A Survey of Blind Forensics Techniques for JPEG Image Tampering ()
1. Introduction
As a very important and effective information carrier in people’s life, image describes objective objects in a simple, direct and vivid way. As image processing technology becomes more advanced, tampering technology becomes more and more complex, and the tampered and forged images are more and more difficult to be detected by the human eye. If image tampering occurs in important occasions such as military politics and courts, it will inevitably have an immeasurable and harmful impact on national security and stability as well as people’s lives.
Active forensics and passive forensics are two main techniques of digital forensics. Active forensics technology refers to the technology of embedding fragile watermark or signature into digital image in advance and extracting watermark or signature for forensics. Digital image passive forensics technology, namely blind forensics technology, is a kind of technology that verifies the authenticity and source of images without relying on pre-signature or pre-embedding information extraction [1]. Compared with active forensics, passive forensics has higher application and research value, but it is more difficult to obtain evidence than active forensics. JPEG, as one of the popular image formats at present, is also the image compression standard. Its advantage is that it can still obtain better image quality with relatively high compression rate and relatively fast processing speed. Therefore, the blind forensics research on JPEG tampered images has very important significance and application prospect. This paper briefly describes the main achievements in passive forensics of JPEG image tampering. Based on the different methods of tamper and detection, the current detection methods can be divided into dual JPEG compression detection method and JPEG block effect inconsistency detection method. The performance of representative methods of two kinds of detection methods is evaluated.
2. Double JPEG Detection
2.1. Double JPEG Image Compression Principle
The double compression of JPEG image means that after the JPEG image is decompressed, it is compressed with a new quantization table and stored again. When image software is used for image tampering, after the tampering is completed, the JPEG image may be compressed again with a quality factor different from the original image compression factor, that is, the dual JPEG image compression. It should be noted that when the first compression quality factor QF1 is equal to the second compression quality factor QF2, the characteristics of the image do not change significantly, in this case, the image is not called through JPEG compression. The image double compression process is shown in Figure 1: decompression of the original JPEG image is performed first, namely decoding and inverse quantization, followed by inverse DCT transformation, and the decompression image is finally compressed for a second time.
2.2. Double-JPEG Image Blind Forensics Algorithm
Researchers have developed many blind forensics algorithms for double-JPEG tampered images. The method of locating tampering areas by estimating the first compression quantization table of images [2] [3] [4] has been studied by many scholars. Farid uses different compression factors to re-compress the JPEG images
Figure 1. Double JPEG compression process.
to be detected. When the compression factor is equal to the compression factor of the tampered area, the statistical characteristics of the tampered area have little change in the degree of distortion, thus achieving the detection of the tampered area [5]. HE realized as a JPEG image tamper with the area of automatic detection and localization, this method can detect the different synthesis methods of image, without full decompression JPEG images can work, the speed, the experimental results show that the method of JPEG image compression effect is good, especially in the compression under the condition of high quality [6]. The estimated quantization step obtained by Fridrich et al. was extracted by estimating DCT coefficient and quantization step compatibility [7]. However, this method can only detect the image tampered with BMP format saved image, JPEG dual compression format is invalid.
The detection algorithm proposed above has relatively large limitations: literature [8] proposed an algorithm that can realize automatic detection of image tampering regions. The average probability density of histogram period is used to approximate the tampering region. Bayes theorem is used to calculate the posterior probability of a certain kind of image block. On the basis of literature [8] , Duan Xintao et al. used particle swarm optimization algorithm to set an adaptive threshold to optimize the posterior probability density map, and classified and judged the threshold. Detection and separation of tampered areas were realized through the posterior probability density map [9]. Experimental results show that this method can automatically detect and extract the tampered areas quickly and accurately, and the detection results are significantly improved when the first quality factor is greater than the second quality factor.
Literature [10] [11] traverse all possible compression factors of the detected image, and try to carry out the third compression, and then analyze the degree of image distortion, which can detect the size of the original compression factor of the image to be detected. Smartphones are exploding in the market for imaging devices, with megapixels threatening traditional digital cameras. While smartphone images are widely distributed, images can be easily manipulated using a variety of photo editing tools. Therefore, smart phone image authentication and recognition after capture is an important content of digital forensics. Qingzhong Liu, et al. in order to improve the detection of pairs of JPEG compression, transplant JPEG steganographic analysis in the design of the adjacent joint density characteristics, and the joint density and DCT domain edge density characteristics of fusion, as a detector, learning classifier using edge density and adjacent joint density characteristics and identify the smartphone source and capture after operation [12].
JPEG double compressed image detection can be divided into compression detection based on different quantization and the same quantization matrix [13]. The feature classification and detection results of the specific algorithm are shown in Table 1, the recognition effect is comprehensively considered according to the detection time and detection effect described in the corresponding
Table 1. JPEG double compressed image feature classification and detection effect.
literature, which is recorded as “general”, “good” and “excellent”. In recent years, with the in-depth research of machine learning and deep learning, the method of deep learning is also applied in image forensics [24] [25] [26] [27] [28]. Literature [29] proposes a convolutional neural network detection algorithm based on double JPEG compression. Literature [30] and literature [31] respectively use naive Bayesian classifier and SVM classifier to detect and extract double JPEG compressed images. Table 2 and Table 3 are AUC values of three algorithms in literature [29] [30] and [31] respectively in two data sets. It can be concluded from the two table data that the algorithm in literature [29] is superior to the other two algorithms, especially in the case of QF2. Although the algorithm achieves good results, the computational complexity is obviously higher than the other two algorithms.
3. JPEG Block Effect Inconsistency Detection
3.1. Generation of JEPG Image Block Effect
In JPEG coding, the two-dimension DCT transformation is performed for each sub-block after partitioning. Although the computation of DCT transformation can be significantly reduced in this way, the correlation of pixel values between original sub-blocks may be ignored. In the next quantization stage, in order to achieve image compression, the quantization step size at the high frequency
Table 2. AUC values of literature [29] , literature [30] and literature [31] in the large data set.
Table 3. AUC values of references [29] [30] and [31] in the small figure data set.
position is generally larger in the quantization table. Therefore, after quantization, most of the high frequency components at the edge of each subblock will be lost, resulting in discontinuity at the boundary of the block in the decoded image, thus forming the block effect [32]. The block effect of an untampered JPEG image should be the same, but the local block effect of the tampered image will be changed, and the block effect can be detected to determine whether the image has been tampered. The quantization step will lead to the loss of a lot of information during JPEG compression, and the quantization error will be introduced during the rounding operation, denoted as e (u, v), and the quantization step can be expressed as shown in formula (1): they are unavoidable.
(1)
The reverse quantization operation is carried out at the decoding end, as shown in formula (2), the DCT coefficient after the reverse quantization is obtained:
(2)
Then DCT inverse transformation is carried out to obtain the decoded image, so that the distribution of decoding quantization error e (u, v) × Q (u, v) can be obtained in the whole decoded image. The decoding quantization error will be superimposed during the block processing of JPEG image, and then the decoding will break the correlation between each sub-block in the image, so the block-effect phenomenon is formed at the sub-block boundary.
3.2. Algorithm Based on JEPG Image Block Effect
In recent years, domestic and foreign researchers have proposed many algorithms to eliminate the block effect [33] - [38] , but these algorithms in the block effect is used to eliminate the blurred image at the same time be tampering with the evidence, so the algorithm of image block effect to eliminate only able to increase the quality of compressed image, JPEG tampering with the harsh conditions of image blind forensics has not improved. Literature [39] first proposed a fast and effective method to detect JPEG block effect, that is, if there is no compression, the difference between adjacent pixels intersecting the block boundary should be similar to the difference between adjacent pixels within the block, but the difference between adjacent pixels intersecting the block boundary will be different after JPEG compression. Figure 2 shows the difference between the pixels within each 8 × 8 block with an intersecting block boundary with a compression quality factor of 85 in Lena image, as shown in formula (3):
(3)
where (x, y) represents the coordinates of A position in each block. By calculating the histogram of
and
of 3 positions (4, 4), (2, 4) and (3, 3), the difference strength of block effect of H1 and H2 is shown in formula (4):
(4)
In this formula, H1(n) and H2(n) respectively represent the total number of bin values of n in the histogram of
and
. It can be seen that the block effect difference of JPEG image is the largest at the intersection of block boundary.
Figure 2. Example of block effect difference of JPEG image. (a) (x, y) = (4, 4); (b) (x, y) = (2, 4); (c) (x, y) = (3, 3); (d) Histogram comparison of (x, y) under different coordinates.
Ye Shuiming et al. [40] selected a certain region of the image, took the Fourier transform of the DCT coefficient in this region, estimated the original quantization matrix according to the frequency domain characteristics, and used the quantization matrix of this region to represent the regions with large differences as tampering regions when calculating the block effect of the whole image. However, this method is only applicable to images with large compression quality factors. Wei Weimin et al. [41] proposed a measurement algorithm for block effect measurement of JPEG spectrum to identify the authenticity of the image. Based on the spectrum analysis, the algorithm made a second-order difference to the image and defined a new index for block effect measurement, which was used for blind forensics of tampering images. Chen, Y. [42] proposed a new technique that USES quantized noise model to detect the block effect caused by dual JPEG compression. The source images used are all JPEG formats, and the periodic features of JPEG images are represented in spatial and transform domains. The quantization noise model is as follows:
, A represents the base matrix of DCT components with A size of 64 × 64, x represents the initial strength of 8 × 8 blocks,
and
represent the quantization DCT coefficient vector after primary and secondary compression,
and
are the corresponding quantization noise. The more the JPEG image is compressed, the closer the noise quantization histogram is to Gaussian distribution. In this method, the image is firstly decomposed according to the principle of block effect, and then the low-frequency compensation is carried out. Only 15 DCT coefficients of the low-frequency are compensated here. Finally, the quantized noise model is modified to detect the double-compression block effect of block alignment or misalignment.
Many scholars have studied the mesh mismatch between the block-effect grid of the tampered region and the background region, and recognized the tampered region according to the extraction of block-effect grid. Tralic, D. et al. [43] proposed that the tamper region of JPEG forged image is detected and located according to the mismatch of image block-effect grid. This detection method can effectively process the image of smooth copy region boundary through the value of average neighboring pixels, and is realized by extracting and analyzing the grid block effect of block components introduced in the process of JPEG compression. Image compression for many times will produce block-effect mesh offset. Huang Wei [44] et al. introduced background information irrelevant to the original image in the process of image re-acquisition. Whether the original of image is offset is detected by using the average information loss of image to conduct block-effect mesh. Compared with the traditional method, this method has higher precision and shorter average detection time.
There must be mismatch inconsistency between block-effect grid of original JPEG image and block-effect grid of tampered image. Based on this assumption, blind forensics is effective in most cases, and detection will fail only if the pasted tampering area coincides with the surrounding original image block-effect grid, but the probability of this happening is only 1/64, that is, 1.56% [45].
4. Conclusions
4.1. Existing Problems
With the rapid development of image processing technology, image tampering has tended to be normalized. Although the blind forensics technology of JPEG image tampering has achieved some effects, it has not made many breakthroughs in recent years and there is no perfect architecture, which is mainly reflected in the following aspects:
1) The method is highly targeted. Most of the blind forensics of JPEG image tampering is for a specific tampering method, such as single compression, double compression, splicing, copy and paste, etc. Because without any prior knowledge when analyzing an image, it is difficult to detect the features of the image forgery to be detected, in order to meet the actual requirements, it is necessary to develop a fusion algorithm that can detect complex image tampering.
2) The forensics algorithm based on the statistical characteristics of JPEG images relies too much on the classifier and the selection of training samples, and most forensics algorithms need to rely on pre-training. For the poor performance of common blind detection, most forensics methods do not have a unified measurement standard.
3) Lack of public database for image testing. Many of the existing methods use proprietary databases or some open source databases, and the images may come from different digital devices. Due to the difference between training samples and test samples, these differences have a low coupling degree, which will lead to different detection results of the same algorithm in different image databases. Therefore, it is impossible to effectively compare the advantages and disadvantages of each algorithm, and there is no unified standard model for the judgment of experimental results. In order to analyze and compare all kinds of tampering images and detection technologies objectively, it is necessary to establish a common image database and unify system evaluation norms and methods.
4.2. Research Prospect
Blind forensics of JPEG image tampering is a kind of passive forensics. Tampering detection can be divided into two types: double JPEG compression detection and block effect inconsistency detection. So far, the solutions to the problems faced are not completely mature, and there is still a certain gap with the actual application. Based on the summary and analysis of the existing research work, future research prospects can be considered from the following aspects:
1) Most JPEG image dual compression methods are only effective when the second compression quality factor QF2 is higher than the first QF1. When QF1 > QF2, the detection effect of the algorithm is poor. In the case of large JPEG second compression quality factor, forensic algorithm detection is still effective, which is the future research trend.
2) When the image is tampered with a lower compression quality factor, the original JPEG compression trace of the tampered area will be destroyed, and the tampering detection difficulty will increase. Therefore, when the tampered image is compressed and saved again with a lower quality factor than the original image, the blind forensics method of JPEG tampered image based on block effect measurement usually has poor or even invalid detection results. The faked JPEG image which is compressed again with a quality factor smaller than the original image can be further analyzed by combining other features, such as combining with the dual quantization of the JPEG image.
3) In recent years, with the rapid development of information and computer research, some fields related to digital image blind forensics research are also constantly innovating and making progress. At present, the rapidly developing statistical machine learning, deep learning, cloud computing, computer vision, big data and so on can provide valuable references for the research on the blind forensics of JPEG image tampering.