logo
Forensic check

HTPBE_DECLARED_SIZE_MISMATCH

HTPBE_DECLARED_SIZE_MISMATCH appears on 0.8% of modified results in our corpus. A marker is evidence about the file, not a judgement about the person who sent it.

Back to all checks
Marker profile

Structural Integrity

File layout altered after the file was finalised.

Share of modified results
0.8%
Frequency rank
#27
Among the 56 markers seen in modified results
Certain confidence
85.0%
Of results with this marker rated certain rather than high
Fires alone
1.3%
Results where it is the only marker found

Marker profile

What HTPBE_DECLARED_SIZE_MISMATCH tells you

HTPBE_DECLARED_SIZE_MISMATCH is one of the named findings returned in modification_markers when a PDF is reported as modified. It belongs to the Structural Integrity group of checks. These checks look at whether the internal layout of the file is consistent with the file having been left untouched since it was finalised.

On 1.3% of the modified results that carry HTPBE_DECLARED_SIZE_MISMATCH it is the only marker. A result with this marker carries 4.6 markers on average. It is most often found together with HTPBE_MULTIPLE_REVISION_LAYERS, on 86.3% of these results.

Example API response

How it appears in a result

When a PDF is reported as modified, HTPBE_DECLARED_SIZE_MISMATCH is listed in modification_markers next to the verdict and its confidence. Each marker is a named, actionable finding – not a score.

GET /api/v1/result/{id}
{
  "id": "9f3a2c1d-8b47-4e6f-a012-3d5e7f890123",
  "status": "modified",
  "modification_confidence": "high",
  "modification_markers": [
    "HTPBE_DECLARED_SIZE_MISMATCH"
  ],
  "creator": "Adobe Acrobat Pro DC",
  "has_incremental_updates": true,
  "page_count": 3
}

Full schema in the API reference →

Distributions

What ships alongside HTPBE_DECLARED_SIZE_MISMATCH

The tools, formats and document traits that appear on the modified results carrying this marker. Shares are of those results.

Common Producers

Adobe Acrobat writes 18.8% of these results – and 11.0% of all modified results naming it carry this marker.

Adobe Acrobat11.0% of its modified18.8%
Adobe PDF Library3.8% of its modified13.8%
PDFOUT5.2% of its modified8.8%
Skia/PDF3.1% of its modified5.0%
TargetStream StreamEDS7.1% of its modified5.0%
iText0.3% of its modified3.8%

Common Creators

Adobe Acrobat is the Creator on 17.5% of these results.

Adobe Acrobat10.7% of its modified17.5%
Acrobat PDFMaker18.9% of its modified12.5%
ADP5.7% of its modified10.0%
Bank of America6.0% of its modified5.0%
PDFium1.2% of its modified3.8%

Often found together with

HTPBE_MULTIPLE_REVISION_LAYERS sits next to HTPBE_DECLARED_SIZE_MISMATCH more often than any other marker.

Document origin

Institutional55.0%
Consumer software30.0%
Scanned5.0%
Unknown5.0%
Unverifiable3.8%

Creator → Producer pairs

Adobe Acrobat → Adobe Acrobat17.5%
Acrobat PDFMaker → Adobe PDF Library12.5%
ADP → PDFOUT8.8%
Bank of America → TargetStream StreamEDS5.0%

Detected origin software

Adobe Acrobat PDFMaker (Office)8.8%
Browser (Print to PDF)5.0%
macOS / iOS (Quartz)3.8%

Confidence of the verdict

Certain85.0%
High15.0%

When these results were checked

May 20268.8%
June 202610.0%
July 202618.8%
August 202611.3%
September 202611.3%
October 202638.8%
November 20261.3%

Document length

1 page51.2%
2–5 pages33.8%
6–20 pages15.0%

File size

Under 100 KB17.5%
100 KB – 1 MB73.8%
1 – 5 MB8.8%

PDF versions

PDF 1.662.5%
PDF 1.721.3%
PDF 1.415.0%

Year the document says it was created

20237.5%
20245.0%
20253.8%
202673.8%

Long tail

Notable observations

Smaller cuts of the results carrying HTPBE_DECLARED_SIZE_MISMATCH – useful context, but treat each row as a single data point rather than a strong signal.

Digitally signed
0%

Of files carry at least one digital signature

Saved revisions
86.3%

Of files contain earlier saved revisions

Embedded JavaScript
2.5%

Of files contain JavaScript code

Embedded files
1.3%

Of files have attachments inside

Avg pages per document
3.0
Markers per result
4.6

Average number of markers on these results

Related checks

Other Structural Integrity checks

Checks from the same group. Each card links to its own reference page.

HTPBE_NAVIGATION_TABLE_MISMATCHInternal file structure showing signs of tampering
Share of modified0.5%
HTPBE_TRAILING_BYTES_AFTER_EOFUnexplained data added to the file after it was finalised
Share of modified0.2%
HTPBE_PROPRIETARY_SIGNALAn additional integrity finding whose method is not disclosed
Share of modified0.7%
Seen together23.8%

FAQ

HTPBE_DECLARED_SIZE_MISMATCH: common questions

What does HTPBE_DECLARED_SIZE_MISMATCH mean?

HTPBE_DECLARED_SIZE_MISMATCH is a named finding in an HTPBE? result: file layout altered after the file was finalised. It is returned in the modification_markers list of a modified result and belongs to the Structural Integrity group of checks.

Does HTPBE_DECLARED_SIZE_MISMATCH mean the document is fake?

No. A marker is evidence about the file, not a judgement about the person who sent it. It records that the file shows this pattern; it does not say why, and it does not assess what the document states. Read it together with the verdict and any other markers on the same result.

What should I do when a result contains HTPBE_DECLARED_SIZE_MISMATCH?

Ask the sender for the original file straight from the issuing system, or request a fresh copy from the issuer. Check whether the document went through a later step such as re-saving, merging or converting, and verify it with the issuer before relying on it for a decision.

How common is HTPBE_DECLARED_SIZE_MISMATCH?

HTPBE_DECLARED_SIZE_MISMATCH appears on 0.8% of the modified results in the HTPBE? corpus. The corpus consists of PDFs people chose to submit for checking, so it skews towards documents someone had a reason to doubt and is not a sample of all PDFs.

Where do I see HTPBE_DECLARED_SIZE_MISMATCH?

In the modification_markers list of the result returned by the HTPBE? API, and on the result page of a modified document. Other checks in the Structural Integrity group are listed below on this page; all 63 checks are listed on the how-it-works page.

Secure your workflow

Create your account – check PDFs on the web or with an API key, both ready on signup.
No sales call. Cancel any time.

Start Free – Close the Structural Fraud GapSee Pricing
Read API Docs →