Forensic check

HTPBE_TOOL_VS_STRUCTURE_MISMATCH

Q: What does HTPBE_TOOL_VS_STRUCTURE_MISMATCH mean?

HTPBE_TOOL_VS_STRUCTURE_MISMATCH is a named finding in an HTPBE result: structural evidence that contradicts the file’s stated origin. It is returned in the modification_markers list of a modified result and belongs to the Generator Fingerprinting group of checks.

Q: Does HTPBE_TOOL_VS_STRUCTURE_MISMATCH mean the document is fake?

No. A marker is evidence about the file, not a judgement about the person who sent it. It records that the file shows this pattern; it does not say why, and it does not assess what the document states. Read it together with the verdict and any other markers on the same result.

Q: What should I do when a result contains HTPBE_TOOL_VS_STRUCTURE_MISMATCH?

Ask the sender for the original file straight from the issuing system, or request a fresh copy from the issuer. Check whether the document went through a later step such as re-saving, merging or converting, and verify it with the issuer before relying on it for a decision.

Q: How common is HTPBE_TOOL_VS_STRUCTURE_MISMATCH?

HTPBE_TOOL_VS_STRUCTURE_MISMATCH appears on 14.8% of the modified results in the HTPBE corpus. The corpus consists of PDFs people chose to submit for checking, so it skews towards documents someone had a reason to doubt and is not a sample of all PDFs.

Q: Where do I see HTPBE_TOOL_VS_STRUCTURE_MISMATCH?

In the modification_markers list of the result returned by the HTPBE API, and on the result page of a modified document. Other checks in the Generator Fingerprinting group are listed below on this page; all 63 checks are listed on the how-it-works page.

HTPBE_TOOL_VS_STRUCTURE_MISMATCH appears on 14.8% of modified results in our corpus. A marker is evidence about the file, not a judgement about the person who sent it.

Back to all checks

Marker profile

Generator Fingerprinting

Structural evidence that contradicts the file’s stated origin.

Share of modified results

14.8%

Frequency rank

Among the 56 markers seen in modified results

Certain confidence

63.6%

Of results with this marker rated certain rather than high

Fires alone

19.7%

Results where it is the only marker found

Marker profile

What HTPBE_TOOL_VS_STRUCTURE_MISMATCH tells you

HTPBE_TOOL_VS_STRUCTURE_MISMATCH is one of the named findings returned in modification_markers when a PDF is reported as modified. It belongs to the Generator Fingerprinting group of checks. These checks compare the software a file claims to come from with what the file itself shows about how it was produced.

On 19.7% of the modified results that carry HTPBE_TOOL_VS_STRUCTURE_MISMATCH it is the only marker. A result with this marker carries 2.5 markers on average. It is most often found together with HTPBE_DATES_DISAGREE, on 52.9% of these results.

Example API response

How it appears in a result

When a PDF is reported as modified, HTPBE_TOOL_VS_STRUCTURE_MISMATCH is listed in modification_markers next to the verdict and its confidence. Each marker is a named, actionable finding – not a score.

GET /api/v1/result/{id}

{
  "id": "9f3a2c1d-8b47-4e6f-a012-3d5e7f890123",
  "status": "modified",
  "modification_confidence": "high",
  "modification_markers": [
    "HTPBE_TOOL_VS_STRUCTURE_MISMATCH"
  ],
  "creator": "Adobe Acrobat Pro DC",
  "has_incremental_updates": true,
  "page_count": 3
}

Full schema in the API reference →

Distributions

What ships alongside HTPBE_TOOL_VS_STRUCTURE_MISMATCH

The tools, formats and document traits that appear on the modified results carrying this marker. Shares are of those results.

Common Producers

iText writes 40.3% of these results – and 64.9% of all modified results naming it carry this marker.

iText64.9% of its modified40.3%

ActiveReports41.3% of its modified5.7%

iOS Print to PDF26.0% of its modified5.1%

TCPDF52.7% of its modified5.1%

Apache FOP57.5% of its modified4.5%

PDFium29.8% of its modified4.3%

Scrive AB72.7% of its modified4.2%

Scanner Samsung100.0% of its modified4.1%

Common Creators

Altiuz Reports is the Creator on 12.2% of these results.

Altiuz Reports51.9% of its modified12.2%

Aspose37.4% of its modified6.0%

ActiveReports26.0% of its modified5.7%

Apache FOP54.3% of its modified4.5%

PDFium27.8% of its modified4.4%

Joomla50.4% of its modified4.2%

PDF Driver72.7% of its modified4.2%

Scanner Samsung100.0% of its modified4.1%

Often found together with

HTPBE_DATES_DISAGREE sits next to HTPBE_TOOL_VS_STRUCTURE_MISMATCH more often than any other marker.

HTPBE_DATES_DISAGREE52.9%

HTPBE_TIMESTAMP_LAYERS_DISAGREE23.0%

HTPBE_MULTIPLE_REVISION_LAYERS16.7%

HTPBE_DESIGN_TEMPLATE_ASSEMBLY11.6%

HTPBE_METADATA_ONLY_REVISION9.1%

HTPBE_CONTENT_STREAM_EDITING_MARKERS8.2%

HTPBE_POST_SIGNATURE_EDIT4.5%

HTPBE_MIXED_PAGE_DIMENSIONS4.3%

Document origin

Institutional71.3%

Consumer software20.9%

Unknown4.0%

Scanned2.3%

Online editor1.2%

Analysis incomplete0.2%

Creator → Producer pairs

Altiuz Reports → iText12.2%

Aspose → iText5.8%

ActiveReports → ActiveReports5.7%

Apache FOP → Apache FOP4.4%

PDFium → PDFium4.3%

Joomla → TCPDF4.2%

PDF Driver → Scrive AB4.2%

Scanner Samsung → Scanner Samsung4.1%

Detected origin software

Browser (Print to PDF)9.5%

macOS / iOS (Quartz)5.4%

Microsoft Print to PDF2.3%

Microsoft Word0.7%

WPS Office0.7%

Adobe Photoshop0.6%

HTML-to-PDF engine0.5%

iLovePDF0.5%

Confidence of the verdict

Certain63.6%

High36.4%

When these results were checked

April 202666.2%

May 20264.6%

June 20262.5%

July 20265.4%

August 20265.9%

September 20265.8%

October 20267.0%

November 20262.5%

Document length

1 page52.3%

2–5 pages36.1%

6–20 pages4.9%

21–100 pages6.6%

File size

Under 100 KB42.9%

100 KB – 1 MB49.2%

1 – 5 MB7.8%

Over 5 MB0.2%

PDF versions

PDF 1.736.8%

PDF 1.421.9%

PDF 1.520.1%

PDF 1.316.3%

PDF 1.64.5%

PDF 2.00.2%

Year the document says it was created

20210.6%

20225.6%

20231.4%

20241.6%

20258.0%

202674.0%

Long tail

Notable observations

Smaller cuts of the results carrying HTPBE_TOOL_VS_STRUCTURE_MISMATCH – useful context, but treat each row as a single data point rather than a strong signal.

Digitally signed

9.4%

Of files carry at least one digital signature

Saved revisions

17.6%

Of files contain earlier saved revisions

Embedded JavaScript

0.4%

Of files contain JavaScript code

Embedded files

4.5%

Of files have attachments inside

Avg pages per document

4.0

Markers per result

2.5

Average number of markers on these results

Related checks

Other Generator Fingerprinting checks

Checks from the same group. Each card links to its own reference page.

HTPBE_FONT_VS_TOOL_MISMATCHFont handling that points to a different producer

Share of modified0.1%

HTPBE_RESIDUAL_PRIOR_GENERATOREvidence of an earlier production history behind the current file

Share of modified0.4%

HTPBE_EDITING_TOOL_FINGERPRINTFingerprints of PDF editing software

Share of modified5.2%

HTPBE_DOCUMENT_RESTAMPED_AFTER_CREATIONDocument re-saved by another tool after its original creation

Share of modified0.1%

HTPBE_ONLINE_EDITOR_ORIGINSigns of processing by an online PDF editing or conversion service

Share of modified2.2%

HTPBE_SELECTIVE_IDENTITY_EDITOrigin information partly removed or edited

Share of modified0.3%

HTPBE_IDENTITY_OVERWRITTENOrigin information replaced with that of different software

Share of modified0.1%

HTPBE_UNKNOWN_IDENTITY_CLAIMMetadata showing signs of having been rewritten

Share of modified1.5%

HTPBE_SCRIPTING_ON_REEMITTEDActive scripting added to the document after its original creation

Share of modified<0.1%

HTPBE_LAYERED_IDENTITY_DISAGREEMENTClaims about the producing software that do not hold up

Share of modified0.5%

HTPBE_IMPOSSIBLE_TOOL_PIPELINEAn implausible chain of production software HTPBE_IDENTITY_BLANKEDIdentifying details stripped from the document after production

Share of modified14.5%

HTPBE_DESIGN_TEMPLATE_ASSEMBLYPage content composed from separately produced parts

Share of modified16.5%

Seen together11.6%

HTPBE_ALTERED_TYPEFACE_IDENTITYA font whose identity appears altered HTPBE_TOOLCHAIN_DEFAULT_METADATA_RESIDUETraces of other software in the document’s production HTPBE_PRINT_PIPELINE_TAMPERINGSigns of alteration in a document that was re-printed to PDF HTPBE_FONT_LAYER_INCONSISTENT_WITH_ISSUERTypography indicating the document was not produced by its stated issuer

Share of modified0.1%

HTPBE_PRODUCER_IDENTITY_FORGEDFabricated origin details that misstate how the document was produced

Share of modified0.1%

FAQ

HTPBE_TOOL_VS_STRUCTURE_MISMATCH: common questions

What does HTPBE_TOOL_VS_STRUCTURE_MISMATCH mean?

HTPBE_TOOL_VS_STRUCTURE_MISMATCH is a named finding in an HTPBE? result: structural evidence that contradicts the file’s stated origin. It is returned in the modification_markers list of a modified result and belongs to the Generator Fingerprinting group of checks.

Does HTPBE_TOOL_VS_STRUCTURE_MISMATCH mean the document is fake?

No. A marker is evidence about the file, not a judgement about the person who sent it. It records that the file shows this pattern; it does not say why, and it does not assess what the document states. Read it together with the verdict and any other markers on the same result.

What should I do when a result contains HTPBE_TOOL_VS_STRUCTURE_MISMATCH?

Ask the sender for the original file straight from the issuing system, or request a fresh copy from the issuer. Check whether the document went through a later step such as re-saving, merging or converting, and verify it with the issuer before relying on it for a decision.

How common is HTPBE_TOOL_VS_STRUCTURE_MISMATCH?

HTPBE_TOOL_VS_STRUCTURE_MISMATCH appears on 14.8% of the modified results in the HTPBE? corpus. The corpus consists of PDFs people chose to submit for checking, so it skews towards documents someone had a reason to doubt and is not a sample of all PDFs.

Where do I see HTPBE_TOOL_VS_STRUCTURE_MISMATCH?

In the modification_markers list of the result returned by the HTPBE? API, and on the result page of a modified document. Other checks in the Generator Fingerprinting group are listed below on this page; all 63 checks are listed on the how-it-works page.

Secure your workflow

Create your account – check PDFs on the web or with an API key, both ready on signup.
No sales call. Cancel any time.

Start Free – Close the Structural Fraud Gap See Pricing

Read API Docs →