Detection of Copy-Move Forgery in Digital Images

Digital images are easy to manipulate and edit due to availability of powerful image processing and editing software. Nowadays, it is possible to add or remove important features from an image without leaving any obvious traces of tampering. As digital cameras and video cameras replace their analog counterparts, the need for authenticating digital images, validating their content, and detecting forgeries will only increase. Detection of malicious manipulation with digital images (digital forgeries) is the topic of this paper. In particular, we focus on detection of a special type of digital forgery – the copy-move attack in which a part of the image is copied and pasted somewhere else in the image with the intent to cover an important image feature. In this paper, we investigate the problem of detecting the copy-move forgery and describe an efficient and reliable detection method. The method may successfully detect the forged part even when the copied area is enhanced/retouched to merge it with the background and when the forged image is saved in a lossy format, such as JPEG. The performance of the proposed method is demonstrated on several forged images. 1. The Need for Detection of Digital Forgeries The availability of powerful digital image processing programs, such as PhotoShop, makes it relatively easy to create digital forgeries from one or multiple images. An example of a digital forgery is shown in Figure 1. As the newspaper cutout shows, three different photographs were used in creating the composite image: Image of the White House, Bill Clinton, and Saddam Hussein. The White House was rescaled and blurred to create an illusion of an out-of-focus background. Then, Bill Clinton and Saddam were cut off from two different images and pasted on the White House image. Care was taken to bring in the speaker stands with microphones while preserving the correct shadows and lighting. Figure 1 is, in fact, an example of a very realisticlooking forgery. Another example of digital forgeries was given in the plenary talk by Dr. Tomaso A. Poggio at Electronic Imaging 2003 in Santa Clara. In his talk, Dr. Poggio showed how engineers can learn the lip movements of any person from a short video clip and then digitally manipulate the lips to arbitrarily alter the spoken content. In a nice example, a video segment showing a TV anchor announcing evening news was altered to make the anchor appear singing a popular song instead, while preserving the match between the sound and lip movement. The fact that one can use sophisticated tools to digitally manipulate images and video to create non-existing situations threatens to diminish the credibility and value of video tapes and images presented as evidence in court independently of the fact whether the video is in a digital or analog form. To tamper an analogue video, one can easily digitize the analog video stream, upload it into a computer, perform the forgeries, and then save the result in the NTSC format on an ordinary videotape. As one can expect, the situation will only get worse as the tools needed to perform the forgeries will move from research labs to commercial software. Figure 1 Example of a digital forgery. Despite the fact that the need for detection of digital forgeries has been recognized by the research community, very few publications are currently available. Digital watermarks have been proposed as a means for fragile authentication, content authentication, detection of tampering, localization of changes, and recovery of original content [1]. While digital watermarks can provide useful information about the image integrity and its processing history, the watermark must be present in the image before the tampering occurs. This limits their application to controlled environments that include military systems or surveillance cameras. Unless all digital acquisition devices are equipped with a watermarking chip, it will be unlikely that a forgery-inthe-wild will be detectable using a watermark. It might be possible, but very difficult, to use unintentional camera “fingerprints” related to sensor noise, its color gamut, and/or its dynamic range to discover tampered areas in images. Another possibility for blind forgery detection is to classify textures that occur in natural images using statistical measures and find discrepancies in those statistics between different portions of the image ([2], [3]). At this point, however, it appears that such approaches will produce a large number of missed detections as well as false positives. In the next section, we introduce one common type of digital forgeries – the copy-move forgery – and show a few examples. Possible approaches to designing a detector are discussed in Section 3. In Section 4, we describe the detection method based on approximate block matching. This approach proved to be by far the most reliable and efficient. The method is tested in the last Section 5 on a few forgeries. In the same section, we summarize the paper and outline future research directions. 2. Copy-Move Forgery Because of the extraordinary difficulty of the problem and its largely unexplored character, the authors believe that the research should start with categorizing forgeries by their mechanism, starting with the simple ones, and analyzing each forgery type separately. In doing so, one will build a diverse Forensic Tool Set (FTS). Even though each tool considered separately may not be reliable enough to provide sufficient evidence for a digital forgery, when the complete set of tools is used, a human expert can fuse the collective evidence and hopefully provide a decisive answer. In this paper, the first step towards building the FTS is taken by identifying one very common class of forgeries, the Copy-Move forgery, and developing efficient algorithms for its detection. In a Copy-Move forgery, a part of the image itself is copied and pasted into another part of the same image. This is usually performed with the intention to make an object “disappear” from the image by covering it with a segment copied from another part of the image. Textured areas, such as grass, foliage, gravel, or fabric with irregular patterns, are ideal for this purpose because the copied areas will likely blend with the background and the human eye cannot easily discern any suspicious artifacts. Because the copied parts come from the same image, its noise component, color palette, dynamic range, and most other important properties will be compatible with the rest of the image and thus will not be detectable using methods that look for incompatibilities in statistical measures in different parts of the image. To make the forgery even harder to detect, one can use the feathered crop or the retouch tool to further mask any traces of the copied-and-moved segments. Examples of the Copy-Move forgery are given in Figures 2–4. Figure 2 is an obvious forgery that was created solely for testing purposes. In Figure 3, you can see a less obvious forgery in which a truck was covered with a portion of the foliage left of the truck (compare the forged image with its original). It is still not too difficult to identify the forged area visually because the original and copied parts of the foliage bear a suspicious similarity. Figure 4 shows another Copy-Move forgery that is much harder to identify visually. This image has been sent to the authors by a third party who did not disclose the nature or extent of the forgery. We used this image as a real-life test for evaluating our detection tools. A visual inspection of the image did not reveal the presence of anything suspicious. Figure 2 Test image “Hats”. Figure 3 Forged test image “Jeep” (above) and its original version (below). Figure 4 Test image “Golf” with an unknown original. 3. Detection of Copy-Move Forgery Any Copy-Move forgery introduces a correlation between the original image segment and the pasted one. This correlation can be used as a basis for a successful detection of this type of forgery. Because the forgery will likely be saved in the lossy JPEG format and because of a possible use of the retouch tool or other localized image processing tools, the segments may not match exactly but only approximately. Thus, we can formulate the following requirements for the detection algorithm: 1. The detection algorithm must allow for an approximate match of small image segments 2. It must work in a reasonable time while introducing few false positives (i.e., detecting incorrect matching areas). 3. Another natural assumption that should be accepted is that the forged segment will likely be a connected component rather than a collection of very small patches or individual pixels. In this section, two algorithms for detection of the Copy-Move forgery are developed – one that uses an exact match for detection and one that is based on an approximate match. Before describing the best approach based on approximate block matching that produced the best balance between performance and complexity, two other approaches were investigated – Exhaustive search and Autocorrelation. 3.1 Exhaustive search This is the simplest (in priciple) and most obvious approach. In this method, the image and its circularly shifted version (see Figure 5) are overlaid looking for closely matching image segments. Let us assume that xij is the pixel value of a grayscale image of size M×N at the position i, j. In the exhaustive search, the following differences are examined: | xij – xi+k mod(M) j+l mod(N) |, k = 0, 1, ..., M–1, l = 0, 1, ..., N–1 for all i and j. It is easy to see that comparing xij with its cyclical shift [k,l] is the same as comparing xij with its cyclical shift [k’,l’], where k’=M–k and l’=N–l. Thus, it suffices to inspect only those shifts [k,l] with 1≤ k ≤ M/2, 1≤ l ≤ N/2, thus cutting the computational complexity by a factor of 4. Figure 5 Test image “Lenna” and its circular shift. For each shift [k,l], the differences ∆xij = | xij – xi+k mod