logo
Forensic check

HTPBE_IDENTITY_LAYERS_DISAGREE

HTPBE_IDENTITY_LAYERS_DISAGREE appears on 2.9% of modified results in our corpus. A marker is evidence about the file, not a judgement about the person who sent it.

Back to all checks
Marker profile

Metadata & Timestamps

Document properties indicating later alteration.

Share of modified results
2.9%
Frequency rank
#12
Among the 56 markers seen in modified results
Certain confidence
8.8%
Of results with this marker rated certain rather than high
Fires alone
45.3%
Results where it is the only marker found

Marker profile

What HTPBE_IDENTITY_LAYERS_DISAGREE tells you

HTPBE_IDENTITY_LAYERS_DISAGREE is one of the named findings returned in modification_markers when a PDF is reported as modified. It belongs to the Metadata & Timestamps group of checks. These checks compare the dates and descriptive properties recorded in a file with each other and with a plausible production history.

On 45.3% of the modified results that carry HTPBE_IDENTITY_LAYERS_DISAGREE it is the only marker. A result with this marker carries 1.8 markers on average. It is most often found together with HTPBE_TIMESTAMP_LAYERS_DISAGREE, on 45.9% of these results.

Example API response

How it appears in a result

When a PDF is reported as modified, HTPBE_IDENTITY_LAYERS_DISAGREE is listed in modification_markers next to the verdict and its confidence. Each marker is a named, actionable finding – not a score.

GET /api/v1/result/{id}
{
  "id": "9f3a2c1d-8b47-4e6f-a012-3d5e7f890123",
  "status": "modified",
  "modification_confidence": "high",
  "modification_markers": [
    "HTPBE_IDENTITY_LAYERS_DISAGREE"
  ],
  "creator": "Adobe Acrobat Pro DC",
  "has_incremental_updates": true,
  "page_count": 3
}

Full schema in the API reference →

Distributions

What ships alongside HTPBE_IDENTITY_LAYERS_DISAGREE

The tools, formats and document traits that appear on the modified results carrying this marker. Shares are of those results.

Common Producers

PD4ML writes 40.4% of these results – and 93.2% of all modified results naming it carry this marker.

PD4ML93.2% of its modified40.4%
mPDF93.5% of its modified37.5%
SAP NetWeaver 75051.9% of its modified4.6%
iText0.7% of its modified2.3%
Skia/PDF5.3% of its modified2.3%
PDFlib7.8% of its modified1.3%
TCPDF2.7% of its modified1.3%
pdf-lib4.3% of its modified1.0%

Common Creators

PD4ML is the Creator on 40.4% of these results.

PD4ML93.2% of its modified40.4%
Adobe Illustrator32.2% of its modified37.5%
Form X_65_80 EN52.2% of its modified3.9%
OpenText Exstream23.1% of its modified2.0%
Microsoft Word0.5% of its modified1.6%
Joomla3.1% of its modified1.3%
Canva5.0% of its modified1.0%

Often found together with

HTPBE_TIMESTAMP_LAYERS_DISAGREE sits next to HTPBE_IDENTITY_LAYERS_DISAGREE more often than any other marker.

Document origin

Institutional54.7%
Consumer software44.0%

Creator → Producer pairs

PD4ML → PD4ML40.4%
Adobe Illustrator → mPDF37.1%
Form X_65_80 EN → SAP NetWeaver 7503.9%
Joomla → TCPDF1.3%
E-statement Batch Generator (PT. Bank Central Asia, Tbk) → iText1.0%

Detected origin software

Adobe Illustrator37.1%
Microsoft Word1.6%
Google Workspace1.3%
Browser (Print to PDF)1.0%

Confidence of the verdict

Certain8.8%
High91.2%

When these results were checked

April 202681.4%
May 20265.2%
June 20260.7%
July 20263.3%
August 20261.0%
September 20265.5%
October 20262.9%

Document length

1 page11.4%
2–5 pages43.6%
6–20 pages45.0%

File size

Under 100 KB88.6%
100 KB – 1 MB8.8%
1 – 5 MB2.6%

PDF versions

PDF 1.643.6%
PDF 1.441.7%
PDF 1.712.4%
PDF 1.51.3%
PDF 1.31.0%

Year the document says it was created

202438.8%
20251.3%
202658.3%

Long tail

Notable observations

Smaller cuts of the results carrying HTPBE_IDENTITY_LAYERS_DISAGREE – useful context, but treat each row as a single data point rather than a strong signal.

Digitally signed
1.6%

Of files carry at least one digital signature

Saved revisions
4.6%

Of files contain earlier saved revisions

Embedded JavaScript
0%

Of files contain JavaScript code

Embedded files
0.3%

Of files have attachments inside

Avg pages per document
6.0
Markers per result
1.8

Average number of markers on these results

Related checks

Other Metadata & Timestamps checks

Checks from the same group. Each card links to its own reference page.

HTPBE_DATES_DISAGREERecorded dates showing the document was changed after creation
Share of modified42.0%
Seen together5.5%
HTPBE_TIMESTAMP_LAYERS_DISAGREEInternal timestamp anomalies indicating a later change
Share of modified8.8%
Seen together45.9%
HTPBE_IMPOSSIBLE_TIMESTAMPTimestamp values that are physically impossible
Share of modified1.5%
HTPBE_INVALID_TIMEZONEDate information that is malformed
Share of modified0.1%
HTPBE_ANNOTATION_PREDATES_CREATIONAnnotation dates that do not fit the document’s timeline
Share of modified0.8%
HTPBE_UNLOCK_TOOL_RESIDUESigns that a document-unlocking or editing tool processed this file
Share of modified<0.1%
HTPBE_XMP_DATES_DESYNCEDMetadata timing indicating a later change
Share of modified0.5%
HTPBE_TIMEZONE_LAYERS_DISAGREETime-zone evidence of a later change
Share of modified<0.1%

FAQ

HTPBE_IDENTITY_LAYERS_DISAGREE: common questions

What does HTPBE_IDENTITY_LAYERS_DISAGREE mean?

HTPBE_IDENTITY_LAYERS_DISAGREE is a named finding in an HTPBE? result: document properties indicating later alteration. It is returned in the modification_markers list of a modified result and belongs to the Metadata & Timestamps group of checks.

Does HTPBE_IDENTITY_LAYERS_DISAGREE mean the document is fake?

No. A marker is evidence about the file, not a judgement about the person who sent it. It records that the file shows this pattern; it does not say why, and it does not assess what the document states. Read it together with the verdict and any other markers on the same result.

What should I do when a result contains HTPBE_IDENTITY_LAYERS_DISAGREE?

Ask the sender for the original file straight from the issuing system, or request a fresh copy from the issuer. Check whether the document went through a later step such as re-saving, merging or converting, and verify it with the issuer before relying on it for a decision.

How common is HTPBE_IDENTITY_LAYERS_DISAGREE?

HTPBE_IDENTITY_LAYERS_DISAGREE appears on 2.9% of the modified results in the HTPBE? corpus. The corpus consists of PDFs people chose to submit for checking, so it skews towards documents someone had a reason to doubt and is not a sample of all PDFs.

Where do I see HTPBE_IDENTITY_LAYERS_DISAGREE?

In the modification_markers list of the result returned by the HTPBE? API, and on the result page of a modified document. Other checks in the Metadata & Timestamps group are listed below on this page; all 63 checks are listed on the how-it-works page.

Secure your workflow

Create your account – check PDFs on the web or with an API key, both ready on signup.
No sales call. Cancel any time.

Start Free – Close the Structural Fraud GapSee Pricing
Read API Docs →