Image Forensics Research Articles

Detecting Double JPEG Compressed Color Images via an Improved Approach

Detecting double Joint Photographic Experts Group (JPEG) compression for color images is vital in the field of image forensics. In previous researches, there have been various approaches to detecting double JPEG compression with different quantization matrices. However, the detection of double JPEG color images with the same quantization matrix is still a challenging task. An effective detection approach to extract features is proposed in this paper by combining traditional analysis with Convolutional Neural Networks (CNN). On the one hand, the number of nonzero pixels and the sum of pixel values of color space conversion error are provided with 12-dimensional features through experiments. On the other hand, the rounding error, the truncation error and the quantization coefficient matrix are used to generate a total of 128-dimensional features via a specially designed CNN. In such a CNN, convolutional layers with fixed kernel of and Dropout layers are adopted to prevent overfitting of the model, and an average pooling layer is used to extract local characteristics. In this approach, the Support Vector Machine (SVM) classifier is applied to distinguish whether a given color image is primarily or secondarily compressed. The approach is also suitable for the case when customized needs are considered. The experimental results show that the proposed approach is more effective than some existing ones when the compression quality factors are low.

Toward Deep-Learning-Based Methods in Image Forgery Detection: A Survey

In the last decades, deep learning (DL) has emerged as a powerful and dominant technique for solving challenging problems in various fields. Likewise, in the field of digital image forensics, a large and growing body of literature investigates DL-based techniques for detecting and classifying tampered regions in images. This article aims to provides a comprehensive survey of state-of-the-art DL-based methods for image-forgery detection. Copy-move images and spliced images, two of the most popular types of forged images, were considered. Recently, owing to advances in DL, DL-based approaches have yielded much better results as compared to traditional non-DL-based ones. The surveyed techniques were proposed by developing or fusing various efficient DL methods, such as CNN, RCNN, or LSTM to adapt to detecting tampered traces.

On the Security of the One-and-a-Half-Class Classifier for SPAM Feature-Based Image Forensics

Combining multiple classifiers is a promising approach to hardening forensic detectors against adversarial evasion attacks. The key idea is that an attacker must fool all individual classifiers to evade detection. The 1.5C classifier is one of these multiple-classifier detectors that is attack-agnostic, and thus even increases the difficulty for an omniscient attacker. Recent work evaluated the 1.5C classifier with SPAM features for image manipulation detection. Despite showing promising results, their security analysis leaves several aspects unresolved. Surprisingly, the results reveal that fooling only one component is often sufficient to evade detection. Additionally, the authors evaluate classifier robustness with only a black-box attack because, currently, there is no white-box attack against SPAM feature-based classifiers. This paper addresses these shortcomings and complements the previous security analysis. First, we develop a novel white-box attack against SPAM feature-based detectors. The proposed attack produces adversarial images with lower distortion than the previous attack. Second, by analyzing the 1.5C classifier’s acceptance region, we identify three pitfalls that explain why the current 1.5C classifier is less robust than a binary classifier in some settings. Third, we illustrate how to mitigate these pitfalls with a simple axis-aligned split classifier. Our experimental evaluation demonstrates the increased robustness of the proposed detector for SPAM feature-based image manipulation detection.

Transformer-Based Named Entity Recognition on Drone Flight Logs to Support Forensic Investigation

The increase in drone usage by the public brings the number of drone incident and attack up. Sophisticated preventive mechanisms, as well as post-incident procedures and frameworks, are needed. Forensic investigation is performed upon a drone incident, aiming to uncover the incident scenario, mitigate the risk and report the examination results. Generally, standard drone forensic procedure consists of three stages, i.e., evidence acquisition, evidence analysis, and reporting. Among the existing research, many attempts have been made in framework proposal and evaluation, study case, and tools proposal and evaluation. However, less research focuses on utilizing specific data artifacts from the drone forensic image, such as telemetry, dataflash, and flight log data. Therefore, this research aims to propose the use of log message data to discover and extract some incident-related information using a deep learning-based NLP technique, i.e., named entity recognition using the Transformer. Cosine similarity is proposed as a substitute for dot-product in the self-attention mechanism of the Transformer encoder layer. Additionally, we propose NER architecture built from a mix of several existing methods and report the performance evaluation. We extract the DJI drone forensic image from a publicly available dataset using Autopsy and DJI Phantom Help and collect the decrypted log messages. Six entity types are defined after carefully reading the log message. These entity types are used in the manual annotation process using the IOB2 scheme as the label. The constructed dataset is used to evaluate the proposed model along with several baseline models. The proposed method outperforms the previous baseline model with a 91.348% F1 score. Finally, we conclude the experiment and mention several future directions.

A forensic method for investigating manipulated video recordings

Forensic image analysis can be used to resolve difficult incidents, such as the increasing number of child sexual abuse cases. Although the United Nations and European Union countries are trying to fight these crimes, criminals are developing new methods to circumvent the measures taken. Sharing videos that do not contain any criminal elements and inserting child sexual abuse videos between frames is a new method that has been seen recently. This article proposes a new method to analyse the videos prepared this way. The proposed method is particularly advantageous for detecting and analysing videos that have been manipulated and embedded in different content and can be applied as a new technique.

Anti‐forensics for double JPEG compression based on deep reinforcement learning

DJPEG (double JPEG compression) detection has received attention in image forensics. In order to study the limitations of forensics detectors under attacks, it is essential to develop DJPEG anti-forensics techniques. Compared with anti-forensics operations performed in spatial domain, existing DCT-based methods have not brought their potential to full play due to the difficulty of directly manipulating DCT coefficients. In recent years, DRL (deep reinforcement learning) has developed rapidly in image-related tasks. Its ability of decision making can turn an unpredictable restoration step into multiple simple trial-and-error modification steps. In this paper, it is investigated how to efficiently modify DCT coefficients for anti-forensics purpose with the help of DRL, and propose a method called AFDJ-DRL (Anti-forensics Framework for DJPEG based on DRL). Specifically, an agent utilizes a policy network to extract DCT inter-block and intra-block features and learn a coefficient-level policy. An environment assigns rewards from multiple sources. Via maximizing such rewards, the agent can learn to modify DCT coefficients in several rounds to obtain images with anti-forensics capability. Experimental results show that the AFDJ-DRL is superior to existing DCT-based methods, and can be applied as a post-processing step for spatial ones for further performance improvement.

Rethinking gradient operator for exposing AI-enabled face forgeries

For image forensics, convolutional neural networks (CNNs) tend to learn image content features rather than subtle manipulation traces, which constrains detection performance. Existing works usually address this issue by following a common pipeline, namely subtracting the original pixel value from the predicted pixel value to enforce CNNs to learn more features from the manipulation traces. However, due to the complicated learning mechanism, they might still have some unnecessary performance losses. In this work, we rethink the advantages of image gradient operator in exposing AI-enabled face forgeries, and design two plug-and-play modules, namely tensor pre-processing (TP) and manipulation trace attention (MTA), by combining the gradient operator with CNNs. Specifically, the TP module refines the feature tensor of each channel in the network by the gradient operator to highlight manipulation traces and improve feature representation. Moreover, the MTA module considers two dimensions, namely channel and manipulation traces, to enforce the network to learn the distribution of the manipulation traces. Both modules can be seamlessly integrated into existing CNNs for end-to-end training. Experiments show that the proposed expert system achieves better results than prior works on five public image datasets. The code is available at: https://github.com/EricGzq/GocNet-pytorch.

Identification of Source Camera by Amalgamation of PRNU and Noise Print Using Dimensionality Expansive Residual Network

It might be challenging in the field of image forensics to identify the source camera of a picture. This researchproposes a noise adaptable convolutional neural network-based technique for camera identification. For cameraidentification, the suggested solution combines Photo Response Non-Uniformity (PRNU) noise and Noiseprint.Three parallel dimensionality expanded residual networks with convolutional layers of kernel size 1x1 were puttogether for enhanced feature extraction. The experiment mentioned above uses pictures from the ”Vision Dataset”as its subject matter. The experimental findings demonstrate the effectiveness of the suggested methodology inidentifying the source camera at the brand, model, and device levels. When two of the three networks were fedwith PRNU and one with noiseprint, the best performance was obtained.

Beyond PRNU: Learning Robust Device-Specific Fingerprint for Source Camera Identification.

Source-camera identification tools assist image forensics investigators to associate an image with a camera. The Photo Response Non-Uniformity (PRNU) noise pattern caused by sensor imperfections has been proven to be an effective way to identify the source camera. However, the PRNU is susceptible to camera settings, scene details, image processing operations (e.g., simple low-pass filtering or JPEG compression), and counter-forensic attacks. A forensic investigator unaware of malicious counter-forensic attacks or incidental image manipulation is at risk of being misled. The spatial synchronization requirement during the matching of two PRNUs also represents a major limitation of the PRNU. To address the PRNU’s fragility issue, in recent years, deep learning-based data-driven approaches have been developed to identify source-camera models. However, the source information learned by existing deep learning models is not able to distinguish individual cameras of the same model. In light of the vulnerabilities of the PRNU fingerprint and data-driven techniques, in this paper, we bring to light the existence of a new robust data-driven device-specific fingerprint in digital images that is capable of identifying individual cameras of the same model in practical forensic scenarios. We discover that the new device fingerprint is location-independent, stochastic, and globally available, which resolves the spatial synchronization issue. Unlike the PRNU, which resides in the high-frequency band, the new device fingerprint is extracted from the low- and mid-frequency bands, which resolves the fragility issue that the PRNU is unable to contend with. Our experiments on various datasets also demonstrate that the new fingerprint is highly resilient to image manipulations such as rotation, gamma correction, and aggressive JPEG compression.

Multitask Image Splicing Tampering Detection Based on Attention Mechanism

In today’s modern communication society, the authenticity of digital media has never been of such importance as it is now. In this aspect, the reliability of digital images is of paramount importance because images can be easily manipulated by means of sophisticated software, such as Photoshop. Splicing tampering is a commonly used photographic manipulation for modifying images. Detecting splicing tampering remains a challenging task in the area of image forensics. A new multitask model based on attention mechanism, densely connected network, Atrous Spatial Pyramid Pooling (ASPP) and U-Net for locating splicing tampering in an image, AttDAU-Net, was proposed. The proposed AttDAU-Net is basically a U-Net that incorporates the spatial rich model filtering, an attention mechanism, an ASPP module and a multitask learning framework, in order to capture more multi-scale information while enlarging the receptive field and improving the detection precision of image splicing tampering. The experimental results on the datasets of CASIA1 and CASIA2 showed promising performance metrics for the proposed model (F1-scores of 0.7736 and 0.6937, respectively), which were better than other state-of-the-art methods for comparison, demonstrating the feasibility and effectiveness of the proposed AttDAU-Net in locating image splicing tampering.

Image Hashing Through Spatio-triad Relationship

Authenticating the content of the digital image has profound influence in legal matters and in court rooms. Image forensics plays an important role towards it. Proposed approach helps to authenticate the original image by generating a content based image signature that is a unique fingerprint for the image. Our novel approach establishes spatio triad relationship among features and finds the centre of gravity or centroid of the same after indexing. Topology of the triad relationship for the content based low level feature descriptors is preserved through aggregation until single key feature is deduced which is a 128 bit signature hash value and represented in decimal form. Density of feature keypoints influences the centre of gravity which acts as a unique signature for the given image. Manipulated image cannot contribute to restore / regenerate the same signature. We have verified our authentication approach for standard benchmark image dataset like MICC-F220, Columbia Image Splicing Evaluation dataset and Image manipulation dataset from Friedrich Alexander University and have found satisfactory results for the same. Content based image signature obtained is used to verify authenticity of image and for retrieval of video from database. Content based image fingerprint generated can also be considered for embedding as a watermark.

Robust Estimation of Upscaling Factor on Double JPEG Compressed Images.

As one of the most important topics in image forensics, resampling detection has developed rapidly in recent years. However, the robustness to JPEG compression is still challenging for most classical spectrum-based methods, since JPEG compression severely degrades the image contents and introduces block artifacts in the boundary of the compression grid. In this article, we propose a method to estimate the upscaling factors on double JPEG compressed images in the presence of image upscaling between the two compressions. We first analyze the spectrum of scaled images and give an overall formulation of how the scaling factors along with the parameters of JPEG compression and image contents influence the appearance of tampering artifacts. The expected positions of five kinds of characteristic peaks are analytically derived. Then, we analyze the features of double JPEG compressed images in the block discrete cosine transform (BDCT) domain and present an inverse scaling strategy for the upscaling factor estimation with a detailed proof. Finally, a fusion method is proposed that through frequency-domain analysis, a candidate set of upscaling factors is given, and through analysis in the BDCT domain, the optimal estimation from all candidates is determined. The experimental results demonstrate that the proposed method outperforms other state-of-the-art methods.

Efficacy of Residual Methods for Passive Image Forensics Using Four Filtered Residue CNN

Efficacy of Residual Methods for Passive Image Forensics Using Four Filtered Residue CNN

Exposing unseen GAN-generated image using unsupervised domain adaptation

Benefiting from the tremendous success of Generative Adversarial Networks (GANs), we are entering a world where it will be increasingly difficult for people to distinguish whether an image is synthetic, which puts new demands on digital image forensics. To resolve this issue, several fake image detectors based on supervised binary classification have been designed. However, current methods remain vulnerable when testing samples are generated by an unseen GAN model. In this work, an unsupervised domain adaptation strategy is introduced to achieve the detection of GAN-generated images in an unknown domain. A Self-Attention block and novel loss function have been constructed to optimize the domain adaptation process, thus obtaining a better generalization. Experimental results demonstrate that the proposed scheme obtains high detection accuracy on the generalization problem and is robust to common post-processing in reality, which shows that unsupervised methods can enhance the generalization ability of detection models to some extent.

Forensics Analysis of Resampling via ConvNeXt Block

Images play an important role in transmitting visual information in our life. It could lead to severe consequences if images are manipulated or tampered maliciously. Digital forensics is an important research area to secure multimedia information. Many forensics technologies are applied to protect our community from the abuse of digital information. In many cases, after tampering, attackers could apply operations such as resampling, JPEG compression, blurring, etc. to cover the traces of tampering. Therefore, it is necessary to detect these manipulations in image forensics before exposing forgeries. In this paper, we propose to employ the prediction error filters, ConvNeXt blocks and convolution modules to classify images with different compression quality factors and resampling rates. By tracing the inconsistencies of resampling rates and compression quality factors, it could provide supplementary information for forensics researchers to expose possible forgeries. The proposed method could achieve great classification performance regardless of the interpolation algorithms. Also, it is highly robust against JPEG compression. In addition, the proposed method can be applied for estimating quality factors of JPEG compression.

Joint image compression and denoising via latent-space scalability

When it comes to image compression in digital cameras, denoising is traditionally performed prior to compression. However, there are applications where image noise may be necessary to demonstrate the trustworthiness of the image, such as court evidence and image forensics. This means that noise itself needs to be coded, in addition to the clean image itself. In this paper, we present a learning-based image compression framework where image denoising and compression are performed jointly. The latent space of the image codec is organized in a scalable manner such that the clean image can be decoded from a subset of the latent space (the base layer), while the noisy image is decoded from the full latent space at a higher rate. Using a subset of the latent space for the denoised image allows denoising to be carried out at a lower rate. Besides providing a scalable representation of the noisy input image, performing denoising jointly with compression makes intuitive sense because noise is hard to compress; hence, compressibility is one of the criteria that may help distinguish noise from the signal. The proposed codec is compared against established compression and denoising benchmarks, and the experiments reveal considerable bitrate savings compared to a cascade combination of a state-of-the-art codec and a state-of-the-art denoiser.

Analisis Forensik Rekayasa Dokumen Digital dengan Metode NIST

Digital Forensics is one of the technological fields contained many sub-fields that can assist technically in collecting digital evidence to be presented in a trial in accordance with applicable law. The example of digital forensics sub-field is Image Forensics, which aims to digitally collect and look for evidentiary facts in determining the authenticity of an image or document that contained images. Various criminal and pornographic cases involving image files are still happening nowadays, therefore forensics on images as evidence is an important key to assist the court in making decisions. This research examines the authenticity of documents in the form of digital letters using National Institute of Standard and Technology (NIST) method by applying the forensic ELA (Error Level Analysis). Several previous researches have proven that the forensic ELA is able to detect modifications that have been made to images. Differences with previous researches and this research are the authors also checked the metadata of the images before performing the ELA examination using Fotoforensics. The results of the analysis shows a high level of consistency in the images and writings due to the accumulation of white dots in several places such as in headers, logos, header’s writings, text contents, footnotes, and signatures.

Adaptive Feature Analysis in Target Detection and Image Forensics Based on the Dual-Flow Layer CNN Model

With the rapid development of artificial intelligence technology, image editing technology has evolved from relying on software such as Photoshop and GIMP for manual modification to using artificial intelligence technology to achieve intelligent and automated tampering of images. Editing, falsifying, and disseminating digital images have become simple and easy, leading to a crisis of confidence in digital images and reducing their reliability as judicial evidence. Therefore, how to identify falsified images, improve their trustworthiness, and avoid judicial injustice has become a problem that must be overcome in the information age. In this paper, we propose a target detection and adaptive feature analysis in image forensics based on a dual-flow layer CNN model, which can effectively perform image forensics. The results show that our algorithm has a clear theoretical basis, a small operational complexity, and a high detection accuracy.

“Porsche Girl”: When a Dead Body Becomes a Meme

Are online users ethically responsible for the memes that they view and circulate? What if those memes have their origins in a leaked forensic image of a dead body? What if that same meme is used to terrorize the victim’s family? “Porsche Girl,” the morbid meme based on the photographs of a teenage girl following a deadly car crash, demonstrates the vulnerability of “memeified” subjects as well as the ethical risks involved when sensitive content is disseminated online. Using the model of distributed responsibility, this case study suggests that viewers are in fact ethically responsible (at least in part) for the online content with which they engage, but that platform regulations and overall legislation also play a crucial role. By perpetuating the circulation of a sensitive image, the harmful effects of the image persist.

Adaptive content suppression based on shared‐hidden‐layer convolutional autoencoder for blind image forensics

SummaryDouble JPEG (DJPEG) compression detection is one of the crucial issues in detecting the presence of image forgery or tampering in blind image forensics. To address this challenge, this article investigates DJPEG compression detection in aligned and nonaligned tampering cases using adaptive image content removal based on a shared‐hidden‐layer convolutional autoencoder for preprocessing. Then the suppressed content images are classified with two convolutional neural networks (CNNs) in a parallel structure. These two networks are responsible for separating the small 64 × 64 single JPEG compression images from the DJPEG ones. The results indicate appropriate performance in the aligned and especially nonaligned cases. The detection possibility in the absence of alignment was investigated and favorable results were achieved. Since it is not possible to determine the exact values of the quality factor (QF) for optimal detection in some cases, we examined the network sensitivity to these QFs. The experimental results were satisfactory, especially in the aligned case. Comparing state‐of‐the‐art methods, we achieved a relative error reduction of about 69% in some cases. In addition, we determined the manipulated locations with high accuracy.