JPEG Ghost Analysis — How Double Compression Exposes Edits

The Invisible Cost of Saving a JPEG

JPEG is a lossy format. Every time you save a photo as JPEG, the encoder divides the image into 8×8 pixel blocks, applies a mathematical transform called the Discrete Cosine Transform (DCT), and then rounds the result according to a quantization table. That rounding discards fine detail — it's why JPEG files are small and why saving at quality 60 looks worse than quality 95.

Here's the key: the amount of information discarded depends on the quality level. Quality 95 keeps most of the detail. Quality 60 throws away a lot. And the specific pattern of rounding artifacts left behind is like a fingerprint — it tells you the quality level used to save that image.

When the entire image was saved at the same quality in a single pass, every 8×8 block carries the same compression fingerprint. But when someone pastes a region from a different JPEG — one saved at a different quality — that region carries a different fingerprint. The two fingerprints coexist in the same file, and JPEG ghost analysis is designed to find exactly that inconsistency.

What Is a JPEG Ghost?

The technique works by re-compressing the image at every quality level from, say, 50 to 99, and comparing each re-compressed version to the original. At most quality levels, every part of the image will show some difference from the re-compressed version. But at the quality level where a region was originally saved, something special happens: the re-compression produces almost the same result, because the quantization artifacts are already "settled" at that quality.

Imagine you have a photo saved at quality 92. You paste in a car from another photo that was saved at quality 75. You save the combined result at quality 92. Now the background has been compressed once at 92, and the car has been compressed first at 75, then at 92 — double compression at mismatched qualities.

When the ghost scanner re-compresses at quality 75, the car region "settles" — its error drops to near zero because 75 was its original quality. The background still shows high error because 75 isn't its native quality. The car glows against the background. That glow is the ghost.

How the Quality Sweep Works

A JPEG ghost scanner automates the process in several steps:

Step 1 — Re-compress at quality N. The scanner takes the original image and re-saves it as a JPEG at a specific quality level — say, quality 50. This produces a new version where every block has been quantized according to quality 50's quantization table.

Step 2 — Compute the difference. It subtracts the re-compressed version from the original, pixel by pixel. Regions where the original was already at quality 50 show minimal difference — they've already been through that quantization. Regions at a different quality show larger differences.

Step 3 — Repeat across the range. Steps 1 and 2 are repeated for every quality level in the sweep range. Each pass produces a difference map, and the scanner tracks the error magnitude per block across all quality levels.

Step 4 — Find the minimum. For each block, the quality level that produces the smallest error is likely the block's original save quality. If the entire image reaches its minimum at quality 92, the photo was probably saved once at quality 92 — consistent compression. If most blocks minimize at 92 but a rectangular region minimizes at 75, that region was likely spliced from a different source.

The scanner visualizes this as a heatmap. Uniform color means consistent compression. Bright patches at a specific quality level mark regions with a different compression history — the ghosts.

What Ghosts Look Like in Practice

Clean image — no ghosts. The heatmap shows uniform, low-intensity noise across the entire frame at every quality level. There's one clear minimum where everything settles together. This is what you'd expect from a camera-original JPEG or a single-pass editor export.

Spliced region — ghost present. A rectangular or irregular region stands out with noticeably different intensity. It may appear darker at one quality level and brighter at another, reaching its minimum error at a different quality than the surrounding area. The boundary between the ghost and the background often follows the edges of the pasted element.

Noisy result — ambiguous. If the image has been re-saved many times, shared on social media (which re-compresses on upload), or converted between formats, the ghost signal degrades. The heatmap shows scattered noise without clear regions. This doesn't mean the image is unedited — just that this particular technique can't find the evidence.

Where Ghost Analysis Proves Useful

Journalism and fact-checking. When a viral photo looks suspicious, ghost analysis can reveal whether elements were composited from different sources. A news desk can run the check in seconds before deciding to publish.

Insurance and legal evidence. Damage photos submitted with insurance claims sometimes contain spliced elements — adding severity to a dent, pasting a different license plate, compositing damage from one car onto another. Ghost analysis flags these inconsistencies for investigators.

Academic and scientific integrity. Research papers with manipulated figures — cloned gel bands, adjusted graphs, altered microscopy images — can be caught when the spliced data was sourced from images saved at a different JPEG quality.

Social media verification. Before sharing a shocking image, running it through a ghost scan takes seconds. A clean result doesn't guarantee authenticity, but a clear ghost immediately raises red flags about the image's integrity.

Limitations to Keep in Mind

Multiple re-saves destroy the signal. Every additional JPEG save adds a new layer of compression artifacts. After three or four generations, the original ghost signal becomes indistinguishable from general compression noise. Images that have been uploaded to and downloaded from social media multiple times are poor candidates for ghost analysis.

Same-quality splicing is invisible. If the source and destination images were both saved at quality 92, the pasted region carries the same compression fingerprint as the background. Ghost analysis won't distinguish them — the technique specifically targets mismatched quality levels.

Non-JPEG formats bypass it entirely. Screenshots, PNG exports, and WebP images don't use DCT-based quantization. Ghost analysis has nothing to work with. If a JPEG was edited and exported as PNG, some residual compression artifacts might survive, but the technique is far less reliable.

JPEG quality isn't standardized. "Quality 85" in Photoshop uses a different quantization table than "quality 85" in GIMP or ImageMagick. The ghost scanner sweeps a range to account for this, but edge cases exist where two different encoders at similar quality levels produce overlapping artifacts.

Ghosts in a Layered Forensic Workflow

No forensic technique works alone. Each method targets a different type of manipulation, and skilled editors can evade any single check. A practical verification workflow combines several passes:

• JPEG ghost analysis — finds regions spliced from images with different JPEG quality levels.
• Error Level Analysis — highlights locally re-saved areas with inconsistent compression error patterns.
• Thumbnail mismatch — reveals any change between the camera-original thumbnail and the current main image.
• Authenticity check — runs metadata consistency, software signature analysis, and compression pattern review in a single automated pass.
• EXIF inspection — checks timestamps, GPS coordinates, camera model, and editing software tags for inconsistencies.

A photo that passes all five has strong credibility. A photo that fails even one deserves closer scrutiny. For a complete walkthrough, see our guide on detecting edited photos.

Common Questions

What is a JPEG ghost? A JPEG ghost is a visual artifact that appears when you re-compress an image at its original quality level. Single-compressed regions blend in smoothly, while spliced regions from a different source glow in the difference map — because their original compression quality was different.

How is this different from ELA? ELA re-saves at a single quality and examines error patterns. Ghost analysis sweeps across many quality levels to pinpoint the specific quality where each region reaches minimum error. Ghost analysis is more targeted at detecting splicing between different-quality sources.

Does this work on PNG or WebP? No. JPEG ghost analysis targets DCT quantization artifacts specific to JPEG compression. PNG is lossless and WebP uses a different lossy scheme. If a JPEG was edited and converted to PNG, residual artifacts may partially survive, but reliability drops significantly.

Does re-saving a JPEG many times affect the analysis? Yes. Each re-save adds more compression noise, blurring the distinction between single and double compression. After three or four saves, the ghost signal often disappears. Social media uploads — which re-compress images — make analysis harder.

What if no ghost appears? A clean sweep means the image has consistent compression history — saved once at a single quality level, or re-saved so many times the original signal is gone. It's a good sign but not absolute proof the image is unedited.

Compression Never Forgets — Until It Does

JPEG ghost analysis exploits a fundamental property of lossy compression: once quantization rounds away detail at a given quality, re-compressing at that same quality changes almost nothing. That stability is what makes ghosts visible — and what makes the technique uniquely powerful for detecting spliced composites. The catch is that every re-save erodes the evidence. If you need to verify a photo, do it as close to the source as possible — before the ghosts fade. Run the same image through the JPEG Ghost Scanner and side-by-side EXIF comparison together for the strongest result.