Chapter 35 — Exercises
A mix of concept checks, hands-on labs, calculations, and judgment calls — because AI is the one chapter where the most important skill is holding a single line in your head under pressure: the machine produces leads; the human produces findings. (answer in Appendix) = worked solution in Answers. ⭐ = stretch. Hands-on labs use data you own or sanctioned practice images and corpora (Appendix J — Practice Images and Lab Setup); never run a model against evidence you are not authorized to examine, and never work on an original. Tool syntax lives in Appendix H — Command-Line Reference, the reusable scripts in Appendix B — Python Forensics Toolkit, and the legal citations in Appendix E — Legal Frameworks Reference. Every "is it fake?" lab below is built around media you created or generated yourself, so the exercise is about the mechanism and the record, not about pronouncing on anyone's evidence.
Group A — The two faces and the pipeline discipline
35.1 In four or five sentences, describe the two faces of artificial intelligence in the forensic lab — AI as a force multiplier and AI as the thing under investigation — and give one concrete example of each from a real case type. Then write, verbatim, the single sentence the chapter says you will repeat under oath, and explain in your own words why "a model outputs a probability, not a fact" is the rule that governs everything else in the chapter. (answer in Appendix)
35.2 Reproduce the five-stage shape of an AI-assisted examination from memory (verified image → data reduction → enrichment → prioritized queue → human review → report). (a) Name the three non-negotiable properties of this pipeline. (b) Identify the single stage that is "the only place a finding is born," and explain what goes wrong if a model's output is allowed to flow straight into the report without it. (c) Explain why the pipeline must run on a hashed working copy of a verified image and never on the original — naming the recurring theme this protects.
35.3 ⭐ (Calculate — the volume problem.) A single mobile extraction holds 250,000 photographs. Suppose an examiner could review one image every 2 seconds, working 8 hours a day with no breaks. (a) How many images can they review per day, and how many working days would the phone alone take? (b) Now scale to a corporate matter of 10 custodians each averaging that volume — how many examiner-days is that? (c) In one sentence, state what these numbers prove about where the real bottleneck of modern forensics lies, and therefore what AI triage is actually for.
Group B — The hashing spectrum
35.4 Define the three rungs of the hashing ladder — cryptographic, fuzzy, and perceptual — and for each give: the question it answers, one named algorithm, and one forensic job it does. Then answer the discriminating question: a contraband image is shared through a chat app that resizes and re-encodes it, so its SHA-256 no longer matches the catalogued copy. Which rung still flags it, and why does that rung survive a transformation the others do not? (answer in Appendix)
35.5 (Hands-on lab — data reduction first.) On a practice image you own, run known-file filtering against a reference set: hashdeep -c sha256 -r -k nsrl-sha256.txt -x ./evidence/ > unknown-files.txt. (a) Record the before/after file counts and the percentage reduction — this is a documented finding in its own right. (b) Explain why doing this cheap, non-AI step before any model run is the most important triage decision in the chapter. (c) Confirm the command read the target read-only and state why that still matters in a lab.
35.6 ⭐ (Calculate — perceptual distance.) Two images produced these 64-bit dHash values:
imgA dHash = 9A2B7C4D8E1F0A3B
imgB dHash = 9A2B7C4C8E1F2A7B
(a) Compute the Hamming distance between them (the number of differing bits). (b) Using the pipeline's threshold of dhash_hamming = 10, classify the pair as "same image" or "different image." (c) Explain why two visually identical JPEGs saved at different qualities have wildly different SHA-256 digests but nearly identical perceptual hashes — and what that buys an examiner chasing a picture that has travelled through three apps.
35.7 (Judgment — what a hash can and cannot say.) A PhotoDNA-style robust hash is run against a lawfully provided known-material list. (a) State precisely what a match means and what a non-match means — and why a non-match says nothing about an unknown image. (b) Explain why novel, AI-generated material will not match such a list at all, and what forensic consequence that has for triage tuned only to known hashes. (c) Why is a hash match described as "probable cause to look," never a conclusion?
Group C — Triage at scale: enrichment
35.8 (Analyze this output.) A triage CNN classifier returned the queue below. Interpret it as an examiner would. (answer in Appendix)
file top label conf 2nd label conf
IMG_00913.jpg document 0.981 screenshot 0.774
IMG_01244.jpg currency 0.942 document 0.611
IMG_02071.heic face 0.918 indoor_scene 0.880
IMG_02488.jpg vehicle 0.889 license_plate 0.547
(a) Which file would you open first if your warrant authorizes a financial-fraud search, and why? (b) The model scored IMG_01244.jpg "currency 0.942." Write the sentence that may appear in your report about this image — and the sentence that may not. (c) Explain why the 0.547 "license_plate" on the last row is a lead to verify, not a license-plate identification.
35.9 (Hands-on lab — OCR, ASR, translation as leads.) On media you own, run OCR on a photo of a printed page (tesseract page.png out -l eng), ASR on a short voice memo (whisper memo.m4a --model medium --task transcribe), and translation on a foreign-language clip (--task translate). (a) Find at least one error in each output (an OCR 0/O or 1/l slip, a misheard name or number, a flattened idiom). (b) State the bold rule the chapter attaches to all three — the output is a lead, not a transcript of record — and describe exactly what you do before quoting any of this in a report. (c) Why is verifying an OCR'd dollar figure or a translated threat against the source non-negotiable when it decides a case?
35.10 ⭐ (Build the graph — anchor #2.) Using the link-analysis sketch in the chapter (the employee who covered their tracks), a NER pass over a custodian's corpus surfaced the entities j.morales, rk_consulting@proton.me, Q3-pricing-model.xlsx, Meridian Holdings LLC, and a personal Dropbox. (a) Draw the graph (nodes = entities, edges = co-occurrence) and mark the one edge that, if real, most strongly suggests exfiltration. (b) List three ways NER and co-occurrence can mislead (a mislabeled entity, a coincidental co-occurrence, a missing-but-real relationship). (c) Write the one sentence that states what the graph is for — and prove the point with the actual evidence you would read next, naming the chapter that owns email/chat corroboration.
35.11 (Build the timeline — the ninety seconds.) A z-score anomaly pass over 1.2 million log lines flagged three events around 02:14 for account j.morales: an off-hours logon (z=4.7), a first-seen USB device, and a 4,212-file read in 7 minutes (z=9.1). (a) Explain what the z-score actually measured and why it is explainable on the stand in a way an autoencoder's reconstruction error is not. (b) State plainly what the anomaly flag did and did not establish. (c) Name the two corroborating artifacts (one registry, one MFT) that prove what the model only ranked, citing the chapters that own them.
Group D — Detecting synthetic media
35.12 Name the visual deepfake detection battery and give a one-line tell for each: blending/boundary, lighting and eye-reflection, eyes/blinking/pupils/teeth, temporal flicker, frequency-domain, and physiological (rPPG). For two of them, name the research detector or study associated with it (e.g., Face X-Ray, "In Ictu Oculi," FakeCatcher). Then state the single discipline that turns this battery of leads into a defensible analysis. (answer in Appendix)
35.13 (Analyze this ensemble.) A detection run on statement_exhibit-12.mp4 produced:
detector score(0=real,1=fake) note
blend-boundary (Face X-Ray) 0.71 elevated at jawline
frequency-domain 0.66 weak periodic peaks
eye-reflection consistency 0.58 mild mismatch L/R
rPPG (heartbeat coherence) 0.49 inconclusive
temporal flicker 0.63 boundary shimmer
ENSEMBLE MEAN 0.61
(a) Why does the chapter insist you read the spread, not just the mean? (b) Write the finding this output supports — and the finding it does not support — in the careful language the chapter requires. (c) The generator that produced this clip (if any) is unknown to your detectors. Explain why that single fact caps how much weight the 0.61 can bear, and what you must do to corroborate it.
35.14 ⭐ (Explain the fingerprint.) A real camera image and a GAN-generated image are transformed to their 2-D frequency spectra. (a) Describe what each spectrum looks like (smooth monotonic falloff vs. a regular lattice of peaks) and explain why the GAN leaves periodic peaks — name the operation inside the generator responsible. (b) Why is this artifact invisible to the naked eye yet robust to recompression that defeats some pixel-level tells? (c) Draw the analogy the chapter makes to a manipulation artifact from Chapter 20 — Photo, Video, and Document Forensics, and state what is the same and what is different about the two.
35.15 (Judgment — the CEO call.) A finance employee receives an urgent voicemail in a perfectly familiar executive voice authorizing a wire transfer. (a) List four audio artifacts of synthetic speech you would look for (spectral, micro-variation, prosody, involuntary sounds, room acoustics — pick four and explain each). (b) List three out-of-band facts that would break the fraud regardless of how good the audio is. (c) Explain why cloned voices "defeat people more easily than faces," and why — as with images — no single audio tell convicts.
35.16 (Calculate — the generalization gap.) The 2020 Deepfake Detection Challenge's top models scored about 82% on the public test set and roughly 65% on the held-out, unfamiliar ("black-box") set. (a) How many percentage points above a coin flip (50%) is the 65% figure? (b) Restate "65% accurate" as an error rate on the kind of fake you actually care about, and explain why that number cannot, by itself, support a binary courtroom conclusion. (c) In one sentence, connect this to Daubert's "known or potential error rate" factor.
Group E — Provenance and authentication
35.17 (Read the structure.) Content Credentials (C2PA) are embedded in a JPEG inside a specific marker. (a) Name the marker and the container format (the two-byte marker and the box format the manifest lives in), and state where the same manifest lives in a PNG. (b) Explain what makes a Content Credential tamper-evident — what binds the claim to the pixels, and what a validator reports when the pixels are altered. (c) State plainly what a valid credential, a failed validation, and an absent credential each mean for your finding — and why "no credential" must never become "therefore fake." (answer in Appendix)
35.18 (Hands-on lab — inspect a credential.) On an image you create or download with Content Credentials (e.g., from Adobe's tools or a SynthID/CR-enabled generator), run c2patool photo.jpg --detailed. (a) Record the signer (the X.509 certificate chain), the assertions (capture device, edit history, any "AI-generated"/"AI-edited" action), and the validation result. (b) Now strip the metadata (re-save through a tool that discards it) and re-run c2patool — confirm the credential is gone and write the one sentence you would put in a report about its absence. (c) Why do you treat a Content Credential "with both hands," exactly as you treat EXIF?
35.19 ⭐ (Watermarking and its limits.) Compare three "prove-it-was-AI" approaches: invisible image watermarking (SynthID), statistical text watermarking for LLMs (the green-list/red-list token-biasing approach), and known-synthetic perceptual hashing of an identified fake. (a) State the one condition under which a generation-time watermark helps — and why an adversary's model defeats it trivially. (b) Name two transformations that degrade a watermark. (c) Explain why the field's center of gravity is shifting from "catch the fake" to "prove the real," and why provenance is "exactly the kind of problem forensics has always solved."
35.20 (Authenticate this — FRE 901.) A video is offered into evidence and the defense says it "could be a deepfake." Build the authentication convergence table the chapter models, with at least six rows: chain of custody, file hash, C2PA credential, container creation time, encoder fingerprint, detection-battery mean, and independent timeline. For each, write a plausible result and its weight/caveat, then write the overall finding in the chapter's careful register — including the sentence acknowledging you cannot prove a negative. Cite the chapters that own acquisition (14), container metadata (20), and timeline (21).
Group F — The double-edged sword in court
35.21 Define the liar's dividend (name the scholars who coined it) and explain why it requires no fake at all to do its damage. Summarize the 2023 matter in which a defense suggested recorded executive statements "might be deepfakes," and the court's response. Then state the answer to the liar's dividend — not a better detector, but a discipline — and name the rule of evidence at its heart. (answer in Appendix)
35.22 (Apply Daubert.) Take the five Daubert/FRE 702 factors (testability, known/potential error rate, peer review, standards, general acceptance) and apply each to a commercial black-box deepfake classifier. (a) Which factor is the sharpest problem and why? (b) Explain the explainability wall and why post-hoc tools (SHAP, LIME, saliency, Grad-CAM) "help but must not be oversold." (c) Why does silent vendor model-updating threaten reproducibility, and why is a result you cannot reproduce a result you cannot defend?
35.23 ⭐ (Judgment — the seductive summary.) A forensic suite's "AI insights" panel summarizes 10,000 chat messages into three fluent paragraphs, one of which asserts a fact you cannot immediately locate in the source. (a) Name the failure mode and the unbending rule that governs AI summaries, translations, and classifications. (b) Explain why a vivid, confident machine output is more dangerous than an obviously rough one — to a tired examiner and to a jury. (c) If your suite used a model to reach a conclusion, what three things must you be able to state about that model, or you "cannot defend the conclusion"?
35.24 (Bias as a reliability and a justice problem.) NIST's NISTIR 8280 (2019) documented false-positive rates that varied by orders of magnitude across demographic groups for many face-recognition algorithms. (a) Explain how a biased lead can bias an entire investigation, not just one image. (b) Give two non-image examples of bias in the triage stack (transcription, translation, or content ranking). (c) Why is "the model is 95% accurate" an incomplete and potentially misleading claim without naming the population and the distribution it was measured on?
Group G — Report, record, and the case file
35.25 (Build the manifest — reproducibility is admissibility.) Draft a reproducibility manifest for an AI-assisted examination, modeled on the chapter's: every tool with its version, every threshold, the validation set and measured error rate for any classifier, and a one-paragraph methods statement asserting that all AI outputs were human-verified and that findings cite artifacts, not scores. Then answer: opposing counsel asks you to replay your triage. Which elements of the manifest make that possible, and why is "I used an AI tool" neither reproducible nor admissible? (answer in Appendix)
35.26 (Chain of custody for a derivative item.) A classifier's flagged set, an ASR transcript, and a detection-battery report are all AI-derived outputs. Write the chain-of-custody / provenance note for one of them, capturing the hashed input it was produced from, the producing tool-and-version, the threshold used, when, by whom, and the hash of the output itself. Explain why a model output you cannot trace back to a hashed input, produced by a named, versioned tool, "is not admissible support — it is an unattributable assertion." Templates are in Appendix F.
35.27 (Progressive project — add the AI-assisted triage and authenticity layer.) Advance your Forensic Case File (running since Chapter 5, assembled at Chapter 38) by producing all five artifacts the chapter specifies, working only on hashed working copies: (1) the data-reduction counts (known-file filtering + near-dup collapse, before/after); (2) the enrichment outputs (classification, OCR, ASR/translation, NER/entity graph), each tagged as a lead for human verification; (3) the anomaly list from a z-score pass on your master timeline, each line linked to the artifact that will prove or refute it; (4) one authentication report for a contested media item, written as convergence-with-limits; (5) the reproducibility manifest. Save them to the case-file folder. In one sentence, explain why letting this chapter's machine-made leads enter the record unverified would undo the work of every prior chapter.
Self-check. You have mastered this chapter when you can, without notes: state the two faces of AI and the one sentence you repeat under oath ("a model outputs a probability, not a fact"); draw the five-stage pipeline and name the only stage where a finding is born; distinguish cryptographic, fuzzy, and perceptual hashing and say which survives recompression and which proves exact identity; run a triage enrichment pass and treat every classification, OCR string, transcript, translation, and entity edge as a lead to verify; run a visual and audio detection battery and explain — without flinching — that detectors generalize poorly to unseen generators, so each result is a corroborated lead and never proof; read a C2PA credential's presence, validity, and absence correctly; answer the liar's dividend with FRE 901 authentication rather than a detector's score; and articulate the Daubert error-rate, explainability, bias, and reproducibility problems well enough to document a model-and-version manifest that survives a Daubert challenge. If "the analysis is consistent with synthesis but does not establish it" still feels like a failure rather than the most honest finding available, re-read "Reliability, bias, and explainability" before you ever testify to a number you cannot explain. Next, Chapter 36 — The Forensic Toolkit surveys the instruments themselves — and weighs the AI features now embedded in every major suite against exactly the reliability standard you just set.