Identifying document generators by color footprints

1 . A computer-implemented method, comprising:

training, in a training phase, a document generator detector, wherein the training includes training the document generator detector to detect whether input documents are generated by any particular document generator of multiple different known document generators including known valid document generators and known fraudulent document generators, and wherein the training includes, for each given known document generator of the multiple different known document generators:

identifying a set of training documents that are each generated by the given known document generator and not by any other different document generators in the multiple different known document generators;

determining, for each respective training document generated by the given known document generator, a document footprint for the respective training document that includes a set of most frequently occurring color values in the respective training document; and

generating a document generator footprint for the given known document generator by determining, based on multiple document footprints of the set of training documents generated by the given known document generator, a set of common color values that occur in the multiple document footprints of the set of training documents generated by the given known document generator;

receiving, in an inference phase, after document generator footprints are generated for the multiple different known document generators during the training phase, a request to classify a first document;

generating a document footprint for the first document that includes a set of most frequently occurring color values in the first document;

determining a classification for the first document that indicates whether the first document was generated by a first known document generator of the multiple different known document generators based on comparing the document footprint for the first document to the document generator footprint for the first known document generator;

in response to determining that the classification for the first document indicates that the first document was generated by the first known document generator:

providing an audit alert in response to the request, in response to determining that the first known document generator is a known fraudulent generator; and

providing an audit pass indication, in response to the request, in response to determining that the first known document generator is a known valid document generator; and

in response to determining that the classification for the first document indicates that the first document was not generated by the first known document generator:

identifying a next known document generator from the multiple different known document generators; and

generating a next classification for the first document that indicates whether the first document was generated by the next known document generator.

2 . The computer-implemented method of claim 1 , wherein color values are RGB (red, green, blue) color values.

3 . The computer-implemented method of claim 2 , wherein color values include RGB color values and a fourth alpha value that represents transparency.

4 . The computer-implemented method of claim 1 , wherein color values are grayscale values.

5 . The computer-implemented method of claim 1 , wherein the set of training documents and the first document are images.

6 . The computer-implemented method of claim 5 , wherein the training documents and the first document are receipt images.

7 . The computer-implemented method of claim 5 , wherein the color values are color values of image pixels.

8 . The computer-implemented method of claim 1 , wherein comparing the document footprint for the first document to the document generator footprint for the first known document generator includes determining whether each color value in the document generator footprint for the first known document generator is included in the document footprint for the first document.

9 . The computer-implemented method of claim 1 , wherein the set of common color values that occur in the set of training documents includes a predetermined number of most common color values that occur in the set of training documents.

10 . The computer-implemented method of claim 1 , wherein determining the document footprint for the respective training document comprises:

generating, for the respective training document, a histogram of frequency counts of color values included in the respective training document;

sorting, for the respective training document, the histogram of frequency counts of color values included in the respective training document by color value frequency count; and

determining the set of most frequently occurring color values in the respective training document based on a sorted histogram for the respective training document.

11 . The computer-implemented method of claim 1 , wherein generating the document generator footprint for the first known document generator comprises determining, as the set of common color values, a set of color values that are included in each document footprint of the set of training documents.

12 . A system comprising:

one or more computers; and

a computer-readable medium coupled to the one or more computers having instructions stored thereon which, when executed by the one or more computers, cause the one or more computers to perform operations comprising:

training, in a training phase, a document generator detector, wherein the training includes training the document generator detector to detect whether input documents are generated by any particular document generator of multiple different known document generators including known valid document generators and known fraudulent document generators, and wherein the training includes, for each given known document generator of the multiple different known document generators:

identifying a set of training documents that are each generated by the given known document generator and not by any other different document generators in the multiple different known document generators;

determining, for each respective training document generated by the given known document generator, a document footprint for the respective training document that includes a set of most frequently occurring color values in the respective training document; and

generating a document generator footprint for the given known document generator by determining, based on multiple document footprints of the set of training documents generated by the given known document generator, a set of common color values that occur in the multiple document footprints of the set of training documents generated by the given known document generator;

receiving, in an inference phase, after document generator footprints are generated for the multiple different known document generators during the training phase, a request to classify a first document;

generating a document footprint for the first document that includes a set of most frequently occurring color values in the first document;

determining a classification for the first document that indicates whether the first document was generated by a first known document generator of the multiple different known document generators based on comparing the document footprint for the first document to the document generator footprint for the first known document generator;

in response to determining that the classification for the first document indicates that the first document was generated by the first known document generator:

providing an audit alert, in response to the request, in response to determining that the first known document generator is a known fraudulent generator; and

providing an audit pass indication, in response to the request, in response to determining that the first known document generator is a known valid document generator; and

in response to determining that the classification for the first document indicates that the first document was not generated by the first known document generator:

identifying a next known document generator from the multiple different known document generators; and

generating a next classification for the first document that indicates whether the first document was generated by the next known document generator.

13 . The system of claim 12 , wherein comparing the document footprint for the first document to the document generator footprint for the first known document generator includes determining whether each color value in the document generator footprint for the first known document generator is included in the document footprint for the first document.

14 . The system of claim 12 , wherein the set of common color values that occur in the set of training documents includes a predetermined number of most common color values that occur in the set of training documents.

15 . The system of claim 12 , wherein determining the document footprint for the respective training document comprises:

generating, for the respective training document, a histogram of frequency counts of color values included in the respective training document;

sorting, for the respective training document, the histogram of frequency counts of color values included in the respective training document by color value frequency count; and

determining the set of most frequently occurring color values in the respective training document based on a sorted histogram for the respective training document.

16 . A computer program product encoded on a non-transitory storage medium, the product comprising non-transitory, computer readable instructions for causing one or more processors to perform operations comprising:

training, in a training phase, a document generator detector, wherein the training includes training the document generator detector to detect whether input documents are generated by any particular document generator of multiple different known document generators including known valid document generators and known fraudulent document generators, and wherein the training includes, for each given known document generator of the multiple different known document generators:

identifying a set of training documents that are each generated by the given known document generator and not by any other different document generators in the multiple different known document generators;

determining, for each respective training document generated by the given known document generator, a document footprint for the respective training document that includes a set of most frequently occurring color values in the respective training document; and

generating a document generator footprint for the given known document generator by determining, based on multiple document footprints of the set of training documents generated by the given known document generator, a set of common color values that occur in the multiple document footprints of the set of training documents generated by the given known document generator;

receiving, in an inference phase, after document generator footprints are generated for the multiple different known document generators during the training phase, a request to classify a first document;

generating a document footprint for the first document that includes a set of most frequently occurring color values in the first document;

determining a classification for the first document that indicates whether the first document was generated by a first known document generator of the multiple different known document generators based on comparing the document footprint for the first document to the document generator footprint for the first known document generator;

in response to determining that the classification for the first document indicates that the first document was generated by the first known document generator:

providing an audit alert, in response to the request, in response to determining that the first known document generator is a known fraudulent generator; and

providing an audit pass indication, in response to the request, in response to determining that the first known document generator is a known valid document generator; and

in response to determining that the classification for the first document indicates that the first document was not generated by the first known document generator:

identifying a next known document generator from the multiple different known document generators; and

generating a next classification for the first document that indicates whether the first document was generated by the next known document generator.

17 . The computer program product of claim 16 , wherein comparing the document footprint for the first document to the document generator footprint for the first known document generator includes determining whether each color value in the document generator footprint for the first known document generator is included in the document footprint for the first document.

18 . The computer program product of claim 16 , wherein the set of common color values that occur in the set of training documents includes a predetermined number of most common color values that occur in the set of training documents.

19 . The computer program product of claim 16 , wherein determining the document footprint for the respective training document comprises:

generating, for the respective training document, a histogram of frequency counts of color values included in the respective training document;

sorting, for the respective training document, the histogram of frequency counts of color values included in the respective training document by color value frequency count; and

determining the set of most frequently occurring color values in the respective training document based on a sorted histogram for the respective training document.

20 . The computer-implemented method of claim 1 , wherein the first known document generator comprises a known fraudulent document generator of a known fraudulent entity known to generate fraudulent documents.

21 . The computer-implemented method of claim 1 , wherein the first known document generator comprises a known valid document generator of a known valid entity known to generate valid documents.