PaperlayerView exact revision on arXiv

Source-linked AI summary

Multilayer Forensic Tampering Detection

Titouan Millet, Thomas Valade, François Gonnet, Mounira Msahli

arXiv:2609.38252v1cs.CR

TL;DR

Seamless PDF tampering challenges visual inspection, motivating automated forensic detection. The paper combines security gating with multi-layer inspection and weighted risk scoring; its examples include an internal-versus-rendered text discrepancy and a malware payload quarantined before forensic analysis.

  • Problem

    PDF editing tools can enable targeted tampering that leaves pages visually seamless, while manual inspection cannot keep pace.

    Source: §I · p. 1

  • Method

    A locally run pipeline gates invalid or malicious files, inspects cleared PDFs with independent forensic modules, and aggregates findings into a weighted risk score.

    Source: §I · p. 1, §II · p. 1

  • Results

    On a falsified certificate, structure and coverage flagged a 100% page stacking rate, and the native stream showed “Dr MILENKOVIC” where the rendered page showed “Dr POC.”

    Source: §III · p. 2

  • Takeaways & Limitations

    Cross-referencing PDF internals with rendered content can reveal alterations not apparent in visual inspection or metadata-only analysis.

    Source: §IV · p. 2

    A visually unmodified letter scored Moderate primarily because it lacked an XMP stream, and reducing false positives on sparse-metadata documents remains open work.

    Source: §III · p. 2

Abstract

from arXiv · show

With the proliferation of free online editing tools, altering or forging pdf documents has become trivially easy, often leaving no visual traces on screen. This paper introduces a two- stage forensic pipeline. An initial security-gating layer validates format compliance and flags embedded malicious payloads and a forensic engine that inspects internal objects across meta- data, visual overlays, and dual-source OCR consistency, etc... A weighted scoring engine aggregates these forensic indicators into an interpretable risk score is proposed. The approach was validated on real medical work-stoppage certificates.

I. INTRODUCTION

PDFs can be seamlessly altered despite their visual fidelity, while manual inspection cannot keep pace. The paper proposes a modular, locally run forensic pipeline to address limits in existing approaches.

I. INTRODUCTION

  • In France, €723 million of fraud was detected and stopped in 2025, including €49 million tied to falsified work-stoppage certificates.Source: §I · p. 1
  • The pipeline combines eight independent forensic modules and aggregates their findings into a weighted, interpretable risk score.The modules cover format validation, malware, metadata, structure, fonts, images, visual overlays, and dual-source OCR.Source: §I · p. 1
  • Existing approaches rely on basic metadata or structural checks, or opaque commercial platforms that require uploading sensitive files to third parties.Source: §I · p. 1

II. PROPOSED ANALYSIS PIPELINE

The pipeline first blocks invalid or malicious PDFs, then inspects cleared documents for signs of forgery. Its weighted score accounts for only modules with analyzable content, while the analysis procedure preserves the original sample and an audit trail.

II. PROPOSED ANALYSIS PIPELINE

  • A common decorator preserves end-to-end processing integrity and an audit trail without mutating the original sample or obscuring diagnostic steps.Source: §II · p. 1
  • The analysis sequence validates format and scans for malware before examining metadata, then conditionally runs coverage and OCR checks based on document content.Source: §II · p. 1
  • Invalid files and active exploits halt at the security gate; cleared PDFs undergo forensic inspection, with high-risk Creator/Producer signatures triggering a maximum score.Source: §II · p. 1
  • The score aggregates capped ratios from weighted modules and normalizes over active modules, so absent optional features do not incur a penalty.Weights are 25%, 25%, 20%, 15%, and 15% for metadata, structure, coverage, fonts, and images, respectively.Source: §II · pp. 1–2

III. IMPLEMENTATION AND RESULTS

Tests on real medical work-stoppage certificates, falsified variants, and malicious PDFs illustrate structural, metadata, and security-gating findings. A falsified example exposed a mismatch between the PDF's internal text and its rendered page, while the malware check quarantined a payload before forensic analysis.

III. IMPLEMENTATION AND RESULTS

  • The working corpus included real certificates, deliberately falsified variants, and known malicious PDFs; Table II presents three representative cases across the risk spectrum.Source: §III · p. 2, Table II · p. 2
  • 44 ms after document opening, the eliminatory malware check quarantined JavaScript triggered through /OpenAction before any forensic module ran.Source: §III · p. 2, Figure 3 · p. 2
  • A visually unmodified letter scored Moderate primarily because it lacked an XMP stream, a field many legitimate PDF generators omit.The authors identify reducing false positives on documents with sparse metadata as open work.Source: §III · p. 2

IV. CONCLUSION

The conclusion presents cross-referencing PDF internals with rendered content as a way to reveal alterations that visual inspection or metadata-only analysis may miss.

IV. CONCLUSION

  • Cross-referencing PDF structure with rendered content can reveal tampering that visual inspection or metadata-only analysis does not show.Source: §IV · p. 2
Loading 2609.38252v1…