Image forgery detection has become a critical necessity for companies and organizations handling large volumes of visual data, especially in sectors such as cybersecurity, identity verification, and forensic auditing. Traditional deep learning methods, while accurate, often require expensive GPUs and large labeled datasets, limiting their adoption in resource-constrained environments. In this context, we propose a lightweight and interpretable approach that uses only CPU, combining multi-scale JPEG analysis with feature engineering techniques. This method is not only efficient but also offers transparency, allowing analysts to understand why an image is classified as tampered.
The core of our proposal is Multi-scale Error Level Analysis (Multi-scale ELA), which evaluates JPEG compressions at seven different quality levels. By comparing differences between these versions, we detect inconsistencies in the image's compression history, a classic indicator of inserted or modified regions. Additionally, we introduce cross-quality ELA ratios, which capture double-compression artifacts typical of splices. This set is complemented by other features such as spatial entropy, FFT energy bands, edge density, SRM residuals, and DCT blockiness, resulting in a 405-dimensional feature vector.
To validate the method, we used the CASIA v2.0 dataset, which has a known format bias: 60% of tampered images are TIFF, while authentic images are JPEG or BMP, with no TIFF samples. This allows a trivial classifier based solely on the file extension to achieve an AUC of 0.80. To avoid this confound, we performed a format-controlled evaluation using only the JPEG subset (9,501 images). Under these conditions, our method achieves an AUC of 0.990 [95% CI: 0.988–0.991] and an F1 of 0.905 using 5-fold stratified cross-validation. Even under a conservative source-aware split (preventing related images from appearing in both train and test), AUC remains at 0.976.
Ablation studies reveal that multi-scale ELA provides the dominant gain (+0.180 over single-quality ELA), while cross-quality ratios offer complementary double-compression detection. These results demonstrate that the method detects compression history inconsistencies, not file-format shortcuts. Moreover, being fully CPU-executable, it offers sub-second inference, making it ideal for deployments in resource-limited environments or the cloud.
At Q2BSTUDIO, we understand that information security and artificial intelligence are fundamental pillars for modern businesses. Therefore, we incorporate techniques like this into our custom software solutions, enabling clients to automate image verification without relying on specialized hardware. For example, a content moderation platform can integrate this classifier as part of a cloud workflow (AWS or Azure), combining it with AI agents to make real-time decisions. Additionally, the interpretable results facilitate reporting in BI tools such as Power BI, where audit teams can visualize the features that led to a detection.
From a cybersecurity perspective, this technique is especially valuable for detecting manipulated images in identity verification processes or digital evidence. Our team at Q2BSTUDIO develops custom software that integrates these algorithms into corporate environments, ensuring that any company, regardless of budget, can protect itself against visual fraud. Furthermore, CPU-only execution makes it easy to include in edge devices or on-premise solutions, which is highly valued by clients with strict privacy requirements.
The future of this line of work involves exploring more features derived from the Wavelet transform or unsupervised machine learning techniques to improve detection of new forgery methods. At Q2BSTUDIO, we are committed to continuous innovation and offer consulting and development services to help companies adopt these technologies. If your organization needs to implement forgery detection systems or strengthen its cybersecurity capabilities, feel free to contact us.
