Inspiration
Certificate fraud occurs quietly and makes it difficult. There are colleges, NGOs, governmental organizations that deal with different documents — degree certificates, income certificates, domicile evidences, and confirmations of course completions. The review of documents relies primarily on taking a glance and seeing whether there is something wrong with the document in front of you. Even though some obvious counterfeiting and forgery may be detected during a manual review process, other types of alterations (such as a seal cloning, a slight alteration of the income figure, or other type(s) of changes) could go unnoticed. Prior to the creation of CertGuard AI, there was no possibility to give the reviewer some extra piece of information before the decision is made.
How we built
CertGuard has two parts:
The first one is a browser-based React component that processes all elements on the client side. The device is never required to send certificates offsite and uses pdf.js (loaded upon request) for PDF rendering, exif-js to retrieve EXIF metadata, the Web Crypto API for SHA-256 hashing, and Canvas 2D API for ELA, noise elements, and identical block analysis done in real-time during the process.
The second part of CertGuard is a Python/Flask backend version of the same system that has some additional features. These include OpenCV for the actual copy-move detection based on ORB keypoints clustering vectors that are identical for different copies, as well as PyMuPDF software to read PDFs and exif-js for obtaining EXIF data.
Challenges I ran into
The toughest part was not the code for the forensic checks. It was explaining clearly what the checks do not settle. It is easy to show one risk score and treat it like a final answer. But a tool that runs on a user device cannot verify that a certificate matches the real records held by the issuing authority. I had to build the interface and the wording around that boundary. So when you see a “Low Risk” label, it means “no tampering signs showed up in this run.” It does not mean “the document is authentic.”
Next, I had to make the browser app actually help, even without any server. Rendering multi page PDFs, pulling out metadata, and doing pixel level image checks often rely on a backend. I had to get pdf.js, exif-js, and the Canvas API to work fully in the browser, and still feel quick. That took a few rounds of changes until the flow stopped lagging.
What's next
- Calibrated accuracy testing. I want a labeled set of genuine and tampered certificates, then adjust the current hand picked limits using real precision and recall, not just gut feel
- RANSAC based geometric checks using the backend copy move matches to reduce false positives
- OCR checks that compare a certificate's stated fields to known formatting patterns for each certificate type
Log in or sign up for Devpost to join the conversation.