A Comprehensive Survey on Methods for Image Integrity

With the increasingly pervasive intentional or unintentional manipulation of data (images, video, audio, and text), the focus on forgery/counterfeit detection is growing exponentially [274]. As highlighted in Figure 1, multimedia forensics is a broad disciplinary area that requires a lot of attention in terms of scientific and forensic activities. It bears the great responsibility of producing and disseminating methods to check Internet data, which is often manipulated, altered, and even generated, maliciously, with intentional anti-forensics techniques [120].

Restricting the scope to image forensics, which is currently a hot topic in multimedia forensics, the article will focus on image manipulation, which occurs when operations are performed on an image to modify it. In current literature, image forgery considers how the entire image is manipulated with malicious intent, whereas in image tampering, only parts of the image are intentionally modified. Image generation uses computer software or algorithms to produce an image or part of an image simulating real-world scenes. The common denominator of these classes of operations is the malicious intention to violate the integrity of an image to deceive the observer, whereas steganography has the objective of transporting secret messages from a sender to a recipient. In the latter, the image is modified so that it can store secret information invisible to the human eye, therefore maintaining the original appearance as much as possible. The goal of research in the field of image manipulation detection and identification is to examine, analyze, and define an acceptable confidence threshold to ensure data integrity and authenticity. At present, machine learning, and particularly approaches involving deep networks, are playing a supporting role both on the side of the attackers (Generative Adversarial Networks (GANs) [129]) and the defenders (Convolutional Neural Networks (CNNs) [193]), whether they are researchers, law enforcement agencies, or general operators in the forensics sector. Transparent editing operations (manipulation) for tampering, retouching, and enhancement on multimedia objects, which are uploaded or shared through social media or web platforms, alter the original content of the images, preventing them from still being considered authentic [247, 309]. However, even without manipulation, two types of artifacts inevitably remain in the image: image acquisition and compression artifacts. The intrinsic properties of these artifacts are essential forensic clues as they differ before and after the manipulation process [179, 198]. All of this leads to a lack of a sure and obvious answer on the origin of the image, the user or device capturing it, and the truthfulness and originality of the acquired scene. As a consequence, many problems arise in the field of forensics, creating a great deal of interest in the search for substantial and cutting-edge solutions. The scientific community has unanimously proposed a twofold classification of all the different approaches to assure/verify image integrity. As shown in Figure 2, “active” technologies usually embed data or signatures into the original image during its digitalization, either in the spatial or frequency domain, and “passive” technologies, which are increasingly sophisticated, are based exclusively on digital content and operate without any knowledge of either the original image or pre-defined data or signature, therefore just relying on, for example, statistical anomalies and/or artifacts. This investigation is a forensic contribution to the general scenario of forgery detection techniques. It will deal with the whole scenario where a target image could be modified. The aim will be (1) to provide an overview of the types of attacks and contrasting techniques and (2) to evaluate to what extent the former can deceive prevention methods and the latter to identify counterfeit images. The widespread diffusion of digital technologies has led, in the field of forensics, to a constant increase in cases in which the use of digital evidence has been decisive in identifying the solution. It is easy to understand how their use will soon be pervasive and well codified within forensic procedures. However, not all the approaches present in the current literature meet the requirements to be exploited in forensic activities [50]. Whenever a method is reproducible and replicable, it can be considered valid in court and/or in front of a judge, and therefore it is forensic. The evaluation of the confidence measure to obtain depends only on the common objective of the involved parties. This review has considered this forensic aspect an essential prerogative: all methods mentioned in the article have an experimental part, thus appearing as replicable and hence forensically sound. Thanks to the Budapest Convention [269, 322] and according to the reproducibility principle, digital evidence has been made admissible in courts. The Convention and the resulting regulations stipulate that all digital evidence is collected, archived, and presented according to a well-codified and recognized process. Once a scientific method has been identified, it will always be necessary to carry out an experimental evaluation phase before it can become a so-called best practice and its expected utility can be recognized by also carrying out a technology transfer action to operators in the sector. The European community boasts a network of experts (ENFSI (European Network of Forensics Science Institutes)) that promotes knowledge sharing, experience exchange, and the reaching of mutual agreements in the field of forensic sciences through the development and use of good practices and their collection in a devoted manual (ENFSI BPM¹) also offering a different taxonomy that can inspire further insight into the problems dealt with. Starting from these assumptions as well as current literature, the survey projects itself into an exhaustive search for reliable and forensically sound methodologies to support technological solutions aimed above all at law enforcement agencies and forensics personnel. It will represent those treated aspects of the same problem assuming that there are counterfeits but doubting that they are always reproducible in court. This is where best practices should come into play, by possibly considering a joint use of different techniques having the same forensic purpose.

Other available surveys in literature often focus on specific kinds of forgery and/or detection strategies (see, e.g., the work of Chauhan et al. [59] on keypoint-based copy-move forgery detection methods or the recent work of Zanardelli et al. [339] about deep learning approaches). This work aims to provide as wide and encompassing an account as possible of existing strategies, orienting readers in this extremely variated field. Many emerging topics like anti-forensic attacks and deepfake would deserve a deeper and wider critical analysis and discussion of open problems, which is beyond the scope of this survey. However, besides mentioning those topics, we suggest references that offer related sufficient and thorough insight. Therefore, although methodologies have evolved up to deep learning and CNNs, this survey demonstrates that the basic work done by traditional techniques, which still support and are the basis for neural networks, is still considerable and indispensable. It also strives to represent a testimony of continuity and tries to establish a common line between traditional and non-traditional approaches. It is worth noting how the statistics show the effective use of these techniques [16] in real operative scenarios. The conceptual map shown in Figure 2 proposes an updated scheme of real approaches to identify counterfeits.

The rest of the article is organized as follows. Section 2 formally introduces image forgery detection, basic concepts, the problem definition, and the workflow of blind approaches. Section 3 reviews the methods of forgery detection proposed in the current literature, and Section 4 presents an evaluation of benchmark datasets fitting this purpose. Section 5 discusses the research challenges and directions. Section 6 draws some conclusions. Finally, due to the broad scope of the subject, contrasting with the journal’s strict space restrictions, further insights, examples, and figures have been included in the online appendix available for the online version of the article.

Image and video forensics (or forensics, for short) refers to a specific area of digital forensics [43, 255] that deals with the study and analysis of images (and videos) for their validation and use in forensics [24]. The field of image forgery detection has been developed (1) to combat the problem of image distortion in various application areas such as forensic and criminal investigation, insurance processing, surveillance systems, intelligence services, medical imaging, and journalism [214], and (2) to reply to some important and complex technological questions such as determining if an image is authentic, doctored, or computer generated [99].

Digital image forgery started to occur a decade after the first image was created in various ways. At present, it exploits various image manipulation software, available for almost all trading platforms. Among the first technical issues to be addressed, the identification of the forgery is especially relevant since the authenticity of the images also follows from it. To achieve this, several forgery detection techniques were used which will be examined in this section (see Figure 2). For the sake of completeness, the information is outlined later in Table 6. Special attention will be given to forensics-viable methods according to the Budapest Convention.

At present, generative AI techniques [270] and diffusion models [75] are a continuous source of new challenges. These techniques are spreading so quickly and in such a pervasive way that they would deserve much more space than a section herein. It is our hope that the suggested references can effectively complement the present survey. Diffusion models can be used also for audio synthesis [341]. As can be deduced from Figure 2, multimedia forensics, in addition to image forensics, also includes audio and video. In particular, following the increasing popularity of deepfakes, interest in video forensics is growing more and more. Currently, deepfake detection is classified into machine learning based classical methods, and more recent ones based on deep learning based (the most widely used), statistical, and blockchain-based techniques [267]. The literature testifies that most deepfake detection research uses deep learning algorithms looking for inconsistencies in deepfake videos. However, since these are generated through adversarial training (often GANs), their ability to evade AI-based detection systems will improve as they become familiar with new detection methods. The challenge of recognizing them is increasingly difficult. The wide range of forensic video products available today for forensic investigators [157] provides an overview that is not able to tackle all challenges. For a complete discussion of this area of research, we suggest referring to exhaustive related works [9, 92, 113, 124, 133, 136, 143, 294, 332, 333].

The main challenge in detecting tampering is represented by the structural changes that occur in digital images. Due to their massive and widespread use in every field of application and considering the speed by which neural networks tackle/propose challenges, research is increasingly projected toward a combined use of traditional techniques with machine learning solutions. In addition to the traditional detection techniques mentioned previously, CNNs can represent an ambitious and effective solution to detect counterfeits. Touted as one of the most popular deep learning methods, CNN-based approaches are recently gaining success in digital image forensics [12, 29, 62, 73, 78, 145, 220, 268, 316, 346]. In active forgery detection, in the work of Zeng et al. [340], a watermarking technique based on an auto-encoder CNN network for robust non-blind watermarking was proposed, which achieves better performance than that of domain transform techniques. However, in passive forgery detection, a CNN has been used to identify the camera that captured the particular image. Yao et al. [334] proposed a multi-classifier based on CNNs that subjected images to post-processing attacks such as JPEG compression and adding noise. Several CNN-based approaches deal with copy-move operation [44, 78, 159, 226, 326]. Ouyang et al. [244] used an adjusted network obtained from an existing trained ImageNet model and obtained satisfactory performance compared to automatically generated spoofed images, although it does not apply to real spoofed images. Quan et al. [263] proposed a CNN generic framework to classify images as computer generated or natural with robust results against re-sampling (resizing) and JPEG compression. In the work of Ali et al. [7], a useful list of CNN-based techniques with related comparisons is mentioned.

Actually, in the context of image tampering, new proposed solutions based on image anomaly detection and deep anomaly detection are emerging. Anomaly detection, or novelty detection, is referred to as the process of discovering data instances that deviate significantly from the majority of data instances. Due to the complexity of the problem and difficulty of learning, an advanced approach such as deep anomaly detection is currently also required [246]. Da Costa et al. [81] surveyed the concerns and efforts made so far to optimize and improve anomaly/tampering detection methods. Their work includes a comprehensive table that summarizes image tampering detection and image anomaly detection datasets fit for purpose. The direction of all these aforementioned efforts introduces the need for a rigorous consideration of new and increasingly complex challenges related to tampered image detection. The most promising trend in terms of research, challenges, and opportunities is the use of machine learning techniques.

The huge diffusion of data (images, video, audio, and text), often uploaded/shared via social media or web platforms, and the possibility of their manipulation/generation also through AI models, poses serious problems. Some examples are counterfeiting biomedical images, deceiving biometric authentication systems, and cheating in scientific publications in the political world and in school activities.

In particular, the deepfake technique (e.g., photorealistic video or image content creation via DL methods), with the associated social and legal problems, poses serious threats to the privacy, reputation, and security of the victims. Despite many recent proposals for deepfake detection, the rapid progress in multimedia technology and the proliferation of application tools continuously pose new challenges calling for a reliable and definitive solution [135]. A side effect is a decreased focus on more traditional forgery techniques, which, however, still represent not completely solved problems.

Whatever the nature of the manipulation, once a digital image represents a crime, it is necessary to detect the forgery. This document presented a comprehensive overview of current and past research specially developed to list image forgery detection algorithms in the digital forensics scenario. The article overviewed the most important methodologies used so far, restricting the scope to cases where the solution is forensic. Taking into account the various other public investigations for the detection of forgery images available in the current literature, it aimed to provide a comprehensive longitudinal overview of the entire image-related forensics scenario. As mentioned in Section 1, retracing the fundamental work carried out so far, this investigation aimed to represent a testimony of continuity between traditional and non-traditional approaches. It is our hope that this survey will help forensic groups tackle the detection of existing attacks, and get basic information about the rising ones while providing a compass for a deeper insight. In the future, we plan to move the focus toward deep manipulation detection in the context of deepfake applications.