How Compression Artifacts Expose Manipulated Videos
Every video encode leaves a fingerprint. Compression forensics reads those fingerprints to reconstruct editing history and expose manipulation.
How Compression Artifacts Expose Manipulated Videos
Every video you watch online has been compressed — usually multiple times. Each compression pass leaves a forensic fingerprint in the pixel data, and those fingerprints can reveal whether a video has been edited, re-encoded, or synthetically generated. Understanding how compression works is essential for anyone evaluating the authenticity of digital video.
How Video Compression Works
Modern video codecs reduce file size by exploiting two types of redundancy: spatial (similar pixels within a single frame) and temporal (similar content across consecutive frames). The codec divides each frame into macroblocks (or coding tree units in newer standards), applies a mathematical transform, and then quantises the result — deliberately discarding fine-grained detail that the human visual system is unlikely to notice.
Codecs organise frames into three principal types:
- I-frames (Intra-coded): Fully self-contained frames encoded without reference to other frames. They act as keyframes and are the largest in file size.
- P-frames (Predicted): Encoded relative to a previous reference frame. They store only the differences (motion vectors and residuals), making them significantly smaller.
- B-frames (Bi-predictive): Encoded relative to both a previous and a future reference frame. They achieve the highest compression ratio but introduce the most complex dependency chains.
The quantisation step is where forensic evidence is created. Each codec applies quantisation in a characteristic way, and the resulting rounding patterns are embedded in the pixel data permanently.
Codec Fingerprints
Different codecs leave different statistical signatures. H.264 (AVC) uses 4×4 and 8×8 integer transforms and a specific deblocking filter that smooths block boundaries in a recognisable pattern. H.265 (HEVC) introduces variable-size coding tree units (up to 64×64) and a sample adaptive offset filter, producing a distinct noise texture. VP9 and AV1 use non-square prediction blocks and different entropy coding methods, leaving their own characteristic imprints.
A trained forensic system can often identify which codec was used to encode a video — and, more importantly, detect when the codec signature is inconsistent across regions of a frame or across the temporal axis, which may suggest selective editing.
Quantisation Patterns and How They Reveal Editing
When a video is encoded, the quantisation parameter (QP) determines how aggressively detail is discarded. Higher QP values produce smaller files but more visible blocking and ringing artefacts. The key forensic insight is that quantisation creates a grid-aligned pattern in the frequency domain. If a portion of a frame was pasted in from a differently encoded source, that region may exhibit a different quantisation grid — offset, rotated, or at a different scale — which can be detected by analysing the DCT coefficient histograms.
Double Compression Detection
One of the most reliable forensic signals is double compression. When an already-compressed video is decoded, edited, and then re-encoded, the second quantisation pass interacts with the residual patterns left by the first. This interaction produces periodic artefacts in the DCT coefficient distributions — a phenomenon sometimes called "double quantisation" or "requantisation artefacts."
If only part of the video was modified, the doubly compressed regions will exhibit these periodic patterns while the untouched regions will show a single-compression signature. This mismatch is a strong indicator that localised editing has occurred.
Why Social Media Videos Look Different
Every major social media platform re-encodes uploaded video through its own transcoding pipeline. These pipelines apply platform-specific settings: resolution caps, target bit-rates, codec choices, and colour-space conversions. As a result, every video shared on social media has been compressed at least twice — once by the creator's device and once by the platform.
This means analysts must account for platform re-encoding when interpreting compression forensics. A video downloaded from a social platform will always show double-compression artefacts, regardless of whether it has been manipulated. The forensic challenge is to distinguish platform-induced compression layers from those introduced by deliberate editing. The ClipForensics compression history module is designed to help with exactly this distinction.
How ClipForensics Analyses Encoding Chains
The ClipForensics compression analysis module examines the DCT coefficient histograms, quantisation matrix fingerprints, and block-boundary statistics of each frame. It estimates the number of compression generations, identifies the likely codec used in each pass, and flags spatial regions where the compression signature differs from the surrounding content. This information feeds into the broader multi-signal forensic pipeline.
Keep in mind that compression analysis alone cannot determine intent. A mismatched compression region may indicate malicious editing, innocent cropping, or simply a re-export from a video editor. Analysts should combine compression signals with other forensic modules — such as optical flow and lighting analysis — before drawing conclusions.
Codec Characteristics and Forensic Signals
| Codec | Block / CTU Size | Distinctive Artefact | Forensic Utility | Notes |
|---|---|---|---|---|
| H.264 / AVC | 4×4 / 8×8 macroblocks | Grid-aligned blocking, deblocking filter smoothing | High | Most widely used; extensive research on detection methods |
| H.265 / HEVC | Up to 64×64 CTU | Variable-block boundaries, SAO filter residuals | Moderate–High | Larger block sizes can mask fine-grained manipulation |
| VP9 | Up to 64×64 superblocks | Non-square partitioning artefacts, loop filter patterns | Moderate | Common in YouTube re-encodes; less academic tooling available |
| AV1 | Up to 128×128 superblocks | Film-grain synthesis layer, CDEF filter residuals | Emerging | Newest codec; forensic research is still maturing |
Limitations of Compression Forensics
Compression analysis is a valuable forensic layer, but it cannot operate in isolation. Multiple legitimate workflows — transcoding for different devices, exporting from editing software, platform re-encoding — produce compression artefacts that can mimic the signals of manipulation. Very high quality encodes (low QP) may leave minimal quantisation evidence, while very low quality encodes may obliterate subtle forensic traces. For a frank discussion of what forensic tools can and cannot do, see our page on detection limitations.
Frequently Asked Questions
Does every re-encoded video show double compression artefacts?
In most cases, yes — any decode-then-reencode cycle introduces requantisation patterns. However, the strength of these patterns depends on the quality settings of both passes. If the second encode uses a much lower quality than the first, the second-pass artefacts may dominate and obscure the first-pass fingerprint.
Can compression analysis tell me which editing software was used?
Sometimes. Certain editors embed characteristic metadata or use specific default encoding profiles that can be identified. However, this is metadata-level evidence and can be easily stripped or spoofed. Compression analysis is more reliable for detecting that editing occurred than for identifying the specific tool.
How does social media re-encoding affect forensic analysis?
Platform re-encoding adds at least one additional compression layer, which complicates analysis. The ClipForensics pipeline accounts for known platform encoding profiles to help distinguish platform-induced artefacts from those that may indicate manipulation. For best results, analyse the highest-quality version of a video available — ideally the original file before platform upload.
Is compression analysis effective against AI-generated video?
It can be. AI-generated videos are typically rendered and then encoded for the first time, meaning they may lack the double-compression artefacts expected of video captured on a real device (which usually encodes on-device and then again on upload). This "too clean" compression profile can itself be a forensic signal. However, this heuristic is not foolproof — a generator could intentionally apply a realistic encoding chain. Combine compression analysis with optical flow and other modules for a more robust assessment.
Can I upload a video to check its compression history?
Yes. Use the ClipForensics upload tool to submit a video for analysis. The scan report includes a dedicated compression history section alongside results from all other forensic modules.
