JPEG-Induced Bias in Document Forensics

Document-tampering detectors rely on the JPEG 8×8 grid, not the edit. Two simple attacks expose this. BMVC 2026, equal-contribution first author.

Nauman Riaz*, Ali Hussain*, Saifullah Saifullah*, Muhammad Imran Malik, Stefan Agne, Andreas Dengel, Sheraz Ahmed. BMVC 2026. (* equal contribution) Paper (PDF)

The question

Modern document-forgery detectors fuse RGB with JPEG DCT features. The implicit assumption is that inconsistencies in the JPEG block-artifact grid are a stable cue for tampering. In natural photos, grid alignment is largely random. Document images, however, have sharply bounded glyphs on clean backgrounds, which makes it easy for an adversary to control where the grid falls. Are detectors learning tampering evidence, or only the position of the grid?

(a) Grid-aligned forgeries (red) evade detection, unlike standard forgeries (blue). (b) Shifting the JPEG grid by a few pixels on an untouched page makes detectors flag almost all of the text.

Two query-free probes

  • Grid-Aligned Forgery (GAF) snaps copy-move, splicing, or generative edits to the 8×8 grid. This preserves local block statistics.
  • Pad–Recompress–Crop (PRC) shifts the whole grid of an authentic image without changing its content or geometry.
  • We add two metrics that expose failures F1 alone hides: Detection Failure Rate (DFR) and False Positive Area (FPA).
PRC on DocTamper: grid misalignment alone triggers widespread false positives (yellow) in several detectors.

Key findings

We evaluated six detectors (CAT-Net, DTD, FFDN, DocForgeNet, RTM, ADCD-Net) on DocTamper and T-SROIE.

  • PRC drops DTD from 0.726 to 0.107 F1 and DocForgeNet from 0.774 to 0.095 F1 on DocTamper, with no pixel of the content changed.
  • GAF copy-move raises DTD’s detection-failure rate from 0.125 to 0.512 on the DocTamper test set, and from 0.099 to 0.845 on its FCD split.
  • The effect is not universal: ADCD-Net is largely robust to PRC. This helps separate models that truly fuse RGB and DCT features from those that memorize where frequency cues appear.

My contribution

I led benchmark design, dataset sourcing and experiment implementation (PyTorch, OpenCV) during my internship at DFKI. This included the controlled GAF/PRC evaluations across detectors, datasets, JPEG compression settings and manipulation alignments. I also characterized the 8×8-alignment failures, testing a collaborator’s initial observation experimentally.

Why it matters

Strong benchmark numbers can rest on a compression artifact that an attacker can trivially control. This is a concrete case of shortcut learning in a security-critical setting, and it is why I am interested in robust representations and in stress-testing models with generated data.