Guides

Everything Tamperlens knows about reading a document's bytes, written out. The field guide is the reference; the rest are walkthroughs of one question each.

Which guide you need depends on two things: what the file is, and whether you are asking if it changed or if a machine made it.
Was it CHANGED after it was made? Was it MADE by a machine? A PDF or Office file Detect an edited PDF revisions · /ID pairs · Producer Detect an AI-generated PDF C2PA credential, or nothing An image Detect an edited image EXIF · encoder fingerprints Detect an AI-generated image a screenshot strips the credential Text you were sent No guide, and no signal. check the file it arrived in Detect AI-generated text classifiers guess; watermarks need a key Do you already hold the original? Then compare the two files directly: it beats every cell above, whatever the question was.

Every cell is a page below. The two columns are not degrees of the same thing: an edit leaves traces in the file's own history, and a generator either left a credential or left nothing at all.

Signal references

What the engine looks for, family by family, with the benign causes named alongside the malicious ones.

  • Fraud signals field guide

    All nineteen families that run on every PDF, what each detects, its benign causes, and how severity is decided.

  • PDF metadata forensics

    The Info dictionary, XMP, and what it means when a file's two records of its own history disagree.

  • What a producer string means

    A searchable table of the /Producer strings found across 1,728 published documents, and what each one indicates.

The nineteen families are grouped by which part of the file the signal is read from: not by how serious it is.
the field guide: nineteen families 5 Origin and history revisions, dates, /ID, Producer, XMP vs Info where it came from 7 Page content fonts, hybrid pages, redaction, injection what the page gives away 3 Signatures coverage, integrity, permissions what it actually covers 4 Numbers and structure CPF/CNPJ/boleto digits, running balance, glyphs when the page disagrees Nine more families run on images; those live in the image guides.

Counts are the ones the field guide itself publishes, family by family. Each group below is one page, and every family on it carries its benign causes and its severity logic.

  • Origin and history signals

    Five families: incremental updates, XMP against Info, date anomalies, the Producer fingerprint, and a changed /ID pair.

  • Page-content signals

    Six families: font anomalies, hybrid pages, redaction exposure, document-borne prompt injection, embedded-image anomalies and active content.

  • Signature signals

    Three families: what the signature covers, whether it still verifies, and what its permissions said was allowed afterwards.

  • Number and structure signals

    Four families: Brazilian identifier check digits, a running balance that stops adding up, glyph anomalies, and structural warnings.

Guides

One question each, answered end to end.

  • Detect an edited PDF

    Incremental updates, changed /ID pairs, editor fingerprints. How a PDF records its own edits.

  • Detect an edited image

    EXIF, encoder fingerprints, AI-generator metadata, and why an absence of metadata proves nothing.

  • Detect an AI-generated PDF

    Two layers that answer different questions: a C2PA credential either validates or it does not, and an AI detector scoring 0.56-0.60 AUC on documents is a coin flip with a decimal point.

  • Detect an AI-generated image

    Content Credentials, vendor watermarks and statistical classifiers: what each proves, and why a screenshot strips the only one that was worth anything.

  • Detect AI-generated text

    Classifiers guess, and they misfire hardest on non-native writers; watermarks need the vendor's key. The file the text arrived in has a history you can actually check.

  • Bank statement fraud signals

    What a forged statement looks like at the byte level, and what a legitimately re-saved one looks like.

  • Detect a fake boleto

    Brazil's payment slip: the three shapes the fraud takes, the checks you run by hand, and the one it cannot catch.

  • ICP-Brasil signature validation

    What Brazil's official validator proves cryptographically, and the unsigned everyday document it cannot see.

  • PDF malware signals

    Embedded JavaScript, /OpenAction and launch actions: presence, reported honestly, not a verdict.

  • How comparison works

    Byte identity, revision ancestry and structural diff. What each one does and does not prove.

  • Incremental update vs full rewrite

    The two ways a PDF can be saved. One keeps every earlier version inside the file; the other keeps none, and it decides what anyone can prove afterwards.

Looking for a tool rather than a guide?