towards digital image anti-forensics via image restorationwei.fan/documents/slides_defense... ·...

Towards Digital Image Anti-Forensicsvia Image Restoration

A Ph.D. thesis defense

by

Wei FAN

supervised by:Kai WANG, Francois CAYRE, and Jean-Marc BROSSIER at GIPSA-lab,

and Zhang XIONG at Beihang University

30/04/2015

Introduction JPEG Anti-Forensics Median Filtering Anti-Forensics Conclusions & Perspectives

Seeing is believing.A picture is worth a thousand words.

Manipulation

Dutch painter Johannes Vermeer,around 1665 Worth1000 user bigchopper, 2014

Wei FAN 2 / 50I Original painting information: http://en.wikipedia.org/wiki/Girl_with_a_Pearl_EarringI Image forgery source: http://www.worth1000.com/entries/740270/girl-with-the-beats

http://en.wikipedia.org/wiki/Girl_with_a_Pearl_Earring

http://www.worth1000.com/entries/740270/girl-with-the-beats


Research Context

Image Forensics:Restore Some Trust to Digital Images

Image ForensicsTo analyze a given digital image so as to detect whether it is aforgery, to identify its origin, to trace its processing history, or toreveal latent details invisible to human naked eyes.

Forensics{

Active Forensics (Fragile Watermarking)Passive Forensics, often directly referred to as Forensics

Wei FAN 3 / 50I Fourandsix Technologies, Inc. http://www.fourandsix.com/about-us/I V. Conotter. “Active and passive multimedia forensics”. PhD thesis. University of Trento, 2011

http://www.fourandsix.com/about-us/


Research Context

Every coin has two sides.

cryptography vs. cryptanalysissteganography vs. steganalysis

Image Anti-ForensicsTo expose the limitations of forensic methods, with the ultimategoal to develop more trustworthy forensics.

Wei FAN 4 / 50I R. Bohme and M. Kirchner. “Counter-forensics: attacking image forensics”. Digital Image Forensics, Springer,

2013, pp. 327-366


Research Context

Research Context

Original image

Wei FAN 5 / 50


Research Context

Research Context

Original image Image forgery

Manipulation

Wei FAN 5 / 50


Research Context

Research Context


Manipulation

Forensic tool


Manipulation

Forensic tool

Wei FAN 5 / 50


Research Context

Research Context


Manipulation

Forensic tool

forensic feature differs


Manipulation

Forensic tool


Wei FAN 5 / 50


Research Context

Research Context


Manipulation

Forensic tool


Image Forgery Detected! (Correctly Classified)


Manipulation

Forensic tool


Image Forgery Detected! (Correctly Classified)

Wei FAN 5 / 50


Research Context

Research Context


Manipulation

Anti-forensic image

Anti-forensics

Wei FAN 5 / 50


Research Context

Research Context


Manipulation

Anti-forensic image

Anti-forensics

Forensic tool


Manipulation

Anti-forensic image

Anti-forensics

Forensic tool

Wei FAN 5 / 50


Research Context

Research Context


Manipulation

Anti-forensic image

Anti-forensics

Forensic toolforensic feature resembles


Manipulation

Anti-forensic image

Anti-forensics


Wei FAN 5 / 50


Research Context

Research Context


Manipulation

Anti-forensic image

Anti-forensics


Original Image Detected! (Wrongly Classified)


Manipulation

Anti-forensic image

Anti-forensics


Original Image Detected! (Wrongly Classified)

Wei FAN 5 / 50


Research Context

Research Context


Manipulation

Anti-forensic image

Anti-forensics

Thesis objective: to design image anti-forensic methods.

Wei FAN 5 / 50


Research Context

Research Context


Manipulation

Anti-forensic image

Anti-forensics

Thesis objective: to design image anti-forensic methods.

Why? the development of trustworthy image forensics.

Wei FAN 5 / 50


Research Context

Farid’s Classification of Image ForensicsImage Forensics

Format Pixel Camera Physically Geometric

JPEG

SPHIT

· · ·

Medianfiltering

Resampling

Splicing

· · ·

Chromaticaberration

CFA

PRNU

· · ·

Lightingdirection

Lightingenviron-

ment

Illuminationcolor

· · ·

Principalpoint

Shadows

Reflections

· · ·

Wei FAN 6 / 50

I H. Farid, “A Survey of Image Forgery Detection,” IEEE Signal Processing Magazine, 2009

I http://w3techs.com/technologies/overview/image_format/allI M. C. Stamm and K. J. R. Liu. “Anti-forensics of digital image compression”. IEEE TIFS 6, 3 (2011), pp.

1050-1065I M. Kirchner and R. Rohme. “Hiding traces of resampling in digital images”. IEEE TIFS 3, 4 (2008), pp. 582-592

http://w3techs.com/technologies/overview/image_format/all


Research Context



JPEG

SPHIT

· · ·

Medianfiltering

Resampling

Splicing

· · ·

Chromaticaberration

CFA

PRNU

· · ·

Lightingdirection

Lightingenviron-

ment

Illuminationcolor

· · ·

Principalpoint

Shadows

Reflections

· · ·

JPEG is the most widely used image format on Internet.

Wei FAN 6 / 50


I http://w3techs.com/technologies/overview/image_format/all

I M. C. Stamm and K. J. R. Liu. “Anti-forensics of digital image compression”. IEEE TIFS 6, 3 (2011), pp.1050-1065

I M. Kirchner and R. Rohme. “Hiding traces of resampling in digital images”. IEEE TIFS 3, 4 (2008), pp. 582-592



Research Context



JPEG

SPHIT

· · ·

Medianfiltering

Resampling

Splicing

· · ·

Chromaticaberration

CFA

PRNU

· · ·

Lightingdirection

Lightingenviron-

ment

Illuminationcolor

· · ·

Principalpoint

Shadows

Reflections

· · ·

JPEG is the most widely used image format on Internet.

Median filtering is a widely used image processing operationfor, e.g., denoising, smoothing, etc.

Median filtering is also used for anti-forensic purposes, e.g.,JPEG image deblocking, disguising resampling artifacts.

Wei FAN 6 / 50


I http://w3techs.com/technologies/overview/image_format/allI M. C. Stamm and K. J. R. Liu. “Anti-forensics of digital image compression”. IEEE TIFS 6, 3 (2011), pp.

1050-1065I M. Kirchner and R. Rohme. “Hiding traces of resampling in digital images”. IEEE TIFS 3, 4 (2008), pp. 582-592



Research Context

Creating A Composite JPEG ImageJPEG image with q1 JPEG image with q2

resulting double JPEG compressed image

image composition, JPEG compression again with q3

JPEG compressedtwice with q1 and q3


Wei FAN 7 / 50I T. Bianchi and A. Piva. “Image forgery localization via block-grained analysis of JPEG artifacts”. IEEE TIFS 7,

3 (2012), pp. 1003-1017


Research Context






−60

−40

−20

0

20

likelihood map


3 (2012), pp. 1003-1017


Methodology

Analysis of Current Image Anti-Forensics

1 JPEG anti-forensicsDithering (≈ noise addition) for DCT histogram smoothingMedian filtering for JPEG deblocking

2 Median filtering anti-forensicsSharpening filteringDithering (≈ noise addition)Noise injection

Wei FAN 8 / 50


I M. Fontani and M. Barni. “Hiding traces of median filtering in digital images”. In: Proc. EUSIPCO: IEEE, 2012,pp. 1239-1243

I Z.-H. Wu, et al. “Anti-forensics of median filtering”. In: Proc. ICASSP. 2013, pp. 3043-3047I D. T. Dang-Nguyen et al. “Counter-forensics of median filtering”. In: Proc. MMSP. 2013, pp. 260-265


Methodology

Analysis of Current Image Anti-Forensics

1 JPEG anti-forensicsDithering (≈ noise addition) for DCT histogram smoothingMedian filtering for JPEG deblocking

2 Median filtering anti-forensicsSharpening filteringDithering (≈ noise addition)Noise injection

Current anti-forensic methods mainly use simple imageprocessing, e.g., filtering, noise addition, etc.

1 Image quality is a concern2 Can be detected by advanced forensic algorithms

Wei FAN 8 / 50


I M. Fontani and M. Barni. “Hiding traces of median filtering in digital images”. In: Proc. EUSIPCO: IEEE, 2012,pp. 1239-1243

I Z.-H. Wu, et al. “Anti-forensics of median filtering”. In: Proc. ICASSP. 2013, pp. 3043-3047I D. T. Dang-Nguyen et al. “Counter-forensics of median filtering”. In: Proc. MMSP. 2013, pp. 260-265


Methodology

Leveraging on Image Restoration

Image RestorationTo estimate the “clean” original image from the corrupted image,usually via solving an ill-posed inverse problem.

Image Anti-Forensics vs. Image RestorationSimilarities

Process the degraded image to approximate the original oneRequire high quality of the processed image

DifferencesAnti-forensics: good forensic undetectability is a mustRestoration: high image quality is the goal

Wei FAN 9 / 50


Methodology

Leveraging on Image Restoration

Image RestorationTo estimate the “clean” original image from the corrupted image,usually via solving an ill-posed inverse problem.

Image Anti-Forensics vs. Image RestorationSimilarities

Process the degraded image to approximate the original oneRequire high quality of the processed image

DifferencesAnti-forensics: good forensic undetectability is a mustRestoration: high image quality is the goal

Proposed Methodology:

Employ MAP estimation (or one of its variants)Adopt & enrich statistical models from image restorationIntegrate some anti-forensic terms/strategies

Wei FAN 9 / 50


Preliminaries

Natural Image Datasets

1 JPEG compressionUCID: 1338 original non-compressed images with size 512×384

2 Median filteringMFTE, MFTR, MFPE: 1607 original, never resampled, non-compressed images with size 512× 512

Wei FAN 10 / 50

I G. Schaefer and M. Stich. “UCID - an uncompressed colour image database”. In: Proc. SPIE, 2004, pp. 472-480I ftp://firewall.teleco.uvigo.es:27244/DS_01_UTFI.zipI ftp://lesc.dinfo.unifi.it/pub/Public/JPEGloc/dataset/

ftp://firewall.teleco.uvigo.es:27244/DS_01_UTFI.zip

ftp://lesc.dinfo.unifi.it/pub/Public/JPEGloc/dataset/


Preliminaries

Evaluation MetricsAnti-Forensics Objective: Good Undetectability & High Image Quality

1 Forensic UndetectabilityArea Under Curve (AUC)

2 Image QualityPeak Signal-to-Noise Ratio (PSNR)Structural SIMilarity (SSIM)

3 Histogram RecoveryKullback-Leibler divergence (KL divergence)

0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1

0

0.2

0.4

0.6

0.8

1

False positive rate

Truepositive

rate

Random guess

Goal:

ROC curve → random guess line AUC → 0.5

Goal:

the higher the PSNR/SSIM value is, the better(reference: the original image)

Goal:

KL divergence → 0(reference: certain histogram constructed from the original image)

original image processed image

JPEG compression/ median filtering(+ anti-forensics)

with a replacement rate

composite image forgery

Wei FAN 11 / 50


Preliminaries





0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1

0

0.2

0.4

0.6

0.8

1

False positive rate

Truepositive

rate

Random guess

Goal:


Goal:


Goal:






Wei FAN 11 / 50I Z. Wang, et al. “Image quality assessment: from error visibility to structural similarity”. IEEE TIP 13, 4 (2004),

pp. 600-612


Preliminaries





0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1

0

0.2

0.4

0.6

0.8

1

False positive rate

Truepositive

rate

Random guess

Goal:


Goal:


Goal:






Wei FAN 11 / 50I S. Kullback and R. A. Leibler. “On information and sufficiency”. Annals of Mathematical Statistics 22, 1 (1951),

pp. 49-86


1 Introduction

2 JPEG Anti-ForensicsTV-based JPEG deblockingPerceptual DCT histogram smoothingUsing a sophisticated image model

3 Median Filtering Anti-Forensics

4 Conclusions & Perspectives

Wei FAN 12 / 50


JPEG Artifacts

Blocking artifacts

DCT coefficient value

DCT

coeffi

cientfrequen

cy

−300 −100 100 3000

0.02

0.04

0.06


DCT

coeffi

cientfrequen

cy

−300 −100 100 3000

0.2

0.4

0.6

0.8

Comb-like quantization artifactsWei FAN 13 / 50


1. TV-Based JPEG Deblocking

Image Total VariationPixel classification:

A: shaded pixels

B: the other pixels

For original image:variation (A) ≈ variation (B)

Total Variation (TV)Simple, but effective image modelWidely used in image denoising, JPEG post-processing, etc.Here, to measure “blocking”, by pixel classification

Wei FAN 14 / 50



TV-Based JPEG Anti-ForensicsDeblocking

arg minU∈ S︸︷︷︸

constraint image space

TV︷︸︸︷∑

1≤i≤H ,1≤j≤W υi,j +α

∣∣∣∣∣∑Ui,j∈A υi,j −∑

Ui,j∈B υi,j

∣∣∣∣∣︸︷︷︸TV-based blocking measurement

TV, image prior

TV-based blocking measurement, deblocking

De-Calibrationarg min

U

28∑k=1

∣∣∣var(DkU)− var(DkUcal)∣∣∣

Ucal : crop the first 4 pixels of U both horizontally and vertically

Wei FAN 15 / 50

I F. Alter, et al. “Adapted total variation for artifact free decompression of JPEG images”. JMIV 23, 2 (2005),pp. 199-211

I S. Lai and R. Bohme, “Countering counter-forensics: the case of JPEG compression,” In: Proc. IH, 2011, pp.285-298



Experimental Results

False positive rate

Truepositiverate

0 0.2 0.4 0.6 0.8 10

0.2

0.4

0.6

0.8

1

KF

KLuo

KQLuo

KV

KL

K1U

K2U

Random guess

False positive rate

Truepositiverate

0 0.2 0.4 0.6 0.8 10

0.2

0.4

0.6

0.8

1

KF

KLuo

KQLuo

KV

KL

K1U

K2U

Random guess

False positive rate

Truepositiverate

0 0.2 0.4 0.6 0.8 10

0.2

0.4

0.6

0.8

1

KF

KLuo

KQLuo

KV

KL

K1U

K2U

Random guess

J , JPEG FJSqSb

, state-of-the-art FJ0 , proposed

J FJSqSb

FJ0

PSNR [dB] 37.0999 30.4591 35.4814SSIM 0.9919 0.9509 0.9843

SummaryFJ

0 has a PSNR gain of 5 dBover FJ

SqSb

The quality of FJ0 is slightly less

good than JROC curves achieved by FJ

0 arethe closest to the random guess

Wei FAN 16 / 50I M. C. Stamm and K. J. R. Liu. “Anti-forensics of digital image compression”. IEEE TIFS 6, 3 (2011), pp.

1050-1065



Example Results

— PSNR = 30.2841 dB PSNR = 26.4496 dB PSNR = 29.8084 dB


DCT

coeffi

cientfrequency

−300 −200 −100 0 100 200 3000

0.01

0.02

0.03

0.04


DCT

coeffi

cientfrequen

cy

−300 −200 −100 0 100 200 3000

0.1

0.2

0.3


DCT

coeffi

cientfrequency

−300 −200 −100 0 100 200 3000

0.01

0.02

0.03


DCT

coeffi

cientfrequency

−300 −200 −100 0 100 200 3000

0.02

0.04

0.06

I, original J , JPEG FJSqSb , state-of-the-art FJ

0 , proposed


1050-1065



Potential Weakness in DCT Histogram


DCTcoeffi

cientfrequency

−100 −50 0 50 1000

0.02

0.04

0.06

0.08

FJSqSb , state-of-the-art


DCTcoeffi

cientfrequency

−150 −100 −50 0 50 100 1500

0.04

0.08

0.12

FJ0 , proposed

Usually happens for FJ0 in the mid-frequency subbands.


1050-1065


2. Perceptual DCT Histogram Smoothing

Improved JPEG Anti-Forensics withPerceptual DCT Histogram Smoothing


DCTcoeffi

cientfrequency

−150 −100 −50 0 50 100 1500

0.04

0.08

0.12

FJ0

J first-roundTV-based deblocking

perceptual DCThistogram smoothing

second-roundTV-based deblockingde-calibrationFJ

FJb

FJbq

FJbqb

Handle JPEG artifacts separately in spatial and DCT domainsSlightly different parameter settings for TV-based deblocking

Wei FAN 19 / 50



Disadvantages of Global Laplacian inModeling DCT Coefficient


DCT

coeffi

cientfrequen

cy

−150 −100 −50 0 50 100 1500

0.04

0.08

0.12

0.16

Kurtosis of the Laplacian distribution: 6

Average kurtosis of AC components ofUCID images: 19.99� 6

93.68% of AC components have kurtosisvalue higher than 6

Robertson and Stevenson’s ConclusionQuantization bin 0: Laplacian distributionOther bins: uniform distribution

Wei FAN 20 / 50I M. A. Robertson and R. L. Stevenson. “DCT quantization noise in compressed images”. IEEE TCSVT 15, 1

(2005), pp. 27-38



After First-Round TV-Based Deblocking


DCT

coeffi

cientfrequen

cy

−150 −100 −50 0 50 100 1500

0.2

0.4

0.6

J , JPEGDCT coefficient value

DCT

coeffi

cientfrequen

cy

−150 −100 −50 0 50 100 1500

0.04

0.08

0.12

0.16

FJb , deblocked

Comb-like quantization artifacts are partly removedBut gaps still remain to some extent

Wei FAN 21 / 50



Adaptive Local Laplacian Model

1 Find the parameter λb of the Laplacian distribution for eachquantization bin

2 If not possible, use the uniform distribution

Finding λb

λb = arg minλ−b ≤λ≤λ

+b

B+r,cQr,c+

⌊Qr,c

2

⌋∑

k=B−r,cQr,c−⌊

Qr,c2

⌋wk ×(H X

r ,c(k)− P(Y = k))2

Wei FAN 22 / 50



Perceptual DCT Histogram Mapping


DCT

coeffi

cientfrequen

cy

−150 −100 −50 0 50 100 1500

0.02

0.04

0.06

0.08

0.1

Distribution target

Minimize the total SSIM value loss

Assignment Problem (for each quantization bin b)

∑o∈Ob

weight function W : Ob × Tb → R︷︸︸︷W (o, f︸︷︷︸bijection f : Ob → Tb

(o))

Ob: the to-be-modified DCT coefficientsof FJ

b

T b: target DCT coefficients values inthe dithered histogram

Wei FAN 23 / 50



Example Results

J , SSIM = 0.9809 FJV , SSIM = 0.9509

FJSq , SSIM = 0.9610 FJ

bq, SSIM = 0.9731

Summary

Less noise present in FJbq

Especially advantageousfor FJ

bq in the relativelysmooth image areas

I G. Valenzise, et al. “The cost of JPEGcompression anti-forensics”. In: Proc.ICASSP. 2011, pp. 1884-1887

I M. C. Stamm and K. J. R. Liu. “Anti-forensics of digital image compression”.IEEE TIFS 6, 3 (2011), pp. 1050-1065

Wei FAN 24 / 50



Histogram Recovery Comparison — FJSq vs. FJ

bq

Difference of KL divergence values:

r c 1 2 3 4 5 6 7 81 0.0001 0.0065 0.0118 0.0278 0.0493 0.0634 0.0663 0.06562 0.0042 0.0166 0.0229 0.0363 0.0447 0.0565 0.0504 0.03693 0.0161 0.0208 0.0291 0.0442 0.0573 0.0665 0.0634 0.04974 0.0200 0.0317 0.0409 0.0470 0.0658 0.0802 0.0553 0.04465 0.0357 0.0395 0.0522 0.0678 0.0764 0.0930 0.0927 0.08566 0.0441 0.0383 0.0642 0.0610 0.0726 0.0769 0.0806 0.09577 0.0538 0.0442 0.0678 0.0595 0.0879 0.0809 0.0948 0.09758 0.0619 0.0545 0.0697 0.0528 0.0927 0.0880 0.0854 0.0722

Average: 0.0552, standard deviation: 0.0249

FJbq constantly outperforms FJ

Sq


1050-1065



Histogram Recovery Comparison — FJSq vs. FJ

bq


r c 1 2 3 4 5 6 7 81 0.0001 0.0065 0.0118 0.0278 0.0493 0.0634 0.0663 0.06562 0.0042 0.0166 0.0229 0.0363 0.0447 0.0565 0.0504 0.03693 0.0161 0.0208 0.0291 0.0442 0.0573 0.0665 0.0634 0.04974 0.0200 0.0317 0.0409 0.0470 0.0658 0.0802 0.0553 0.04465 0.0357 0.0395 0.0522 0.0678 0.0764 0.0930 0.0927 0.08566 0.0441 0.0383 0.0642 0.0610 0.0726 0.0769 0.0806 0.09577 0.0538 0.0442 0.0678 0.0595 0.0879 0.0809 0.0948 0.09758 0.0619 0.0545 0.0697 0.0528 0.0927 0.0880 0.0854 0.0722

all positive

Average: 0.0552, standard deviation: 0.0249

FJbq constantly outperforms FJ

Sq


1050-1065



Forensic Undetectability

False positive rate

Truepositiverate

0 0.2 0.4 0.6 0.8 10

0.2

0.4

0.6

0.8

1

KF

KLuo

KQLuo

KV

KL

K1U

K2U

Random guess

FJ

Replacement rate

AUC

0 0.1 0.2 0.3 0.4 0.5 0.6 0.8 10.5

0.6

0.7

0.8

0.9

1

J

FJSq

FJSqSb

FJV

FJSu

FJ0

FJ

KS100Li

Replacement rate

AUC

0 0.1 0.2 0.3 0.4 0.5 0.6 0.8 10.5

0.6

0.7

0.8

0.9

1

J

FJSq

FJSqSb

FJV

FJSu

FJ0

FJ

KS686P

Scalar-based detectors:ROC curves achieved by FJ are close to the random guess

SVM-based detectors:At low image replacement rate: good undetectabilityFJ outperforms the state-of-the-art anti-forensic JPEG images

Wei FAN 26 / 50



Forensic Undetectability

False positive rate

Truepositiverate

0 0.2 0.4 0.6 0.8 10

0.2

0.4

0.6

0.8

1

KF

KLuo

KQLuo

KV

KL

K1U

K2U

Random guess

FJ

Replacement rate

AUC

0 0.1 0.2 0.3 0.4 0.5 0.6 0.8 10.5

0.6

0.7

0.8

0.9

1

J

FJSq

FJSqSb

FJV

FJSu

FJ0

FJ

KS100Li

Replacement rate

AUC

0 0.1 0.2 0.3 0.4 0.5 0.6 0.8 10.5

0.6

0.7

0.8

0.9

1

J

FJSq

FJSqSb

FJV

FJSu

FJ0

FJ

KS686P

Scalar-based detectors:ROC curves achieved by FJ are close to the random guess

SVM-based detectors:At low image replacement rate: good undetectabilityFJ outperforms the state-of-the-art anti-forensic JPEG images

FJ FJ

Wei FAN 26 / 50



Example Results

I, — J , PSNR = 31.8094 dB FJSq Sb

, PSNR = 26.9808 dB FJ , PSNR = 31.5878 dB


DCT

coeffi

cientfrequen

cy

−400 −300 −200 −100 0 100 200 300 4000

0.01

0.02

0.03

0.04


DCT

coeffi

cien

tfreq

uen

cy

−80 −60 −40 −20 0 20 40 60 800

0.05

0.1

0.15

0.2

0.25


DCT

coeffi

cien

tfreq

uen

cy

−60 −40 −20 0 20 40 600

0.05

0.1

0.15

0.2

0.25

0.3

0.35


DCT

coeffi

cien

tfreq

uen

cy

−15 −10 −5 0 5 10 150

0.05

0.1

0.15

0.2

0.25

0.3

0.35

(2, 2) (6, 4) (3, 7) (8, 8)


1050-1065



Application: Disguising Non-Aligned DoubleJPEG Compression

QF2

AUC

50 60 70 80 90 1000.5

0.6

0.7

0.8

0.9

1NA-DJPG-TNA-DJPG-S

NA-DJPG-SS

NA-DJPG-V

NA-DJPG-SuNA-DJPG-F0

NA-DJPG-F

-T -S -SS -V -Su -F0 -FPSNR [dB] 34.6098 32.7958 30.2825 32.4824 30.9379 33.8345 34.0929

SSIM 0.9319 0.8650 0.8487 0.8864 0.8898 0.9168 0.9222

without perceptual DCThistogram smoothing

with perceptual DCThistogram smoothing

Wei FAN 28 / 50I T. Bianchi and A. Piva. “Detection of nonaligned double JPEG compression based on integer periodicity maps”.

IEEE TIFS 7, 2 (2012), pp. 842-848








−60

−40

−20

0

20

without anti-forensics

−30

−20

−10

0

10

with anti-forensics


3 (2012), pp. 1003-1017


3. Using A Sophisticated Image Model

JPEG Image Quality Enhancement

AssumptionsJPEG compression: y = x + nq

nq : a random quantity, 0-mean multivariate Gaussiannq and x are independent

MAP criterionx = arg max

xp(x|y) = arg max

xp(y|x)p(x) = arg max

xp(nq)p(x)

Wei FAN 30 / 50I M. A. Robertson and R. L. Stevenson. “DCT quantization noise in compressed images”. IEEE TCSVT 15, 1

(2005), pp. 27-38



Proposed Optimization Problem

ModelsImage prior: GMM (Gaussian Mixture Model)

Framework: Expected Patch Log Likelihood (EPLL)

Cost Function

arg minu

{

regularization parameter︷︸︸︷λ

2

64∑k=1

∑Pi∈Sk︸︷︷︸

the k-th group of patch extracting matrices

(Pi(y− u))t

covariance matrix for the k-th kind of patch︷︸︸︷C−1

k Pi(y− u)

−∑

ilog p(the i-th overlapping patch︷︸︸︷

Piu)}

Wei FAN 31 / 50I D. Zoran and Y. Weiss. “From learning models of natural image patches to whole image restoration”. In: Proc.

ICCV. 2011, pp. 479-486






Cost Function

arg minu

{


2

64∑k=1



(Pi(y− u))t


k Pi(y− u)

−∑


Piu)}

JPEG compression model


ICCV. 2011, pp. 479-486






Cost Function

arg minu

{


2

64∑k=1



(Pi(y− u))t


k Pi(y− u)

−∑


Piu)}

JPEG compression model

Image prior using GMM under EPLL


ICCV. 2011, pp. 479-486



Experimental Results (PSNR [dB])

JPEG image FoE-based Proposed

LenaQ1 30.71 31.95 32.06Q2 30.08 31.44 31.48Q3 27.45 28.83 28.94

PeppersQ1 30.72 32.04 32.09Q2 30.17 31.61 31.59Q3 27.66 29.35 29.40

BarbaraQ1 25.95 26.65 26.94Q2 25.60 26.31 26.56Q3 24.05 24.86 25.00

BaboonQ1 24.32 24.77 24.84Q2 24.14 24.62 24.68Q3 22.14 22.61 22.61

Competitive in PSNR gain Around ten times faster

Wei FAN 32 / 50I D. Sun and W.-K. Cham, “Postprocessing of low bit-rate block DCT coded images based on a fields of experts

prior,” IEEE TIP, 2007



Calibration-Based DCT Histogram Smoothing

J(quality factor q)

IJquality enhancement

IJc

crop by 1 pixel (calibration)

(→ ↓)

Jc

JPEGcom

pression

qualityfactor

q

NqDCT coefficient

subtraction

FJc

DCT coefficientsummation

Calibration:Translation invarianceCropping breaks the 8× 8 block structureNon-parametric DCT quantization noise estimation

Wei FAN 33 / 50



Histogram Recovery Comparison — FJbq vs. FJ

c


r c 1 2 3 4 5 6 7 81 −0.0081 −0.0001 0.0096 0.0121 0.0075 0.0126 0.0171 −0.02652 0.0037 0.0081 0.0127 0.0025 −0.0013 0.0201 0.0056 −0.03933 0.0171 0.0120 0.0098 −0.0036 −0.0062 −0.0050 −0.0099 −0.06634 0.0133 0.0046 −0.0013 −0.0110 −0.0194 −0.0086 −0.0097 −0.07085 0.0106 0.0022 −0.0037 −0.0159 −0.0291 −0.0237 −0.0591 −0.11736 0.0090 0.0114 −0.0104 −0.0179 −0.0323 −0.0253 −0.0692 −0.12297 0.0353 0.0223 −0.0124 −0.0079 −0.0660 −0.0690 −0.0936 −0.10678 −0.0050 −0.0332 −0.0730 −0.0720 −0.1385 −0.1372 −0.1235 −0.0357

FJc outperforms FJ

bq in low-frequency DCT subbandsThe calibration-based DCT histogram smoothing is faster

Wei FAN 34 / 50



Proposed JPEG Anti-ForensicsRemove introduced extraunnatural noise

JPEG anti-forensic purposes

Cost Function

arg minu

{


2 ‖u− y‖2 +regularization parameter︷︸︸︷

α × ι(u)︸︷︷︸TV of u

+regularization parameter︷︸︸︷

β28∑

k=1

7∑c=0| νk(calibrated image by c pixels︷︸︸︷

uc )︸︷︷︸variance of subband k

− σ2k︸︷︷︸

estimated variance from FJc

|

+∑

i

regularization parameter︷︸︸︷γ

2 ‖Piu− zi‖2 − log p(auxiliary variable for “Half Quadratic Splitting”︷︸︸︷

zi )}

Wei FAN 35 / 50





Cost Function

arg minu

{





β28∑

k=1



− σ2k︸︷︷︸


|

+∑

i



zi )}

Image fidelity to JPEG image

Wei FAN 35 / 50





Cost Function

arg minu

{





β28∑

k=1



− σ2k︸︷︷︸


|

+∑

i



zi )}

Image fidelity to JPEG imageAnti-forensic terms

Wei FAN 35 / 50





Cost Function

arg minu

{





β28∑

k=1



− σ2k︸︷︷︸


|

+∑

i



zi )}

Image fidelity to JPEG imageAnti-forensic terms

Image prior +“Half Quadratic Splitting”

Wei FAN 35 / 50




False positive rate

Truepositiverate

0 0.2 0.4 0.6 0.8 10

0.2

0.4

0.6

0.8

1

KF

KLuo

KQLuo

KV

KL

K1U

K2U

Random guess

FJ0 , TV deblk.

False positive rate

Truepositiverate

0 0.2 0.4 0.6 0.8 10

0.2

0.4

0.6

0.8

1

KF

KLuo

KQLuo

KV

KL

K1U

K2U

Random guess

FJ , TV deblk. + DCT hist. smth.

False positive rate

Truepositiverate

0 0.2 0.4 0.6 0.8 10

0.2

0.4

0.6

0.8

1

KF

KLuo

KQLuo

KV

KL

K1U

K2U

Random guess

FJ1 , GMM + calibration

KF KLuo KQLuo KV KL K1

U K2U PSNR [dB] SSIM

J 0.9991 1.0000 0.9996 0.9976 0.9811 0.9860 0.8840 37.0999 0.9919FJ

Sq Sb0.3783 0.0806 0.6288 0.8337 0.5338 0.6309 0.4854 30.4591 0.9509

IJ 0.9997 0.9982 0.9528 0.7851 0.9698 0.9878 0.8779 37.8930 0.9927FJ

c 0.9994 0.8147 0.5949 0.7383 0.9868 0.9868 0.8944 35.3209 0.9876FJ

1 0.5522 0.7291 0.3594 0.7394 0.5272 0.7750 0.5787 35.2568 0.9832FJ

0 0.6756 0.6046 0.5194 0.6210 0.4490 0.6772 0.5880 35.4814 0.9843FJ 0.5398 0.6425 0.4598 0.6159 0.4344 0.5894 0.5317 35.9855 0.9866

Wei FAN 36 / 50



Example Results

I, — J , PSNR = 33.3476 dB FJSq Sb

, PSNR = 29.9070 dB FJ1 , PSNR = 32.4401 dB


DCT

coeffi

cientfrequency

−200 −100 0 100 2000

0.04

0.08

0.12

0.16


DCT

coeffi

cientfrequen

cy

−100 −50 0 50 1000

0.1

0.2

0.3


DCT

coeffi

cientfrequency

−30 −20 −10 0 10 20 300

0.1

0.2

0.3


DCT

coeffi

cientfrequency

−10 −5 0 5 100

0.2

0.4

0.6

(2, 2) (1, 6) (7, 4) (8, 8)


1050-1065


1 Introduction

2 JPEG Anti-Forensics

3 Median Filtering Anti-ForensicsVariational image deconvolution frameworkQuality enhancement & anti-forensics

4 Conclusions & Perspectives

Wei FAN 38 / 50


Median Filtering “Streaking” Artifacts

Smoother local image neighborhood

[84 96 97 8184 85 87 7881 81 88 8584 80 91 84

]

[84 87 87 8982 85 85 8881 84 85 8880 84 84 88

]


[84 96 97 8184 85 87 7881 81 88 8584 80 91 84

]

[84 87 87 8982 85 85 8881 84 85 8880 84 84 88

]


[84 96 97 8184 85 87 7881 81 88 8584 80 91 84

]

[84 87 87 8982 85 85 8881 84 85 8880 84 84 88

]Pixel value difference

Frequency

−200 −100 0 100 2000

0.1

0.2

0.3

Pixel value difference

Frequency

−200 −100 0 100 2000

0.1

0.2

0.3

Smaller pixel value differenceWei FAN 39 / 50I A. C. Bovik. “Streaking in median filtered images”. IEEE TASSP 35, 4 (1987), pp. 493-503


Image Variational Deconvolution Framework

Median Filtering Process

Convolution Kernel Matrix

Ψk =

ψk1 ψk

4 ψk7

ψk2 ψk

5 ψk8

ψk3 ψk

6 ψk9

, with ψkk = 1 and ψk

i = 0 for ∀i 6= k,i, k ∈ {1, 2, · · · , 9},

Simplification

ΨDBM =

[0.0930 0.1076 0.09270.1109 0.1921 0.11090.0926 0.1074 0.0929

]ΨAVE =

[0.1111 0.1111 0.11110.1111 0.1111 0.11110.1111 0.1111 0.1111

]

ΨGAU =

[0.0113 0.0838 0.01130.0838 0.6193 0.08380.0113 0.0838 0.0113

]

Wei FAN 40 / 50

I H.-D. Yuan. “Blind forensics of median filtering in digital images”. IEEE TIFS 6, 4 (2011), pp. 1335-1345I D. Krishnan, et al. “Blind deconvolution using a normalized sparsity measure”. In: Proc. CVPR. 2011, pp.

233-240



Pixel Value Difference

Pixel value difference

Frequency

−300 −100 100 3000

0.1

0.2

0.3

Observed dataFitted p.m.f. curve

IPixel value difference

Frequency

−300 −100 100 3000

0.1

0.2

0.3

Observed data

M

Generalized Gaussian Distribution

f (d) = β

2αΓ(1/β)e−(|d|/α)β

Wei FAN 41 / 50I D. Krishnan and R. Fergus. “Fast image deconvolution using hyper-Laplacian priors”. In: Proc. NIPS. 2009, pp.

1033-1041




Cost Function

arg minu

λ2

median filtering approximation︷︸︸︷‖Ku− y‖22 +ω ‖u− y‖22︸︷︷︸

close to MF image

+

histogram regularization︷︸︸︷∑Jj=1

∥∥∥Fjuαj

∥∥∥βj

βj

Spatially homogenous kernel for approximation

Image fidelity to the median filtered image

Image prior

Wei FAN 42 / 50I D. Krishnan, et al. “Blind deconvolution using a normalized sparsity measure”. In: Proc. CVPR. 2011, pp.

233-240


Quality Enhancement & Anti-Forensics

Median Filtered Image Quality Enhancement

Original, — Noised (3%)PSNR = 20.8403 dB

Median filteredPSNR = 25.1402 dB

Quality enhancedPSNR = 26.5970 dB

Noise density 1% 3% 5% 7%PSNR [dB] SSIM PSNR [dB] SSIM PSNR [dB] SSIM PSNR [dB] SSIM

Noised 25.1365 0.8308 20.3642 0.6388 18.1466 0.5327 16.6851 0.4632Median filtered 37.1336 0.9827 36.7957 0.9818 36.4031 0.9807 35.8924 0.9793

Quality enhanced 38.0723 0.9892 37.5155 0.9876 36.7914 0.9850 35.7542 0.9803

Parameter setting: ω = 0.4, λ = 1000, γ = 1200

Wei FAN 43 / 50



Median Filtering Anti-Forensics

Pixel Value PerturbationReduce the occurrences of ‘0’ in the first-order pixel differenceMinor image quality sacrifice

Triple Pair

Apply pixel value perturbation before deconvolutionParameter setting: ω = 0.1, λ = 1500, γ = 500

Wei FAN 44 / 50




False positive rate

Truepositiverate

0 0.2 0.4 0.6 0.8 10

0.2

0.4

0.6

0.8

1

KK

KK

KC

KY

Random guess

False positive rate

Truepositiverate

0 0.2 0.4 0.6 0.8 10

0.2

0.4

0.6

0.8

1

KK

KK

KC

KY

Random guess

False positive rate

Truepositiverate

0 0.2 0.4 0.6 0.8 10

0.2

0.4

0.6

0.8

1

KK

KK

KC

KY

Random guess

False positive rate

Truepositiverate

0 0.2 0.4 0.6 0.8 10

0.2

0.4

0.6

0.8

1

KK

KK

KC

KY

Random guess

M, median filtered FMW , state-of-the-art FM

D , state-of-the-art FM , proposed

Image quality Anti-forensic performance KL divergencePSNR [dB] SSIM KK KK KC KY f1 f2 f3 f4

M 37.2847 0.9831 0.9722 0.9824 0.9938 0.9984 0.1632 0.1611 0.0775 0.0753Mp 38.0580 0.9897 0.7974 0.8587 0.8429 0.8080 0.0925 0.0880 0.0475 0.0437FM

W 33.6033 0.9552 0.4592 0.6586 0.6668 0.3336 0.1148 0.1338 0.0619 0.0689FM

D 33.4272 0.9714 0.5347 0.4635 0.7479 0.6518 0.0547 0.0563 0.0383 0.0389FM 37.5184 0.9901 0.5595 0.5061 0.6490 0.5886 0.0484 0.0449 0.0272 0.0238

Better undetectability Higher image quality (even w.r.t. M)Lower KL divergence values

Wei FAN 45 / 50I Z.-H. Wu, et al. “Anti-forensics of median filtering”. In: ICASSP. 2013, pp. 3043-3047I D. T. Dang-Nguyen, et al. “Counter-forensics of median filtering”. In: MMSP. 2013, pp. 260-265



Against SVM-Based Detectors

Replacement rate

AUC

0 0.1 0.2 0.3 0.4 0.5 0.6 0.8 10.5

0.6

0.7

0.8

0.9

1

M

FM

W

FM

D

FM

Replacement rate

AUC

0 0.1 0.2 0.3 0.4 0.5 0.6 0.8 10.5

0.6

0.7

0.8

0.9

1

M

FM

W

FM

D

FMKS686SPAM KS44

MFF

Replacement rate

AUC

0 0.1 0.2 0.3 0.4 0.5 0.6 0.8 10.5

0.6

0.7

0.8

0.9

1

M

FM

W

FM

D

FM

Replacement rate

AUC

0 0.1 0.2 0.3 0.4 0.5 0.6 0.8 10.5

0.6

0.7

0.8

0.9

1

M

FM

W

FM

D

FM

Replacement rate

AUC

0 0.1 0.2 0.3 0.4 0.5 0.6 0.8 10.5

0.6

0.7

0.8

0.9

1

M

FM

W

FM

D

FMKS56GLF KS10

AR KS220LTP

FM FM

FM FM FM

Wei FAN 46 / 50

I T. Pevny, et al. “Steganalysis by subtractive pixel adjacency matrix”. IEEE TIFS 5, 2 (2010), pp. 215-224I H.-D. Yuan. “Blind forensics of median filtering in digital images”. IEEE TIFS 6, 4 (2011), pp. 1335-1345I C. Chen, et al. “Blind detection of median filtering in digital images: a difference domain based approach”. IEEE

TIFS 22, 12 (2013), pp. 4699-4710I X. Kang, et al. “Robust median filtering forensics using an autoregressive model”. IEEE TIFS 8, 9 (2013), pp.

1456-1468I Y. Zhang, et al. “Revealing the traces of median filtering using high-order local ternary patterns”. IEEE Signal

Processing Letters 21, 3 (2014), pp. 275-280



Application: JPEG Deblocking

Image quality Anti-forensic performancePSNR [dB] SSIM KF K1

U K2U KK KK KC KY

J 42.9742 0.9975 0.9930 0.9871 0.8937 0.3895 0.2699 0.3990 0.4985Jm 37.0888 0.9830 0.6128 0.7151 0.5288 0.9659 0.9786 0.9924 0.9986J w 33.5111 0.9549 0.6321 0.5709 0.5363 0.4109 0.6061 0.6369 0.3225J d 33.3101 0.9711 0.4945 0.6255 0.5274 0.5035 0.4256 0.7230 0.6489J f 37.2413 0.9894 0.6003 0.5168 0.4754 0.5137 0.4489 0.6244 0.5976

High image qualityGood forensic undetectability against both JPEG blocking / medianfiltering forensic detectors

Wei FAN 47 / 50


I Z.-H. Wu, et al. “Anti-forensics of median filtering”. In: ICASSP. 2013, pp. 3043-3047I D. T. Dang-Nguyen, et al. “Counter-forensics of median filtering”. In: MMSP. 2013, pp. 260-265


Conclusions

1 A new research line of designing imageanti-forensics via image restoration

2 JPEG anti-forensics using TV-baseddeblocking

3 Perceptual DCT histogram smoothing

4 Leveraging on a sophisticated imageprior model and calibration:

JPEG image quality enhancement

Non-parametric DCT quantizationnoise estimation

5 Median filtered image quality en-hancement and anti-forensics via vari-ational deconvolution

I Wei Fan, Kai Wang, Francois Cayre, and Zhang Xiong,“A variational approach to JPEG anti-forensics”, InProc. of the IEEE International Conference on Acous-tics, Speech, and Signal Processing (ICASSP), Vancou-ver, Canada, pp. 3058-3062, 2013.

I Wei Fan, Kai Wang, Francois Cayre, and Zhang Xiong,“JPEG anti-forensics with improved tradeoff betweenforensic undetectability and image quality”, IEEE Trans-actions on Information Forensics and Security, vol. 9,no. 8, pp. 1211-1226, 2014.

I Wei Fan, Kai Wang, Francois Cayre, and Zhang Xiong,“JPEG anti-forensics using non-parametric DCT quanti-zation noise estimation and natural image statistics”, InProc. of the ACM International Workshop on Informa-tion Hiding and Multimedia Security (ACM IHMMSec),Montpellier, France, pp. 117-122, 2013. (Best PaperAward)

I Wei Fan, Kai Wang, Francois Cayre, and Zhang Xiong,“Median filtered image quality enhancement and anti-forensics via variational deconvolution”, IEEE Transac-tions on Information Forensics and Security, vol. 10, no.5, pp. 1076-1091, 2015.

Wei FAN 48 / 50

I Wei Fan, Kai Wang, Francois Cayre, and Zhang Xiong, “3-D lighting-based image forgery detection using shape-from-shading”, In Proc. of the European Signal Processing Conference (EUSIPCO), Bucharest, Romania, IEEE,pp. 1777-1781, 2012.


Conclusions

1 A new research line of designing imageanti-forensics via image restoration

2 JPEG anti-forensics using TV-baseddeblocking

3 Perceptual DCT histogram smoothing

4 Leveraging on a sophisticated imageprior model and calibration:

JPEG image quality enhancement

Non-parametric DCT quantizationnoise estimation

5 Median filtered image quality en-hancement and anti-forensics via vari-ational deconvolution

I Wei Fan, Kai Wang, Francois Cayre, and Zhang Xiong,“A variational approach to JPEG anti-forensics”, InProc. of the IEEE International Conference on Acous-tics, Speech, and Signal Processing (ICASSP), Vancou-ver, Canada, pp. 3058-3062, 2013.

I Wei Fan, Kai Wang, Francois Cayre, and Zhang Xiong,“JPEG anti-forensics with improved tradeoff betweenforensic undetectability and image quality”, IEEE Trans-actions on Information Forensics and Security, vol. 9,no. 8, pp. 1211-1226, 2014.

I Wei Fan, Kai Wang, Francois Cayre, and Zhang Xiong,“JPEG anti-forensics using non-parametric DCT quanti-zation noise estimation and natural image statistics”, InProc. of the ACM International Workshop on Informa-tion Hiding and Multimedia Security (ACM IHMMSec),Montpellier, France, pp. 117-122, 2013. (Best PaperAward)

I Wei Fan, Kai Wang, Francois Cayre, and Zhang Xiong,“Median filtered image quality enhancement and anti-forensics via variational deconvolution”, IEEE Transac-tions on Information Forensics and Security, vol. 10, no.5, pp. 1076-1091, 2015.

Lessons Learned

1 Better image anti-forensicmethods are designed

2 Current forensic methodsare not that reliable

3 Natural image statistics isimportant

Wei FAN 48 / 50

I Wei Fan, Kai Wang, Francois Cayre, and Zhang Xiong, “3-D lighting-based image forgery detection using shape-from-shading”, In Proc. of the European Signal Processing Conference (EUSIPCO), Bucharest, Romania, IEEE,pp. 1777-1781, 2012.


Perspectives

Short Term

Anti-forensic JPEG image with better quality than the JPEG image

Other image anti-forensic methods leveraging on image restoration

Anti-forensics on other digital media, e.g., video

Long Term

Universal image anti-forensics

Open Questions

A single step attack for JPEG anti-forensics?Estimation of the spatially heterogeneous convolution kernel for me-dian filtering?Anti-forensic image, as a whole, against machine learning basedforensic detectors?

Wei FAN 49 / 50


Thank you for your attention!

Q & A

Wei FAN 50 / 50

towards digital image anti-forensics via image restorationwei.fan/documents/slides_defense... ·...

Documents