PHASE BASED DETECTION OF JPEG COUNTER FORENSICS

Gamal Fahmy*∗ , Abdullah Alqallaf** and Rolf Wurtz***

*Electrical Engineering Dept., Assiut University, Egypt

**Electrical Engineering Dept., Kuwait University, Kuwait
***Institut fur Neuroinformatik, Ruhr-Universitt Bochum, Germany

ABSTRACT possible hackings. This dithering signal has to be sufficient

to fill in all gaps, but if it exceeded a certain limit it can
Many recent techniques for forgery detection tried to counter
also be detected. This detection can occur by recompressing
noise dithering, which is considered to be the most successful
the dithered image with different compression parameters
technique for removing footprints of JPEG editing in coun-
such as the JPEG quantization matrix (QM) [8], or quantiza-
tering forensics. In this paper we propose a novel idea of
tion step size [6], or the QM size [7]. In [9], another novel
detecting any noise dithering that is typically adopted in re-
idea was introduced by recompressing decoded JPEG images
moving footprints in counter anti forensics of images. This
until quantization noise saturates, and it has been reported
technique is based on detecting phase variations for DCT co-
to be the most robust technique in noisy environments as
efficients, for decoded JPEG images. We try to measure the
in [10, 11]. In [12], it has been agreed upon that the amount
level of coherence of phase values for coefficients and de-
of noise significantly affects the performance of the detection
tect thresholded variations that would indicate some editing
of forgery, although it has also been highlighted that there
or tampering of images. The proposed technique is robust
are some sweet spots where the sensitivity of this detection
against noise dithering due to the fact that local homogeneous
does not get affected with bad image quality. In this pa-
regions inherit distinctive phase values. These phase values
per we present a novel idea of exploiting spatial frequency
are inconsistent with embedded or dithered noise signals that
phases (SFP) and spatial frequency magnitudes (SFM) to
are considered to be out of phase and can be easily detected
find distinctive local original image features to detect any
in noisy environments. Our proposed technique is compared
forgeries. Spatial frequency phase and magnitudes have been
with literature techniques for performance in noisy applica-
long considered by human visual system and computer vision
tions.
researchers [13, 14]. Marr in [15], designed several models
Index Terms— image forensics, JPEG edits, anti forensic to measure how humans perceive phase data and indicated
that homogenous data samples tend to have close spatial fre-
quency phase values, while noise samples and coefficients
1. INTRODUCTION
tend to be out of phase and can be easily detected from a
phase prospective. As will be shown in the next sections,
The recent availability of photo editing software with the
this technique of adopting phase data to detect forgery can
wide-spread use of digital imagery in different applications
locate possible noisy dithered regions of suspectable images
has made it easier than ever to edit, manipulate and tamper the
with outstanding performance compared to current literature
content of digital images. While manipulating different un-
techniques. We also tested our technique with different noise
compressed image versions (i.e. bmp) can be easier to tamper
levels to measure its robustness against noise. Section 2 gives
or hack, compressed images with the widely used JPEG stan-
an overview about our proposed phase based detection tech-
dard, are harder to edit and tamper undetectably, due to traces
nique; section 3 shows how we employed this technique for
left by the JPEG compression. Several JPEG forensics and
countering forensics. Section 4 shows our comparison with
anti-forensics detection techniques have appeared in the last
literature techniques in [6] and [9], followed by conclusions
decade to detect either forgery of compressed images [1–3],
in section 6.
or removals of hacking footprints in counter forensics [4, 5].
We note here that the noise dithering technique presented
in [4, 5], has been considered in later literature, [6, 7], as a 2. PHASED BASED IMAGE ANALYSIS
robust technique for countering forensics by introducing a
dithering signal in the DCT domain that will match the dis- Any spatial domain (pixel domain) consists of different si-
tribution of tampered images to the original one and hide any nusoidal frequencies in the transform domain, each of these
frequencies is represented as a spatial frequency magnitude
∗ Thanks for Alexander von Humboldt foundation, Germany for funding (SFM) and a spatial frequency phase (SFP), [15], as with
any sinusoidal signal. If we take the Fourier transform of 2. Construct an SFP image that consist of phase values, it
any 16x16 image block, and note every Fourier coefficient only consist of these 16x16 blocks
in the ith and j th row and column as Zij , then a and b would
correspond to the real and complex parts for that coefficient, 3. Measure the local variance for each 16x16 pixel val-
Z = a + ib. R and θ would correspond the magnitude and ues of the original image, that corresponds to a specific
phase of this complex coefficient as: 16x16 phase value block.
p 4. If a 16x16 block has a large amount of edges (phase
R = a2 + b2 (1)
non smooth peaks) with a low variance value of its 8x8
, while the phase component is calculated as: pixel block, this would indicate that this block has been
edited or hacked, phase values for this block would a lot
a
θ = tan( ) (2) of discrepancies and would have a high variance value.
b
We note here that the local variance measured in step 3, is just
In the Human Visual System, the content of an image
a suggested methodology to detect if this block of the image
is analyzed through multiple independent spatial frequency
is likely to be edited or not. This is performed based on the
channels [15]. Although these channels do not interact sub-
hypothesis that a low variance region would correspond to a
stantially with each other, there are some points in the image
homogenous region and any phase incoherence in this region
where the spatial frequency phase of all (or most) of the chan-
would indicate some editing, as in noise dithering we inject
nels are coherent with each other, this is typical in homoge-
noise just to match the DCT coefficient distribution without
nous image regions. These coherence points are perceived
considering any phase inconsistency. We also note that noise
as visual features when the various spatial frequency com-
is typically out of phase and any dithered noise would have a
ponents at these points, all have the same spatial frequency
phase component (SFP) that is random and would not match
phase value, even if they do not enjoy similar spatial fre-
the original region phase data.
quency magnitude values. When the phase of the various spa-
tial frequency components in an image region are not coherent
this would indicate presence of noise, as noise is typically out 4. EXPERIMENTAL RESULTS
of phase and does not correlate well with different image con-
tents. In noise dithering [4, 5], where added noise is supposed We adopted the successful technique of [4, 5] in injecting
to fill in quantization gaps of decoded image coefficients, even noise in different homogeneous, nonhomogeneous and edge
though noise is supposed to have similar spatial frequency image regions and tried to detect possible forgeries and hack-
magnitudes in all image regions, for Fourier histogram coeffi- ings with our proposed technique. It was our own belief, that
cients (different frequencies), noise will not be phase coherent phase data can not be adjusted with any type of dithering
with the original image. Hence the degree of phase coherence while adjusting the edited image region.
in different image regions, can be used as an indication of We compared our detection performance with several recent
the amount of added noise to this region of the image, which literature techniques as in [9], [6]. In our tested data set of
would correspond to whether it was edited or not. We note images we selected 280 images that are JPEG compressed
here that noise dithering would add noise coefficients that with different quality factors ranging from 30 to 90, which
match the decoded image coefficients in magnitude, hence indicates different noise levels. For each image we also made
the Fourier coefficient histogram will not detect any magni- a dithered version, where a counter forensic dithered noise
tude discrepancies, but there is a large amount of phase in- signal is added in different regions of the image. These differ-
consistencies, which is an indication of added dithered noise. ent regions would be homogenous, nonhomogeneous or edge
In our proposed approach we measure the spatial frequency image regions. This would make our test samples 560 images
phase coherence across the suspectable image, especially for (half original, and half forensically countered). One third
homogenous image regions where a high level of phase co- of the dithered images were homogenous images, one third
herence is expected and try to detect any region of phase mis- were nonhomogenous and one third were edge images. Fig.1
match (incoherence) which would correspond to added noise. shows the detection performance of our phase coherence
based anti-forensic technique for JPEG images compressed
with different Quality factors (30 to 90), for homogenous
3. DETECTION OF NOISE DITHERING
regions. Performance of the most recent successful litera-
In detecting noise dithering for our suspectable JPEG com- ture techniques is also illustrated in Fig.1 for homogenous
pressed image, perform the following steps: regions. Fig.2 shows the same comparison of Fig.1 but for
the 3 types textures.
1. Measure the amount of phase coherence for every Fig.3 shows an edited image with some dithering around the
16x16 Fourier block of decoded coefficients by mea- embedded object (door) in a homogenous region and the de-
suring the histogram θ for all block Fourier coefficients. tected phase inconsistency in it. In our simulation results we
measured the level of phase coherence of all three types of
images for both original and dithered versions. The resulting
output was just a binary value of edited or not edited. While
all original images were correctly classified as not edited
images, different classifications were obtained for dithered
images based upon region type and JPEG quality factor. In
our experiments we selected an accuracy metric as our per-
formance metric for forgery detection. This accuracy metric
is defined as the number of correctly identified noise dithered
images as edited or not edited, to the total number of test
sample images. This choice of accuracy is justified by the
balanced database that we had that consisted of equal number
of original and attached (edited or dithered) images.
We note here that phase coherence inconsistency detection
was high for dithered homogenous regions, due to the fact
that homogeneous transform coefficients tends to have a uni-
form spatial frequency phase value, and any injected noise
Fig. 1: Dithering detection performance against different quality
would be out of phase and would introduce an amount of
factors for 3 recent literature methods
phase inconsistency that can be easily detected.
We also note that this detection measure would drop in non-
homogeneous regions, as the amount of phase coherence is ings of Digital Forensic Research Workshop. Citeseer,
minimal by definition [13]. In edge regions detection was 2003.
at a middle level of the previous two regions due to the fact
that edges would correspond to typical regions in the image [2] Z. Fan and R.L. de Queiroz, “Identification of bitmap
to be attacked, while the amount of phase coherence is less compression history: Jpeg detection and quantizer esti-
as edges represent a mix between low and sharp transition mation,” Image Processing, IEEE Transactions on, vol.
frequency coefficient values. Table 1 shows detection values 12, no. 2, pp. 230–235, 2003.
for the three techniques with different quality factor values.
[3] G. Valenzise, M. Tagliasacchi, and S. Tubaro, “The
cost of jpeg compression anti-forensics,” in Acoustics,
5. CONCLUSIONS
Speech and Signal Processing (ICASSP), 2011 IEEE In-
In this paper a novel technique was presented for the detec- ternational Conference on. IEEE, 2011, pp. 1884–1887.
tion of forgery or tampering of JPEG images, the proposed [4] M.C. Stamm, S.K. Tjoa, W.S. Lin, and K.J.R. Liu,
approach relied on spatial frequency phase data that is embed- “Undetectable image tampering through jpeg compres-
ded in spatial frequencies of the image and is primarily based sion anti-forensics,” in Image Processing (ICIP), 2010
on the assumption that noise is typically out of phase of its 17th IEEE International Conference on. IEEE, 2010, pp.
embedded region, hence any noise dithering can be detected 2109–2112.
especially in homogenous regions where any phase discrep-
ancy is easily recognizable. [5] M.C. Stamm, S.K. Tjoa, W.S. Lin, and K.J.R. Liu,
A promising future direction of research can be investigating “Anti-forensics of jpeg compression,” in Acoustics
the tradeoff between forgery detection sensitivity and human Speech and Signal Processing (ICASSP), 2010 IEEE In-
sensitivity for the image in noisy environments. ternational Conference on. IEEE, 2010, pp. 1694–1697.
Table 1: Performance for nonhomogeneous/edge sample images [6] G. Valenzise, V. Nobile, M. Tagliasacchi, and S. Tubaro,
“Countering jpeg antiforensics,” in IEEE Int. Conf. on
Q=90 Q=70 Q=50 Q=30
Image Processing, ICIP, 2011.
Our Phase based 61/60 62/63 60/59 58/55
Lai in [9] 81/79 75/70 58/55 50/51 [7] Gamal Fahmy, “Detectable tampering of jpeg anti-
Valenzise in [6] 75/71 65/61 52/51 49/48
forensics,” in WIAR’2012; National Workshop on In-
formation Assurance Research; Proceedings of. VDE,
2012, pp. 1–4.
6. REFERENCES
[8] H. Farid, “Exposing digital forgeries from jpeg ghosts,”
[1] A.J. Fridrich, B.D. Soukal, and A.J. Lukáš, “Detection Information Forensics and Security, IEEE Transactions
of copy-move forgery in digital images,” in in Proceed- on, vol. 4, no. 1, pp. 154–160, 2009.
 (a) (b)

Fig. 3: A fake image with noise dithered around the embedded door with detected phase incoherence, white points indicate phase incoherence

Conference on Signal Processing and Information Tech-

nology; Proceedings of. IEEE, 2014.
[11] G. Valenzise, M. Tagliasacchi, and S. Tubaro,
“Detectability-quality trade-off in jpeg counter-
forensics,” in IEEE Int. Conf. on Image Processing,
ICIP, 2014.

[12] Xiaoyu Chu, Matthew C Stamm, Yan Chen, and KJ Liu,

“Concealability-rate-distortion tradeoff in image com-
pression anti-forensics,” in Acoustics, Speech and
Signal Processing (ICASSP), 2013 IEEE International
Conference on. IEEE, 2013, pp. 3063–3067.

[13] Eric Wharton, Karen Panetta, and Sos Agaian, “Human

visual system based similarity metrics,” in Systems, Man
and Cybernetics, 2008. SMC 2008. IEEE International
Conference on. IEEE, 2008, pp. 685–690.
Fig. 2: Dithering detection performance against different quality
factors for 3 types of sample images [14] Gamal Fahmy, John Black Jr, and Sethuraman Pan-
chanathan, “Texture characterization for joint compres-
sion and classification based on human perception in the
[9] ShiYue Lai and Rainer Bhme, “Block convergence in wavelet domain,” Image Processing, IEEE Transactions
repeated transform coding: Jpeg-100 forensics, carbon on, vol. 15, no. 6, pp. 1389–1396, 2006.
dating, and tamper detection.,” in Proceedings of the
IEEE International Conference on Acoustics, Speech [15] David Marr et al., “Vision: A computational investi-
and Signal Processing, ICASSP 2013, Vancouver, BC, gation into the human representation and processing of
Canada, 2013, pp. 3028–3032, IEEE. visual information,” 1982.

[10] Gamal Fahmy, “Nonorthogonal dct block convergence

for jpeg-75 forensics,” in ISSPIT 2014;International