Tutorial: Error Level Analysis
Error Level Analysis (ELA) identifies areas within an image that are at different compression levels. With JPEG images, the entire picture should be at roughly the same error level. If a section of the image is at a significantly different error level, then it likely indicates a digital modification.
JPEG images use a lossy compression system. Each re-encoding (resave) of the image adds more quality loss to the image. Specifically, the JPEG algorithm operates on an 8x8 pixel grid. Each 8x8 square is compressed independently. If the image is completely unmodified, then all 8x8 squares should have similar error potentials. If the image is unmodified and resaved, then every square should degrade at approximately the same rate.
ELA saves the image at a specified JPEG quality level. This resave introduces a known amount of error across the entire image. The resaved image is then compared against the original image.
If an image is modified, then every 8x8 square that was touched by the modification should be at a higher error potential than the rest of the image. Modified areas will appear with a higher potential error level.
With ELA, every grid that is not optimized for the quality level will show grid squares that change during a resave. For example, digital cameras do not optimize images for the specified camera quality level (high, medium, low, etc.). Original pictures from digital cameras should have a high degree of change during any resave (high ELA values). However, an unmodified digital photo that has been resaved will have lower ELA values. In contrast, if the grid square is already at its minimum error level, then it will not change during the resave.
| Image | ELA
|
|---|
| 
|
| An original digital photograph (Source: Hacker Factor) has high ELA values, represented by white colors in the ELA. The sections that are black correspond to the solid white book and the black 8x8 squares in the original image. Solid colors compress very well, so these are already at their minimum error levels.
|
| 
|
| The original image was resaved one time. To the human eye, there is no visible difference between the original and the resave image. However, ELA shows much more black and more dark colors. If this image were resaved again, it will have even lower (darker) ELA values.
|
| 
|
| The resaved image was digitally modified: books were copied and a toy dinosaur was added. ELA clearly shows the modified areas as having higher ELA values.
|
It is important to recognize that high frequency areas, such as edges along objects, will usually have higher ELA values than the rest of the picture. For example, the text on the books stands out because the light/dark contrast creates a high frequency edge. In general, you should compare edges with edges and surfaces with surfaces. If all surfaces except one have similar ELA values, then the outlier should be suspect.
With ELA and resaved images, there may be a visible separation between the luminance and chrominance channels as a blue/purple/red coloring called
rainbowing. Drawing tools such as Photoshop can introduce a distinct rainbowing pattern across near-uniform surfaces.
| Image | ELA
|
|---|
| 
|
| Computer-generated hands. ("NMRIH Hands", Matthew Fagan, 2009). The ELA shows red and blue rainbowing as background stripes. In other pictures, rainbowing may appear as large patches.
|
In general, Photoshop and other Adobe products generate a large amount of rainbowing, while the open source GIMP program generates little. Some drawing tools, such as Microsoft's Paint, do not generate rainbowing.
The presence of rainbowing only suggests that an Adobe product, like Photoshop or Lightroom, was used to save the image. It does not identify intentional modifications.
The results from ELA are directly dependent on the image quality. You may want to know if something was added, but if the picture is a copy of a copy of a copy, then ELA may only detect the resaves. Try to find the best quality version of the picture.
For example, many pictures are hosted at Flickr. Flickr provides small, medium, large, and original images. The small, medium, and large are derivative images (resaves) created by Flickr. The "original" is whatever the user sent to Flickr, so the original will be the best quality. Similarly, pictures on news sites are usually resaved. If they have a tagline like "Source: AP Images", then go to the source and use that picture instead. News sites typically recolor, resize, and crop images before saving them at a very low quality. Go for the original source (or get as close as you can to the original source) to improve the image's quality and the ELA results.
Two easy ways to tell that the image is not an original is to look at the image size and attributions. In general, digital cameras do not generate small pictures. Pictures that are sized for the web are likely resized from other pictures, and even those may not be camera-original. Also, many web sites add their logo or URL to a corner of the picture. That means the base picture was resaved and the last modification was likely the addition of the attribution.
For best results, try to find the source picture. If you don't know where to start, then try
TinEye. Many pictures on the web are resaved as they pass from user to user. TinEye doesn't know every picture on the web, but it knows many pictures. If the picture is being passed around, then TinEye can help find the source (or at least a better copy of the image). In general, the biggest image is usually the best quality. (But some sites do scale images larger...)
With training and practice, ELA users can also learn to identify image scaling, quality, cropping, and resave transformations. When combined with other algorithms, ELA becomes a very powerful evaluation tool.
While ELA is an excellent tool for detecting modifications, there are a number of caveats:
- A single pixel change, or minor color adjustment, may not generate a noticeable change in the ELA.
- Since JPEG operates on a grid, a change to any part of the grid will likely modify the entire grid square. You may not be able to identify exactly which pixel in the grid was modified.
- JPEG uses the YUV color space. High contrast colors in the same grid, such as black and white, orange and blue, or green and purple (opposite ends of the YUV color space), will usually generate higher ELA values than similar colors in the same grid.
- ELA only identifies what regions have different compression levels. It does not identify sources. If a lower quality image is spliced into a higher quality picture, then the lower quality image may appear as a darker region.
- Scaling, recoloring, or adding noise to an image will modify the entire image, creating a higher error level potential.
- If an image is resaved multiple times, then it may be entirely at a minimum error level, where more resaves do not alter the image. In this case, the ELA will return a black image and no modifications can be identified using this algorithm.
- With Photoshop, the simple act of saving the picture can auto-sharpen textures and edges, creating a higher error level potential. This artifact does not identify intentional modification; it identifies that an Adobe product was used. (Remember: if someone needs to download a picture from their camera or resize a picture for the web, they are just as likely to reach for Photoshop as they are to use any other tool.) Technically, ELA detects a modification because Adobe automatically performed a modification, but the modification was not necessarily intentional by the user.
ELA is only one algorithm and the results may not be conclusive. It is important to validate findings with other analysis techniques and algorithms.
