Design and Analysis of New Methods on Passive Image Forensics Advisor: Fernando Pérez-González GPSC Signal Processing and Communications Group Vigo. November 8, 3.
Why do we need Image Forensics? Because... Nowadays, an image cannot be considered as an undeniable proof of occurrence of an event. Each year, digital camera prices are reduced by half the price for twice the quality. A lot of powerful and intuitive image editing tools facilitate the manipulation and alteration of digital images. Example Image Doctor David Va zquez-padı n Original image Modified image
How to cope with image tampering? Different ways... Active techniques: require a known signal that is embedded in the image to detect forgeries. Example: digital watermarking. Passive techniques: also known as blind, work in the absence of any prior information of the original image. Advantage Active Forensics The known signal provides a lot of information. Advantage Passive Forensics No prior information about the host is needed. Drawback A known signal has to be embedded in the host. Drawback Complexity of the problem grows very fast.
Passive Image Forensics on Realistic Scenarios Two years ago: Benetton new advertising campaign... What can we say? Cut and paste, adjusting brightness and contrast. Spatial transformations: resizing or rotations. Filtering: blurring. Final goal of Image Forensics: Identify all the operators applied to the original image.
Tampering detection through resampling inconsistencies The composition of different pictures imply: Spatial transformations of the tampered region. BUT, the resampling factor of a natural image should be constant.
Our proposals for Resampling Detection and Estimation Analytical description and modeling of the resampling operator: L Resampling Operator Interpolation Filter M Scalar Quantizer x[m] y[n] z[n] Derivation of several methods for exposing inconsistencies on the resampling factor of an image: Based on the cyclic covariance of the resampled signal. Based on the scalar quantization applied to the resampled signal.
Statistical test for detecting the presence of resampling Resampled signal by L M : y[n] = k x[k]h[nm kl] Resampled signal is cyclostationary: c yy [n; τ] = y[n]y[n + τ] c yy [n; τ] = c yy [ n + m L M ; τ ], m Z Analysis on the frequency domain of the cyclic covariance: T y 3 5 5 5 α /π.75.5.5 Γ= 55.689.5.5.5.5 α /π.5 α /π.5.75.75.5.5.5.5.75 α /π Rotated Image Analysis Block After thresholding D. Vázquez-Padín, C. Mosquera, and F. Pérez-González, Two-dimensional Statistical Test for the Presence of Almost Cyclostationarity on Images, in IEEE International Conference on Image Processing (ICIP), Hong Kong, China,, pp. 745-748.
Prefilter design for resampling factor estimation Autoregressive model for original signal P-order FIR filter AR() Filter w[n] ρ z - u[n] L Linear Filter h(t) M x[n] x[n] FIR Prefilter (P-order filter) y[n] Estimation of the resampling factor ^ Ns Objective function Θ ( Cyy [π M ; L ] + C yy [π L M ; ] ) L C yy [π k ;, where C yy [ω; τ] = FS{c yy [n; τ]} L ] L L k= k M,L M First-order filter Second-order filter 5.5 5. 4 4 3. 3.9.8.5.7 p p.6.5..4.3 3.5 3. 4 4. 5 5 4 3 3 4 5 p 5 5 4 3 3 4 5 p D. Vázquez-Padín and F. Pérez-González, Prefilter Design for Forensic Resampling Estimation, in IEEE International Workshop on Information Forensics and Security (WIFS), Foz do Iguaçu, Brazil,, pp. -6.
Exposing original and duplicated regions July, : during the BP oil crisis... Original image Tampered image Combination of SIFT-based method and Resampling-based method Matching between R (x,x ) and R (x,x ) Matching between R 3 (x,x ) and R 4 (x,x ) R (x,x ) R (x,x ) R 3 (x,x ) R 4 (x,x ) SIFT-based method Resampling-based method D. Vázquez-Padín and F. Pérez-González, Exposing original and duplicated regions using SIFT features and resampling traces, in International Workshop on Digital Watermarking (IWDW), Atlantic City, USA,, pp. 36-3.
ML estimation of the resampling factor Theoretical analysis Relying on the rounding operation applied after resampling, an approximation of the likelihood function of the quantized resampled signal is obtained. 7 Original signal 6 Resampled signal x z 5 z 4 x z z x 3 3 z 4 z x 5 3.5.5.5 3 (a) Original and resampled signals. 7 z 7 z z 3 6 6 Goal Given a vector of observations, we want to know the resampling factor M L applied to the original signal. 5 4 Δ 3 x 3 4 5 6 (b) Resulting pdf for x. 3.5.5 5 Δ 4 3 Δ x 4 6 8 (c) Feasible interval for x. 3.5.5.5.5 Description of the method ( L M = 5 3 ) 3 4 5 6 7 (d) Resulting pdf for x. x 4 6 (e) Resulting pdf for x 3. D. Vázquez-Padín and P. Comesaña, ML Estimation of the Resampling Factor, in IEEE International Workshop on Information Forensics and Security (WIFS), Tenerife, Spain,, pp. 5-. x 3
Set-Membership Identification of Resampled Signals Feasibility problem Given a vector of observations z, the length of the interpolator N h and assuming a candidate resampling factor Lc M c, find x, h, subject to x Z Nx, h R N h, x min x i x max, i =,..., N x, h min h j h max, j =,..., N h, y n z n, n =,..., Nz, where, y n = k x kh nmc kl c and z n = Q (y n). If there exist no x and h satisfying all the above constraints with the candidate resampling factor L c M c, then the problem is said to be infeasible. Correct resampling factor estimation [%] 9 8 7 6 5 4 3 N z =64 N z =8 N z =56 N z =5...3.4.5.6.7.8.9 ξ (true resampling factor) Comparative results Frequency-based method ML method 3 Set-membership D. Vázquez-Padín, P. Comesaña, and F. Pérez-González, Set-Membership Identification of Resampled Signals, in IEEE International Workshop on Information Forensics and Security (WIFS), Guangzhou, China, 3. (Accepted)
Conclusions and Future Work Conclusions There exists no universal tool for Image Forensics. Resampling detection and estimation is only one of many tools that could be used by a forensic analyst. The set-membership approach is very important from the point of view of a forensic analyst. Future Work Analyze different interpolation strategies, i.e., content-dependent, non-linear, etc. Add JPEG compression to our model, since the vast majority of tampered images are JPEG compressed.