tamperlint

Explainable tamper detection for PDFs and scanned documents: file structure, fonts, layout, pixels and arithmetic, with a plain-language reason for every finding.

View on GitHub Rule reference Real-world evaluation

Example reports

Nine synthetic SPECIMEN documents from fictional issuers, each analysed by tamperlint 0.1.0.dev0. Open a report to see every finding explained, and each one that points to a spot on the page boxed on the page preview. The documents and reports are rebuilt from the code in the repository on every change.

First page of statement_genuine.pdf
INTACT evidence 0.00

Genuine bank statement

Produced in one pass by the issuer's statement generator. Nothing was changed.

No evidence of tampering found.

Open report Sample file
First page of statement_signed.pdf
INTACT evidence 0.05

Digitally signed statement

The genuine statement with a digital signature added, a legitimate later change.

No evidence of tampering found.

Open report Sample file
First page of statement_edited.pdf
SUSPICIOUS evidence 0.96

One amount retyped

A debit covered with a white box and a new amount typed on top in another font, saved as an incremental update.

  • TL-LOGIC-001 Running balance does not reconcile
  • TL-REV-002 Later revision rewrote page content
  • TL-FONT-002 Font used only for a few characters
  • TL-OVL-001 Filled shape covers text
  • + 2 more
Open report Sample file
First page of statement_edited_flattened.pdf
SUSPICIOUS evidence 0.59

Expense hidden, balances fixed, history removed

A large debit replaced by a smaller one, every later balance corrected so the arithmetic still holds, and the file re-saved to erase its edit history.

  • TL-OVL-001 Filled shape covers text
  • TL-GEO-002 Inconsistent typeface or size in a column of values
  • TL-GEO-001 Amount out of line with its row
Open report Sample file
First page of statement_signed_then_edited.pdf
SUSPICIOUS evidence 0.99

Edited after signing

The signed statement with a debit retyped after the signature was applied.

  • TL-SIG-002 Changes after signing are not permitted
  • TL-LOGIC-001 Running balance does not reconcile
  • TL-REV-002 Later revision rewrote page content
  • TL-FONT-002 Font used only for a few characters
  • + 3 more
Open report Sample file
First page of invoice_genuine.pdf
INTACT evidence 0.00

Genuine invoice

Line items, tax and total produced by the issuer's invoicing software.

No evidence of tampering found.

Open report Sample file
First page of invoice_total_inflated.pdf
SUSPICIOUS evidence 0.63

Inflated invoice total

The total raised above the sum of the lines and tax. The file carries no editing traces; only the arithmetic gives it away.

  • TL-LOGIC-002 Invoice totals do not add up
Open report Sample file
First page of scan_genuine.jpg
INCONCLUSIVE evidence 0.00

Genuine scan

A scan of the genuine statement. Pixels alone cannot vouch for a document, so the verdict is INCONCLUSIVE by design.

No evidence of tampering found.

Open report Sample file
First page of scan_rows_copied.jpg
SUSPICIOUS evidence 0.63

Rows copied inside a scan

Three transaction rows copied over three later rows of the same scan, so the statement shows duplicated transactions.

  • TL-IMG-002 Duplicated image region
Open report Sample file

Try it on your own files

tamperlint runs on your machine: no GPU, no API keys, and your documents never leave your computer.

pip install "tamperlint[synth] @ git+https://github.com/muneeb9211/tamperlint"
tamperlint check statement.pdf
tamperlint check statement.pdf -f html -o reports/