Passive detection of copy-paste forgery between JPEG images

JCentSouth Univ(2012)19：2839285 1 DoI：l01007sl177l一012一l 3505 Passive detection of copypaste forgery between JPEG images LI Xianghua(香7匕 ZttAO Yuqian(0 前) ，LIAO Miao() ，FY_Shih ，Y Q，Shi 垒Springer 1School ofCivil Enginecring，Central South University，Changsha 410083，China； 2School ofGeoscienccs and lnfoPhysics，Central South University，Changsha 410083，China； 3Computing Sciences，New Jersey Institute of Technology，Newark NJ 07 1 02，USA； 4Electrical and Computer Engineering，New Jersey Institute of Technology，Newark NJ 07 1 02，USA Central South University Press and SpringerVerlag Berlin Heidelberg 20 1 2 Abstract：A blind digita1 jmage forensic method f0r detecting copypaste forgery between JPEG images was proposed I、vo copypaste tampering scenarios were introduced at first：the tampered image was saved in an uncompressed format or in a JPEG compressed formatThen the proposed detection method was analyzed and simulated for al1 the cases ofthe two tampering scenarios The tampered region is detected by computing the averaged SHill of absolute difierence(ASAD)images between the examined image and a resaved JPEG compressed image at different quality factorsThe experimental results show the advantages of the proposed method：capability of detecting sinai1 andor multiple tampered regionssimple computationand hence fast speed in processing Key words：image forensic；JPEG compression；copypaste forgery；passive detection；tampered image；compressed image 1 Introduction The authenticity of digital images plays an important role in many fields such as：forensic investigation， criminal investigation， surveillance systems，intelligence services，disaster forecast，and journalism1The art of making an image fakery has a long historyIn the rapidly developing digital age，the image can be tampered easily without leaving perceptible tracesUndoubtedly,this brings difficulty for people to prove the trustworthiness of digital imagesTherefore， the image forensics technologies are becoming increasingly important23 Recently,many passive image forensic authenticity techniques have been developed which can be grouped into the following five categories【4：1)pixelbased techniques，2)formatbased techniques，3)camerabased techniques，4)physically based tecbniques，and 5) geometric-based techniquesThese techniques are used to identify the image sources and expose forgeries through detecting some intrinsic image regularities or some common tampering anomalies f5 JPEG is a commonly used compression standard for photographic imagesThe degree of compression can be adjusted，allowing a selectable tradeoff between storage size and image qualityJPEG is also the most common image format，used by digital cameras and other photographic image capture devicesJPEG compression iS based on block splitting and discrete cosine transforill (DCT)，so it introduces blocking artifactIn fact the blocking artifact can be regarded as a speciaI hidden watermark in JPEG imagesand tampering can be found by detecting the integrity and consistence of the special watermarkIn Ref6，the blocking artifact grid(BAG) extraction method was proposed to detect the doctored JPEG images by checking the mismatched block artifact caused by copypasted JPEG imagesIn Re7，LU0 et al presented the blocking artifact characteristics matrix (BACM)，which exhibits regular symmeica1 shape for original JPEG images，and applied it to expose digital forgeries by detecting the symmetrical change of BACM The method is only efHcient for the cropped and recompressed imagesBased on BACM，BARNI et al81 proposed two algorithms of detecting the copy-paste tampering by double JPEG detection and image segmentation But bOth of the algorithins are timeconsuming，and the segmentation could be very djfficult for some tampered images if the tampered regions cannot be segmented Successfullv11o measure the inconsistencies of blocking artifact，YE et a1 f91 presented a fast quantization table estimation algorithm based on the histogram power spectrum of DCT coefficientsBut suspicious area must be firstly selected for evaluation，which is actually difficultIn Ref f 1 01，a statistica1 model based on the generalized Benfords law Foundation item：Project(6 1 1 72 1 84)suppolled by the National Natural Science Foundation of China；Project(200902482)supposed by China Postdoctoral ScienceFoundation Specially Funded Project；Project(12JJ6062)supportedbytheNatural Science FoundationofHunanProvince，China Received date：2012-0202；Accepted date：2012-0502 Corresponding author：ZHAO Yuqian，Associate Professor，PhD；Tel：十86 89929876；Email：zhaocsuhotmail com 2840 一 ： ! ：兰 ! ! ! 三 !二三 forgery detection method is proposed for the probability distributions of the first digits of the quantized JPEG coefficients is used to detect the JPEG compression and image forensicsLIN et al1l 1 developed a method for detecting che tampered JPEG images by examining the double quantization effect hidden among the DCT coefficients，and computing the block posterior probability map(BPPM)by Bayesian approachCopymove forgery detection methods were proposed in Refs12一l6】，but they are only effective when a part of the image is copied and pasted into another part of the same imageLUO et al1 7introduced the JPEG quantization，rounding，and truncation errors to identif3，whether a bitmap image has previously been JPEG compressedto estimate the quantization steps of a JPEG image，and to detect the quantization table of a JPEG imageWANG et al1 8】proposed a tampered region localization method by employing principal component analysis(PCA)on JPEG compression noise， in which the extracted high frequency quantization noise region in the difference image between the origina1 image and JPEG compressed image is considered as the tampered regionFor digital forensics，FARID et al have conducted some pioneering works and have developed some effective methods f19-2l】In Ref2o1，JPEG ghost was proposed to detect image tamperingThis is a computationally simple technique for detecting tampered region when a JPEG compressed image with quality factor QI is inserted into an uncompressed image，and then the tampered image is saved at a JPEG compressed imagewith aqualityfactorQ2 andQ2Q1 Inspired by Re201，we propose in this work a blind digital image forensics method for detecting copy-paste forgery between JPEG images：It works for two tampering scenariosFirst，tampering is conducted between JPEG images，and the composite image is saved in an uncompressed format，such as BMP or TIF or PNG Second，tampering is done between JPEG imagesand the composite image is saved in the JPEG formatThe regionsthat are obviouslybrighter ordarkerthanthe rest in the image of averaged sum of absolute difference (ASAD)are identified as the tampered regionsAlthough the JPEG quality factor is relevant in our proposed method，the estimation of the primary quantization matrix1 0，2224is not required 2 Methodology In this section，we first introduce two copypaste image tampering scenarios and briefly review JPEG compression and decompressionThen we analyze two tampering scenarios by simulation and detect the tampered images by examplesFinally,the copy-paste 21 Tampering scenarios Copy。paste processing is a rudimentary and often primary method for digital image tamperingAs JPEG is a widely used image format in our daily lifewe discuss copy。paste tampering between JPEG images which have different JPEG quality factorsThat is，a region can be selected coming from an JPEG compressed image with a quality factor of Q1AIt is then decompressed and 1nserted into another image with the JPEG quality factor of Q1BThe composite image is then saved as either an uncompressed format(scenario I、or a JPEG compressed formatwith a qualityfactorofQ。(scenarioIi) If it is not specified，in the rest of the paper，we denote JPEG quality factor by capital letter Q，and quantization step by lower case letter qNote that the Iocations of copy and paste can be arbitrary and the above copypaste processing can also be conducted on the same image 22 Brief review about JPEG compression and decompression Prior to presenting our method，we briefly review the standard JEPG compression in the following four steps (1)A RGB color image is firstly converted to YCbCr format，containing one luminance component(Y) and two chrominance components(Cb and Cr1 (2)The image is then split into nonoverlapping blocks of 8x8 pixelsIn each block，the YCb，and Cr components undergo a DCT transform after all these pixels values being converted from unsigned to signed integers(eg，from0，255to一128，127) f3)Each DCT coefficient c is divided by a quantization step q and then rounded to its nearest integer (41 The quantized DCT coefficients for all 8x8 blocks are entropy encoded，using，say,Huffman code In step(3)，a larger quantization step g will yield a severer compression rate，which means lower quality of JPEG image，and vice versaBecause human visual system is much more sensitive to smal1 variations over lowfrequency components than to that over high frequency components，the magnitudes of the hi曲-frequency components are stored with a lower accuracy也an that of the lowfrequency componentsThe decoding of a JPEG image involves straightforwardly the inverse steps of JPEG compression：entropy decoding， inverse DCT fIDCT)and inverse JPEG quantization In our method，to detect the copypaste and the tampered regionwe first resaved the tobe detected JCentSouth Univ(2012)l9：28392851 image in JPEG format with different JPEG quality factors，and then compute the ASAD images between the to_be detected image and each resaved JPEG compressed imageFinally,we judge whether the image has been tampered and，if so，determine the tampered region by observing the generated ASAD imagesIf any region in the ASAD images turns out to be brighter or darker than the rest regions of the same ASAD image，the regmn corresponding to the image under examination is considered to be tamperedNote that in the first step of our method，after being resaved in JPEG format，the tO_be detected image undergoes another JPEG compression 2841 23 Tampering detection for Scenario 1 In this section，we introduce the simulation curves of copypaste tampering detection for Scenario I。and provide an example to illustrate how to detect the tampered region To facilitate our analysis，we obtain a sequence of coefficients(the pixel values)from a 512512 uncompressed grayscale Lena image column by column from，eg，left to right and denote these coefficients by Co We apply double JPEG compression to these coefficients with the first quantization step，g1 z，to obtain coefficients c1f，and then the second quantization step，q2f，to yield coefficients c2fWe compute the ASAD value between c2i and c1 as： sAD(f)= 512 512 厶一n=l c2 (，z)一c1 ( )I，f 0， (1) Let gl denote integers from 9 to 23 in an increment of 7，q2a=q2K=l6，and q2a一-g2 gThe solid(dash)curve ( in each graph of Fig1 shows the ASAD value between c2 ( )and c】 (c】7)as a function of q ranging from 1 to 30 in an increment of 1It can be observed that curves 6c and in each graph do not overlap except when g1n= 1 ，as shown in Fig1(b)The curve C reaches its minimum if qln(gI is integer multiples of g，and curve reaches its loca1 maximum when q is double of 1d，ie q=2q2 =1 8，as shown in Fig1(a)From Figs1(a)and fc1。we also observe another characteristic that，the difference between curves and ，denoted by d，is obvious at some quantization steps q It is observed from the above simulation that if the same 1D data sequence is quantized with two different quantization steps，one can doubly quanfize these two sequences with a series of different quantization steps and obtain two different ASAD curvesThe difference between these two ASAD curves will be rather obvious at some quantization steps used in the double quantizationThis difference indicates that the 凸 矗 尝 昙 Quantization step，q Quantization step，q Quantization step，q Fig1 ASAD between data sequence quantized by q xd(g1 ， followed quantized by q in range of1，30(The difference between curves and is denoted by ：(a)g1 =9；(b)gIn=16； (c)ql =23 quantization steps used in the first quantization for two data sequences are differentThis observation can be used for the copypaste forgery detection of scenario I Figure 2 shows the tampered image，in which a central portion，having been JPEG compressed at quality ： ：兰 ! !二 tampered since the gray values of the central region and the remaining region are distinctly different in the ASAD image 2843 24 Tampering detection for Scenario II Similar to Scenario I，we process data sequence，Co， using the following procedure：firstly they are quantized by q】 ，subsequently quantized by g2 to yield coefficients c2 ，and lastly quantized by q3i to yield coefficients c3i The ASAD value between c3f and c2f is computed as 1 512x512 VASAO ( ， There are two different cases in Scenario II：乱 s min(OIA，Olg)；and bQs_min(Q1A，Q1B) We explain the process by illustrating an example Let ql gl =1 1 and q1=23Let q2a=q2fl be integers from 7 to 1 5 in an increment of 4，and q3 q3 g be integers from 1 to 30 in an increment of 1In Fig3，the solid (dashed)curve。【( shows the ASAD value between c3 (c3p)and c2 (c3)as a function of qIt is observed that both ASAD values in each graph reach their minima VASAD=0 when gI is integer multiples of qMost importantly,the difference between CHIVES仅and is obvious at some quantization steps g，such as from 20 to 30 in Figs3(a)and(b)，and from 25 to 30 in Fig3(c) The difference between curves d and reaches its maximum at g。二23 as shown in Fig3(b)，which is mainly because the quantization step qlJ(=23)is nearly doubled asthatofq2p(=11) Figure 4(a)shows the tampered image，which was produced by inserting a region from an image with JPEG quality factor of Q1A 85 into the central portion of another image with JPEG quality factor of Q1B=55，and saving the composite image at JPEG quality factor of Qs 75Shown in each subsequent panel is the ASAD image between the tampered image and a resaved JPEG compressed image at different quality factors Qrs changing from 30 to 60 in an increment of 5Figure 4 clearly indicates the evidence of copypaste tampering conducted between JPEG images Case bQ min(Q1A，Q,B) Similar to Case a，let ql 1 1，g1口 23，g2 =g2 change from 25 to 29 in an increment of 2，and q3a=q3p=q change from 1 to 30 in an increment of 1We observe from Fig5 that，in each graph，curves and almost change synchronously and overlap，and therefore，the difference between curves and is small for al1 ofthe quantization steps qTherefore，it seems prohibited to detect the tampered region in this case by the proposed method 曼 凸 矗 Quantization step，q Quantization step，q Quantization step，q Fig3 ASAD simulation curves with q2“( q2p)smaller than maximum of ql and qlfl：(a)q2 7；(b)q2 1 1；(C)q2 1 5 25 Proposed method According to the simulations， analyses and examples above，we propose the copypaste forgery detection method consisting of the following steps (1)JPEG compression We resave the tobe detected image f using JPEG quality factor of Qrs，to obtain a JPEG compressed image 尼 (1 JCentSouth Univ(2012)19：2839-2851 2845 2 暑 尝 Quantization step，q Quantization step，q Quantization step，q Fig5 ASAD simulation curves with q2 ( g larger than qld and gl口：(a)q2=25；(b)q2=27；(c)q2 29 (31 Deterrnine whether the image has experienced copy-paste tampering or not and，if so，determine the tampered region by observing the generated ASAD imageIf any region in the ASAD images tums out to be brighter or darker than the rest regions of the same ASAD image，the region corresponding to the image under examination is considered tampered f4、Repeat the above steps for another different resaved JPEG quality factor Qrs if needed In our method，the value of block size b can be arbitrarily chosenIf b is too small，the detected tampered region will not be clearly enough to differentiate it from the rest regionIfb is too largethe edge of detected tampered region will be blurry；the smaller tampered regions will be difficult to detect；and the computing time will increase remarkablyIn this paper,b is chosen as 10And we will discuss the size of b in details in the experiments 3 Experimental results and discussion We start with original uncompressed images，each of size 576x768，from Re251Each of the tampered images is obtaine