How JPEG Recompression Detects Image Forgery

JPEG recompression detection is a core digital forensics technique used to uncover spliced or altered photos by analyzing mathematical inconsistencies left behind during the saving process. When an image is manipulated—such as pasting an object from one photo into another—and re-saved, the modified regions often retain distinct compression histories compared to the untampered areas. This article explains how the JPEG compression process works, how forensic tools detect double compression and grid misalignments, and how these artifacts expose photographic forgery.

The Mechanics of JPEG Compression

To understand recompression detection, it is essential to look at standard JPEG encoding. When a camera or software saves a file as a JPEG, it performs three key steps:

1. Block Division: The image is split into regular grids of 8x8 pixels.
2. Discrete Cosine Transform (DCT): Each 8x8 block is converted from spatial pixel values into frequency domain coefficients.
3. Quantization: High-frequency visual details are discarded using a specific quantization table, which determines the file's compression level and visual quality.

Quantization is a lossy process. Once these high-frequency values are divided and rounded to integers, the original data cannot be perfectly restored.

How Splicing Creates Compression Inconsistencies

Image splicing occurs when an element from a donor image is pasted into a host image. When the final composite is saved as a new JPEG, it undergoes recompression. This creates two detectable forensic anomalies: double quantization effects and block grid misalignment.

1. Double Quantization (DQ) Artifacts

If an image is compressed once at quality level \(Q_1\) and later re-saved at quality level \(Q_2\), the DCT coefficients undergo double quantization. This creates periodic peaks and valleys in the histogram of the DCT coefficients—patterns that never occur in an authentic, singly compressed image.

In a spliced photo, the background might experience uniform double compression, while a newly drawn or uncompressed object only experiences single compression. Conversely, if a pre-compressed donor patch is pasted into a raw image, only the spliced region will exhibit double compression artifacts. Forensic software identifies these localized statistical differences to map out forged areas.

2. Grid Misalignment

Because JPEG operates on rigid 8x8 pixel grids, splicing an object from one image to another almost always disrupts this geometry. Unless the perpetrator precisely aligns the pasted object to match the exact 8x8 block boundaries of the host canvas, the spliced patch will have its original 8x8 grid shifted relative to the rest of the image.

Forensic algorithms detect these mismatched block boundary artifacts, pinpointing spliced borders even if the visual seams have been feathered or smoothed using photo editing software.

3. Ghost Artifacts

When an image is recompressed at a lower quality than its original state, the error introduced between the successive compressions reaches a measurable minimum when tested against the original compression parameters. Forensic tools can test an image against multiple quality factors to reveal "JPEG ghosts"—shadowy visual footprints that highlight regions with differing compression histories.

Practical Application and Limitations

JPEG recompression analysis is non-destructive and operates on the underlying data rather than visual plausibility. It effectively uncovers edits that are invisible to the naked eye.

However, the technique has operational boundaries:

• Multiple Global Saves: Repeatedly re-saving the entire image at low quality can eventually overwrite and homogenize local forensic traces.
• Anti-Forensic Techniques: Deliberate noise injection or severe post-processing, such as aggressive blurring, can obscure coefficient distributions.

Despite these limitations, JPEG recompression detection remains one of the most reliable and mathematically grounded methods for validating digital media authenticity.