Mar 2026 — Jul 2026

Hybrid Font Metadata & Glyph Matching for PDF Text Tampering Detection

Final-year research thesis — catching PDF text tampering invisible to the eye by fusing font metadata with visual glyph analysis.

PDF is the standard trusted format for bank statements, invoices, academic certificates, vehicle registrations, and legal contracts — which makes it a target. An attacker can change a word, number, or font inside a PDF without altering how the page looks, defeating manual review and simple text scanning. This BSc (Hons) thesis proposes an automated, explainable detection system that combines the font metadata embedded in a PDF (font name, size, encoding, spacing) with a visual analysis of each character's rendered glyph (stroke width, curvature, spacing), fuses both signals into a font-matching score, and classifies each text block with a Random Forest model — highlighting the suspicious region on the page with a confidence score instead of returning an opaque binary verdict.

Tech Stack

PDF & Feature Extraction

  • PyMuPDF (fitz) — PDF parsing, font metadata + bounding-box extraction
  • OpenCV & Pillow (PIL) — 300 DPI glyph rendering and visual feature extraction
  • NumPy & pandas — feature engineering and dataset assembly

Machine Learning

  • scikit-learn — Random Forest classifier, stratified k-fold cross-validation

Detection API

  • Flask + Flask-CORS
  • Werkzeug

Reviewer Web App

  • React (Create React App)
  • react-dropzone — drag-and-drop PDF upload
  • Axios

Features

Dataset & Ground Truth

  • ＋2,500 synthetic PDFs — 500 genuine, 2,000 tampered across 4 tampering methods (500 each): font change, character replacement, spacing alteration, embedding mismatch
  • ＋5 real-world document types — bank statements, invoices, vehicle registrations, academic certificates, legal contracts
  • ＋Stratified train/validation/test split by document category and tampering type, to prevent data leakage between training and evaluation

Hybrid Detection Pipeline

  • ＋Font metadata extraction — font name, flags (bold/italic/serif/monospace), size, character spacing, encoding, embedding type (Type1/TrueType/Type0-CID) via PyMuPDF
  • ＋Glyph rendering & visual features — each text block rasterised at 300 DPI; per-glyph stroke width, contour curvature, aspect ratio/x-height, inter-character spacing, and an edge-density histogram
  • ＋Font matching score — a weighted deviation score S(bᵢ) = α·D_meta(bᵢ) + (1-α)·D_glyph(bᵢ) comparing each text block against the document's own dominant metadata and glyph profile, with α tuned on a validation set
  • ＋Optional hybrid verification — OCR-based semantic/logical consistency checks on numeric or verifiable content (totals, dates) to filter false positives

Machine Learning & Explainability

  • ＋Random Forest classifier over the concatenated metadata + glyph feature vectors — chosen over a CNN for being lightweight on tabular features, resistant to overfitting on a medium synthetic dataset, and able to expose feature importances
  • ＋Ablation study across metadata-only (α=1), glyph-only (α=0), and the tuned hybrid configuration, to test whether combining both channels actually helps
  • ＋Per-block explainability output — the block score, the metadata vs. glyph contribution split, the top contributing features, and a highlighted region + confidence score for a human reviewer

Results

  • ＋Random Forest hybrid model: 82.8% document-level accuracy, vs. 24.4% for a rule-based baseline
  • ＋Near-perfect detection (100%) on font-change and embedding-mismatch tampering; 78% on character-replacement and spacing-alteration, the two hardest categories
  • ＋80% accuracy on invoices, bank statements, vehicle registrations, and academic certificates; 60% on legal contracts, the most structurally varied document type
  • ＋Key finding: font consistency is the strongest single tamper indicator, and embedding-mismatch tampering is the easiest to catch automatically

Reviewer Web App

  • ＋A Flask API wraps the trained detector and PyMuPDF pipeline behind a REST endpoint
  • ＋A React frontend lets a reviewer drag and drop a PDF and see flagged regions with their confidence scores

Architecture & Design Patterns