A STUDY ON THE PHOTO RESPONSE NON-UNIFORMITY NOISE PATTERN BASEDIMAGE FORENSICS IN REAL-WORLD APPLICATIONS

Yu Chen and Vrizlynn L. L. Thing

Institute for Infocomm Research,1 Fusionopolis Way, 138632, Singapore{ychen, vriz}@i2r.a-star.edu.sg

ABSTRACT

In this paper, we study Photo Response Non-Uniformity(PRNU) based image tampering detection methods and theirapplicability in real-world image tampering detection applica-tions. Experiments using current PRNU based image forensicmethods were conducted to evaluate the performance of ex-isting methods in the realistic applications. The PRNU basedforensic approach was tested on the images taken by cam-eras including current and popular DSLR/sub-DSLR modelswhich have rarely been tested and reported. In our exper-iments, over 800 PRNU noise patterns are generated from80 authentic photos and the biometric-like experiments havebeen conducted to study the similarities between intra-classand inter-class PRNU noise patterns. The analysis for theperformance of current methods and the suggestions for thefurther research and development towards PRNU based im-age forensic approach are presented.

Index Terms— Photo response non-uniformity; Imageforensics; Image tampering detection; Image identity

1. THE RESEARCH BACKGROUND

With the progress of information technology, more and moreof our activities are recorded in electronic formats, e.g. digitalimages, videos, and sound records. Among these formats, thedigital image plays an important role as a popular informationcarrier. Thus, there is an increasing security concern on theintegrity of images. The original photos may be tampered toserve as manipulated evidences to support an inexistent fact.Therefore, a robust image tampering detection or identity ver-ification approach is thus in requests[1].

The expectation of an image tampering detection ap-proach is to be able to verify the integrity of an image anddetect the tampered region if the image is forged. The chal-lenges faced when designing such an approach are 1) thereare plenty of image forgery methods; and the design is ex-pected to detect targeted images generated by different kindsof tampering processes. 2) There should be no restrictions

on the formats of the targeted images, and the design is ex-pected to be reliable for most of popularly used image for-mats. The PRNU based image integrity verification methodcan be considered as a promising candidate technique for de-veloping such an image forgery detection system. Becausethe PRNU based algorithm utilizes the device/camera identityfor image verification, it can work for different image tamper-ing methods and for different image formats as well [3][4] [5][6][7].

The fundamental design idea of the PRNU verificationmethod is that each camera bears a unique noise pattern, likeeach person has unique fingerprints and iris patterns, and thePRNU noise patterns are identical in all of the photos takenby this camera. Thus, the integrity of an image can be verifiedif the following two conditions can be met: 1) the noise pat-tern can be extracted from the image/images and 2) the cam-era PRNU noise pattern has been obtained. We believe im-age identity verification may be possible by using the PRNUmethod because it is possible to obtain multiple photos froma target camera. Those images can be obtained from existingphotos or by taking new photos with the camera.

However, for further design and development regarding apractical image forensic approach, the PRNU based techniquemust be tested for its robustness against the lower noise lev-els of recent consumer digital cameras. The improved noisededuction schemes of the recent cameras may affect the per-formance of PRNU based methods. It would be very diffi-cult to extract the reliable PRNU patterns from the cameraswhich embed more advanced noise control features. Few re-ported works have tested the PRNU based methods for theimages/photos taken by current mid-end and high-end cameramodels. In this work, we conduct an investigation and eval-uation which are supported by newly designed experimentsto discover the feasibility and possible design directions of apractical PRNU based image forensics approach for currentreal world applications.

In the rest of this paper, a review of the existing PRNUbased methods is given in Section 2. In section 3, the con-ducted experiments are demonstrated. Analysis and sug-

gestions for further research and development regarding thePRNU based image tampering detection approach is pre-sented in the last section.

2. THE REVIEW OF EXISTING PRNU NOISEPATTERN BASED IMAGE FORENSICS METHODS

Some algorithms and approaches that have been proposed toextract the camera PRNU noise pattern with single or multipleimages. Based on the reported results, the existing methodsare robust and reliable in image integrity verification as wellas tampered region detection for previously introduced low-end camera models. This section would give a brief review tothe current approaches, and more details of this approach canbe found in [3][8].

The PRNU pattern is one kind of Fixed Pattern Noise(FPN). The FPN is a constant pattern that identifies non-uniformity noises in an imaging device/camera. The unique-ness of FPN is due to the differences caused by the small man-ufactory variations or defects for each device. The FPN con-sists of dark signal non-uniformity (DSNU) which is the noiseresponse pattern obtained without external illuminations andthe PRNU which refers to the ratio of the illumination inten-sity on a pixel to the output signal.

The DSNU is only present in images without external il-luminations e.g. taking image with lenses covers on. It isdifficult to obtain such images for some of image tamperingdetection cases, e.g. the camera is not accessible. Obviously,the PRNU based method is more applicable for most of real-world image forensic applications, as the pattern is present inmost of images with external illuminations.

An existing well recognized PRNU method is proposedby[8]. Here we give a brief introduction. The image withPRNU noise would be an output of the camera sensor to theinput illumination. This output can be modeled as:

I = I(0) + I(0)K + θ (1)

I(0) is the noise-free response, the θ is a combination ofindependent random noises and the I(0)K is the PRNU term.A de-noised output I(0) can be obtained by a de-noising filter,then,

W = I − I(0) = IK + I(0) − I(0) + (I(0) − I)K + θ

= IK + ε (2)

The noise ε is the sum of θ and two additional terms in-troduced by the de-noising filter. The image content is sig-nificantly deducted in the noise residual W, thus the PRNUpattern can be better computed from W than from originalimage I .

The estimator of the PRNU factor K can be derived fromN images from the camera, for k = 1, 2, ...N as

Wk

Ik= K +

εkIk, Wk = Ik − I(0)k , I

(0)k = F (Ik) (3)

Then, from N images, the likelihood of K factor can ob-tained as:

L(K) =

−N/2N∑

k=1

log(2πσ2/(I2k))−N∑

k=1

(Wk/Ik −K)2

2σ2/(Ik)2(4)

The ML estimate K for the expected PRNU fact is ob-tained by taking partial derivatives of (5) as:

K =N∑

k=1

WkIk/N∑

k=1

(Ik)2 (5)

A matrix of K can be obtained as a PRNU noise patternof a given picture. The filter they used to obtain the noise-lessI(0) is a frequency selective filter [2].

Further research and studies have been conducted to im-prove the PRNU based methods and investigate the meth-ods in various applications. The authors from [9] studiedthe PRNU based image forensics method on video identifica-tion, and from the reported results, the PRNU based methodworks well for the videos with low resolutions. The work in[11] discovered that the minimum average correlation energy(MACE) filter is better than the normalized cross correlations(NCC) filter in calculating the similarity scores for camcorderidentification. In [10], the Block-matching and 3D (BM3D)filter is used to obtain de-noised image and thus to get thePRNU noise pattern. Their reported results show that betterPRNU patterns can be generated by using BM3D than usingthe wavelet selective filter [2].

3. EXPERIMENTS OF PRNU APPROACH

The purpose of our experiments is to test the PRNU basedmethod on the images with lower noise levels. Becausethe designs of imaging devices/cameras improve rapidly withonly several months for a new generation of models to arrive,the inherited noise is getting less obvious and more difficultto be estimated. We need to find out if the PRNU noise pat-terns can be still detectable for the recent mid-end or high-endcamera models, and how well the detection performance is.

In our experiments, we adopt BM3D denoising filter[12]to obtain the denoised image Idenoised . The BM3D filter isconsidered as one of most advanced image denoising filters[10] and is proven to outperform the wavelet denoising filter[2] which is applied in the most of previous works.

To eliminate the artefacts given by the sensor design andthe colour interpolation which are identical for each brand and

model, as suggested in [8], the noise pattern is zero-meanedby subtracting the mean value of each row from each pixel inthe row and then subtracting the mean value of each columnfrom each pixel in the column.

N =

M∑i=1

NiIorii /

M∑i=1

(Iorii )2 (6)

Multiple images from the same camera have been used toestimate a PRNU noise pattern [3]. Although there are someexiting methods to estimate the PRNU noise from a singleimage, using multiple images would get very reliable and ac-curate results. As in Equation (7), to obtain the PRNU noisepattern, the noise from each image contribute with differentweights regarding the intensity of the pixel in the original im-age to the final estimation of PRNU pattern. We treat thethree channels of images separately and add one channel asthe summation of RGB channels. Thus, four PRNU patternscan be extracted for one camera.

To calculate the similarity between each pair ofPRNU patterns Pa and Pb, we use the cross-correlationcorr(Pa, Pb).

The experiments are carried out with the relatively newgenerations of mid-end and high-end camera models includ-ing Canon EOS 60D, NIKON J1, NIKON D90, and SONYNEX-5N. The reason we chose these camera models for ourexperiments is that they are currently popular consumer dig-ital cameras with advanced noise detection features and littleinformation or experimental result has been analyzed or re-ported for the camera models like those. We also believe thatif a practical and reliable image forensics approach is achiev-able; such an approach should be able to work stably for mostof the current on the market camera models as well as thenew models which can be expected in the near future. Withthe rapid improvement of techniques, the noise levels in thenewly introduced low-end and mid-end camera models couldbe even better than some high-end models introduced yearsago. Thus, if an image forensic algorithm lacks the capabil-ities required for some relatively new mid-end or high-endcamera models, it cannot be expected to be reliable for up-coming camera models in practical applications for a reason-able period of time e.g. two or three years.

As the definition of the high-end camera model includesthose professional and rarely sold in the market ones, for aconvincing evaluation, we chose those four models which arecurrently popular and were sold at reasonable prices. The costfor each of four models camera body with one or two lensesis less than US$1,000, as in early 2012.

We use four cameras of those four models in our experi-ments. 20 photos with natural scenes were collected for eachcamera. The photos were taken by our colleagues who haveconfirmed that none of the collected photos has been post-processed after being transmitted out from the cameras. Some

example photos we use in our experiments are illustrated inFig.1.

We randomly chose 10 photos taken from each camera togenerate the reference patterns and use the rest of the pho-tos to generate our query patterns. To generate the regionalPRNU noise patterns, we divided 35 non-overlapping regionswith the same dimensions of 512x512 from the top left re-gion with the target region size of 3584x2560 for each photo.Thus, each camera can have 35 PRNU reference patterns from10 chosen images and there are 140 reference patterns in to-tal in our study. To illustrate the effects of image quantity tothe PRNU pattern estimation, two sets of query patterns havebeen generated. Each of the first set of query patterns is ob-tained by using a pair of photos from the same camera. Thus,for each camera, there are 175 query patterns and 700 querypatterns in total. Each of the second set of query cases is gen-erated by using 5 photos from the same camera. Thus, thereare 70 query patterns for each camera and we have 280 querycases in the experiment.

The experiments are designed to test each of query pat-terns against every reference pattern by measuring the similar-ity scores. For the first experiment which uses the set of 700queries, there are 98000 (700 *140) comparisons for each offour channels, among those, 700 belong to intra-class compar-isons and the rest 97300 refer to inter-class comparisons. Forthe second experiment which uses the set of the 280 queries,there are 39200 (280 *140) comparisons in total for each offour channels, among those, 280 are intra-class comparisonsand the rest 38920 comparisons refer to inter-class.

The distributions in percentages of the similarity scoresof inter-class and intra-class for two sets of experiments areillustrated in the Fig.2. The four figures on the left side ofFig.2 illustrate the similarity distributions for the first exper-iment with each query pattern generated from 2 images, andthe four figures on the right illustrate the second experimentwith each query pattern generated from 5 images. The firstthree rows of figures refer to the red, green and blue channelrespectively and the fourth row refer to the summation chan-nel with each similarity score is the summation of the scoresof RGB channels. The horizontal axis of each figure indicatesdifferent similarity scores calculated by cross correlation, andthe vertical axis of each figure indicates the different distri-butions of the comparisons in percentage which is obtainedby dividing the total number of comparisons with a certainscore from each class by the total number of comparisons con-ducted in the same class.

From Fig.2, it can be seen from both experiments, the sim-ilarity scores for a majority of inter-class (blue bins) occupywithin the small similarity scores while the similarity scoresfor intra-class (red bins) expand for a wider range on the hori-zontal axis. The similarity distributions for the second exper-iment are better separated between inter-class and intra-classthan the first experiment. This is because the PRNU noisepattern can be better estimated with more images, each of the

Table 1. The cameras used in the experiment, with corresponding model featuresAttributes Canon EOS 60D NIKON J1 SONY NEX-5N NIKON D90

Resolutions (as default) 5184 x 3456 3872 x 2592 4912 x 3264 4288 x 2848Introduced in 2010 2011 2011 2008

Output formant JPEG JPEG JPEG JPEGNumber of images 20 20 20 20

Camera type DSLR Sub-DSLR Sub-DSLR DSLR

Fig. 1. the example photos used in our experiments

query patterns for the first experiment is generated from 2 im-ages which is less than 5 images used for the second experi-ment. The ROC curves for each experiment are generated andshown in Fig.3 for a further analysis.

In Fig.3, the four figures on the left side refer the firstexperiment and the other four figures on the right refer tothe second experiment. The figures from the first to fourthrow demonstrate the ROC curves for the red, green, blue andthe summation channel, respectively. The red curves showthe corresponding false acceptance rate (FAR) and the greencurves refer to the corresponding false rejected rate (FRR).The horizontal axis from each figure in Fig.3 illustrates dif-ferent thresholds on the similarity scores and the vertical axisrefers to the corresponding FAR and FRR rates. It is shownclearly that with the increasing of the threshold on the sim-ilarity scores, the FAR rate drops, which means fewer com-parisons from inter-class are classified as identical. Mean-while, the FRR rate increases as more comparisons from theintra-class are classified as non-identical. To better illustratethe classification capability for the tested PRNU method, theequal error rate (EER) on each channel for each experiment isgiven in Table 2.

In Table 2, it is clearly shown that the second experimentwith better PRNU estimation yields better classification per-formance than the first experiment. In our experiments, thebest result we got is from the second experiment which uti-lizes 5 images to estimate each query PRNU pattern.

4. CONCLUSION AND FUTURE WORKS

The results from our experiments show that the PRNU basedmethods are able to provide a certain level of capability interms of verifying the integrity of the photos, even in chal-lenging cases when using photos taken by the current mid-end and high-end camera models as targets, and the numberof images used to estimate the PRNU pattern is limited. Theexperimental results support the feasibility for further designand development of a PRNU based practical and reliable im-age tampering detection approach for real-world applications.

The lowest EER rate we obtained is at the level of 10−2

at 0.0853 which is given by the summation channel of oursecond experiment. However, a reliable biometric approachsuch as finger print or iris recognition system usually yields anEER rate well below the level of 10−3. Increasing the quan-tity of images used for the PRNU pattern estimation wouldcertainly improve the performance but would also make theapproach less applicable for many realistic applications whenthe number of photos we can obtain from the target camera islimited.

Considering that the consumer digital cameras are still im-proving fast and the images are expected to get more noise-less, we suggest not taking the PRNU based image forensicapproach as a reliable and standalone image tampering de-tection system but as an integrated supporting module workswith other image forensic approaches to increase the decisionconfidence and improve the robustness of the whole system.

Regarding future work, we plan to work on further testing

Fig. 2. the distributions of similarity scores for first (left column of figures) and second experiment (right column)

Fig. 3. the ROC curves for the first experiment (left column of figures) and the second experiment (right column)

Table 2. the EER rates for the red, green, blue and summation of RGB channels from the first and second experimentsExperiments Red channel Green channel Blue channel Summation RGB

1st experiment EER 0.1715 0.1980 0.1954 0.17461st experiment Threshold 0.0074 0.0072 0.0085 0.0219

2nd experiment EER 0.0860 0.0965 0.1013 0.08532nd experiment Threshold 0.0200 0.0225 0.0225 0.0654

on PRNU based methods with involving more camera modelsfrom low-end to high-end and from recent to previous mod-els for a more thorough investigation. Furthermore, we areworking on improvements for the PRNU pattern estimationmethod to obtain better PRNU pattern without involving moreimages.

5. ACKNOWLEDGMENTS

The authors would like to thank our I2R colleagues Mr. Wee-Yong Lim, Mr. Darell J. J. Tan and Mr. Jun-Wen Wong forsharing the photos used in our experiments.

6. REFERENCES

[1] A.C., Popescuand and H., Farid: Exposing Digital Forg-eries in Color Filter Array Interpolated Images. IEEETransactions on Signal Processing, vol. 53(10), pp.39483959, 2005.

[2] M. K. Mihcak, I. Kozintsev, and K. Ramchandran, Spa-tially adaptive statistical modelling of wavelet image co-efficients and its application to denoising, in Proc. IEEEInt. Conf. Acoustics, Speech, and Signal Processing,Phoenix, AZ, Mar. 1999, vol. 6, pp. 32533256.

[3] J. Luks, J. Fridrich, and M. Goljan, Digital camera iden-tification from sensor pattern noise, IEEE Trans. Inf.Forensics Security, vol. 1, no. 2, pp. 205214, Jun. 2006.

[4] H. Gou, A. Swaminathan, and M. Wu, Robust scan-ner identification based on noise features, in Proc. SPIE,Electronic Imaging, Security, Steganography, and Water-marking of Multimedia Contents IX, San Jose, CA, Jan.29Feb. 1, 2007, vol. 6505, pp. 0S0T

[5] N. Khanna, A. K. Mikkilineni, G. T. C. Chiu, J. P. Alle-bach, and E. J. Delp, III, Forensic classification of imag-ing sensor types, in Proc. SPIE, Electronic Imaging, Se-curity, Steganography, Watermarking Multimedia Con-tents IX, San Jose, CA, Jan. 29Feb. 1, 2007, vol. 6505,pp. 0U0V

[6] B. Sankur, O. Celiktutan, and I. Avcibas, Blind identifi-cation of cell phone cameras, in Proc. SPIE, ElectronicImaging, Security, Steganography, Watermarking Multi-media Contents IX, San Jose, CA, Jan. 29Feb. 1, 2007,vol. 6505, pp. 1H1I.

[7] T. Gloe, E. Franz, and A. Winkler, Forensics for flatbedscanners, in Proc. SPIE, Electronic Imaging, Security,Steganography, Watermarking Multimedia Contents IX,San Jose, CA, Jan. 29Feb. 1, 2007, vol. 6505, pp. 1I1J.

[8] M. Chen, J. Fridrich, and M. Goljan, and J. Luk , De-termining image originand integrity using sensor noise,IEEE Trans. Inform. Sec. Forensics, vol. 3, no.1, pp.7490, Mar. 2008

[9] V. H. Wiger and G. Zeno, Using Sensor Noise to Iden-tify Low Resolution Compressed Videos from YouTubein Proc. Computational Forensics, Lecture Notes in Com-puter Science, Volume 5718. ISBN 978-3-642-03520-3.Springer Berlin Heidelberg, 2009, p. 104

[10] Chierchia,G.,Parrilli,S., Poggi,G., Sansone,C., Verdo-liva, L., On the Influence of Denoising in PRNU basedForgery detection. Proceedings of the 2nd ACM work-shop on Multimdia in Forensics,Security and Intelligence2010, pp.77-82

[11] D.K., Hyun, C.H. Choi, H.K., Lee, Camcorder Identifi-cation for Heavily Compressed Low Resolution Videos,Lecture Notes in Electrical Engineering, 2012, Volume114, Part 5, 695-701, DOI: 10.1007/978-94-007-2792-2-68

[12] K. Dabov, A. Foi, V. Katkovnik, and K. Egiazarian, Im-age denoising by sparse 3D transform-domain collabora-tive filtering, IEEE Trans. Image Process., vol. 16, no. 8,August 2007.