Forensics Analyzer Documentation

Version: Image Forensics v3.0.0 | Video Forensics v2.5.0

This guide helps you understand the analysis reports from ImageForensicsAnalyzer and VideoForensicsAnalyzer. Each section explains what the signatures mean and how to interpret the results.

1. Overview: How the Analyzers Work

What These Tools Do

The forensics analyzers examine files at the binary level to detect signs of AI generation, manipulation, or editing. They look for:

Embedded signatures - Text strings left by software tools
Metadata patterns - Information stored within files about how they were created
Structural anomalies - Technical characteristics that differ from authentic camera/recording content
Encoding fingerprints - Specific compression patterns associated with AI pipelines

What the Report Tells You

A forensics report provides:

A risk assessment indicating likelihood of AI generation
A list of detected signatures with confidence levels
Technical details about the file's encoding and metadata
For videos: frame-by-frame analysis of visual patterns

Important Limitations

No forensic tool is 100% accurate. Consider these factors:

Legitimate editing software may trigger some signatures
AI-generated content can be "cleaned" to remove obvious markers
New AI tools may not yet be in the signature database
Low-confidence signatures should be treated as informational only

2. Understanding Confidence Levels

Every detected signature includes a confidence rating:

Level	Meaning	What to Do
Very High	Near-certain identification. The signature is unique to a specific AI tool or manipulation software.	This is strong evidence. The file very likely came from the identified source.
High	Strong indicator. The signature is rarely found in authentic camera/recording content.	Take seriously. Look for corroborating factors in the report.
Medium	Possible indicator. The signature may appear in both AI and legitimate content.	Consider alongside other evidence. Don't rely on this alone.
Low	Weak indicator. Common in many types of files.	Informational only. Not reliable for determining AI generation.

3. Risk Assessment Explained

The analyzers calculate an overall risk score based on multiple factors.

Risk Levels

Level	Score Range	Interpretation
High	50-100	Strong evidence of AI generation or significant manipulation. Multiple high-confidence indicators present.
Medium	30-49	Moderate evidence. May include AI tool signatures or suspicious encoding patterns. Warrants further investigation.
Low-Medium	15-29	Some indicators present, but not conclusive. Could be legitimate editing software or partial AI assistance.
Low	0-14	Minimal indicators. Appears to be authentic or processed with standard tools.

Factor Impacts

Each factor in the report is weighted by its significance:

Critical - Direct attribution to an AI tool (e.g., "Tool: Runway ML")
High - Strong AI indicators (signatures, suspicious encoding)
Medium - Supporting evidence (ML frameworks, cloud platforms)
Low - Minor indicators (generic patterns)
Info - Neutral information (C2PA present, encoder type)

4. Image Forensics Signatures

AI Generation Signatures (Strong)

These signatures are strong evidence of AI image generation. They rarely appear in photos from cameras or standard editing software.

Signature	Description	What It Means
Midjourney	Text-to-image AI service	Image was created or processed by Midjourney's AI
Stable Diffusion	Open-source AI image generator	Image was generated using Stable Diffusion models
DALL-E	OpenAI's image generation AI	Image was created by OpenAI's DALL-E system
NovelAI	AI art generation service	Image originated from NovelAI's generators
Automatic1111	Popular Stable Diffusion interface	Generated using the Automatic1111 web UI
ComfyUI	Node-based AI generation interface	Created using ComfyUI workflow system
InvokeAI	Stable Diffusion distribution	Generated using InvokeAI software
DreamStudio	Stability AI's web service	Created using Stability AI's platform
Bing Image Creator	Microsoft's AI image tool	Generated through Microsoft's Bing AI
Adobe Firefly	Adobe's generative AI	Created using Adobe's Firefly AI tools
SDXL	Stable Diffusion XL model	Generated using the larger SDXL model
Flux.1 / FLUX	Modern diffusion model	Generated using Flux AI models
Fooocus	Simplified SD interface	Created using Fooocus generator
IDEOGRAM / ideogram.ai	Text-focused AI generator	Created using Ideogram's AI service
Recraft	AI design tool	Generated using Recraft AI
Imagine with Meta	Meta's AI image generator	Created through Meta's AI tools
Google Inc. 2016	ICC Profile signature (UTF-16 BE)	Strong indicator of Google AI (Gemini/Imagen) origin
Gemini	Google's multimodal AI	Image processed or generated by Google Gemini
Imagen	Google's image generation AI	Created using Google's Imagen system
Diffusers	HuggingFace library	Generated using HuggingFace Diffusers library
HuggingFace	ML model repository	Created using models from HuggingFace
Civitai	AI model sharing platform	Generated using models from Civitai

Editing/Manipulation Signatures

These indicate the image was edited with professional software. Not necessarily AI-generated, but has been modified.

Signature	Category	What It Means
Adobe Photoshop	Photo Editing	Image was edited in Photoshop
Adobe Lightroom	Photo Editing	Image was processed in Lightroom
GIMP	Photo Editing	Edited with the free GIMP software
Affinity Photo	Photo Editing	Processed with Affinity Photo
Pixelmator	Photo Editing	Edited using Pixelmator (Mac)
Paint.NET	Photo Editing	Processed with Paint.NET
Capture One	RAW Processing	Professional RAW development software
Snapseed	Mobile Editing	Edited using Google's Snapseed app
Meitu	Beauty App	Processed with Meitu beautification app
FaceApp	Face Modification	Face was modified using FaceApp AI

Deepfake/Face Manipulation Signatures

These are serious indicators of facial manipulation or synthetic face generation.

Signature	Description	Severity
DeepFaceLab	Face-swapping software	Critical - Direct deepfake tool
FaceSwap	Open-source face-swap	Critical - Explicit face manipulation
Roop	One-click face swap	Critical - Face replacement detected
Reface	Face-swap app	High - Mobile face-swap tool
SimSwap	AI face swapping	Critical - Advanced face manipulation
InsightFace	Face analysis library	High - Often used for face swapping
GFPGAN	Face restoration AI	Medium - Face enhancement (may be legitimate restoration)
CodeFormer	Face restoration AI	Medium - Advanced face enhancement
Real-ESRGAN	Image upscaling AI	Low - May be legitimate upscaling
Lensa	AI portrait app	High - AI-enhanced/generated portraits
Remini	Photo enhancement AI	Medium - AI enhancement applied

Pattern-Based Detection (Regex)

The analyzer also detects AI signatures through patterns rather than exact text matches:

Pattern Type	What It Detects	Example Match
Midjourney Filename	UUID patterns with "_mj_" marker	`abc123_mj_image.png`
Midjourney Parameters	Command-line style generation parameters	`--v 5`, `--ar 16:9`
SD Generation Info	Automatic1111 generation metadata	`Steps: 30, Sampler: Euler`
CFG Scale	Guidance scale parameter	`CFG scale: 7.5`
Model Hash	AI model identification	`Model hash: a1b2c3d4`
ComfyUI Workflow	JSON workflow structures	`"class_type": "KSampler"`
DALL-E Signature	OpenAI generation marker	`Generated by DALL·E`
Prompt/Negative Prompt	Generation prompts in metadata	`Prompt: beautiful landscape...`
Seed Value	Random seed for generation	`Seed: 123456789`

5. Video Forensics Signatures

AI Video Generation Tools

These signatures indicate the video was generated by AI systems.

Signature	Company	Description
Runway ML / Gen-2 / Gen-3	Runway	Leading AI video generation platform. Creates videos from text or images.
Pika Labs	Pika	Text-to-video AI. Known for creative video generation.
OpenAI Sora / Sora1	OpenAI	OpenAI's advanced video generation AI.
Synthesia	Synthesia	AI avatar video platform. Creates videos of synthetic humans speaking.
HeyGen	HeyGen	AI avatar videos with voice cloning.
D-ID	D-ID	Talking head AI. Animates faces from photos.
Colossyan	Colossyan	Enterprise AI avatar platform.
Stable Video Diffusion	Stability AI	Open-source video generation model.
Google Veo / Lumiere / Phenaki	Google	Google's video generation AI systems.
Meta Make-A-Video / Emu Video	Meta	Meta's video generation research projects.
AnimateDiff	Open Source	Animation framework for Stable Diffusion images.
ModelScope / ZeroScope	Various	Open-source text-to-video models.
CogVideo / VideoCrafter	Research	Academic video generation models.
Luma AI / Dream Machine	Luma	AI video and 3D generation platform.
Kaiber AI	Kaiber	AI video generation for music and art.
Kling AI	Kuaishou	Chinese AI video generation platform.
MiniMax / Hailuo	MiniMax	Chinese AI video generation (Hailuo AI).
Haiper AI	Haiper	AI video creation platform.
PixVerse	PixVerse	AI video generation service.
Deforum / Warp Fusion	Open Source	Animation tools for AI image sequences.

Deepfake/Face Manipulation (Video)

Signature	Type	Risk Level
DeepFaceLab	Face Swap	Critical - Most common deepfake tool
FaceSwap / FaceFusion	Face Swap	Critical - Open-source face replacement
Wav2Lip	Lip Sync	Critical - AI lip synchronization
Roop	Face Swap	Critical - Single-image face swap
First Order Motion	Animation	High - Animates images from video
SimSwap / InsightFace	Face Swap	Critical - Advanced face manipulation
SadTalker / MakeItTalk	Talking Head	High - Animates portraits to speak
Audio2Face	Facial Animation	High - Audio-driven face animation
LivePortrait	Portrait Animation	High - Real-time portrait animation

Cloud AI Platforms

Detection of cloud infrastructure used for AI processing:

Replicate - Model hosting platform (often runs AI video models)
FAL.ai - AI inference platform
Modal - Cloud compute for AI
Together AI - AI model hosting
Fireworks AI - Fast AI inference
HuggingFace - AI model repository and hosting
Gradio - AI demo interfaces (indicates AI processing)
RunPod / Vast.ai - GPU cloud providers

ML Framework Signatures

Presence of machine learning libraries may indicate AI processing:

PyTorch / TensorFlow / Keras - Deep learning frameworks
HuggingFace Diffusers - AI image/video generation library
Safetensors - AI model format
ComfyUI / Automatic1111 - AI generation interfaces
ControlNet / IP-Adapter - AI conditioning techniques
LoRA - AI model fine-tuning method

Binary Signatures

Some AI tools leave binary (non-text) patterns in video headers:

Signature	Pattern	Meaning
Kling AI SPS	`95 90 05 00 5b b0 11`	Kling AI's H.264 encoder signature in video stream parameters

6. Encoding Analysis (Video)

What Encoding Analysis Reveals

AI video generation tools typically use fast, simple encoding settings. The analyzer looks at x264/x265 encoder parameters to detect patterns associated with AI pipelines.

Suspicious Encoding Options

These encoding settings, when found together, suggest AI generation:

Option	Suspicious Value	Weight	Why It's Suspicious
scenecut	0	4	Scene detection disabled. AI generates frame-by-frame, doesn't need scene cuts.
bframes	0	3	No bidirectional frames. AI generates sequential frames without temporal prediction.
subme	0	3	No subpixel motion estimation. AI content has no real motion to estimate.
cabac	0	2	CABAC disabled for speed. AI pipelines prioritize fast encoding.
ref	1	2	Single reference frame. AI doesn't benefit from multiple references.
mbtree	0	1	Macroblock tree disabled. Not needed for AI-generated content.
trellis	0	1	Trellis optimization disabled for speed.
8x8dct	0	1	8x8 discrete cosine transform disabled.
weightp	0	1	Weighted prediction disabled.
mixed_ref	0	1	Mixed references disabled.

Encoding Score Thresholds

Score	Likelihood	Interpretation
0	None	Normal encoding parameters
1-7	Low	Some fast-encode options, possibly legitimate
8-11	Medium	Suspicious pattern of options
12-15	Medium-High	Likely AI encoding pipeline
16+	High	Strong evidence of AI encoding

Truncated Encoder String

When the x264 encoder string doesn't include the "options:" section, it often indicates the video passed through a cloud AI pipeline that strips this information.

7. Frame Analysis (Video)

What Frame Analysis Measures

The analyzer extracts frames from the video and measures statistical properties that differ between AI-generated and real video.

Per-Frame Metrics

Metric	What It Measures	AI Indicator
Color Stats (mean, std)	Average color and variation per channel (R, G, B)	AI videos often have unnaturally consistent colors
Edge Density	Amount of sharp edges in the frame	AI may have unusual edge patterns
Noise Estimate	Background noise level	AI generates unnaturally uniform noise
Histogram Entropy	Information density (0-8 bits)	AI may have unnatural distribution
Banding Score	Color quantization artifacts	AI often produces color banding

Cross-Frame Analysis

Analysis	Description	Suspicious Threshold
Color Consistency	Range of color variation across frames	<15 total range indicates synthetic content
Noise Patterns	Variance of noise across frames	<0.5 variance indicates uniform AI noise
Banding Analysis	Average banding artifacts	>20 average indicates AI color issues

Detected Anomalies

color_consistency - "Unusually consistent colors (synthetic)" - Colors don't vary naturally
uniform_noise - "Uniform noise (uncommon natural)" - Noise is too consistent across frames
color_banding - "Color banding (AI common)" - Visible steps in color gradients

8. C2PA Content Credentials

What is C2PA?

C2PA (Coalition for Content Provenance and Authenticity) is an industry standard for embedding verifiable information about how content was created. Major companies like Adobe, Microsoft, Google, and OpenAI are adopting this standard.

C2PA Indicators

Indicator	Meaning	Significance
c2pa	C2PA Content Credentials present	File contains provenance data
jumb / JUMBF	JUMBF container found	ISO standard container for C2PA data
trainedAlgorithmicMedia	IPTC AI-Generated flag	High confidence: Explicitly marked as AI-generated
compositeWithTrainedAlgorithmicMedia	IPTC AI-Composite flag	Contains AI-generated elements mixed with other content
algorithmicMedia	IPTC Algorithmic flag	Created using algorithmic/AI processes
digitalSourceType	Source type declaration	Describes origin (camera, AI, composite, etc.)
softwareAgent	Creation software	Names the tool that created the content
truepic	Truepic signing	Content signed by Truepic verification service

Interpreting C2PA Results

C2PA present + AI flag: Content creator has honestly declared AI generation
C2PA present, no AI flag: May be from a camera or editing software
C2PA absent: No provenance data (neither confirms nor denies AI)

9. Filename Pattern Detection

Why Filenames Matter

AI tools often generate files with distinctive naming patterns. Even if metadata is stripped, the filename may reveal the source.

Known Filename Patterns

Pattern	Source	Example	Confidence
Generated_Image_[Month]_[Day]_[Year]	Google Gemini	`Generated_Image_November_14__2025_-_1_15PM.png`	Very High
UUID with _mj_ marker	Midjourney	`a1b2c3d4_mj_5678.png`	High
DALL·E or DALL-E variants	DALL-E / OpenAI	`DALL·E_2025_image.png`	Very High
00001-1234567890-prompt	Stable Diffusion (Auto1111)	`00001-123456789-beautiful_landscape.png`	High
comfyui_[number]	ComfyUI	`comfyui_00001.png`	Very High
leonardo_ai_[...]	Leonardo.AI	`leonardo_ai_creative_123.png`	High
OIG.[...] or bing_image	Bing Image Creator	`OIG.abc123.jpg`	High
firefly_[...] or adobe_firefly	Adobe Firefly	`firefly_generated_image.png`	High
flux_dev or flux_schnell	Flux	`flux_dev_output.png`	Medium
nightcafe_[...]	NightCafe	`nightcafe_studio_art.png`	High

Video-Specific Filename Patterns

Pattern	Source	Score Impact
kling_[...]	Kling AI	+40 points
runway_[...]	Runway ML	+40 points
pika_[...]	Pika Labs	+40 points
sora_[...]	OpenAI Sora	+40 points
synthesia_[...]	Synthesia	+40 points
text_to_video or txt2vid	Any T2V generator	+20 points
ai_generated	Generic AI	+20 points
YYYYMMDD_HHMM_ timestamp	AI service export	+10 points
24+ character hex ID	AI service export	+15 points

10. Quantization Tables (Images)

What Are Quantization Tables?

JPEG images use quantization tables during compression. Different software uses different tables, creating a "fingerprint" that can identify the source application.

Known Quantization Tables

Table Name	Source	Significance
Standard_IJG_50	IJG (JPEG standard) Quality 50	Default JPEG library. May indicate programmatic generation.
Standard_IJG_75	IJG Quality 75	Common default quality setting.
Standard_IJG_90	IJG Quality 90	High quality setting.
Photoshop_SaveWeb_HQ	Adobe Photoshop "Save for Web"	Indicates Photoshop processing.

Match Types

Exact - Table matches perfectly (very high confidence)
Approximate - 95%+ similarity (high confidence)
Similar - 85-95% similarity (medium confidence)

Why Standard Tables May Indicate AI

Real cameras typically use proprietary quantization tables. When an image uses the standard IJG tables, it often means:

The image was generated by software (not a camera)
It was re-encoded by a web service or API
The original metadata/tables were stripped

11. Glossary of Terms

AI Generation: Content created entirely by artificial intelligence from text prompts or other inputs.
B-frames: Bidirectional video frames that reference both past and future frames. AI-generated videos often lack these.
C2PA: Coalition for Content Provenance and Authenticity. An industry standard for content credentials.
CABAC: Context-Adaptive Binary Arithmetic Coding. Advanced compression often disabled in AI pipelines.
CFG Scale: Classifier-Free Guidance scale. A parameter controlling how closely AI follows the prompt.
ComfyUI: A node-based interface for AI image generation using Stable Diffusion.
Deepfake: AI-manipulated video, typically involving face replacement or animation.
Diffusion Model: The AI architecture used by Stable Diffusion, DALL-E 3, Midjourney, and most modern image generators.
Entropy: A measure of information density. High entropy means more random/complex data.
FFmpeg: Open-source video processing library. Often used in AI pipelines.
ftyp: The "file type" box at the start of MP4 files identifying the format version.
ICC Profile: Color management data embedded in images. Can contain identifying information.
JUMBF: JPEG Universal Metadata Box Format. The container standard for C2PA data.
LoRA: Low-Rank Adaptation. A technique for fine-tuning AI models.
Metadata: Information about the file embedded within it (creator, date, camera model, etc.).
MP4 Box: A structural unit in MP4 files. Different boxes contain different data types.
moov: The MP4 box containing movie metadata and track information.
Quantization Table: The mathematical table used during JPEG compression. Acts as a fingerprint.
Scene Cut: Video encoding feature that detects scene changes. Often disabled in AI video.
Seed: The random number used to initialize AI generation. Same seed = same output.
Signature: A text string or pattern that identifies a specific tool or process.
Stable Diffusion: Open-source AI image generation model. Basis for many AI art tools.
stts: MP4 box containing time-to-sample information (frame timing).
Text-to-Image (T2I): AI that generates images from text descriptions.
Text-to-Video (T2V): AI that generates videos from text descriptions.
WebCodecs: Browser API for low-level video decoding. Used for frame analysis.
x264/x265: Video encoding libraries for H.264 and H.265 formats.