A vendor sends you an invoice. Or an applicant submits a bank statement. Visually, everything looks crisp and authentic. But someone opened Photoshop, edited an account number, or pasted a signature from a different document.
To the human eye, sub-pixel splices are virtually invisible. But to JPEG compression math, they scream.
Over the past few months, I built and open-sourced deeptrace-ela — a zero-GPU, NIST-grade Error Level Analysis (ELA) forensics engine in Python.

Here is how the math works, why naive ELA implementations create hundreds of false alarms, and how we solved it in under 100ms on a standard CPU.

What is Error Level Analysis (ELA)?

Every time a lossy JPEG image is saved, the discrete cosine transform (DCT) quantizes high-frequency color data into 8x8 pixel blocks. This process introduces a tiny, uniform mathematical error across the entire surface of the image.
If an image has never been modified, its entire compression history is uniform.

• Original Image: Uniform JPEG quantization across the entire frame.
• Attacker Splice: Spliced elements come with a different compression history or uncompressed raw pixels.
• Re-saved Image: The spliced elements degrade at a completely different mathematical rate than the background. ELA exposes this by:
• Re-compressing the image in memory at a known quality tier ($Q = 95$).
• Calculating the absolute difference between the input pixels and the newly re-compressed pixels: Δ(x, y) = |I_orig(x, y) - I_resaved(x, y)|
• Dynamically amplifying the residual difference so microscopic discrepancies glow brightly in a forensic heatmap. Untampered ambient areas reach compression equilibrium and appear dark/uniform. Pasted or spliced elements stick out immediately. --- ## Why Naive ELA Scripts Fail (The Text Edge Trap) If you google "Python Error Level Analysis script", you will usually find a 10-line snippet that uses PIL to subtract an image from its resaved copy with a fixed multiplier. If you run that script on a real-world document (like a scanned contract or a PDF receipt), it fails catastrophically. Why? The Gibbs Phenomenon. High-contrast transitions — like sharp black serif letters on white paper — naturally generate high-frequency ringing during JPEG compression. A naive script flags every single character on the page as "tampered." You get hundreds of false alarms and zero actionable forensic value. ### How We Fixed It in deeptrace-ela To turn ELA into an enterprise-grade forensic tool, we added three deterministic safeguards:
• NIST-Calibrated Resave Tier ($Q = 95$): We found that $Q = 95$ provides the optimal signal-to-noise ratio: it exposes second-generation compression anomalies without inducing false high-frequency saturation.
• Dynamic Contrast Amplification: Instead of a hardcoded multiplier (which either blows out the image or makes faint tampered edges invisible), the engine computes scale dynamically based on peak residual delta: Scale = min(15.0, 255 / max(Delta))
• Adaptive Ambient Thresholding (μ + 3.5σ): Instead of arbitrary cutoffs, the engine measures the ambient noise distribution of the background, establishing a statistical baseline (μ) and standard deviation (σ). Only contiguous clusters exceeding μ + 3.5σ that don't match standard edge-ringing profiles are flagged as SUSPICIOUS. --- ## Quickstart: 3 Lines of Python You can install it directly via pip (no heavy C++ or GPU dependencies required):

pip install deeptrace-ela

1. In Python

from deeptrace_ela import analyze_ela

Run NIST-calibrated ELA analysis

result = analyze_ela("suspicious_invoice.jpg", quality=95)
print(f"Forensic Verdict: {result.verdict}") # 'SUSPICIOUS' or 'CLEAN'
print(f"Mean Ambient Error: {result.mean_error:.2f}")

Check any detected anomaly clusters

for box in result.anomalies:
print(f"Tamper detected at x={box.x}, y={box.y} (Peak Delta: {box.peak_delta})")

Save the amplified forensic heatmap

result.save_heatmap("heatmap.png")

1. From Your Terminal (CLI)

You can also analyze images directly from your command line:

# Generate visual heatmap
deeptrace-ela suspicious_check.jpg --output heatmap.png
# Output structured JSON for automated backend verification pipelines
deeptrace-ela contract.jpg --json

CLI Output:

============================================================
 DeepTrace ELA — Image Forensics Engine
============================================================
Image:        contract.jpg (1920x1080)
Resave Q:     95
Max Delta:    84.0
Mean Error:   3.42
Status:       ⚠️ SUSPICIOUS (2 anomalous compression cluster(s) detected)
Detected Anomalies:
  [#1] Bounding Box: [x=420, y=310, w=180, h=45] | Peak Delta: 68.2
  [#2] Bounding Box: [x=915, y=740, w=120, h=35] | Peak Delta: 72.1
Heatmap saved to: heatmap.png

Zero-GPU & Sub-100ms Latency

Most modern document AI tools require heavy PyTorch models and dedicated GPUs just to check an image.

Because deeptrace-ela is built purely on NumPy vectorization and PIL buffer arithmetic:

Memory footprint: < 30 MB RAM

Execution speed: ~35ms – 85ms on a 1080p image on a standard laptop CPU

Zero GPU needed: Can easily run on cheap AWS Lambda functions, micro EC2 instances, or embedded edge devices.

Source Code & Community

The package is MIT-licensed, thoroughly unit-tested across Python 3.9 through 3.13 on Linux, macOS, and Windows, and live on PyPI.

GitHub Repository: samjanjua6/deeptrace-ela

PyPI: pypi.org/project/deeptrace-ela

Full Architecture Breakdown: Engineering an NIST-Grade ELA Forensics Engine

Portfolio & Case Studies: shaheerulhassan.com

If you are building document verification pipelines, automated KYC systems, or just curious about computer vision forensics, give it a try.

I'd love to hear how your teams handle scanned documents vs. digitally created PDFs when running compression forensics — drop your thoughts in the comments!