Detecting Digital Forgeries using Blind Noise Estimation

September 29, ACM MM&Sec 2011Buffalo, New York

Xunyu Pan, Xing Zhang and Siwei LyuComputer Science Department

University at Albany, SUNY

Outline

– Motivation

– Related Works

– Detection Method

– Experimental Results

– Discussion and Future Work

Image Splicing

Credit: Liu Weiqiang PhotoPhotoshop

Creation of Visual Effects

Motivation• Image splicing and creation of visual effects are two

common manipulations used in image tampering, where noise is introduced to either conceal tampering traces or changing image contents

• The variance of noise in a authentic images is generally uniform distributed

• We propose a new method to effectively expose image forgery by detecting the noise variance differences between original and tampered parts of an image

An Example of Image Splicing Forgery

Original images

Tampered image

Outline

– Motivation

– Related Works

– Detection Method

– Experimental Result

– Discussion and future work

Previous Works• Determine the existence of forgery by extracting camera

sensor fingerprint (e.g. PRNU) from training images and further detecting image forgery by supervised learning (SVM)– Knowledge of specific camera models [Lukas, 06], [Sutcu, 07] and

[Filler, 08]– No extent and location of the forgery [Gou, 07]

• Locate image forgery using noise level difference – Knowledge of the kurtosis of the adding noise and the original

image [Popescu, 04]– Inefficient blocks merging algorithm[Mahdian, 09]

Outline

– Motivation

– Related Works

– Detection Method

– Experimental Results

– Discussion and Future Work

Pipeline of the Proposed Method

Image Block Segmentation

• Image segmentation for local noise estimation– Larger block are more stable and accurate– Smaller block represents local noise more

precisely

• We segment image into 64 × 64 pixel non-overlapping blocks in the first round detection

Image Block Segmentation

Means and standard deviations of estimated noise on 100 image blocks of various sizes by adding noise Std 25

16×16

32×32

64×64

128×128

256×256

Pipeline of the Proposed Method

Image Kurtosis

• Image kurtosis is the measure of the "peakedness" of the probability distribution of pixels:

• Suppose a white Gaussian noise of zero mean and unknown variance is added to the image to obtain an image , denote as:

• The kurtosis of can be computed as:y

2n

yx

xy

3)1(

32

22

2

ny

n

xy

44

Pipeline of Noise Estimation

The Objective Function

• Assuming the kurtosis is scale invariant, we can estimate the kurtosis of and the variance of noise by minimizing the objective function:

2

2 2

2

2

22

2,

2 3

1

3argminˆ,ˆN

iy

ny

n

xnx i

i

nx

x

Major Steps for the Noise Estimation

• STEP 1: Conversion from image domain to DCT domain

• STEP 2: Compute the variance and kurtosis for each response image

• STEP 3: Noise estimation by the optimization of the objective function (MATLAB fminsearch function)

Pipeline of the Proposed Method

K-means Clustering

• Classify all non-overlapping image blocks into k (k=2) clusters based on their noise level– (1) Starting with randomly selected k means– (2) Assign each block to the cluster with the

closest mean– (3) Compute a new mean for each cluster– (4) Repeat (2) and (3) until the stopping criteria is

satisfied

Initial Detection

• Image blocks are classified using K-means clustering algorithm– Assume the tampered region is smaller than

authentic region. The cluster with fewer blocks is treated as forgery

– False positives - complex textures: tree, grass, … Need a second round refined detection

Refined Detection

• Segment the detected suspicious region into 32 × 32 non-overlapping image blocks

• Estimate noise level for each 32 × 32 blocks

• keep all two clusters if their means are close enough

264

232

2 8.02.0

Outline

– Motivation

– Related Works

– Detection Method

– Experimental Results

– Discussion and future Work

Quantitative Testing Results

• We define two quantitative measure of performance based on the detection accuracy and false positives

– Block detection accuracy (BDA)

– Block false positive (BFP)

BDA and BFP

~

|||~|

BDA

|~||~|BFP

Quantitative Experiments

• One uncompressed color image from Kodak dataset

• A randomly located 192 × 192 image block is tampered with Gaussian noise of various noise levels

• Generate 100 images for each noise level in the range of [1, 10] (total 1000 forged images)

Quantitative Experiments

Averages of BDA/BFP for 100 tampered image at each noise level σ = [1, 10 ]

Qualitative Experiments

Detection resultImage tampered with noise σ=5

Qualitative Experiments

Detection resultImage tampered with noise σ=10

Qualitative Experiments

Detection resultImage tampered with noise σ=15

Qualitative Experiments (cont.)

Detection result of our method on image splicing forgery

Qualitative Experiments (cont.)

Detection result of our method on rain/snow appearance created using image noise

Qualitative Testing Results (cont.)

Detection result of our method on ground glass appearance created using image noise

Outline

– Motivation

– Related Works

– Detection Method

– Experimental Results

– Discussion and Future work

Summary

• In this work, we propose a novel method for image forgery detection based on the clustering of image blocks with different noise variances

• Experimental results with credible forgeries show the efficacy of our method

Discussion• Advantages

– Reliably expose image splicing or forgeries created for special visual effects

– No prior knowledge of the imaging device or of kurtosis of the original image

• Limitations– Non-overlapping can not locate the extent of tampered region

precisely– Failure estimation in one block leads to missing tampered region

Future Work

• Detect noise inconsistency due to different JPEG compression qualities

• Improve the detection accuracy and efficacy by noise estimation on local overlapping image blocks using fast estimation method

Thank You!