What JPEG Compression Leaves Behind

JPEG compression is lossy, deterministic and traceable. Those three properties make it one of the richest sources of forensic evidence available in a single file.

The pipeline

A JPEG encoder converts the image to a luminance-chrominance colour space, subsamples the chrominance channels, splits the image into 8×8 blocks, applies a discrete cosine transform to each block, divides the resulting coefficients by a quantisation table, and rounds to integers.

That rounding is where information is destroyed — and where evidence is created.

Why re-saving is detectable

Quantisation is idempotent for a given table: if you decode and re-encode an image with the same quality setting, most coefficients land on the same values they already had. The change is small.

Encode with a different table, and coefficients get redistributed. Do it repeatedly and the coefficient histogram develops characteristic gaps and clusters — evidence of multiple compression generations. Our compression layer probes this indirectly by measuring how much an image changes under controlled re-encoding: an image already heavily compressed changes little; a pristine image changes a lot.

Block boundaries

The 8×8 grid is fixed relative to the image origin. Two consequences:

• Blocking artefacts align to that grid, and remain detectable even at moderate quality.
• If a region has been pasted from another image and not aligned to the grid, its internal block structure is offset from the host grid. Grid misalignment is one of the strongest splice indicators available.

Practical readings

• Very low compression score — the file has already been compressed hard. Common for social-media downloads and messaging-app forwards. Says little about manipulation.
• Very high compression score — the file is close to pristine. Consistent with an original camera file, or with a freshly generated image that has never been through a lossy cycle.
• Uniform response across the frame — no regional compression inconsistency detected.

What breaks it

• PNG and lossless WebP have no JPEG history to read. The compression layer contributes little.
• Screenshots reset the history. Everything in the frame shares one compression generation regardless of origin.
• Resizing destroys block alignment, defeating grid-misalignment analysis.

Why this layer earns its place

Compression analysis is the layer most likely to catch an image that has been edited and re-saved but is otherwise convincing. It does not care whether the edit was made by a human or a model — it cares that the file went through an encoder twice with different settings. That makes it a useful complement to noise analysis, which targets generation specifically.