Double JPEG Compression Detection

The foundational statistical artifact exploited for detection. When an image is JPEG compressed, its Discrete Cosine Transform (DCT) coefficients are quantized using a specific quantization table. Decompression and re-compression with a different table causes the coefficient histogram to exhibit periodic peaks and valleys—a pattern absent in singly compressed images. The DQ effect is mathematically modeled as the convolution of the original coefficient distribution with a periodic impulse train, creating a detectable comb-like signature in the histogram's Fourier transform.

A forensic technique to estimate the primary quantization table (the table used during the first compression) from the doubly compressed image. By analyzing the periodicity of the DCT coefficient histogram, the step size of the original quantizer can be recovered. This is achieved by computing the Power Spectral Density (PSD) of the histogram; the location of the dominant peak in the PSD directly corresponds to the primary quantization step. This reveals the compression history even when the final image quality is high.

A visualization method that re-compresses the suspect image at various quality factors and subtracts the result from the original. When the re-compression quality factor matches the primary compression quality, the difference image reveals a faint 'ghost' of the original compression structure. This occurs because the DCT grid aligns perfectly with the original block boundaries, minimizing the difference. Misaligned grids produce a strong, visible grid artifact. This technique is effective for detecting localized tampering where a spliced region has a different compression history.

JPEG compression introduces blocking artifacts at 8x8 pixel boundaries due to independent quantization of each DCT block. In a doubly compressed image, these block boundaries may be misaligned if the image was cropped between compressions. By measuring the Blocking Artifact Strength (BAS) across the image grid, forensic analysts can detect regions where the 8x8 grid structure is inconsistent. A shift in the grid alignment creates a detectable periodic pattern in the difference image, localizing the tampered region.

The distribution of the first digits of quantized DCT coefficients in a singly compressed JPEG follows a generalized Benford's Law distribution. Double compression disrupts this logarithmic distribution, causing statistically significant deviations. By applying a chi-squared goodness-of-fit test against the expected Benford distribution, forensic tools can flag images with a high probability of re-compression. This method is computationally efficient and works as a blind detection technique without requiring knowledge of the original quantization table.

A specific visual artifact introduced by the rounding and truncation of DCT coefficients during double compression. When a coefficient is quantized, de-quantized, and re-quantized, the rounding error creates a characteristic dimple pattern in the coefficient histogram at integer multiples of the quantization step. These dimples are a direct consequence of the double rounding operation and are highly specific to the JPEG pipeline. Their presence is a strong indicator of re-compression, even when the two quality factors are similar.

A forensic method that re-saves an image at a known quality level and computes the difference from the original. Regions with different compression histories—such as spliced-in objects—will exhibit distinct error levels, visually highlighting potential manipulation zones.

• Identifies inconsistent compression ratios across an image
• Effective for detecting splicing and airbrushing
• Outputs a heatmap where brighter areas indicate higher potential tampering

The core mechanism behind double JPEG detection. Every JPEG encoder uses a quantization table—a 64-entry matrix that determines how aggressively each DCT frequency coefficient is compressed. When an image is decompressed and re-saved, the secondary quantization table leaves a distinct statistical signature that can be estimated from pixel values alone.

• Reveals the primary compression quality even after re-saving
• Mismatched tables across image regions indicate localized tampering
• Tables are often unique to specific camera models or software

A technique that searches for residual evidence of a previous compression grid that is no longer aligned with the current 8×8 block structure. By computationally shifting the decompression grid and re-compressing, analysts can detect 'ghost' boundaries where the original blocking artifacts persist.

• Detects cropping and rotation after initial compression
• Exploits blocking artifact misalignment
• Reveals whether an image was resized between saves

A statistical forensic method that tests whether the distribution of first digits in DCT coefficients follows the expected logarithmic distribution. Natural, single-compressed images conform closely to Benford's Law; double-compressed or manipulated images exhibit measurable deviations.

• Detects anomalous coefficient distributions
• Effective against seam carving and inpainting
• Used as a blind forensics technique requiring no reference image

Examines the periodic 8×8 blocking grid inherent to JPEG compression. When an image is cropped or spliced, the grid alignment shifts, creating detectable discontinuities at manipulation boundaries. This technique measures the periodicity and strength of blocking artifacts across the image.

• Detects grid misalignment from cropping
• Identifies pasted regions with different artifact patterns
• Complements quantization table analysis for tampering localization