<figure><img src="image_1.png" /></figure>

HAL
open science

# A Combined Feature Encoding Network with Semantic Enhancement for Image Tampering Forensics

Yuling Luo, Ce Liang, Shunsheng Zhang, Sheng Qin

► To cite this version:

Yuling Luo, Ce Liang, Shunsheng Zhang, Sheng Qin. A Combined Feature Encoding Network with Semantic Enhancement for Image Tampering Forensics. 18th IFIP International Conference on Digital Forensics (DigitalForensics), Jan 2022, Virtual, United States. pp.107-121, 10.1007/978-3-031-10078-9_6. hal-05315738

HAL Id: hal-05315738

https://inria.hal.science/hal-05315738v1

Submitted on 15 Oct 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_2.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
<figure><img src="image_3.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
Chapter 6

A COMBINED FEATURE ENCODING
NETWORK WITH SEMANTIC
ENHANCEMENT FOR IMAGE
TAMPERING FORENSICS

Yuling Luo, Ce Liang, Shunsheng Zhang and Sheng Qin

**Abstract**

Image tampering forensics is performed by analyzing images to locate the tampered regions. However, most image tampering detection methods lack locational accuracy and are effective only for specific types of tampering. To address these problems, this chapter proposes a method that employs an encoder-decoder network structure with combined multiple feature encoding to segment tampered regions of an image from untampered regions. Three features, obtained using constrained convolution, steganalysis rich model filtering and common convolution, are combined. During the encoding stage, ring residual units are used to extract features. The combination of multiple features and the ring residual units makes the proposed method most suitable for image tampering detection. Channel attention with a soft threshold function is used to reinforce semantic information in the decoding stage. Experiments with three image forensic datasets, NIST16, COVERAGE and CASIA, demonstrate that the proposed method exhibits strong performance in terms of the F1 score and localization of tampered regions.

**Keywords:**

Image tampering, encoder-decoder, combined features, semantics

# 1. Introduction

Digital image editing software is often used by unscrupulous individuals to tamper with images for purposes of fraud, harassment and blackmail. It is imperative to develop image forensic techniques that can effectively detect tampered images created by sophisticated image editing software.
<figure><img src="image_4.png" /><figcaption>*Figure 1.* Image tampering using splicing, copy-paste and removal.</figcaption></figure>

In general, image tampering involves image splicing, copy-paste and removal. The first row in Figure 1 shows tampered images created by the three techniques and the second row shows the corresponding ground truth masks of the images. Splicing adds an object or part of an image to another image. Copy-paste adds an object from an image to another area of the same image, resulting in two similar objects. Removal eliminates an area of an image or hides certain objects in an image.

Early research on image tampering detection developed algorithms that relied on prior knowledge about the questioned images. For example, Luo et al. [11] analyzed the error distributions caused by one or two image compressions to detect tampering. Ferrara et al. [7] examined the interpolated characteristics of color filter arrays to discover tampered regions in images. Mahdian and Saic [12] analyzed the noise distributions of images to detect tampered regions. The principal limitation of these and other algorithms based on manually-designed features is that they can detect tampered images only under specific conditions.

Recently, deep learning methods that leverage convolutional neural networks (CNNs) have demonstrated good performance in various image recognition tasks [8, 10]. However, image tampering detection is more challenging than image recognition because it requires finding subtle traces of tampered regions in images. Wu et al. [15] computed correlations between pairs of pixels in images to locate tampered regions; however, the approach only focuses on copy-paste tampering. Zhou et al. [19] analyzed red-green-blue (RGB) and noise streams to detect image tampering. Bi et al. [5] employed a network based on ring residual
units to improve feature extraction and distinguish between tampered
and untampered regions of images; however, the method is only applica-
ble to image splicing tampering detection. Bappy et al. [2, 3] employed
resampled features combined with a long short term memory (LSTM)
network to detect various types of image tampering. However, their
original method described in [2] localizes tampering at the image block
level, which reduces its accuracy. Although the new method of Bappy
et al. [3] achieves pixel-level localization, its accuracy still needs to be
improved.

In summary, most state-of-the-art image tampering detection meth-
ods focus on specific types of tampering and/or have inaccurate localiza-
tion. To address these limitations, this chapter proposes a generalized
image tampering detection network structure. First, convolutional com-
binations are used to obtain combined features that contain adequate in-
formation about different types of image tampering. Next, ring residual
units are used for encoding. Following this, channel attention with a soft
threshold function for semantic information enhancement is employed to
make the network more focused on tampered regions. Finally, decod-
ing yields a mask with the tampered regions. The experimental results
demonstrate that the proposed method outperforms baseline methods
with F1 scores of 0.892 with the NIST16 dataset [13], 0.568 with the
COVERAGE dataset [14] and 0.441 with the CASIA v1 dataset [6].

## 2. Proposed Method

The proposed method is designed to identify tampered regions in im-
ages. Figure 2 shows the network structure underlying the method. It is
inadequate to use common convolution to detect image tampering traces.
To address this problem, the proposed method extracts the residual fea-
tures of a tampered image via constrained convolution. Constrained
convolution suppresses the influence of image content on the tampered
traces.

The proposed method also leverages noise features extracted by ste-
ganalysis rich model (SRM) filtering to identify noise inconsistencies
between the real and tampered regions of an image. Common convolu-
tion is used to extract image texture features from the RGB channels.
All these features are fused to obtain rich information. The ring residual
unit enhances feature extraction to further discern differences between
the untampered and tampered image regions. Additionally, channel at-
tention with a soft threshold function (SSE) is employed to enhance
semantic information in the decoding stage. The overall network is end-
to-end trainable.
<figure><img src="image_5.png" /><figcaption>Figure 2. Network structure.</figcaption></figure>

## 2.1 Combined Feature Extraction

Combined feature extraction is performed using constrained convolution and steganalysis rich model convolution:

* **Constrained Convolution:** Image manipulation usually leaves specific traces of the types of image editing. Common convolution tends to learn the content of an image, but is unsuitable for learning subtle tampering traces. To address this limitation, Bayar and Stamm [4] proposed a constrained convolutional neural network for general-purpose image manipulation detection. Constrained con-
<figure><img src="image_6.png" /><figcaption>Figure 3. Steganalysis rich model filter kernels.</figcaption></figure>

volution suppresses the content of an image while adaptively learning the low-level residual features of tampered traces. It provides better generalization and robustness characteristics than common convolution.

The constrained convolutional layer is described as follows:

$$ 
\begin{aligned}
W_k(0, 0) &= -1 \\
\sum_{m,n \neq 0} W_k(m, n) &= 1
\end{aligned}
 $$

where $W_k$ is the $k^{th}$ convolutional kernel and (0,0) is the center coordinate of $W_k$.

During each iteration, $W_k$ is normalized by updating the center position of each convolution filter to -1. The remaining partial position weights are divided by the sum of the weights other than the center position.

* **Steganalysis Rich Model Convolution.** Steganalysis rich model filtering is widely used in steganalysis to capture manipulation cues. While paying attention to the surface traces of an image, more attention should be paid to the statistical information within the image. Noise flow was proposed by Zhou et al. [19] to discover noise inconsistencies between real and tampered image regions with the noise features extracted via steganalysis rich model filtering. Steganalysis rich model filtering improves detection accuracy by analyzing the noise distribution within an image. The noise features may be extracted effectively using a steganalysis rich model filter with three kernels [19]. Figure 3 shows the three kernels of the steganalysis rich model filter.

As described above, two different features can be used for tampering detection. In this research, three different fused features are obtained from tampered images using a custom convolution of the two features as
<figure><img src="image_7.png" /><figcaption>Figure 4. Ring residual unit connections, feedback and overall structure.</figcaption></figure>

well as common convolution. Wu et al. [16] state that such rich features
are very effective at training image tampering detection models.

## 2.2 Encoding Network

The encoding network is constructed with ring residual units [5] and
pooling layers. As shown in Figure 2, five ring residual units are cascaded
with four pooling layers. The channels obtained, from the top to bottom
of the encoding network, are 32, 64, 128, 256 and 256. Finally, a 16 ×
16 × 256 feature map is obtained.

A ring residual unit [5] is employed as the basic encoder. As shown
in Figure 4(d), a ring residual unit comprises two residual connections
and one feedback propagation. In the first residual connection shown in
Figure 4(a), the feature map $x$ is input to the ring residual unit. The
output $y_f$ is obtained by two convolution operations, a shortcut and an
add operation. The size of each convolutional kernel is $3 \times 3 \times c$ ($c$ is
the number of convolutional kernels). In the residual feedback shown in
Figure 4(b), the output $y_i$ is obtained by backward propagation of $y_f$.
In the second residual connection shown in Figure 4(c), the final output
is obtained with $y_i$ as input.

The outputs $y_f$ and $y_i$ are given by:
$$ 
\begin{aligned}
y_f &= F(x) + x \\
y_i &= (S(y_f) + 1) \times x
\end{aligned}
 $$

where $F(x)$ is the output of two convolutions, $x$ is the input, $y_f$ is the output after the first residual connection, $S$ is the sigmoid activation function. The final output $y_i$ is computed as the sum of the $y_f$ outputs processed by the $S$ function in the residual feedback multiplied by the input $x$.

## 2.3 Decoding Network

The decoding network is also formed by ring residual units, and each decoder has a corresponding encoder. The decoding process performs upsampling on the feature maps, which is a deconvolution operation with a 3 × 3 convolution kernel. Four deconvolution blocks are mapped to the corresponding encoders, where the four deconvolution blocks yield feature maps of sizes 16 × 16 × 256, 32 × 32 × 128, 64 × 64 × 64 and 128 × 128 × 32, respectively. Finally, differences between the tampered and non-tampered regions are identified using the ring residual unit.

## 2.4 Semantic Reinforcement

Pooling layers are widely used in convolutional neural networks to reduce overfitting. However, a pooling operation reduces the size of the feature map, causing some key information to be lost. To address this issue, an attention mechanism is utilized to enhance the semantic information extracted by the encoder for the corresponding decoding process.

Attention mechanisms can focus on important regions in a feature map. Channel attention [9] yields a set of weights that explain the importance of feature map channels. However, channel attention only focuses on channel information. As discussed in [17], a soft threshold function can be regarded as a nonlinear layer embedded in a deep neural network to eliminate unimportant features. Therefore, channel attention with a soft threshold function is used to focus on relevant regions of the feature map and further weaken the unimportant regions.

The soft threshold function is given by:

$$ y = \begin{cases} x - \tau, & x > \tau \\ 0, & |x| \le \tau \\ x + \tau, & x < -\tau \end{cases} $$

where $x$ is the input feature, $y$ is the output feature and $\tau$ is the threshold value.
<figure><img src="image_8.png" /><figcaption>Figure 5. Structure of channel attention with a soft threshold function.</figcaption></figure>

Figure 5 shows the structure of channel attention with a soft threshold function. Global pooling is applied to the feature map to obtain a one-dimensional vector. Next, the one-dimensional vector is applied to the two-layer fully-connected (FC) network with a rectified linear unit (ReLU) and subsequently passed to a sigmoid function to obtain the weight parameter $\alpha$ for each channel. The threshold $\tau$ is computed as:

$$ \tau_c = \alpha_c \times x_c $$

where $\tau_c$ is the threshold of the $c^{th}$ feature map channel, $\alpha_c$ is the weight parameter of the $c^{th}$ channel and $x_c$ is the mean value of the $c^{th}$ channel obtained by global average pooling.

The threshold is positive and stays within a reasonable range. Attention with the soft threshold makes the feature map focus on the channel information and also designates regions below the threshold in each channel as irrelevant regions, weakening the focus on irrelevant regions.

# 3. Experiments and Results

This section describes the experimental setup and metrics, datasets and results.

## 3.1 Experimental Setup and Metrics

An Nvidia GTX 2080 Ti GPU was used to execute the image tampering detection method. The parameters of the network were initialized with random values and optimized by stochastic gradient descent using a batch of 10 samples, momentum of 0.9, weight decay of 0.0005 and initial learning rate of 0.001. Cross-entropy was employed as the loss function.

The metrics used to evaluate the effectiveness of the detection method included the precision $P$, recall $R$ and F1 score $F1$. The metrics were computed as follows:
<table><caption>Table 1. Training and testing dataset splits.</caption><thead><tr><th>Dataset</th><th>Synthetic</th><th>NIST16</th><th>COVERAGE</th><th>CASIA</th></tr></thead><tbody><tr><td>Training Set</td><td>65 K</td><td>404</td><td>375</td><td>5,123 (v2)</td></tr><tr><td>Testing Set</td><td>-</td><td>160</td><td>125</td><td>921 (v1)</td></tr></tbody></table>

$$ 
\begin{aligned}
P &= \frac{TP}{TP + FP} \\
R &= \frac{TP}{TP + FN} \\
F1 &= \frac{2 \times P \times R}{P + R}
\end{aligned}
 $$

where the true positive *TP* is the number of pixels correctly detected as tampered, false negative *FN* is the number of pixels incorrectly detected as real, false positive *FP* is the number of pixels incorrectly detected as tampered, and *F1* is the summed average of the precision *P* and recall *R*.

## 3.2 Datasets

The network was pre-trained using a synthetic dataset from [3] comprising approximately 65 K images with 1024 × 1024 pixels.

The detection method was evaluated using three image forensic datasets. The NIST16 dataset [13] includes images with three types of tampering, splicing, copy-paste and removal. The original COVERAGE dataset [14] comprises only 100 images, primarily images with copy-paste tampering; since this dataset was too small, it was augmented via image flipping to bring the total up to 500 images. The CASIA dataset [6] has two versions, CASIA v1 and CASIA v2. The CASIA v2 is usually used for fine-tuning and CASIA v1 is used for testing. During the training, all the images were resized to 256 × 256 pixels. Table 1 provides details about the datasets, including their training and testing splits.

## 3.3 Experimental Results

This section presents the results of four evaluations of the proposed detection method: ablation, comparisons of pixel-level accuracy against different methods, comparisons of F1 scores and area under curve (AUC) values against different methods, and qualitative evaluation.
<table><caption>Table 2. Comparison of precision, recall and F1 scores for the NIST16 dataset.</caption><thead><tr><th>Method</th><th>Precision</th><th>Recall</th><th>F1 Score</th></tr></thead><tbody><tr><td>Base</td><td>0.840</td><td>0.800</td><td>0.819</td></tr><tr><td>Base-Combined</td><td>0.870</td><td>0.846</td><td>0.857</td></tr><tr><td>Base-SSE</td><td>0.885</td><td>0.858</td><td>0.871</td></tr><tr><td>Proposed Method</td><td><u>0.914</u></td><td><u>0.871</u></td><td><u>0.892</u></td></tr></tbody></table>

The proposed method was compared against traditional detection methods based on feature extraction as well as advanced methods based on deep learning, specifically, ELA [11], NOI [12], CFA [7], FCN [10], Encoder-Decoder [1], J-LSTM-Conv [2], RGB-N [19], LSTM-EnDec [3] and I-DeepLabv3 [18]. Comparisons were performed based on pixel-level accuracy, F1 score and area under curve.

**Ablation.** The validity of the proposed method was evaluated by comparing it against baseline methods. The Base method uses only ring residual units [5]. The Base-Combined method uses encoding with combined features and ring residual units. The Base-SSE method uses semantic reinforcement with the soft threshold function and ring residual units.

Table 2 shows the precision, recall and F1 scores obtained for the NIST16 dataset. The Base-Combined method (using combined features) outperforms the Base method by 3% to 4.6% for all three metrics; this is because combined features convey more tampering information than individual features. The F1 score of the Base-SSE method (using semantic reinforcement) outperforms the Base method by 7% because it focuses on more important regions and compensates for information loss due to downsampling. Table 2 shows that the proposed model method has the best results (underlined) for all three metrics.

**Accuracy Performance Comparisons.** Image tampering detection requires a mask expressing the tampered regions in order to be implemented using a full convolutional structure. Fully convolutional networks (FCNs) [10] and encoder-decoders [1] have been proposed to obtain masks for semantic segmentation. However, Table 3 shows that it is inadequate to use such methods to detect tampered images due to their low pixel-level accuracy results (74.28% and 82.96%). Indeed, with the best pixel-level accuracy of 98.00% (underlined), the proposed method outperforms the FCN and Encoder-Decoder methods with the NIST16 dataset. Note that the dash symbol (-) in Table 3 denotes that
<table><caption>Table 3. Comparison of pixel-level accuracy results.</caption><thead><tr><th>Method</th><th>NIST16</th><th>COVERAGE</th><th>CASIA</th></tr></thead><tbody><tr><td>FCN[10]</td><td>74.28%</td><td>—</td><td>—</td></tr><tr><td>Encoder-Decoder[1]</td><td>82.96%</td><td>—</td><td>—</td></tr><tr><td>J-LSTM-Conv[2]</td><td>84.60%</td><td>88.76%</td><td>—</td></tr><tr><td>LSTM-EnDec[3]</td><td>94.80%</td><td>88.76%</td><td>—</td></tr><tr><td>Proposed Method</td><td><u>98.00%</u></td><td><u>91.55%</u></td><td>86.02%</td></tr></tbody></table>

no results were provided by the developers of the specific method for the given dataset.

The proposed method also fares well in comparison with the J-LSTM-Conv [2] and LSTM-EnDec [3] methods. The pixel-level accuracy results of the proposed method are 13.4% and 3.2% better than the J-LSTM-Conv and LSTM-EnDec methods, respectively, for the NIST16 dataset. The proposed method also has the best result (underlined) with the COVERAGE dataset. The reason is that the combination of ring residual units and multiple features enables the proposed method to better locate tampered regions in images.

**Other Performance Comparisons.** It is not enough to evaluate image tampering detection methods using pixel-level accuracy alone. Therefore, the F1 score and area under curve metrics were used to compare the proposed method against other competing methods.

<table><caption>Table 4. Comparison of F1 scores.</caption><thead><tr><th>Method</th><th>NIST16</th><th>COVERAGE</th><th>CASIA</th></tr></thead><tbody><tr><td>ELA[11]</td><td>0.236</td><td>0.222</td><td>0.214</td></tr><tr><td>NOI[12]</td><td>0.285</td><td>0.269</td><td>0.263</td></tr><tr><td>CFA[7]</td><td>0.174</td><td>0.190</td><td>0.207</td></tr><tr><td>RGB-N[19]</td><td>0.772</td><td>0.437</td><td>0.408</td></tr><tr><td>I-DeepLabv3 [18]</td><td>—</td><td>—</td><td>0.423</td></tr><tr><td>Proposed Method</td><td><u>0.892</u></td><td><u>0.568</u></td><td><u>0.441</u></td></tr></tbody></table>

Table 4 shows the F1 score comparison. The proposed method yielded F1 scores of 0.892 and 0.568 with the NIST16 and COVERAGE datasets, respectively, which constitute 17.0% and 13.1% improvements over the RGB-N method [19]. Note that the dash symbols (—) are assigned to the I-DeepLabv3 method because its developers did not publish results for the NIST16 and COVERAGE datasets.
<table><caption>Table 5. Comparison of pixel-level area under curve results.</caption><thead><tr><td>Method</td><td>NIST16</td><td>COVERAGE</td></tr></thead><tbody><tr><td>ELA[11]</td><td>0.429</td><td>0.583</td></tr><tr><td>NOI[12]</td><td>0.487</td><td>0.587</td></tr><tr><td>CFA[7]</td><td>0.501</td><td>0.485</td></tr><tr><td>J-LSTM-Conv[2]</td><td>0.614</td><td>—</td></tr><tr><td>RGB-N[19]</td><td>0.934</td><td>0.817</td></tr><tr><td>LSTM-EnDec[3]</td><td>0.794</td><td>0.712</td></tr><tr><td>Proposed Method</td><td><u>0.973</u></td><td><u>0.897</u></td></tr></tbody></table>

Table 5 shows the area under curve results for the proposed method and other methods. The proposed method has the best results (underlined) for the two datasets used in the evaluation. Note that the dash symbol (–) is assigned to the J-LSTM-Conv method because its developers did not publish results for the COVERAGE dataset.

Based on the F1 score and area under curve results in Tables 4 and 5, it can be concluded that the proposed method outperforms traditional methods because they manually extract specific features and can only target specific types of tampering. The proposed method also outperforms the deep learning methods in terms of the F1 score and area under curve metrics for the NIST16 and COVERAGE datasets.

**Qualitative Evaluation.** Figure 6 shows sample detection results. The three rows (top to bottom) contain images or results corresponding to the three image tampering techniques, copy-paste, splicing and removal. The first and second columns (from left to right) show the tampered images and tampered region ground truth masks, respectively. The third and fourth columns show the masks predicted using only the ring residual units and the proposed method, respectively. The fifth column shows the probability heat maps.

The qualitative results of tampered localization in Figure 6 compare the localization between the Base method (constructed using only ring residual units) and the proposed method. The ground truth column shows masks that indicate the tampered regions of the images (white portions). The images in the heat map column convey the probabilities of detecting tampered regions. As seen in Figure 6, unlike the proposed method, the Base method incorrectly identifies some small regions as tampered regions or does not detect tampering around the boundaries of tampered regions.
<figure><img src="image_9.png" /><figcaption>Figure 6. Example detection results.</figcaption></figure>

Additionally, when the proposed method was evaluated using the NIST16 testing set comprising the three types of tampered images, it yielded F1 scores of 0.9305 for splicing tampered images, 0.936 for copy-paste tampered images, and 0.8339 for removal tampered images. This amply demonstrates its effectiveness at detecting various types of image tampering. The strong results are obtained because the proposed method encodes rich features that can effectively and accurately detect tampered regions of images.

## 4. Conclusions

The image tampering detection method described in this chapter employs an encoder-decoder network structure with combined multiple feature encoding to segment tampered regions of an image from untampered regions. In particular, it employs combined features and ring residual units for encoding, which enable the effective extraction of tampered features. Furthermore, it incorporates semantic enhancement, which compensates for information loss due to downsampling and improves localization accuracy. The method also demonstrates its generalization capability by detecting tampered images created by different techniques with high accuracy. In a series of experiments, the proposed model outperforms state-of-the-art image tampering detection methods, achieving
F1 scores of 0.892, 0.568 and 0.441 for the NIST16, COVERAGE and CASIA v1 datasets, respectively.

The principal limitation with the image tampering detection method
is its inconsistency at identifying small tampered regions. Future re-
search will attempt to address this limitation.

References

[1] V. Badrinarayanan, A. Kendall and R. Cipolla, SegNet: A deep convolutional encoder-decoder architecture for image segmentation, *IEEE Transactions on Pattern Analysis and Machine Intelligence*, vol. 39(12), pp. 2481-2495, 2017.

[2] J. Bappy, A. Roy-Chowdhury, J. Bunk, L. Nataraj and B. Manjunath, Exploiting spatial structure for localizing manipulated image regions, *Proceedings of the IEEE International Conference on Computer Vision*, pp. 4980–4989, 2017.

[3] J. Bappy, C. Simons, L. Nataraj, B. Manjunath and A. Roy-Chowdhury, Hybrid LSTM and encoder-decoder architecture for detection of image forgeries, *IEEE Transactions on Image Processing*, vol. 28(7), pp. 3286–3300, 2019.

[4] B. Bayar and M. Stamm, Constrained convolutional neural networks: A new approach towards general purpose image manipulation detection, *IEEE Transactions on Information Forensics and Security*, vol. 13(11), pp. 2691–2706, 2018.

[5] X. Bi, Y. Wei, B. Xiao and W. Li, RRU-Net: The ringed residual U-Net for image splicing forgery detection, *Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops*, pp. 30–39, 2019.

[6] J. Dong, W. Wang and T. Tan, CASIA image tampering detection evaluation database, *Proceedings of the IEEE China Summit and International Conference on Signal and Information Processing*, pp. 422–426, 2013.

[7] P. Ferrara, T. Bianchi, A. De Rosa and A. Piva, Image forgery localization via fine-grained analysis of CFA artifacts, *IEEE Transactions on Information Forensics and Security*, vol. 7(5), pp. 1566–1577, 2012.

[8] R. Girshick, Fast R-CNN, *Proceedings of the IEEE International Conference on Computer Vision*, pp. 1440–1448, 2015.

[9] J. Hu, L. Shen, S. Albanie, G. Sun and E. Wu, Squeeze-and-excitation networks, *IEEE Transactions on Pattern Analysis and Machine Intelligence*, vol. 42(8), pp. 2011–2023, 2020.
[10] J. Long, E. Shelhamer and T. Darrell, Fully convolutional networks for semantic segmentation, *Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition*, pp. 3431–3440, 2015.

[11] W. Luo, J. Huang and G. Qiu, JPEG error analysis and its applications to digital image forensics, *IEEE Transactions on Information Forensics and Security*, vol. 5(3), pp. 480–491, 2010.

[12] B. Mahdian and S. Saic, Using noise inconsistencies for blind image forensics, *Image and Vision Computing*, vol. 27(10), pp. 1497–1503, 2009.

[13] Multimodal Information Group, Information Technology Laboratory, Nimble Challenge 2017 Evaluation, National Institute of Standards and Technology, Gaithersburg, Maryland (www.nist.gov/itl/Iad/mig/nimble-challenge-2017-evaluation), 2019.

[14] B. Wen, Y. Zhu, R. Subramanian, T. Ng, X. Shen and S. Winkler, COVERAGE – A novel database for copy-move forgery detection, *Proceedings of the IEEE International Conference on Image Processing*, pp. 161–165, 2016.

[15] Y. Wu, W. Abd-Almageed and P. Natarajan, Image copy-move forgery detection via an end-to-end deep neural network, *Proceedings of the IEEE Winter Conference on Applications of Computer Vision*, pp. 1907–1915, 2018.

[16] Y. Wu, W. Abd-Almageed and P. Natarajan, ManTra-Net: Manipulation tracing network for detection and localization of image forgeries with anomalous features, *Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition*, pp. 9535–9544, 2019.

[17] M. Zhao, S. Zhong, X. Fu, B. Tang and M. Pecht, Deep residual shrinkage networks for fault diagnosis, *IEEE Transactions on Industrial Informatics*, vol. 16(7), pp. 4681–4690, 2020.

[18] Q. Zhao, G. Cao, A. Zhou, X. Huang and L. Yang, Image tampering detection via semantic segmentation network, *Proceedings of the Fifteenth IEEE International Conference on Signal Processing*, pp. 165–169, 2020.

[19] P. Zhou, X. Han, V. Morariu and L. Davis, Learning rich features for image manipulation detection, *Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition*, pp. 1053–1061, 2018.