Detecting Digital Forgeries using Blind Noise Estimation Xunyu Pan, Xing Zhang and Siwei Lyu Computer Science Department University at Albany, SUNY September 29, ACM MM&Sec 2011 Buffalo, New York

Outline Motivation Related Works Detection Method Experimental Results Discussion and Future Work

Image Splicing Photoshop Photo Credit: Liu Weiqiang

Creation of Visual Effects

Motivation Image splicing and creation of visual effects are two common manipulations used in image tampering, where noise is introduced to either conceal tampering traces or changing image contents The variance of noise in a authentic images is generally uniform distributed We propose a new method to effectively expose image forgery by detecting the noise variance differences between original and tampered parts of an image

An Example of Image Splicing Forgery Original images Tampered image

Outline Motivation Related Works Detection Method Experimental Result Discussion and future work

Previous Works Determine the existence of forgery by extracting camera sensor fingerprint (e.g. PRNU) from training images and further detecting image forgery by supervised learning (SVM) Knowledge of specific camera models [Lukas, 06], [Sutcu, 07] and [Filler, 08] No extent and location of the forgery [Gou, 07] Locate image forgery using noise level difference Knowledge of the kurtosis of the adding noise and the original image [Popescu, 04] Inefficient blocks merging algorithm[Mahdian, 09]

Outline Motivation Related Works Detection Method Experimental Results Discussion and Future Work

Pipeline of the Proposed Method

Image Block Segmentation Image segmentation for local noise estimation Larger block are more stable and accurate Smaller block represents local noise more precisely We segment image into 64 × 64 pixel non-overlapping blocks in the first round detection

Image Block Segmentation 32×32 128×128 256×256 64×64 16×16 Means and standard deviations of estimated noise on 100 image blocks of various sizes by adding noise Std 25

Pipeline of the Proposed Method

Image Kurtosis Image kurtosis is the measure of the "peakedness" of the probability distribution of pixels: Suppose a white Gaussian noise of zero mean and unknown variance is added to the image to obtain an image , denote as: The kurtosis of can be computed as:

Pipeline of Noise Estimation

The Objective Function Assuming the kurtosis is scale invariant, we can estimate the kurtosis of and the variance of noise by minimizing the objective function:

Major Steps for the Noise Estimation STEP 1: Conversion from image domain to DCT domain STEP 2: Compute the variance and kurtosis for each response image STEP 3: Noise estimation by the optimization of the objective function (MATLAB fminsearch function)

Pipeline of the Proposed Method

K-means Clustering Classify all non-overlapping image blocks into k (k=2) clusters based on their noise level (1) Starting with randomly selected k means (2) Assign each block to the cluster with the closest mean (3) Compute a new mean for each cluster (4) Repeat (2) and (3) until the stopping criteria is satisfied

Initial Detection Image blocks are classified using K-means clustering algorithm Assume the tampered region is smaller than authentic region. The cluster with fewer blocks is treated as forgery False positives - complex textures: tree, grass, … Need a second round refined detection

Refined Detection Segment the detected suspicious region into 32 × 32 non-overlapping image blocks Estimate noise level for each 32 × 32 blocks keep all two clusters if their means are close enough

Outline Motivation Related Works Detection Method Experimental Results Discussion and future Work

Quantitative Testing Results We define two quantitative measure of performance based on the detection accuracy and false positives Block detection accuracy (BDA) Block false positive (BFP)

BDA and BFP

Quantitative Experiments One uncompressed color image from Kodak dataset A randomly located 192 × 192 image block is tampered with Gaussian noise of various noise levels Generate 100 images for each noise level in the range of [1, 10] (total 1000 forged images)

Quantitative Experiments Averages of BDA/BFP for 100 tampered image at each noise level σ = [1, 10 ]

Qualitative Experiments Image tampered with noise σ=5 Detection result

Qualitative Experiments Image tampered with noise σ=10 Detection result

Qualitative Experiments Image tampered with noise σ=15 Detection result

Qualitative Experiments (cont.) Detection result of our method on image splicing forgery

Qualitative Experiments (cont.) Detection result of our method on rain/snow appearance created using image noise

Qualitative Testing Results (cont.) Detection result of our method on ground glass appearance created using image noise

Outline Motivation Related Works Detection Method Experimental Results Discussion and Future work

Summary In this work, we propose a novel method for image forgery detection based on the clustering of image blocks with different noise variances Experimental results with credible forgeries show the efficacy of our method

Discussion Advantages Limitations Reliably expose image splicing or forgeries created for special visual effects No prior knowledge of the imaging device or of kurtosis of the original image Limitations Non-overlapping can not locate the extent of tampered region precisely Failure estimation in one block leads to missing tampered region

Future Work Detect noise inconsistency due to different JPEG compression qualities Improve the detection accuracy and efficacy by noise estimation on local overlapping image blocks using fast estimation method

Thank You!