Ghost Artifact Analysis in JPEG Forensics Explained

Ghost artifact analysis is a digital image forensic technique used to detect whether an image has been compressed multiple times and to estimate the quality levels of previous JPEG compressions. When an image is modified and resaved, the underlying Discrete Cosine Transform (DCT) coefficients retain traces of earlier compression stages. By systematically recompressing the suspected image at varying quality factors and measuring the resulting differences, forensic examiners can identify specific local minima known as "ghosts," which reveal both previous compression qualities and tampered regions.

How JPEG Compression Creates Forensics Traces

JPEG compression is a lossy process that divides an image into 8x8 pixel blocks, transforms these blocks using the Discrete Cosine Transform, and quantizes the resulting frequency coefficients using a specific quantization table determined by a compression quality factor (typically scaled from 1 to 100). Quantization rounds off frequency values, discarding high-frequency details that the human eye is less likely to perceive.

When a JPEG image is decompressed, edited, and saved again, it undergoes double JPEG compression. Unless the exact same quantization parameters and grid alignments are used, this subsequent round introduces subtle mathematical irregularities into the DCT coefficient distribution.

The Mechanics of Ghost Artifact Analysis

Ghost artifact analysis exposes these irregularities through a systematic process:

1. Iterative Recompression: The analyzed image is recompressed multiple times across a full spectrum of JPEG quality factors, usually ranging from 1 to 100.
2. Difference Calculation: For each tested quality factor, the algorithm computes the pixel-by-pixel difference between the recompressed image and the input image. This is typically calculated using the sum of squared differences (SSD) or normalized absolute differences across localized blocks.
3. Error Curve Plotting: The average difference across the image (or localized regions) is plotted against the tested quality levels, generating an error curve.

Identifying Past Quality Levels

When an image originally compressed at quality \(Q_1\) is recompressed at a test quality \(q\), the error behaves predictably based on the relationship between \(q\) and \(Q_1\):

• When \(q = Q_1\): The quantization steps match the original compression. Because the data was already quantized to these specific intervals, applying them again introduces minimal new distortion. This creates a distinct dip or local minimum in the error metric.
• When \(q \neq Q_1\): The mismatch in quantization steps forces the coefficients to be rounded into different intervals, yielding significantly higher difference values.

The dip that occurs when \(q\) matches \(Q_1\) is the "ghost artifact." By locating this minimum on the error curve, analysts can determine the original compression quality factor applied to the file, even if the file was later saved at a different quality level (\(Q_2\)).

Detecting Image Forgeries

Ghost artifact analysis is particularly effective for detecting image splices. If a composite image is created by pasting an object from an image compressed at quality \(Q_A\) into a background compressed at quality \(Q_B\), and the entire composition is then saved at quality \(Q_C\), each section will exhibit different ghost artifacts.

By analyzing the difference maps spatially rather than globally, the spliced object will display a minimum difference at quality \(Q_A\), while the rest of the image reaches its minimum at \(Q_B\). The spliced area will visually stand out as a dark or bright "ghost" silhouette against the surrounding background at specific quality thresholds, providing clear forensic evidence of localized manipulation.