Forensic Science International 233 (2013) 158–166

Contents lists available at ScienceDirect

Forensic Science International

journal homepage: www.elsevier.com/locate/forsciint

Passive forensics for copy-move image forgery using a method based

on DCT and SVD
Jie Zhao a,b,*, Jichang Guo a
a
School of Electronic Information Engineering, Tianjin University, Tianjin 300072, China
b
School of Computer and Information Engineering, Tianjin Chengjian University, Tianjin 300384, China

A R T I C L E I N F O A B S T R A C T

Article history: As powerful image editing tools are widely used, the demand for identifying the authenticity of an image
Received 17 April 2013 is much increased. Copy-move forgery is one of the tampering techniques which are frequently used.
Received in revised form 5 September 2013 Most existing techniques to expose this forgery need to improve the robustness for common post-
Accepted 7 September 2013
processing operations and fail to precisely locate the tampering region especially when there are large
Available online 18 September 2013
similar or flat regions in the image. In this paper, a robust method based on DCT and SVD is proposed to
detect this specific artifact. Firstly, the suspicious image is divided into fixed-size overlapping blocks and
Keywords:
2D-DCT is applied to each block, then the DCT coefficients are quantized by a quantization matrix to
Copy-move forgery
obtain a more robust representation of each block. Secondly, each quantized block is divided non-
Digital image forensics
Region duplication detection overlapping sub-blocks and SVD is applied to each sub-block, then features are extracted to reduce the
Passive authentication dimension of each block using its largest singular value. Finally, the feature vectors are lexicographically
sorted, and duplicated image blocks will be matched by predefined shift frequency threshold.
Experiment results demonstrate that our proposed method can effectively detect multiple copy-move
forgery and precisely locate the duplicated regions, even when an image was distorted by Gaussian
blurring, AWGN, JPEG compression and their mixed operations.
ß 2013 Elsevier Ireland Ltd. All rights reserved.

1. Introduction blind forensics aims at assessing the authenticity of an image

without prior knowledge and in the absence of watermarks or
With the widespread use of powerful digital image editing signatures, which works by assuming that even if the tampered
tools, even people who are not experts in image processing can images do not reveal any visual artifacts or anomalies, the
tamper with an image easily without leaving visible clues. Thus it underlying statistics of these images would be distinct from the
poses a very serious social problem as to how much of its content original ones. Owing to its incomparable advantage, passive-blind
can be believed in, whether it is authentic or tampered, especially image forensics has become a very hot and promising research
as a witness in a courtroom, insurance claims and scientific fraud. aspect in the image authentication field.
When the counterfeit images are used for vicious purpose, it may Among forgery techniques using typical image processing tools,
result in inestimable losses. Therefore, developing techniques to copy-move forgery is the most common type of image tampering
verify the authenticity and integrity of digital images become very where a region of an image is copied and pasted to another non-
significant, which is one of the primary goals in image forensics. intersecting region in the same image to conceal an important
Over the past few years, the field of digital forensics, which is novel element or to emphasize a particular object. Since duplicated
and exciting, has emerged to help restore the reliance to digital regions come from the same image, they have similar properties
images. Digital watermarking [1,2] has been addressed as a means like texture, noise and color. An example of copy-move forgery is
by which an image can be authenticated, however, the drawback of illustrated in Fig. 1. Fig. 1(a) is the original image, while Fig. 1(b) is a
which is that a watermark must be inserted at the time of fake counterpart where the fountain on the right was copied and
recording, which would restrict this approach to specially placed over the base of the building on the left. In the last decade,
equipped digital cameras. In contrast to this method, passive- many passive detection schemes for copy-move forgery have been
proposed, which could be grouped into two categories: block-
based methods and keypoint-based methods. Fridrich [3] first
* Corresponding author at: School of Computer and Information Engineering,
analyzed the exhaustive search and then proposed a block
Tianjin Chengjian University, Tianjin 300384, China. Tel.: +86 22 23085130. matching detection scheme based on discrete cosine transform
E-mail addresses: [email protected] (J. Zhao), [email protected] (J. Guo). (DCT) which is one of the landmark methods for copy-move

0379-0738/$ – see front matter ß 2013 Elsevier Ireland Ltd. All rights reserved.
http://dx.doi.org/10.1016/j.forsciint.2013.09.013
 J. Zhao, J. Guo / Forensic Science International 233 (2013) 158–166 159

Fig. 1. An example of copy-move forgery.

forgery detection. Popescu [4] proposed a similar method which copy-move forgery and precisely locate the duplicated regions, but
used principal component analysis (PCA) instead of DCT. The also has stronger robustness to common post-processing attacks
accuracy of the method is good except for small block sizes and low such as Gaussian blurring, additive white Gaussian noise, JPEG
SNR. Luo [5] extracted color features as well as special intensity compression and their mixed operations.
ratio to represent a block characteristics vector. A different The rest of the paper is organized as follows. The review of DCT
approach was presented by Kang [6] in which the features were and SVD is given in Section 2. In Section 3, the proposed forgery
represented by the singular value decomposition (SVD). Bayram detection method is described in detail. The experimental results
[7] applied Fourier-Mellin transform (FMT) to each block and FMT are given and the corresponding analysis is discussed in Section 4.
values were finally projected to one dimension to form the feature The conclusion is drawn in Section 5.
vector. Mahdian [8] used a method based on blur moment
invariants to locate the forgery regions. Li [9] extracted the features 2. Review of DCT and SVD
of the circular blocks using rotation invariant uniform local binary
patterns. Lynch [10] proposed an efficient expanding block 2.1. Discrete cosine transform
algorithm primarily using direct block comparison instead of
indirect comparisons based on block features. Almost all the Discrete cosine transform (DCT) is a mathematical transforma-
methods mentioned above are block-based which attempt to find tion method which can transform each pixel of an image in the
an effective and robust representation of each block, moreover, spatial domain into DCT coefficient in the frequent domain. It is
they are expected to be insensitive to common post-processing significant to numerous applications in science and engineering,
operations including additive white Gaussian noise (AWGN), from lossy compression of audio (e.g. MP3) and images (e.g. JPEG)
Gaussian blurring and JPEG compression. to spectral methods for the numerical solution of partial
Unlike block-based methods, keypoint-based methods rely on differential equations. It is worthy to note that DCT has some
the identification and selection of high-entropy image regions. In useful properties which are of particular value to image processing,
[11–13], some approaches that extracted keypoints by scale- such as energy compaction, de-correlation, symmetry and so on,
invariant feature transform (SIFT) were proposed to detect the especially for lossy data compression, because it has a strong
forgery due to their robustness to several geometrical transforms ‘‘energy compaction’’ property: most of the signal information
such as rotation and scaling. However, SIFT-based scheme still has tends to be concentrated in a few low-frequency components of
a limitation on detection performance since it is only possible to the DCT. Two-dimensional DCT of a M  N matrix is defined as
extract the keypoints from peculiar points of the image and not follows:
robust to some post-processing operations like blurring and
flipping based on our experimental results. Shivakumar [14]
proposed another keypoint-based method which used speeded up X
M X
1N 1
pð2m þ 1Þ p pð2n þ 1Þq
B pq ¼ a p aq Amn cos cos 0 p
robust features (SURF). Recently, Chen [15] developed a method by m¼0 n¼0
2M 2N
extracting Harris corner points as keypoints and employing step
 M  1; 0  q  N  1
sector statistics to represent the small circle image region around
each Harris point. The main drawback of most keypoint-based 8 8
>
> 1 >
> 1
methods is that copied regions are often only sparsely covered by < pffiffiffiffiffi; p ¼ 0 < pffiffiffiffi; q¼0
matched keypoints. Thus they do not provide the exact extent and a p ¼ pMffiffiffi N
aq ¼ pffiffiffi (1)
> >
location of the detected duplicated region, but only displays the : 2; 1  p  M  1
> : 2;
>
1qN1
matched keypoints. Furthermore, if the copied region exhibits little M N
structure, it may happen that the region is completely missed [16]. The values Bpq are called the DCT coefficients of special
Most existing methods are typically evaluated against simple grayscale value Amn.
forgeries where human viewers have no trouble to identify the
duplicated regions and low resolution images which are a far cry 2.2. Singular value decomposition
from realistic tampered images with high resolution. In this paper,
we develop an effective and robust detection algorithm based on Singular value decomposition (SVD) is a matrix factorization
DCT and SVD whose framework is also block-based. A series of and has three properties, namely, stability, scaling property and
experiments conducted on challenging realistic forgery images rotation invariance, which represents algebraic and geometric
demonstrate our method can not only effectively detect multiple invariant properties of an image [17,18]. SVD has been used in a
160 J. Zhao, J. Guo / Forensic Science International 233 (2013) 158–166

large amount of fields such as signal processing, data compression

and pattern analysis. The basic theory of SVD is as follows:
Let A be an image matrix with A 2 RMN of rank r, its SVD is given
by the formula:

A ¼ U SV T (2)

where U is a M  M matrix of the orthonormal eigenvectors of AAT,

VT is the transpose of a N  N matrix containing the orthonormal
eigenvectors of ATA, S 2 RMN is a M  N diagonal matrix of the
singular values which are the square roots of the eigen values of
ATA, divided in the form of equation:
 
S ¼ Sr 0 (3)
0 0

where Sr is a square diagonal matrix in Rrr, Sr = diag(s1, s2, . . .,

sr). r is the rank of A that is equal to number of non-negative
singular values. The positive diagonal entries in Sr are called the
singular values of A and ranked in decreasing order as follows:
s1  s2      sr > 0.
SVD is not only an important tool for exploratory data analysis,
dimensionality reduction and data compression, but also a method
for noise reduction. The singular values are unique for a matrix,
which form a steady representation of image blocks. Through a large
number of experiments, we find that only a few large singular values
dominate for most natural images while all the other singular values
Fig. 2. Framework of the detection algorithm.
are quite small. It can be drawn that the relatively small singular
values are sensitive to noise while the largest singular value (LSV)
contains most energy of each image block and has a good stability
3.2. Implementation details
even when images suffer from minor distortions. This is the property
of SVD of which our algorithm takes advantage.
Our detection algorithm includes seven steps, the details of
which are given as follows:
3. The proposed algorithm
Step1: Pre-processing the suspicious image.
Assume that the suspicious image is a gray image I of the size
Owing to the nature of copy-move forgery, there must be at
M  N. If it is a color image, it is first converted to a grayscale image
least a pair of similar regions in a tampered image, which is the
using the standard formula:
basis of all passive detection algorithms. A natural image, on the
contrary, is unlikely to have two large similar regions except for the Y ¼ 0:299R þ 0:587G þ 0:114B (4)
images that have a large area of smooth region, such as blue sky or
green grassland in the image. Hence, the task of passive-blind where R, G, B are three channels of the input color image, Y is its
forensics is to determine whether an image contains large similar luminance component.
regions. Since the shape and size of copied regions are unknown, it Step2: Dividing the suspicious image into fixed-size over-
is definitely computationally impossible to try to compare every lapping blocks.
possible pairs of region pixel by pixel. Obviously, it is more The suspicious image is divided into overlapping blocks with the
effective to divide a forensic image into fixed-sized overlapping size of b  b pixels by sliding one pixel form upper left corner right
blocks and examine whether pairs of blocks are duplicated. The key down to lower right corner, that is, the adjacent overlapping blocks
step is to extract some appropriate and robust features from each only have one different row or column. We assume that the size of
block in order to implement an effective detection. Therefore, a duplicated region is larger than the size of overlapping block, which is
good feature can not only represent the whole block, but also has reasonable on account of the fact that a meaningful forged operation
the robustness of common post-processing operations, and what is must be of a certain area. Each block is denoted as Bij, where i and
more, make the detection algorithm have lower computational j indicates the starting point of the block’s row and column
complexity. respectively. The total number of overlapping blocks for a suspicious
image of M  N pixels is (M  b + 1)  (N  b + 1).
3.1. Algorithm framework Step3: Appling 2D-DCT to each block to obtain DCT coefficients
with the same size.
The discussions above draw forth the framework of copy-move Two-dimensional DCT is applied to each block. After that a DCT
forgery detection algorithm, which is also shown in Fig. 2. The coefficients matrix with the same size as the block is exploited,
whole detection framework is given as follows: which can represent the corresponding block. Here, we assume
that the size of each block is 8  8, thus the size of the DCT
(1) Dividing the suspicious image into fixed-size overlapping coefficients matrix is also 8  8. Since the method of extracting
blocks. features of each block in our algorithm is inspired by the thought
(2) Applying 2D-DCT to each block to generate the quantized that a quantization table is applied to each DCT coefficients matrix
coefficients by means of quantization. in the JPEG image encoding, the size of each block is definitely
(3) Extracting SVD-based features from each quantized block. assigned to 8  8.
(4) Matching similar block pairs. Step4: Dividing DCT coefficients matrix by quantization steps
(5) Removing the isolated blocks and output the detection result. stored in the quantization matrix and rounding to integers.
 J. Zhao, J. Guo / Forensic Science International 233 (2013) 158–166 161

It is the nature of DCT that the energy of transformed domain matching pairs in the same mutual position, that is, they have the
will be focused on the low frequency coefficients, that is, not all of same shift vector. Towards this goal, if two consecutive rows of
the elements are equally important and the top-left part of DCT the sorted matrix à are found, the algorithm calculates the
coefficients represents most of the information. We are inspired shift vector between them, stores the positions of each block
from quantization mechanism of JPEG images encoding in order to which represented by a feature vector with the size of 1  16 in a
yield a more robust representation of each image block. In our separate list and increments a shift vector counter C. Formally,
method, the size of each block Bij is set to 8  8 and the quantized let (i1, j1) and (i2, j2) be the top-left corner’s coordinate of the
DCT coefficient is computed with two blocks which represented by two consecutive rows of
  the sorted matrix Ã, thus the shift vector S between them is
Di j
Dqij ¼ round i; j 2 f0; 1; . . . ; 7g (5) calculated as:
Qij
S ¼ ðs1 ; s2 Þ ¼ ði1  i2 ; j1  j2 Þ: (8)
where Dij is the un-quantized DCT coefficient, Q is the quantization
table in which the element Qij controls the compression ratio, with Due to the shift vector S and S correspond to the same shift,
larger values producing greater compression, and Dqij is the the shift vectors are normalized, if necessary, by multiplying by 1
quantized coefficient. so that S  0. For each pair of blocks represented by the consecutive
Step5: Representing each quantized block by partitioning it into rows of the sorted matrix Ã, we increment the normalized shift
sub-blocks and extracting robust features from each sub-block. vector counter C by one:
We divide each overlapping quantized block into non-over- Cðs1 ; s2 Þ ¼ Cðs1 ; s2 Þ þ 1: (9)
lapping sub-blocks with the size of 2  2 pixels. SVD is applied to
each sub-block and its largest singular value is recorded. For each The shift vector counter C is initialized to zero before the
quantized block of size 8  8 pixels, we can obtain 16 largest algorithm starts. At the end of the matching process, the counter C
singular values of different sub-block which constitute a feature indicates the frequencies with which different normalized shift
vector to represent the block as shown in Fig. 3. Assuming that vectors occur. Then the algorithm finds all normalized shift vectors
Smaxp is the largest singular value of the corresponding sub-block S1, S2, . . ., SK, whose occurrence exceeds a user-specified threshold
labeled p(p 2 {1, . . ., 16}), they can be combined to form a feature Tshift:
vector with the size of 1  16, denote as:
CðSr Þ > T shift for all r ¼ 1; 2; . . . ; K: (10)
V ¼ ½Smax1 ; Smax2 ; . . . ; Smax16 : (6) It is worth mentioning that the value of the threshold Tshift is
So a 8  8 block is represented by a 1  16 feature vector, related to the size of the smallest region that can be identified by
compared with other block-based detection methods in [3,4], the algorithm. Larger values may cause the algorithm to miss some
whose feature dimension is 1  64, 1  32, the dimension of ours is not-so-closely matching blocks, while too small a value of Tshift
lower. may introduce too many false matches.
Step6: Matching similar block pairs. In addition, since the duplicated regions are assumed to be not
After obtaining the feature vector for each block, a matrix A is overlapping and the divided blocks may be overlapping, an
created by arranging the feature vectors into the feature matrix A. additional user-specified parameter Td is also applied to make a
The row of matrix A corresponds to the feature vector extracted of judgment, that is, shift vectors is counted if and only if it is
each block and the number of rows in matrix A is generated by two similar feature vectors whose Euclidean distance
(M  b + 1)(N  b + 1) equal to the total number of image blocks. is larger than Td:
In brief, the feature matrix A is with the size of qffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi
(M  b + 1)(N  b + 1)  16. ðx1  x2 Þ2 þ ðy1  y2 Þ2 > T d : (11)
2 3
V1 In sum, in order to determine whether the blocks are duplicated
6 V2 7 or not, we set two thresholds: shift frequency threshold Tshift and
6 7
A¼6 .. 7 (7) distance threshold Td. Only if the test satisfies the Eqs. (10) and
4 . 5
V ðMbþ1ÞðNbþ1Þ (11), we mark a color map for the copied and duplicated blocks to
show the forgery detection result.
Note that if the two blocks in the suspicious image are similar Step7: Post-processing and outputting the final detection result.
enough, their corresponding feature vectors in feature matrix A Morphologically open operation is applied to fill the holes in
would be similar as well. Thus matching similar block pairs can be marked regions and remove the isolated blocks, then output the
conducted by lexicographically sorting the rows of matrix A to final detection result.
make the feature vectors of similar blocks adjacent to each other.
Here the lexicographically sorted matrix is denoted as Ã. To avoid 4. Experiment results and analysis
some false matches whenever possible, the algorithm needs to pay
a close attention to the mutual positions of each matching block All the experiments were carried out on the platform with Intel
pair and outputs a specific block pair only if there are many other Pentium 2.13 GHz and Matlab R2010b. The tampered images were
created by Photoshop CS3 based on the following three datasets.
The first dataset contains some test images in common use came
from the miscellaneous volume of USC-SIPI database with the sizes
of 256  256 pixels and 512  512 pixels [19]. The second dataset
contains 24 uncompressed PNG true color images of size 768  512
pixels released by Kodak Corporation for unrestricted research
usage [20]. In addition, we collected 50 high resolution images of
size 1024  768 pixels from Google image search [21], which
formed the third dataset. In our experiments, without specific
specification, all the parameters are set as: b = 8, Q = 75, Td = 40,
Fig. 3. Extracting features from each quantized DCT block of 8  8 using LSV. Tshift = 90 by default. A disk with the radius of 5 is used in the
162 J. Zhao, J. Guo / Forensic Science International 233 (2013) 158–166

Fig. 4. Shown on the top row are three tampered images with different sizes of duplicated regions. Shown below are the corresponding detection results. DAR/FPR rates and
size of duplicated regions are given respectively.

Fig. 5. Shown are the detection results of non-regular copy-move forgeries. DAR/FPR rates are given below respectively.

morphologically opening operation. By using our method, for each 4.1. Performance evaluation
image with the four different sizes from the three datasets
mentioned above, it takes about 9 s, 36 s, 55 s and 115 s to locate For practical applications, the most important aspect of a
the tampered regions respectively. Nevertheless, if we use C++ or detection method is the ability to distinguish tampered and
Java programming languages to implement the algorithm, our original images. However, the power to correctly locate the
algorithm will achieve higher efficiency. tampered region is also significant, which gives the strong

Fig. 6. Shown are the detection results of multiple non-regular copy-move forgeries. DAR/FPR rates are given below respectively.
 J. Zhao, J. Guo / Forensic Science International 233 (2013) 158–166 163

Fig. 7. Shown are the detection results of multiple non-regular copy-move forgeries under different post-processing operations. DAR/FPR rates are given below respectively.

evidence to expose digital forgeries. Thus, we evaluate the of original region and forgery region in original image respectively,
performance of our algorithm at two levels: at image level, where and c̃S ; c̃T as pixels of original region and forgery region in
we focus on whether the fact that an image has been tampered or detected result image respectively. From these we compute the
not can be detected; at pixel level, where we evaluate how detection accuracy rate DAR and the false positive rate FPR. They
accurately can tampered regions be identified. are defined as follows:
At image level, we keep a record of some important measures    
   
which are the number of correctly detected forged images TP, the cS \ c̃S  þ cT \ c̃T 
DAR ¼     (13)
number of images that have been erroneously detected as forged c  þ c 
S T
FP, and the falsely missed forged images FN. From these we
compute the measures Precision, p and Recall, r which are defined    
   
c̃S  cS  þ c̃T  cT 
as follows [16]: FPR ¼     (14)
   
c̃S  þ c̃T 
TP TP
p¼ and r¼ : (12)
TP þ FP TP þ FN where j j means the area of region, \ means the intersection of two
regions and – means the difference of two regions. In this sense,
Precision denotes the probability that a detected forgery is truly DAR indicates the performance of algorithm correctly locating
a forgery; while Recall shows the probability that a forged image is pixels of copy-move regions in the tampered image, while FPR
detected. reflects the percentage of pixels which are not contained in
At pixel level, we adopt two quantitative measures to evaluate duplicated region but included by the implemented method. That
the performance of the proposed method. Denote cS, cT as pixels is, two parameters indicate how precisely our algorithm can locate

Table 1
Detection results of the tampered images distorted by Gaussian blurring.

w = 3, s = 0.5 w = 3, s = 1 w = 5, s = 0.5 w = 5, s = 1

32  32 48  48 32  32 48  48 32  32 48  48 32  32 48  48

p 1.000 1.000 0.993 0.997 0.985 0.991 0.983 0.988

r 1.000 1.000 1.000 1.000 1.000 1.000 0.985 1.000
DAR 0.922 0.948 0.886 0.926 0.913 0.947 0.847 0.892
FPR 0.033 0.015 0.033 0.018 0.033 0.014 0.056 0.015
164 J. Zhao, J. Guo / Forensic Science International 233 (2013) 158–166

Table 2
Detection results of the tampered images distorted by additive white Gaussian noise.

SNR = 40 dB SNR = 35 dB SNR = 30 dB SNR = 25 dB

32  32 48  48 32  32 48  48 32  32 48  48 32  32 48  48

p 0.990 1.000 0.988 0.990 0.968 0.982 0.965 0.978

r 1.000 1.000 0.990 1.000 0.978 0.985 0.933 0.938
DAR 0.987 0.995 0.979 0.991 0.932 0.982 0.885 0.893
FPR 0.003 0.003 0.003 0.066 0.089 0.112 0.169 0.154

Table 3
Detection results of the tampered images distorted by JPEG compression.

Q = 90 Q = 80 Q = 70

32  32 48  48 32  32 48  48 32  32 48  48

p 0.947 0.967 0.903 0.935 0.882 0.899

r 0.973 0.978 0.923 0.940 0.823 0.874
DAR 0.961 0.981 0.879 0.944 0.773 0.815
FPR 0.012 0.003 0.097 0.004 0.139 0.029

copy-move regions. The more DAR is close to 1 and FPR is close to 0, challenge to discern the forgery. To the best of our knowledge, a
the more precise the method would be. number of previous methods cease to be effective under the
circumstances; however, the detection results of our algorithm are
4.2. Effectiveness and accuracy test satisfactory. Images shown in Fig. 6 are the testing results which
demonstrate that our algorithm work well even when the
In the following experiment, we select some color images with tampered images have multiple duplicated regions, however,
the size of 768  512 pixels from the second dataset to test the literature [3–10] fail to consider such forgery.
effectiveness of our algorithm. Here, we divide these images into
two groups. In the first group, we randomly choose three kinds of 4.3. Robustness test
blocks with different sizes, which are 32  32 pixels, 64  64 pixels
and 96  96 pixels (corresponding to 0.26%, 1.04% and 2.34% of Since forgers usually do their utmost to create an imperceptible
total image area) respectively, to tamper with, while all the tampered image, various kinds of post-processing operations are
duplicated regions are non-regular and meaningful objects in the carried out such as additive Gaussian noise, Gaussian blurring,
second group. All the doctored images in this experiment are JPEG compression or mixed operations. In this section, we conduct
without any post-processing operation and the corresponding a series of experiments to test the robustness of the proposed
detection results are illustrated in Figs. 4–6. The top row shows the method. Fig. 7 shows such situation, which indicates that our
tampered images, with the yellow line indicating the copy-move algorithm can locate multiple duplication regions under different
regions and pasting location, and the bottom gives the detection post-processing operations with a satisfactory degree, even when
results. Owing to space constrains, just a part of the experimental the image is processed by mixed operations. However, literature
results are given here. [3,4,6–14] do not give such experiment.
Fig. 4 shows that the accuracy rate DAR is generally greater than Furthermore, in order to evaluate quantitatively the robustness
0.95 and the false positive rate FPR equals to 0, that is, our of our algorithm to different image distortions, we selected
algorithm can locate the tampered regions quite precisely. In randomly 100 original images from the three datasets to generate
addition, Fig. 4 also indicates that the detection performance of our doctored images by copying a square region at a random location
algorithm gradually improves with the increase of size of and pasting onto a non-overlapping region. The sizes of square
duplicated regions. Fig. 5 illustrates that our algorithm can find region were 32  32 pixels and 48  48 pixels respectively, each
the duplicated regions precisely when all the duplicated regions kind of which included four differently relative location to
are non-regular and meaning, even though there are large similar generate 800 tampered images. These tampered images together
or flat regions in the image, such as large areas of sky or water. Due with their original version were then distorted by commonly used
to the homogenous background in the suspicious images, it is post-processing operations with different parameters, such as

Fig. 8. DAR/FPR curves for DCT, SVD and proposed methods with different Gaussian blurring (w = 5, s = 0.5, 1, 1.5, 2, 2.5 and 3) when the duplicated region is 64  64 pixels.
 J. Zhao, J. Guo / Forensic Science International 233 (2013) 158–166 165

Fig. 9. DAR/FPR curves for DCT, SVD and proposed methods with different additive white Gaussian noise (SNR = 25 dB, 30 dB, 35 dB and 40 dB) when the duplicated region is
64  64 pixels.

Fig. 10. DAR/FPR curves for DCT, SVD and proposed methods with different JPEG compression (Q = 70, 75, 80, 85 and 90) when the duplicated region is 64  64 pixels.

Gaussian blurring, AWGN and JPEG compression. The experimen- SNR drops to about 25 dB, while our method achieves higher DAR
tal results were given in Tables 1–3, which evaluated the and lower FPR than other methods. Fig. 10 shows that the
robustness from image level and pixel level respectively. comparison result when the tempered images are contaminated by
The detection results shown in Tables 1–3 indicate that the JPEG compression with different quality factor (Q = 70, 75, 80, 85
larger the area of duplicated region is, the better the detection and 90), which illustrates that our method does work well when
performance would be, no matter which post-operation the image the images are slightly compressed.
is distorted by. Table 1 shows that the proposed method has a high
detection performance when the images are distorted by Gaussian
5. Conclusions
blurring, even when the image has poor quality ðw ¼ 5; s ¼ 1Þ and
small region (32  32 pixels), our method fails to detect only six
We have proposed a robust passive detection method for copy-
images in a total of 400 tampered images (r = 0.985). We can draw
move forgery which works in the absence of digital watermarks or
a conclusion from Table 2 that our method performs well also in
signatures information. Compare with previous works, such as [3–
the case of processing AWGN distorted images. Results of
8], the overall performance of our method is better. The
tampered images distorted by JPEG compression with different
experiment results show that the proposed algorithm could not
quality are shown in Table 3, which indicate that our method has
only effectively detect multiple copy-move forgery and precisely
the ability to locate tampered regions in the case of slight
locate the duplicated regions, but also has stronger robustness to
compression.
Gaussian blurring, AWGN, JPEG compression and their mixed
In the last experiment, we compared our method with two
operations. Thus, we believe our study can make a little
relevant approaches: DCT-based [3] and SVD-based [6]. Here we
contribution to the area of multimedia forensics.
only selected 400 tampered images with the duplicated size of
48  48 pixels for convenience. The overall average DAR/FPR
Acknowledgements
performance comparisons over 400 tampered images are shown in
Figs. 8–10.
This work was supported by Higher School Science &
In the case of Gaussian blurring, Fig. 8 indicates that the DAR
Technology Fund Planning Project of Tianjin City (Grant #
curve of the proposed method gains better performance than
20120712), China.
others, with DAR  85%, when the blurring radius increases. The
FPR curve also gives a satisfactory result that our method has the
lowest FPR, even though with larger blurring radius s = 3. References
However, keypoint-based methods [11–15] fail to detect such
[1] A. Mishra, A. Goel, R. Singh, G. Chetty, L. Singh, A novel image watermarking
forgery. Similar behavior is observed in the case of noise adding
scheme using extreme learning machine, in: The 2012 International Joint Con-
illustrated in Fig. 9, where the tampered images are distorted by ference on Neural Networks (IJCNN), 2012, 1–6.
white Gaussian noise (SNR = 25 dB, 30 dB, 35 dB and 40 dB). With [2] X. Tong, Y. Liu, M. Zhang, Y. Chen, A novel chaos-based fragile watermarking for
the increase of SNR levels, the DAR increases and the FPR decreases image tampering detection and self-recovery, Signal Process. Image Comm. 28
(2013) 301–308.
for all methods. Observations from the DAR/FPR curves show that, [3] J. Fridrich, D. Soukalm, J. Lukas, Detection of Copy-Move Forgery in Digital Images,
the SVD-based method has the worst performance especially when Digital Forensic Research Workshop, Cleveland, 2003, pp. 19–23.
166 J. Zhao, J. Guo / Forensic Science International 233 (2013) 158–166

[4] A.C. Popescu, H. Farid, Exposing Digital Forgeries by Detecting Duplicated Image [12] I. Amerini, L. Ballan, R. Caldelli, A. Del Bimbo, G. Serra, A SIFT-based forensic
Regions, Tech. Rep. TR2004-515, Dartmouth College, 2004. method for copy-move attack detection and transformation recovery, IEEE Trans.
[5] W. Luo, J. Huang, G. Qiu, Robust detection of region-duplication forgery in digital Inf. Forensics Secur. 6 (3) (2011) 1099–1110.
images, in: International Conference on Pattern Recognition, Vol. 4, 2006, [13] H. Huang, W. Guo, Y. Zhang, Detection of copy-move forgery in digital images
746–749. using SIFT algorithm, in: Proceedings of IEEE Pacific-Asia Workshop on Compu-
[6] X. Kang, S. Wei, Identifying tampered regions using singular value decomposition tational Intelligence and Industrial Application, Vol. 2, 2008, pp. 272–276.
in digital image forensics, in: Proceedings of International Conference on Com- [14] B.L. Shivakumar, S. Baboo, Detection of region duplication forgery in digital
puter Science and Software Engineering, 2008, pp. 926–930. images using SURF, Int. J. Comput. Sci. Issues 8 (4) (2011) 199–205.
[7] S. Bayram, H.T. Sencar, N. Memon, An efficient and robust method for detecting [15] L. Chen, W. Lu, J. Ni, W. Sun, J. Huang, Region duplication detection based on Harris
copy-move forgery, in: IEEE International Conference on Acoustics, Speech and corner points and step sector statistics, J. Vis. Comm. Image Representation 24
Signal Processing, IEEE Press, New York, 2009. (2013) 244–254.
[8] B. Mahdian, S. Saic, Detection of copy-move forgery using a method based on blur [16] V. Christlein, C. Riess, J. Jordan, et al., An evaluation of popular copy-move forgery
moment invariants, Forensic Sci. Int. 171 (2007) 180–189. detection approaches, IEEE Trans. Inf. Forensics Secur. 7 (6) (2012) 1841–1854.
[9] L. Li, S. Li, H. Zhu, An efficient scheme for detecting copy-move forged images [17] G.H. Golub, C.F. Van Loan, Matrix Computations, 3/e, Johns Hopkins University
by local binary patterns, J. Inf. Hiding Multimedia Signal Process. 4 (1) (2013) Press, Baltimore, 1996.
46–56. [18] V.C. Klema, The singular value decomposition: its computation and some appli-
[10] G. Lynch, F.Y. Shih, H.M. Liao, An efficient expanding block algorithm for image cations, IEEE Trans. Automat. Contr. 25 (1980) 164–176.
copy-move forgery detection, Inf. Sci. 239 (2013) 253–265. [19] The USC-SIPI Image Database: http://sipi.usc.edu/database/.
[11] X. Pan, S. Lyu, Region duplication detection using image feature matching, IEEE [20] Kodak Lossless True Color Image Suite: http://r0k.us/graphics/kodak/.
Trans. Inf. Forensics Secur. 5 (4) (2010) 857–867. [21] Google Image Search: http://images.google.com/.