. Spatial ELA maps provide intuitive visualization aiding interpretability.

Technical innovations

• Introduction of multi-scale ELA across seven JPEG quality levels to resolve single-quality ELA’s sensitivity to unknown compression quality.
• Novel cross-quality ELA ratio features that capture double-compression artifacts invariant to absolute residual magnitude.
• Rigorous format-controlled evaluation methodology isolating JPEG-only subset to avoid confounding from non-forensic metadata and container format bias.
• Comprehensive handcrafted 405-dimensional feature vector combining multi-scale ELA, cross-quality ratios, spatial entropy, FFT bands, edge density, SRM residuals, and DCT blockiness for interpretable CPU-only forgery screening.

Datasets

• CASIA v2.0 — 12,614 images (7,491 authentic, 5,123 tampered) — mixed JPEG, TIFF, BMP with tampered format confound
• CASIA JPEG-only subset — 9,501 images (7,437 authentic JPEG + 2,064 tampered JPEG) — format-controlled subset derived from CASIA v2.0
• Columbia image splicing blocks — 1,845 image blocks (933 authentic, 912 spliced) — external dataset for zero-shot transfer
• CoMoFoD small JPEG subset — 3,600 images (copy-move negative control) — external zero-shot negative control dataset

Baselines vs proposed

• Single-quality ELA (q=75): AUC = 0.806, F1 = 0.595 vs proposed multi-scale ELA + all features: AUC = 0.990, F1 = 0.905 (JPEG-only subset)
• Cross-quality ratio features only: AUC = 0.985, F1 = 0.882 vs full features AUC = 0.990
• Multi-scale ELA only: AUC = 0.986, F1 = 0.892 vs full features AUC = 0.990
• Format leakage metadata baseline: file metadata combined AUC 0.924 vs image-content based method AUC 0.971 on mixed-format
• External transfer to Columbia splicing blocks: AUC = 0.708 vs CASIA JPEG-only in-domain AUC = 0.990
• External transfer to CoMoFoD copy-move: AUC = 0.499 (chance) vs CASIA copy-move detection AUC = 0.992

Figures from the paper

Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2607.06615.

Fig 1: ELA visualization for an authentic image (top) and tampered

Fig 2 (page 2).

Fig 3 (page 2).

Fig 4 (page 2).

Fig 5 (page 2).

Fig 6 (page 2).

Fig 7 (page 2).

Fig 8 (page 2).

Limitations

• Focused exclusively on images with JPEG compression history; lossless or PNG-only images yield uninformative ELA residuals.
• The method detects compression-history inconsistencies but cannot localize manipulations at pixel level—only image-level binary classification is provided.
• Robustness degrades under heavy post-processing like strong Gaussian blur (σ=2) or 50% downscaling, which destroy compression-domain traces.
• External transfer performance is moderate or poor depending on dataset and manipulation type — limited generalization beyond CASIA JPEG-source forgery scenarios.
• Same-image copy-move manipulations preserving compression uniformity (like CoMoFoD) escape detection, delimiting scope to cross-source multiple-compression manipulations.
• Format-controlled evaluation requires explicit filtering of TIFF and BMP images; prior work using full CASIA v2.0 may have reported inflated results due to format leakage.

Open questions / follow-ons

• How to extend multi-scale compression response features to pixel-level manipulation localization for precise tamper boundary detection?
• Can the method be adapted or extended to detect forgeries or manipulations in AI-generated content that lacks double-compression artifacts?
• How to combine this compression-history inconsistency detection with complementary copy-move detectors that target same-image duplication without compression changes?
• How does the method generalize across diverse real-world datasets beyond CASIA, NIST MFC, and DSO-1, particularly under varying JPEG compression chains?

Why it matters for bot defense

For bot-defense and CAPTCHA practitioners, the paper offers a compelling CPU-efficient, interpretable screening method capable of reliably detecting image forgeries by exploiting intrinsic JPEG compression artifact inconsistencies. Its lightweight nature and sub-second inference times make it suitable for large-scale automated image integrity screening without requiring costly GPU resources, often a barrier for deployment in production pipelines. The explicit format-controlled evaluation demonstrates the importance of avoiding dataset biases and format shortcuts that could cause misleadingly high detection rates in forensic benchmarks. Although it does not provide pixel-level localization, the method’s focus on forensic signal robustness and interpretability is valuable for upstream forgery screening prior to more computationally intensive analysis or human review. However, its limited effectiveness against copy-move forgeries preserving compression uniformity and degraded robustness under heavy image post-processing indicate that it should be combined with complementary detection methods for comprehensive bot-defense. Overall, this approach strengthens the portfolio of practical forgery screening techniques applicable in real-world image authenticity verification contexts relevant to CAPTCHA and bot-defense.

Cite

@article{arxiv2607_06615,
  title={ Format-Controlled Multi-Scale JPEG Compression Response Analysis for Image-Level Forgery Screening },
  author={ Sujith K Mandala },
  journal={arXiv preprint arXiv:2607.06615},
  year={ 2026 },
  url={https://arxiv.org/abs/2607.06615}
}

Read the full paper

• arXiv:2607.06615 (abstract)
• arXiv:2607.06615 (PDF)