Image Forgery Detection Based on Quantization Table Estimation

Guo-Shiang Lin
Dept. of Computer Science and
Information Engineering,
Da-Yeh University, Chang-Hua,
Taiwan
khlin@mail.dyu.edu.tw
Min-Kuan Chang
Dept. of Electrical Engineering,
National Chung Hsing
University, Tai-Chung, Taiwan
minkuanc@dragon.nchu.edu.tw
You-Lin Chen
Dept. of Electrical Engineering,
National Chung Hsing
University, Tai-Chung, Taiwan
keitaro@wmc.ee.nchu.edu.tw
Abstract
In this paper, we proposed a passive scheme to achieve
image forgery. The inconsistent measure of quantization
table is characterized to develop the proposed scheme. The
proposed scheme is composed of candidate region selection,
quantization table estimation, and forgery detection. To
select candidate regions for estimating quantization table, a
split-and-merge algorithm based on quad-tree
decomposition is devised. To estimate the quantization table,
we classify the type of PSD and then adjust the estimation
algorithm. After quantization table estimation, the variation
resulting from the inconsistent of quantization table is
utilized to detect tampered regions. The experimental results
show that our proposed scheme can not only estimates
quantization table correctly but also detect tampered
regions well.
1. Introduction
To date, the amount of digital image/video has increased
dramatically during the past few years. Since digital
images/videos can be copied or duplicated without quality
degradation by using digital processing tools, content
authentication becomes an important functionality to help
receivers to identify the integrity of received data.
Digital watermarking [1] has many applications and one
of the most important applications is the authentication of
digital images. In [1], a compressed-domain scheme was
proposed to achieve dual protection of JPEG images based
on informed embedding and two-stage watermark extraction
techniques. Though watermark embedding should make the
visual quality of the cover media well, the quality
degradation is permanent. In addition, most images/videos
do not be embedded any digital watermark. That means that
in the absence of digital watermarks, other techniques that
can help us make statements about the origin, veracity and
authenticity of digital images is very necessary. These
reasons motive us to develop a non-watermarking scheme
for verifying image content and localizing the tampered
regions. Compared with watermarking methods that actively
embed secret data, non-watermarking schemes passively
achieve forgery detection by analyzing digital content.
Some methods [2],[3],[4],[5] for image/video forensics
were proposed. For example, a phenomenon [4] that there is
a regular symmetrical shape in the blocking artifact
characteristics matrix for a JPEG image is analyzed. A
method [4] based on this phenomenon was developed to
detect cropped and recompressed blocks. In [3], the
blocking artifact measure is computed and then utilized to
detect digital forgery. However, it seems not clear to explain
how to select suspicious regions and then estimate the
quantization matrix based on the un-tampered regions.
Besides, in digital capture devices, e.g., digital camera, most
digital images are stored and transmitted in JPEG format. It
implies that the information of quantization table exists in
uncompressed images. Therefore, it motives us to develop
an image forgery detection scheme based on the information
of quantization table.
2. The Proposed Scheme
Quantization is an important process to control image
quality and bit rate in JPEG compression standard. After
JPEG compression, some phenomena resulting from
quantization certainly occur in the resulting image. The
important one is that AC coefficients in the low and middle
frequency bands often become the multiples of
corresponding quantization stepsize after de-quantization. If
we gather AC coefficients with the same frequency from all
of 88 DCT blocks and then plot its histogram, there are
several peaks at the multiples of the corresponding
quantization stepsize. It is expected that this phenomenon
might not exist when some regions in an image were
tampered. It implies that this phenomenon can be
characterized as a feature for forgery detection. To
determine whether this phenomenon exists or not, the
variation resulting from the inconsistent of quantization
table can be characterized for detecting image forgery.
Based on the observation, this proposed scheme is
composed of candidate region selection, quantization table
estimation, and forgery detection. Figure 1 illustrates the
block diagram of the proposed scheme. We elaborate each
part in the flowing.
Figure 1. The block diagram of the proposed scheme
MVA2009 IAPR Conference on Machine Vision Applications, May 20-22, 2009, Yokohama, JAPAN
3-10
66
2.1 Candidate region selection
In [3], authors did not mention how to remove the
suspicious tampered regions for estimating quantization
table. Here we adopt a split-and-merge algorithm based on
quad-tree decomposition to remove suspicious tampered
regions. After removing suspicious regions, the others can
be exploited as the candidate region for quantization table
estimation. The split-and-merge algorithm of candidate
region selection is described as follows.
1. Divide the test image into four sub-images by using
quad-tree decomposition.
2. Perform the quantization table estimation (mentioned
later) for each sub-image.
3. Use each estimated quantization table to re-encode and
reconstruct the sub-image.
4. Calculate the mean square error (MSE)
MSE
e of DCT
coefficients in the sub-image before and after the
recompression as
( ) ( ) ( ) ( )
_
O e

O
=
i
B
i i i
MSE
X X Q Q X e
2
1
~ ~ 1
, (1)
where X represents DCT blocks and X
i
represents the
i-th DCT block; O is the number of 88 blocks; Q
~
denotes the estimated quantization table in this
sub-image;
1
~

Q is the inverse quantization. Based on

Parsevals theorem,
MSE
e is the same in the spatial
and DCT domains.
5. Quad-tree decompose this sub-image if the MSE of
any partition is large than one pre-defined threshold or
the number that the quantization stepsize is equal to 1
is large than a predefined threshold. Otherwise, this
sub-image is determined as un-tampered region.
6. Repeat steps 2-5 until the number of 88 blocks within
each sub-image is less than a pre-defined threshold T
B
for estimating quantization table.
7. Combine these un-tampered sub-images as a coarse
candidate region for quantization table estimation.
To correctly estimate the quantization table, some
misclassified blocks should be re-selected into the candidate
region. Therefore, the candidate region for quantization
table estimation should be refined. The refined algorithm is
described as follows.
1. Obtain the quantization table based on a coarse
candidate region.
2. Estimate the quantization table in each suspicious
sub-image and compute the mean absolute difference
Q
Diff of the i-th block as
( ) ( )
_
=
=
63
1
~ ~
63
1
i
C Q
i Q i Q Diff
, (2)
where
C
Q
~
are the estimated quantization table based
on the coarse candidate region and

represents the
absolute operator.
3. Merge each sub-image whose
Q
Diff is less than a
given threshold (T
Q
) into the coarse candidate region
and then re-perform the quantization table estimation to
obtain the refined quantization table
R
Q
~
.
2.2 Quantization table estimation
In [3], the relationship between the quantization stepsize
and power spectrum density (PSD) of histogram for each
AC coefficient is analyzed. The phenomenon that the
numbers of peaks of PSD is equal to the quantization
stepsize subtracting 1 is observed. In order to correctly
detect peaks of PSD, the smoothed version of the second
derivative of PSD is obtained and then the number of its
local minimums is calculated for estimating quantization
stepsize. Unfortunately, this method [3] is unstable to
correctly estimate the quantization step for each AC
component due to the local minimum might disappear
within the middle range of PSD. Therefore, to improve the
drawback, we develop a content-adaptive quantization table
estimation algorithm in the proposed scheme.
Before introducing the quantization table estimation
algorithm, we define the Fourier transform
i
H of
histogram
i
h of the i-th AC coefficient as
( )
i i
h H + = , (3)
where ( ) + represents the Fourier transform. The
histogram
i
h of the i-th AC coefficient can be obtained by
collecting each i-th AC coefficients from each 88 DCT
block. Then the PSD
i
S of the i-th AC coefficient can be
obtained as
( ) ( ) ( ) ( ) { } .,... 2 , 1 , Im Re |
2 2
= + = = k k H k H s s S
i i k k i
, (4)
where ( ) Re and ( ) Im denote the real and image parts of
a complex number, respectively.
Since different quantization stepsizes cause different
PSDs, it is difficult to estimate each quantization stepsize by
using a simple detection method. To adaptively estimate the
quantization stepsize, we classify the PSD into different
types and then adjust the quantization table estimation
algorithm. First, two features are devised to classify the PSD
into four categories. One feature f
1
is the local minimum
numbers for each PSD. As we know, the local minimum
numbers
min
N
are related to the quantization stepsize.
Second, we define a shape factor of PSD as a feature f
2
to
evaluate whether the quantization stepsize is large or not.
The larger the quantization stepsize is, the larger the shape
factor is. To measure the shape factor of a PSD, a bin index
can be obtained based on a pre-defined threshold. Figure 2
illustrates the shape factor of PSD. Based on the two
features and two pre-defined thresholds (T
1
and T
2
), four
types of PSD can be determined and shown in Table I. Type
I and IV indicate that small and large quantization stepsizes
are adopted, respectively.
67
2
f
Figure 2. An illustration for the shape factor of PSD
Table 1. Four types of PSD
f
1
f
2
Type I 0 or T
1
< T
2
Type II > T
1
< T
2
Type III > T
1
> T
2
Type IV T
1
> T
2
After classifying the type of PSD, the quantization
stepsize estimation algorithm is described as follows.
1. For Type I, the estimated quantization stepsize is set to
1.
2. For Type IV, the quantization stepsize can not be
estimated.
3. For Type II, find the bin index u of the first peak in the
PSD and then the quantization stepsize can be
calculated via
( )
( ) ( ) ( ) ( )
(
(
(
(

)
`

|
.
|

\
|

=
u
k X k X
k Q
i i
512 , min max ceil max
, (5)
where | |
, ceil(), max{}, and min{} denotes the
rounding, ceiling, maximum, and minimum operators,
respectively.
4. For Type III, the Fourier Transform of PSD is adopted
and the index of its first peak is found as the
quantization stepsize.
2.3 Forgery detection
After quantization table estimation, we evaluate the
variation resulting from the inconsistent of quantization
table. The mean absolute error (MAE) of the i-th DCT block
is defined as
( ) ( ) ( )
( )
( )
_
=
(

=
63
1
~
~
k
R
i R
i i
MAE
k Q
k X
k Q k X X e
. (6)

It is expected that if one block is an innocent one, a right
quantization table can be estimated and then its
MAE
e is
small. If one sub-image was tampered, the wrong
quantization table is obtained and then large
MAE
e occurs
after a recompression process with the wrong quantization
table. In other words, we can determine whether the 88
block is tampered according to
MAE
e resulting from the
recompression process. Therefore, according to the above
phenomenon, the decision rule in the forgery detection can
be determined: a suspicious 88 block is tampered if its
corresponding MAE is larger than a given threshold.
3. Experimental Results
Several popular images with size 512512, such as Lena,
Baboon, and F16, are selected for performance evaluation.
The threshold T
B
and T
Q
are 256 and 3, respectively. The
parameters, T
1
and T
2
, for determining the PSD type are 1
and 100, respectively.
3.1 Quantization table estimation
In order to evaluate the performance of quantization table
estimation, we also adopt the mean absolute error (MAE)
between the true and estimated quantization table as a
measurement. Figure 3 shows the MAE of quantization
table estimation under different quality factors. As we can
see in Fig. 3, the MAEs are kept small when the quality
factor is from 50 to 85. In addition, compared with [3], the
MAEs of our proposed scheme are less than those of [3]
under different quality factors. The results demonstrate that
the quantization table estimation of our proposed scheme
can provide a better performance.
3.2 Forgery detection
Here a copy-paste tampering [5] is adopted to evaluate
the capability of forgery detection. Since the block
mis-matching for generating the tampered image might
affect the performance of forgery detection, we also discuss
its impact. Figure 4(a) and 4(b) shows two tampered images
with and without block mis-matching, respectively. The
tampered regions are copied from the original image. As
shown in Fig. 4(a) and 4(b), the visual quality of two
tampered images remain well. Figure 4(c) and 4(d) illustrate
the results for forgery detection. In Figs. 4(c) and 4(d), the
white lines indicate the tampered regions. As shown in Figs.
4(c) and 4(d), the tampered regions can be detected well
regardless of the existence of block mis-matching.
Figure 5(a) and 5(b) show a test image and its forgery
version. As shown in Fig. 5(b), it is difficult to decide
whether this image is tampered or not. Figure 5(c) illustrates
the result of forgery detection. Compared with Figs. 5(a),
5(b), and 5(c), the detection result demonstrates that our
proposed scheme can identify the tampered region well.
68
Figure 3. The MAE of quantization table estimation

(a) (b)

(c) (d)
Figure 4. Tampered images: (a) block mis-matching, (b)
block matching; forgery detection: (c) block mis-matching,
(d) block matching
4. Conclusion
In this article, a passive scheme to achieve forgery
detection is developed for uncompressed images. The
inconsistent measure of quantization table is characterized
as a feature in the proposed scheme. The proposed scheme
is composed of candidate region selection, quantization
table estimation, and forgery detection. To select candidate
regions for estimating quantization table, a split-and-merge
algorithm based on quad-tree decomposition is devised. To
estimate the quantization table, we classify the type of PSD
and then adjust the estimation algorithm. After quantization
table estimation, the variation resulting from the inconsistent
of quantization table is utilized to detect tampered regions.
The experimental results show that the performance of
quantization table estimation in our proposed scheme is
better than that of [3]. In addition, our proposed scheme can
detect tampered regions well.

(a) (b)
(c)
Figure 5. (a) original image, (b) tampered version, and (c)
forgery detection
References
[1] Wen-Nung Lie, Guo-Shiang Lin, and Sheng-Lung Cheng,
Dual protection of JPEG images based on informed
embedding and two-stage watermark extraction techniques,
IEEE Transactions on Information Forensics and Security,
vol. 1, no. 3, pp.330-341, Sep. 2006.
[2] T. V. Lanh, K.-S. Chong, S. Emmanuel, and M. S
Kankanhalli, A survey on digital camera image forensic
methods, in Proc. IEEE International Conference on
Multimedia & Expo, pp. 16-19, 2007.
[3] S. Ye, Q. Sun and E.-C. Chang, Detecting digital image
forgeries by measuring inconsistence of blocking artifact,
in Proc. IEEE International Conference on Multimedia &
Expo, pp. 12-15, 2007.
[4] W. Luo, Z. Qu, J. Huang, and G. Qiu, A novel method for
detection cropped and recompressed image block, in Proc.
IEEE International Conference on Acoustics, Speech, and
Signal Processing, pp. II-217II-220, Hawaii, April 2007.
[5] C.-C. Hsu, T.-Y. Hung, C.-W. Lin, and C.-T. Hsu, Video
forgery detection using sensor pattern noise, 2008 21th
Conference on Computer Vision, Graphics and Image
Processing, Taiwan, R.O.C.
69