The term “mimicry attack” has been coined in computer security and used in adversarial machine learning: an attacker observes what a machine-learning system has learned and adjusts the malicious input so that it mimics a benign input. In this paper we extend this concept to image forensics, to allow an attacker modifying a manipulated image so that it appears pristine when analyzed by a target forensic detector. Recent work has shown that such attacks can be executed against detectors based on deep networks for hiding image tampering. We do more than that: our mimicry attack can force the target detector to identify arbitrary fictitious manipulations, while hiding the true ones. Accordingly, the user of the forensic detector is completely misled. From a methodological viewpoint, the proposed attack artificially alters the detector-specific intermediate representations according to the pixel distribution in the manipulated image, by applying a gradient-based optimization process. Experimental tests on different data sets and detectors demonstrate that our approach succeeds in jointly hiding manipulated areas and arbitrarily adding new ones, favorably comparing with the state-of-the-art in the first task.

The amount of multimedia content shared everyday, combined with the level of realism reached by recent fake-generating technologies, threatens to impair the trustworthiness of online information sources. The process of uploading and sharing data tends to hinder standard media forensic analyses, since multiple re-sharing steps progressively hide the traces of past manipulations. At the same time though, new traces are introduced by the platforms themselves, enabling the reconstruction of the sharing history of digital objects, with possible applications in information flow monitoring and source identification. In this work, we propose a supervised framework for the reconstruction of image sharing chains on social media platforms. The system is structured as a cascade of backtracking blocks, each of them tracing back one step of the sharing chain at a time. Blocks are designed as ensembles of classifiers trained to analyse the input image independently from one another by leveraging different feature representations that describe both content and container of the media object. Individual decisions are then properly combined by a late fusion strategy. Results highlight the advantages of employing multiple clues, which allow accurately tracing back up to three steps along the sharing chain.

With today's technologies, the possibility to generate highly realistic visual fakes is within everyone's reach, leading to major threats in terms of misinformation and data trustworthiness. This holds in particular for synthetically generated faces, which are able to deceive even the most experienced observers, and can be exploited to create fake digital identities with synthetic facial attributes, to be used on social networks and online services. In response to this threat, researchers have employed artificial intelligence to detect synthetic images by analysing patterns and artifacts introduced by the generative models. However, most online images are subject to repeated sharing operations by social media platforms. Said platforms process uploaded images by applying operations (like compression) that progressively degrade those useful forensic traces, compromising the effectiveness of the developed detectors. To solve the synthetic-vs-real problem “in the wild”, more realistic image databases are needed to train specialised detectors. In this work, we present TrueFace, a first dataset of social-media-processed real and synthetic faces, obtained by the successful StyleGAN generative models, and shared on Facebook, Twitter and Telegram. The dataset is used to validate a ResNet-based image classification model addressing the discrimination of synthetic-vs-real faces in both presocial and post-social scenarios. The results demonstrate that even detectors with extremely high performance on non-shared images struggle to retain their accuracy on images from social media, while fine-tuning with shared images strongly mitigates such performance issues.

Video stabilization is an in-camera processing commonly applied by modern acquisition devices. While significantly improving the visual quality of the resulting videos, it has been shown that such operation typically hinders the forensic analysis of video signals. In fact, the correct identification of the acquisition source usually based on Photo Response non-Uniformity (PRNU) is subject to the estimation of the transformation applied to each frame in the stabilization phase. A number of techniques have been proposed for dealing with this problem, which however typically suffer from a high computational burden due to the grid search in the space of inversion parameters. Our work attempts to alleviate these short-comings by exploiting the parallelization capabilities of Graphics Processing Units (GPUs), typically used for deep learning applications, in the framework of stabilised frames inversion. Moreover, we propose to exploit SIFT features to estimate the camera momentum and identify less stabilized temporal segments, thus enabling a more accurate identification analysis, and to efficiently initialize the frame-wise parameter search of consecutive frames. Experiments on a consolidated benchmark dataset confirm the effectiveness of the proposed approach in reducing the required computational time and improving the source identification accuracy. The code is available at https://github.com/AMontiB/GPU-PRNU-SIFT.

Abstract The dependability of visual information on the web and the authenticity of digital media appearing virally in social media platforms has been raising unprecedented concerns. As a result, in the last years the multimedia forensics research community pursued the ambition to scale the forensic analysis to real-world web-based open systems. This survey aims at describing the work done so far on the analysis of shared data, covering three main aspects: forensics techniques performing source identification and integrity verification on media uploaded on social networks, platform provenance analysis allowing to identify sharing platforms, and multimedia verification algorithms assessing the credibility of media objects in relation to its associated textual information. The achieved results are highlighted together with current open issues and research challenges to be addressed in order to advance the field in the next future.

In order to defend neural networks against malicious attacks, recent approaches propose the use of secret keys in the training or inference pipelines of learning systems. While this concept is innovative and the results are promising in terms of attack mitigation and classification accuracy, the effectiveness relies on the secrecy of the key. However, this aspect is often not discussed. In this short paper, we explore this issue for the case of a recently proposed key-based deep neural network. White-box experiments on multiple models and datasets, using the original key-based method and our own extensions, show that it is currently possible to extract secret key bits with relatively limited effort.

Abstract Backdoor attacks against supervised machine learning methods seek to modify the training samples in such a way that, at inference time, the presence of a specific pattern (trigger) in the input data causes misclassifications to a target class chosen by the adversary. Successful backdoor attacks have been presented in particular for face recognition systems based on deep neural networks (DNNs). These attacks were evaluated for identical triggers at training and inference time. However, the vulnerability to backdoor attacks in practice crucially depends on the sensitivity of the backdoored classifier to approximate trigger inputs. To assess this, we study the response of a backdoored DNN for face recognition to trigger signals that have been transformed with typical image processing operators of varying strength. Results for different kinds of geometric and color transformations suggest that in particular geometric misplacements and partial occlusions of the trigger limit the effectiveness of the backdoor attacks considered. Moreover, our analysis reveals that the spatial interaction of the trigger with the subject’s face affects the success of the attack. Experiments with physical triggers inserted in live acquisitions validate the observed response of the DNN when triggers are inserted digitally.

The detection of rescaling operations represents an important task in multimedia forensics. While many effective heuristics have been proposed, there is no theory on the forensic detectability revealing the conditions of more or less reliable detection. We study the problem of discriminating 1D and 2D genuine signals from signals that have been downscaled with the goal of quantifying the statistical distinguishability between these two hypotheses. This is done by assuming known signal models and deriving the expressions of statistical distances that are linked to the hypothesis testing theory, namely, the symmetrized form of Kullback-Leibler divergence known as the Jeffreys divergence, and the Bhattacharyya divergence. The analysis is performed for varying parameters of both the genuine signal model (variance and one-step correlation) and the rescaling process (rescaling factor, interpolation kernel, grid shift, and anti-alias filter), thus allowing us to reveal the insights on their influence and interplay. In addition to the signal itself, we consider the signal transformations (prefilter and covariance matrix estimators) that are often involved in practical rescaling detectors, showing that they yield similar results in terms of distinguishability. Numerical tests on synthetic and real signals confirm the main observations from the theoretical analysis.

The convergence statistics of JPEG blocks has been shown to be a useful tool to forensically analyze high quality compressed images. Since current approaches are based on empirical observations, we propose a theoretical analysis explaining the case of grayscale images and maximum quality JPEG compression (i.e., quality factor equal to 100). The approximate distribution of the stable block ratio at different compression stages is derived, showing that it ultimately depends on the variance of the quantization noise in the DCT domain. We apply such results to discriminate never compressed images and images compressed once with maximum quality, by resorting to results on JPEG error statistics. Tests on image patches with different size and content validate the theoretical results, which allow for obtaining high accuracy through a calibration-free maximum likelihood classification rule.

Studying the impact of sharing platforms like social networks and messaging services on multimedia content nowadays represents a due step in multimedia forensics research. In this framework, we study the characteristics of images that are uploaded and shared through three popular mobile messaging apps combined with two different sending mobile operating systems (OS). In our analysis, we consider information contained both in the image signal and in the metadata of the image file. We show that it is generally possible to identify a posteriori the last app and the OS that have been used for uploading. This is done by considering different scenarios involving images shared both once and twice. Moreover, we show that, by leveraging the knowledge of the last sharing app and system, it is possible to retrieve information on the previous sharing step for double shared images. In relation to prior works, a discussion on the influence of the rescaling and recompression mechanism - usually performed differently through apps and OSs - is also proposed, and the feasibility of retrieving the compression parameters of the image before being shared is assessed.

Although several methods have been proposed for the detection of resampling operations in multimedia signals and the estimation of the resampling factor, the fundamental limits for this forensic task leave open research questions. In this work, we explore the effects that a downsampling operation introduces in the statistics of a 1D signal as a function of the parameters used. We quantify the statistical distance between an original signal and its downsampled version by means of the Kullback-Leibler Divergence (KLD) in case of a wide-sense stationary 1st-order autoregressive signal model. Values of the KLD are derived for different signal parameters, resampling factors and interpolation kernels, thus predicting the achievable hypothesis distinguishability in each case. Our analysis reveals unexpected detectability in case of strong downsampling due to the local correlation structure of the original signal. Moreover, since existing detection methods generally leverage the cyclostationarity of resampled signals, we also address the case where the autocovariance values are estimated directly by means of the sample autocovariance from the signal under investigation. Under the considered assumptions, the Wishart distribution models the sample covariance matrix of a signal segment and the KLD under different hypotheses is derived.

Intrinsic statistical properties of natural uncompressed images are used in image forensics for detecting the traces of previous processing operations. In this paper, we propose novel forensic detectors of JPEG compression traces in images stored in uncompressed formats, based on a theoretical analysis of Benford-Fourier coefficients computed on the 8 × 8 block-Discrete Cosine Transform (DCT) domain. In fact, the distribution of such coefficients is derived theoretically both under the hypotheses of no compression and previous compression with a certain quality factor, allowing for the computation of the respective likelihood functions. Then, two classification tests based on different statistics are proposed, both relying on a discriminative threshold that can be determined without the need of any training phase. The statistical analysis is based on the only assumptions of generalized Gaussian distribution of DCT coefficients and independence among DCT frequencies, thus resulting in robust detectors applying to any uncompressed image. In fact, experiments on different datasets show that the proposed models are suitable for the images of different sizes and source cameras, thus overcoming dataset-dependence issues that typically affect the state-of-art techniques.

We address the known problem of detecting a previous compression in JPEG images, focusing on the challenging case of high and very high quality factors (>= 90) as well as repeated compression with identical or nearly identical quality factors. We first revisit the approaches based on Benford--Fourier analysis in the DCT domain and block convergence analysis in the spatial domain. Both were originally conceived for specific scenarios. Leveraging decision tree theory, we design a combined approach complementing the discriminatory capabilities. We obtain a set of novel detectors targeted to high quality grayscale JPEG images.

In this paper, we propose a forensic technique that is able to detect the application of a median filter to 1D data. The method relies on deterministic mathematical properties of the median filter, which lead to the identification of specific relationships among the sample values that cannot be found in the filtered sequences. Hence, their presence in the analyzed 1D sequence allows excluding the application of the median filter. Owing to its deterministic nature, the method ensures 0% false negatives, and although false positives (sequences not filtered classified as filtered) are theoretically possible, experimental results show that the false alarm rate is null for sufficiently long sequences. Furthermore, the proposed technique has the capability to locate with good precision a median filtered part of 1-D data and provides a good estimate of the window size used.

Digital forensics is a relatively new research area which aims at authenticating digital media by detecting possible digital forgeries. Indeed, the ever increasing availability of multimedia data on the web, coupled with the great advances reached by computer graphical tools, makes the modification of an image and the creation of visually compelling forgeries an easy task for any user. This in turns creates the need of reliable tools to validate the trustworthiness of the represented information. In such a context, we present here RAISE, a large dataset of 8156 high-resolution raw images, depicting various subjects and scenarios, properly annotated and available together with accompanying metadata. Such a wide collection of untouched and diverse data is intended to become a powerful resource for, but not limited to, forensic researchers by providing a common benchmark for a fair comparison, testing and evaluation of existing and next generation forensic algorithms. In this paper we describe how RAISE has been collected and organized, discuss how digital image forensics and many other multimedia research areas may benefit of this new publicly available benchmark dataset and test a very recent forensic technique for JPEG compression detection.

First-order statistics of First Significant Digits (FSD) have been recently exploited in multimedia forensics as a powerful tool to reveal traces of previous coding operations. As an answer, adversarial approaches aimed at modifying the FSD histogram and fooling such forensic methods have been proposed. However, the existing techniques have limitations in terms of distortion introduced in the multimedia object. In this paper, a transportation-theoretic formulation of the problem is presented which provides a close-to-optimal solution. Such strategy is tested in a well-known image forensic scenario, where FSDs of 8 × 8-DCT coefficients after single or double quantization are modified in order to restore a certain target histogram and the distortion with respect to the provided compressed image is measured in terms of MSE.

Intrinsic statistical properties of natural uncompressed images can be used in image forensics for detecting traces of previous processing operations. In this paper, we extend the recent theoretical analysis of Benford-Fourier coefficients and propose a novel forensic detector of JPEG compression traces in images stored in an uncompressed format. The classification is based on a binary hypothesis test for which we can derive theoretically the confidence intervals, thus avoiding any training phase. Experiments on real images and comparisons with state-of-art techniques show that the proposed detector outperforms existing ones and overcomes issues due to dataset-dependency.

Traces left by lossy compression processes have been widely studied in digital image forensics. In particular, the artifacts produced by JPEG compression have been characterized and exploited both in forensic methods and counter-forensic attacks. In this paper, we propose a novel anti-forensic procedure, aimed at concealing the traces of single JPEG compression by recovering the original distribution of first significant digits (FSD) of the DCT coefficients. We analyze the performance of our method and compare it with anti-forensic attacks reported in the literature in terms of quality of the resulting image. In addition, we prove the effectiveness of our approach as counter-forensic processing by measuring its impact on the performance of two different forensic tools, applied after the anti-forensic action.