An Interpretable Hybrid Expert System for PNG Encoder Attribution in Digital Forensics

PNG encoder attribution supports authenticity review and inspectable forensic decision support when metadata is incomplete. Messaging and online social networks (OSNs) dominate image sharing; relay operations—metadata stripping, container rewrites, and platform re-encoding—disrupt encoder traces in PNG byte streams. Classical encoder fingerprints target static coder statistics, yet paired QQ/WeChat relay drift on the encoder axis remains unmeasured; pixel AIGC detectors screen generative content without attributing the write path once ancillary chunks are removed.We propose a three-layer hybrid expert system on parser-grounded 𝝓(𝐛): a knowledge layer (deterministic parsing and versioned routing predicates); an inference layer (Random Forest with MDI traceability, isotonic calibration, and open-set screening); and a disposition layer (accept, defer, or escalate from template firings and calibrated score bands). Platform-aware robust forensics (PARF), our paired-SNS protocol, quantifies encoder-axis drift after controlled QQ/WeChat relays on the same FS2AI capsule.On the public From Screenshot to AI-Generated (FS2AI) dataset, closed-set Top-1 is 97.50% on the canonical seed-42 fold under mild custody, while PARF encoder-axis Top-1 falls to 31.33% (QQ) and 25.23% (WeChat) after paired relays—recording relay-induced collapse, not first-save survival. Screenshot-to-AI transfer is fragile zero-shot but recovers in the published few-shot harness; encoder and content-axis detectors remain parallel audit streams, not a fused module.