One French insurer’s document intake carries 859 distinct JPEG quantization tables, each a slightly different recipe for deciding which image detail gets thrown away. The public benchmark on which most document-forgery detectors are trained and scored carries exactly one, which means those models have spent their entire training lives studying a single compression fingerprint and treating departures from it as evidence. Retailers are now pointing the same class of model at certificates of origin, sub-tier audit files and resale authentication paperwork, and they are choosing between vendors on scores computed inside the one condition the models were built for.

A quantization table is a fingerprint, not a setting. The JPEG standard leaves the encoder to decide what survives compression, and nearly every camera, scanner and PDF converter ships hard-coded tables tuned to its own hardware, so a page that has passed through three of them carries a layered compression history. Forgery detectors exploit this, because a region that has been edited and re-saved stops matching the compression traces of the page around it. The DocQT study, revised on arXiv yesterday and built from the document intake of the French insurer MAIF, shows what happens when a model learns that trick from one table and is then shown the tables real documents arrive in.

The result splits along architecture, and that split is the finding a buyer should read. The authors trained two localisation models twice over: once under the field’s default quality-factor augmentation, once under quantization tables drawn from the live intake. Retraining on realistic tables bought FFDN, which takes the quantization table as an explicit input, 14.5 F1 points on tampered-region localisation. Mesorch, which does not read the table, gained nothing under realistic compression and lost ground on the standard benchmark condition it had been tuned for. Two architectures and one insurer is narrow evidence, and the authors say so. It is still enough to establish the mechanism, because the mechanism lives in the file format rather than in the industry.

The false-positive number is where this stops being a leaderboard argument. Run against authentic documents from the live intake, the standard-trained model marked spurious tampered pixels at roughly six times the rate of the version trained on real tables. Those are clean documents being accused, and each accusation spends a person’s attention rather than a model’s. MAIF receives more than 100,000 documents a month for claims handling alone, so a small proportional error is a large absolute queue. A detector whose queue is mostly noise does not get overruled; it gets switched off.

A separate benchmark published in March measured how far the gap travels. DocForge-Bench ran fourteen forgery-detection methods across eight document datasets with no domain-specific tuning. The detector trained on the field’s standard dataset scores 0.914 pixel-F1 on its own test set, DocForge-Bench found. Tested against a set of forged receipts it had never seen, the same detector scores 0.002. The diagnosis matters more than the collapse: most methods held moderate pixel-level AUC, meaning they still ranked suspicious pixels roughly correctly and had lost only the ability to decide where suspicion becomes a finding.

These models have not learned what a forgery looks like; they have learned what one pipeline looks like, and they treat everything outside it as suspect.

That trick has limits DocForge-Bench is explicit about. Its eight datasets predate diffusion- and LLM-generated document forgery, so nothing in either study says a model retrained on realistic quantization tables catches a page an AI model built from scratch. The compression-table fix narrows the mismatch these two studies measured; it does not close the newer one.

Retail is now assembling exactly the kind of intake these models handle worst. U.S. Customs and Border Protection’s forced labour enforcement guidance for importers, issued on 9 June and summarised by Holland & Knight, asks importers to produce purchase orders, bills of materials, production records, transport documents and supplier attestations down through sub-tier suppliers, under a clear-and-convincing-evidence standard that redacted or untranslated records are unlikely to satisfy. A dossier assembled that way is a stack of photographs taken on a dyehouse manager’s phone, run through a mill’s ageing office copier, re-saved by a freight forwarder’s PDF tool and uploaded by a compliance team in a fourth country. Every one of those steps writes its own quantization table. The documents carrying the most legal weight are the ones that have passed through the most hands, which is another way of saying they are the ones furthest from any benchmark.

The strongest objection is that none of this is a modelling failure at all. DocForge-Bench found that adapting the decision threshold on as few as ten in-domain images recovered between 39 and 55 percent of the achievable gap, which points at miscalibration rather than blindness. Read that way, a retailer runs a short calibration against its own document flow and the problem shrinks to a deployment detail. What has to hold for that to work is possession of labelled tampered examples from your own intake, and a brand verifying supplier paperwork does not keep a folder of known forgeries in its own compression chain. Recovering half of an achievable gap also leaves the other half, and the DocQT result locates that half in what the model was trained to look at rather than in where its threshold falls.

The procurement question this changes is narrow and answerable. A vendor demonstration reports a benchmark score, but what predicts performance on your certificates of origin is the distribution of quantization tables in your own intake, which any retailer can measure in an afternoon by reading its own JPEG headers against the table bank the DocQT authors released. Ask which tables the model saw in training, and whether it reads the table at all. Where those two answers do not match your supplier documents, the benchmark is measuring the vendor’s pipeline rather than your exposure. Forged trade paperwork rarely fails because it looks wrong: the textile diversion ring OLAF dismantled filed transit records showing cargo arriving in Spain that had never left Poland. A system that has learned to recognise a scanner’s signature will keep clearing documents like those, and keep stopping the honest ones.