A signature field's /V dictionary holds /SubFilter (adbe.pkcs7.detached or ETSI.CAdES.detached), /ByteRange (two byte spans around the /Contents hex string) and /Contents (the CMS signature). Later changes are added as incremental updates, so a signed PDF can legitimately grow; a document timestamp (ETSI.RFC3161) or DSS dictionary may be appended for long-term validation.
Viewers must check that the byte ranges cover the whole file up to the signature and that later incremental updates only make permitted changes. Academic research from Ruhr University Bochum (2019 and 2021: incremental saving, signature wrapping and shadow attacks) showed many viewers accepting manipulated documents. The PDF signature verifier reports byte-range coverage and post-signing changes.