Kahane

Image Forensics Psych 221 Final Project - Matthew Kahane

Image Forensics

In a forensic analyst's ideal world, the images we see would be faithful representations of what was seen by the camera. There are situations in which we would like to detect whether an image has been JPEG compressed multiple times. A doubly JPEG compressed image would indicated that the image has been saved multiple times and is thus more likely to have been tampered with in between the first save (ostensibly by the camera) and the second save (perhaps in photoshop or some other editing software.) Based on the work of Dartmouth Professor Hany Farid (among others), this project attempts to implement code that will detect doubly compressed images. There are a other ways to go about detecting image forgeries. One is to implement an Expectation/Maximization algorithm that can detect and interpolate a camera's color filter array. Parts of an image that do not fit in well with the periodic nature of the CFA will come under suspicion as forged. This project, though, will take advantage of JPEG compression algorithm (and the artifacts it leaves behind) to detect image forgeries.

Introduction

Let us begin with the ideas behind JPEG compression. JPEG (which stands for Joint Photographic Experts Group) has become an image compression standard. The algorithm behind standard JPEG compression is as follows:

1. For each pixel channel(

    #Traverse the image in raster form and for each 8 x 8 blocks of pixels
         #Apply a 2D Discrete Cosine Transform (DCT) to each 8 x 8 block - This results in an 8 x 8 block of DCT coefficients
         #Divide this 8 x 8 block of DCT coefficients by an 8 x 8  quantization table
         #Take the floor of this quantized table
         #We now have an 8 x 8 representation of the uncompressed 8 x 8 pixel block but due to quantization and rounding, many of the coefficients are the same.  
         #This new quantized block can be Huffman encoded, losslessly

We see that the key step of this compression process is the quantization and loss. When we simply have an 8 x 8 block of coefficients, we are still one-to-one with the original pixel table. However, dividing by an integer and rounding will cause information loss. We can also intuit that dividing by a larger number causes more coefficients to be rounded to zero. Because of this, the quantization table is often very small (close to one) in the upper left corner - the coefficient for low spatial cosines - and very large (on the order of 10 or so) in the lower right corner - the coefficient for large spatial cosines. This is because an image can stand to lose a lot of information in high spatial frequencies without losing too much discernable quality.

Background

How then, can we leverage this algorithm to distinguish doubly compressed images. Let us consider DCT coefficients (for instance the 1,1 frequency or 2,2 frequency) across all 8 x 8 transformed blocks of an image channel. We can put these coefficients into a histogram. If we begin with an uncompressed image, and simply take the unquantized DCT coefficients, these should be pretty randomly distributed - as random as the pixel values themselves. After quantization and rounding though, there will be a pattern based on how heavy the quantization is. For instance, heavy quantization will produce a lot of zeros. We are taking these coefficients and forcing them into bins. What happens, then, if we do this a second time? We will look first at an intuitive explanation and then at a rigorous explanation

Intuitive

Here is your intuition

Rigor

Here is your rigor

Methods

Simulating Compression

Here is how I simulated Double Compression

Testing for Double Compression

Here is how I tested for Double Compression

Results

Results of Simulating Double Compression

Present Strange Results

Results of Testing Double Compression

Best to do by inspection

Conclusions

What worked what didn't

References

Shower Praise on Hany

Appendix 1

[Simulation_Script]

[Testing_Script] [Function_Style_Code]