Error Level Analysis with Python

Concepts

What is Error Level Analysis (ELA)

Error Level Analysis is a forensic technique that visualizes the compression error introduced when a JPEG image is saved. JPEG compression is lossy; each 8 × 8 block is quantized, discarding high‑frequency information. In an untouched image the discarded data – the error – is roughly uniform. When a region has been edited and saved separately, its compression error differs, producing visible boundaries in an ELA map.

Historical background

These works established the theoretical basis for using JPEG recompression error as a forensic cue and spurred the development of practical software.

Primary purpose

• Reveal inconsistent compression that often indicates copy‑move, splicing, or retouching.
• Provide a rapid visual cue before deeper forensic analysis (noise analysis, metadata inspection, sensor‑pattern analysis).

Basic principle of JPEG compression

1. Color conversion – RGB pixels are transformed to the YCbCr color space, separating luminance from chrominance.
2. Block division – The image is partitioned into 8 × 8 pixel blocks, the fundamental unit of JPEG processing.
3. Discrete Cosine Transform (DCT) – Each block is converted from the spatial domain to the frequency domain; the DCT concentrates most visual information into a few low‑frequency coefficients.
4. Quantization – DCT coefficients are divided by a quantization matrix and rounded to integers. This step discards high‑frequency detail and creates the irreversible loss.
5. Entropy coding – The quantized coefficients are further compressed using Huffman or arithmetic coding, which removes statistical redundancy without altering the error pattern.

During recompression the same steps repeat. The pixel‑wise difference between the original image and the recompressed version is the error level that ELA visualizes.

Why the recompression quality is set to 95 in the example

Choosing a quality close to the original (typically 90‑95) preserves the original error pattern while still introducing a measurable difference. A very low quality would overwrite the subtle error variations, making tampered regions indistinguishable; a quality of 100 would produce negligible new error, yielding a flat map. Empirical tests show that 95 balances visibility and fidelity for most consumer‑grade JPEGs.

How manipulation reveals itself

Assumptions & limitations

• JPEG requirement – The image must be saved in a lossy JPEG format; lossless formats (PNG, TIFF) produce a flat error map.
• Unknown original quality – ELA assumes the analyst does not know the original compression quality. If the image has been saved multiple times at the same quality, the error pattern may become uniform and tampering can be missed.
• Quality‑mismatch failure – When the original quality is known and the analyst recompresses at a vastly different quality, the introduced error can dominate the map, obscuring genuine inconsistencies.
• Post‑processing masking – Strong filtering, sharpening, or noise reduction can homogenize error levels and generate false negatives.
• Heuristic nature – ELA highlights suspicious areas but does not prove manipulation; it must be corroborated with complementary forensic methods.
• False positives – Progressive JPEGs, images that contain multiple embedded thumbnails, or regions that were originally saved at different qualities can produce non‑uniform error without any tampering.

Examples

1. Simple ELA with Python (Pillow & NumPy)

import sys
from pathlib import Path
from PIL import Image, UnidentifiedImageError
import numpy as np
import matplotlib.pyplot as plt

def load_image(path: Path) -> Image.Image:
    if not path.is_file():
        raise FileNotFoundError(f"Image file not found: {path}")
    try:
        return Image.open(path).convert('RGB')
    except UnidentifiedImageError:
        raise ValueError(f"File is not a valid image: {path}")

def recompress(image: Image.Image, quality: int = 95) -> Image.Image:
    # In‑memory recompression avoids creating temporary files
    from io import BytesIO
    buffer = BytesIO()
    image.save(buffer, format='JPEG', quality=quality)
    buffer.seek(0)
    return Image.open(buffer).convert('RGB')

def compute_ela(original: Image.Image, recompressed: Image.Image, scale: int = 20) -> np.ndarray:
    orig_arr = np.array(original, dtype=np.int16)
    recomp_arr = np.array(recompressed, dtype=np.int16)
    diff = np.abs(orig_arr - recomp_arr)
    ela = np.clip(diff * scale, 0, 255).astype(np.uint8)
    return ela

def show_ela(ela: np.ndarray, scale: int):
    plt.figure(figsize=(8, 6))
    plt.imshow(ela)
    plt.title(f"Error Level Analysis (scale ×{scale})")
    plt.axis('off')
    plt.show()

if __name__ == '__main__':
    if len(sys.argv) != 2:
        print("Usage: python ela.py <path_to_jpeg>")
        sys.exit(1)

    img_path = Path(sys.argv[1])
    original = load_image(img_path)
    recompressed = recompress(original, quality=95)
    ela_image = compute_ela(original, recompressed, scale=20)
    show_ela(ela_image, scale=20)

Explanation of each step

1. Loading – The function checks for file existence and validates that the file is a readable image, raising clear exceptions for missing or corrupt inputs.
2. Re‑compression – The image is saved to an in‑memory buffer at quality 95, ensuring a controlled second compression without leaving temporary files on disk.
3. Difference calculation – Converting to signed 16‑bit integers prevents underflow when subtracting unsigned 8‑bit values. The absolute difference captures the per‑pixel error.
4. Scaling – JPEG error is typically 0–5 intensity levels; multiplying by 20 expands the range for visual inspection while preserving the spatial pattern.
5. Display – Matplotlib renders the amplified error map as a quick visual cue.

2. Detecting a spliced region

Run the same script on an image that contains a copy‑pasted object from a different source (e.g., spliced.jpg). The resulting ELA map will show a uniform gray background with a distinctly brighter or darker patch where the spliced object resides, indicating a mismatch in compression history.

3. Automated detection of high‑error blocks

def flag_high_error_blocks(ela: np.ndarray, block_size: int = 8, threshold: float = 30.0) -> np.ndarray:
    # Convert to a single‑channel intensity image
    gray = np.mean(ela, axis=2)
    h, w = gray.shape
    mask = np.zeros_like(gray, dtype=np.uint8)

    for y in range(0, h, block_size):
        for x in range(0, w, block_size):
            block = gray[y:y+block_size, x:x+block_size]
            if block.mean() > threshold:
                mask[y:y+block_size, x:x+block_size] = 255
    return mask

def overlay_mask(original: Image.Image, mask: np.ndarray, alpha: float = 0.4) -> Image.Image:
    mask_rgb = np.stack([mask]*3, axis=2)
    overlay = Image.fromarray(mask_rgb).convert('RGB')
    return Image.blend(original, overlay, alpha)

# Example usage
mask = flag_high_error_blocks(ela_image, block_size=8, threshold=30.0)
result = overlay_mask(original, mask, alpha=0.4)

plt.figure(figsize=(8, 6))
plt.imshow(result)
plt.title("Potential tampered blocks (red overlay)")
plt.axis('off')
plt.show()

Rationale for the threshold – The mean error of an untouched JPEG after scaling by 20 typically falls between 10 and 20. Empirical testing on a diverse set of images shows that a threshold around 30 reliably isolates blocks whose error deviates by more than one standard deviation from the global mean, reducing false positives while still catching most manipulations. Adjust the value for images with extreme lighting or compression artifacts.

4. Additional illustrative cases

These examples demonstrate that ELA performance depends on the image’s compression history and the nature of the manipulation.

Key notes

• Applicability – ELA is only meaningful on lossy JPEGs; lossless formats yield flat maps.
• Interpretation – Uniform gray indicates a likely untouched image; non‑uniform patterns suggest possible tampering but are not conclusive.
• Quality selection – Recompress at a quality close to the suspected original (90‑95) to preserve the native error pattern without overwhelming it.
• Block granularity – JPEG operates on 8 × 8 blocks; analyzing error at this scale aligns with the compression algorithm and improves detection reliability.
• Limitations – Different original qualities, progressive encoding, heavy post‑processing, and embedded thumbnails can produce false positives or mask true manipulations. Use ELA as an initial screening tool, then apply complementary methods such as noise variance analysis, sensor‑pattern (CFA) verification, and metadata inspection.
• Performance considerations – Computing the absolute difference and scaling is linear in the number of pixels (O(N)). For very large images (tens of megapixels) memory usage can become a bottleneck; processing the image in tiled chunks or down‑sampling before analysis mitigates this. Real‑time applications typically pre‑process a reduced‑resolution version to obtain a quick heuristic map.

By understanding the underlying JPEG mechanics, the rationale behind parameter choices, and the method’s constraints, practitioners can employ ELA effectively as part of a broader forensic workflow.