Improved PRNU-Based Forgery Localization

In a past post, we presented several improvements we did to Amped Authenticate’s Camera Identification filter based on PRNU analysis. Those improvements propagated also to the PRNU Tampering filter so that Amped Authenticate also features an improved algorithm for forgery localization. Improvements mainly include:

Peak-to-Correlation Energy-based (PCE) analysis
During block-based analysis, the PCE is computed and the point yielding the maximum PCE value (peak) is considered. If the peak is in the expected position, the block is considered authentic; if the peak is in a different position, then the PCE value is compared with a threshold to decide the authenticity of the block.

Support for multi-core processing
If your CPU features multiple logical cores, block-based analysis will run in parallel, thus reducing the computation time.

Faster, easier training
Thanks to PCE robustness, there is no need to train a separate model for forgery detection: you can use the same .crp file created for Camera Identification.

Forgery localization for cropped images
If the image is cropped and/or rotated before or after manipulation, the PRNU Tampering filter will detect cropping, compensate for it and run the forgery localization algorithm. The same applies to resizing and/or rotation. Combination of resizing and cropping is not supported yet.

Alert for unreliable regions
PRNU-based forgery localization is not reliable in saturated areas (i.e., totally white or black regions of the image). Indeed, for those pixels, it is impossible to discriminate between the image content and the actual sensor noise. The new version of PRNU-based forgery localization enables highlighting of white and black saturated pixels (marked in yellow and blue, respectively), in order to help the analyst rule out false alarms.

Experimental validation

Base dataset
The forgery localization algorithm has been tested using images from the Base dataset we described in a recent post (29 devices, 10,000+ images). For each device, 15 images were randomly selected and, for each image, a copy-move tampering operation was performed. This means that a randomly positioned region of varying size was selected, rotated/resized and copied to another location of the same image. After pasting pixels, the image was JPEG compressed. Parameters regulating the forgery operations and final compression are as in Table 4.

Some examples of forged images and corresponding forgery localization maps are shown below. It is evident that false alarms are the main problem with PRNU-based forgery localization. Indeed, it is highly probable that manipulated pixels do not correlate with the sensor pattern; unfortunately, it is not as probable that untouched pixels will correlate sufficiently with the pattern, thus leading to false alarms.

In particular, saturated and very dark regions are more prone to raise false alarms. For this reason, the output map highlights dark regions in blue and saturated regions in yellow.

Samples of forged images

The list of performance per device is given in Table 5 below. On average, the overall pixel accuracy is 70.4%, meaning that 7 pixels out of 10 are correctly marked as authentic or forged.  Taking a closer look, we also observe that, in general, the True Positive rate (correctly detecting manipulated pixels, denoted by TP in parenthesis) reaches higher values compared to the True Negative rate (correctly marking untouched pixels as authentic, denoted by TN). This is expected, as yielding high values for TN requires a good local sensor noise match throughout the whole image, which is difficult to obtain in case dark or strongly textured regions are present (see the figures on the second and third rows above for an example). Finally, the fact that the TP rate never reaches 90% should not be worrying too much: most missed pixels are those laying on the edge of the tampered region, which are not detected because in the block-based analysis they share the same block with neighboring authentic pixels (see top and bottom figures above).

Overall, we can definitely say the new PRNU Tampering Detection filter is a powerful forgery localization tool, provided that: a) you have enough images from the camera to build a reliable reference pattern, and b) you keep in mind that, being a multiplicative noise, PRNU will be less reliable on dark regions.

Table 5: device specific forgery detection performance