CHEN AND HSU: DETECTING RECOMPRESSION OF JPEG IMAGES VIA PERIODICITY ANALYSIS 397(a) (b)Fig. 1. DCT coefﬁcients histogram: (a) 2nd ac term with quantization step size and (b) 12th ac term with quantization step size .image has been cropped and recompressed. However, thesespatial domain methods, which rely on detecting abnormalityin blocking artifacts, are unable to detect recompression whenthere involves no spatially shift or cropping with misalignedblock boundaries from the original JPEG image.In frequency domain analysis, Benford’s law has been usedto model the statistical change in DCT coefﬁcients caused byrecompression , . In , a method via DCT coefﬁcientanalysis is proposed to detect and locate doubly compressed re-gions. However, although these frequency domain methods tryto detect abnormality in DCT distributions, they usually fail todetect recompression with misaligned block boundaries.As is clear from the previous discussion (and to the bestof our knowledge), no approach has been proposed for JPEGrecompression detection that tackles both aligned and mis-aligned block boundaries. Considering that quantization tableestimation completely relies on analysis of DCT coefﬁcients,one would fail to measure the primary quantization table fromrecompressed images once there involves spatial shift withmisaligned block boundaries. On the other hand, the spatialdomain methods for detecting the abnormality of blocking arti-facts would fail when the recompression includes no shifted ormisaligned block boundaries. To the contrary, when the blockboundaries in the recompressed images are misaligned fromthe original JPEG image, frequency domain methods usuallyfail to detect the abnormalities on DCT distributions.In this paper, we assume the authentic images are originally inJPEG format and all tampering operations involve recompres-sion. We propose a new compression characteristic that shouldbe insensitive to either block aligned or misaligned cases, andthen detect recompression in JPEG images using this proposedcharacteristic. In Section II, we describe the periodic character-istic of JPEG compressed images in mathematic formulation. InSection III, we further derive the variation of periodicity charac-teristics for doubly compressed JPEG images. Based on the pe-riodicity characteristics discussed in Sections II and III, we thenpropose a robust recompression detection method in Section IV.A series of experimental results are presented in Section V tovalidate the effectiveness of the proposed method. Finally, weconclude in Section VI.II. PERIODICITY CHARACTERISTICS OF JPEG IMAGESIn the JPEG lossy compression standard, an input image isﬁrst divided into nonoverlapped 8 8 blocks, and each block isindividually transformed using the DCT. The DCT coefﬁcientsare then quantized by a quantization matrix and ﬁnally encodedby the entropy coder. This block-based compression scheme in-herently results in periodicity characteristics in both the spatialand DCT domains. In the spatial domain, since each block is in-dividually transformed and quantized, the intensity inconsisten-cies between block boundaries may result in blocking artifacts.Especially in a heavily compressed image, blocking artifacts arecomparatively noticeable every eight pixels and yield a regularperiodic pattern in the spatial domain. In the DCT domain, sinceall blocks are quantized using the same 8 8 quantization ma-trix, coefﬁcients of the same DCT term in the entire image aremultiples of their corresponding quantization step. If we con-struct a histogram for each DCT term, then each of the 64 his-tograms would behave as a periodic signal. Note that the peri-odicity become less obvious with a large quantization step size,because most DCT coefﬁcients will be quantized to zero. Anexample is shown in Fig. 1, where Fig. 1(a) and (b) are the his-tograms of the 2nd and the 12th ac terms (in zigzag scan order).From Fig. 1, histogram of lower frequency term shows a clearperiodic pattern, while the periodicity in higher frequency termis less obvious.Next, we will mathematically formulate the periodicity char-acteristics in spatial and DCT domains.A. Periodicity of Blocking ArtifactsBlocking artifacts are caused by the intensity distortion be-tween adjacent blocks after lossy compression. Let denote thebinary representation of the ideal blocking artifacts for an 8 8blockif(1)where 1 indicates the area with consistent intensity and 0 indi-cates the blocking boundary. Hence, the binary representation
398 IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. 6, NO. 2, JUNE 2011Fig. 2. The 8 8 peaks after discrete Fourier transform.of blocking artifacts for a JPEG image is represented as(2)where indicates the periodicity of block coding, which equalseight in JPEG format.In (2), we model the ideal blocking artifacts as a 2-D periodicpattern in spatial domain. Next, we analyze the spatial period-icity by conducting Fourier transform on and obtain(3)Equation (3) shows that is nonzero only when orare multiples of or . Hence, there are peaksin the Fourier domain of the ideal 2-D periodic signaland the peak magnitudes areotherwise(4)where , . If we partition these 8 8 peaks intofour regions, as shown in Fig. 2, then, from (4), the peak magni-tudes are consistent within each region. Therefore, we concludethat the peak energy distributions characterize the periodicity ofideal blocking artifacts in the spatial domain and can be seen asan inherent signature of a singly compressed JPEG image.B. Periodicity of DCT CoefﬁcientsThe distribution of block DCT coefﬁcients on natural imageshas been shown to behave like Gaussian and Laplacian distribu-tions for dc and ac coefﬁcients, respectively. As shown in Fig. 3,although the quantized coefﬁcients concentrate only on multi-ples of the quantization steps, the distribution remains the sameeven after the DCT coefﬁcients are quantized. Therefore, wecould formulate the distribution of quantized DCT coefﬁcientsin singly compressed JPEG images as(5)where indicates the quantization step size, denotesa zero-mean Laplacian distribution and is the Laplacian pa-rameter. In (5), is normalized by to ensure the proba-bility integral equals to one.We next analyze the periodicity in (5) by 1-D Fourier trans-form and obtainifelseifelse.(6)In (6), since and are near zero and negligible, thespectrum behaves like a periodic signal with constant peak mag-nitude on multiples of . An example is shown in Fig. 4.Thus, we could use the peak energy distribution to characterizethe periodicity of DCT coefﬁcients in the frequency domain.Note that, although this periodicity exists in every quantizedDCT coefﬁcient, those DCT coefﬁcients quantized by largequantization step sizes tend to concentrate only on a few peaks[as shown in Fig. 1(b)] and thus yield weaker periodicity in theFourier domain [as shown in Fig. 4(b)].III. CHANGE OF PERIODICITY CHARACTERISTICS AFTERRECOMPRESSIONIn Section II, we derived two periodicity characteristics forsingly compressed JPEG images. In this section, we analyzehow recompression may affect the above-mentioned character-istics. We assume all the source images are originally JPEGcompressed and all the tampering operations will eventually in-volve recompression. Fig. 5 shows an example of copy-movetampering, where and are the upper-left coor-dinates of the region in the original and tampered images, re-spectively. As shown in Fig. 5, the copy-move tampering mayresult in misaligned block boundaries between the two JPEGimages if or are not multiples of the blocksize. Otherwise, the tampered image would have aligned blockboundaries. In addition, we assume that no matter what tam-pering operations are conducted on an image, the ﬁnal step is to
CHEN AND HSU: DETECTING RECOMPRESSION OF JPEG IMAGES VIA PERIODICITY ANALYSIS 399(a) (b)Fig. 3. Distribution of ﬁrst ac term: (a) unquantized DCT coefﬁcients; (b) quantized DCT coefﬁcients with quantization step .(a) (b)Fig. 4. Fourier domain of Fig. 1(a) and (b), respectively.Fig. 5. Example of copy-move tampering .save and recompress the tampered image as a new JPEG image.We will now discuss how recompression may change the twoperiodicity characteristics in the spatial and DCT domains.A. Periodic Blocking Artifacts After Misaligned-BlockRecompressionIn a singly compressed image, blocking artifacts are locatedonly on block boundaries, as indicated in (2). However, oncean image has been tampered or cropped with misaligned blockboundaries, the original blocking artifacts would shift along thecropping vector . Thus, we formulate the blocking arti-facts in the cropped image (or subimage) as(7)where , ; andare the coordinates in the original and spatially shiftedJPEG images, respectively.Note that, although blocking artifacts provide evidence ofcompression in the spatial domain, if and (i.e.,aligned-block boundaries), we will not be able to detect anyabnormalities in the blocking artifacts from the recompressedimage. Therefore, here we only discuss the misaligned-blockcase, which means that after recompression, the originalblocking artifacts would be located inside the blocks, but notalong the block boundaries.Fig. 6 shows the tampering operation with block-misalignedcropping and recompression. Since the strength of the originalblocking artifacts would decrease after recompression, as shown
400 IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. 6, NO. 2, JUNE 2011Fig. 6. Cropping and recompression operation: (a) the primary block with theﬁrst compression artifact; (b) after cropping, the blocking artifacts were shiftedaway from the block boundary; (c) after recompression, new blocking artifactsappear on the current block boundary, and the primary compression effect re-mains inside the block but with weaker strength.in Fig. 6(c), we formulate the original blocking artifacts in therecompressed image as(8)where , , and , .The parameters and indicate the decreasing degrees ofthe original blocking artifacts at the th block. In order toobtain tractable results, we assume the decreasing degrees areblock independent and rewrite (8) as(9)where and , . Now, with (2),(7), and (9), we assume the blocking artifacts in the ﬁrst andsecond compressions are conditionally independent and thenmodel the mathematical form of the two blocking artifacts inthe recompressed image as(10)Next, we again analyze the periodic characteristic by Fouriertransform and derive the power spectrum ofotherwise(11)where andif andFrom (11), we see that power spectrum is determined by thefollowing factors: , , , and . Unlike (4), the peak mag-nitude will not always be consistent in the vertical, horizontal,and diagonal regions (as deﬁned in Fig. 2).B. Periodicity of DCT Coefﬁcients After Aligned-BlockRecompressionAssume a set of JPEG blocks is recompressed with mis-aligned block boundary. If we conduct DCT on these blocks,then the original periodicity caused by quantization will nolonger exist. The reason is that these blocks now are compositeof their original blocks and neighboring blocks. Since thenewly calculated DCT coefﬁcients are obtained from thesecomposite blocks instead of the original JPEG blocks, we willnot observe any of the original periodicity from analyzing theDCT histograms. On the other hand, if we analyze the DCThistograms on JPEG blocks recompressed with aligned blockboundaries, then the original periodicity could still be observed.Therefore, here we only discuss the DCT periodicity for thecase of aligned-block recompression.Let and denote the quantization step sizes for the orig-inal JPEG compression and recompression, respectively; and, , and denote the unquantized DCT coefﬁcient, the DCTcoefﬁcients after the original JPEG compression, and recom-pression, respectively. That is,and(12)The quantization constraint set (QCS) theorem  showed thatthe DCT coefﬁcients before and after compression would bebounded byand(13)From (12), the recompressed DCT coefﬁcient is collectedfrom the range centered at and its dis-tribution could be modeled as(14)However, as there are rounding errors while conducting IDCTand DCT, we modify the distribution of the quantized DCT coef-ﬁcient from into by convolving the original formu-lation in (6) with a Gaussian distribution . Finally,we substitute into (14) and obtain(15)where the range of is determined by the sign of the coefﬁ-cient . We compare the simulation result from (15) with the
CHEN AND HSU: DETECTING RECOMPRESSION OF JPEG IMAGES VIA PERIODICITY ANALYSIS 401(a) (b)Fig. 7. Distribution of doubly compressed DCT coefﬁcients, where the ﬁrst quantization step is equal to 9 and the second quantization step is equal to 4: (a) groundtruth in JPEG image; and (b) the simulation result by (15).Fig. 8. Within-block pixels and across-block pixels in an 8 8 block.ground truth distribution of doubly compressed DCT coefﬁ-cients in Fig. 7. The results in Fig. 7 show that our formulationindeed approximates the ground truth reasonably well.Next, as in Section II-B, we analyze the periodic character-istics of by Fourier transform. In order to simplify thecalculation, here we ignore the rounding errors and obtain thefrequency response from (14)where(16)From (16), has a higher magnitude (i.e., the observedpeak) when is a multiple of or . However, sinceis close to one when is nearly zero, the magnitudes ofat multiples of are much larger than at multiplesof . That is, the peak magnitudes would not remain con-sistent once a JPEG image is doubly compressed.IV. DETECTING RECOMPRESSION VIA JPEG PERIODICCHARACTERISTICSIn Sections II and III, we have discussed the periodicity ofblocking artifacts and DCT coefﬁcients for singly and doublycompressed JPEG images. Next, in this section, we will presentour proposed recompression detection method in terms of theperiodicity in JPEG images.Fig. 9. (a) Original image; (b) probability map of (a) using the method in ;and (c) estimated blocking artifact of (a) with our proposed approach.When dealing with color images, we could conduct the detec-tion on three color components independently. However, sincethe two chromatic components and are coarsely sampledand quantized in JPEG standard, their periodicity tends to bepoorly characterized than in component. Therefore, we willconduct the detection method on component only.A. Detecting Misaligned-Block Recompression by BlockingArtifacts1) Estimation of Blocking Artifacts: Since our periodicityanalysis of blocking artifacts rely on the binary representationof ideal blocking artifacts, we now describe how we estimatethe blocking artifacts from JPEG images. We ﬁrst use a simplemethod  to measure the local pixel difference as(17)where is the intensity of the pixel . Next, if weclassify pixels into two classes: within-block pixels and across-block pixels (as shown in Fig. 8), then the local pixel differ-ences of within-block pixels are usually highly similarto each other within a small neighborhood. Therefore, in ourearlier work , we assume that there exists a local linear de-pendency of for all within-block pixels. However, theassumption for linear dependency of blocking artifacts is over-simpliﬁed for complex images. Our simulation results show thatthe estimated blocking artifacts are highly content-dependent,as shown in Fig. 9(b), because the linear dependency model de-rived from the whole image may not apply to local characteristicof different pixels in complex images.
402 IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. 6, NO. 2, JUNE 2011(a) (b)Fig. 10. Pixel difference distribution: (a) at block position (0,0); and (b) at block position (7,7).Therefore, instead of using the linear dependency model, herewe propose to model the blockiness in terms of both the localpixel difference and its interblock correlation. Assumewe decompose an image into nonoverlapped 8 8 blocks andconstruct 64 distributions of pixel differ-ence across the whole image. Although the 64 distributions maybehave differently, depending on the image content, the distri-butions for the within-block pixels tend to concentrate aroundzero, as shown in Fig. 10(a). On the other hand, the distribu-tions for across-block pixels usually have a larger variance, asshown in Fig. 10(b). Here, we represent these distributions bynonparametric histograms and deﬁne the pixel likelihood to thecorresponding distribution bywhere(18)If we observe both the pixel difference and its likeli-hood , we ﬁnd that pixels located on imageedge or texture area usually have larger but have smallerlikelihood. Therefore, we can construct a better content-inde-pendent model to estimate blocking artifacts by including bothand its likelihood. We measure the distance between twoadjacent pixels and as(19)where and are interblock distribu-tions of pixels and , respectively. Theﬁrst term in (19) measures the absolute value difference be-tween the two local pixel differences and .The second term in (19) includesand , which measure the conﬁdenceof each pixel to the corresponding interblock distribution,and and ,which measure the between-class likelihood. Ifand are highly similar in terms of blockiness, thenwould be close to zero.Using (19), next we estimate the blockiness byweighted averaging the distance between a pixel and its eightneighbors(20)where is the normalized weight proportional to the prob-ability likelihood of pixel(21)In order to be consistent with the binary representation de-ﬁned in (1), we modify (20) as follows:(22)Thus, would be close to one if is highly similarto its neighbors.Fig. 9(c) shows the result obtained by (22). As we expect,since the local pixel difference of an across-block pixel
CHEN AND HSU: DETECTING RECOMPRESSION OF JPEG IMAGES VIA PERIODICITY ANALYSIS 403Fig. 11. (a) Original image; (b) peak window of (a), ; and (c) peakwindow of (a) with and .is usually dissimilar with its neighbors, its tends to beclose to zero, which is indicated by a black pixel. Moreover,in comparison with the result of our earlier work in , theproposed estimate of blocking artifacts is more independent toimage content and could better capture the inherent blockinessexisting in JPEG images.2) Feature Extraction in Fourier Domain: Next, we convertthe blocking artifacts to Fourier domain. As shownin (3), we should observe 8 8 peaks in the power spectrum.In addition, from (4) and (10), a singly compressed JPEGimage has consistent peak magnitudes within the horizontal,vertical, and diagonal regions (as deﬁned in Fig. 2), while arecompressed image will not have consistent peak magnitudes.For example, in Fig. 11(b) and (c), we show the magnitudes ofonly the 8 8 peaks in the power spectrum for both the singlycompressed and the recompressed image. Note that in Fig. 11,we ignore the strongest peak at the lowest frequency (0,0).As shown in Fig. 11(b), most peak magnitudes concentrateon vertical and horizontal regions and are evenly distributedwithin each region. On the other hand, in Fig. 11(c), since theblocking periodicity from the ﬁrst compression also contributesto the estimate of blocking artifacts, the peak magnitudes nowlook very different from Fig. 11(b).Therefore, we propose to extract features to measure the peakenergy distribution so as to discriminate between singly com-pressed images and recompressed images. We calculate the nor-malized peak energy from three nonoverlapping regions ,, and , as deﬁned in Fig. 2, and extract the following fourfeatures:and(23)We will then use the four features to characterize the change ofblocking artifacts caused by misaligned-block recompression.B. Detecting Aligned-Block Recompression By DCTPeriodicityIn Section II-B, we have shown that the histograms of DCTcoefﬁcients in a singly compressed JPEG image are periodicand the spectrum [as derived in (6)] are also periodic withconstant peak magnitudes. On the other hand, as discussedin Section III-B, the histogram of DCT coefﬁcients in the re-compressed image has multiple periodicities and the spectrumno longer has constant peak magnitudes. Therefore, we ﬁrstconstruct 64 histograms for the 8 8 DCTcoefﬁcients individually and next derive the peaks from thecorresponding spectrum .A simple peak extraction method is proposed here. For everypower spectrum value , we use a search windowwhich involves to , to detect whetheris a local maximum or not. Two empirical constraintsare stated below(24)where , , and are parameters and are empirically set as, , and .Using the above constraints, we extract these local maximaas the peaks of . Then we adopt standard deviation to showthe periodicity variation; that is,(25)where indicates all extracted peaks of .As we have demonstrated in Section II, when the DCT coef-ﬁcients are concentrated on a few peaks in high frequency band,the periodicity becomes less easy to detect. Therefore, we onlyuse the ﬁrst ﬁve ac terms’ DCT coefﬁcients in zig-zag scan orderto extract peak variation features.Combining the four features in (23) and the ﬁve features in(25), we ﬁnally extract nine periodic features for JPEG recom-pression detection.V. EXPERIMENTAL RESULTSTo evaluate the proposed periodic features in JPEG images,here we focus on two tampering operations: 1) cropping andrecompression, and 2) composite JPEG sources. All our experi-ments are conducted on the component of color images. In theﬁrst part, all the cropped image blocks reveal the primary com-pression traces of blocking artifacts in the spatial domain. Thus,we use the ﬁrst experiment to validate the proposed four featuresin Section IV-A and compare to the related work  whichalso use spatial statistics. In the second part, local copy-movehas been conducted; that is, the tampered images are compositeof multiple JPEG sources. We use the nine periodic features inboth the spatial and DCT domains to detect composite JPEGimages. To show the superiority of our method, we also com-pare with two existing methods , , where  detects
404 IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. 6, NO. 2, JUNE 2011TABLE IDETECTION ACCURACY (%) OF SINGLE COMPRESSION(QUALITY FACTOR ) AND DOUBLE COMPRESSION (1STQUALITY FACTOR AND SECOND QUALITY FACTOR )doubly compressed images by Benford’s Law, and  detectsdoctored JPEG images by double quantization effects.Moreover, to validate the robustness of the proposed featuresunder different distortions, we conduct a series of experimentsfor sensitivity analysis. We also evaluate the robustness of theproposed features using different sizes of pasted patch in copy-move tampering.A. Detecting Cropping and RecompressionIn this experiment, we use 250 color images captured using aNikon D80 with RAW format and 3872 2592 resolution. Weﬁrst compress these images with quality factor , crop intosize of 720 480 with aligned block boundaries, and use thisdata set as our singly compressed images. To create the cropped-and-recompressed images, we compress the RAW images withquality factor , followed by randomly cropping into size of720 480 and recompression with quality factor .Table I shows the detection accuracy with the proposed fourfeatures in Section IV-A and also a comparison with the BACM method. The detection results in Table I show that ourproposed method indeed outperforms BACM in most cases.Nevertheless, these features are feasible only when the originalquality factor is smaller than the recompression quality factor.Otherwise, the former high quality compression informationwould be destroyed by recompression with lower quality factor.The cropping position also inﬂuences the detection accuracy.For example, if images are cropped along or withbefore recompression, the previous blocking arti-facts, which is especially large at position (7,7), would becomeless obvious to be detected. As shown in Fig. 12(b), if we cropimages along or , most primary blocking artifactswill be merged into the second blocking artifacts, including thepixel difference at position (7,7). Therefore, the trace of originalcompression becomes less obvious compared with Fig. 12(a).After Fourier transform, the peak energy, instead of divergingto diagonal peaks, would still be distributed along vertical orhorizontal peaks and retain consistency, making it an unreliablefeature.B. Detecting Composite JPEG SourcesIn this experiment, we use 250 color images with RAWformat, which were captured using Canon EOS, Nikon D80,Fig. 12. Cropped and recompressed 8 8 JPEG block with different croppingvector. (a) cropping vector and (b) cropping vector .Fig. 13. Constructing a composite JPEG image, where the image size is1024 1024, the size of the copy-move subimage is 720 720, and thecropping vector is randomly selected from (0,0) to (7,7).TABLE IIDETECTION ACCURACY (%) OF COMPOSITE JPEG IMAGESand Pentax K100D. We ﬁrst compress these images with qualityfactor , crop into size of 1024 1024 with aligned blockboundaries, and use this data set as our singly compressedimages. To create the tampered image set, for each image inthe singly compressed image set with quality factor , werandomly select another image with the same quality factor,crop a 720 720 patch, paste this patch to , and then save thecomposite image as a new JPEG image with quality factor. Fig. 13 shows the copy-move operation. Note that allcropping positions are randomly selected and may result ineither misaligned or aligned block boundaries. Thus, we have500 images for each quality setting with and . Usingthe nine features proposed in Section IV, we randomly select400 images as training data to SVM, and use the rest as testdata.Table II shows the experimental results. We discuss the re-sults in three cases, i.e., , and. If , both blockiness and DCTfeatures reveal the trace of recompression. If ,blockiness features behave poorly since the pixel difference is
CHEN AND HSU: DETECTING RECOMPRESSION OF JPEG IMAGES VIA PERIODICITY ANALYSIS 405TABLE IIIEXPERIMENTAL SETTING OF SENSITIVITY ANALYSISless discriminative as the quality factor decreases. Also, DCTfeatures poorly characterize the periodicity variation since theperiodicity is dominated by the second quantization step. Notethat, whether or , the proposed DCTfeatures are both ineffective whenorwhere andindicate the ﬁrst and second quantization steps (26)In (26), when one quantization step is a multiple of the other,the histograms of the corresponding DCT coefﬁcients would re-veal only one single periodicity either from the ﬁrst or secondcompression. Nevertheless, these cases in (26) rarely happen si-multaneously for all the 64 DCT coefﬁcients and thus we couldstill obtain sufﬁcient features to discriminate periodicity change.The average detection rates of andare 98% and 80%, respectively. As we expect, our proposed fea-tures are robust to detect recompression.Nevertheless, the average detection accuracy is merely 70%when . Since the ﬁrst and second quantizationstep sizes are the same, it is impossible for DCT features todistinguish the primary periodicity. Only the blockiness featuresare valid when the primary blocking artifacts locate inside an8 8 block, which implies that misalignment must always bepresent. With these constraints, we expect that the detection ratedecreases much noticeably in this special case.Furthermore, we compare our periodic features with the ex-isting methods in  and . Since the method in  appliedthe ﬁrst digit distribution of DCT coefﬁcients and requires alarge amount of information for statistical analysis, this work isnot reliable for detecting locally tampered images. Similarly, themethod in  also relies on statistic features of double quanti-zation effects, and thus requires a sufﬁcient number of tamperedblocks for reliable detection. Table II compares the detection ac-curacy with  and  using the ﬁxed-sized pasted patch. Asshown in Table II, our proposed features outperform  and in , , and cases.C. Sensitivity AnalysisIn this experiment, we use the composite JPEG images as ourtampered data to validate the sensitivity of the proposed periodicfeatures. The sensitivity analysis we conduct before recompres-sion includes white Gaussian noises, blurring operation, rotationof the pasted patches, and copy-move tampering with differentsizes of pasted patch. The experimental setting for this sensi-tivity analysis is listed in Table III, where the percentage (%) ofFig. 14. Detection accuracy of composite JPEG images with (a) whiteGaussian noise, (b) image blurring, (c) image rotation, and (d) different size ofpasted regions.pasted patch indicates the ratio of the copy-move patch in thewhole image.Fig. 14(a)–(d) shows the detection accuracy with differentlevels of distortions or different sizes of pasted patch. We ﬁxthe quality factor of ﬁrst compression as 50 to ensureis always larger than . As shown in Fig. 14, our proposedperiodic features are not sensitive to different distortion levels.Note that, when the size of pasted patch is smaller, more un-tampered blocks, which inherit recompression characteristics,are available. Therefore, as shown in Fig. 14(d), our proposedmethod works better with the smaller size of pasted patch. Inaddition, in Fig. 14(a) and (b), the detection rate does not al-ways increase as increases when global operations such asadditive white Gaussian noise or blurring are applied. Becauseglobal operation tends to change the intensities of all pixels andmay destroy the primary compression artifacts, the remainingperiodic features could be insufﬁcient to characterize the recom-pression in either spatial or frequency domain. Therefore, ourapproach is limited if a global operation with a large distortionlevel is applied before recompression.VI. CONCLUSIONIn this paper, we considered tampering in JPEG images as aproblem of detecting recompression. The main contributionsof our work include: 1) we used mathematical formulation andtheoretical proof to show that the periodicity of compressionartifacts would change once a JPEG image is recompressed;2) using this property, we further proposed a novel and robustapproach for detecting recompression; and 3) combining theperiodic features in both spatial and frequency domains, ourmethod can detect recompression with either aligned or mis-aligned block boundaries. Experimental results show that theproposed method outperforms existing approaches in mostquality factor settings.
406 IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. 6, NO. 2, JUNE 2011REFERENCES A. C. Popescu and H. Farid, “Exposing digital forgeries by detectingtraces of re-sampling,” IEEE Trans. Signal Process., vol. 53, no. 2, pt.2, pp. 758–767, Feb. 2005. A. C. Popescu and H. Farid, “Exposing digital forgeries in color ﬁlterarray interpolated images,” IEEE Trans. Signal Process., vol. 53, no.10, pt. 2, pp. 3948–3959, Oct. 2005. A. Swaminathan, M. Wu, and K. J. R. Liu, “Non-intrusive compo-nent forensics of visual sensors using output images,” IEEE Trans. Inf.Forensics Security, vol. 2, no. 1, pp. 91–106, Mar. 2007. H. Cao and A. C. Kot, “Accurate detection of demosaicing regularityfrom output images,” in Proc. IEEE Int. Symp. Circuits and Systems,2009, pp. 497–500. J. Lukas and J. Fridrich, “Digital camera identiﬁcation from sensorpattern noise,” IEEE Trans. Inf. Forensics Security, vol. 1, no. 2, pp.205–214, Jun. 2006. H. Gou, A. Swaminathan, and M. Wu, “Intrinsic sensor noise forforensic analysis on scanners and scanned images,” IEEE Trans. Inf.Forensics Security, vol. 4, no. 3, pp. 476–491, Sep. 2009. M. K. Johnson and H. Farid, “Exposing digital forgeries by detectinginconsistencies in lighting,” in Proc. ACM Multimedia and SecurityWorkshop, New York, 2005. S. Lyu and H. Farid, “How realistic is photorealistic?,” IEEE Trans.Signal Process., vol. 53, no. 2, pp. 845–850, Feb. 2005. P. Zhang and X. Kong, “Detecting image tampering using featurefusion,” in Proc. IEEE Conf. Availability, Reliability and Security,Fukuoka, 2009, pp. 335–340. J. Fridrich, M. Goljan, and R. Du, “Steganalysis based on JPEG com-patibility,” in Proc. SPIE Multimedia Systems and Applications IV,Denver, CO, Aug. 2001, pp. 275–280. Z. Fan and R. L. de Queiroz, “Identiﬁcation of bitmap compressionhistory: JPEG detection and quantizer estimation,” IEEE Trans. ImageProcess., vol. 12, no. 2, pp. 230–235, Feb. 2003. R. Neelamani, R. D. Queiroz, Z. Fang, and R. G. Baraniuk, “JPEGcompression history estimation for color images,” IEEE Trans. ImageProcess., vol. 15, no. 6, pp. 1365–1379, Jun. 2006. S. Ye, Q. Sun, and E. C. Chang, “Detecting digital image forgeries bymeasuring inconsistencies of blocking artifact,” in Proc. ICME, Jul.2007, pp. 12–15. W. Luo, Z. Qu, J. Huang, and G. Qiu, “A novel method for detectingcropped and recompressed image block,” in Proc. ICASSP, Apr. 2007,vol. 2, pp. 217–220. Y. L. Chen and C. T. Hsu, “Image tampering detection by blockingperiodicity analysis in JPEG compressed images,” in Proc. MMSP,Cairns, 2008, pp. 803–808. D. Fu, Y. Q. Shi, and W. Su, “A generalized Benford’s law for JPEGcoefﬁcients and its applications in image forensics,” in Proc. SPIE,Security, Steganography, and Watermarking of Multimedia ContentsIX, San Jose, CA, Jan. 2007. B. Li, Y. Q. Shi, and J. Huang, “Detecting doubly compressed JPEGimages by mode based ﬁrst digit features,” in Proc. MMSP, Cairns,2008, pp. 730–735. J. He, Z. Lin, L. Wang, and X. Tang, “Detecting doctored JPEG imagesvia DCT coefﬁcients analysis,” in Proc. Eur. Conf. Computer Vision,Graz, Austria, 2006. A. Zakhor, “Iterative procedures for reduction of blocking effects intransform image coding,” IEEE Trans. Circuits Syst. Video Technol.,vol. 2, no. 1, pp. 91–95, Mar. 1992.Yi-Lei Chen was born in Taipei, Taiwan, in 1985.He received the B.S. degree in computer science in2007 and the M.S. degree in computer science in2009, both from the National Tsing Hua University,Hsinchu, Taiwan. He is currently working towardthe Ph.D. degree at the Department of ComputerScience, National Tsing Hua University, Hsinchu.His research interests are digital image forensics,and image/video analysis and processing.Chiou-Ting Hsu (M’98) received the B.S. degreein computer and information science from NationalChiao Tung University, Hsinchu, Taiwan in 1991,and the Ph.D. degree in computer science andinformation engineering from National TaiwanUniversity (NTU), Taipei, Taiwan, in 1997.She was a postdoctoral researcher with the Com-munication and Multimedia Laboratory, NTU, from1997 to 1998. From 1998 to 1999, she was withPhilips Innovation Center Taipei, Philips Research,as a senior research engineer. She joined the Depart-ment of Computer Science, National Tsing Hua University, Hsinchu, Taiwan,as an Assistant Professor in 1999 and is currently an Associate Professor. Herresearch interests include multimedia signal processing, video analysis, andcontent-based retrieval.Prof. Hsu received the Citation Classic Award from Thomson ISI in 2001 forher paper “Hidden digital watermarks in images.” She is currently an AssociateEditor of Advances in Multimedia.