How Sniffer Detects Deepfakes and NCII: The Technical Approach

The Detection Challenge

Detecting whether an image is authentic or manipulated is one of the hardest problems in digital forensics. There's no single "fake detector" — manipulation leaves different traces depending on how it was done.

That's why we built a multi-layer forensic pipeline. Each layer detects a different type of manipulation. Together, they provide a comprehensive verdict.

The Seven-Layer Pipeline

Layer 1: Error Level Analysis (ELA)

ELA measures how different parts of an image compress differently. When an image is edited, the modified regions compress at different rates than the original. ELA highlights these differences.

What it detects:

• Spliced elements (face swapped from another image)
• Copy-paste regions
• Photoshop-style editing

How it works:

1. Re-save the image at a known quality level
2. Compare the re-saved version to the original
3. Calculate the difference (error level) at each pixel
4. Regions with higher error levels may indicate manipulation

Layer 2: DCT Analysis

Discrete Cosine Transform (DCT) analysis examines the frequency domain of an image. JPEG compression uses DCT blocks, and manipulation disrupts the natural pattern of these blocks.

What it detects:

• Resizing and scaling operations
• Compression inconsistencies
• Block-level manipulation

Layer 3: Metadata Forensics

EXIF metadata contains information about how, when, and where an image was created. Inconsistencies in metadata can reveal manipulation.

What it detects:

• Mismatched timestamps
• Inconsistent camera information
• Edited metadata fields
• Missing or corrupted EXIF data

Layer 4: AI/Neural Detection

We use trained neural networks to detect artifacts specific to AI-generated images. GANs (Generative Adversarial Networks) and diffusion models leave characteristic traces that differ from real photographs.

What it detects:

• GAN-generated faces
• AI image generation artifacts
• Deepfake facial manipulation
• Synthetic media patterns

This is critical because AI-generated NCII is a growing threat. Content categories on Indian sites include "AI-generated deepfakes of real individuals."

Layer 5: Noise Pattern Analysis

Every camera sensor has a unique noise pattern (sensor noise). When an image is manipulated, the noise pattern becomes inconsistent across the image.

What it detects:

• Composite images (parts from different sources)
• Region-specific editing
• Inconsistent sensor noise

Layer 6: Facial Landmark Analysis

We analyze facial landmarks — the geometric relationships between facial features. Manipulated faces often have subtle inconsistencies in these relationships.

What it detects:

• Face swapping
• Facial feature manipulation
• Expression synthesis
• Age/gender modification

Layer 7: Clone Detection

Clone detection identifies regions that have been copied and pasted within the same image. This is common in removing or duplicating elements.

What it detects:

• Copy-paste manipulation
• Object removal
• Region duplication

Perceptual Hashing: The MeitY SOP Compliance Layer

The MeitY SOP of October 2025 mandates that platforms deploy "crawler technology" and "hash-matching" for NCII content. Sniffer implements this through perceptual hashing:

Hash Technologies We Use

Hash Type	How It Works	Strengths	Weaknesses
PDQ (Meta)	Perceptual hash for photos	Survives resize, compression	Cropping/borders evade detection
PhotoDNA (Microsoft)	Industry standard for image matching	Proven at scale	Computationally expensive
Cryptographic (SHA-256)	Exact file fingerprint	Lightweight, fast	Any pixel change = new hash
Local Descriptor (SIFT)	Hundreds of visual interest points	Most robust — survives drastic changes	Computationally expensive

How StopNCII.org Works

StopNCII.org is the global standard for NCII prevention, operated by the UK Revenge Porn Helpline:

1. Victim selects images
2. Hash generated locally (image never leaves device)
3. Hash shared with 50+ partner platforms
4. Platforms scan uploads against hash database
5. Content removed & blocked

The limitation: StopNCII only works on participating platforms. Indian porn sites (MyDesi, Aagmaal, Desi49) are NOT participants.

Sniffer's role: We build the crawler technology that monitors the sites StopNCII cannot reach. We feed discovered NCII back into the StopNCII hash bank.

The Scoring System

Each layer produces a confidence score between 0 and 1. These scores are combined using a weighted algorithm to produce a final verdict:

• 0.0 - 0.3: Likely Authentic
• 0.3 - 0.5: Inconclusive
• 0.5 - 0.7: Suspicious
• 0.7 - 1.0: Likely Manipulated

The weights are calibrated based on the type of manipulation each layer is best at detecting.

Distribution Tracing

Beyond detecting manipulation, Sniffer traces where an image has been shared. Using perceptual fingerprinting, we scan:

• Known leak networks (MyDesi, Desi49, Aagmaal)
• Mirror sites
• Content aggregators
• Telegram channels

This creates a distribution map showing exactly where the content exists online.

The Evidence Report

All of this analysis produces a forensic report that includes:

• Per-layer confidence scores
• A cryptographic case ID
• A SHA-256 image hash
• Distribution trace results
• Takedown guidance

This report meets the evidentiary standards of courts and law enforcement. It's not just a "fake detector" — it's a complete forensic toolkit.

Why Multiple Layers Matter

No single detection method is foolproof. A sophisticated attacker might bypass one layer but not all seven. The multi-layer approach provides:

• Redundancy — If one layer misses something, another catches it
• Comprehensive coverage — Different manipulation types are detected by different layers
• Higher confidence — Multiple signals agreeing increases certainty

The MeitY Compliance Angle

The MeitY SOP requires platforms to:

1. Deploy crawler technology
2. Generate hashes of reported NCII content
3. Match new uploads against hash database
4. Prevent re-uploads
5. Communicate hashes to I4C via Sahyog Portal

Sniffer provides the technology layer that makes this possible. We're not just building a victim tool — we're building the infrastructure that the law mandates.

---

Want to try it? Upload an image to Sniffer and see the forensic analysis in action.