What Error Level Analysis Actually Tells You

Error Level Analysis is probably the most recognisable image-forensics visual on the internet, and also the most frequently misinterpreted. Bright regions get screenshotted, circled in red, and captioned “PROOF OF EDITING.” Usually they are nothing of the sort.

The mechanism

JPEG is a lossy format. Every time an image is saved, the encoder discards information in 8×8 pixel blocks, and each save introduces a predictable amount of error. ELA exploits that predictability: we re-save your image at a known quality level, subtract the result from the original, and amplify the difference.

In an image saved exactly once, the whole frame has been through the same number of compression cycles, so the error is roughly uniform. Splice in a region from a different source — or paste a face, or clone out a logo — and that region carries a different compression history. It responds differently to re-saving, and the difference shows up as a brighter or darker patch.

What the colours mean in our implementation

Our map bands the error into three ranges:

• Blue — very low error. Flat, uniform areas that compress cleanly.
• Green — moderate error. Normal detail and texture.
• Red — high error. Sharp edges, high-frequency detail, or a region with a different compression history.

The word “or” in that last bullet is doing enormous work.

The classic false positive

High-contrast edges always produce high error. Text on a background, the outline of a building against sky, the edge of a white shirt — all of these light up red in a completely untouched photograph. This is not manipulation; it is how the discrete cosine transform behaves at a discontinuity.

If you take one thing from this article: a bright edge is meaningless. A bright region with soft interior detail that differs from surrounding regions of similar texture is interesting.

How to actually read a map

Compare like with like. Find two areas of the image with similar detail levels and ask whether they show similar error. A face that is uniformly brighter than every other face in a group photo is worth investigating. A single sharp edge that is brighter than the surrounding grass is not.

Then check whether the suspicious region has a rectangular boundary, or a boundary that follows an object outline suspiciously precisely. Compositing tools leave geometric fingerprints that natural scenes rarely produce.

When ELA tells you nothing at all

ELA needs compression history to read. It is close to useless on:

• PNG files that have never been JPEG-encoded
• Images that have been re-saved many times, where everything has converged to a similar error level
• Screenshots, which flatten all prior history into a single new capture
• Heavily downscaled images, where resampling has destroyed the block structure

This is why we present ELA alongside three other layers rather than on its own. When the noise and compression layers disagree with the ELA map, that disagreement is itself the finding.