Forensic Detectors Research Articles

Reliable Out-of-Distribution Recognition of Synthetic Images.

Generative adversarial networks (GANs) and diffusion models (DMs) have revolutionized the creation of synthetically generated but realistic-looking images. Distinguishing such generated images from real camera captures is one of the key tasks in current multimedia forensics research. One particular challenge is the generalization to unseen generators or post-processing. This can be viewed as an issue of handling out-of-distribution inputs. Forensic detectors can be hardened by the extensive augmentation of the training data or specifically tailored networks. Nevertheless, such precautions only manage but do not remove the risk of prediction failures on inputs that look reasonable to an analyst but in fact are out of the training distribution of the network. With this work, we aim to close this gap with a Bayesian Neural Network (BNN) that provides an additional uncertainty measure to warn an analyst of difficult decisions. More specifically, the BNN learns the task at hand and also detects potential confusion between post-processing and image generator artifacts. Our experiments show that the BNN achieves on-par performance with the state-of-the-art detectors while producing more reliable predictions on out-of-distribution examples.

CSC-Net: Cross-Color Spatial Co-Occurrence Matrix Network for Detecting Synthesized Fake Images

Recently, the Generative Adversarial Networks (GAN) generated images have been spread over the social networks, which brings the new challenge in the the community of media forensics. Although some reliable forensic tools have advanced the study of detecting GAN generated images, while the detection accuracy cannot be guaranteed when facing the malicious post-processing attacks, especially in the practical social network scenario. Thus, in this context, we propose a novel well-designed deep neural network equipped with handed-crafted features for dealing with this problem. In particular, relying on the Cross-color Spatial Co-occurrence Matrix (CSCM), the discriminative features are extracted after carefully analyzing and selecting the most effective color channels. Next, the fused features are fed into the deep neutral network for training a high-efficient forensic detector. Extensive experimental results empirically verify that in most detection scenarios, our proposed detector performs superiorly to the prior arts, especially in the case of post-processing attacks. Moreover, we also highlight the relevance of the proposed detector over the realistic social network platforms, and its generalization capability in three different scenarios.

Black-box attack against GAN-generated image detector with contrastive perturbation

The emergence of visually realistic GAN-generated facial images has raised concerns regarding potential misuse. In response, effective forensic algorithms have been developed to detect such synthetic images in recent years. However, the vulnerability of such forensic detectors to adversarial attacks remains an important issue that requires further investigation. In this paper, we propose a new black-box attack method against GAN-generated image detectors. It involves contrastive learning strategy to train an encoder–decoder anti-forensic network with a contrastive loss function. GAN-generated and corresponding simulated real images are constructed as positive and negative samples, respectively. By leveraging the trained attack model, we can apply imperceptible perturbation to input synthetic images for removing GAN fingerprint to some extent. GAN-generated image detectors may be deceived consequently. Extensive experimental results demonstrate that the proposed attack effectively reduces the accuracy of three state-of-the-art detectors on six popular GANs, while also achieving high visual quality of the attacked images. The source code will be available at https://github.com/ZXMMD/BAttGAND.

A Local Perturbation Generation Method for GAN-Generated Face Anti-Forensics

Although the current generative adversarial networks (GAN)-generated face forensic detectors based on deep neural networks (DNNs) have achieved considerable performance, they are vulnerable to adversarial attacks. In this paper, an effective local perturbation generation method is proposed to expose the vulnerability of state-of-the-art forensic detectors. The main idea is to mine the fake faces’ areas of common concern in multiple-detectors’ decision-making, then generate local anti-forensic perturbations by GANs in these areas to enhance the visual quality and transferability of anti-forensic faces. Meanwhile, in order to improve the anti-forensic effect, a double- mask (soft mask and hard mask) strategy and a three-part loss (the GAN training loss, the adversarial loss consisting of ensemble classification loss and ensemble feature loss, and the regularization loss) are designed for the training of the generator. Experiments conducted on fake faces generated by StyleGAN demonstrate the proposed method’s advantage over the state-of-the-art methods in terms of anti-forensic success rate, imperceptibility, and transferability. The source code is available at <uri xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">https://github.com/imagecbj/A-Local-Perturbation-Generation-Method-for-GAN-generated-Face-Anti-forensics</uri> .

TIMIT-TTS: A Text-to-Speech Dataset for Multimodal Synthetic Media Detection

With the rapid development of deep learning techniques, the generation and counterfeiting of multimedia material has become increasingly simple. Current technology enables the creation of videos where both the visual and audio contents are falsified. While the multimedia forensics community has begun to address this threat by developing fake media detectors. However, the vast majority existing forensic techniques only analyze one modality at a time. This is an important limitation when authenticating manipulated videos, because sophisticated forgeries may be difficult to detect without exploiting cross-modal inconsistencies (e.g., across the audio and visual tracks). One important reason for the lack of multimodal detectors is a similar lack of research datasets containing multimodal forgeries. Existing datasets typically contain only one falsified modality, such as deepfaked videos with authentic audio tracks, or synthetic audio with no associated video. Currently, datasets are needed that can be used to develop, train, and test these forensic algorithms. In this paper, we propose a new audio-visual deepfake dataset containing multimodal video forgeries. We present a general pipeline for synthesizing deepfake speech content from a given video, facilitating the creation of counterfeit multimodal material. The proposed method uses Text-to-Speech (TTS) and Dynamic Time Warping (DTW) techniques to achieve realistic speech tracks. We use this pipeline to generate and release TIMIT-TTS, a synthetic speech dataset containing the most cutting-edge methods in the TTS field. This can be used as a standalone audio dataset, or combined with DeepfakeTIMIT and VidTIMIT video datasets to perform multimodal research. Finally, we present numerous experiments to benchmark the proposed dataset in both monomodal (i.e., audio) and multimodal (i.e., audio and video) conditions. This highlights the need for multimodal forensic detectors and more multimodal deepfake data.

On the Security of the One-and-a-Half-Class Classifier for SPAM Feature-Based Image Forensics

Combining multiple classifiers is a promising approach to hardening forensic detectors against adversarial evasion attacks. The key idea is that an attacker must fool all individual classifiers to evade detection. The 1.5C classifier is one of these multiple-classifier detectors that is attack-agnostic, and thus even increases the difficulty for an omniscient attacker. Recent work evaluated the 1.5C classifier with SPAM features for image manipulation detection. Despite showing promising results, their security analysis leaves several aspects unresolved. Surprisingly, the results reveal that fooling only one component is often sufficient to evade detection. Additionally, the authors evaluate classifier robustness with only a black-box attack because, currently, there is no white-box attack against SPAM feature-based classifiers. This paper addresses these shortcomings and complements the previous security analysis. First, we develop a novel white-box attack against SPAM feature-based detectors. The proposed attack produces adversarial images with lower distortion than the previous attack. Second, by analyzing the 1.5C classifier’s acceptance region, we identify three pitfalls that explain why the current 1.5C classifier is less robust than a binary classifier in some settings. Third, we illustrate how to mitigate these pitfalls with a simple axis-aligned split classifier. Our experimental evaluation demonstrates the increased robustness of the proposed detector for SPAM feature-based image manipulation detection.

Image splicing forgery detection using simplified generalized noise model

To deal with the problem of image forgery detection, many forensic tools have been proposed. Most existing tools perform efficiently in a supervised scenario with a large training set while their statistical performances cannot be analytically established. Also, limited research proposes statistical model-based detectors for image forensics, especially for image splicing forgery detection. Therefore, in this paper, we propose a training-free forensic detector with analytically statistical performance for splicing forgery detection. The detector is designed based on a simplified noise model of JPEG image which assumes the variance of pixels as a quadratic function of the expectation of pixels. The proposed simplified noise model is characterized by two parameters which can serve as camera fingerprints for image forgery detection. By employing the framework of hypothesis testing theory, a training-free Generalized Likelihood Ratio Test (GLRT) is designed, which ensures the high detection performance for a prescribed false alarm rate. Besides, detection threshold can be configured in the fashion independent of image content. Numerical results validate the accuracy of the simplified noise model and the effectiveness of the proposed detector.

Enhancing PRNU-based image forensics with a non-parametric correlation predictor based on locally weighted regression

For PRNU-based image manipulation localization, the cor- relation predictor plays a crucial role to reduce false positives considerably, as well as increasing accuracy of manipulation local- ization. In this paper, we propose a novel correlation predictor with a non-parametric learning algorithm, which is Locally Weighted Regression. Instead of fitting a global set of model parameters, a non-parametric learning algorithm fits a model dynamically by sampling the training set based on the pixel in the query image at which the correlation needs to be predicted. Our experimental results suggest that building a model dynamically based on the distance of training examples from the query pixel in the feature space helps to predict the correlation more accurately. Experimental results on benchmark data indicate that integrating the new predictor significantly improves the accuracy of predicted correlation, as well as image manipulation localization performance of PRNU-based forensic detectors.

Deepfake-Image Anti-Forensics with Adversarial Examples Attacks

Many deepfake-image forensic detectors have been proposed and improved due to the development of synthetic techniques. However, recent studies show that most of these detectors are not immune to adversarial example attacks. Therefore, understanding the impact of adversarial examples on their performance is an important step towards improving deepfake-image detectors. This study developed an anti-forensics case study of two popular general deepfake detectors based on their accuracy and generalization. Herein, we propose the Poisson noise DeepFool (PNDF), an improved iterative adversarial examples generation method. This method can simply and effectively attack forensics detectors by adding perturbations to images in different directions. Our attacks can reduce its AUC from 0.9999 to 0.0331, and the detection accuracy of deepfake images from 0.9997 to 0.0731. Compared with state-of-the-art studies, our work provides an important defense direction for future research on deepfake-image detectors, by focusing on the generalization performance of detectors and their resistance to adversarial example attacks.

An adversarial learning framework with cross-domain loss for median filtered image restoration and anti-forensics

As an ill-posed problem, median filtered (MF) image restoration and anti-forensics still face a challenge in improving the visual quality and deceiving the forensic detectors simultaneously. MF image restoration mainly aims at image visual quality recovery, while MF image anti-forensics primarily focuses on deceiving the existing forensic algorithms. Median filtering is popularly used as an operation for image denoising and smoothing. It is also employed by image anti-forensics to conceal or remove the traces of other image manipulating operations, such as JPEG blocking artifacts and the periodicity introduced by image resampling. This work proposes an adversarial learning framework that introduces loss terms spanning three domains for MF image restoration and anti-forensics. The differences of high-frequency coefficients in the discrete wavelet transform (DWT) domain are introduced as a term of loss term to restore high-frequency components. Moreover, high-frequency subband variance loss in the discrete cosine transform (DCT) domain is proposed to make the statistical characteristics of the generated image closer to that of the original image. Together with the Huber loss in the spatial domain, a novel generator network is developed and trained to enhance information flow and feature reuse. A capsule network is applied as a discriminator for differentiating the generated image from the original version. We explore a solution through adversarial learning in an infinite set of possible solutions. Experimental results demonstrate that the proposed method is able to restore the visual quality of MF images with salt and pepper noise previously more effectively than the existing methods. What is more, our method achieves the best anti-forensic performance in comparison with the existing state-of-the-art MF image anti-forensic methods, while enhancing the quality of anti-forensically restored images.

An approach to expose dithering-based JPEG anti-forensics

A forensic analyst needs to exploit various kinds of artefacts for developing a powerful forensic technique. Among those, the JPEG compression artefacts such as blocking artefacts & DCT histogram artefacts are the most widely used. JPEG anti-forensic techniques aim to disguise forensic detectors by removing these artefacts. Hence, a technique for the detection of dithering-based JPEG anti-forensic methods is the need of an hour. An approach proposed in this paper exploits the spread of discrete cosine transform (DCT) coefficients around integer multiple of quantization step size with repeated application of dithering-based JPEG anti-forensics. The paper first briefly explains dithering-based state-of-the-art JPEG anti-forensic techniques. Then the proposed method is illustrated thoroughly, and finally, experimental results are reported to demonstrate the accuracy of the proposed method.

Camera Obscura: Exploiting in-camera processing for image counter forensics

For the last two decades Image Forensics has been providing an arsenal of forensic tools to detect tampered images. At the same time, anti-forensics technologies kept evolving to mislead forensic detectors. Such attacks are generally designed to affect a single forensic trace (e.g. JPEG compression, sensor patter noise, histogram statistics) without considering that the image alteration can negatively affect other traces, thus making harder to mimic multiple statistics of natural images. Nevertheless, performing of several attacks can ruin the image quality. In this paper we introduce Camera Obscura, a method that, given a tampered picture, generates a pristine image with native camera metadata, JPEG structure, Quantization Tables, Preview, Thumbnails, their corresponding Quantization Tables, single compression statistics and any in-camera (even proprietary) processing. The attack is performed by exploiting and extending Magic Lantern, an alternative camera firmware, to perform in-camera image buffer substitution. As opposed to available image anti-forensic techniques, Camera Obscura accurately reproduces multiple image statistics in one attack with a limited effect on global image quality. With these characteristics, it can be applied for many different applications such as injecting reference image statistics into a computer generated image, exchange the supposed source of a given image or hide any signal-based editing operation.

Perception matters: Exploring imperceptible and transferable anti-forensics for GAN-generated fake face imagery detection

Abstract Recently, generative adversarial networks (GANs) can generate photo-realistic fake facial images which are perceptually indistinguishable from real face photos, promoting research on fake face detection. Though fake face forensics can achieve high detection accuracy, their anti-forensic counterparts are less investigated. Here we explore more imperceptible and transferable anti-forensics for fake face imagery detection based on adversarial attacks. Since facial and background regions are often smooth, even small perturbation could cause noticeable perceptual impairment in fake face images. Therefore it makes existing transfer-based adversarial attacks ineffective as an anti-forensic method. Our perturbation analysis reveals the intuitive reason of the perceptual degradation issue when directly applying such existing attacks. We then propose a novel adversarial attack method, better suitable for image anti-forensics, in the transformed color domain by considering visual perception. Conceptually simple yet effective, the proposed method can fool both deep learning and non-deep learning based forensic detectors, achieving higher adversarial transferability and significantly improved visual quality. Specially, when adversaries consider imperceptibility as a constraint, the proposed anti-forensic method achieves the state-of-the-art attacking performances in the transfer-based black-box setting (i.e. around 30% higher attack transferability than baseline attacks). More imperceptible and more transferable, the proposed method raises new security concerns to fake face imagery detection. We have released our code for public use, and hopefully the proposed method can be further explored in related forensic applications as an anti-forensic benchmark.

Antiforensics of Speech Resampling Using Dual‐Path Strategy

Resampling is an operation to convert a digital speech from a given sampling rate to a different one. It can be used to interface two systems with different sampling rates. Unfortunately, resampling may also be intentionally utilized as a postoperation to remove the manipulated artifacts left by pitch shifting, splicing, etc. To detect the resampling, some forensic detectors have been proposed. Little consideration, however, has been given to the security of these detectors themselves. To expose weaknesses of these resampling detectors and hide the resampling artifacts, a dual‐path resampling antiforensic framework is proposed in this paper. In the proposed framework, 1D median filtering is utilized to destroy the linear correlation between the adjacent speech samples introduced by resampling on low‐frequency component. And for high‐frequency component, Gaussian white noise perturbation (GWNP) is adopted to destroy the periodic resampling traces. The experimental results show that the proposed method successfully deceives the existing resampling forensic algorithms while keeping good perceptual quality of the resampled speech.

Reliable Camera Model Identification Using Sparse Gaussian Processes

Identifying the model of a camera that has captured an image can be an important task in criminal investigations. Many methods assume that the image under analysis originates from a given set of known camera models. In practice, however, a photo can come from an unknown camera model, or its appearance could have been altered by unknown post-processing. In such a case, forensic detectors are prone to fail silently. One way to mitigate silent failures is to use a rejection mechanism for unknown examples. In this work, we propose Gaussian processes (GPs), which intrinsically provide such a rejection mechanism. This makes GPs a potentially powerful tool in multimedia forensics, where forensic analysts regularly work on images from unknown origins. We demonstrate that GPs scale well to the task of camera model identification. Probabilistic predictions from a GP classifier achieve high classification accuracy for known camera models while providing reliable uncertainty estimates. The built-in uncertainty estimates effectively tackle open-set camera model identification, outperforming two state-of-the-art methods.

A JPEG Forensic Detector for Color Bitmap Images

Identification of decompressed JPEG images, especially those compressed with high JPEG quality factors, is a challenging issue in image forensics. Furthermore, the applicability of the existing JPEG forensic detectors in forgery localization is limited by their inability to cope with spatial misalignment in the $8\times 8$ JPEG grid. This paper proposes a novel forensic detector for decompressed JPEG color images stored in the bitmap format. The basic idea is to exploit the chroma upsampling traces introduced during the JPEG decompression of color images. We first show that the chroma upsampling alters the wide-sense stationary nature of the chroma planes and introduces wide-sense cyclostationarity in the upsampled chroma planes of decompressed JPEG images. As a result, unlike in the case of never-compressed images, the distributions of the odd-even and even-odd pixel pair differences are different for the chroma planes of never-compressed and decompressed JPEG images. We use the two-sample Kolmogorov-Smirnov (KS) test to find the similarity between these distributions and thereby to differentiate between never-compressed and decompressed JPEG images. The experimental results on a large set of images, including realistically-forged images, show the efficacy of the proposed detector even in the presence of spatial desynchronization due to image cropping.

An Antiforensic Method against AMR Compression Detection

Adaptive multirate (AMR) compression audio has been exploited as an effective forensic evidence to justify audio authenticity. Little consideration has been given, however, to antiforensic techniques capable of fooling AMR compression forensic algorithms. In this paper, we present an antiforensic method based on generative adversarial network (GAN) to attack AMR compression detectors. The GAN framework is utilized to modify double AMR compressed audio to have the underlying statistics of single compressed one. Three state-of-the-art detectors of AMR compression are selected as the targets to be attacked. The experimental results demonstrate that the proposed method is capable of removing the forensically detectable artifacts of AMR compression under various ratios with an average successful attack rate about 94.75%, which means the modified audios generated by our well-trained generator can treat the forensic detector effectively. Moreover, we show that the perceptual quality of the generated AMR audio is well preserved.

Digital image forensic approach based on the second-order statistical analysis of CFA artifacts

The truthfulness of digital images can be evaluated by investigating the CFA artifacts introduced due to the interpolation process of the image acquisition phase. In this paper, an image tampering detection technique is proposed by exposing the CFA artifacts in difference domain through the higher-order statistical analysis based on the Markov transition probability matrix (MTPM). Firstly, the given image is re-interpolated with most commonly used four Bayer CFA patterns. The re-interpolation process is performed by using bilinear interpolation scheme for simplicity purpose. Then, the difference between the given image and its re-interpolated versions is evaluated to analyze the CFA inconsistencies. The target difference image is selected corresponding to the maximum sum which is further processed to evaluate the MTPM based second-order statistical feature. The recommended approach is assessed on different images from UCID dataset and various social networking websites based on scalar-based and SVM/machine learning based forensic detectors. The experiment results confirm that the projected method offers improved efficiency in comparison to the existing techniques based on different forgery scenarios.

A CNN-Based Correlation Predictor for PRNU-Based Image Manipulation Localization

For PRNU-based forensic detectors, the fundamental test statistic is the normalized correlation between the camera fingerprint and the noise residual extracted from the image in successive overlapping analysis windows. The correlation predictor plays a crucial role in the performance of all such detectors. The traditional correlation predictor is based on predefined hand-crafted features representing intensity, texture and saturation characteristics of the image block under inspection. The performance of such an approach depends largely on the training and test data. We propose a convolutional neural network (CNN) architecture to predict the correlation from image patches of suitable size fed as input. Our empirical finding suggests that the CNN generalizes much better than the classical correlation predictor. With the CNN, we could operate with a common network architecture for various digital camera devices as well as a single network that could universally predict correlations for content from all cameras we experimented with, even including the ones that were not used in training the network. Integrating the CNN with our forensic detector gave state-of-the-art results.

Anti-forensic approach for JPEG compressed images with enhanced image quality and forensic undetectability

Most of the detectors employed in digital image forensics are based on JPEG compression. To determine the capability of these forensic detectors, proficient anti-forensic techniques that challenge and help in the upgradation of forensic techniques are required. This paper proposes an anti-forensic technique based on the shifted block Discrete Fractional Cosine Transform (DFrCT) approach. Afterwards, Total variation (TV) -based deblocking operation is used in order to remove the compression blocking artifacts. Due to the shifted block approach, the proposed method performs histogram smoothing without adding any dithering signal, which means that it is capable of applying dithering by itself. Further, to remove blocking artifacts which are left during the JPEG compression TV-based deblocking is used. The DFrCT approach provides an additional fractional parameter to improve the accuracy of the proposed approach. The proposed scheme is evaluated based on the UCID dataset images by considering the scalar based and machine learning-based forensic detectors. It is observed from the experimental results that the proposed approach provides improved performance in terms of PSNR, SSIM, and forensic undetectability when compared to existing techniques. The analysis performed in this paper challenges the security and robustness of JPEG compression forensic techniques.