-
-
Notifications
You must be signed in to change notification settings - Fork 0
Methodology
Jura Trace uses multiple independent forensic detectors to assess content authenticity. No single detector is conclusive. The trust score reflects the combined weight of all available signals, like a bedrock reading taken from every detection layer at once. This page explains each detector, how scores are computed, and the known limitations of automated analysis.
The full scoring algorithm is open-source under AGPL-3.0-or-later at src-tauri/src/lib.rs::compute_trust. Readers can reproduce every calculation from the published source.
- Trust Score
- Investigation Modes
- Detector Reference
- Signal Weighting
- What This Does Not Prove
- Alignment with the Berkeley Protocol
Every analysis produces a trust score between 0% and 100%. The score summarises how consistent the available evidence is with an unmanipulated, authentically captured image.
| Level | Score range | Verdict | Meaning |
|---|---|---|---|
| High Trust | 71%–100% | Authentic | No detectors flagged anomalies. Content appears consistent with authentic capture. |
| Moderate Trust | 40%–70% | Inconclusive | Some signals raised concerns but evidence is not definitive. Human review is recommended. |
| Low Trust | 0%–39% | Synthetic | Multiple strong signals indicate manipulation or AI generation. |
The trust score is built from five components applied in a defined sequence. No single component can override the others when evidence strongly disagrees. The headline "20% EXIF / 80% forensic" ratio describes only step 2. The composite-evidence cap and verdict ceilings can independently collapse the score to between 25% and 55%, regardless of the weighted sum.
Step 1. Forensic signal analysis (primary).
The worst-case score across the pixel-level detectors: ELA, noise residuals, copy-move detection, JPEG Ghost, the deepfake ensemble (GBM v4 + UnivFD v10onnx), segmented ELA, and colour temperature. A min() approach prevents a single strong negative signal from being averaged away by clean results elsewhere. This is the dominant contributor to the score.
Step 2. EXIF metadata consistency (corroborating, capped at 20% weight).
Derived from the EXIF anomaly detector (twelve base consistency rules, five injection-detection sub-checks for templated timestamps, integer-degree GPS, programmatic pipeline software signatures, missing MakerNote on mandatory-vendor cameras, and iPhone sRGB mismatch, plus two XMP AI-provenance sub-checks for Iptc4xmpExt:DigitalSourceType and known AI generator values in xmp:CreatorTool). Weighted at 20% because EXIF is trivially edited by any free tool and is stripped by most social media platforms. A clean EXIF block cannot rescue a low forensic-trust score.
Step 3. C2PA provenance adjustment.
When a cryptographically valid C2PA manifest is present, the score receives a +0.10 uplift (capped at 100%). When the manifest itself declares AI generation (trainedAlgorithmicMedia), the score is reduced by 0.25. A self-declared origin is the strongest provenance signal the system recognises.
Step 4. Composite-evidence cap (maximum 0.55). When two independent regional detectors (segmented ELA and colour temperature) flag anomalies in the same image, the overall trust score is capped at 55% regardless of the weighted sum. Two independent regional detectors agreeing is a strong indicator of compositing that overrides clean whole-image results.
Step 5. Deepfake verdict ceiling. When the deepfake ensemble returns a synthetic verdict, the score is capped at: 25% for high confidence, 35% for medium, 45% for low. An inconclusive verdict caps at 55%. This ceiling prevents a clean EXIF block or an incidentally present C2PA manifest from inflating the score when the AI detector has already flagged the content. Screenshots and documents bypass this ceiling.
A C2PA-declared AI image lands near 25% regardless of how clean its EXIF is. The five components together produce the score, not a simple two-term average.
| Mode | Typical time | Detectors active | Best for |
|---|---|---|---|
| Standard | ~15 s | EXIF anomaly, C2PA, ELA, deepfake ensemble | Routine triage and quick authenticity checks |
| Deep | ~60 s | All detectors, including regional analysis | Investigating specific concerns or disputed content |
Regional detectors (segmented ELA, colour temperature) run only in Deep mode. On-demand investigation tools (NPR, shadow consistency, splice boundary) are available separately in Expert View regardless of mode.
Ten detectors run automatically on every verification. Their results feed into the numeric trust score. Three further tools are available on demand for manual investigation and do not contribute to the score.
What it measures. The consistency of metadata embedded in a file at capture, including camera model, GPS coordinates, timestamps, software tags, and resolution values.
How it works. Applies consistency rules to the file's EXIF block, then runs five injection-detection sub-checks: programmatic imaging libraries (Pillow, ImageMagick, OpenCV) in the Software field; canonical template timestamps; GPS coordinates at exact integer degrees; cameras whose firmware always writes a MakerNote but where none is present; and iPhones declaring sRGB without a MakerNote. Two XMP sub-checks parse the packet for Iptc4xmpExt:DigitalSourceType and known AI generator strings in xmp:CreatorTool. The xmpMM:History edit-history stack is also parsed for manipulation tool signatures (clone stamp, content-aware fill, healing brush, generative fill).
What a positive finding means. One or more metadata fields are missing, inconsistent, or contain signatures associated with editing software or scripted pipelines.
Known limitations. Social media platforms and CMS tools routinely strip or rewrite metadata; their output can be indistinguishable from fabrication signals. Scientific and archival workflows using Pillow or ImageMagick will trigger the programmatic-library sub-check legitimately. XMP provenance declarations are self-reported: a file can assert digitalCapture even if the pixels were generated. The absence of an AI-provenance declaration is inconclusive, never confirmation of authenticity.
Active in: Standard and Deep.
What it measures. Whether the file carries a cryptographically signed provenance record following the Coalition for Content Provenance and Authenticity (C2PA) open standard.
How it works. Reads and cryptographically verifies the embedded C2PA manifest. If valid, extracts the claim_generator field to detect whether a known AI creation tool signed the credentials. An AI-generated image signed by its creator carries valid credentials; those credentials are then treated as evidence of AI origin rather than evidence of authenticity.
What a positive finding means. A valid manifest means the provenance chain is intact since signing. An invalid or absent manifest means the file cannot be verified via this standard. Absence is not a negative finding.
Known limitations. Most existing images do not carry C2PA credentials. Jura Trace signs manifests using a self-signed certificate in Sovereign mode. These manifests are cryptographically valid but not trusted by third-party C2PA verifiers such as Adobe's Content Authenticity web tool. Conformant-mode signing (using a certificate from a C2PA Trust List authority) is feature-flagged off in v1.0 and planned for a later release.
Active in: Standard and Deep.
What it measures. Differences in compression error across regions of a JPEG image. Every JPEG save loses a predictable amount of information. ELA amplifies differences to reveal regions saved a different number of times from the rest.
How it works. Re-compresses the image at a known quality level and subtracts the result from the original. In an unedited image, error levels are broadly uniform. Regions pasted from another source, or edited after the original compression, show higher error levels and appear brighter in the ELA heatmap.
What a positive finding means. Uneven error levels suggest one or more regions were modified after the original file was created, or were composited from a source with a different compression history.
Known limitations. Unreliable on multiply-compressed JPEG images. Social media platforms compress images multiple times, creating artefacts indistinguishable from manipulation signals. High-detail areas (foliage, fabric, hair) naturally produce higher ELA values.
Active in: Standard and Deep.
What it measures. The distribution and consistency of noise grain across the image. Cameras introduce a characteristic noise pattern at sensor level. AI-generated images often lack this natural grain distribution.
How it works. Divides the image into blocks and measures variance within each block. Compares the variance distribution against expected natural camera noise patterns. Blocks with significantly higher or lower noise than their neighbours are flagged as anomalous.
What a positive finding means. Unnaturally uniform noise may indicate AI generation. Localised noise anomalies between regions may indicate compositing from sources with different sensor noise profiles.
Known limitations. May flag authentic images with intentional grain (film scans, night photography, high-ISO captures) as anomalous. Screenshots, illustrations, and heavily sharpened images all have non-camera-like noise profiles and may trigger without indicating manipulation.
Active in: Standard and Deep.
What it measures. Whether any region of the image has been duplicated from another part of the same image, a technique commonly used to clone out unwanted content or replicate objects.
How it works. Breaks the image into small overlapping patches and generates a compact fingerprint for each patch. Those fingerprints are compared across the whole image: if two patches in different parts of the image are nearly identical, they are likely copies of each other. The detector verifies that the matches form a geometrically coherent group (rather than random coincidence) before flagging them. The technique detects clones even when the copied region has been rotated or scaled. (Technical detail: SIFT descriptors with Lowe's ratio test, RANSAC geometric verification, DBSCAN clustering.)
What a positive finding means. One or more regions appear to have been copied from elsewhere in the same image, consistent with clone-stamp or healing-brush editing.
Known limitations. Images with naturally repeating patterns (wallpaper, tiling, crowd scenes) can produce false matches. Flat, low-texture regions (plain skies, smooth walls) may not yield enough SIFT keypoints to detect copying. Images below approximately 128×128 pixels are not analysed.
Active in: Standard and Deep.
What it measures. Statistical patterns distinguishing AI-generated imagery from photographs taken with a real camera. AI generation models leave characteristic fingerprints in noise structure, texture distributions, and spectral patterns.
How it works. Two classifiers run in ensemble.
GBM v4 examines statistical properties of the image that are invisible to the naked eye: the distribution of noise grain, the way fine texture repeats across the image, the consistency of colour-channel data, and the spatial pattern of sensor noise that real camera hardware imprints on every photograph it takes. AI generation models produce these properties differently from physical sensors. The classifier extracts 84 such measurements across six feature classes (noise statistics, spectral decay, Local Binary Pattern texture descriptors, Grey-Level Co-occurrence Matrix measures, demosaic inter-channel coherence, and PRNU sensor pattern consistency) and uses a gradient-boosted decision tree to score the result. PRNU follows the Lukáš/Fridrich/Goljan 2006 framework. GBM v4 was trained on over 10,000 images from 14 generator families. Performance: cross-validation AUC-ROC 0.9868, authentic false-positive rate 4.54%, calibrated threshold 0.49.
UnivFD v10onnx is a LogisticRegression classifier on CLIP ViT-B/32 embeddings, trained on over 50,000 samples including platform-forwarded augmentation and multi-format augmentation across PNG, TIFF, WebP, and HEIC. Performance: AUC-ROC 0.9929, authentic FP rate 3.87%, recall 95.77%. Per-format AUC: PNG 0.998 / TIFF 0.995 / WebP 0.993 / HEIC 0.990.
The two scores are combined into an ensemble verdict. Both models are retrained as new generator families are identified.
What a positive finding means. The statistical properties of the image are more consistent with AI generation than camera capture.
Known limitations. May underperform on outputs from generator families not represented in the training corpus. Known recall gaps at launch: flux_dev 88.9%, sdxl_turbo 91.1%. Minimum image size: 128×128 pixels. Heavily processed photographs, CGI renders, and composite illustrations can exhibit AI-like statistical properties. Human review is always warranted.
Active in: Standard and Deep.
What it measures. Evidence of double compression: the signature left when a region was previously saved as a JPEG at a different quality level before being composited into the final file.
How it works. Re-compresses the image at multiple quality levels and measures the deviation from the original in each block. Regions showing minimum deviation at an unexpected quality level (different from the rest of the image) are flagged as potential JPEG ghosts.
What a positive finding means. Part of the image appears to have been saved at a different JPEG quality setting from the rest, consistent with being spliced from a separately compressed source.
Known limitations. Only applicable to JPEG files; produces no signal on PNG, WebP, or TIFF. Carries a 0.5× weight (half that of ELA and noise analysis) because formal empirical validation against a real-world splice benchmark has not yet been completed. Improving this calibration is planned post-launch. Social media re-encoding (Twitter, WhatsApp) wipes differential ghost signatures entirely. The effective weight scales with the estimated JPEG quality factor: effective_weight = 0.5 × max(jpeg_quality / 100, 0.3).
Active in: Standard and Deep.
What it measures. Regional variation in compression error levels across a grid of image segments. Where whole-image ELA analyses the frame uniformly, segmented ELA examines whether specific regions are inconsistent with their neighbours, reading the strata of individual regions rather than the whole formation at once.
How it works. Divides the image into an 8×8 grid (64 cells) and runs ELA independently on each cell. Applies cluster analysis to identify groups of cells with anomalously high error levels compared to the rest of the image.
What a positive finding means. Specific regions show compression error levels inconsistent with adjacent areas, suggesting those regions may have been added from a differently compressed source.
Known limitations. Images with highly varied content (a person against a smooth background, overlaid text, logos, or watermarks) produce natural regional ELA variation that can trigger this detector. Grid-based analysis may distribute artefacts across cell boundaries.
Active in: Deep only.
What it measures. Whether the colour temperature (the warm or cool quality of the light) is consistent across different segments of the image. Elements photographed under different lighting conditions carry different colour casts even after global white balance adjustments.
How it works. Converts the image to a perceptual colour representation (CIELAB, a standard that aligns colour distance with human visual perception) and segments it into regions. Analyses the warm/cool balance of each segment (the a and b channels). Significant divergence between segments, particularly between foreground and background, is treated as an inconsistency indicator.
What a positive finding means. Different regions appear to have been captured under different lighting conditions. Combined with other regional signals, this increases confidence in a composite manipulation finding.
Known limitations. Assumes single-illuminant scenes. Mixed-lighting conditions (tungsten combined with daylight, indoor/outdoor transitions) and intentional colour grading produce false positives. Results are most meaningful for outdoor scenes with consistent natural light.
Active in: Deep only.
What it measures. Semantic-level characteristics of the image using a large-scale vision-language model. Rather than analysing low-level pixel statistics, CLIP Detection asks whether the overall image content appears consistent with AI-generated or authentic photographic output.
How it works. Passes the image through an OpenCLIP ViT-B/32 vision encoder and performs zero-shot classification. Cosine similarity scores are used to derive a confidence-weighted verdict. This detector requires an optional approximately 350 MB model download and loads lazily on first use. The production-grade path is UnivFD v10onnx (a trained logistic regression classifier on the same CLIP embeddings), which contributes to the trust score separately. CLIP class probability bars displayed in the interface are currently marked "Experimental, informational only" and do not contribute to scoring.
What a positive finding means. The image's visual semantics are more consistent with AI-generated content than with authentic photography. This is a complementary signal operating at a different level of abstraction to the statistical detectors.
Known limitations. Highly stylised or artistic photography, heavily post-processed images, macro photography, and subjects statistically over-represented in AI training data may produce elevated AI probability scores. Requires the optional CLIP ViT-B/32 model (bundled, approximately 580 MB combined with UnivFD weights).
Active in: Deep (only when the optional model is installed).
These three tools are available in Expert View and can be triggered manually when the automatic signals are ambiguous. They do not contribute to the numeric trust score and their results should be used to inform investigator judgement, not to produce a quantitative verdict.
Analyses the statistical relationships between adjacent pixels. Natural photographs have characteristic correlation patterns arising from optical blur, sensor interpolation, and scene continuity. AI generators produce pixels through a fundamentally different process that disturbs these relationships. Computes horizontal and vertical pixel correlation coefficients, variance of pixel differences, and high-frequency energy ratios, then compares against empirical distributions from authentic photographs.
Demoted from automatic scoring in April 2026. A hand-tuned NPR statistic is partially redundant with UnivFD v10onnx, which encodes upsampling artefacts at a higher level of abstraction via CLIP features. The sidecar endpoint remains for manual investigation.
Analyses whether the implied direction of light is consistent across different regions. In an authentic photograph, shadows and highlights all point away from the same light source. Composite images frequently fail this check. Divides the image into regions and computes a gradient-weighted estimate of light direction for each, then compares directions across regions.
Demoted from automatic scoring in April 2026. The gradient-weighted estimate is noisy on textured and cluttered backgrounds. The canonical shadow-constraint technique (Kee, O'Brien and Farid 2013) requires user-placed shadow/object point pairs and is a better fit as a manual region-of-interest tool.
Examines edges within the image for three manipulation signals simultaneously: JPEG DCT grid discontinuities (abrupt changes in the compression block pattern at potential splice points); noise level changes (sudden shifts in noise grain across a boundary); and feathering artefacts (the soft-edge signature left by selection tools and layer masking). Agreement between multiple signals at the same location substantially increases confidence.
Demoted from automatic scoring in April 2026. The three-signal fusion produced no suspicious=true results in production during calibration testing, contributing noise without adding discriminative value. A future replacement using learned splice localisation is backlog work.
When multiple detectors run simultaneously, their results are combined using a weighted ensemble. Weights reflect empirical reliability as manipulation indicators.
| Detector | Weight | Notes |
|---|---|---|
| Error Level Analysis | 2.0 | Most reliable single manipulation indicator |
| Segmented ELA | 1.5 | Regional variant; high specificity for compositing |
| Colour Temperature | 1.5 | Strong composite indicator when consistent with other regional signals |
| Noise Analysis | 1.0 | Standard weight; useful for both AI detection and compositing |
| Copy-Move Detection | 1.0 | Standard weight; specific to clone-stamp manipulation |
| JPEG Ghost | 0.5× | Quality-adaptive; consensus weight pending real-world splice benchmark |
| Shadow Consistency | On-demand | Not in trust scoring |
| Splice Boundary | On-demand | Not in trust scoring |
| AI Generation Detection | Independent | Combined via worst-case with manipulation score; not pooled into the weighted sum |
When ELA and the AI Generation Detection ensemble both return clean results but other signals (noise analysis, copy-move) flag concerns, Jura Trace applies a concordance dampening factor. Mixed signals alongside a clean ELA result are most commonly caused by codec artefacts (AVIF, WebP, HEIC) and heavy recompression rather than genuine manipulation. Dampening reduces false positives in these cases while preserving sensitivity when the primary detectors also fire.
Jura Trace is a forensic aid. Like all forensic tools, it has limits that apply to every analysis.
Automated analysis cannot prove authenticity. A high trust score means no detectors found anomalies. It does not mean the content is definitively authentic. It means analysis found nothing to indicate otherwise.
A low trust score may reflect legitimate processing. Social media platforms, CMS tools, and publishing workflows routinely recompress, resize, and strip metadata from images. These processes produce forensic artefacts indistinguishable from some manipulation signals.
Scores should inform human judgement, not replace it. No forensic detector has a zero false positive or false negative rate. Results must be interpreted by a human, in context, alongside other available evidence.
Jura Trace is not a legal authority. Results are not legal evidence and should not be presented as definitive findings in proceedings without expert interpretation. Treat them as investigative indicators warranting further examination by a qualified forensic specialist.
Detectors are trained on current AI generation techniques. AI generation technology advances rapidly. A period of reduced sensitivity should be expected whenever a new generation technique becomes widespread. Both classifiers are retrained regularly.
The Berkeley Protocol on Digital Open Source Investigations (UNODC/OHCHR, 2020) requires that analytical methods be transparent, reproducible, and honest about uncertainty (§6). Jura Trace is designed with these requirements in mind:
- The full scoring algorithm is published in
src-tauri/src/lib.rs::compute_trustunder AGPL-3.0-or-later, so any investigator can reproduce every calculation from source. - This methodology page documents every detector, its weight in the score, its known limitations, and the empirical basis (or absence of one) for each calibration decision.
- Trust scores are presented as confidence indicators with explicit uncertainty acknowledgement, not as definitive verdicts.
- Limitations are disclosed prominently rather than buried in footnotes.
Last updated 2026-06-04 for Jura Trace v1.0.