• Matthew C. Stamm, Steven K. Tjoa, W. Sabrina Lin, and K. J. Ray Liu
• IEEE Int. Conf. Acoustics, Speech, and Signal Processing, March 2010
• Download: Paper, BibTeX

  @INPROCEEDINGS{stamm2010icassp_antiforensics,
    title = "Anti-Forensics of {JPEG} Compression",
    author = "Matthew C. Stamm and Steven K. Tjoa and W. Sabrina Lin and K. J. Ray Liu",
    booktitle = "Proc. IEEE Int. Conf. Acoustics, Speech, and Signal Processing",
    address = "Dallas, TX",
    year = "2010",
    month = mar,
    pages = "1694--1697"
  };

Digital image forensics is a relatively new field that has only become popular within the last seven years. A newer body of research involves anti-forensics — methods of processing images that disguise evidence of earlier image processing or tampering. By altering the forensically significant properties in an image, existing image forensic systems may be rendered useless. Like many areas of security, we benefit from the study of anti-forensics by understanding the attacks that are most likely to occur before they actually do. Then, we can refine our image forensic systems further.

Earlier, our group proposed the first forensic system that identifies which compression method was used upon a digital image. In this paper, we propose an anti-forensic method for defeating the identification of JPEG compression in an image. Our method alters the intrinsic fingerprint of JPEG-compressed images in the transform domain such that the attacked image is perceptually similar to the image before attack. To our knowledge, this work is the first to propose a method specifically designed to defeat compression identification systems, and we anticipate that more work will follow.

• W. Sabrina Lin, Steven K. Tjoa, H. Vicky Zhao, and K. J. Ray Liu
• IEEE Trans. Information Forensics and Security, September 2009
• Download: Paper, BibTeX

  @ARTICLE{lin2009tifs,
    title = "Digital Image Source Coder Forensics via Intrinsic Fingerprints",
    author = "W. Sabrina Lin and Steven K. Tjoa and H. Vicky Zhao and K. J. Ray Liu",
    journal = "IEEE Trans. Information Forensics and Security",
    year = "2009",
    month = sep,
    volume = "4",
    number = "3",
    pages = "460--475"
  };

Multimedia forensic methods allow us to verify and maintain the integrity of our multimedia data. For example, we can embed a watermark into a digital image to bind the identity of its owner to the image itself. However, traditional forensic approaches such as watermarking are not applicable in many real-world scenarios, for example, when we do not have access to the original data.

In this paper, we investigate the use of intrinsic fingerprints — subsets of data which are, or have become, an intrinsic part of the data in question — for formulating a forensic methodology that can identify the compression history of a digital image. By examining the intrinsic fingerprints in an image, we can tell what compression method (e.g., JPEG, etc.) was used in order to determine the origin of the image and thereby assess its authenticity.

Although there exist methods that estimate parameters of individual compression schemes, to our knowledge, our work is the first to address the problem of image compression identification and offer a unified forensic framework incorporating multiple encoders.

• Steven Tjoa, W. Sabrina Lin, and K. J. Ray Liu
• IEEE Int. Conf. Image Processing, September 2007
• Download: Paper, Presentation, BibTeX

  @INPROCEEDINGS{tjoa2007icip,
    title = "Transform Coder Classification for Digital Image Forensics",
    author = "Steven Tjoa and W. Sabrina Lin and K. J. Ray Liu",
    booktitle = "Proc. IEEE Int. Conf. on Image Processing",
    address = "San Antonio, TX",
    year = "2007",
    month = sep,
    volume = "6",
    pages = {VI-105--VI-108},
  };

Our TIFS paper was the first work to offer a unified forensic framework that can identify the compression method used upon an image. Among these compression methods are transform coders — compression methods that apply some form of entropy coding in the transform domain (e.g., via discrete cosine transform, wavelet transform, etc.). Transform coding is undoubtedly the most popular category of image coders in use today. Therefore, the forensic problem of transform coder classification deserves attention.

In this paper, we propose a method that can identify which transform was used upon an image during the compression process. By analyzing the transform coefficient histogram obtained after applying a candidate transform, we can determine if the image was compressed using the transform tested. Results show that forensic classification accuracy is high when testing from among six well-known transforms.

To our knowledge, this work is the first to address the problem of transform coder classification and propose a working solution.

• W. Sabrina Lin, Steven Tjoa, H. Vicky Zhao, and K. J. Ray Liu
• IEEE Int. Conf. Multimedia and Expo, July 2007
• Download: Paper, BibTeX

  @INPROCEEDINGS{lin2007icme,
    title = "Image Source Coding Forensics via Intrinsic Fingerprints",
    author = "W. Sabrina Lin and Steven Tjoa and H. Vicky Zhao and K. J. Ray Liu",
    booktitle = "Proc. IEEE Int. Conf. Multimedia and Expo",
    address = "Beijing, China",
    year = "2007",
    month = jul,
    pages = "1127--1130",
  };

The most popular image compression schemes in use today are lossy, i.e., compression imposes some irreversible distortion in the image in order to achieve a smaller file size. Because each compression method imposes different kinds of distortion, the distortion can act as a fingerprint of the compression method. Existing image compression methods can be grouped into a few categories — e.g., transform coding, vector quantization, subband coding, linear predictive coding, embedded coding — where all methods in the same category leave behind the same type of fingerprint in an image during compression.

In this paper, we analyze the intrinsic fingerprints of different types of image compression methods and propose a forensic system that identifies the type of the compression and provides a confidence measure in the system’s decision. Results show that the system can achieve a probability of detection of 0.82 for an image PSNR of 40 dB and even higher accuracy for lower PSNRs.

• Steven Tjoa, W. Sabrina Lin, H. Vicky Zhao, and K. J. Ray Liu
• IEEE Int. Conf. Acoustics, Speech, and Signal Processing, April 2007
• Download: Paper, Presentation, BibTeX

  @INPROCEEDINGS{tjoa2007icassp,
    title = "Block Size Forensic Analysis in Digital Images",
    author = "Steven Tjoa and W. Sabrina Lin and H. Vicky Zhao and K. J. Ray Liu",
    booktitle = "Proc. IEEE Int. Conf. Acoustics, Speech, and Signal Processing",
    year = "2007",
    address = "Honolulu, HI",
    month = apr,
    volume = "1",
    pages = {I-633--I-636}
  };

Our work on image compression forensics attempts to identify the compression method used upon an image by analyzing its intrinsic fingerprint. Many popular image compression methods such as JPEG employ block processing. Therefore, to even begin forensic analysis for digital images, we must first address the presence of block processing on our image data. For forensic analysis of block-based coding schemes, estimating the block size is an obvious and crucial first step, because inaccurate block size estimation can possibly invalidate subsequent forensic tests.

Block artifact measurement is a well-established research area, with purposes primarily related to image restoration and distortion measurement. However, artifact measurement for the purpose of forensic analysis has not been explored. Here, we pose the following question: given a compressed image, can we detect the presence of block processing? If so, can we estimate the block size? Existing work in block artifact measurement is not tailored to answer this question due to strong assumptions placed upon the input data.

In this paper, we propose a novel scheme to detect the presence of block processing along with estimation of the block size. We first obtain a block artifact signature and then estimate the block size through maximum-likelihood estimation. Finally, we propose a binary hypothesis test that identifies the presence or absence of block processing with high detection rates and low false alarm rates.