How JPEG Re-Saving Alters Benford's Law in DCTs

Re-saving a tampered JPEG image significantly alters the statistical distribution of its Discrete Cosine Transform (DCT) coefficients, causing them to deviate from Generalized Benford’s Law. While pristine JPEG images naturally adhere to a logarithmic first-digit distribution across their DCT coefficients, localized manipulation combined with a second compression cycle introduces double quantization artifacts, grid misalignment, and mixed frequency statistics. This article explains how the JPEG compression pipeline interacts with Benford's Law, the exact mechanics of how tampering and re-saving disrupt this distribution, and how forensic analysts measure these anomalies to detect forgery.

Benford's Law in Pristine JPEG Compression

In unmodified JPEG images, the Discrete Cosine Transform converts 8x8 pixel blocks from the spatial domain into the frequency domain. These resulting DCT coefficients—particularly the alternating current (AC) coefficients that represent image details and textures—exhibit a natural logarithmic decay in their magnitude. When these coefficients are quantized, the distribution of their first significant digits closely follows Generalized Benford’s Law (GBL):

\[P(D = d) = N \log_{10} \left(1 + \frac{1}{s + d^q}\right)\]

In this model, \(d \in \{1, 2, \dots, 9\}\) represents the first significant digit, while \(N\), \(s\), and \(q\) are fitting parameters dependent on the image content and quantization table. In an authentic, single-compressed JPEG, the probability of a coefficient beginning with the digit 1 is highest (approximately 30%), progressively decreasing as the digits increase toward 9.

The Impact of Image Tampering

Tampering typically involves operations such as splicing, cloning, or object removal. When a patch from one image is pasted into another:

• Grid Misalignment: The 8x8 DCT grid of the inserted patch rarely aligns perfectly with the host image's original 8x8 grid. This disrupts the phase coherence of the underlying pixel blocks.
• Statistical Inconsistency: The spliced region often originates from an image compressed with a different quantization matrix, introducing foreign frequency distributions to localized blocks.
• Spatial Filtering: Post-processing operations like feathering, blurring, or resizing smooth the edges of spliced elements. This reduces high-frequency AC coefficients, skewing the expected spread of values prior to re-saving.

How Re-Saving Alters the First-Digit Distribution

When the modified image is saved again as a JPEG, the entire canvas undergoes a second round of compression, known as double quantization. This process fundamentally breaks Benford's Law in three specific ways:

1. Periodic Histogram Artifacts (Comb Effects): Re-quantizing DCT coefficients with a new step size causes certain bins in the coefficient histogram to become depleted while others accumulate an unnatural concentration of values. This periodicity directly distorts the smooth, monotonic decline dictated by Benford's Law, creating anomalous spikes in specific first digits.
2. Shifted First-Digit Probabilities: If the second compression uses a lower quality factor (coarser quantization), many mid-to-high frequency coefficients are rounded down to zero. The remaining non-zero coefficients cluster heavily around lower integers (such as \(\pm 1\) and \(\pm 2\)), artificially inflating the probability of digit 1 beyond standard GBL predictions. Conversely, if a finer quantization step is applied, previously quantized intervals are split irregularly, producing non-conforming distributions across higher digits like 3, 4, or 5.
3. Local vs. Global Divergence: The untampered background undergoes uniform double compression, whereas the tampered region undergoes a divergent transformation (such as uncompressed-to-compressed, or double compression with misaligned block boundaries). When the entire image is measured globally, the mixture of two distinct statistical profiles flattens or warps the overall GBL curve.

Forensic Detection

Digital forensics detects these alterations by extracting the first significant digits of the dequantized AC coefficients across all 8x8 blocks. The observed digit frequencies are compared against the theoretical Generalized Benford's Law distribution using statistical goodness-of-fit metrics, most commonly the Chi-Square (\(\chi^2\)) test or the Kolmogorov-Smirnov test.

A high goodness-of-fit error indicates double compression or tampering. Furthermore, running Benford analysis across sliding windows or individual 8x8 blocks allows analysts to isolate the exact boundaries of the forged region, as spliced sections display localized spikes in statistical deviation compared to the rest of the image.