Multilayer Forensic Tampering Detection

PDFs are increasingly used for official documents, making them vulnerable to tampering via free online editing tools, which necessitates automated detection methods due to significant financial risks associated with document fraud. The proposed solution is a modular, twostage forensic pipeline designed to detect PDF tampering by integrating eight independent forensic modules and aggregating their results into an interpretable risk score.

The gist

A modular application is presented whose primary goal is to facilitate and automate the detection of PDF tampering or compromise, built on eight independent forensic modules (format validation, malware detection, metadata, structure, fonts, images, visual overlay, and dual-source OCR) aggregated into a weighted score.

Proposed Analysis Pipeline

The pipeline operates in two successive phases: Ingestion and Security Gating and Forensic Forgery Inspection. The initial phase involves an upfront sanitization gate where the file is validated against basic PDF specifications to ensure compliance and check for malicious payloads, halting execution immediately if an invalid format or active exploit is detected. This is followed by the Forensic Forgery Inspection phase, which subjects cleared documents to multi-layer scrutiny. This inspection includes:

1. An eliminatory check on high-risk Creator/Producer signatures, which immediately assigns a maximum risk score (100%) and short-circuits the process if triggered.

2. Evaluation of structural and visual consistency to uncover fraudulent modifications, such as checking if the structure has drawings or images or if the image count is greater than zero.

3. Analysis of coverage, which is triggered only if structural elements are present ("R.structure.has drawings or R.images.count > 0").

4. OCR analysis, which is performed only if there are images ("R.images.count > 0").

Scoring Engine and Weighting

The final risk assessment is determined by a weighted scoring engine that aggregates indicators into an interpretable risk score using Equation (2):

score = round 100 × P Pm rm wm

Where:

m ∈ A (weight wm, maximum attainable raw score Mm)

The weights assigned to the modules are specified as: wm ∈ [25, 25, 20, 15, 15]% for [metadata, structure, coverage, fonts, images]. The final score is normalized over active modules only; for instance, a page lacking optional features like raster imagery is never penalized for a module that had nothing to analyze. The resulting score maps to an interpretable risk level:

0 Compliant (Conforme)

1–15 Low (Faible)

16–35 Moderate (Modéré)

The highest range, 61–99, or 100 (elim.) Critical, is designated as the maximum risk level.

Implementation and Results

The pipeline was validated on a corpus of real medical work-stoppage certificates, including deliberately falsified variants and known malicious PDFs. Table II summarizes representative cases across the risk spectrum:

Falsified certificate 54% High

Malicious payload 100% (elim.) Critical

The results demonstrated that cross-referencing internal structure with rendered content can reveal alterations invisible to simple visual inspection or metadata analysis. For example, on a falsified certificate, the structure and coverage flagged a 100% page stacking rate, and the native content stream read “Dr MILENKOVIC” while the rendered page displayed “Dr POC,” exposing a substituted name. Furthermore, infrastructure protection was shown through an eliminatory malware check that quarantined an embedded JavaScript exploit before any forensic module could evaluate document authenticity.

Limitations and Future Work

A limitation noted is that the module weighting is not immune to false positives (Table II, row 3), as a single metadata-absence flag can be a weak signal in isolation. To mitigate this residual false-positive rate on documents with sparse metadata, the approach relies on combining eight independent modules rather than triggering on one flag alone. Future improvements include incorporating AI-based approaches to enhance detection accuracy and overall system effectiveness through data-driven learning. The proposed architecture is also designed to be extensible, allowing for the definition and integration of additional filtering and forensic analysis modules as new fraud or tampering patterns emerge. The paper concludes that cross-referencing internal structure with rendered content is effective in revealing alterations not apparent during simple visual inspection or metadata analysis alone. The approach was validated on real-world cases, such as those related to Assurance Maladie fraud detected and stopped in 2025, where 49 million euros were tied to falsified work-stoppage certificates. The pipeline is designed for local, document-aware processing rather than requiring sensitive files to be uploaded to third-party infrastructure. The approach was validated on real medical work-stoppage certificates.

Here are the specific improvements for an AI system based on this research, along with what those improved systems can achieve:

1. A modular, multi-stage forensic pipeline that integrates format validation, malware scanning (host protection), and deep document inspection (metadata, structure, OCR consistency).

2. An automated risk scoring engine that aggregates indicators from eight independent forensic modules into a single, interpretable weighted score (Eq. 2).

3. A system capable of detecting subtle, non-visual tampering by cross-referencing internal data streams with rendered output (e.g., comparing native content stream text against OCR results) to expose invisible alterations like substituted names or date inconsistencies.

4. An initial security gating layer that immediately halts processing if the PDF format is invalid or if it contains known malicious payloads, thus protecting the host environment before deep forensic analysis begins.

5. A high-risk flagging mechanism where specific eliminatory flags (e.g., high-risk creator signatures) automatically trigger a maximum CRITICAL risk score (100%), bypassing further analysis for immediate quarantine action.

This improved AI system can perform the following specific tasks:

1. Detect and flag PDF documents that have been subtly altered to conceal fraudulent information (e.g., changing names, dates, or amounts) by comparing the original document structure with its rendered text output (OCR consistency).

2. Identify malicious PDFs designed to exploit host systems (e.g., those containing embedded JavaScript or active exploits), allowing for immediate quarantine of the file before it can execute on a user's machine.

3. Provide a transparent and auditable risk assessment for any document, translating complex technical findings into an easily understood risk level (Compliant, Low, Moderate, High, Critical).

4. Automate the triage of large volumes of documents by prioritizing those with the highest detected tampering risks (e.g., scoring Falsified certificate at 54% High) for human review.

5. Implement a scalable architecture that is extensible; new forensic modules or fraud patterns can be added and integrated without redesigning the core engine, enabling continuous adaptation to emerging document tampering techniques.

With the proliferation of free online editing tools, altering or forging pdf documents has become trivially easy, often leaving no visual traces on screen. This paper introduces a two- stage forensic pipeline. An initial security-gating layer validates format compliance and flags embedded malicious payloads and a forensic engine that inspects internal objects across meta- data, visual overlays, and dual-source OCR consistency, etc... A weighted scoring engine aggregates these forensic indicators into an interpretable risk score is proposed. The approach was validated on real medical work-stoppage certificates.