Book cover of Adversarial Multimedia Forensics

Volume 104

Advances in Information Security

Series Editors

Sushil Jajodia

George Mason University, Fairfax, VA, USA

Pierangela Samarati

Milano, Italy

Javier Lopez

Malaga, Spain

Jaideep Vaidya

East Brunswick, NJ, USA

The purpose of the Advances in Information Security book series is to establish the state of the art and set the course for future research in information security. The scope of this series includes not only all aspects of computer, network security, and cryptography, but related areas, such as fault tolerance and software assurance. The series serves as a central source of reference for information security research and developments. The series aims to publish thorough and cohesive overviews on specific topics in Information Security, as well as works that are larger in scope than survey articles and that will contain more detailed background information. The series also provides a single point of coverage of advanced and timely topics and a forum for topics that may not have reached a level of maturity to warrant a comprehensive textbook.

Editors

Ehsan Nowroozi, Kassem Kallas and Alireza Jolfaei

Adversarial Multimedia Forensics

First Edition

The Springer logo.

Editors

Ehsan Nowroozi

Department of Business and Computing, Ravensbourne University London, London, UK

Kassem Kallas

INRIA, Rennes, France

Alireza Jolfaei

College of Science and Engineering, Flinders University, Adelaide, SA, Australia

ISSN 1568-2633e-ISSN 2512-2193

Advances in Information Security

ISBN 978-3-031-49802-2e-ISBN 978-3-031-49803-9

https://doi.org/10.1007/978-3-031-49803-9

© The Editor(s) (if applicable) and The Author(s), under exclusive license to Springer Nature Switzerland AG 2024

This work is subject to copyright. All rights are solely and exclusively licensed by the Publisher, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation, broadcasting, reproduction on microfilms or in any other physical way, and transmission or information storage and retrieval, electronic adaptation, computer software, or by similar or dissimilar methodology now known or hereafter developed.

The use of general descriptive names, registered names, trademarks, service marks, etc. in this publication does not imply, even in the absence of a specific statement, that such names are exempt from the relevant protective laws and regulations and therefore free for general use.

The publisher, the authors, and the editors are safe to assume that the advice and information in this book are believed to be true and accurate at the date of publication. Neither the publisher nor the authors or the editors give a warranty, expressed or implied, with respect to the material contained herein or for any errors or omissions that may have been made. The publisher remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

This Springer imprint is published by the registered company Springer Nature Switzerland AG

The registered company address is: Gewerbestrasse 11, 6330 Cham, Switzerland

Preface

In today’s world, multimedia, such as images, videos, and audio, have become integral for shaping opinions, making decisions, and determining court outcomes. However, the ease with which such content is manipulated has created ethical and legal challenges. Adversarial multimedia forensics is an emerging field at the intersection of computer science, engineering, and law that aims to develop robust techniques for detecting and preventing manipulation. This book serves as a comprehensive guide for state-of-the-art methods, challenges, and the future of this rapidly evolving discipline.

The importance of multimedia forensics, especially adversarial techniques, now extends far beyond academia to sectors such as social media, law enforcement, and journalism. For example, tech firms integrate forensic algorithms on platforms to automatically detect manipulated content and to maintain information integrity. Research funding and collaboration in this space are increasing, reflecting their growing significance. Law agencies leverage multimedia forensics to validate evidence and solve crimes, from identifying fraud deepfakes to verifying the authenticity of content as legal evidence. Even in reporting, multimedia verification abilities can mean the difference between responsible journalism and the spread of misinformation. This widespread real-world applicability makes this field indispensable for maintaining multimedia trustworthiness. Ethical and legal implications are also addressed, such as how forensic analysis should be presented in court and the ethical boundaries analysts should respect when investigating content. These considerations are critical for establishing credibility and standards.

Sophisticated editing software and deep learning have facilitated the creation of convincing forgeries. Deepfakes can seamlessly swap faces, making it appear that people said or did things that they did not. Audio spoofing can frauduently replicate voice recording. These manipulations cause harm from personal defamation to the spread of societal-scale misinformation. Traditional forensic methods look for inconsistencies in lighting or pixels in order to detect forgeries. However, advanced manipulation techniques have been used to evade these mechanisms. This creates an adversarial cat-and-mouse dynamic, in which analysts must constantly adapt. This book explores how adversarial machine learning can help and challenge forensic efforts. Readers will dive deeply into techniques from classic signal processing to cutting-edge machine learning used in adversarial multimedia forensics. Topics such as feature extraction, anomaly detection, and adversarial training were covered, providing balanced perspectives on the strengths and limits of the approaches. The case studies offer insights into real-world applications. As manipulation continues to evolve, this field must also evolve. The book concludes by looking at future directions, such as integrating metadata, developing real-time systems, and creating standardized benchmarks to evaluate methods.

Intended for those in computer science, engineering, and other related fields, this book explores the challenges and opportunities of the adversarial side of multimedia forensics. Some machine learning and signal processing basics are helpful but are not required. The goal is to equip readers with the knowledge to navigate this complex space and drive innovation in this exciting, ever-changing field.

Acknowledgments

The lead editor wishes to express sincere appreciation to the numerous individuals whose contributions were instrumental in bringing this book to fruition, first and foremost the chapter authors, whose expertise and dedicated efforts in researching and writing their manuscripts provided the foundational content that enabled the compilation of this volume; additionally, gratitude is due to the reviewers, whose discerning feedback and critiques proved invaluable in revising the chapters to maximize their scholarly merit; finally, the editor would like to recognize the professional guidance of the publishing team at Springer, particularly Susan Lagerstrom-Fife as head editor, whose experienced support throughout the publication process was greatly appreciated; in summary, the editor is indebted to all those who generously offered their time and talents to make this book a reality and hopes they share in pride of being part of this scholarly endeavor.

Anselmo Ferriera, Cyber and Digital Citizen’s Security Unit, European Joint Research Center, European Commission, Italy

Jianwei Fei, Nanjing University of Information Science & Technology, China

Behrooz Razeghi, Idiap Research Institute, Switzerland

Meng Li, Hefei University of Technology, China

Shantanu Pal, Deakin University, Australia

Saman Shoja Chaeikar, Australian Institute of Higher Education, Australia

Ali Mehrabi, Western Sydney University, Australia

Soheila Ghane, BHP, Australia

Sona Taheri, RMIT University, Australia

Prabhat Kumar, LUT University, Finland

Randhir Kumar, Indian Institute of Technology, India

Sattar Seifollahi, Resolution Life, Australia

Rahim Taheri, University of Portsmouth, England

Iuliia Tkachenko, Université Lumière Lyon 2, France

Hannes Mareen, Gent University, Belgium

Siwei Lyu, University of Buffalo, USA

KIJAK Ewa, University of Rennes, IRISA, INRIA, France

Pedro Comesaña Alfaro, University of Vigo, Spain

Ehsan Nowroozi

Kassem Kallas

Alireza Jolfaei

London, United KingdomBrest, Bretagne, FranceAdelaide, SA, Australia

Contents

Model Poisoning Attack Against Federated Learning with Adaptive Aggregation1

Seyedsina Nabavirazavi, Rahim Taheri, Mani Ghahremani and Sundararaja Sitharama Iyengar

1 Introduction1

2 Related Work3

2.​1 Federated Learning in Image Classification3

2.​2 Poisoning Attacks in Federated Learning4

2.​3 Adaptive Aggregation in Federated Learning5

3 Background and Problem Definition7

4 Stealthy Model Poisoning Attack (MSA)9

5 Adaptive Federated Optimization10

6 Evaluation12

6.​1 Simulation Setup12

6.​2 Parameter and System Setting13

6.​3 Test Metrics13

6.​4 Dataset14

7 Experimental Results14

7.​1 Results in No Attack Scenario15

7.​2 Results With Attack in Rounds Multiples of 516

7.​3 Results With Attack in rounds multiples of 1018

7.​4 Results With Attack in Rounds Multiples of 2019

8 Discussion on the Results20

9 Conclusions and Future Work22

References23

Image Forgery Detection Using Comprint:​ A Comprehensive Study29

Hannes Mareen, Peter Lambert and Glenn Van Wallendael

1 Introduction29

2 State of the Art31

2.​1 Active Forgery Detection Methods31

2.​2 Passive Forgery Detection Methods32

3 Comprint35

3.​1 Fingerprint Extraction35

3.​2 Forgery Localization38

3.​3 Fusing Comprint and Noiseprint39

4 Evaluation39

4.​1 Measures40

4.​2 Artificial Dataset:​ Differences in JPEG Parameters41

4.​3 Realistic Datasets:​ Real and Manipulated Images44

5 Limitations47

6 Conclusion51

References52

Good or Evil:​ Generative Adversarial Networks in Digital Forensics55

Maryna Veksler and Kemal Akkaya

1 Introduction55

2 Background57

2.​1 Forensics vs Anti Forensics vs Counter-Anti Forensics57

2.​2 Generative Adversarial Networks58

2.​3 Methodology61

3 GAN-Based Anti-forensics62

3.​1 Image Manipulation Anti-forensics64

3.​2 Anti-forensics for Computer-Generated Images75

3.​3 GAN-Based Audio Anti-forensics77

3.​4 Advantages of GAN-Based Anti-forensics78

4 Overview of GAN Methods to Improve the Forensic Detectors79

4.​1 Strengthening Forensic Detectors to Identify Deep Fakes79

4.​2 Improving Signature Forensics Using GANs80

4.​3 Summary of GAN Usage to Improve the Detection of Forged and Synthetic Data82

5 Future Directions83

6 Conclusion85

References85

Refined GAN-Based Attack Against Image Splicing Detection and Localization Algorithms93

Shengbang Fang and Matthew C. Stamm

1 Introduction93

2 Related Work95

2.​1 Siamese Network Based Forensic Algorithms96

2.​2 Traditional Anti-Forensic Attacks96

2.​3 GAN-Based Approaches96

2.​4 Adversarial Example Attacks97

2.​5 Attacks Against Clustering and Contrastive Learning97

2.​6 Multi-Task Training Optimization98

3 Problem Formulation98

4 Proposed Method99

4.​1 Stage 1.​ Patch Sampling99

4.​2 Stage 2.​ Refinement100

5 Experimental Setup104

5.​1 Dataset104

5.​2 Training Methods105

5.​3 Evaluation Metrics105

6 Results107

6.​1 Overall Attack Performance107

6.​2 When Baseline Generative Attack Fails108

6.​3 Ablation Study109

7 Limitations115

7.​1 Improvement from Good Baseline Generative Attacked Images115

7.​2 Uncontrollable Localization Heatmap117

7.​3 Optimal Loss Weights and Learning Rates118

8 Conclusion119

References120

Generative Adversarial Networks for Artificial Satellite Image Creation and Manipulation125

Samaneh Ghelichkhani, Yousef Ahmed Mohammed Al-Dhameri Salem, Huseyn Salahov, Feras Ashor Ibrik Adam, Ahmad Jad Charbatji and Marwa Issam Abdulkareem

1 Introduction125

2 Relevant Work126

3 Datasets127

4 DNN Models129

4.​1 Pix2Pix for Season Transfer129

4.​2 CycleGAN for Land Cover Transfer132

4.​3 Splicing wiht iGPT135

4.​4 Splicing Using Vision Transformer138

5 Results141

6 Conclusion141

References141

Domain Specific Information Based Learning for Facial Image Forensics145

Chethana H. T., Trisiladevi C. Nagavi, P. Mahesha and S. G. Kruthika

1 Introduction145

2 Multimedia Forensics147

3 General Framework of Automated Forensic Face Recognition151

4 Related Work152

5 Challenges of Face Recognition for Forensics153

6 Motivation155

7 Datasets Used156

7.​1 Composite Sketch with Age Variations Dataset156

7.​2 E- PRIP Dataset156

7.​3 Disguised Faces in the Wild Dataset157

8 Metrics Used to Evaluate the Performance159

9 Applications160

10 Conclusion161

References161

Linguistic Steganography and Linguistic Steganalysis163

Hanzhou Wu, Tianyu Yang, Xiaoyan Zheng and Yurun Fang

1 Introduction163

2 Preliminaries165

2.​1 Mathematical Description of Linguistic Steganography165

2.​2 General Framework of Linguistic Steganalysis167

2.​3 Language Model168

2.​4 Evaluation Metrics169

3 Linguistic Steganography171

3.​1 Modification-Oriented Linguistic Steganography (ModLS)171

3.​2 Generation-Oriented Linguistic Steganography (GenLS)174

4 Linguistic Steganalysis178

4.​1 Conventional Linguistic Steganalysis179

4.​2 End-to-End Linguistic Steganalysis181

5 Challenges and Opportunities185

6 Conclusion186

References187

Random Deep Feature Selection’s Efficiency in Securing Image Manipulation Detectors Opposed by Adversarial Attacks191

Nada Jadalla, Nesrine Tamagoult Dit Mongar, Sana Sultan and Marwa Issam Abdulkareem

1 Introduction191

2 Proposed Method194

2.​1 RDFS Detection Considering FC Networks195

2.​2 RDFS Detection Considering SVM196

3 Different Implementations of Manipulation Detection196

3.​1 CNN Original Detectors197

3.​2 Minimizing Detectors198

3.​3 Adversarial Attacks198

4 Discussion and Experimental Findings199

4.​1 Experimental Design199

4.​2 Classification Based on FC Results201

4.​3 Classification Based on SVM Results202

5 Conclusion204

References205

Optimized Distribution for Robust Watermarking of Deep Neural Networks Through Fixed Embedding Weights207

Melisa Çevik, Ege Baran Çakan, Elin Su Sentürk, Utku Anil Çakmak and Marwa Issam Abdulkareem

1 Introduction207

2 DNN Watermarking History and Prior Art209

3 Notation, Watermarking Model and Requirements211

3.​1 Preliminaries211

3.​2 Watermark Specifications and Model212

4 Suggested DDN Watermarking Method213

4.​1 Reliable Watermarking Algorithm214

4.​2 Watermark Extraction219

5 Experimental Methodology220

5.​1 Host Networks and Tasks220

5.​2 Watermarking Algorithm Configuration221

5.​3 Setting for Robustness Analysis222

6 Findings and Analysis223

6.​1 Performance of Watermarked DNN Models223

6.​2 Robustness Assessment227

7 Conclusion Stage232

References234

Anti Forensic Measures and Their Impact on Forensic Investigations237

Lars Schmitt and Gökhan Kul

1 Introduction237

2 Factors of AFM Effectiveness239

2.​1 Problems Regarding the Effectiveness239

2.​2 Discussed Factors240

3 Anti Forensic Measures242

3.​1 Physical Destruction242

3.​2 Artifact Wiping245

3.​3 Disk Wiping246

3.​4 NSRL Scrubbing246

3.​5 MACE Scrambling247

3.​6 File Signature Scrambling247

3.​7 Registry Wiping248

3.​8 Log Manipulation248

3.​9 Defragmentation249

3.​10 Artifact Injection249

3.​11 File Compression249

3.​12 Forensic Tool Bug Exploitation250

3.​13 Compression Bombs250

3.​14 Loop References251

3.​15 Steganography251

3.​16 Data Hiding Techniques252

3.​17 Live Operating Systems252

3.​18 Virtual Machines253

3.​19 Non-standard Programs254

3.​20 Data Pooling254

3.​21 Non-standard RAIDs254

3.​22 Dummy Drives255

3.​23 Full Disk/​Drive, and File Encryption255

3.​24 Encrypted Containers256

3.​25 File Encryption256

3.​26 Hash Collisions257

3.​27 Media Integrity Obfuscation258

4 Conclusion259

References260

Using Vocoder Artifacts For Audio Deepfakes Detection263

Chengzhe Sun, Ehab AlBadawy, Timothy F Davison, Sarah R Robinson, Ming-Ching Chang and Siwei Lyu

1 Introduction263

2 Related Works on Audio Deepfake266

2.​1 Human Voice Synthesis266

2.​2 Neural Vocoders267

2.​3 Autoregressive Models269

2.​4 Diffusion Based Models269

2.​5 GAN Based Models270

2.​6 Synthetic Audio Detection270

3 Vocoder Detection271

3.​1 Speaker Verification Based Rawnet2271

3.​2 Vocoder Identification Based Rawnet2272

4 The LibriVoc Datasets273

4.​1 Librivoc High-Level Overview274

4.​2 Training Process274

4.​3 Train/​Dev/​Test Split Configuration275

5 Evaluation Results275

5.​1 Synthesized Audio Detection275

5.​2 Classification of Neural Vocoder Artifacts277

5.​3 Leave N Out Cross-Validation278

5.​4 Robustness and Ablation Studies279

6 Conclusion280

References281

Index283

About the Author

Ehsan Nowroozi

A photo of Ehsan Nowroozi.

is a Senior Lecturer (Associate Professor) at Ravensbourne University London, Department of Business and Computing, London, UK. He received his doctorate from Siena University in 2020. He is a highly skilled researcher in the field of artificial intelligence for cybersecurity that addresses areas such as adversarial machine learning (Adv-ML), adversarial multimedia forensics (Adv-MF), network security, and digital forensics (DF). To makes AI systems more secure and resilient, Ehsan’s work emphasizes determining and defending against adversarial threats. His research has had a significant impact on the development of AI-cyber and the ability to defend against cyber threats. He had four postdocs in different high-prestige universities, including a Research Fellow at the Centre for Secure Information Technologies (CSIT) at Queen’s University Belfast in the United Kingdom, a Research Fellow at the Security and Privacy Research Group (SPRITZ) at the University of Padua in Italy, a Research Fellow at the Visual Information Processing and Protection (VIPP) at the University of Siena in Italy, a Research Fellow at the Sabanci University in Turkey. He was also an assistant professor at Bahcesehir University, Istanbul, Turkey. He has worked on a variety of projects funded by renowned institutions, such as DARPA, the Air Force Research Laboratory (AFRL) of the U.S. government, the Italian Ministry of University and Research (MUR), and THALES United Kingdom. He serves as a reviewer for prominent journals, such as IEEE TNSM, IEEE TIFS, and IEEE TNNLS. In addition, he has been a senior member of the Institute of Electrical and Electronics Engineers (IEEE) since 2022 and an ACM Professional member since 2023.

Kassem Kallas

A photo of Kassem Kallas.

is a Senior Scientist specializing in Machine Learning and Artificial Intelligence with a particular focus on cybersecurity. He earned his PhD in Information Engineering and Sciences in the field of cybersecurity from the University of Siena in 2017, securing the third place in the Springer Best-of-the-Best PhD Thesis Award. His educational journey includes BSc and MSc degrees in Telecom Engineering and Computer and Communication Engineering from the Lebanese International University in 2010 and 2012, respectively. Additionally, he obtained a second level specialized master in Wireless Systems and Related Technologies from Politenico di Torino in 2013. He participated in diverse research projects funded by prestigious institutions such as DARPA, the U.S. Air Force Research Laboratory, the Italian Ministry of University and Research, and the French National Research Agency. He worked at different national institutes, including the National Institute of Standards and Technology (NIST), USA, focusing on AI for wireless systems, and the French National Institute for Research in Digital Science and Technology (INRIA), where he worked on advancing AI Security for defense applications. In industrial settings, he served as an R&D scientist and AI consultant for various Italian companies. Currently, he holds the position of Senior Scientist at the French National Institute of Health and Medical Research, with a dedicated focus on AI security for medical applications. He is the recipient of the Best Paper Award at the Ninth International Conference on Advances in Multimedia (MMEDIA) in 2017, and the top $$3\%$$ paper award at the 2023 International Conference on Acoustics, Speech, and Signal Processing (ICASSP) in Rhodes Island, Greece. He is also an author of the book “Information Fusion in Distributed Sensor Networks with Byzantines,” published by Springer Signals and Communication Technology, and served as the editor for the book “Adversarial Multimedia Forensics,” published by Springer in Advances in Information Security. He holds a senior membership in IEEE and actively engages in various professional communities, including IEEE Young Professionals, Entrepreneurship Exchange Community, Computer Society Technical Community on Cyber Security, Computer Society Technical Community on Security and Privacy, Signal Processing Society, the European Association for Signal Processing (EURASIP), Association for Computing Machinery (ACM), and Asia-Pacific Signal and Information Processing Association (APSIPA).

He also participated in the ITU AI/ML in 5G 2020 Challenge and proposed an AI-based solution to the problem statement “Beam-Selection in Millimeter-Wave MIMO Systems.” His research interests include game-theoretic concepts for adversarial signal processing, pattern recognition, and image processing for anti-counterfeiting applications, and machine learning security threats and defenses. In his spare time, Dr. Kallas volunteers as a mentor at IEEE Collabortec. He is also pursuing an Executive Master of Business Administration (E-MBA) in Strategic Leadership at Valar Institute at Quantic School of Business and Technology to further enhance his expertise in the field of business.

Alireza Jolfaei

A photo of Alireza Jolfaei.

is an Associate Professor of Cybersecurity and Networking in the College of Science and Engineering at Flinders University. He is a Senior Member of the IEEE and a Distinguished Speaker of the ACM on the topic of Cybersecurity. He has previously been a faculty member with Macquarie University and Federation University in Australia, and Temple University in the USA. He received a Ph.D. degree in Applied Cryptography from Griffith University, Gold Coast, Australia. His main research interest is in Cyber-Physical Systems Security, where he investigates the hidden interdependencies in industrial communication protocols and aims to provide fundamentally new methods for security-aware modelling, analysis and design of safety-critical cyber-physical systems in the presence of cyber-adversaries. He has been a chief investigator of several internal and external grants with a total amount exceeding $2,6 million. He successfully supervised eight HDR students to completion. He received the prestigious IEEE Australian Council award for his research paper published in the IEEE Transactions on Information Forensics and Security. Dr. Jolfaei is the Chair of the Security and Privacy Technical Committee of the IEEE Consumer Technology Society and the Editor-in-Chief of the IEEE Consumer Technology Society’s World Newsletter. He has served as the IEEE Australia Chair of the IEEE Technology and Engineering Management Society for Membership Development and Activities, as the Secretary of the IEEE NSW Joint Chapter on Consumer Technology, Broadcast Technology, and Product Safety Engineering, as the Chairman of the Computational Intelligence Society in the IEEE Victoria Section, and also as the Chairman of Professional and Career Activities for the IEEE Queensland Section. He was the founder and councilor of the IEEE Student Branch at Federation University and also contributed to the foundation of the IEEE Northern Territory Subsection. He has served as the associate editor of several IEEE journals and transactions, including the IEEE Transactions on Consumer Technology and IEEE IoT Journal. He has served as a Program Co-Chair and a Technical Program Committee member for major conferences, including IEEE ICCCN.

© The Author(s), under exclusive license to Springer Nature Switzerland AG 2024

E. Nowroozi et al. (eds.)Adversarial Multimedia ForensicsAdvances in Information Security104https://doi.org/10.1007/978-3-031-49803-9_1

Model Poisoning Attack Against Federated Learning with Adaptive Aggregation

Seyedsina Nabavirazavi1  , Rahim Taheri2  , Mani Ghahremani2   and Sundararaja Sitharama Iyengar1  

(1)

School of Computing and Information Sciences, Florida International University, Miami, FL, USA

(2)

School of Computing, University of Portsmouth, Portsmouth, UK

Seyedsina Nabavirazavi

Email: snabavir@fiu.edu

Rahim Taheri (Corresponding author)

Email: rahim.taheri@port.ac.uk

Mani Ghahremani

Email: mani.ghahremani@port.ac.uk

Sundararaja Sitharama Iyengar

Email: iyengar@cs.fiu.edu

Keywords

Federated learningModel poisoning attackAdaptive aggregationRobustnessAdversarial attackImage classification

1 Introduction

Federated Learning (FL) stands at the forefront of decentralized machine learning, providing an innovative framework for collaborative model development while safeguarding data privacy and decentralization. In today’s machine learning landscape, data is often distributed across numerous devices or servers, creating challenges that stem from privacy concerns, security constraints, and communication limitations. FL emerges as a solution to these complexities by ensuring data remains on local devices, never directly exposed to central servers or other participants. Instead of transmitting raw data, FL selectively shares model updates or gradients with a central server, thereby preserving individual data privacy.

The advantages of FL are multifaceted. It offers robust privacy protection, reduces the communication overhead inherent in centralized approaches, and empowers the training of models on a diverse array of data sources, leading to more resilient and generalizable models. Its applications span across various domains: from enhancing mobile applications without compromising user data privacy, to facilitating knowledge sharing among healthcare providers while preserving patient data confidentiality, to optimizing Internet of Things (IoT) devices’ machine learning capabilities.

While FL’s merits are evident, it is essential to recognize that as it gains momentum and sees real-world deployment, a comprehensive assessment of its security aspects becomes paramount. This chapter delves into a critical security concern within FL, focusing on model poisoning attacks, and, more specifically, investigates how these attacks impact adaptive aggregation methods. Although FL excels in privacy preservation and efficient communication, it is not invulnerable to security vulnerabilities. A prominent threat that looms over FL is the model poisoning attack—a form of adversarial manipulation aimed at injecting malicious updates into the training process. These attacks intend to subvert the integrity and performance of the learned global model. They exploit FL’s decentralized nature, where clients autonomously train local models on their respective datasets and contribute updates to the central server. These vulnerabilities underscore the pressing need to evaluate FL’s resilience against adversarial attacks and to devise countermeasures that can bolster its security posture.

As the field of FL advances, adaptive aggregation methods have emerged as a promising avenue for enhancing convergence and performance. Techniques such as FEDADAGRAD, FEDYOGI, and FEDADAM introduce adaptivity to optimize the model aggregation process, resulting in improved convergence rates and enhanced robustness. However, the intricate interplay between adaptive aggregation and adversarial attacks remains largely unexplored. This chapter aims to bridge this gap by investigating the vulnerability of adaptive federated aggregation methods to model poisoning attacks. Through comprehensive empirical evaluations on image datasets, our objective is to shed light on the susceptibility of these state-of-the-art algorithms to adversarial manipulation.

In light of the aforementioned context, this chapter endeavors to achieve several key objectives:

Assess the vulnerability of adaptive federated aggregation methods (e.g., FEDADAGRAD, FEDYOGI, and FEDADAM) to model poisoning attacks.

Conduct empirical evaluations on image datasets to unveil vulnerabilities and gauge the impact of adversarial manipulation.

Offer insights into the complex dynamics between adaptive aggregation and adversarial attacks, enhancing our understanding of FL security.

Emphasize the importance of robust defense mechanisms to bolster FL’s security and promote the adoption of secure and reliable decentralized machine learning practices.

In the forthcoming sections, we delve into the related works,methodology, experimental setup, results, and discussions, all of which contribute to a comprehensive assessment of the security landscape within federated learning, particularly when adaptive aggregation methods are considered in the presence of adversarial model poisoning attacks.

2 Related Work

Previous research related to the chapter can be categorized into three main areas: federated learning in image classification, poisoning attacks in federated learning, and adaptive aggregation in federated learning.

2.1 Federated Learning in Image Classification

FL applications in the field of image classification are diverse and impactful, especially given the sensitive nature of medical data. A generic framework that has made substantial contributions to this area is FedCV. Developed by He et al., FedCV serves as a comprehensive library and benchmarking framework designed for computer vision tasks, including image classification. It provides various FL algorithms and addresses challenges such as non-IID (Independent and Identically Distributed) data and system efficiency [16]. Following FedCV, Liu et al. developed FedVision, an early practical application of FL in computer vision. FedVision focuses on object detection and has been utilized in smart city applications to improve efficiency and reduce costs [26]. Jallepalli et al. further extend FL applications to the automotive industry by applying it in autonomous driving systems for object detection, achieving competitive results while ensuring data privacy [19].

FL has been used extensively when it comes to the classification of medical images. Yan et al. introduced a self-supervised FL framework that leverages Transformer-based pre-training and masked image modeling for a variety of medical imaging tasks, including retinal and chest X-ray classifications [51]. Another work by Feki et al. addresses the COVID-19 pandemic by proposing a collaborative FL framework to diagnose COVID-19 from chest X-ray images. The framework accommodates non-IID and unbalanced data distributions [12]. Yan et al. also proposed the use of FL for COVID-19 data training and compared different neural architectures, such as MobileNet and ResNet18, finding that FL shows promise in improving model accuracy while preserving data privacy [50]. Prior to the COVID era, Gu et al. discussed FL in multi-site fMRI classification and emphasized the importance of privacy-preserving strategies like differential privacy [15]. Another application by Feng et al. explores FL for the reconstruction of MR images, using a domain-specific approach to preserve specificity [13].

In terms of human-machine interaction, Shome et al. introduced FedAffect, a FL-based framework designed for facial expression recognition. This framework utilizes both labeled and unlabeled data to improve the robustness and diversity of face representations [39]. Recent advancements in FL have also addressed specific challenges in the domain of facial recognition and pain estimation. For example, Niu et al. introduce FedGC to tackle FL for face recognition with greater privacy considerations [33]. Meng et al. propose PrivacyFace, a framework that improves FL in face recognition by sharing auxiliary and privacy-agnostic information among clients [29]. Rudovic et al. offer a Personalized Federated Deep Learning approach for pain estimation from face images, aiming to improve data privacy and reduce the burden on nursing staff [37]. These contributions collectively highlight the promise and challenges of employing FL in diverse application scenarios.

2.2 Poisoning Attacks in Federated Learning

Poisoning attacks were introduced prior to FL, with the first known instance being a data poisoning attack against an SVM by Biggio et al. [3]. This pioneering work was later extended to distributed environments, including FL, by Li et al. [25], leading to the identification of two main types of poisoning attacks: Data Poisoning and Model Poisoning [56]. In Data Poisoning, the attacker corrupts or alters data labels, while Model Poisoning, as described by Yu and Cui [56], focuses on local model updates or inserting backdoors into the global model. Poisoning attacks in FL can also be categorized as targeted or untargeted [10]. Targeted attacks aim at a specific goal, such as causing the global model to misclassify a certain class of inputs as a certain label. On the other hand, untargeted attacks aim for general disruption, such as causing the global model to diverge or preventing it from converging to a high-accuracy model. Xia et al. [48] introduce an in-between classification of semi-targeted, where the attacker is given a specific class and aims to manipulate the global model in such a way that instances belonging to this class are misclassified as something other than what they truly are. Alternative definitions include clean label and dirty label poisoning [6, 38], closely aligning with the concepts of targeted and untargeted attacks.

The emergence of poisoning attacks requires robust defense strategies. These strategies are broadly categorized into three main groups: model analysis, byzantine robustness aggregation, and verification-based approaches [48]. Specific efforts in this direction include Zhilin et al.’s survey, which concentrated on defense strategies against model poisoning attacks, distinguishing between evaluation methods for local updates and aggregation methods for the global model [46]. Lingjuan et al. explored poisoning attacks and defenses from the perspective of privacy and robustness aggregation [27]. Meanwhile, mechanisms such as the Two-phase Defense Against Poisoning Attacks (DPA-FL) [23], and CONTRA which is a scheme that reduces attack success rate and global model degradation [1], have been proposed to counter these threats. Furthermore, a review by Yang et al. highlights the role of encryption methods such as homomorphic encryption and secure aggregation in enhancing privacy protection within FL [54]. Although certain works such as those of Gosselin et al. provided an enumeration of security issues in FL, including poisoning attacks, they emphasized the need for deeper exploration in defense strategies [14].

Next, we will discuss some notable types of untargeted poisoning attacks in FL, focusing on data poisoning (DP) and model poisoning (MP) techniques. Data poisoning can be divided into clean label attacks, where the attacker subtly alters the training data, and dirty label attacks, where both the features and the labels are manipulated, a strategy commonly referred to as “label-flipping” [60]. A common example of a dirty label attack is to change some training examples’ labels to incorrect values [44]. One untargeted model poisoning (MP) technique involves using fake clients to add noise to the global model, as demonstrated in [17], is an attack that leverages differential noise to subtly manipulate the model in a way that is stealthy and persists over time. Similarly, [4] utilizes fake clients to send malicious local model updates, effectively lowering the global model’s accuracy. Moreover, Yang et al. introduced the Model Shuffle Attack (MSA) for differential privacy-based federated learning, shuffling and scaling model parameters in specific layers, further disguising the attack by using parameter clipping [8]. These attacks, despite their variety, underscore the complexity of defending against untargeted poisoning attacks in FL and emphasize the ongoing need for robust defenses.

Lastly, we will present and discuss a few examples of targeted and semi-targeted poisoning attacks designed to manipulate the global model’s performance on a specific class without affecting other classes. For example, backdoor attacks, such as those documented by Mothukuri et al. [30], involve injecting a malicious model into the existing model while retaining accuracy on unrelated tasks. Other examples include FedRecAttack, a model poisoning attack on federated recommendation [36], and PoisonGAN, a generative poisoning method against edge computing systems [58]. Targeted attacks may also exhibit semi-targeted characteristics, such as in the work of Zhang et al. [57]. In contrast, semi-targeted attacks allow for broader manipulation, enabling the attacker to compromise machine learning models to perform undesired behaviors across various classes. Notable examples include the Attacking Distance-aware Attack (ADA) proposed by Sun et al. [42], which enhances poisoning attacks by optimizing the target class in the feature space. Additionally, semi-targeted backdoor attacks, as explored by Sun et al. [41] and Bagdasaryan et al. [2], can reduce performance on targeted tasks while maintaining overall functionality. Collectively, these attacks reveal the intricacy and evolving threat landscape of poisoning attacks in FL, underscoring the importance of developing robust defenses.

2.3 Adaptive Aggregation in Federated Learning

Adaptive Aggregation can be defined as techniques that dynamically adjust the weights of the model updates in a way that improves the accuracy of the FL model. But also the term can be defined scalable, fault-tolerant, and cost-effective architectures or approaches to aggregation in FL. Adaptive aggregation can be used to address a number of challenges in federated learning, such as non-IID (Independent and Identically Distributed) data, client heterogeneity, and stragglers (where the slowest nodes can limit the overall training speed). There are a number of different adaptive aggregation algorithms and architectures that have been proposed which we will review in this section.

A key challenge in FL is the data heterogeneity that impairs the generalization of the global model. Therefore, adaptive aggregation strategies are increasingly focusing on addressing challenges related to heterogeneity and efficiency, especially within diverse and complex environments such as mobile devices and IoT. Ek et al. [9] introduced FedDist, an innovative FL aggregation method that modifies model architecture by detecting dissimilarities between clients, thereby enhancing personalization without compromising generalization. Moving towards efficiency in convergence and computation, [7] proposed FedHQ, which accelerates convergence in FL by computing and leveraging instantaneous quantization errors, and assigns aggregation weights based on the heterogeneity of quantization errors, thus optimizing communication efficiency. Similarly, [32] presented FedCS to mitigate inefficiencies with heterogeneous clients in Mobile Edge Computing, demonstrating reduced training times. In the context of IoT scenarios, [40] proposed an architecture that integrates Digital Twin technology and Deep Q Network to adaptively adjust aggregation frequency in industrial IoT, effectively navigating the environment’s heterogeneity. Zhang et al. [59] addressed statistical heterogeneity in FL with FedALA, which adaptively aggregates global and local models, improving test accuracy. These adaptive aggregation techniques reflect significant progress in efficiently managing data scale, computing capabilities, communication channels, and the unique challenges of heterogeneous IoT landscapes, including promising advancements in domains like Human Activity Recognition with smartphones as emphasized by Ek et al. [9].

Non-IID data is a specific aspect of data heterogeneity, often referring to situations where data on different clients may follow disparate distributions. Challenges with non-IID data, particularly cluster-skewed data, can cause the global model to converge to an over-fitted solution, as demonstrated by the novel federated learning model FedDRL, proposed by Nguyen et al. [31]. This model leverages deep reinforcement learning to dynamically determine each client’s impact factor in the aggregation process, improving upon existing methods such as FedAvg. Similar in aim, Khan et al. introduced two adaptive aggregation methods specifically designed to handle both IID and non-IID data, namely Similarity Weighted Aggregation (SimAgg) and Regularized Aggregation (RegAgg), which focus on client selection and weight aggregation [22]. The approach also extends to a differential privacy federated deep learning framework for medical image segmentation, providing an additional layer of privacy preservation. Addressing the issue of non-IID data, [45] proposed a new model aggregation method called weighted clustered federated learning (CFL). The method clusters participating edge devices based on the cosine similarity of their local gradients, improving the convergence rate and learning accuracy in scenarios with imbalanced data. These strategies collectively offer innovative solutions to the complexities of non-IID data, significantly advancing the performance and stability of federated learning models across various domains and applications.

FL has seen significant advancements in addressing challenges related to efficiency, convergence, energy consumption, and robustness in the face of non-IID data and unstable networks. FedAvg [28], although a standard in non-convex FL, faces issues like slow convergence and network bottleneck latency, prompting the introduction of adaptive partial gradient aggregation (FedPGA) by Jiang and Hu [21], a decentralized architecture that enhances convergence. To further contribute to efficiency and robust communication, [5] developed the EA-ALA algorithm, and [34] proposed federated particle swarm optimization (FedPSO), respectively. Energy optimization is tackled by Yang et al. [52] by proposing an iterative algorithm that optimizes energy consumption under latency constraints, while [43] addresses security and scalability with LEGATO. These methods are complemented by the layer-wise adaptive model aggregation scheme, FedLAMA, proposed by Lee et al. [24]. Employing a unique layer-wise prioritization method, FedLAMA offers dynamic control over the aggregation interval for individual layers, reducing communication costs by up to 60% for Independent and Identically Distributed (IID) data and 70% for non-IID data, without significant compromise in model accuracy. It presents a novel method for balancing model discrepancy against communication cost, demonstrating robustness and efficiency in handling data heterogeneity and increasing the scalability of Federated Learning. These collective advancements reflect the diverse and evolving landscape of FL, highlighting innovative strategies to navigate complex and heterogeneous data environments, and confirming the potential of these approaches in providing scalable and accurate Federated Learning solutions.

Another avenue of research in the area of FL has been devoted to developing architectures that enhance scalability, parallelization, efficiency, and adaptability to various environments. AdaFed, presented in [20], introduces a scalable architecture that employs serverless functions to enable parallelization and tree-based aggregation, thus handling participant variations efficiently and minimizing resources and costs. Wu et al. further expand on hierarchical federated learning by introducing HiFL in [47], a system that strategically combines both synchronous client-edge and asynchronous edge-cloud model aggregation, offering an adaptive solution to control the staleness threshold. Hu et al. in [18] propose Spread, a tiered architecture that offloads model aggregation to edge devices, leading to a remarkable speedup in model training compared to existing FL systems. Ye et al. [55] presents Eco-FL, an Edge Collaborative pipeline-based Federated Learning framework specifically designed for IoT devices, employing adaptive workload migration and client grouping strategies to enable efficient local training acceleration. Together, these approaches along many others represent the cutting-edge of parallelization, scalability, and efficiency in federated learning, contributing unique solutions to the multifaceted challenges of distributed learning environments.

3 Background and Problem Definition

Despite its promise, FL is not immune to security threats, especially model poisoning attacks. This type of attack poses a significant challenge to FL systems, as malicious clients can manipulate the global model’s convergence and performance.

In this chapter, we delve into the realm of model poisoning attacks against FL systems, specifically focusing on their impact in the context of adaptive aggregation functions. Aggregation functions play a crucial role in FL, as they are responsible for aggregating local model updates from participating clients to update the global model. Adaptive aggregation functions, in particular, dynamically adjust their behavior based on the characteristics of the clients’ data and the training process. The central problem addressed in this chapter revolves around understanding the vulnerability of FL systems employing aggregation functions to model poisoning attacks. We aim to investigate how such attacks affect the convergence behavior, accuracy, and overall performance of FL under different scenarios and attack intensities. Specifically, we explore the behavior of adaptive aggregation functions, such as FedYogi, Adagrad, and FedAdam, in the presence of model poisoning attacks executed at varying rounds of the training process and compare it with traditional averaging aggregation.

To achieve this, we design a comprehensive experimental framework that simulates realistic FL scenarios with varying levels of adversarial attacks. We consider the Fashion-MNIST dataset as a representative case study and employ adaptive aggregation functions commonly used in FL implementations. Through extensive experimentation, we analyze the impact of model poisoning attacks on FL accuracy, convergence, precision, and recall across different aggregation functions and attack rounds. By investigating these aspects, we aim to contribute to the understanding of the robustness of adaptive aggregation-based FL systems against model poisoning attacks. The insights gained from this study can guide researchers and practitioners in developing more resilient and secure FL solutions in real-world applications.

The ultimate goal of model poisoning attacks in federated systems is usually to deviate the global model towards an attainable target (targeted attacks) or towards the opposite of the desired direction (untargeted attacks). Fang et al. [11] formulate the general untargeted model poisoning attack as an optimization problem, where the adversary maximizes a deviation factor without being exposed to the aggregation rule. There is a trade-off, for example, between the deviation factor and being neglected by the trimmed mean aggregation rule. The adversary works out the trade-off during the federated rounds based on prior knowledge about the local and global parameters. However, we assume in this work that the primary goal of the adversary is to remain undetected. More formally, we employ an attack where the output of the local poisoned model is exactly the same as the before-attack local model of a compromised client. In such a scenario, a server with a synthesized validation set cannot detect the compromised clients. Given the emphasis on stealthiness, the attack is designed to gradually deviate the global model over successive attack rounds, as opposed to causing an abrupt performance decline in the global model. Furthermore, our adversary does not require any knowledge about the prior local models, training data, and no communication between the compromised clients is necessary. The threat model assumes the federated system employs averaging aggregation, either adaptive or non-adaptive.

In the subsequent sections, we present the methodology, experimental setup, results, and discussions based on our investigation of model poisoning attacks against FL systems with adaptive aggregation functions.

4 Stealthy Model Poisoning Attack (MSA)

In this section, we explain a novel model poisoning attack called MSA, designed to compromise the integrity of FL systems and presented in [53]. MSA exploits the privacy mechanisms typically present in FL, making it a stealthy and potent attack. The core concept behind MSA is to manipulate the parameters of the malicious model in a way that maximizes its performance on the test set while undermining the global model’s performance during aggregation. The attack consists of two main steps including shuffling and scaling. In the shuffling step, the attacker rearranges the order of parameters within specific layers of the malicious model. This operation perturbs the parameter arrangement, introducing a subtle change that is not immediately apparent when analyzing the model. The scaling step involves adjusting the magnitudes of model parameters. To maintain the similarity between the parameter distribution of the malicious model and the benign model, the attacker employs a careful scaling strategy. This involves scaling up some parameters while scaling down others, effectively balancing the perturbation to evade detection.

As an example, consider the neural network in Fig. 1 which has two convolutional layers, two max-pooling layers, and two fully-connected layers. To achieve equivalent output in the shuffled model, controlled shuffling of convolutional and fully connected layers is necessary. Shuffling involves rearranging kernels and biases while retaining consistent output. Imagine the first convolutional layer has k kernels. Initially, kernel weights and biases in the first convolutional layer are shuffled arbitrarily along with their biases. The next convolutional layer has $$n*k$$ kernels with $$n=2, k=4$$ in our example. We divide the kernels into n groups and duplicate the shuffling pattern of layer 1 for each kernel group. Notably, bias shuffling is omitted in the second convolutional layer to ensure output consistency. For shuffling the fully connected layers, we swap the first layer’s weight matrix rows arbitrarily along with the biases. We shuffle the next layer with the previous pattern but we swap the columns of the weight matrix instead of the rows.For instance, if rows 1 and 2 are swapped in the first layer, columns 1 and 2 are interchanged in the second layer. Bias shuffling is omitted in the second fully connected layer as well.

An illustration denotes a workflow going through the layers of convolution 1, max pooling 1, convolution 2, max pooling 2, fully-connected 1, and fully-connected 2.

Fig. 1

Local model architecture for shuffling and scaling

In the subsequent phase known as scaling within the poisoning attack, there is a unique approach. For successive pairs of convolutional layers, a vector $$\alpha $$ acts as a set of scaling factors, aligning with the kernel count in the initial layer ($$k=4$$ in this context). Applying $$\alpha $$ to Conv.1 kernels and $$\frac {1}{\alpha }$$ to each kernel group in Conv.2 sustains output consistency. Moreover, employing vectors $$\beta $$ and their reciprocals in fully connected layers maintains equivalent output.

It is imperative to highlight that the procedures of scaling and shuffling can be executed independently and applied exclusively to either the convolutional or fully connected layers. This approach remains effective for any CNN architecture featuring an even number of convolutional and fully connected layers.

The key advantage of MSA lies in its unique blend of operations, which enables the malicious model to blend in with the benign models. When treated as black boxes, the malicious models exhibit similar behavior to the benign models on the test set, making them exceptionally difficult to identify. Additionally, MSA is engineered to evade robust aggregation rules, such as Krum and Trimmed Mean, which are designed to identify and exclude outlier models. By adjusting the privacy budget, MSA ensures that the noise added to the malicious model is smaller than that added to the benign model. This results in Euclidean distances between malicious and benign models that are comparable to those between benign models, enabling malicious models to remain hidden within the aggregation. It is crucial to emphasize that the outcome produced by the compromised local model remains indistinguishable from that of the benign model during evaluation, particularly when dropout mechanisms are deactivated.

The Model Poisoning Attack (MSA) applied in this chapter demonstrates the potential vulnerabilities of FL systems. Its distinctive approach of shuffling and scaling operations enhances its stealthiness and adaptability, posing a significant challenge to the detection of malicious models. This emphasizes the need for robust defense mechanisms to safeguard the security and integrity of FL in the face of advanced attacks like MSA.

5 Adaptive Federated Optimization

Traditional federated optimization methods, such as Federated Averaging (FEDAVG), while effective, have been found to exhibit convergence challenges in certain scenarios. To address this, the concept of Adaptive Federated Aggregation has gained traction [35]. Adaptive federated aggregation leverages the principles of adaptive optimization techniques, like ADAGRAD, ADAM, and YOGI, to dynamically adjust the aggregation process during model updates. This approach capitalizes on the insights of adaptive optimization, which have demonstrated success in enhancing convergence rates and handling challenging optimization landscapes. By integrating adaptivity into the aggregation step, federated learning systems can potentially achieve improved convergence behavior and enhanced performance across diverse and non-convex optimization settings. All three methods introduce a term $$v_t$$ which controls the learning rate during aggregation.

where $$\tau $$ is the degree of adaptivity, $$\eta $$ is the learning rate, $$x_t$$ is the global parameters in iteration t and m is calculated from the local updates and the decay parameters ($$\beta _1$$, $$\beta _2$$).

FEDADAGRAD

is a variant of the adaptive federated aggregation framework that combines the power of adaptive optimization methods with federated learning. In FEDADAGRAD, the server performs adaptive gradient-based updates using the ADAGRAD algorithm, while individual clients employ Stochastic Gradient Descent (SGD) for local training. This enables the server to dynamically adjust learning rates based on historical gradient information, thereby adapting to the varying characteristics of each client’s data distribution. The adaptive nature of FEDADAGRAD allows it to navigate complex optimization surfaces more effectively, potentially leading to enhanced convergence rates and improved model quality.

FEDYOGI

is another embodiment of the adaptive federated aggregation concept, employing the YOGI optimization algorithm for server-side updates. YOGI extends upon the principles of the popular ADAM optimizer, incorporating techniques to enhance its convergence behavior. In FEDYOGI, the server utilizes YOGI to adaptively aggregate client updates, while clients engage in local SGD. By integrating YOGI’s adaptive learning rate mechanisms into federated learning, FEDYOGI aims to overcome challenges posed by non-convex optimization landscapes and client heterogeneity. This approach demonstrates the potential for faster convergence and improved communication efficiency in federated settings.

FEDADAM

represents an adaptive federated aggregation approach that leverages the ADAM optimization algorithm for server updates. ADAM’s adaptive learning rate and momentum mechanisms are harnessed to adjust the aggregation process during federated model training. In FEDADAM, the server computes aggregated updates using ADAM, while clients perform local SGD iterations. This combination seeks to exploit the strengths of both adaptive optimization and federated learning, potentially mitigating convergence issues and facilitating efficient coordination among distributed clients. FEDADAM underscores the significance of adaptivity in enhancing the robustness and efficiency of federated optimization.

Incorporating these adaptive federated aggregation methods into the federated learning framework presents an exciting avenue for addressing challenges related to convergence, client heterogeneity, and communication efficiency. These approaches hold promise for advancing the state of the art in federated optimization and enabling more effective and scalable collaborative machine learning across decentralized environments.

6 Evaluation

In this section, we outline the evaluation requirements employed to evaluate the performance of various aggregation strategies on the Fashion-MNIST dataset. We discuss the parameter and system settings, test metrics, and dataset used in the experiments.

6.1 Simulation Setup

In this chapter, we exclusively focus on the Fashion-MNIST dataset for our experimentation. To facilitate comparison and assess their viability, we have implemented four distinct aggregation strategies, including the Krum aggregation rule. Each participating client undertakes the training of an individual convolutional neural network on a unique subset of the Fashion-MNIST dataset.

The orchestration of the learning process is initiated and managed by a central server. In each round of training, the server gathers the locally trained model parameters from the participating clients and aggregates these parameters. Subsequently, the server communicates the updated global model parameters back to the clients.

It is essential to underline that compromised clients do not need the capability to record their local model parameters during any given round. No coordination is requisite among compromised clients. Each compromised client autonomously executes the poisoning attack during the predetermined attack rounds and subsequently communicates the poisoned parameters to the server.

6.2 Parameter and System Setting

In this sub-section, we describe the parameters used in FL scenarios in this chapter.

First, we have the following considerations for our testbed.

number of compromised clients (c) = 8

number of benign clients (m) = 20

the server knows the maximum number of compromised clients (c).

The best performance was achieved with the following decay parameters.

FEDADAGRAD:

global learning rate: $$\eta = 10^{-1}$$

local learning rate: $$\eta _l = 10^{-1}$$

degree of adaptivity: $$\tau = 10^{-9}$$

decay parameters: $$\beta _1 = \beta _2 = 0$$

FEDYOGI:

global learning rate: $$\eta = 10^{-2}$$

local learning rate: $$\eta _l = 0.0316$$

degree of adaptivity: $$\tau = 10^{-3}$$

decay parameters: $$\beta _1 = 0.9, \beta _2 = 0.99$$

FEDADAM:

global learning rate: $$\eta = 10^{-1}$$

local learning rate: $$\eta _l =10^{-1}$$

degree of adaptivity: $$\tau = 10^{-9}$$

decay parameters: $$\beta _1 = 0.9, \beta _2 = 0.55$$

Throughout our simulation, we conduct a comprehensive performance analysis that contrasts the efficiency of federated averaging with the MSA attack, both in the presence and absence of adaptive techniques. Importantly, we ensured that the number of compromised clients did not exceed the number of normal clients in the network. Additionally, due to the characteristics of our dataset (Fashion-MNIST) comprising 60,000 samples, and the requirement for each client to possess a unique subset of the dataset, we maintained a fixed number of clients at 10.

6.3 Test Metrics

In this chapter, we utilize various machine learning metrics to assess and compare the outcomes of our models. These metrics provide valuable insights into the performance and effectiveness of the classification methods employed. The following metrics are employed:

Accuracy: This metric is widely employed to evaluate the classification model’s performance. Accuracy gauges the ratio of correct predictions made by the model to the total number of predictions.

Loss: The loss metric quantifies the disparity between the model’s predicted values and the true values of the target variable. It serves as a measure of the model’s predictive error.

Precision: Precision is a crucial metric that measures the fraction of accurately predicted positive instances out of all instances predicted as positive by the model. High precision indicates a low rate of false positives.

Recall: Also referred to as Sensitivity or True Positive Rate (TPR), recall calculates the proportion of positive instances correctly identified by the model among all actual positive instances.

These metrics collectively provide a comprehensive understanding of the model’s classification performance, predictive accuracy, and ability to discern positive instances. By evaluating and contrasting these metrics, we can gain valuable insights into the strengths and weaknesses of different classification approaches.

6.4 Dataset

The experiments conducted in this chapter utilize the Fashion-MNIST [49] dataset. This dataset holds prominence in the realm of machine learning and computer vision. It serves as a replacement for the conventional MNIST dataset, renowned for its collection of handwritten digits ranging from 0 to 9. Zalando Research introduced the Fashion-MNIST dataset with the intention of establishing a benchmark for image classification tasks, particularly emphasizing fashion items. Comprising a total of 70,000 grayscale images of fashion products, the dataset is categorized into ten classes, each denoting distinct types of clothing or accessories. The dataset is bifurcated into two subsets: a training set containing 60,000 images and a test set encompassing 10,000 images. Every image conforms to a 28 times 28 grayscale format, bearing semblance to the original source images in terms of dimensions.

7 Experimental Results

In this section, we examine the results related to various scenarios. Overall, all the results pertain to 100 rounds of FL, and whenever we discuss attacks, we refer to the attacks introduced in the previous sections. The initial scenario involves employing FL in a setting with no attackers. In subsequent scenarios, attacks were carried out in rounds with a multiple of 5, 10, and 20, respectively.

7.1 Results in No Attack Scenario

In Fig. 2, we present the results of accuracy and loss pertaining to the application of FL using four different adaptive aggregation scenarios as aggregation function, in case no adversarial attacks have occurred yet. The depicted results correspond to 100 rounds of FL runs. The aggregation functions utilized include Adagrad, FedAdam, FedYogi, and FedAVG. As observed in this figure, when employing the FedAVG aggregation function, FL demonstrates the best performance. In this state, FL rapidly achieves an accuracy exceeding 80% even in the initial rounds, and it reaches an accuracy of around 90% in the later rounds. When utilizing the FedYogi aggregation function, federated learning requires a greater number of rounds to reach an accuracy of approximately 80%, compared to when using FedAVG aggregation. However, after a sufficient number of rounds, in some cases, the accuracy of FedYogi surpasses the FedAVG. The results in the subfigure which shows loss value, further confirms the aforementioned results. It is evident that both the FedAVG and FedYogi approaches exhibit loss values below 2% after a sufficient number of rounds. However, the FedAdam and Adagrad methods show higher loss values in comparison. In all scenarios, a critical observation emerges: FL achieves convergence across all aggregation functions in the absence of any attacks. This convergence is characterized by a significant reduction in the loss, signifying the accomplishment of convergence prior to the occurrence of any attacks. An important point highlighted by the presented results is that the value of loss in Fig. 2 consistently diminishes when no attack is carried out. This signifies that the FL classification remains convergent when employing any of the utilized aggregation functions. However, in subsequent sections, it will become apparent that when an attack is executed, the loss value remains constant, leading to a lack of convergence in the classification process.

Two line graphs represent the trends for Adagrad, Fed Adam, Fed Yogi, and Fed A V G algorithms. 1. The plot of accuracy versus the number of rounds represents an increasing trend. 2. The graph of loss versus the number of rounds has a decreasing trend. Fed Adam has larger fluctuations.

Fig. 2

Accuracy and loss values for FL running on fashion-MNIST by considering different aggregation functions, in case no attack happens

The results concerning precision and recall are presented in Fig. 3. It is evident that among the aggregation methods, employing FL with FedAVG and FedYogi yields superior results compared to the instances where FedAdam and Adagrad methods are utilized. This observation corresponds precisely with what was observed in Fig. 2 during the assessment of accuracy and loss. By considering Figs. 2 and 3 collectively, one can deduce that the utilization of FL in conjunction with the four aggregation functions, while potentially leading to variations in classification accuracy, all exhibit the ability to converge.

Two line graphs represent the trends for Adagrad, Fed Adam, Fed Yogi, and Fed A V G algorithms. Both plots of precision and recall versus the number of rounds represent an increasing trend with fluctuation. The fluctuation is more intense for Fed Adam.

Fig. 3

Precision and recall values for FL running on fashion-MNIST by considering different aggregation functions, in case no attack happens

7.2 Results With Attack in Rounds Multiples of 5

Figure 4 depicts the results of accuracy and loss values obtained from the execution of federated learning for various aggregation functions. These results correspond to scenarios where attacks have been conducted in multiples of 5. When categorizing the robustness of these aggregation functions in terms of their ability to withstand adversarial model poisoning attacks without significant accuracy reduction, the FedYogi aggregation function demonstrates the highest level of robustness. It not only maintains a notable accuracy level but also achieves elevated accuracy. The Adagrad and FedAdam aggregation functions follow suit in subsequent rankings, displaying intermediate levels of resistance against such attacks. Conversely, the FedAVG aggregation function exhibits the weakest performance in this regard. However, it is important to emphasize that the primary objective of the attack employed was not to directly lower accuracy; rather, her, its purpose was to undermine model convergence.

Two line graphs represent the trends for Adagrad, Fed Adam, Fed Yogi, and Fed A V G algorithms. The graph for accuracy denotes an increasing trend with several peaks and troughs. The plot of loss denotes a linear trend with fluctuations. The fluctuation is more intense for Fed Adam.

Fig. 4

Accuracy and loss values for FL running on fashion-MNIST by considering different aggregation functions, in case attacks happen in multiples of 5

By considering these outcomes, it is revealed that when FL employs the FedAVG aggregation function, the attack leads to a reduction in accuracy and loss, with loss values suggesting successful convergence. Concerning other aggregation functions used in this study, particularly FedYogi, while the accuracy values do not exhibit a significant decline, an analysis of the loss values indicates that even after 100 rounds of execution, convergence is not achieved as compared to the scenario without an attack. It appears that when adaptive aggregation functions are employed, the attack has impeded the convergence of FL. When considering Fig. 4, it becomes apparent that the loss no longer decreases after a certain round. This observation implies that the attacks were successful in preventing the convergence of the FL process.

Figure 5 illustrates the precision and recall values pertinent to this particular scenario. These outcomes are portrayed across 100 execution rounds, with the attacks occurring in rounds of multiples of 5. Among the aggregation functions similar to those discussed in Fig. 3 with respect to accuracy measurements, when FL employs the FedAVG aggregation function, it encounters substantial fluctuations in precision and recall values due to the influence of the attack. Nonetheless, the performance of the FedYogi method remains comparatively unaltered, while the other two aggregation functions also demonstrate relatively minor degrees of impact. As a result, it can be deduced that when attacks take place in rounds of multiples 5 and the aggregation functions employed are FedYogi, FedAdam, and Adagrad, the most significant repercussion of the attack lies in the disruption of convergence.

Two line graphs represent increasing trends for Adagrad, Fed Adam, Fed Yogi, and Fed A V G algorithms. Both plots of precision and recall versus the number of rounds denote the progression of lines with large fluctuations. Fed Adam has a decline toward the end in both graphs.

Fig. 5

Precision and recall values for FL running on Fashion-MNIST by considering different aggregation functions, in case attacks happen in multiples of 5

7.3 Results With Attack in rounds multiples of 10

In Fig. 6, the results pertaining to accuracy and loss are presented for FL-based classification. This is carried out using four aggregation functions: FedAVG, FedYogi, FedAdam, and Adagrad. The scenarios depicted encompass attacks executed during rounds with a multiplier of 10. Similar to the findings presented in previous figures, it is observed that the employed attack has significantly reduced the accuracy of the FL classification when the FedAVG aggregation function is utilized. However, when FL employs the other three aggregation functions, it exhibits greater robustness in terms of accuracy reduction against this attack. Despite this, the convergence of FL has been notably compromised, with persistently high loss values even after 100 rounds of execution.

Two line graphs represent the trends for Adagrad, Fed Adam, Fed Yogi, and Fed A V G algorithms with multiple fluctuations. 1. The graph of Accuracy denotes an increasing trend for Adagrad and Fed Yogi. 2. The graph of Loss denotes a fluctuating trend in the lines.

Fig. 6

Accuracy and loss values for FL running on fashion-MNIST by considering different aggregation functions, in case attacks happen in multiples of 10

The results presented in Fig. 7 pertain to the precision and recall values. These outcomes validate the same conclusions drawn from the results depicted in Fig. 6. Additionally, the discrepancies in precision and recall values across the four instances of FL executions utilizing different aggregation functions underscore the variations in robustness among these approaches. In this context, it’s noteworthy that the FedAVG aggregation function demonstrates the weakest performance, while the FedYogi aggregation function showcases the most favorable performance. However, it’s important to acknowledge that the primary objective of the attack employed is to impede the convergence of FL classification.

Two line graphs represent the trends for Adagrad, Fed Adam, Fed Yogi, and Fed A V G algorithms with multiple fluctuations. 1. The graph of preciosn versus the number of rounds. 2. The graph of recall versus the number of rounds. Fed Adam has a larger fluctuation in both graphs.

Fig. 7

Precision and recall values for FL running on Fashion-MNIST by considering different aggregation functions, in case attacks happen in multiples of 10

7.4 Results With Attack in Rounds Multiples of 20

In Fig. 8, accuracy and loss values in the classification by FL with four distinct aggregation functions are presented. These results correspond to scenarios where attacks were executed in rounds multiples of 10. As observed, the reduction in accuracy within the FedAVG aggregation function scenario occurred later compared to previous scenarios. Moreover, considering the loss values, it is evident that despite the attack occurring in only 5 rounds out of 100 possible rounds, it still significantly impacted the convergence. The loss values either remained constant or, in many instances, exhibited an increase. This demonstrates that even though the attack employed in this study may not have a substantial impact on the accuracy of FL classification when using adaptive functions, it does hinder convergence of classification.

2 line graphs represent the trends for Adagrad, Fed Adam, Fed Yogi, and Fed A V G algorithms with multiple fluctuations. 1. The graph of Accuracy denotes an initial increase. 2. The graph of Loss has a decreasing trend. Fed Adam and Fed A V G increase toward the end.

Fig. 8

Accuracy and loss values for FL running on fashion-MNIST by considering different aggregation functions, in case attacks happen in multiples of 20

Figure 9 represents the final figure within this book chapter, displaying precision and recall values since attacks were conducted in rounds of multiples of 20. It is observed that among the four discussed aggregation functions, when utilizing the FedYogi and Adagrad functions, precision and recall values do not exhibit a significant reduction. This outcome precisely corroborates the results depicted in Fig. 8.

Two line graphs represent the trends for Adagrad, Fed Adam, Fed Yogi, and Fed A V G algorithms with multiple fluctuations. Both plots of precision and recall versus the number of rounds denote an increasing trend for Adagrad and Fed Yogi and a decreasing trend for Fed Adam and Fed A V G.

Fig. 9

Precision and recall values for FL running on fashion-MNIST by considering different aggregation functions, in case attacks happen in multiples of 20

8 Discussion on the Results

The presented results shed light on the behavior of federated learning (FL) under various scenarios, particularly focusing on the impact of model poisoning attacks when adaptive aggregation functions are utilized. These scenarios encompass a comprehensive analysis of accuracy, loss, precision, and recall values across different rounds of FL executions. The examination of these outcomes provides valuable insights into the robustness and convergence of FL under the influence of attacks.

Results in no Attack Scenario The initial investigation was carried out in a setting without any adversarial attacks. The results, as depicted in Fig. 2, indicate that FL demonstrates promising convergence behavior across all aggregation functions. Notably, the FedAVG aggregation function yields the best accuracy performance, swiftly reaching accuracy levels above 80% and further improving to around 90% in later rounds. FedYogi’s accuracy takes slightly longer to surpass 80% accuracy compared to FedAVG. However, in some cases, FedYogi outperforms FedAVG after sufficient rounds. This outcome showcases the adaptability and efficiency of adaptive aggregation functions in promoting convergence.

Furthermore, the loss values portrayed in the same figure reaffirm these results. Both FedAVG and FedYogi approaches exhibit low loss values after a certain number of rounds, indicating successful convergence. In contrast, the FedAdam and Adagrad methods show higher loss values, which correlates with their comparatively lower convergence rates. Importantly, the consistent decrease in loss values indicates the convergence of FL across all aggregation functions in the absence of attacks. Results With Attack in rounds multiples of 5, 10, and 20 The subsequent examination delved into scenarios with adversarial model poisoning attacks introduced at different rounds. The results reveal the varying impact of attacks on the convergence and robustness of FL. In the case of attacks occurring at rounds multiples of 5 (Fig. 4), FedYogi stands out as the most robust aggregation function. It maintains or even increases accuracy levels while other functions experience significant accuracy drops. This indicates that FedYogi can withstand the attacks without compromising classification accuracy. However, it’s noteworthy that the primary goal of the attack was to hinder model convergence rather than directly reducing accuracy. The evidence presented in this section underscores the detrimental effects of attacks on the convergence of FL, particularly when employing the FedAVG aggregation function. Moving on to attacks in rounds multiples of 10 (Fig. 6), it becomes apparent that the attack’s impact on accuracy reduction is less pronounced when utilizing adaptive aggregation functions such as FedYogi and Adagrad. The loss values remain high even after 100 rounds, signifying compromised convergence. This observation underscores that the attacks impede the convergence process and substantiates the importance of robust aggregation functions. Finally, the examination of attacks in rounds multiples of 20 (Fig. 8) showcases the evolving impact of attacks on accuracy and loss values. FedYogi remains robust in maintaining accuracy, while the convergence of FL is significantly affected. The attack’s influence on loss values further emphasizes the disruption of convergence, even when using adaptive aggregation functions.

The comprehensive analysis of FL under different attack scenarios highlights key insights:

Robustness of Adaptive Aggregation Functions: Adaptive aggregation functions, particularly FedYogi and Adagrad, exhibit higher robustness against model poisoning attacks. They maintain or improve accuracy levels compared to the FedAVG aggregation function.

Impact on Convergence: Attacks, even with the goal of hindering convergence rather than reducing accuracy, have a significant impact on FL. Loss values no longer decrease, indicating disrupted convergence.

Convergence vs. Accuracy: While adaptive aggregation functions may maintain accuracy levels, the convergence of FL is compromised. This emphasizes the importance of considering both accuracy and convergence when assessing the impact of attacks.

In summary, the results underscore the interplay between aggregation functions, accuracy, and convergence in the face of model poisoning attacks. These findings contribute to a deeper understanding of the vulnerabilities and strengths of FL in adaptive aggregation scenarios, offering valuable insights for enhancing the robustness of FL systems.

9 Conclusions and Future Work

In this chapter, we have investigated the vulnerability of FL to model poisoning attacks in the context of adaptive aggregation functions. Our comprehensive analysis across various attack scenarios has shed light on the behavior of FL under different aggregation strategies, focusing on accuracy, convergence, and robustness. The results have revealed several key insights that contribute to the understanding of FL’s robustness against model this poisoning attack.

Our findings highlight the robustness and adaptability of certain aggregation functions, particularly FedYogi and Adagrad, in the presence of model poisoning attacks. These functions demonstrated the ability to maintain or enhance classification accuracy while withstanding the attacks, underscoring their potential for robust FL implementations. The analysis demonstrated that model poisoning attacks hinder the convergence of FL, even when adaptive aggregation functions are utilized. The disruption in loss reduction indicates compromised convergence and highlights the vulnerability of FL systems. Some of the potential future directions that can be proposed include:

Investigating dynamic adaptation strategies for aggregation functions could provide insights into designing more resilient FL systems. Adaptive mechanisms that can automatically adjust aggregation strategies based on the severity of attacks could mitigate their impact.

Further research could focus on developing techniques to enhance the robustness of FL against model poisoning attacks. Exploring novel aggregation strategies that strike a balance between maintaining accuracy and withstanding attacks could be a promising avenue.

In conclusion, this study provides valuable insights into the behavior of FL under model poisoning attacks, particularly in the context of adaptive aggregation functions. The findings emphasize the need for a balanced approach that considers accuracy, convergence, and robustness when designing FL systems. As FL continues to be adopted in various applications, addressing its vulnerabilities and enhancing its resilience against attacks will remain crucial for its successful deployment in real-world scenarios.

Acknowledgements

The research was sponsored by the Army Research Office and was accomplished under Grant Number W911NF-21-1-0264. The views and conclusions contained in this document are those of the authors and should not be interpreted as representing the official policies, either expressed or implied, of the Army Research Office or the U.S. Government. The U.S. Government is authorized to reproduce and distribute reprints for Government purposes notwithstanding any copyright notation herein.

References

1.

Awan, S., Luo, B., Li, F.: Contra: Defending against poisoning attacks in federated learning. In: European Symposium on Research in Computer Security (2021). https://​par.​nsf.​gov/​biblio/​10294585

2.

Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., Shmatikov, V.: How to backdoor federated learning. In: Chiappa, S., Calandra, R. (eds.) Proceedings of the Twenty Third International Conference on Artificial Intelligence and Statistics. Proceedings of Machine Learning Research, vol. 108, pp. 2938–2948 (2020). https://​proceedings.​mlr.​press/​v108/​bagdasaryan20a.​html

3.

Biggio, B., Nelson, B., Laskov, P.: Poisoning attacks against support vector machines. In: Proceedings of the 29th International Coference on International Conference on Machine Learning, pp. 1467–1474. ICML 12. Omnipress, Madison (2012)

4.

Cao, X., Gong, N.: Mpaf: Model poisoning attacks to federated learning based on fake clients. In: 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW), pp. 3395–3403. IEEE Computer Society, Los Alamitos (2022). https://​doi.​org/​10.​1109/​CVPRW56347.​2022.​00383, https://​doi.​ieeecomputersoci​ety.​org/​10.​1109/​CVPRW56347.​2022.​00383

5.

Chen, X., Liu, G.: Adaptive lazily aggregation based on error accumulation. In: 2023 4th International Conference on Electronic Communication and Artificial Intelligence (ICECAI), pp. 74–77 (2023). https://​doi.​org/​10.​1109/​ICECAI58670.​2023.​10176452

6.

Chen, X., Liu, C., Li, B., Lu, K., Song, D.: Targeted backdoor attacks on deep learning systems using data poisoning (2017). https://​api.​semanticscholar.​org/​CorpusID:​36122023. ArXiv: abs/1712.05526

7.

Chen, S., Shen, C., Zhang, L., Tang, Y.: Dynamic aggregation for heterogeneous quantization in federated learning. IEEE Trans. Wirel. Commun. pp. 1–1 (2021). https://​doi.​org/​10.​1109/​TWC.​2021.​3076613

8.

Cheng, H., Yang, M., Chen, F., Liu, X., Wang, M., Li, X.: Model poisoning attack in differential privacy-based federated learning. Inf. Sci. 630, 158–172 (2023)Crossref

9.

Ek, S., Portet, F., Lalanda, P., Vega, G.: A federated learning aggregation algorithm for pervasive computing: Evaluation and comparison. In: 2021 IEEE International Conference on Pervasive Computing and Communications (PerCom), pp. 1–10 (2021). https://​doi.​org/​10.​1109/​PERCOM50583.​2021.​9439129

10.

Erbil, P., Gursoy, M.E.: Defending against targeted poisoning attacks in federated learning. In: 2022 IEEE 4th International Conference on Trust, Privacy and Security in Intelligent Systems, and Applications (TPS-ISA), pp. 198–207 (2022). https://​doi.​org/​10.​1109/​TPS-ISA56441.​2022.​00033

11.

Fang, M., Cao, X., Jia, J., Gong, N.: Local model poisoning attacks to Byzantine-Robust federated learning. In: 29th USENIX security symposium (USENIX Security 20), pp. 1605–1622 (2020)

12.

Feki, I., Ammar, S., Kessentini, Y., Muhammad, K.: Federated learning for covid-19 screening from chest x-ray images. Appl. Soft Comput. 106, 107330 (2021). https://​doi.​org/​https://​doi.​org/​10.​1016/​j.​asoc.​2021.​107330, https://​www.​sciencedirect.​com/​science/​article/​pii/​S156849462100253​2

13.

Feng, C.m., Yan, Y., Wang, S., Xu, Y., Shao, L., Fu, H.: Specificity-preserving federated learning for mr image reconstruction. IEEE Trans. Med. Imaging 42(7), 2010–2021 (2023). https://​doi.​org/​10.​1109/​TMI.​2022.​3202106

14.

Gosselin, R., Vieu, L., Loukil, F., Benoit, A.: Privacy and security in federated learning: a survey. Appl. Sci. 12(19) (2022). https://​doi.​org/​10.​3390/​app12199901, https://​www.​mdpi.​com/​2076-3417/​12/​19/​9901

15.

Gu, Y., Li, X., Dvornek, N., Staib, L.H., Ventola, P., Duncan, J.S.: Multi-site fmri analysis using privacy-preserving federated learning and domain adaptation: abide results. Med. Image Anal. 65, 101765 (2020). https://​doi.​org/​10.​1016/​j.​media.​2020.​101765, https://​www.​sciencedirect.​com/​science/​article/​pii/​S136184152030129​8

16.

He, C., Shah, A.D., Tang, Z., Fan, D., Sivashunmugam, A.N., Bhogaraju, K., Shimpi, M., Shen, L., Chu, X., Soltanolkotabi, M., Avestimehr, S.: Fedcv: A federated learning framework for diverse computer vision tasks (2021). https://​api.​semanticscholar.​org/​CorpusID:​234599864. ArXiv: abs/2111.11066

17.

Hossain, M., Islam, S., Badsha, S., Shen, H.: Desmp: Differential privacy-exploited stealthy model poisoning attacks in federated learning. In: 2021 17th International Conference on Mobility, Sensing and Networking (MSN), pp. 167–174. IEEE Computer Society, Los Alamitos (2021). https://​doi.​org/​10.​1109/​MSN53354.​2021.​00038, https://​doi.​ieeecomputersoci​ety.​org/​10.​1109/​MSN53354.​2021.​00038

18.

Hu, C., Liang, H.H., Han, X.M., Liu, B.A., Cheng, D.Z., Wang, D.: Spread: decentralized model aggregation for scalable federated learning. In: Proceedings of the 51st International Conference on Parallel Processing. ICPP ’22, Association for Computing Machinery, New York (2023). https://​doi.​org/​10.​1145/​3545008.​3545030

19.

Jallepalli, D., Ravikumar, N.C., Badarinath, P.V., Uchil, S., Suresh, M.A.: Federated learning for object detection in autonomous vehicles. In: 2021 IEEE Seventh International Conference on Big Data Computing Service and Applications (BigDataService), pp. 107–114 (2021). https://​doi.​org/​10.​1109/​BigDataService52​369.​2021.​00018

20.

Jayaram, K.R., Muthusamy, V., Thomas, G., Verma, A., Purcell, M.: Adaptive aggregation for federated learning. In: 2022 IEEE International Conference on Big Data (Big Data), pp. 180–185 (2022). https://​doi.​org/​10.​1109/​BigData55660.​2022.​10021119

21.

Jiang, J., Hu, L.: Decentralised federated learning with adaptive partial gradient aggregation. CAAI Trans. Intell. Technol. 5(3), 230–236 (2020). https://​doi.​org/​10.​1049/​trit.​2020.​0082, https://​ietresearch.​onlinelibrary.​wiley.​com/​doi/​abs/​10.​1049/​trit.​2020.​0082

22.

Khan, M., Jafaritadi, M., Alhoniemi, E., Kontio, E., Khan, S.: Adaptive weight aggregation in federated learning for brain tumor segmentation. In: Crimi, A., Bakas, S. (eds.) Brainlesion: Glioma, Multiple Sclerosis, Stroke and Traumatic Brain Injuries. Lecture Notes in Computer Science, vol. 12963. Springer, Cham (2022). https://​doi.​org/​10.​1007/​978-3-031-09002-8_​40

23.

Lai, Y.C., Lin, J.Y., Lin, Y.D., Hwang, R.H., Lin, P.C., Wu, H.K., Chen, C.K.: Two-phase defense against poisoning attacks on federated learning-based intrusion detection. Comput. Secur. 129 (2023). https://​doi.​org/​10.​1016/​j.​cose.​2023.​103205

24.

Lee, S., Zhang, T., Avestimehr, A.S.: Layer-wise adaptive model aggregation for scalable federated learning. Proc. AAAI Conf. Artif. Intell. 37(7), 8491–8499 (2023). https://​doi.​org/​10.​1609/​aaai.​v37i7.​26023, https://​ojs.​aaai.​org/​index.​php/​AAAI/​article/​view/​26023

25.

Li, Z., Sharma, V., P. Mohanty, S.: Preserving data privacy via federated learning: challenges and solutions. IEEE Consum. Electron. Mag. 9(3), 8–16 (2020). https://​doi.​org/​10.​1109/​MCE.​2019.​2959108

26.

Liu, Y., Huang, A., Luo, Y., Huang, H., Liu, Y., Chen, Y., Feng, L., Chen, T., Yu, H., Yang, Q.: Fedvision: an online visual object detection platform powered by federated learning. Proc. AAAI Conf. Artif. Intell. 34, 13172–13179 (04 2020). https://​doi.​org/​10.​1609/​aaai.​v34i08.​7021

27.

Lyu, L., Yu, H., Ma, X., Sun, L., Zhao, J., Yang, Q., Yu, P.: Privacy and robustness in federated learning: attacks and defenses (2020). arXiv:2012.06337

28.

Mcmahan, H.B., Moore, E., Ramage, D., Hampson, S., Aguera Y Arcas, B.: Communication-efficient learning of deep networks from decentralized data. In: International Conference on Artificial Intelligence and Statistics (2016), https://​api.​semanticscholar.​org/​CorpusID:​14955348

29.

Meng, Q., Zhou, F., Ren, H., Feng, T., Liu, G., Lin, Y.: Improving federated learning face recognition via privacy-agnostic clusters (2022). arXiv:2201.12467

30.

Mothukuri, V., Parizi, R.M., Pouriyeh, S., Huang, Y., Dehghantanha, A., Srivastava, G.: A survey on security and privacy of federated learning. Future Gener. Comput. Syst. 115, 619–640 (2021). https://​doi.​org/​10.​1016/​j.​future.​2020.​10.​007, https://​www.​sciencedirect.​com/​science/​article/​pii/​S0167739X2032984​8

31.

Nguyen, N.H., Nguyen, P.L., Nguyen, T.D., Nguyen, T.T., Nguyen, D.L., Nguyen, T.H., Pham, H.H., Truong, T.N.: Feddrl: Deep reinforcement learning-based adaptive aggregation for non-iid data in federated learning. In: Proceedings of the 51st International Conference on Parallel Processing, ICPP ’22. Association for Computing Machinery, New York (2023). https://​doi.​org/​10.​1145/​3545008.​3545085

32.

Nishio, T., Yonetani, R.: Client selection for federated learning with heterogeneous resources in mobile edge. In: ICC 2019 - 2019 IEEE International Conference on Communications (ICC), pp. 1–7 (05 2019). https://​doi.​org/​10.​1109/​ICC.​2019.​8761315

33.

Niu, Y., Deng, W.: Federated learning for face recognition with gradient correction. Proc. AAAI Conf. Artif. Intell. 36(2), 1999–2007 (2022). https://​doi.​org/​10.​1609/​aaai.​v36i2.​20095, https://​ojs.​aaai.​org/​index.​php/​AAAI/​article/​view/​20095

34.

Park, S., Suh, Y., Lee, J.: Fedpso: Federated learning using particle swarm optimization to reduce communication costs. Sensors 21, 600 (2021). https://​doi.​org/​10.​3390/​s21020600Crossref

35.

Reddi, S., Charles, Z., Zaheer, M., Garrett, Z., Rush, K., Konečnỳ, J., Kumar, S., McMahan, H.B.: Adaptive federated optimization. Preprint (2020). arXiv:2003.00295

36.

Rong, D., Ye, S., Zhao, R., Yuen, H.N., Chen, J., He, Q.: Fedrecattack: Model poisoning attack to federated recommendation. In: 2022 IEEE 38th International Conference on Data Engineering (ICDE), pp. 2643–2655 (2022). https://​doi.​org/​10.​1109/​ICDE53745.​2022.​00243

37.

Rudovic, O., Tobis, N., Kaltwang, S., Schuller, B., Rueckert, D., Cohn, J.F., Picard, R.W.: Personalized federated deep learning for pain estimation from face images (2021). arXiv:2101.04800

38.

Shafahi, A., Huang, W.R., Najibi, M., Suciu, O., Studer, C., Dumitras, T., Goldstein, T.: Poison frogs! targeted clean-label poisoning attacks on neural networks (2018). arXiv:1804.00792

39.

Shome, D., Kar, T.: Fedaffect: few-shot federated learning for facial expression recognition. In: Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV) Workshops, pp. 4168–4175 (2021)

40.

Song, Q., Lei, S., Sun, W., Zhang, Y.: Adaptive federated learning for digital twin driven industrial internet of things. In: 2021 IEEE Wireless Communications and Networking Conference (WCNC), pp. 1–6 (2021). https://​doi.​org/​10.​1109/​WCNC49053.​2021.​9417370

41.

Sun, Z., Kairouz, P., Suresh, A.T., Mcmahan, H.B.: Can you really backdoor federated learning? (2019). arXiv:1911.07963

42.

Sun, Y., Ochiai, H., Sakuma, J.: Semi-targeted model poisoning attack on federated learning via backward error analysis (2022). arXiv:2203.11633

43.

Varma, K., Zhou, Y., Baracaldo, N., Anwar, A.: Legato: a layerwise gradient aggregation algorithm for mitigating byzantine attacks in federated learning. In: 2021 IEEE 14th International Conference on Cloud Computing (CLOUD), pp. 272–277 (2021). https://​api.​semanticscholar.​org/​CorpusID:​236447622

44.

Virat, S., Amir, H., Peter, K., Daniel, R.: Back to the drawing board: A critical evaluation of poisoning attacks on federated learning (2021). arXiv:2108.10241

45.

Wang, D., Zhang, N., Tao, M.: Adaptive clustering-based model aggregation for federated learning with imbalanced data. In: 2021 IEEE 22nd International Workshop on Signal Processing Advances in Wireless Communications (SPAWC), pp. 591–595 (2021). https://​doi.​org/​10.​1109/​SPAWC51858.​2021.​9593144

46.

Wang, Z., Kang, Q., Zhang, X., Hu, Q.: Defense strategies toward model poisoning attacks in federated learning: A survey (2022). arXiv:2202.06414

47.

Wu, Q., Chen, X., Ouyang, T., Zhou, Z., Zhang, X., Yang, S., Zhang, J.: Hiflash: Communication-efficient hierarchical federated learning with adaptive staleness control and heterogeneity-aware client-edge association. IEEE Trans. Parallel Distrib. Syst. 34(5), 1560–1579 (2023). https://​doi.​org/​10.​1109/​TPDS.​2023.​3238049Crossref

48.

Xia, G., Chen, J., Yu, C., Ma, J.: Poisoning attacks in federated learning: a survey. IEEE Access 11, 10708–10722 (2023). https://​doi.​org/​10.​1109/​ACCESS.​2023.​3238823Crossref

49.

Xiao, H., Rasul, K., Vollgraf, R.: Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms. Preprint (2017). arXiv:1708.07747

50.

Yan, B., Wang, J., Cheng, J., Zhou, Y., Zhang, Y., Yang, Y., Liu, L., Zhao, H., Wang, C., Liu, B.: Experiments of federated learning for covid-19 chest x-ray images. In: Sun, X., Zhang, X., Xia, Z., Bertino, E. (eds.) Advances in Artificial Intelligence and Security, pp. 41–53. Springer International Publishing, Cham (2021)Crossref

51.

Yan, R., Qu, L., Wei, Q., Huang, S.c., Shen, L., Rubin, D.L., Xing, L., Zhou, Y.: Label-efficient self-supervised federated learning for tackling data heterogeneity in medical imaging. IEEE Trans. Med. Imaging 42(7), 1932–1943 (2023). https://​doi.​org/​10.​1109/​TMI.​2022.​3233574

52.

Yang, Z., Chen, M., Saad, W., Hong, C.S., Shikh-bahaei, M.: Energy efficient federated learning over wireless communication networks. Trans. Wirel. Commun. 20(3), 1935–1949 (2021). https://​doi.​org/​10.​1109/​TWC.​2020.​3037554.Crossref

53.

Yang, M., Cheng, H., Chen, F., Liu, X., Wang, M., Li, X.: Model poisoning attack in differential privacy-based federated learning. Inf. Sci. 630, 158–172 (2023)Crossref

54.

Yang, Q., Huang, A., Fan, L.E.A.: Federated learning with privacy-preserving and model ip-right-protection. Mach. Intell. Res. 20, 19–37 (2023). https://​doi.​org/​10.​1007/​s11633-022-1343-2Crossref

55.

Ye, S., Zeng, L., Wu, Q., Luo, K., Fang, Q., Chen, X.: Eco-fl: Adaptive federated learning with efficient edge collaborative pipeline training. In: Proceedings of the 51st International Conference on Parallel Processing. ICPP ’22, Association for Computing Machinery, New York (2023). https://​doi.​org/​10.​1145/​3545008.​3545015

56.

Yu, S., Cui, L.: Poisoning Attacks and Counterattacks in Federated Learning, pp. 37–54. Digital Privacy and Security, Springer Nature Singapore, Singapore (2023). https://​doi.​org/​10.​1007/​978-981-19-8692-5_​3

57.

Zhang, J., Chen, J., Wu, D., Chen, B., Yu, S.: Poisoning attack in federated learning using generative adversarial nets. In: 2019 18th IEEE International Conference On Trust, Security And Privacy In Computing And Communications/13th IEEE International Conference On Big Data Science And Engineering (TrustCom/BigDataSE), pp. 374–380 (2019). https://​doi.​org/​10.​1109/​TrustCom/​BigDataSE.​2019.​00057

58.

Zhang, J., Chen, B., Cheng, X., Binh, H.T.T., Yu, S.: Poisongan: Generative poisoning attacks against federated learning in edge computing systems. IEEE Internet Things J. 8(5), 3310–3322 (2021). https://​doi.​org/​10.​1109/​JIOT.​2020.​3023126Crossref

59.

Zhang, J., Hua, Y., Wang, H., Song, T., Xue, Z., Ma, R., Guan, H.: Fedala: Adaptive local aggregation for personalized federated learning. Proc. AAAI Conf. Artif. Intell. 37(9), 11237–11244 (2023). https://​doi.​org/​10.​1609/​aaai.​v37i9.​26330, https://​ojs.​aaai.​org/​index.​php/​AAAI/​article/​view/​26330

60.

Zheng, J., Yang, J., Baker, T., Tang, S., Tan, Y.a., Zhang, Q.: Clean-label poisoning attacks on federated learning for iot. Expert Syst. 40(5), e13161 (2023). https://​doi.​org/​10.​1111/​exsy.​13161, https://​onlinelibrary.​wiley.​com/​doi/​abs/​10.​1111/​exsy.​13161

© The Author(s), under exclusive license to Springer Nature Switzerland AG 2024

E. Nowroozi et al. (eds.)Adversarial Multimedia ForensicsAdvances in Information Security104https://doi.org/10.1007/978-3-031-49803-9_2

Image Forgery Detection Using Comprint: A Comprehensive Study

Hannes Mareen1  , Peter Lambert1   and Glenn Van Wallendael1  

(1)

IDLab, Ghent University - imec, Ghent, Belgium

Hannes Mareen (Corresponding author)

Email: hannes.mareen@ugent.be

Peter Lambert

Email: peter.lambert@ugent.be

Glenn Van Wallendael

Email: glenn.vanwallendael@ugent.be

Keywords

Image forgery detectionImage tamperingImage forensicsMultimedia forensicsMachine and deep learning

This work was funded in part by the Flemish government (COM-PRESS project, within the relanceplan Vlaamse Veerkracht), IDLab (Ghent University—imec), Research Foundation—Flanders (FWO), Flanders Innovation & Entrepreneurship (VLAIO), and the European Union.

1 Introduction

Digital image manipulation is becoming increasingly accessible and realistic with the use of (AI-assisted) image editing tools. For instance, Fig. 1a shows a forged image in which the faces of the Ghostbuster stars have been replaced with those of the authors of this paper. This forgery was created using FaceHub.live, a face swapping or deepfake website. While these tools have many harmless applications, they can also be used in a malicious way, such as for misinformation and fabricating evidence. As a result, researching image forensic methods is essential [31].

3 images. A has a photograph labeled forged image with a deepfake face-swapping tool of 3 men standing in front of a building. B has the color gradient comprint or compression fingerprint corresponding to the forged image with 3 spots. C has the heatmap corresponding to the comprint with 3 spots.

Fig. 1

The ability to create (a) realistic image manipulations has been greatly enhanced with the use of (a) free AI-based tools. In light of this, we present Comprint, an image forgery detection and localization technique that uses a (b) compression fingerprint. The method identifies inconsistencies in the compression history. As such, forgeries are detected and localized in a (c) heatmap

Existing forgery detection methods often focus on identifying subtle traces of an image’s digital history [38]. That is, every step in the acquisition and editing process typically leave behind (imperceptible) traces. For instance, camera sensors introduce unique noise patterns [24], and each compression algorithm introduces specific artifacts such as blocking artifacts [6, 7, 17, 23, 42]. Even when these traces are imperceptible, they can be exploited by a computer. However, it becomes challenging to detect these subtle traces when images are recompressed to a lower quality, which is often the case on the internet or when shared through social media. Thus, successfully identifying forgeries can still be challenging.

Recent methods that rely on deep learning with a large dataset of manipulated training data demonstrated better resistance against recompression [36, 38]. However, typical supervised AI-based methods do not generalize well to forgeries, as they overfit on the forgery types that were seen at training time. As an alternative, one-class methods are trained using only real data. Since these methods cannot overfit on one specific type of forgery, they generalize better. For instance, Noiseprint [8] and Comprint [26, 27] are algorithms that learned to extract a camera fingerprint and compression fingerprint, respectively. Then, inconsistencies in this fingerprint reveal tampering. These schemes demonstrated promising results, especially when fusing them [26].

This chapter presents an overview of the Comprint method, which detect discrepancies in JPEG compression artifacts in order to identify tampered regions in images. Unlike traditional methods that assume that pristine regions were compressed twice and forged regions only once, Comprint makes a more generic assumption. That is, it assumes that the compression history of pristine regions differ from the history of the forged regions. It is trained on only pristine, non-tampered, images (one-class training). These images are compressed using different Quality Factors (QF) or non-standard quantization tables of the Joint Picture Expert Group (JPEG) coding standard. Moreover, Siamese training is applied, in which the network is trained to recognize regions that have undergone either the same or a different compression. As such, the network takes an image as input and extracts a unique compression fingerprint, known as a “comprint.” Then, the fingerprint is segmented into a heatmap using a localization algorithm, making it easy to identify tampered areas in the image. Figure 1b and c shows an example of a comprint and corresponding heatmap, for the forged deepfake image shown in Fig. 1a.

The rest of this chapter is organized as follows. First, Sect. 2 summarizes related work. Then, the Comprint architecture is described in Sect. 3. Next, Sect. 4 lists the experimental results and demonstrates the top-notch performance of Comprint. Subsequently, Sect. 5 discusses the limitations and ethical usage of the method. Finally, the chapter is concluded in Sect. 6.

2 State of the Art

The main categories of image manipulation detection approaches are listed in this section. The section provides an overview of various methods proposed in scientific literature.

2.1 Active Forgery Detection Methods

Active forgery detection methods require a protection step before the image potentially undergoes forgery by a malicious actor, such as during the acquisition stage. By extracting this information, one can verify the integrity and authenticity of an image. The embedded information could be a watermark that is hidden in the image, or a digital signature that is added as metadata [19].

Fragile or semi-fragile watermarks can be embedded invisibly into an image. When the resulting image is tampered with, the watermark will be (locally) distorted, and hence detects (and localizes) the forgery. Fragile watermarks embed signatures of the original pixels in the image and have the disadvantage that these signatures change notably when the image undergoes global non-invasive post processing, such as recompression [45]. In other words, fragile watermarks do not perform well in in-the-wild circumstances. Semi-fragile watermarks solve this issue by using robust hash functions that only notably change when there is a semantic change of the image, but do not change significantly when global non-invasive post processing is performed [13].

Alternatively, a self-recovery watermark can be used, which is a downsampled encoded version of the image that is hidden in the image. By recovering this compressed version and comparing it to the image, tampering can be localized. Although self-recovery schemes are capable of impressive restoration performance, they are limited to lossless image representations and thus have limited applicability in practical scenarios [19].

The disadvantage of watermarking schemes is that their embedding distort the original image. As an alternative, digital signatures could be added as metadata, without changing the original image. Similar as in semi-fragile watermarking, the signature could be a robust hash that survives global changes that preserve semantics but changes when malicious tampering occurs [40]. In practice, though, there is a trade-off between the robustness and security.

Although active detection methods perform relatively well in certain niche use cases, their main disadvantage is that they require an embedding process before the image undergoes potential manipulation, which is not feasible in most use cases. Therefore, this book chapter focuses on passive forgery detection methods which do not pose any such strict requirements on the images under investigation.

2.2 Passive Forgery Detection Methods

Passive forgery detection methods are more feasible to be used in most applications, although they tackle a more challenging problem compared to active methods. That is because they cannot rely on information that was embedded into the image prior to the tampering. Instead, they rely on artefacts that are introduced during the various stages of an image’s life cycle. We can categorize these into three categories: acquisition, coding and editing artefacts. When certain artefacts related to editing are detected, it may suggest forgery. Alternatively, inconsistencies in the acquisition and coding artefacts suggest manipulation.

Acquisition Artifacts

When an image is captured by a digital camera, it undergoes several steps before it is transformed into a digital image. For example, the captured light passes a lens, optical filter, a Color Filter Array (CFA) with a corresponding demosaicing step, an imaging sensor, and undergoes in-camera software processing (such as changes in brightness, contrast and saturation, as well as white balancing).

Camera lenses have imperfections such as lens aberration that can be utilized for forgery detection. For example, inconsistencies in chromatic aberration artifacts can be exploited to detect forgeries [28, 43]. Chromatic aberration arises when the lens responds differently to various wavelengths, causing colors to refract differently and no longer converge on the image sensor.

The process of demosaicing, which involves interpolating data from CFA filters, introduces a correlation pattern into the resulting image pixels. When manipulating an image, this correlation pattern may be distorted. Popescu and Farid presented one of the earliest approaches for dealing with CFA artifacts [35]. They proposed a linear model to account for the periodic correlations introduced during CFA interpolation and used the Expectation-Maximization (EM) algorithm to estimate both the parameters of the model (i.e., the form of the correlations) and which samples are correlated to their neighbors simultaneously. These correlations, or lack thereof, reveal traces of tampering.

The photo-response non-uniformity (PRNU) noise is often used to identify camera models and devices, but also to detect and localize manipulations [24]. The PRNU is a unique pattern left behind by the camera sensor. A disadvantage is that estimating the PRNU noise requires many images from the same camera, which is not always feasible in real-world scenarios.

The Noiseprint method solves the disadvantage of PRNU-based methods by extracting a camera model fingerprint, or noiseprint, without requiring many images from that camera [8]. Instead, the noiseprint extraction was trained using a large dataset of images from several camera models, but generalizes to models that were not seen during training as well. This is done using Siamese training, where pairs of patches with either the same or a different camera model are fed to a CNN, and the distance between their corresponding outputs (i.e., fingerprints) should be small or large, respectively. This follows the idea of one-class training, which is a type of deep-learning method where only pristine data is used to form the training set, instead of a trying to build a representative set for all possible manipulations types (which is impossible, as new manipulation types may arise in the future). This way, the model simply learns some characteristic of pristine images, and inconsistencies in these characteristics indicate forgeries. In the case of Noiseprint, anomalies in the camera model fingerprint or noiseprint identify forgeries. This method has proven to perform very well in comparison with other methods, and was used for inspiration of the presented Comprint method.

Splicebuster [9] extracts a range of features from an image, that capture in-camera processing traces. By clustering these features, inconsistencies are detected that may be introduced by splicing. Both Noiseprint and Comprint (our presented method) utilize the same heatmap extraction method as Splicebuster, albeit applied to a novel fingerprint rather than the original image.

The EXIF metadata that a camera adds in an image can also be used for forgery detection. For example, the EXIF-SC method [16] uses a Siamese network to detect splicing by analyzing the self-consistency of the EXIF metadata of an image. However, this metadata is commonly deleted when images are shared through social media, or can easily be changed by an adversary.

Coding Artifacts

Using anomalies in JPEG coding artifacts is a very common approach in forgery detection. For example, mismatches in JPEG blocks, the corresponding grid, or block convergence are commonly investigated [17, 21, 23, 42]. In conventional techniques, these coding artifacts are statistically analysed such that a handcrafted model could be created. However, building practical handcrafted models that are applicable in real-world scenarios remains challenging, as these methods are limited by their assumptions.

Double quantization or double JPEG compression artifacts-based methods [2, 6, 7, 25] assume the authentic region is compressed twice, while the fake region is compressed only once. This was done both using conventional methods that create a handcrafted model of the JPEG compression artifacts, and deep-learning approaches that are trained with pictures compressed either once or twice to automatically extract relevant features [1, 33]. However, comparing regions that are compressed twice with those that are compressed once does not work well when the entire image is compressed multiple times.

Recently, Kwon et al. proposed a Compression Artifact Tracing Network (CAT-Net) that exploits both acquisition and double JPEG compression artifacts, by working both in the spatial and Discrete Cosine Transform (DCT) domain [20]. This technique uses deep learning with a very large training set that includes image compressed with a high number of JPEG quantization tables.

Editing Artifacts

With the advent of deep learning, it became common to train a neural network on a large dataset of both pristine and fake images, thereby learning to detect the editing artifacts. These methods’ generalization capabilities (within the assumptions of the algorithms) depend on the training set diversity.

Specifically for learning deepfake face forgeries, many neural networks have been proposed that learned the difference between synthetic and generated faces [4, 36, 44]. These networks have shown an impressively good performance, even in the presence of recompression. However, they have the main disadvantage that they do not generalize well, i.e., they are limited to detecting the face forgery types seen during draining.

RRU-Net [5] is a deep-learning method that focuses on splicing artefacts only. Again, this may perform well on this type of manipulation, but does not generalize to other forgeries. ManTra-Net [39] and SPAN [15] are CNNs that are trained on 385 different manipulation types, which improves their generalization. However, building appropriate training datasets remains challenging due to the vast variety of manipulations, leading to poor performance on unseen fakes.

In conclusion, robust forgery detection and localization in real-world scenarios is still challenging, and it is hence important to continue research in this field.

3 Comprint

This section gives an overview of the Comprint method, which combines two main research directions in forgery detection to achieve its objective. The first direction is exploiting JPEG compression artifacts and the second direction is one-class deep learning.

The first research direction is exploiting JPEG compression artifacts, although Comprint does this in a different way than conventional methods. That is, it does not simply assume that pristine regions were compressed twice and forged regions compressed only a single time. Neither does it try to detect which specific compression parameters were used previously. Instead, Comprint simply assumes that the compression history of the real and fake regions are different. This is a more generalized approach. Comprint extracts a compression fingerprint, in which it subsequently looks for inconsistencies to reveal forgeries.

The second research direction that Comprint pursues is one-class deep learning. Similarly to the existing Noiseprint method [8], Comprint generalizes well to unseen forgery types, as it is not trained for specific manipulation types.

Comprint combines these two research directions: it exploits inconsistencies in JPEG compression artifacts using a one-class deep-learning architecture. As such, the method extracts a fingerprint of the an image, named the “comprint.” Afterwards, we analyze the comprint for inconsistencies, as these reveal forgeries.

The extraction of the comprint is discussed in Sects. 3–3.1, and the conversion into a heatmap is explained in Sects. 3–3.2. Finally, we fuse Comprint and Noiseprint in Sects. 3–3.3.

3.1 Fingerprint Extraction

Architecture

The system to extract compression fingerprints (or “comprints”) uses a Siamese architecture (see Fig. 2), which is inspired by the Noiseprint architecture [8]. The Siamese architecture trains a Convolutional Neural Network (CNN) to recognize similarities and differences between image patches based on their compression history. During training, we transform pairs of image patches into fingerprints using the CNN. These pairs either underwent a similar level of compression (labeled as $$-$$1) or a different level of compression (labeled as +1). Then, we calculate the distance between each pair of fingerprints. The loss function is defined to compare the distance to the corresponding labels.

A model diagram has the following flow, 2 images labeled patches 1 and 2, C N N layers, fingerprints 1 and 2, distance, softmax layer, and cross-entropy with a loop of loss and update weights to shared weights between the C N N layers. Cross-entropy also has an input of labels.

Fig. 2

Architecture for Siamese training of Comprint. The fingerprints are extracted from pairs of patches that either were compressed using the same or different settings, which should have similar or dissimilar corresponding fingerprints, respectively

The CNN architecture (see Fig. 3) is based on a Denoiser CNN (DnCNN), which was initially proposed for image denoising and JPEG deblocking [46]. The CNN consists of 2D convolutional layers, batch-normalization layers and rectified-linear-unit (ReLU) layers, and this for d times. To maintain the same dimensions in the output fingerprint, the patches are zero-padded. The convolutional layers use $$3 \times 3$$ filters and have 64 dimensions, except for the last layer which outputs only a single dimension. The input layer only has a single channel (i.e., the luminance channel of the image, which contains most information). Future work should investigate adding color information to the input. First, we trained the CNN to estimate JPEG artifacts (in a non-Siamese way). Then, the pretrained CNN’s weights are used to initialize the CNN in the Siamese architecture.

A model diagram has the following flow, a photo of 3 men in front of a building, convolution 64 3 by 3 layer, R e L U layer, convolution 64 3 by 3 layer, batch normalization layer, R e L U layer, convolution 1 3 by 3 layer, and color gradient compression fingerprint.

Fig. 3

Architecture of the CNN, used both in the pretraining and Siamese training steps

The trained CNN from the Siamese architecture can be used to extract the comprint from any image (in any resolution). Figure 1b shows an example of an extracted comprint from a manipulated image (Fig. 1a).

Implementation Details

Training the CNN model for comprint extraction involves two main steps: (1) pretraining a CNN to estimate the JPEG compression noise, and (2) using this pretrained CNN as initialization for the subsequent Siamese training process that optimizes the fingerprints.

In more detail, the CNN is pretraining to estimate the compression artifacts. For this, we use a dataset of uncompressed images and corresponding JPEG-compressed images of various qualities. The CNN gets JPEG-compressed images as input, and is trained to output the corresponding compression noise. As a distance metric, we use the Euclidean distance.

Then, the pretrained CNN weights are used to initialize the CNN in Siamese training. For each pair of input images, the CNN should extract fingerprints that have a large distance if the compression of the pair is different, while it should have a small/zero distance when the same compression is used. As such, the loss value during Siamese training is calculated based on the squared Euclidean distance between patch pairs. In more detail, the Euclidean distance between each pair $$k_{i,1}$$ and $$k_{i,2}$$ (pair i) is calculated as follows:

(1)

After calculating this distance for each pair in the batch (with n pairs), we convert the distances into a probability distribution p. This is done by using the softmax, in the following way:

(2)

This softmax processing converts all distances to the interval $$[0,1]$$, which can be compared to the labels when calculating the cross-entropy loss for each batch.

Finally, after training, we can use the CNN to transform an image under investigation into a compression fingerprint or comprint. A visual overview of this process is presented in Fig. 2.

Training Methodology

The RAISE database [10] was used as a basis for the training and validation datasets. The database consists of high-resolution images capturing a variety of subjects. We randomly selected 1000 images for training, and an additional 100 for validation. We preprocessed this image by converting them to grayscale and resizing them to $$200\times 200$$ pixels, in line with the similar DnCNN setup [46]. The use of small resolution training images ensures that each patch has variation and textured regions that cause compression artifacts.

To augment the training set, we performed JPEG compression and on-the-fly cropping. In each pair, the first patch is compressed using either a random JPEG QF or a non-standard quantization table (from a predefined list). Then, the second patch of the pair was compressed with either the same or a different QF/quantization table (with a probability of $$p=0.5$$). The CNN was trained with 10 different QFs and 9 non-standard quantization tables used in the Adobe Photoshop editing software (which is commonly used in forgeries). The 10 QFs are: 90, 80, 70, 60, 50, 40, 35, 30, 25, 20, and the non-standard quantization tables correspond to Photoshop qualities 12 (very high quality) to 4 (low quality). A denser quality spacing was used for lower QFs due to the larger difference between images compressed with slightly different QFs at lower values, as a result of the higher amount of noise introduced. The compression was performed using libjpeg-turbo for the standard QFs, and with Photoshop CS4 v11.0 for the non-standard quantization tables.

For the implementation of the CNN, we used $$d=20$$ groups of layers. The training was done for 50 epochs (for both the pretrained and Siamese-trained CNN) with 4000 batches per epoch and 200 pairs of patches per batch, with a patch size of $$48\times 48$$. Moreover, we used the ADAM optimizer. Future work may explore more training setups, including the incorporation of other image compression standards, more quantization tables and JPEG implementations.

The code and data are publicly available for reproducibility.¹

3.2 Forgery Localization

The comprint may already provide an indication of which regions were compressed differently, but it does not perform a clear forgery localization. Therefore, we apply Splicebuster, a blind localization algorithm [9]. The algorithm assumes that there are only two regions to be segmented, i.e., two regions that were compressed differently. By using the assumption that the pristine and manipulated regions underwent different compression, we can utilize these regions for forgery localization.

The localization algorithm is illustrated and presented in Fig. 4. To begin, the method extracts co-occurrence-based subtractive-pixel-adjacency-matrix (SPAM) features from the comprint [34]. It’s worth noting that the high-pass filter from Splicebuster is not applied. Instead, we applied a normalization to the fingerprint before transforming it into a heatmap. Then, we use these multi-dimensional SPAM features as input for an Expectation-Maximization (EM) algorithm. This step determines model parameters for two regions (i.e., a real and forged one), and assigns each pixel location a probability of belonging in each of these two regions. This produces a pixel-level continuous-valued segmentation map, indicating the forgery probability. These pixel values can then be visualized as a heatmap. As an example, Fig. 1c shows the heatmap of the comprint in Fig. 1b.

A model diagram has the following flow, color gradient compression fingerprint, feature extraction, comprint features layers, expectation-maximization, and heatmap with 2 spots.

Fig. 4

High-level overview of the forgery localization algorithm. Features are extracted from the comprint, which are then fed to an EM algorithm to cluster them into a heatmap of forgery probability

As a final step, we can apply an image-level forgery detection step to transform a heatmap into a binary decision (real/manipulated). In our experiments (see Sect. 4), we extract the 99.5th percentile highest value of the heatmap and compare that to a threshold, resulting in a binary decision of forgery detection.

3.3 Fusing Comprint and Noiseprint

Comprint and Noiseprint are two algorithms that both use the Splicebuster-based localization process (described in Sects. 3–3.2). The main difference is that Comprint uses compression artifacts, while Noiseprint uses camera-specific noise. To take advantage of both of these complementary approaches, we propose to fuse Comprint and Noiseprint. We refer to this combined method as Comprint+Noiseprint.

The fusion process is outlined in Fig. 5. First, the method calculates co-occurrence-based features from both comprint and noiseprint. As a result, we obtain a pair of multi-dimensional SPAM features, from both fingerprints. These features are stacked and given to the EM algorithm for segmentation. In theory, this approach of stacking fingerprint features for fusion features can be applied to other methods as well. If the fingerprints contain complementary characteristics, the performance is expected to improve.

A model diagram has the following flow, comprint and noiseprint, feature extraction, comprint features and noiseprint features layers, concatenation, comprint + noiseprint features combined layers, expectation-maximization, and heatmap of comprint + noiseprint with 2 spots.

Fig. 5

High-level diagram of the fusion between the complementary fingerprints comprint and noiseprint

4 Evaluation

This section evaluates Comprint’s performance to detect and localize forgeries. First, Sects. 4–4.1 discusses the measures used to evaluate the performance. Then, the performance for differences in JPEG parameters is evaluated in a controlled environment of artificial datasets, in Sects. 4–4.2. Next, Sects. 4–4.3 measures the performance on realistic datasets of pristine and manipulated images.

4.1 Measures

Pixel-Level Forgery Localization Measure

We can transform the continuous-valued heatmap to a binary pixel-level forgery localization by comparing each pixel value to a threshold. This binary heatmap can then be compared to a binary ground truth mask, using metrics such as precision and recall, which use the True Positive (TP) rate, False Positive (FP) rate, and False Negative (FN) rate. In this paper, we calculate the Matthew’s Correlation Coefficient (MCC) and the F1 score. The MCC is the cross-correlation coefficient between the decision and the ground truth, and is calculated as:

(3)

The F1 score is calculated as:

(4)

A higher MCC and F1 score (i.e., near 1) is considered better than a lower score (i.e., near $$-$$1 for the MCC, or near 0 for the F1 score).

It is important to note three aspects of this evaluation method. First, the interpretation of the F1 score depends on the ratio of manipulated/pristine pixels in the image. When for example 50% of the pixels are pristine and 50% are manipulated, the minimum F1 score is approximately 0.67. Such a relatively high score is usually interpreted as a rather good F1 score in typical scenarios where the manipulated region is much smaller than the pristine one [8, 26]. In Sects. 4–4.2, we are working with composite images where the ratio of manipulated/pristine pixels is 50/50. Therefore, we do not use the F1 score in that section, but rather the MCC score, which is easier to interpret. Second, to ensure that the threshold value does not affect the evaluation, we report the maximum F1 score over all thresholds. Third, Comprint segments the image in regions that show different compression characteristics. We assume that this difference in compression-traces is caused by a forgery, but the choice of assigning a pristine or manipulated label to each region is arbitrary. To account for this, we consider both the ground truth and inverted ground truth, and report only the maximum score.

Image-Level Forgery Detection Measure

As explained in Sects. 3–3.2, to perform image-level forgery detection, we need to extract a global statistic from the heatmap, and compare it to a threshold to get a binary decision (real/forged). In this study, we use the 99.5th percentile highest value of the heatmap as the global statistic. This value is then compared to a threshold. To avoid dependence on a specific threshold, the TP rate is plotted against the FP rate for a range of thresholds for each dataset, resulting in a Receiver Operating Characteristic (ROC) curve. Finally, the performance measure is calculated as the Area Under the ROC Curve (AUC). A higher AUC score (i.e., near 1) demonstrates a better performance than a lower score.

Existing state-of-the-art algorithms have used different global statistics for image-level forgery detection. For instance, ManTraNet [39] and EXIF-SC [16] use the average likelihood of the heatmap. However, when the forged area is small, the average can be significantly lower. Using the maximum value, as done in DCT [42], solves this issue. However, the maximum can be significantly influenced by outliers. This is why we propose to use the 99.5th percentile highest value as a global statistic.

In our experiments, the global statistic used in the original reference methods (ManTraNet, EXIF-SC, DCT) [16, 39, 42] was utilized. When the global statistic was not specified (RRU-Net) [5], the 99.5th percentile highest value was used. Note that image-level forgery detection results were not calculated for reference methods that only proposed pixel-level forgery localization (BLK, NADQ, ADQ, CAGI, DJPEG, SPAN, CR-CNN) [6, 7, 15, 17, 23, 33, 41]. An exception was made for the Splicebuster [9] and Noiseprint [8] methods, as Comprint is based on these methods. In these methods, we use the 99.5th percentile highest value as well.

4.2 Artificial Dataset: Differences in JPEG Parameters

This section evaluates the impact of the QF, the DCT implementation, the use of non-standard quantization tables, and recompression. In order to analyze this, we created an artificial dataset of composite images. That is, we selected 50 random images from the RAISE dataset [10] as a test set, resized them to $$1000\times 1000$$ pixels, and compressed these using a variety of JPEG parameters. Then, from each test image, we created composite images where the left side of the image was compressed with a certain JPEG parameter set (number 1), and the right side of the image with another parameter set (number 2). More specifically, we analyzed the effect of changing the following parameters: QF (i.e., standard quantization table), non-standard quantization table, and DCT implementation (integer, fast, or float). These compressed images were created using libjpeg-turbo. By changing the parameter sets in composite images, the compression fingerprint should be different for the left and right side. Additionally, we recompressed some composite images to measure how well we can distinguish the left and right side in challenging circumstances. In this way, we can measure the robustness of our scheme in a controlled environment.

As mentioned in Sects. 4–4.1, the F1 score is hard to interpret for composite images with a 50/50 ratio of manipulated/pristine images. Hence, we only use the MCC to evaluate the performance of the composite images of the artificial dataset.

Quality Factor

Figure 6 shows the impact of the QF difference or step size of the two halves of the composite images. That is, the left half of the image has a QF ranging from 50 to 100 (QF1, plotted on the x-axis), and the right half has a QF that is either 10, 5, 2, or 1 larger than the left side (depending on the step size). When the step size is high (e.g., 10 or 5), the performance is very good (i.e., a high MCC score). However, when the step size decreases (e.g. 2 or 1), the performance decreases significantly. In other words, the method cannot sufficiently distinguish small QF differences. This is not surprising, as the method was trained on QF differences of 5 and more. However, it should be noted that small QF differences can be better distinguished when the QFs are higher (i.e., above 90). Future work should investigate whether training with lower QF differences increases the robustness at small QF differences sufficiently. This is not self-evident, since distinguishing subtle QF differences is a challenging problem. Additionally, future work should investigate why there is a drop in performance around $$QF1=65$$ and $$QF1=90$$ when the step size is 5 or 10.

A multi-line graph, titled influence of Q F step size, of M C C versus Q F 1. It plots the overlapping and intersected step size = 10, 5, 2, and 1 lines with a fluctuating trend and peaks and dips.

Fig. 6

Influence of JPEG QF step size on performance (MCC). Reducing the step size decreases the performance

Non-standard Quantization Table

Figure 7 shows the impact of creating composite images using non-standard quantization tables that were not seen during training. We selected 11 random non-standard quantization tables (provided from the work of Park et al. [33], ID 140–150) and created $$11 \cdot 10 = 110$$ composite images for each of the 50 test images, to create all possible pairs between the tables. These non-standard quantization tables have corresponding approximate quality factors between 67.18 and 95.68 (according to the JPEGSnoop tool [18]). Additionally, we took care to not select the non-standard quantization tables that Photoshop uses (as we used those tables during training).

A violin plot, titled performance for non-standard quantization tables, of M C C versus Q table 1. The q table 1 value of 150 has the highest M C C interquartile range and median, while the value of 146 has the lowest range and median.

Fig. 7

Influence of 11 random non-standard quantization tables (index 140 to 150) on performance (MCC)

In Fig. 7, the x-axis shows the quantization table id used in the left side of the image (QTable1). Because it would be unpractical to show a separate curve for each quantization table id used in the right side of the image (QTable2), we show the distribution of MCC scores for all 10 quantization tables that each QTable 1 is paired with in a violin plot. We notice that the mean MCC score is relatively high for all quantization tables, although there are outliers with low MCC scores for several quantization tables. This demonstrates that Comprint is able to distinguish non-standard quantization tables, even though it only saw standard quantization tables (i.e., QFs) and few non-standard quantization tables from Photoshop during training. As the performance can still be improved in some outlier cases, future work may investigate if including more quantization tables during training improves the performance of the outliers.

DCT Implementation

Figure 8 shows the impact of the JPEG DCT implementations on the performance. The two halves of the composite images contain a difference in QF, similar as in Fig. 6, but now we evaluate these differences for the three DCT implementations (i.e., integer, fast, and float). The float implementation is the most accurate but slowest, and the fast implementation is the least accurate and fastest. We also, only evaluated a QF step size of 5, and measured for only every 5 QF1 values (instead of for every QF1 value, as in Fig. 6). We can observe that all three DCT implementations perform approximately equally. Hence, even though Comprint was trained on the integer DCT version only, it works on all three implementations.

A multi-line graph of M C C versus Q F 1. It plots the overlapping integer, fast, and float lines with a fluctuating trend and peaks and dips.

Fig. 8

Influence of DCT implementation on performance (MCC). Although the method was trained on the integer DCT version, it works on all implementations

Robustness Against Recompression

Figure 9 shows the MCC values for two trained Comprint models on the test composite dataset with QF step size 5 that was additionally recompressed with QFs ranging from 50 to 100. In this way, we can measure the robustness against recompression. We again only measured the performance for every 5 QF1 values. First, Fig. 9a shows the performance for a model that did not see any recompression during training (i.e., it only saw a single compression step, as described in Sects. 3–3.1). We can see that this model is not resilient to recompression, with a significant decrease in performance even when recompressed with a Rec. QF of 95, which resembles visually lossless compression.

2 multi-line graphs of M C C versus Q F 1 labeled no recompression seen and recompression seen during training, respectively. Both graphs plot the no recompression, recompression Q F = 100, 95, 90, 80, 70, 60, and 50 lines with a decreasing and linear trend with fluctuations.

Fig. 9

Performance on recompressed dataset, for (a) a model that did not see recompression during training, and (b) one that did. Figures from Mareen et al. [27]

We additionally trained a model with random recompression during training, creating a recompression-aware model [3]. That is, during Siamese training the image pairs were recompressed with a QF in the set {50, 55, 60, 65, 70, 80, 90}, with a probability of 50%. Fig. 9b shows the performance of this model that did see recompression during training. We can see that this model is resilient to recompression, with a significant performance drop only observed when recompressed with a Rec. QF of 70 or lower.

Conclusion

From the artificial dataset evaluation, we can conclude that current Comprint method is robust against changes in JPEG parameters, even when they were not seen during training. However, the performance can still be improved for very subtle changes (such as small QF differences). Additionally, it is only robust against recompression when it is incorporated during training.

4.3 Realistic Datasets: Real and Manipulated Images

This section evaluates the performance on realistic datasets that contain both real and manipulated images. We used 5 evaluation datasets and compared the performance with 13 reference methods, described below. These results were first presented in previous work [26].

Realistic Evaluation Datasets

We selected 5 evaluation datasets used to compare the results of the proposed method with the reference methods. The datasets cover a wide range of manipulations and hence are good to measure the methods’ applicability to real-world scenarios. The datasets are described in Table 1 and include the estimated JPEG quality factor which gives an indication of the image quality in the datasets.

Table 1

Evaluation datasets

Dataset

#fake

#real

Format

Description

[11]

DSO-1

100

100

PNG

Only splicing

[47]

FaceSwap

879

1651

JPEG@39-100

Face swaps with FaceSwap-app

[29]

IMD2020

2010

414

PNG & JPEG@45-100

Various forgery types found on the internet

[22]

OpenForensics

18,895

N/A

JPEG@100

Synthetic face swapping

[12]

VIPP

62

69

JPEG@40-100

Uses double JPEG compression

Reference Methods

In our evaluation, we compare the results of Comprint to 13 state-of-the-art reference methods, which are classified into four categories as described in Sect. 2.

The first category comprises conventional model-driven methods, including BLK [23], DCT [42], NADQ [6], ADQ [7], and CAGI [17]. These methods all exploit JPEG artifacts, and their implementations were provided by Iakovidou et al. [17]. The second category includes the supervised CNN method, Splicebuster [9], which exploits traces left by in-camera processing instead of compression artifacts. The third category encompasses generic supervised CNNs, including DJPEG [33], RRU-Net [5], ManTraNet [39], SPAN [15], and CR-CNN [41], which are trained on a diverse range of manipulations. Finally, the fourth category consists of one-class deep-learning methods, EXIF-SC [16] and Noiseprint [8], that are trained on pristine data only, using Siamese networks.

Results

The images in the realistic datasets typically do not have the issue with class imbalance that the composite images of the artificial dataset have (i.e., 50/50 pristine/manipulated ratio, see Sects. 4–4.2). Instead, the forged region is typically much smaller than the pristine region. Therefore, the F1 score is easier to interpret, and is hence used as a measure for forgery localization performance here.

Tables 2 and 3 report the average F1 and AUC scores for pixel-level forgery localization and image-level forgery detection, respectively. For each dataset, we emphasized the three largest values in bold, underline, and italics, respectively. Note that the OpenForensics dataset does not contain any real image, and hence we could not calculate forgery-detection measures.

Table 2

Results of pixel-level forgery localization (avg. F1 score)

Model

DSO-1

FaceSwap

IMD2020

OpenFor

VIPP

Average

[7]

ADQ

0.530

0.426

0.446

0.675

0.572

0.530

[23]

BLK

0.449

0.097

0.267

0.262

0.411

0.297

[17]

CAGI

0.537

0.172

0.299

0.293

0.460

0.352

[42]

DCT

0.350

0.182

0.328

0.408

0.416

0.337

[6]

NADQ

0.247

0.037

0.170

0.114

0.248

0.163

[9]

Splicebuster

0.662

0.330

0.326

0.440

0.447

0.441

[33]

DJPEG

0.701

0.334

0.297

0.434

0.492

0.452

[5]

RRU-Net

0.360

0.064

0.336

0.203

0.349

0.262

[41]

CR-CNN

0.432

0.128

0.476

0.224

0.406

0.333

[39]

ManTraNet

0.538

0.153

0.324

0.653

0.354

0.404

[15]

SPAN

0.390

0.093

0.252

0.173

0.404

0.262

[16]

EXIF-SC

0.577

0.293

0.323

0.310

0.424

0.385

[8]

Noiseprint

0.812

0.309

0.397

0.672

0.556

0.549

Comprint

0.763

0.353

0.388

0.634

0.497

0.527

Comprint+Noiseprint

0.813

0.417

0.435

0.712

0.581

0.592

Table 3

Results of image-level forgery detection (AUC score)

Model

DSO-1

FaceSwap

IMD2020

VIPP

Average

[42]

DCT

0.409

0.569

0.600

0.653

0.558

[9]

Splicebuster

0.775

0.553

0.544

0.544

0.604

[5]

RRU-Net

0.497

0.507

0.565

0.512

0.520

[39]

ManTraNet

0.874

0.479

0.558

0.590

0.625

[16]

EXIF-SC

0.237

0.453

0.435

0.397

0.381

[8]

Noiseprint

0.848

0.537

0.548

0.586

0.630

Comprint

0.940

0.525

0.656

0.622

0.686

Comprint+Noiseprint

0.930

0.532

0.637

0.616

0.679

Comprint vs. Noiseprint

Both the Noiseprint and Comprint methods perform similarly, although Noiseprint has a slightly better performance for forgery localization and Comprint slightly wins for detection. This similar performance is due to their similar design, although it is important to note that their underlying assumptions are different.

Comprint vs. Splicebuster

The Comprint and Splicebuster method only differ in the input to the same localization method. Splicebuster uses high-pass filtering on the input image, whereas Comprint uses the compression fingerprint. On average, Comprint outperforms Splicebuster (both in terms of F1 and AUC score), demonstrating its potential.

Double JPEG Compression-Based Methods

Methods that use compression artifacts (ADQ, DCT, DJPEG, and Comprint) perform very well for the VIPP dataset, which is because the dataset was designed for double compression detection. On most datasets, ADQ is a top performer for forgery localization, and DCT a top performer for forgery detection. However, both methods have poor performance on DSO-1, in which the images are losslessly compressed as PNGs. This indicates that one should not solely rely on double JPEG compression traces.

Non-standard Quantization Tables

Model-based methods using compression artifacts (ADQ, BLK, CAGI, DCT, NADQ) do not perform well on DSO-1, while the data-driven DJPEG method that also uses compression artifacts performed better. We suspect that this is because DJPEG was trained using a wider range of (non-standard) quantization tables, in contrast to model-based methods that only use standard QFs. A similar pattern was seen when Comprint was trained with only standard QFs. Thus, although Sects. 4–4.2 demonstrated that Comprint can distinguish non-standard quantization tables that were unseen during training, this analysis demonstrates that the performance can be further improved when incorporating Photoshop quantization tables during training. This further motivates the future work direction to include more quantization tables during training.

Generalization to Unseen Forgeries

All methods showed relatively low performance (below 0.5 F1 score) on the FaceSwap and IMD2020 datasets, indicating the need for further forgery localization research. Also, although CR-CNN performed best for forgery localization on the IMD2020 dataset, it does not perform well on the other datasets, indicating it does not generalize well. On the OpenForensics dataset, Noiseprint, Comprint, ManTraNet, and ADQ all performed relatively well. However, MantraNet performed poorly on the other datasets, highlighting the lack of generalization for supervised CNNs trained with manipulated images. Most notably, Comprint and Noiseprint performed consistently well across all datasets, demonstrating that these one-class training methods generalize well.

Combination of Comprint and Noiseprint

The average performance of Comprint (with an F1 score of 0.527) and Noiseprint (with an F1 score of 0.549) for pixel-level forgery localization improves when they are combined (resulting in an F1 score of 0.592). However, for image-level forgery detection, the individual performance of Comprint (with an AUC of 0.686) is slightly better compared to the combination (with an AUC of 0.679). An example shown in Fig. 10 illustrates the positive impact of combining Comprint and Noiseprint. Despite their relatively low individual F1 scores and the presence of false positive detections in their heatmaps, the fusion results in a higher F1 score and a clearer heatmap.

7 images. A has a photograph labeled forged image from open forensics of a woman and a man inside a house. B has an image labeled ground truth of a shield-shaped spot against a dark background. C and D have color gradient images labeled comprint and noiseprint with spots. E, F, and G have heatmaps.

Fig. 10

Example image (a) of the OpenForensics dataset and (b) its corresponding ground truth. The fingerprint and heatmap of (c, e) Comprint and (d, f) Noiseprint both do not perform well. In contrast, when fused (g) Comprint+Noiseprint they can accurately detect and localize the face forgery. Figures from Mareen et al. [26]

5 Limitations

Although Comprint and its fusion with Noiseprint perform competitively with the state of the art and are hence promising, the results in Sect. 4 demonstrate that there is still room for improvement. This section briefly discusses Comprint’s main weaknesses. The limitations described in this section are opportunities for future research.

Smooth Areas With Constant Pixel Values

A weakness of the current Comprint method is that it cannot extract a compression fingerprint in smooth image areas that do not contain any pixel variation. For example, in Fig. 11, the fingerprint is disrupted in the area of the overexposed window. This area is also clearly visible in the heatmap, which could make a forensic investigator believe that the area has been tampered with. In reality, it is simply because that region does not contain compression artifacts because it has a constant pixel value that was not affected by the quantization in the JPEG compression.

4 images. A has a photograph labeled forged image from V I P P of the interiors of an under-construction building. B has an image labeled ground truth of an inverted V-shaped spot against a dark background. C has the comprint with a noise filter. D has a heatmap with color gradient dots and shapes.

Fig. 11

Example highlighting a weakness of comprint: smooth areas without any compression artifacts or pixel variations can be detected as false positives. (a) Forged image from VIPP. (b) Ground truth. (c) Comprint. (d) Heatmap

Raw Images Without Compression

Comprint has the inherent weakness that it does not work when there were no compression artifacts before the manipulation. For example, when a raw image coming from a camera is manipulated before any compression happened, or if only lossless compression steps (e.g. PNG) have been performed.

Heatmap Extraction in Two Regions

The heatmap extraction of the current Comprint method clusters the image in two regions: a real and a fake region, corresponding to two regions containing a different compression history. However, it is also possible to have more than two regions with different compression histories. In this case, not all regions may be clustered in the fake region in the heatmap. For example, Fig. 12 has three regions: (1) a real one containing the two monkeys and the background, (2) a fake manipulation that adds the cigarette and lighter, and (3) the text that was added later. Although these three regions exhibit distinct properties in the fingerprint (Fig. 12c), they are only clustered in two regions in the heatmap (Fig. 12d). The region with the text is not highlighted in the heatmap, resulting in a false-negative detection. Future work should look into optionally clustering the fingerprint in more than two regions.

4 images. A has an image labeled forged image from I M D 2020 of 2 chimpanzees smoking in the forest with a text that reads is it lit, yeah it's lit. B has an image labeled ground truth with spots. C has the comprint image with color gradient spots. D has a heatmap with color gradient spots.

Fig. 12

Example highlighting a weakness of comprint: even when three clusters of fingerprints are present in the fingerprint, the heatmap will only cluster them in two. (a) Forged image from IMD2020. (b) Ground truth. (c) Comprint. (d) Heatmap

Robustness to Quality Reduction

Although Sect. 4.2 demonstrated that Comprint shows some robustness against recompression when it is incorporated during training, its resilience is limited. For example, in the experiments visualized in Fig. 9, the MCC drops significantly when the recompression QF is 70 or lower. Unfortunately, in-the-wild images under investigation are often shared multiple times on social media. In each sharing event, the image may have been recompressed to a lower quality, as well as downsampled to a lower resolution. In such circumstances, Comprint does not perform well, and providing robustness in such circumstances is hence a major reason for future work. For example, one could augment the training set using a larger variety of post-processing operations such as multiple recompression and downsampling steps. Alternatively, one could try to exploit the knowledge of the last recompression step in the forgery detection.

Vulnerability to Attacks

As the compression fingerprint is extracted using a deep-learning algorithm, it may be vulnerable to (adversarial) attacks [30]. Therefore, future research should evaluate the robustness against such attacks. For example, it should be investigated if the comprint can still meaningfully be extracted after methods that reduce JPEG compression artifacts have been applied to the image under investigation. This artifact reduction could be done using the pretrained model that was used for Comprint (see Sects. 3–3.1), or other specialized algorithms [37]. Other common adversarial attacks of CNNs include the Jacobian-based Saliency Map Attack (JSMA) [32] and the Fast Gradient Sign Attack (FGSM) [14].

Ethical Considerations

It is extremely important to use Comprint ethically during forensic investigations. In fact, drawing false conclusions may have strong implications in forensic investigations. That is, an investigator should carefully consider the limitations and potential vulnerabilities discussed in this section. Therefore, we advise investigators or fact checkers that use these tools to consult an expert on this matter before drawing conclusions. In any case, it is important to remember that forensic tools can never be 100% accurate, and thus their outputs should be also be handled as such when communicating externally about them.

6 Conclusion

This book chapter introduced Comprint, a novel approach for detecting and localizing image forgeries. The key contribution of the method is the utilization of compression fingerprints. Comprint was trained only with pristine data, compressed in various ways. Forgeries are identified by detecting inconsistencies in the compression fingerprint. The main advantage of the method is that it can detect manipulations that were not seen during training. In fact, it did not see any manipulation at all during training. Moreover, the performance of Comprint was boosted by fusing it with Noiseprint, which complements Comprint’s approach.

Our evaluation of Comprint’s performance showed its robustness against subtle changes in JPEG parameters such as a quantization factor differences, the use of non-standard quantization tables, and various DCT implementations. The results demonstrated that Comprint is capable of working with JPEG parameters unseen during training, although its performance decreases for extremely subtle parameter changes. Compared to 13 benchmark methods, Comprint (and its fusion with Noiseprint) demonstrated superior performance in forgery detection and localization. Despite the remaining challenges posed by in-the-wild forgery detection, Comprint in its current form can provide valuable assistance in multimedia forensics.

Acknowledgements

This work used computational resources (imec iLabt & STEVIN Supercomputer Infrastructure) provided by Ghent University, imec, the Flemish Supercomputer Center (VSC), the Hercules Foundation, the Flemish Government department EWI, and the University Federico II of Naples.

References

1.

Barni, M., Bondi, L., Bonettini, N., Bestagini, P., Costanzo, A., Maggini, M., Tondi, B., Tubaro, S.: Aligned and non-aligned double JPEG detection using convolutional neural networks. J. Vis. Commun. Image Represent. 49, 153–163 (2017)Crossref

2.

Barni, M., Nowroozi, E., Tondi, B.: Higher-order, adversary-aware, double jpeg-detection via selected training on attacked samples. In: 2017 25th European Signal Processing Conference (EUSIPCO), pp. 281–285 (2017). https://​doi.​org/​10.​23919/​EUSIPCO.​2017.​8081213

3.

Barni, M., Costanzo, A., Nowroozi, E., Tondi, B.: CNN-based detection of generic contrast adjustment with jpeg post-processing. In: 2018 25th IEEE International Conference on Image Processing (ICIP), pp. 3803–3807 (2018). https://​doi.​org/​10.​1109/​ICIP.​2018.​8451698

4.

Barni, M., Kallas, K., Nowroozi, E., Tondi, B.: CNN detection of GAN-generated face images based on cross-band co-occurrences analysis. In: 2020 IEEE International Workshop on Information Forensics and Security (WIFS), pp. 1–6 (2020). https://​doi.​org/​10.​1109/​WIFS49906.​2020.​9360905

5.

Bi, X., Wei, Y., Xiao, B., Li, W.: RRU-net: the ringed residual U-net for image splicing forgery detection. In: IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW), pp. 30–39 (2019). https://​doi.​org/​10.​1109/​CVPRW.​2019.​00010

6.

Bianchi, T., Piva, A.: Image forgery localization via block-grained analysis of JPEG artifacts. IEEE Trans. Inf. Forensics Secur. 7(3), 1003–1017 (2012). https://​doi.​org/​10.​1109/​TIFS.​2012.​2187516Crossref

7.

Bianchi, T., De Rosa, A., Piva, A.: Improved DCT coefficient analysis for forgery localization in JPEG images. In: IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 2444–2447 (2011). https://​doi.​org/​10.​1109/​ICASSP.​2011.​5946978

8.

Cozzolino, D., Verdoliva, L.: Noiseprint: a CNN-based camera model fingerprint. IEEE Trans. Inf. Forensics Secur. 15, 144–159 (2020). https://​doi.​org/​10.​1109/​TIFS.​2019.​2916364Crossref

9.

Cozzolino, D., Poggi, G., Verdoliva, L.: Splicebuster: a new blind image splicing detector. In: IEEE International Workshop on Information Forensics and Security (WIFS), pp. 1–6 (2015). https://​doi.​org/​10.​1109/​WIFS.​2015.​7368565

10.

Dang-Nguyen, D.T., Pasquini, C., Conotter, V., Boato, G.: RAISE: a raw images dataset for digital image forensics. In: 6th ACM Multimedia Systems Conference, pp. 219–224 (2015)

11.

de Carvalho, T.J., Riess, C., Angelopoulou, E., Pedrini, H., de Rezende Rocha, A.: Exposing digital image forgeries by illumination color classification. IEEE Trans. Inf. Forensics Secur. 8(7), 1182–1194 (2013). https://​doi.​org/​10.​1109/​TIFS.​2013.​2265677Crossref

12.

Fontani, M., Bianchi, T., De Rosa, A., Piva, A., Barni, M.: A framework for decision fusion in image forensics based on Dempster–Shafer theory of evidence. IEEE Trans. Inf. Forensics Secur. 8(4), 593–607 (2013). https://​doi.​org/​10.​1109/​TIFS.​2013.​2248727Crossref

13.

Fridrich, J., Goljan, M.: Robust hash functions for digital watermarking. In: Proceedings International Conference on Information Technology: Coding and Computing (Cat. No. PR00540), pp. 178–183 (2000). https://​doi.​org/​10.​1109/​ITCC.​2000.​844203

14.

Goodfellow, I.J., Shlens, J., Szegedy, C.: Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 (2014)

15.

Hu, X., Zhang, Z., Jiang, Z., Chaudhuri, S., Yang, Z., Nevatia, R.: SPAN: spatial pyramid attention network for image manipulation localization. In: European Conference on Computer Vision (ECCV), pp. 312–328 (2020)

16.

Huh, M., Liu, A., Owens, A., Efros, A.A.: Fighting fake news: image splice detection via learned self-consistency. In: European Conference on Computer Vision (ECCV) (2018)

17.

Iakovidou, C., Zampoglou, M., Papadopoulos, S., Kompatsiaris, Y.: Content-aware detection of JPEG grid inconsistencies for intuitive image forensics. J. Vis. Commun. Image Represent. 54, 155–170 (2018). https://​doi.​org/​https://​doi.​org/​10.​1016/​j.​jvcir.​2018.​05.​011Crossref

18.

Impulse Adventure: JPEGSnoop v1.8.0. https://​github.​com/​ImpulseAdventure​/​JPEGsnoop (2017) [Online; Accessed 10 Feb 2023]

19.

Korus, P.: Digital image integrity – a survey of protection and verification techniques. Digit. Signal Process. 71, 1–26 (2017). https://​doi.​org/​https://​doi.​org/​10.​1016/​j.​dsp.​2017.​08.​009, https://​www.​sciencedirect.​com/​science/​article/​pii/​S105120041730193​8

20.

Kwon, M.J., Yu, I.J., Nam, S.H., Lee, H.K.: CAT-Net: compression artifact tracing network for detection and localization of image splicing. In: IEEE Winter Conference on Applications of Computer Vision (WACV), pp. 375–384 (2021). https://​doi.​org/​10.​1109/​WACV48630.​2021.​00042

21.

Lai, S., Böhme, R.: Block convergence in repeated transform coding: Jpeg-100 forensics, carbon dating, and tamper detection. In: 2013 IEEE International Conference on Acoustics, Speech and Signal Processing, pp. 3028–3032 (2013). https://​doi.​org/​10.​1109/​ICASSP.​2013.​6638214

22.

Le, T.N., Nguyen, H.H., Yamagishi, J., Echizen, I.: Openforensics: large-scale challenging dataset for multi-face forgery detection and segmentation in-the-wild. In: IEEE/CVF International Conference on Computer Vision (ICCV), pp. 10097–10107 (2021). https://​doi.​org/​10.​1109/​ICCV48922.​2021.​00996

23.

Li, W., Yuan, Y., Yu, N.: Passive detection of doctored JPEG image via block artifact grid extraction. Signal Process. 89(9), 1821–1829 (2009). https://​doi.​org/​https://​doi.​org/​10.​1016/​j.​sigpro.​2009.​03.​025Crossref

24.

Lin, X., Li, C.T.: Refining PRNU-based detection of image forgeries. In: 2016 Digital Media Industry Academic Forum (DMIAF), pp. 222–226 (2016). https://​doi.​org/​10.​1109/​DMIAF.​2016.​7574937

25.

Lin, Z., He, J., Tang, X., Tang, C.K.: Fast, automatic and fine-grained tampered JPEG image detection via DCT coefficient analysis. Pattern Recogn. 42(11), 2492–2501 (2009). https://​doi.​org/​https://​doi.​org/​10.​1016/​j.​patcog.​2009.​03.​019Crossref

26.

Mareen, H., Vanden Bussche, D., Guillaro, F., Cozzolino, D., Van Wallendael, G., Lambert, P., Verdoliva, L.: Comprint: image forgery detection and localization using compression fingerprints. In: Proc. Int. Conf. on Pattern Recognition (ICPR) (2022)

27.

Mareen, H., Vanden Bussche, D., Van Wallendael, G., Luisa Verdoliva, P.L.: Training data improvement for image forgery detection using comprint. In: Proc. Int. Conf. on Consumer Electronics (ICCE) (2023)

28.

Mayer, O., Stamm, M.C.: Accurate and efficient image forgery detection using lateral chromatic aberration. IEEE Trans. Inf. Forensics Secur. 13(7), 1762–1777 (2018)Crossref

29.

Novozámský, A., Mahdian, B., Saic, S.: IMD2020: a large-scale annotated dataset tailored for detecting manipulated images. In: IEEE Winter Applications of Computer Vision Workshops (WACVW), pp. 71–80 (2020). https://​doi.​org/​10.​1109/​WACVW50321.​2020.​9096940

30.

Nowroozi, E., et al.: A survey of machine learning techniques in adversarial image forensics. Comput. Secur. 100, 102092 (2021). https://​doi.​org/​https://​doi.​org/​10.​1016/​j.​cose.​2020.​102092, https://​www.​sciencedirect.​com/​science/​article/​pii/​S016740482030365​5

31.

Nowroozi, E., Seyedshoari, S., Mohammadi, M., Jolfaei, A.: Impact of media forensics and deepfake in society. In: Breakthroughs in Digital Biometrics and Forensics, pp. 387–410. Springer, Berlin (2022)

32.

Papernot, N., McDaniel, P., Jha, S., Fredrikson, M., Celik, Z.B., Swami, A.: The limitations of deep learning in adversarial settings. In: 2016 IEEE European Symposium on Security and Privacy (EuroS&P), pp. 372–387. IEEE (2016)

33.

Park, J., Cho, D., Ahn, W., Lee, H.K.: Double JPEG detection in mixed JPEG quality factors using deep convolutional neural network. In: European Conference on Computer Vision (ECCV), pp. 656–672 (2018)

34.

Pevny, T., Bas, P., Fridrich, J.: Steganalysis by subtractive pixel adjacency matrix. IEEE Trans. Inf. Forensics Secur. 5(2), 215–224 (2010). https://​doi.​org/​10.​1109/​TIFS.​2010.​2045842Crossref

35.

Popescu, A., Farid, H.: Exposing digital forgeries in color filter array interpolated images. IEEE Trans. Signal Process. 53(10), 3948–3959 (2005). https://​doi.​org/​10.​1109/​TSP.​2005.​855406MathSciNetCrossref

36.

Rössler, A., Cozzolino, D., Verdoliva, L., Riess, C., Thies, J., Niessner, M.: Faceforensics++: learning to detect manipulated facial images. In: IEEE/CVF International Conference on Computer Vision (ICCV), pp. 1–11 (2019). https://​doi.​org/​10.​1109/​ICCV.​2019.​00009

37.

Stamm, M.C., Tjoa, S.K., Lin, W.S., Liu, K.R.: Undetectable image tampering through jpeg compression anti-forensics. In: 2010 IEEE International Conference on Image Processing, pp. 2109–2112. IEEE (2010)

38.

Verdoliva, L.: Media forensics and deepfakes: an overview. IEEE J. Sel. Top. Signal Process. 14(5), 910–932 (2020). https://​doi.​org/​10.​1109/​JSTSP.​2020.​3002101Crossref

39.

Wu, Y., AbdAlmageed, W., Natarajan, P.: ManTra-Net: manipulation tracing network for detection and localization of image forgeries with anomalous features. In: IEEE Conference on Computer Vision and Pattern Recognition (CVPR) (2019)

40.

Yan, C.P., Pun, C.M.: Multi-scale difference map fusion for tamper localization using binary ranking hashing. IEEE Trans. Inf. Forensics Secur. 12(9), 2144–2158 (2017). https://​doi.​org/​10.​1109/​TIFS.​2017.​2699942Crossref

41.

Yang, C., Li, H., Lin, F., Jiang, B., Zhao, H.J.: Constrained R-CNN: a general image manipulation detection model. In: IEEE International Conference on Multimedia and Expo (ICME), pp. 1–6 (2020)

42.

Ye, S., Sun, Q., Chang, E.C.: Detecting digital image forgeries by measuring inconsistencies of blocking artifact. In: IEEE International Conference on Multimedia and Expo, pp. 12–15 (2007). https://​doi.​org/​10.​1109/​ICME.​2007.​4284574

43.

Yerushalmy, I., Hel-Or, H.: Digital image forgery detection based on lens and sensor aberration. Int. J. Comput. Vis. 92, 71–91 (2011)Crossref

44.

Yu, N., Davis, L.S., Fritz, M.: Attributing fake images to GANs: learning and analyzing gan fingerprints. In: Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 7556–7566 (2019)

45.

Zhang, X., Wang, S.: Statistical fragile watermarking capable of locating individual tampered pixels. IEEE Signal Process. Lett. 14(10), 727–730 (2007). https://​doi.​org/​10.​1109/​LSP.​2007.​896436Crossref

46.

Zhang, K., Zuo, W., Chen, Y., Meng, D., Zhang, L.: Beyond a gaussian denoiser: residual learning of deep CNN for image denoising. IEEE Trans. Image Process. 26(7), 3142–3155 (2017). https://​doi.​org/​10.​1109/​TIP.​2017.​2662206MathSciNetCrossref

47.

Zhou, P., Han, X., Morariu, V.I., Davis, L.S.: Two-stream neural networks for tampered face detection. In: IEEE Conference on Computer Vision and Pattern Recognition Workshops (CVPRW), pp. 1831–1839 (2017). https://​doi.​org/​10.​1109/​CVPRW.​2017.​229

Footnotes

1

Comprint’s source code can be found at https://​github.​com/​IDLabMedia/​comprint.

© The Author(s), under exclusive license to Springer Nature Switzerland AG 2024

E. Nowroozi et al. (eds.)Adversarial Multimedia ForensicsAdvances in Information Security104https://doi.org/10.1007/978-3-031-49803-9_3

Good or Evil: Generative Adversarial Networks in Digital Forensics

Maryna Veksler1   and Kemal Akkaya1  

(1)

Advanced Wireless and Security (ADWISE) Lab, Florida International University, Miami, FL, USA

Maryna Veksler (Corresponding author)

Email: mveks001@fiu.edu

Kemal Akkaya

Email: kakkaya@fiu.edu

Keywords

Deep fakesMultimedia forensicsMachine and deep learningImage and video forensicsCybersecurity

1 Introduction

The widespread availability of smart devices in recent years caused a colossal increase in the usage of multimedia data. Everyday users around the world create and share enormous amounts of various content such as video, images, and audio. However, the improvements in technological approaches opened new possibilities to compromise the multimedia data via fake content creation, data manipulation and altering. Subsequently, a large number of forensic methods have been proposed to identify the authenticity of digital data and its origin.

To effectively identify counterfeited data, forensic examiners rely on the analysis of the traces left by alteration operations [57]. Traditional forensic techniques use statistical tools to evaluate whether the distribution of multimedia data contains any abnormal deviations [81]. These abnormalities are often specific to the data alteration method and are used to distinguish between the modified and unaltered data. At the same time, forensic examiners can use more advanced machine and deep learning (ML/DL) techniques, which allow for faster and more precise data analysis [14]. Since manipulations on digital data often leave insignificant yet persistent traces, the DL-based forensic classifiers can exploit this property to robustly extract artifacts that are foreign to the original data. Moreover, the research community is constantly looking for ways to further improve the accuracy of forensic classifiers by designing complex DL models and using more comprehensive datasets.

Different from the forensic examiners, the adversaries are developing new methods for anti-forensics. The majority of the existing anti-forensic techniques focus on removing or hiding the artifacts created due to manipulation operations using statistical tools [20, 50, 100]. Thus, these approaches require extensive knowledge of the domain and are time-consuming due to the uniqueness of each case. To address these shortcomings, adversaries utilize DL models to automatically and quickly generate fake data to fool classifiers. One example is high-quality deep fakes created using generative adversarial networks (GANs) [5]. Introduced in 2014 [38], GANs are DL models that can be used to create realistic synthetic data. Well-designed GANs are proven to be capable of generating a large number of adversarial samples quickly to conduct rapid attacks on the forensic classifier. At the same time, GANs can be used to modify the data itself in such a way that the changes are imperceptible by humans and cannot be easily recognized by statistical analysis [83]. Motivated by these examples, new GAN-based anti-forensic methods are on the rise.

Therefore, one of the aims of this chapter is to present the applications of GANs for anti-forensics purposes. While earlier GAN-based attacks have been designed exclusively for image manipulations, the flexibility of GANs provided a perfect opportunity to extend these methods to other applications such as the naturalization of computer graphics (CG) and audio alteration. Despite a limited number of approaches designed for other domains, GAN-based anti-forensics is demonstrated to be more effective in comparison to traditional manual methods used to hide the alteration artifacts. Furthermore, it can be applied in any domain that uses digital media data as the main source of information.

In addition to anti-forensics, we also discuss the methods which use GANs to improve the effectiveness of existing forensic classifiers. Often considered as a tool of the attacker, GANs can be adapted to train the forensic detector directly against generative models. Moreover, due to their capability to quickly generate new samples, GANs can be used to improve existing datasets used to train forensic detectors. Even though it is still to be seen whether GANs can be incorporated into the design of forensics approaches regularly, the existing work up-to-date indicates a huge potential and advantage of these methods.

Furthermore, this chapter provides a qualitative analysis of both forensic and anti-forensic GAN-based methods using common metrics specific to different digital domains. We also identify the benefits and shortcomings of the presented methods before offering a list of future potential usage of GANs for the above purposes.

This chapter is organized as follows: Sect. 2 provides background on forensic and anti-forensic life-cycle and GANs. In Sect. 3, we discuss the applications of GANs for anti-forensics. This includes the details of GAN-based attacks and their advantages. Subsequently, the usage of GANs to improve existing forensic detectors is described in Sect. 4. We summarize the advantages and shortcomings of using GANs for the benefit of both forensic and anti-forensic domains and discuss future research directions in Sect. 5. Finally, we conclude our work in Sect. 6.

2 Background

In this section, we provide an overview of the forensic, anti-forensics, and counter-anti-forensics methods. Furthermore, we discuss the structure of GANs, their sub-types, and architectural components.

2.1 Forensics vs Anti Forensics vs Counter-Anti Forensics

In the new realm, when digital data became a main source of information sharing, the demand for effective methods for data verification and analysis is as high as ever. While numerous forensic techniques have been proposed to establish information authenticity, the advancement of artificial intelligence (AI) technologies created new opportunities for adversaries. Specifically, AI models allow to create high-quality deep fakes [47] and remove traces of data tampering [83] to get around existing validation methods. Referred to as anti-forensics, these techniques pose a significant threat to traditional forensics.

The majority of multimedia forensic approaches operate by identifying distinct patterns or traces left by algorithms used to create and modify digital data. These techniques can be further classified into two categories based on whether the examiner applies analytical tools or deep learning (DL) algorithms. Recent examples of incorporating ML and DL algorithms into the tools for digital forensics demonstrate their high potential and benefit for investigation procedures [21]. While DL-based models are proven to be highly successful in detecting multimedia alterations compared to traditional analytical methods, they come with multiple design complexities. First, the system requires a large amount of relevant data which has to be both diversified yet homogeneous such that an algorithm can learn to generalize correct patterns. Next, the model needs to be developed and trained via multiple iterations, which requires the availability of high-power computing resources and time. Finally, forensic classifiers are often designed for a singular problem (i.e., either filtering detection or source camera identification), which adds complexity to the data verification process on a larger scale. These challenges cause forensic community to design the official procedural guidelines for investigations based on the traditional data analysis. For example, best practice manuals established by European Network of Forensic Science Institutes (ENFSI) for digital imaging [2, 4] and audio analysis [1] contain mostly statistical based approaches. Subsequently, anti-forensics methods work on the principle of removing or modifying the traces of data manipulation. Similar to the forensic classifier’s limitations, the anti-forensic system is trained to perform specific tasks such as generation of human faces deep fakes or removal of camera-specific noiseprints [25] and requires high-quality datasets.

In general, digital anti-forensics can be separated into two categories based on its purpose [26]. The first category is targeted anti forensics or white-box. It requires an adversary to have prior knowledge about a forensic classifier and possess the victim’s data to produce a high-quality forgery. Its main goal is to trick the classifier using handcrafted impersonation. Black box approach corresponds to the second category of anti-forensics. In this case, an attacker creates a forgery with the purpose to mislead and confuse the classifier by disrupting its operation and lowering its accuracy.

As anti-forensics becomes more advance, forensics investigators are faced with a new challenge to recognize these attacks and strengthen existing methods accordingly. This process is referred to as counter anti-forensics. The success of the latter requires a detailed analysis of the existing anti-forensic methods combined with the procedures to integrate the improvements into existing forensic systems [65]. Combined, forensic, anti-forensics, and counter anti-forensics create a closed life cycle loop such that anti-forensic is developed based on the forensics and stimulates the advancement in the counter anti-forensics, which is then integrated with forensics. Figure 1 illustrates the cyclic relationships between forensic, anti-forensic, and counter anti-forensics.

A relationship diagram. Forensics includes analysis of the operation-specific features and focus on accuracy improvement. Counter anti-forensics includes identifying the features specific to the forged or altered data. Anti-forensics includes removing or modifying, the traces of data alteration.

Fig. 1

Diagram of the relations between forensics, anti-forensics, and counter anti-forensics

2.2 Generative Adversarial Networks

Generative adversarial network (GANs) are highly efficient ML algorithms used to create a high quality synthetic content [38]. The original implementation consists of two models—discriminator, D and generator, G. These components are designed in a competition manner and try to constantly outperform each other. Specifically, G generates samples that closely resemble original data, while D attempts to accurately identify the generated data. As indicated in Fig. 2, two networks are trained alternately and adjusted based on each other’s performance until G is capable of producing the data indistinguishable from real samples. The design of discriminator is usually derived based on the existing forensic classifier or it is designed to closely mimic the classifier’s behavior. This approach ensures that the generator is trained against the strong opponent to increase the chances for generated data to fool forensic system.

A block diagram for vanilla G A N. Random input is followed by generator, fake sample, discriminator with real sample, fake or real, and backpropagation.

Fig. 2

Vanilla GAN

Classification of GANs

In recent years, the research community developed more complex architectures built upon the vanilla GAN structure in Fig. 2. Firstly, GANs can be classified based on the input type. Figure 3a demonstrates the implementation of conditional GAN (CGAN). Compared to vanilla GAN, CGAN uses additional contextual information such as class labels, data distribution, or modality variation. The main advantages include (1) a capability to generate data with more specificity and (2) faster convergence. Another popular application of GANs refers to networks that attempt to convert data from domain X into domain Y. Figure 3b indicates the architecture of pix2pix GAN [44] used for the domain translation of various multimedia data. Generally applied for image-to-image translation, its architecture can be adjusted to accommodate merely any data type such as text or audio.

2 block diagrams for G A N types. a. Random input and label are followed by generator, fake sample and label, discriminator with real sample and label, fake or real, and backpropagation. b. Input data X is followed by generator, real and fake samples X and Y, discriminators, and fake or real.

Fig. 3

Types of GAN based on the input types. (a) Conditional GAN. (b) Domain translation

GANs also vary based on the number of independent generators and discriminators within the network. Figure 4a illustrates an extended generative framework for domain translation tasks, namely CycleGAN [106]. It consists of two discriminator-generator pairs for each domain. The framework adapts the principle of cycle consistency such that the data from domain X converted to domain Y and then reconstructed back to domain X should be identical. The significant difference of this network compared to others is that its discriminators are configured to do the classification task based on the domain, rather than simply distinguish real data from fake.

3 block diagrams for G A N types. a. Input X or Y is followed by generators X 2 Y and Y 2 X, fake samples X or Y, reconstructed samples X or Y, and discriminators X and Y. b. A generator is followed by discriminators 1 and 2. c. Generators 1 and 2, and 2 fake samples are followed by discriminator 1.

Fig. 4

Type of GAN based on the number of discriminators and generators. (a) CycleGAN, (b) D2GAN, (c) MADGAN

Multiple GANs can also be employed to stabilize the training process and improve the backpropagation feedback provided to the generator. Figure 4b demonstrates the architecture of the dual discriminator GAN (D2GAN) [62]. The architectures of G and both discriminators can be selected based on the requirements, allowing to design each D that are best suited for the different classification tasks (e.g., object classification and histogram distribution). Similar to having multiple discriminators, a GAN can have multiple generators operating to discover various modes of the image (i.e. MADGAN [55]) as depicted in Fig. 4c).

While it is important to select an optimal architecture based on a given task, the most important component when developing a GAN framework is its loss function. The loss in GAN is designed to be a joint between generator and discriminator networks. Introduced in the first GAN, min-max loss [38] is derived from the cross-entropy between real and generated samples and is considered to be the default function. The discriminator’s goal is to maximize the loss using Eq. 1, based on its ability to distinguish fake and real samples correctly. Since the generator cannot directly affect E$${ }_{\mathrm {x}}$$log(D(x)) term, its goal is to minimize E$${ }_{\mathrm {z}}$$log(1-D(G(z))) based on its ability to successfully fool the discriminator.

(1)

GAN Loss Functions

Although min-max loss is considered a standard function when designing GAN, the research identifies multiple challenges that cause network failures and poor performance [8]. Since the architecture of discriminator and/or generator models is often based on the Convolutional Neural Network (CNN) structure, GANs may experience a vanishing gradient problem, which refers to the cases when the discriminator outperforms the generator by a large margin imposing heavy penalties on the latter. Another issue is related to situations when either one of GAN models converges too quickly and causes the other one to provide meaningless feedback. Finally, GANs are often affected by the mode collapse problem which occurs when the generator begins to produce similar outputs, instead of diversified data. To address these challenges, several variations of GAN loss functions can be used. The modified min-max loss function was proposed as a solution to the vanishing gradient and the generator’s early saturation in the training. Based on the original min-max loss, it forces the generator to maximize the value of the discriminator probabilities and expressed as $$-log(D(G(z)))$$.

Furthermore, Wasserstein loss has been introduced in [39] as a solution to the vanishing gradient and mode collapse. Unlike the standard loss function, it enables the discriminator to output any number indicating the score for the data, essentially converting the classification problem to the regression domain. During the training, the discriminator attempts to maximize the difference between values it generates for real and fake data using $$D(x) - D(G(Z))$$ function. At the same time, the generator maximizes the discriminator’s outputs when applied to the fake data as follows: $$D(G(Z))$$.

As GAN architecture became more complex, specialized loss functions were proposed. For example, Eq. 2 describes the loss function used to train the CGAN model. Based on the min-max function, it differs in such a way that both the generator and the discriminator are using conditional probability. This loss can be applied to any GAN when additional information is supplied along with the main input to both discriminator and generator.

(2)

2.3 Methodology

In this work, we focus on following research questions:

What are the design trends, benefits, and limitations of GAN-based anti-forensics?

How GANs can be applied to strengthen existing ML/DL systems in the scenarios of anti-forensic attacks?

We examined the literature on Google Scholar, Springer Link, ACM Digital Library, and IEEE Explore Digital Library using variations of the following concepts: (1) GAN or generative adversarial networks, (2) anti-forensics or counter-forensics, (3) forensic classifier improvement or detection improvement. We further split the resulting papers into two categories, GAN-based anti-forensics and GAN methods for ML classifier strengthening. Figure 5 reports details about the number of resulting papers. Papers discovered through Google Scholar are only included when they are not present in the other identified digital libraries.

A bar graph plots the number of articles found versus digital libraries. I E E E explore is at 13 followed by Springer Link at 4, Google Scholar at 4, and A C M digital library at 3.

Fig. 5

Research papers by digital libraries

3 GAN-Based Anti-forensics

In recent years, GANs attracted a lot of interest in anti-forensic domain. Most often used to create deep fakes, GAN models can be utilized to alter and modify the media data as a whole or partially. Since main concern of anti-forensics is how to effectively hide the distinct traces left by manipulation operations while preserving data content and quality, the principle of domain translation can be applied such that the altered data is translated to manifest the properties of the original. When designing and evaluating GAN-based anti-forensic approaches, an adversary follows the below requirements:

Undetectability. The generated data should not carry operation-specific patterns.

Data Quality. The generated data has to preserve the original content.

Persistence of Manipulation. The effects of the data manipulation should persist in generated data, while undetectable by forensic classifiers.

In addition to the above design principles, an advanced attacker may develop a more complex system that achieves transferability and scalability. In this case, the anti-forensic method can fool multiple forensic detectors (FD) and can be quickly adjusted based on the requirements (e.g., manipulation type), making an attack more dangerous. Table 1 provides the list of common metrics used to assess the robustness of a given anti-forensic method.

Table 1

Measurements used to evaluate the anti-forensic approaches

Measurement

Meaning

Domain-specific

Peak-signal-to-noise ratio (PSNR)

Quantifies the reconstruction quality of the data

Yes—image

Structural similarity index measure (SSIM)

Assesses the similarity between falsified and unaltered data

Yes—image

Perceptual evaluation of speech quality (PESQ)

Measures the quality of falsified audio

Yes—audio

Classifier degradation of the accuracy (CDA)

Indicates the success of anti-forensic attack in terms of AUC value. Values closer to 0.5 indicate a higher success rate

No

Successful Attack Rate (SAR)

Quantifies successful anti-forensic attacks

No

Transferability

Indicates whether the attack can be applied against multiple forensic detectors. Given a score based on the number of forensic classifiers tested against

No

Scalability

Indicates whether the method can be quickly changed based on the new requirements

No

We identified two categories of measurements used to evaluate anti-forensic approaches. Domain-specific measurements are selected to assess the quality of GAN-generated data. Peak-signal-to-noise ratio (PSNR) and structural similarity index (SSIM) are commonly used to assess image quality. Measured between $$-$$1 and 1, a higher SSIM value indicates a perfect similarity which reflects the differences between image pixel properties (i.e., contrast and structure). PSNR is used to measure the absolute error between pixels such that higher values indicate better quality of generated images. We select perceptual evaluation of speech quality (PESQ) algorithm which resides between $$-$$0.5 and 4.5 to assess the quality of audio data.

We also define four types of non-domain-specific measurements, which directly reflect the properties of the anti-forensic GAN system and its performance. In addition to transferability and scalability, we use classifier degradation of the accuracy (CDA) to measure the probability of the success of anti-forensic attacks in terms of Area Under the Curve (AUC) and successful attack rate (SAR) to quantify an overall probability of success of anti-forensic attacks. In this work, we provide SAR and CDA values based on the results provided in discussed papers. Since it results in a heterogeneous analysis of the performance of GAN anti-forensic methods, we set a specific baseline comparison between SAR and CDA. Thus, SAR of 100% corresponds to a 0.5 CDA score, while SAR of 0% is equivalent to either 0.0 or 1.0 CDA.

Anti-forensic GANs are often complex architectures with customized network components and loss functions. Specifically, additional discriminators can be introduced to the network to focus on specific statistical measurements of the data in combination with original classification discriminator. For example, an adversarial model can have a discriminator responsible for identifying the contrast enhancement operation based on the pixel data [79] or for analyzing the histogram distribution of the data [107]. In this section, we analyze GAN-based forensic approaches used in different domains.

3.1 Image Manipulation Anti-forensics

Image manipulation operation detection is a leading challenge in digital forensics. The difficulty lies in the high heterogeneity of the techniques applied to increase the image quality, hide the information, and modify the object within the image. Variety of traditional [20, 50, 100] and DL-based [15, 24] techniques have been developed to tackle this problem. The former employs the analysis of statistical features such as histogram distribution and pixel differences to identify traces of manipulation operations. The latter applies a probabilistic approach to extract pixel patterns persisting within the data for different manipulation. Thus, an adversary has to hide, remove, or overwrite the operation-specific artifacts to perform a successful anti-forensic attack.

Earlier works in the anti-forensic domain have mostly focused on a single operation applied to the image. However, the improvement of existing forensic classifiers drove the need for more robust adversarial methods. Table 2 lists popular manipulation techniques with their description. Traditional anti-forensic methods often leave specific artifacts that indicate not only the presence of the manipulation but also its type. Moreover, in cases of median filtering operations, there is a challenge to preserve the original content [19], while attempts to remove artifacts created due to the contrast enhancement operations may require changes in multiple domains. Thus, it becomes a necessity for an adversary to know the forensic mechanisms in place.

Table 2

Description of the most common image manipulation techniques

Manipulation

What is it?

Challenges

Detection methods

JPEG compression

Blocking artifacts that suppress the forensic analysis of the image

Requires manual removal of the specific artifacts

Image analysis in discrete cosine transform (DCT) and spatial domains

Median Filtering

Erasing the processing history of other image manipulation techniques.

Introduces streaking artifacts, which degrade image quality; requires knowledge of the targeted forensic algorithm

Statistical examination of the pixel matrices

Contrast Enhancement

Hiding the traces of image forgery

Introduces changes into pixel domain; requires addressing the artifacts left in pixel, histogram, and gray level co-occurrence (GLCM) domains

Analysis of the histogram distribution and GLCM using statistical methods and CNN algorithms

Source Camera Falsification

Changing the source camera model estimates using demosaicing approach

Leaves demosaic specific traces

Analysis of content-independent color dependencies in the residuals

Recently, new GAN-based anti-forensic techniques have been introduced [83] to effectively conceal the traces indicating various image manipulations. Domain-translation architectures became a starting point of the GAN-based image anti-forensics. Designed to convert data from one domain to another, these networks can be employed to remove the manipulation artifacts and make an image appear as an original on the pixel level. In this section, we describe and evaluate GAN-based approaches for various image manipulation techniques.

JPEG Anti-forensics

In [60], Luo et al. designed a JPEG compression anti-forensic attack as an image-to-image translation problem. In their work, a traditional GAN architecture is used, which contains one discriminator and one generator. The authors selected super-resolution GAN (SRGAN) [52] as a backbone for the generator structure, while the discriminator was built as a complex CNN model. Since JPEG compression affects the high-frequency domain of the image, an additional preprocessing layer is added to the discriminator, which stacks the input image with the same image processed by the high-pass filter. Furthermore, a customized set of loss functions is designed for the generator to accommodate the JPEG compression task. The losses are defined as follows: (1) pixel-wise loss to identify the difference between JPEG compressed and original image, which allows assessing the visual quality; (2) perceptual loss to complement the pixel-wise loss in the high-frequency domain; and (3) adversarial loss. The last one corresponds to the traditional min-max loss function used in GANs and co-exists with discriminator loss. The VGG-16 model [80] was selected as a forensic classifier for the experiments. The results of this work indicated that the proposed system achieves 90% SAR on average, independent of the image size and quality factor (QF) of JPEG compression. The designed approach demonstrated similar or better anti-forensic performance when compared to methods in [82] and [84] while preserving and even increasing the visual image quality. The authors in [86] proposed a similar approach for double JPEG anti-forensics, but only adversarial min-max loss was considered. Their framework produced high-quality images with SSIM above 0.91 and reduced the forensic detector accuracy from 98% to 58%.

Later technique developed by Wu et al. [92] further improved the method proposed in [60] by expanding the loss definition. Specifically, two additional loss functions were introduced in place of perceptual loss. High-frequency loss was designed based on the Euclidean distance concerning the differences in the DCT domain between the original and generated images to address the loss of high-frequency components. Since JPEG compression introduces a significant variance of DCT coefficients, the authors proposed to use calibration loss to minimize its effects. The anti-forensic method achieved an average SAR of 95% for different sizes of images and JPEG QF when tested against CNN-based classifier [14]. Moreover, it achieved an average of 50% CDA when tested against the conventional JPEG forensic methods [32, 51].

The work in [43], proposed AFDJ-GAN architecture that addresses the following challenges: (1) removing artifacts from pixel domain, (2) preserving visual image quality, and (3) applicability across different DL-based forensic detectors. The authors designed a three-component generator, which destroys the JPEG grid, reconstructs the image that does not have additional compression artifacts, and generates a simulated double-compressed JPEG image. The generator loss consists of reconstructed loss, which effectively calculates the Euclidean distance between reconstructed and uncompressed images and adversarial loss. For the discriminator, the paper uses a histogram based on the image AC coefficient as an input to classify the image. The proposed anti-forensic method was tested against three statistical [7, 11] and one DL-based [67] forensic detectors. The experiments demonstrated that AFDJ-GAN outperforms other anti-forensic techniques in terms of both SAR and image quality.

Table 3 summarizes performance measurements of single operation anti-forensic approaches for JPEG compression. The main advantage of GAN-based methods compared to the conventional alternatives is their ability to not only preserve but also enhance image visual quality. Moreover, approaches in [92] and [43] are proven to be transferable across different forensic detectors and scalable for different image sizes and JPEG QF. While a majority of GAN-based JPEG anti-forensic approaches show comparable performance, the work in [43] is the most appealing from the perspective of the highest maximum SAR and lowest system training time. On the other hand, the method proposed in [60] achieves the highest image quality, however, it was only tested against a single DL-based model. Compared to the traditional anti-forensic methods, GAN networks are more robust since (1) no prior knowledge about the forensic classifier is required and (2) custom loss functions can be adjusted to address the operation-specific artifacts left in high-frequency and spatial domains.

Table 3

Comparison of the GAN-based JPEG anti-forensic techniques

Approach

SAR

PSNR (dB)

SSIM

Dataset

Transferability

Training time (epochs)

[60]

84–96%

33.5–38.975

0.89–0.96

BossBase [13], BOWS [12]

No

50

[86]

42%

27.81–30.34

0.91–0.94

DIV2K [6]

No

Not specified

[92]

90.23–95.88%

33.36–35.21

0.905–0.935

BossBase, BOWS, UCID [78]

3

55

[43]

82–99.7%

34.14–37.61

0.905–0.95

BossBase, RAISE4K [29], DIV2K

4

20

Median Filtering Anti-forensics

The median filtering (MF) anti-forensics is often used to erase processing traces of other manipulation techniques such as JPEG compression. At the same time, it introduces new artifacts degrading image quality and can be easily distinguished by forensic detectors. While traditional anti-forensic approaches attempt to remove the clues of MF operations by stabilizing the pixel variations, they are limited by the adversary’s knowledge of the classifier framework. To address this challenge, Kim et al. [49] proposed domain translation GAN (Fig. 3b) which focuses on both visual and statistical image restoration. The proposed network was tested against scalar-based [20, 50, 100], ML-based [22, 46, 72, 103], and CNN-based [14, 23] forensic algorithms and achieved an average CDA of 0.345, 0.5, and 0.435 correspondingly. Despite promising results in fooling the classifier and high visual image quality, the authors concluded that the generator network failed to restore specific noises (e.g., salt-and-pepper), preventing the increase in forensic undetectability.

Recently, Wu et al. [93] proposed a new GAN-based MF anti-forensic framework, which uses cross-domain loss to improve the generator performance. The generator architecture applies high-pass filter concatenation operation between images and $$5 \times 5$$ residuals to preserve the high-frequency information. The authors propose a modified generator loss, which consists of three distinct components combined with adversarial loss. First, Huber loss is used to determine the differences between pixel values of the original and generated images as a combination of mean square error (MSE) and mean absolute error (MAE) values. Next, the difference between high-frequency DWT in low-high, high-low, and high-high sub-bands are calculated to express high-frequency coefficients loss. Finally, high-frequency sub-band variance loss is applied to reduce the gap between the generated and original images. The authors selected three types of forensics detectors, traditional [20, 50, 100], CNN-based [15, 24], and support vector machine (SVM) based [53, 101], to evaluate the performance of their anti-forensic framework. According to the results, the proposed method for MF anti-forensics achieved an average of 0.487, 0.495, and 0.25 for CDA values based on the detector types.

From the results in Table 4, we can conclude that approach in [49] is more robust in almost all categories. However, the method in [93] is more beneficial if an attack is conducted against scalar or CNN forensic detectors. Since authors in [49] mentioned that the low anti-forensic performance is due to the noise restoration limitation of the generator, we can assume that adding custom loss functions that are based on high-frequency image components improves the GAN capability to learn those features. Proposed GAN-based approaches also demonstrated superior results when compared to the traditional MF attacks [33, 48] in terms of both anti-forensic performance and image restoration quality.

Table 4

Comparison of the GAN-based median filtering anti-forensic techniques

Approach

CDA scalar — ML — DL

PSNR (dB)

SSIM

Dataset

Transferability

Training time (epochs)

[49]

0.345 — 0.5 — 0.435

42.5061

0.9754

RAISE-1k

9

21

[93]

0.487 — 0.25 — 0.495

32.56–36.02

0.90–0.955

BossBase, BOWS, UCID-V2

7

33

Contrast Enhancement Anti-forensics

Another popular image anti-forensic technique is referred to as the contrast enhancement (CE) method. This wide category includes various manipulations that focus on image quality improvement, including sharpening and increase of brightness. In [79], the authors developed a GAN-based approach for applying anti-forensic image sharpening. They used pix2pix GAN architecture (Fig. 3b) with U-Net [76] generator and PatchGAN discriminator structures. The network operates by introducing sharpening effects to original images while preserving their content. Tested against the state-of-the-art CNN classifier [99], the designed approach demonstrated a potential for GAN-based CE anti-forensics with CDA value recorded between 0.13 and 0.27, while images’ PSNR was recorded 5 dB higher compared to the traditionally sharpened image.

Later, Zou et al. [107] conducted a more detailed study to address the artifacts left by CE operations in pixel, histogram, and gray level concurrence (GLCM) domains and focused on preserving the effects of CE along with the image visual quality. The authors identified three stages of a GAN-based CE anti-forensic framework. First, the U-Net generator transforms the CE image while adversarial loss is calculated based on P-CNN [96] discriminator structure using the domain translation principle. Next, Fourier transform (FT) is used to create an image histogram and to approximate high-frequency measure, which is used to calculate histogram-based loss. Finally, pixel-wise loss is applied to reduce the visual differentiation between CE and GAN-generated images. Thus, the generator loss consists of default adversarial loss, pixel-wise loss, and histogram-based loss. Histogram-based loss is used to minimize high-frequency components of the image histogram for better deception performance against histogram- and GLCM-based forensic detectors. The authors selected three CNN-based CE forensic detectors [85, 96] to test their approach and recorded 87% for the SAR against the classifier models, combined with 0.9926 SSIM and 49.0258 dB when assessing the image quality.

Compared to [79], the approach presented in [107] provides a more effective system for CE anti-forensics due to the higher transferability as indicated in Table 5. Moreover, it addresses more applications of CE techniques, while authors in [79] exclusively target the sharpening operation. Unlike traditional approaches, GAN-based solutions can address the problem of removing traces left by CE operation in the histogram, GLCM, and spatial image representations, ensuring the transferability of an attack.

Table 5

Comparison of the GAN-based contrast enhancement anti-forensic techniques

Approach

CDA — SAR

PSNR (dB)

SSIM

Dataset

Transferability

Training time (epochs)

[79]

0.13–0.27 —

30.74–35.73

Not specified

BossBase, UCID & NRCS

No

100

[107]

— 87–97%

49.0258

0.9926

BossBase

3

40

Source Camera Anti-forensics

In recent years, the forensic community put a lot of effort towards source camera identification methods, triggering the design of various anti-forensic techniques. While there exist several traditional source camera falsification approaches, the only GAN-based approach was proposed in [25] by Chen et al. In the proposed MISLGAN architecture (Fig. 6), the generator consists of three components. First, the synthetic color filter array (CFA) block is applied to remove demosaicing traces of the original camera. Then, a set of convolutional blocks is used to generate new fake camera traces followed by a feature map reduction block that combines a high-dimensional feature map into a falsified color image. The discriminator structure is directly inherited from the forensic detector under the attack to increase the quality of generated data. Authors design the generator’s loss based on (1) perceptual loss indicating the difference between the original and falsified images, (2) classification loss based on the cross-entropy values of the CNN classifier, and (3) adversarial loss. The results demonstrate that MISLGAN can be applied to two distinct attack scenarios. The proposed model can be used to attack the camera models directly used during the GAN training with a SAR of 98%, while it achieved 97% SAR when applied to falsify camera models previously unseen by MISLGAN. In both cases, the authors recorded the average PSNR and SSIM of 42.7840 dB and 0.9704 respectively.

2 block diagrams. M I S L G A N overview has a generator, a discriminator for fake or real, and camera model classification. M I S L G A N generator has an input image followed by synthetic C F A, convolution blocks N = 64 and 128, feature map reduction, and falsified output.

Fig. 6

MISLGAN overview [25]

Multi Operation Image Anti-forensics

While the aforementioned GAN-based image anti-forensic techniques can fool forensic detectors with high success rates and allow to preserve the visual image quality, they were designed to address a single image alteration which limits their scalability. Since in the majority of cases, attackers apply the combination of two or more manipulations, more generalized anti-forensic techniques are required.

In [91], Wu et al. proposed to use Wasserstein GAN [9] with gradient penalty (WGAN-GP) [39] that targets the removal of multiple image operations applied subsequently. For the generator, the authors select a skip-connection architecture typical for image-to-image translation problems. CNN-based discriminator has an additional high-frequency residual feature (HPF) block applied to the input image. The generator loss is designed similarly to the one used in [60] to ensure image similarity from both statistical and conceptual perspectives. The discriminator is trained to maximize the Wasserstein distance between distributions of the original and generated images. To evaluate the proposed method, the authors generated the dataset such that each image has at least two different manipulations selected from a predefined list. Tested against two CNN-based forensic detectors [15, 24], the WGAN-GP was able to achieve an average of 0.50 DCA while not only preserving the image quality but also enhancing it for given cases independent from the type of image manipulations. This work was further extended in [89]. Authors defined an additional high-frequency residual loss for the generator to preserve high-frequency components after manipulation and extended the HPF block in the discriminator to repress scene content while sustaining high-frequency data. Evaluated against three forensic classifiers [15, 24, 101], the network proved to be scalable when applied to three consecutive manipulations anti-forensics while preserving an average of 0.5 CDA and having slightly better visual quality.

Authors in [94] proposed to utilize more complex GAN architecture to account for changes in feature and spatial domains of the image data. Inspired by D2GAN and domain translation GAN, Xie et al. developed a dual-domain generative adversarial network (DDGAN) which consists of a single generator and two discriminators. Skip-connection CNN is used as a generator backbone with an additional concatenation between the manipulated inputs and their residual outputs produced by the generator. A single difference in the architectures of feature and spatial discriminators is the feature extraction block used in the first one. Its purpose is to convert images into operation-specific domain maps. The loss of DDGAN is derived based on the content loss that reflects the content differences between original and generated images and dual-domain adversarial loss that combines adversarial losses of both discriminators. The authors applied a combination of MF and JPEG compression manipulation techniques to evaluate the performance of DDGAN. The experiments indicate that DDGAN generates high-quality visuals while achieving an average of 0.48 CDA when forensic detectors are not trained on anti-forensically processed images.

In [105], Zhao et al. designed a GAN for transferable anti-forensic attacks that operate on the principle of (1) erasing traces left due to the manipulation operations and (2) generating traces inherent to unaltered images. Unlike traditional GAN, the proposed network introduces an additional component in the form of the ensemble of surrogate CNN. The goal of this ensemble is to enforce a generator to produce images that can mimic traces of unaltered data for various image manipulations. Each CNN is pre-trained to perform a specific forensic task and thus provides more explicit feedback regarding generator performance. The generator loss is comprised of perceptual loss, classification loss, and adversarial loss, where classification loss reflects the ability of the generator to fool the ensemble of surrogate CNNs. The conducted experiments demonstrate that the proposed approach achieves an average of 98% success rate when used to conduct an attack against 6 forensic detectors [16–18, 42, 80, 102], while no significant visual distortions are observed.

Ding et al. [31] developed the extra supervision GAN (ExS-GAN), which consists of a traditional generator-discriminator (G1-D1) pair and two additional discriminative networks that perform an extra-supervision function. The first additional discriminator (D2) is used to classify the data produced by GAN, while the second (D3) is applied to differentiate manipulated from unaltered images. All three discriminators are given the same weight and thus the generator loss is calculated based on D2 and D3 classification losses and D1 adversarial loss. While the network can be directly applied for various single-image manipulations, the authors do not mention whether ExS-GAN is suitable for multi-operation anti-forensics. The results demonstrate that the proposed framework achieves SAR between 97% and 91% independent from the image manipulation type.

The evaluation in Table 6 reflects a summary of methods for multi-operation anti-forensic methods. We observed that all of them achieve high anti-forensic performance while the image quality stays intact. Nonetheless, the approach designed in [105] stands out in almost all categories with the highest SAR, image quality, transferability, and scalability. Moreover, after the original system setup, its training time was significantly shorter than other works. When examining the design of the proposed GANs, we noted that later works [31, 94, 105] incorporate multiple networks to provide more constructive feedback to the generator. Additional models perform either discriminative or classification functions. Since artifacts left by image manipulation operations are usually present in different domains (e.g., spatial, high-frequency), the discriminators can be configured to operate on different data representations. This ensures that the generator can remove operational traces of different types while preserving the image quality. For the generator to perform well for various image manipulations, the classifiers should classify the data based on diversified criteria and may be designed based on existing forensic detectors.

Table 6

Comparison of the GAN-based methods for multi operation image anti-forensics

Approach

Number of applied manipulations

CDA — SAR

PSNR (dB)

SSIM

Dataset

Transferability

Training time (epochs)

[91]

2

0.49–0.51 —

29.43–38.73

0.85–0.96

BossBase, BOWS

2

60

[89]

3

0.5 —

27.60–37.3

0.82–0.96

BossBase, BOWS

3

60

[94]

2

0.455–0.498 —

40.97–41.53

0.964–0.968

Custom, not publicly available

2

30

[105]

3

— 98%

45.83–56.64

0.99

Dresden [37]

6

12

[31]

6

— 91–95%

24.64–35.12

0.82–0.92

BossBase, RAISE, UCID & NRCS

3

50

Lessons Learned

Generally configured as an image-to-image translation problem, GAN-based image anti-forensic can address multiple challenges of the traditional statistical approaches. While an adversary still needs to have a basic knowledge about the manipulation operations applied to the image, it is often enough to design a robust loss function that enforces the generator to effectively remove manipulation traces. Figure 7 illustrates losses commonly utilized when designing GAN for image manipulation anti-forensics. For simplicity, we assigned losses with custom names (e.g., Huber, perceptual) to the categories based on their functionality. The most often utilized spatial pixel-wise and high-frequency coefficients losses ensure that the generator preserves the image content and produces high-quality image data after removing the manipulation traces. The high-frequency pixel-wise loss is less prevalent and mostly used to complement high-frequency coefficients and spatial pixel-wise losses. The classification loss is commonly used in GANs for multi-operation anti-forensic and is a key component that ensures that the generator can remove traces of different origins.

A horizontal bar graph plots loss functions versus the number of approaches utilizing loss. Pixel-wise spatial has 10 followed by high-frequency coefficients with 8, pixel-wise high-frequency with 3, and classification with 3.

Fig. 7

The usage of different loss functions to train GAN for image manipulation anti-forensic

3.2 Anti-forensics for Computer-Generated Images

The introduction of computer graphic images (CGI) created a need for a new forensic branch dedicated to distinguishing generated content from natural images (NI). This challenge is especially crucial from a data security and privacy perspective. Specifically, CGI content may threaten legal justice procedures and journalistic integrity. Therefore, the research community is constantly working towards the development of new techniques for CGI forensics. At the same time, anti-forensics methods are progressing to increase the quality of generated data and make it more realistic and indistinguishable from the NI. While traditional CGI anti-forensics methods may achieve a high deception rate against forensic detectors, most of them are not transferable across different detection algorithms and causes adversaries to design more sophisticated techniques.

Following recent trends, authors in [70] designed a GAN-based anti-forensic technique based on the domain translation principle. Referred to as regenerated CG facial image GAN (CGR-GAN), the proposed framework consists of one generator and one discriminator that utilize a one-way mapping function to convert CGI to NI. The generator structure is based on U-Net with additional skip connections between the encoder-decoder stack to improve the coding characteristics of original data during the information transfer across layers. Derived from PatchGAN, a discriminator focuses on image patches rather than an entire image. However, instead of approximating the probability of the image being fake or real, the discriminative model operates based on the Wasserstein distance converting classification task into a regression problem. This adversarial loss is combined with the other three functions to ensure optimal performance. Based on the Manhattan distance, content and style losses are calculated using feature maps generated by different layers of the pre-trained VGG-19 network. This accounts for both the high-level features relevant to image layout and content and low-level features characterizing the pixel information. Additionally, total variation regularized loss is used to smoothen the regenerated CGI. The proposed method was tested against six forensic detectors and compared with the H-Net model [63]. The experiments demonstrate that the CGR-GAN exhibits the same or better performance in terms of deception ability and increases the undetectability of CGI by an average of 25%, and outperforms the competitors when it comes to the visual quality of images.

In [28], Cui et al. proposed an improved GAN for CGI by introducing a subset of discriminators, D1 and D2. The main difference between the two is that D1 accepts real and generated images as is, while images fed to D2 undergo the preprocessing stage, during which two Sobel filters are applied. The loss function of the network consists of joint discriminative losses and Wasserstein distance values. While the proposed method generates high-quality CGI, the discriminator’s ability to distinguish between fake and real data degrades exponentially with the number of GAN training iterations. Moreover, the authors did not provide effective performance measurements when tested against CNN-based forensic detectors.

The work in [71] addresses the shortcoming of [70]. Specifically, the proposed bidirectional conversion between CG and NI facial images based on GAN (BDC-GAN) model incorporates the noise of one domain with another domain content to achieve higher deception performance against forensic detectors. Unlike CGR-GAN, BDC-GAN contains two groups of generators and discriminators and operates on the content and sensor pattern noise (SPN) of the CG and NI images, essentially mimicking the domain translation problem. The SPN is calculated by obtaining the difference between the input data and its low-pass filtered version. Based on the auto-encoder structure, the generators are fed with the SPN and content information such that CGI content is combined with NI noise and NI content coupled together with CGI noise. The generated data is then distinguished by the corresponding discriminators. The authors design four types of loss as follows: (1) adversarial loss to decrease the distance between the data distribution of the opposite domains, (2) content loss to preserve the content of the NI and CGI realisticity, (3) noise loss to conserve the noise features for NI and CGI, and (4) reconstruction loss to asses the reconstruction ability of the generators. The evaluation results indicate that BDC-GAN achieves close to 100% deception accuracy when tested against forensic detectors proposed in [27, 73, 75], and [36], while the detection accuracy of [69] dropped to 15%. Depending on the dataset used the detection accuracy of [61, 90, 97], and [64] varied from 33% to 9%, 9% to 38%, 3% to 40% and 9% to 0.7% respectively. The authors also compared the deception capability of BDC-GAN against traditional domain translation networks (i.e., CycleGAN, DiscoGAN, DualGAN) and recorded similar performance, indicating that the latter can be also used as an effective tool for CGI anti-forensics for most cases.

While CGI presents a difficult challenge for the forensic detector, its deception capabilities can be further improved using GAN techniques. An adversary can transfer the NI features onto the CGI without significant content change using a GAN generator as an encoder-decoder. However, similar to the image manipulation anti-forensic methods, the success of CGI-to-NI transformation heavily depends on the loss functions and GAN architecture. Based on the results in [70], we conclude that while style and content losses allow the original CGI to partially adopt the natural face characteristics, they do not address high-frequency artifacts left by original algorithms for content generation. To resolve this challenge, the work in [71] incorporates SPN analysis of the image data to maintain the features of the high-frequency domain.

3.3 GAN-Based Audio Anti-forensics

Despite a lot of efforts being dedicated to studying image anti-forensic methods to improve the quality and robustness of forensic detectors, little to no work has been conducted for the audio domain. While existing audio source identification (ASI) and audio verification (AV) techniques are on the rise, they are still in the phase of improving detection accuracy and do not consider approaches that aim to directly attack their classification capabilities. Since the investigation of anti-forensic methods can be applied to strengthen ASI and AF methods, it is crucial to consider potential vector attacks before adversaries.

Since GAN has been successfully used for anti-forensics in the image domain, Li et al. [56] attempted to adapt the GAN to audio source falsification. Two types of attacks are considered—confusing and misleading. During the confusing attack, an adversary aims to generate new audio that does not contain traces of the original audio source. On the other hand, the misleading attack refers to a scenario when an attacker embeds falsified traces of a specific category into the generated audio. The proposed network consists of three components: a generator, a discriminator, and a forensic detector. The generator architecture is inherited from the SEGAN [68] that was proven to be successful in speech enhancement applications and uses an encoder-decoder structure to remove the source traces. The authors built a deep CNN detector to distinguish between the unaltered and generated data, while the model proposed in [40] is used as a forensic detector. The loss function of the proposed GAN is calculated based on min-max adversarial loss, perceptional loss between original and generated audio, and classification loss of the forensic detector. The last one is computed to produce two different loss values based on whether a forensic detector is under a misleading or confusing attack. Evaluated against three ASI methods, the proposed approach was shown to significantly decrease the detection accuracy by over 90% as a result of the confusing attack. Moreover, the authors recorded an average of 80% SAR when performing the misleading attack against six devices. In both cases, the generated audio samples preserved a high content quality with minor statistical changes indicated by PESQ scores over 3.3 for most cases.

Recently, the authors in [59] employed the GAN framework to generate fake stereo audio based on the mono audio component. The architecture of the proposed GAN is almost identical to the one in [56], except that the forensic detector architecture is specific to AV classification. Evaluated against MUSIC and FILM AV models [58], the proposed GAN for the stereo audio falsification achieved SAR of 70% and 98%.

3.4 Advantages of GAN-Based Anti-forensics

There are multiple benefits of using the GAN-based anti-forensic attacks over the statistical-based manually designed techniques. Unlike traditional techniques, GAN methods are more flexible since they do not try to trick the forensic detector by exploiting its weak spots, but rather introduce new traces that mimic data distribution present in the unaltered samples. Since GANs can be applied to the whole data sample and remove traces of the anti-forensic operation automatically, the adversary does not need to possess domain-specific knowledge or manually erase the alteration traces significantly reducing the time required to develop and deploy the attack.

Moreover, once trained an anti-forensic GAN can be applied (1) on different samples as long as the goal of an attacker remains the same and (2) independently from parametric features of data samples, such as image size or alteration factors, which contribute to the scalability property. Additionally, it has been demonstrated that GAN-based techniques can target multiple attack vectors [89, 94, 105] by adjusting the parameters of adversarial training. Thus, an adversary is capable to design an attack that is transferable across various forensic methods without a need to manually analyze each data sample. Combined, the scalability and transferability of GAN-based methods allow the launching of rapid attacks on a large scale.

While traditional anti-forensic methods often introduce quality distortion artifacts to the manipulated data, it is not the case with GANs. On the contrary, the adversarial generators can preserve the original data contents as the number of distortions can be controlled during the training by employing customized loss functions. Furthermore, GAN-generated data may be of higher quality compared to the original image while retaining the effects of the manipulations.

4 Overview of GAN Methods to Improve the Forensic Detectors

From the perspective of a forensic domain, generator and discriminator components of GAN can be seen as anti-forensics and forensic/counter anti-forensics. Thus, it makes this type of network particularly suitable for various applications in the domain. Most often utilized to create deep fakes [45], GAN created a significant challenge for forensic specialists when it comes to verifying data integrity. However, some of the GAN capabilities can also be applied to improve existing forensic detectors.

At its core, GAN is built to achieve optimal performance for the generator. However, during the training process, the discriminator is also trained to recognize GAN-generated samples and becomes more familiar with adversarial data. This principle allowed for a new wave of counter anti-forensics when GANs are used to strengthen the classifier. Multiple works are proposed to use GANs for data augmentation and preprocessing during the training phase to ensure that forensic models can learn features of synthetic data and later identify it as a forgery [95, 104]. Another approach combines an initially trained forensic model with a generator to further adjust the weights and make the classifier resistant against adversarial samples [10, 88]. Next, we survey the approaches that use GANs to improve the performance of forensic classifiers for synthetically created data.

4.1 Strengthening Forensic Detectors to Identify Deep Fakes

The advancement in synthetic data generation inevitably brought new challenges to digital forensics [3]. Due to their capabilities, GANs became a main tool for the production of high-quality deep fakes. These images allow an adversary to impersonate famous people or to create fake social media identities. As GAN capabilities keep advancing, the generated data becomes more versatile and cannot be easily recognized by traditional forensic approaches.

To assess the threats of deep fakes, the work conducted in [54] focused on investigating whether traditional forensic approaches can effectively identify GAN-generated data. The authors considered two methods to detect fake images—intrusive and non-intrusive. For the intrusive approach, the forensic detector classifies data produced by a specific GAN, whose architecture is assumed to be known in advance. The idea was to test whether the GAN discriminator can be used for forensic purposes. The experiments demonstrate that this approach is ineffective because (1) the discriminator has to be trained for the same number of epochs as the generator limiting its applicability when an attacker is unknown, and (2) the discriminator tends to misclassify real data consistently resulting in a large number of false alarms For the non-intrusive detection approach, the authors used face quality assessment, inception scores, and VGG-based features. After the evaluation, the authors concluded that these methods are limited because they require the availability of a large amount of training data and prior knowledge of an attack. Thus, the proposed methods are not scalable.

Since it has been identified that existing methods are often limited to the specific type of generated images or GAN model used to create data, multiple methods have been proposed to improve the generalizing performance of existing forensic methods. One solution to improve the performance of forensic models for generated data was proposed by Xuan et al. [95]. Focused on generated fake images, the authors used preprocessed images to train a forensic CNN classifier. The main aim of their work was to ensure the generalization ability of the classifier is independent of the GAN used to produce deep fakes. The proposed system consists of three steps. First, filtering techniques are applied to both real and fake data to destroy the low-level unstable patterns which appear due to the specific GAN architecture. This ensures that the classifier can focus on extracting features persistent across any fake image. The created dataset was then used to train a deep convolution GAN (DCGAN) discriminator, which is later used as a forensic detector. The results indicate that using preprocessed data to train the detector leads to a slight increment in its classification ability, but it does not equally applicable to different models.

In [10], Baek et al. proposed to utilize ensembling methods to improve the classification ability of the discriminator. The proposed framework included two generators and two discriminators. The ensemble of discriminators consisted of ResNet [41] and DenseNet [42] models. The authors used the outputs of the last fully convolutional layers of each network to generate a concatenated 2048-dimensional feature vector for binary classification of fake versus real data. Generators were trained differently to increase the discriminative ability of the framework. The first model was pre-trained, while the other one was trained from scratch simultaneously with the ensembled discriminators. The framework utilized custom adversarial loss based on the discriminator’s ability to classify data produced by both generators. The results of the ablation studies indicated that the proposed method was effective when applied to FaceForensics++ [77] dataset and outperformed the majority of the state-of-the-art forensic detectors.

4.2 Improving Signature Forensics Using GANs

At a time of increased concerns for data security and integrity, strong authentication mechanisms are required. However, despite the significant advancement of technologies, handwritten signatures are still commonly used to verify one’s identity. Since the digital medium allows one to sign and share documents online, the forensic domain identifies two types of forgery detection procedures, online and offline. The online forgery detectors aim to verify the signature based on its appearance and the writing style as they analyze the text dynamically. The offline signature verification process is solely based on the static evaluation of the final result. There exist multiple ways for forensic signature examination, however, the methods that are based on manual analysis of the statistical characteristics and different features involve complex steps that require a lot of time frame and cost. As the signature itself is presented as a scanned image, a variety of DL-based forensic methods used for images have been applied for signature forgery detection. While these approaches allow for a simplified verification process, they have drawbacks such as limited access to data and complex feature extraction. In light of this discussion, GAN methods for synthetic data generation appear as an appealing tool to improve signature verification techniques by (1) training the classifier as a GAN discriminator or (2) introducing a more comprehensive sample space for the forensic classifiers’ training.

The authors in [104] adopted GAN to implement the unsupervised signature verification method that can be applied for both per-user signature identification (WD) and the universal user-independent classification (WI). In the approach, the DCGAN-based GAN model proposed in [74] is used to obtain signature-specific features. Extracted from all convolutional layers of discriminators, these features are used to train a hybrid WD-WI classifier. Tested on GPDSsyntheticSignature dataset [34], the proposed approach demonstrates great potential for using GAN discriminator as a signature forensic classifier with FAR value recorded between 14.79% and 17.38%. Later, Wang et al. [88] designed a signature verification method based on domain translation GAN architecture. Applied to the custom database of Chinese signatures, the two domains represent the image of the original handwritten signatures and their appearance in standard Song font characters. Even though the proposed method achieved 90% identification accuracy at a reduced time and cost, the authors emphasized that it can be further improved by increasing the number of training samples and expanding the dataset by adding foreign signatures.

Vorugunti et al. [87] targeted a more complex problem that involves online signature verification. However, to remove the requirement for system supervision and to reduce the real-time computational cost, their network was focused only on the static analysis of the final signature. They used vanilla GAN architecture to train the high-quality forensic detector using adversarial loss. The experimental results indicate that using GAN discriminator as a forensic classifier helps to achieve an average accuracy of 95% EER when evaluated on MCYT [66], SVC [35], and SUSIG [30] datasets.

In [98], Yapici et al. utilized a GAN model to solve the problem of insufficient data required to train the DL-based detector effectively. The proposed system introduces a new data augmentation module as an intermediate step between data preprocessing and signature classification. Utilizing the domain translation principle, the authors use CycleGAN model to increase the number of augmented genuine signatures used to train the forensic classifier. This system operates by selecting a pair of two genuine signatures per person and feeding them into the CycleGAN as input and target domains. This approach allows for obtaining new augmented samples based on high-level features. At the later stage, augmented data is merged with the original dataset to train the forensic detector. The experimental results indicate that incorporating the GAN-based data augmentation stage increases the accuracy of the classifiers by an average of 10% when compared to methods without any data augmentation techniques and by an average of 5% compared to methods that use traditional data augmentation techniques. The designed approach was also evaluated using Type 1 and 2 errors. Type 1 error refers to the false rejection rate (FRP) indicating that the system rejected the genuine signature, while Type 2 error or false acceptance rate (FAR) measures the number of times a forged signature was accepted as genuine. In cases when FAR and FRR are the same, the equal error rate (EER) is measured. When evaluated on GPDSsyntheticSignature and MYCT-75 datasets, the authors recorded an average of 8% FAR and 15% EER for the former dataset, with 3% FAR and 5% EER values reported for the MYCT-75 dataset.

4.3 Summary of GAN Usage to Improve the Detection of Forged and Synthetic Data

To generalize the GAN-based approaches that aim to improve existing forensic detectors, we define two categories. The first category refers to database/feature-oriented approaches. These methods use GAN to generate either new synthetic data or features that are used to train forensic detectors. On the other hand, training-oriented approaches incorporate the forensic classifier in the GAN architecture and train it as part of adversarial learning. Furthermore, the training-oriented approaches can be further split based on whether the forensic detector is trained against the specific GAN generator or possess transferability properties. Figure 8 summarizes the existing GAN-based dataset/feature approaches and training-oriented GAN-based approaches for the improvement of forensic detectors.

A classification chart for improving F D with G A N. Dataset or feature oriented has feature extraction, and dataset expansion by augmenting original data and prepossessing G A N data. Training-oriented has against set of the G A N generators with different settings and G A N architecture dependent.

Fig. 8

Classification of GAN-based methods for the forensic detectors strengthening

When compared, the dataset/feature-oriented methods are more flexible and generic since they can be applied without any prior knowledge about the GAN used to generate fake data. Thus, they are scalable and retain high transferability across different domains. On the contrary, the training-oriented methods are often designed to strengthen the forensic detector against particular GAN generators [87, 88]. Even though classifiers trained in this manner can be applied in different domains, they are biased toward the recognition of the generator-specific patterns present in the forged data. However, as demonstrated in [10], it is possible to improve the generalization of the GAN-based forensic detector when adversarially training is performed against the generators of different structures.

Overall, it is evident that incorporating GAN with existing forensic detectors is beneficial as all approaches have been demonstrated to improve its classification ability against adversarial methods. However, we emphasize that to design and train an efficient GAN-based forensic detector, it is important to refrain from using methods that are dependent upon a specific dataset of synthetic data or generator models.

5 Future Directions

There have been significant advances in GAN-based forensic and anti-forensic techniques. On one hand, the adversary adapted generative networks to train high-quality generators that (1) can successfully trick the existing forensic classifiers and (2) are equally effective against the traditional analytical approaches for data analysis. On the other hand, forensic examiners have been using GANs to improve the performance of existing forensic classifiers. In this section, we identify a list of open research questions that need to be addressed in future research of GAN applications in forensics, followed by a list of potential GAN anti-forensic attacks.

Generalizing Anti-forensic Attacks

Mostly conducted for the image domain, the recent research has been focused on addressing the fundamental challenges of making the GAN-based attacks more generalized in terms of the scalability for data variation and transferability across different forensic methods. As indicated in Sect. 3.1, the research achieved significant progress on this matter with the recently developed network targeting the forensic classifiers of different types. To conduct a multi-vector attack, the adversaries can incorporate custom components when designing GAN modules. Specifically, carefully designed loss functions allow the generators to acquire the capability to address the traces left by multiple manipulations across both spatial and high-frequency image domains, while the incorporation of the discriminators configured to perform different classification tasks provides extensive feedback regarding the anti-forensic quality of the generated data along with its visual appearance.

Inter Domain Applications

With GAN-based image anti-forensic on the rise, it is natural to explore its potential applicability to other domains. Already, there have been multiple attempts to employ GANs as a tool to increase the realisticity of CGIs to make them indistinguishable from NIs [28, 70, 71]. While these efforts revealed the vulnerabilities of existing forensic detectors, it is still a challenging task to achieve both, (1) preserving the quality of the generated data and (2) effectively removing the traces indicating the forgery. Despite ongoing efforts to explore GAN-based anti-forensics for image manipulation and CGI, there has been little to no work done in exploring its usage for other tasks.

Because DL-based techniques are actively incorporated to design forensic detectors to verify various types of multimedia data, it is unclear how well they can perform when tasked with the detection of GAN-modified data. While it is important to improve the accuracy of the forensic detectors for specific tasks, the research for GANs for audio anti-forensic [56, 59] demonstrated that the high accuracy of the classifier does not guarantee its high performance under the attacks using synthetically modified data.

At the same time, the advancement of technologies creates new possibilities for forgeries, since more data is being stored and shared digitally. For example, we observe a large number of official documents being converted to digital versions for convenience purposes. However, as the amount of paperless data grows exponentially, it is common to apply ML and NLP classifiers for the analysis, opening a wide range of possibilities for GAN-based counterfeiting. In Fig. 9, we identify the applications that are most suitable for the GAN-based anti-forensic technique and classify them based on the data type being analyzed by the examiners.

A classification chart of domains. Images include manipulation and alteration, C G I, source origin, watermarking, and signature verification. Audio has manipulation and alteration, source origin, and voice recognition. Videos have manipulation and alteration, source origin, and deepfakes.

Fig. 9

Different vectors of GAN-based anti-forensic attacks based on the domain

Strengthening Forensic Detectors

Despite GAN being presented as an excellent tool to create high-quality forgeries and to conduct various types of adversarial attacks, considering it strictly adversarial is a mistake. In recent years, there have been multiple attempts to integrate the capabilities of adversarial learning into the process of designing and training the forensic classifier (Sect. 4). This allows for strengthening the forensic detectors in terms of their resistance against synthetically created and modified data.

As one of the main challenges in designing an effective DL-based forensic method is a limited amount of available data, which is specific for a given domain, GANs can be used to generate more samples using augmentation techniques [98]. Additionally, the forensic classifiers can be improved to recognize the synthetic data when designed and trained as GAN discriminators [87, 88] trained directly against the generator model. However, the latter often lack the generalization capabilities when applied to detect forgeries created using different GAN techniques. This is because generator models leave distinct fingerprints, similar to the real-world cameras’ noiseprints. Thus, the forensic detectors should be trained such that they are enabled to recognize generic features of synthetic data, rather than GAN-specific traces. One way to address this challenge is adversarial training of the forensic detectors against samples generated by different generator models [10]. However, it is unclear how to effectively scale these methods to a large number of GAN generators. Another approach to improve the discovery of GAN-independent features of the forged data is to create new features based on probabilistic differences between real and fake data. While it has been demonstrated to be successful to distinguish targeted forgeries from benign samples [104], it is unclear whether it can be applied for cases when the original data is unavailable.

6 Conclusion

In this chapter, we provided a comprehensive overview of GAN applications for forensics and anti-forensic domains. We presented a detailed analysis of the GAN-based anti-forensic attacks and their components, qualitatively evaluated the existing methods within different digital domains (i.e., image manipulation, CGI, and audio), and specified the main advantages of using GANs over traditional anti-forensic methods. We also described how GANs can be applied to improve the performance of the forensic classifiers and proposed the classification of these approaches. In addition to this, we identified the main shortcomings of designing an effective GAN anti-forensic attack and of adapting GANs to strengthen existing forensic methods. Finally, we derived a list of potential GAN-based anti-forensic applications in different domains.

References

1.

Best Practice Manual for Digital Audio Authenticity Analysis

2.

Best Practice Manual for Digital Image Authentication

3.

Impact of media forensics and deepfake in society, pp. 387–410 (2022)

4.

Aerts-Bruintjes, M., Bartha, Z., Leitet, E., Orsolya Lévai , E., Castro Martinez, S., Moreton, R., Moreton, J., Pickersgill, E., Ruifrok, A.: Guideline for Facial Recognition System End Users. ENFSI

5.

Aggarwal, A., Mittal, M., Battineni, G.: Generative adversarial network: an overview of theory and applications. Int. J. Inf. Manage. Data Insights 1(1), 100004 (2021)

6.

Agustsson, E., Timofte, R.: Ntire 2017 challenge on single image super-resolution: dataset and study. In: 2017 IEEE Conference on Computer Vision and Pattern Recognition Workshops (CVPRW), pp. 1122–1131 (2017). https://​doi.​org/​10.​1109/​CVPRW.​2017.​150

7.

Amerini, I., Uricchio, T., Ballan, L., Caldelli, R.: Localization of JPEG double compression through multi-domain convolutional neural networks. In: 2017 IEEE Conference on Computer Vision and Pattern Recognition Workshops (CVPRW), pp. 1865–1871. IEEE (2017)

8.

Arjovsky, M., Bottou, L.: Towards principled methods for training generative adversarial networks. arXiv preprint arXiv:1701.04862 (2017)

9.

Arjovsky, M., Chintala, S., Bottou, L.: Wasserstein generative adversarial networks. In: International Conference on Machine Learning, pp. 214–223. PMLR (2017)

10.

Baek, J.Y., Yoo, Y.S., Bae, S.H.: Generative adversarial ensemble learning for face forensics. IEEE Access 8, 45421–45431 (2020). https://​doi.​org/​10.​1109/​ACCESS.​2020.​2968612Crossref

11.

Barni, M., Bondi, L., Bonettini, N., Bestagini, P., Costanzo, A., Maggini, M., Tondi, B., Tubaro, S.: Aligned and non-aligned double JPEG detection using convolutional neural networks. J. Vis. Commun. Image Represent. 49, 153–163 (2017)Crossref

12.

Bas, P., Furon, T.: Bows-2 contest (break our watermarking system). Organised within the activity of the Watermarking Virtual Laboratory (WAVILA) of the European Network of Excellence ECRYPT (2008)

13.

Bas, P., Filler, T., Pevnỳ, T.: “break our steganographic system” : the ins and outs of organizing boss. In: Information Hiding: 13th International Conference, IH, 2011, Prague, May 18–20, 2011, Revised Selected Papers 13, pp. 59–70. Springer, Berlin (2011)

14.

Bayar, B., Stamm, M.C.: A deep learning approach to universal image manipulation detection using a new convolutional layer. In: Proceedings of the 4th ACM Workshop on Information Hiding and Multimedia Security, pp. 5–10 (2016)

15.

Bayar, B., Stamm, M.C.: Design principles of convolutional neural networks for multimedia forensics. Electron. Imaging 29, 77–86 (2017)Crossref

16.

Bayar, B., Stamm, M.C.: Constrained convolutional neural networks: a new approach towards general purpose image manipulation detection. IEEE Trans. Inf. Forensics Secur. 13(11), 2691–2706 (2018)Crossref

17.

Boroumand, M., Fridrich, J.: Deep learning for detecting processing history of images. Electron. Imaging 30, 1–9 (2018)Crossref

18.

Boroumand, M., Chen, M., Fridrich, J.: Deep residual network for steganalysis of digital images. IEEE Trans. Inf. Forensics Secur. 14(5), 1181–1193 (2018)Crossref

19.

Bovik, A.: Streaking in median filtered images. IEEE Trans. Acoust. Speech Signal Process. 35(4), 493–503 (1987)Crossref

20.

Cao, G., Zhao, Y., Ni, R., Yu, L., Tian, H.: Forensic detection of median filtering in digital images. In: 2010 IEEE International Conference on Multimedia and Expo, pp. 89–94. IEEE (2010)

21.

Cellebrite: Cellebrite introduces advanced machine learning technology to analytics solution to accelerate evidence discovery (Jun 2018). https://​www.​prnewswire.​com/​news-releases/​cellebrite-introduces-advanced-machine-learning-technology-to-analytics-solution-to-accelerate-evidence-discovery-300500279.​html

22.

Chen, C., Ni, J., Huang, J.: Blind detection of median filtering in digital images: a difference domain based approach. IEEE Trans. Image Process. 22(12), 4699–4710 (2013)MathSciNetCrossref

23.

Chen, J., Kang, X., Liu, Y., Wang, Z.J.: Median filtering forensics based on convolutional neural networks. IEEE Signal Process. Lett. 22(11), 1849–1853 (2015)Crossref

24.

Chen, Y., Kang, X., Wang, Z.J., Zhang, Q.: Densely connected convolutional neural network for multi-purpose image forensics under anti-forensic attacks. In: Proceedings of the 6th ACM Workshop on Information Hiding and Multimedia Security, pp. 91–96 (2018)

25.

Chen, C., Zhao, X., Stamm, M.C.: Mislgan: an anti-forensic camera model falsification framework using a generative adversarial network. In: 2018 25th IEEE International Conference on Image Processing (ICIP), pp. 535–539 (2018). https://​doi.​org/​10.​1109/​ICIP.​2018.​8451503

26.

Chen, C., Zhao, X., Stamm, M.C.: Generative adversarial attacks against deep-learning-based camera model identification. IEEE Trans. Inf. Forensics Secur, 1–1 (2019)

27.

Cui, Q., McIntosh, S., Sun, H.: Identifying materials of photographic images and photorealistic computer generated graphics based on deep CNNs. Comput. Mater. Continua 55(2), 229–241 (2018)

28.

Cui, Q., Meng, R., Zhou, Z., Xingming, S., Zhu, K.: An anti-forensic scheme on computer graphic images and natural images using generative adversarial networks. Math. Biosci. Eng. 16, 4923–4935 (2019). https://​doi.​org/​10.​3934/​mbe.​2019248MathSciNetCrossref

29.

Dang-Nguyen, D.T., Pasquini, C., Conotter, V., Boato, G.: Raise: a raw images dataset for digital image forensics. In: Proceedings of the 6th ACM Multimedia Systems Conference, pp. 219–224 (2015)

30.

Diaz, M., Fischer, A., Plamondon, R., Ferrer, M.A.: Towards an automatic on-line signature verifier using only one reference per signer. In: 2015 13th International Conference on Document Analysis and Recognition (ICDAR), pp. 631–635. IEEE (2015)

31.

Ding, F., Shen, Z., Zhu, G., Kwong, S., Zhou, Y., Lyu, S.: Exs-gan: synthesizing anti-forensics images via extra supervised GAN. IEEE Trans. Cybern., 1–12 (2022). https://​doi.​org/​10.​1109/​TCYB.​2022.​3210294

32.

Fan, W., Wang, K., Cayre, F., Xiong, Z.: A variational approach to jpeg anti-forensics. In: 2013 IEEE International Conference on Acoustics, Speech and Signal Processing, pp. 3058–3062. IEEE (2013)

33.

Fan, W., Wang, K., Cayre, F., Xiong, Z.: Median filtered image quality enhancement and anti-forensics via variational deconvolution. IEEE Trans. Inf. Forensics Secur. 10(5), 1076–1091 (2015)Crossref

34.

Ferrer, M.A., Diaz-Cabrera, M., Morales, A., Galbally, J., Gomez-Barrero, M.: Realistic synthetic off-line signature generation based on synthetic on-line data. In: 2013 47th International Carnahan Conference on Security Technology (ICCST), pp. 1–6 (2013)

35.

Fischer, A., Plamondon, R.: Signature verification based on the kinematic theory of rapid human movements. IEEE Trans. Hum.-Mach. Syst. 47(2), 169–180 (2016)Crossref

36.

Gando, G., Yamada, T., Sato, H., Oyama, S., Kurihara, M.: Fine-tuning deep convolutional neural networks for distinguishing illustrations from photographs. Expert Syst. Appl. 66, 295–301 (2016)Crossref

37.

Gloe, T., Böhme, R.: The ‘dresden image database’ for benchmarking digital image forensics. In: Proceedings of the 2010 ACM Symposium on Applied Computing, pp. 1584–1590 (2010)

38.

Goodfellow, I., Pouget-Abadie, J., Mirza, M., Xu, B., Warde-Farley, D., Ozair, S., Courville, A., Bengio, Y.: Generative adversarial networks. Commun. ACM 63(11), 139–144 (2020)MathSciNetCrossref

39.

Gulrajani, I., Ahmed, F., Arjovsky, M., Dumoulin, V., Courville, A.C.: Improved training of Wasserstein GANs. In: Advances in Neural Information Processing Systems, 30 (2017)

40.

Hanilci, C., Ertas, F., Ertas, T., Eskidere, Ö.: Recognition of brand and models of cell-phones from recorded speech signals. IEEE Trans. Inf. Forensics Secur, 7(2), 625–634 (2011).Crossref

41.

He, K., Zhang, X., Ren, S., Sun, J.: Deep residual learning for image recognition. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 770–778 (2016)

42.

Huang, G., Liu, Z., Van Der Maaten, L., Weinberger, K.Q.: Densely connected convolutional networks. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 4700–4708 (2017)

43.

Huang, D., Tang, W., Li, B.: Anti-forensics for double JPEG compression based on generative adversarial network, pp. 759–771. Springer, Berlin (2021)

44.

Isola, P., Zhu, J.Y., Zhou, T., Efros, A.A.: Image-to-image translation with conditional adversarial networks. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 1125–1134 (2017)

45.

Kalpokas, I., Kalpokiene, J.: From GANs to deepfakes: getting the characteristics right. In: Deepfakes: A Realistic Assessment of Potentials, Risks, and Policy Regulation, pp. 29–39. Springer, Berlin (2022)

46.

Kang, X., Stamm, M.C., Peng, A., Liu, K.R.: Robust median filtering forensics using an autoregressive model. IEEE Trans. Inf. Forensics Secur. 8(9), 1456–1468 (2013)Crossref

47.

Karnouskos, S.: Artificial intelligence in digital media: the era of deepfakes. IEEE Trans. Technol. Soc. 1(3), 138–147 (2020). https://​doi.​org/​10.​1109/​TTS.​2020.​3001312Crossref

48.

Kim, D., Jang, H.U., Mun, S.M., Choi, S., Lee, H.K.: Median filtered image restoration and anti-forensics using adversarial networks. IEEE Signal Process. Lett. 25(2), 278–282 (2017)Crossref

49.

Kim, D., Jang, H.U., Mun, S.M., Choi, S., Lee, H.K.: Median filtered image restoration and anti-forensics using adversarial networks. IEEE Signal Process. Lett. (2), 278–282 (2018). https://​doi.​org/​10.​1109/​LSP.​2017.​2782363Crossref

50.

Kirchner, M., Fridrich, J.: On detection of median filtering in digital images. In: Media Forensics and Security II, vol. 7541, pp. 371–382. SPIE (2010)

51.

Lai, S., Böhme, R.: Countering counter-forensics: the case of JPEG compression. In: Information Hiding: 13th International Conference, IH 2011, Prague, May 18–20, 2011, Revised Selected Papers 13, pp. 285–298. Springer, Berlin (2011)

52.

Ledig, C., Theis, L., Huszár, F., Caballero, J., Cunningham, A., Acosta, A., Aitken, A., Tejani, A., Totz, J., Wang, Z., et al.: Photo-realistic single image super-resolution using a generative adversarial network. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 4681–4690 (2017)

53.

Li, H., Luo, W., Qiu, X., Huang, J.: Identification of various image operations using residual-based features. IEEE Trans. Circuits Syst. Video Technol. 28(1), 31–45 (2016)Crossref

54.

Li, H., Chen, H., Li, B., Tan, S.: Can forensic detectors identify GAN generated images? In: 2018 Asia-Pacific Signal and Information Processing Association Annual Summit and Conference (APSIPA ASC), pp. 722–727 (2018). https://​doi.​org/​10.​23919/​APSIPA.​2018.​8659461

55.

Li, D., Chen, D., Jin, B., Shi, L., Goh, J., Ng, S.K.: Mad-gan: multivariate anomaly detection for time series data with generative adversarial networks. In: Artificial Neural Networks and Machine Learning–ICANN 2019: Text and Time Series: 28th International Conference on Artificial Neural Networks, Munich, September 17–19, 2019, Proceedings, Part IV, pp. 703–716. Springer, Berlin (2019)

56.

Li, X., Yan, D., Dong, L., Wang, R.: Anti-forensics of audio source identification using generative adversarial network. IEEE Access 7, 184332–184339 (2019). https://​doi.​org/​10.​1109/​ACCESS.​2019.​2960097Crossref

57.

Liu, K.R.: Multimedia Fingerprinting Forensics for Traitor Tracing, vol. 4. Hindawi Publishing Corporation, London (2005)Crossref

58.

Liu, T., Yan, D.: Identification of fake stereo audio. arXiv preprint arXiv:2104.09832 (2021)

59.

Liu, T., Yan, D., Yan, N., Chen, G.: Anti-forensics of fake stereo audio using generative adversarial network. Multimedia Tools Appl. 81(12), 17155–17167 (2022)Crossref

60.

Luo, Y., Zi, H., Zhang, Q., Kang, X.: Anti-forensics of JPEG compression using generative adversarial networks. In: 2018 26th European Signal Processing Conference (EUSIPCO), pp. 952–956 (2018). https://​doi.​org/​10.​23919/​EUSIPCO.​2018.​8553259

61.

Nguyen, H.H., Nguyen-Son, H.Q., Nguyen, T.D., Echizen, I.: Discriminating between computer-generated facial images and natural ones using smoothness property and local entropy. In: Digital-Forensics and Watermarking: 14th International Workshop, IWDW 2015, Tokyo, October 7–10, 2015, Revised Selected Papers 14, pp. 39–50. Springer, Berlin (2016)

62.

Nguyen, T., Le, T., Vu, H., Phung, D.: Dual discriminator generative adversarial nets. In: Guyon, I., Luxburg, U.V., Bengio, S., Wallach, H., Fergus, R., Vishwanathan, S., Garnett, R. (eds.) Advances in Neural Information Processing Systems 30, pp. 2667–2677. Curran Associates, Inc. (2017), http://​papers.​nips.​cc/​paper/​6860-dual-discriminator-generative-adversarial-nets.​pdf

63.

Nguyen, H.H., Tieu, n.d.T., Nguyen-Son, H.Q., Yamagishi, J., Echizen, I.: Transformation on computer-generated facial image to avoid detection by spoofing detector. In: 2018 IEEE International Conference on Multimedia and Expo (ICME), pp. 1–6 (2018). https://​doi.​org/​10.​1109/​ICME.​2018.​8486579

64.

Nguyen, H.H., Tieu, T.n.d., Nguyen-Son, H.Q., Nozick, V., Yamagishi, J., Echizen, I.: Modular convolutional neural network for discriminating between computer-generated images and photographic images. In: Proceedings of the 13th International Conference on Availability, Reliability and Security, pp. 1–10 (2018)

65.

Nowroozi, E., Dehghantanha, A., Parizi, R.M., Choo, K.K.R.: A survey of machine learning techniques in adversarial image forensics. Comput. Secur. 100, 102092 (2021). https://​doi.​org/​10.​1016/​j.​cose.​2020.​102092, https://​www.​sciencedirect.​com/​science/​article/​pii/​S016740482030365​5

66.

Ortega-Garcia, J., Fierrez-Aguilar, J., Simon, D., Gonzalez, J., Faundez-Zanuy, M., Espinosa, V., Satue, A., Hernáez, I., Igarza, J.J., Vivaracho, C.E., Escudero, D., Moro, Q.I.: MCYT baseline corpus: a bimodal biometric database. IEE Proc. Vis. Image Signal Process. 150(6), 395–401 (2003)Crossref

67.

Park, J., Cho, D., Ahn, W., Lee, H.K.: Double jpeg detection in mixed JPEG quality factors using deep convolutional neural network. In: Proceedings of the European Conference on Computer Vision (ECCV), pp. 636–652 (2018)

68.

Pascual, S., Bonafonte, A., Serra, J.: Segan: speech enhancement generative adversarial network. arXiv preprint arXiv:1703.09452 (2017)

69.

Peng, F., Zhou, D.l., Long, M., Sun, X.m.: Discrimination of natural images and computer generated graphics based on multi-fractal and regression analysis. AEU-Int. J. Electron. Commun. 71, 72–81 (2017)

70.

Peng, F., Yin, L.P., Zhang, L.B., Long, M.: CGR-GAN: CG facial image regeneration for antiforensics based on generative adversarial network. IEEE Trans. Multimedia 22(10), 2511–2525 (2020). https://​doi.​org/​10.​1109/​TMM.​2019.​2959443Crossref

71.

Peng, F., Yin, L., Long, M.: BDC-GAN: bidirectional conversion between computer-generated and natural facial images for anti-forensics. IEEE Trans. Circuits Syst. Video Technol. 32(10), 6657–6670 (2022). https://​doi.​org/​10.​1109/​TCSVT.​2022.​3177238Crossref

72.

Pevnỳ, T., Bas, P., Fridrich, J.: Steganalysis by subtractive pixel adjacency matrix. In: Proceedings of the 11th ACM Workshop on Multimedia and Security, pp. 75–84 (2009)

73.

Quan, W., Wang, K., Yan, D.M., Zhang, X.: Distinguishing between natural and computer-generated images using convolutional neural networks. IEEE Trans. Inf. Forensics Secur. 13(11), 2772–2787 (2018)Crossref

74.

Radford, A., Metz, L., Chintala, S.: Unsupervised representation learning with deep convolutional generative adversarial networks. arXiv preprint arXiv:1511.06434 (2015)

75.

Rahmouni, N., Nozick, V., Yamagishi, J., Echizen, I.: Distinguishing computer graphics from natural images using convolution neural networks. In: 2017 IEEE Workshop on Information Forensics and Security (WIFS), pp. 1–6 (2017)

76.

Ronneberger, O., Fischer, P., Brox, T.: U-net: convolutional networks for biomedical image segmentation. In: Medical Image Computing and Computer-Assisted Intervention–MICCAI 2015: 18th International Conference, Munich, October 5–9, 2015, Proceedings, Part III 18, pp. 234–241. Springer, Berlin (2015)

77.

Rossler, A., Cozzolino, D., Verdoliva, L., Riess, C., Thies, J., Nießner, M.: Faceforensics++: learning to detect manipulated facial images. In: Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 1–11 (2019)

78.

Schaefer, G., Stich, M.: Ucid–An Uncompressed Colour Image Database School of Computing and Mathematics. Nottingham Trent University, Nottingham (2003)

79.

Shen, Z., Ding, F., Shi, Y.: Anti-forensics of image sharpening using generative adversarial network. In: Wang, H., Zhao, X., Shi, Y., Kim, H.J., Piva, A. (eds.) Digital Forensics and Watermarking. Springer International Publishing, Cham (2020)

80.

Simonyan, K., Zisserman, A.: Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556 (2014)

81.

Stamm, M.C., Liu, K.R.: Forensic detection of image manipulation using statistical intrinsic fingerprints. IEEE Trans. Inf. Forensics Secur. 5(3), 492–506 (2010)Crossref

82.

Stamm, M.C., Liu, K.R.: Anti-forensics of digital image compression. IEEE Trans. Inf. Forensics Secur. 6(3), 1050–1065 (2011)Crossref

83.

Stamm, M.C., Zhao, X.: Anti-forensic attacks using generative adversarial networks. In: Multimedia Forensics, p. 467 (2022)

84.

Stamm, M.C., Tjoa, S.K., Lin, W.S., Liu, K.R.: Anti-forensics of JPEG compression. In: 2010 IEEE International Conference on Acoustics, Speech and Signal Processing, pp. 1694–1697. IEEE (2010)

85.

Sun, J.Y., Kim, S.W., Lee, S.W., Ko, S.J.: A novel contrast enhancement forensics based on convolutional neural networks. Signal Process.: Image Commun. 63, 149–160 (2018)

86.

Uddin, K., Yang, Y., Oh, B.T.: Anti-forensic against double JPEG compression detection using adversarial generative network. In: Proceedings of the Korean Society of Broadcast Engineers Conference, pp. 58–60. The Korean Institute of Broadcast and Media Engineers, Seoul (2019)

87.

Vorugunti, C.S., Mukherjee, P., Pulabaigari, V.: Online signature profiling using generative adversarial networks. In: 2020 International Conference on COMmunication Systems & NETworkS (COMSNETS), pp. 894–896 (2020). https://​doi.​org/​10.​1109/​COMSNETS48256.​2020.​9027369

88.

Wang, S., Jia, S.: Signature handwriting identification based on generative adversarial networks. J. Phys.: Conf. Ser. 1187(4), 042047 (2019). https://​doi.​org/​10.​1088/​1742-6596/​1187/​4/​042047

89.

Wu, J., Sun, W.: Towards multi-operation image anti-forensics with generative adversarial networks. Comput. Secur. 100, 102083 (2021). https://​doi.​org/​10.​1016/​j.​cose.​2020.​102083, https://​www.​sciencedirect.​com/​science/​article/​pii/​S016740482030356​4

90.

Wu, R., Li, X., Yang, B.: Identifying computer generated graphics via histogram features. In: 2011 18th IEEE International Conference on Image Processing, pp. 1933–1936. IEEE (2011)

91.

Wu, J., Wang, Z., Zeng, H., Kang, X.: Multiple-operation image anti-forensics with WGAN-GP framework. In: 2019 Asia-Pacific Signal and Information Processing Association Annual Summit and Conference (APSIPA ASC), pp. 1303–1307 (2019). https://​doi.​org/​10.​1109/​APSIPAASC47483.​2019.​9023173

92.

Wu, J., Liu, L., Kang, X., Sun, W.: A generative adversarial network framework for JPEG anti-forensics. In: 2020 Asia-Pacific Signal and Information Processing Association Annual Summit and Conference (APSIPA ASC), pp. 1442–1447 (2020)

93.

Wu, J., Tong, T., Chen, Y., Kang, X., Sun, W.: An adversarial learning framework with cross-domain loss for median filtered image restoration and anti-forensics. Comput. Secur. 112, 102497 (2022). https://​doi.​org/​10.​1016/​j.​cose.​2021.​102497, https://​www.​sciencedirect.​com/​science/​article/​pii/​S016740482100321​7

94.

Xie, H., Ni, J., Shi, Y.Q.: Dual-domain generative adversarial network for digital image operation anti-forensics. IEEE Trans. Circuits Syst. Video Technol. 32(3), 1701–1706 (2022). https://​doi.​org/​10.​1109/​TCSVT.​2021.​3068294Crossref

95.

Xuan, X., Peng, B., Wang, W., Dong, J.: On the generalization of GAN image forensics. In: Sun, Z., He, R., Feng, J., Shan, S., Guo, Z. (eds.) Biometric Recognition, pp. 134–141. Springer International Publishing, Cham (2019)Crossref

96.

Yang, P., Ni, R., Zhao, Y., Cao, G., Zhao, W.: Robust contrast enhancement forensics using pixel and histogram domain CNNs. arXiv preprint arXiv:1803.04749 (2018)

97.

Yao, Y., Hu, W., Zhang, W., Wu, T., Shi, Y.Q.: Distinguishing computer-generated graphics from natural images based on sensor pattern noise and deep learning. Sensors 18(4), 1296 (2018)Crossref

98.

Yapıcı, M.M., Tekerek, A., Topaloğlu, N.: Deep learning-based data augmentation method and signature verification system for offline handwritten signature. Pattern Anal. Appl. 24(1), 165–179 (2021). https://​doi.​org/​10.​1007/​s10044-020-00912-6Crossref

99.

Ye, J., Shen, Z., Behrani, P., Ding, F., Shi, Y.Q.: Detecting USM image sharpening by using CNN. Signal Process.: Image Commun. 68, 258–264 (2018)

100.

Yuan, H.D.: Blind forensics of median filtering in digital images. IEEE Trans. Inf. Forensics Secur. 6(4), 1335–1345 (2011)Crossref

101.

Zeng, H., Kang, X., Peng, A.: A multi-purpose countermeasure against image anti-forensics using autoregressive model. Neurocomputing 189, 117–122 (2016)Crossref

102.

Zhan, Y., Chen, Y., Zhang, Q., Kang, X.: Image forensics based on transfer learning and convolutional neural network. In: Proceedings of the 5th ACM Workshop on Information Hiding and Multimedia Security, pp. 165–170 (2017)

103.

Zhang, Y., Li, S., Wang, S., Shi, Y.Q.: Revealing the traces of median filtering using high-order local ternary patterns. IEEE Signal Process. Lett. 21(3), 275–279 (2014)Crossref

104.

Zhang, Z., Liu, X., Cui, Y.: Multi-phase offline signature verification system using deep convolutional generative adversarial networks. In: 2016 9th International Symposium on Computational Intelligence and Design (ISCID), vol. 2, pp. 103–107 (2016). https://​doi.​org/​10.​1109/​ISCID.​2016.​2033

105.

Zhao, X., Chen, C., Stamm, M.C.: A transferable anti-forensic attack on forensic CNNs using a generative adversarial network. arXiv abs/2101.09568 (2021)

106.

Zhu, J.Y., Park, T., Isola, P., Efros, A.A.: Unpaired image-to-image translation using cycle-consistent adversarial networks. In: 2017 IEEE International Conference on Computer Vision (ICCV) (2017)

107.

Zou, H., Pengpeng, Y., Ni, R., Zhao, Y.: Anti-forensics of image contrast enhancement based on generative adversarial network. Secur. Commun. Netw. 2021, 1–8 (03 2021). https://​doi.​org/​10.​1155/​2021/​6663486

© The Author(s), under exclusive license to Springer Nature Switzerland AG 2024

E. Nowroozi et al. (eds.)Adversarial Multimedia ForensicsAdvances in Information Security104https://doi.org/10.1007/978-3-031-49803-9_4

Refined GAN-Based Attack Against Image Splicing Detection and Localization Algorithms

Shengbang Fang1   and Matthew C. Stamm1  

(1)

Department of Electrical and Computer Engineering, Drexel University, Philadelphia, PA, USA

Matthew C. Stamm

Email: mcs382@drexel.edu

Keywords

Image forensicsDeep learningContrastive learningAnti-forensic attackAdversarial attack

1 Introduction

Recent developments in digital image manipulation and synthesizing techniques have enabled people to easily edit and generate content in images. However, this also presents a significant threat to the authenticity of images. To combat the threats caused by image forgery, researchers in the forensics community have developed numerous forensic algorithms utilizing traditional signal processing methods [7, 25, 36, 45, 52] and deep learning techniques [2]. These algorithms include image manipulation detection [6, 10], camera model source identification [54], image splicing detection and localization [18, 31, 42, 43], synthetic image detection [26, 55], and deepfake detection [44, 46, 63, 64].

One important approach is image splicing detection and localization algorithms. The state-of-the-art splicing detection and localization algorithms utilize Siamese neural networks to detect and localize forgery content in the image by analyzing the inconsistency of forensic traces throughout the image. These algorithms include Forensic Similarity Graph (FSG) [43], EXIF-Net [31], and Noiseprint [18]. Among them, FSG employs a Siamese network trained to predict whether two images are from the same camera model. EXIF-Net uses a Siamese network trained to predict whether the input pair of images contains the same EXIF metadata. Noiseprint employs a fully convolutional neural network trained in a Siamese manner to output the specific “noise” associated with the source camera model. These algorithms utilize patch-wise similarity information throughout the full-size image and employ different clustering algorithms to detect forgery content with distinct forensic traces from the real background of the images. They have been demonstrated to be successful in detecting and localizing spliced images, especially in images with large sizes (Fig. 1).

An illustrative process starts with the input image, followed by GAN-based and refined GAN-based, and then ends with the heatmap under baseline generative attack.

Fig. 1

The proposed method of our attack. Baseline generative attack sometimes still retain the cluster community structure of the forensic traces of an spliced image. Our attack refine the baseline generative attack using the spliced images, by further remove the inconsistency of forensic similarity among spliced images. The refinement will make the forensic traces distribution of the image more even and consistent. Our proposed method can significantly reduce the correlation between the ground truth mask and the predicted heatmap of Siamese network-based forensic algorithms

While forensics algorithms have significantly aided researchers and investigators in combating digital image forgery, they remain vulnerable to anti-forensic and adversarial attacks. It is important to understand the weakness of the existing forensic algorithms through anti-forensic research. Researchers have discovered that many signal-processing-based forensic algorithms are susceptible to being fooled by anti-forensics attacks [27, 48, 50]. As deep learning has gained popularity, adversarial example attacks [12, 28, 41] have also been found to be highly effective in deceiving deep learning-based approaches. The adversarial example attack fools the deep neural network by introducing small perturbations on the images, which could be invisible to human eyes. In the meantime, GAN-based generative attack [14, 24, 60] have demonstrated significant success in deceiving forensic algorithms with high accuracy. Research [24] has shown that this type of attack can convincingly deceive state-of-the-art Siamese-based image splicing detection and localization algorithms.

However, while the recent GAN-based attack on splicing detection and localization has shown a high success rate, it may be less effective in certain scenarios. The state-of-the-art splicing detection and localization algorithms often contains two stages when doing analysis. In Stage 1 these algorithms use Siamese neural networks to compare the forensic similarity demographics within an image. In Stage 2 these algorithms use clustering algorithms on the similarity measurements to detect and localize falsified contents. The reason why existing GAN-based attack can fail in certain scenarios lies in the fact that GAN-based attacks, along with other types of attacks, are primarily optimized to deceive Siamese neural networks. They are not explicitly designed to deceive the clustering algorithms utilized by the forensic approaches. As a result, in some cases, GAN-based attacks synthesize forensic traces in the attacked spliced images that in come cases cause forensic traces from different regions to appear similar, but the traces within the spliced content may still exhibit lower level of similarities with the real region. This allows the clustering algorithm to detect and localize the spliced content in the attacked image. Consequently, a new attack optimized to deceive clustering algorithms is necessary to gain a deeper understanding of the vulnerabilities and potential risks associated with Siamese-based forensic algorithms.

In this paper, we present a novel attack that refines the GAN-based approach, effectively deceiving Siamese-based splicing detection and localization algorithms in scenarios where GAN-based attacks is less successful. Our attack directly optimizes the GAN-based attack generator using the provided spliced images, making images from the spliced content have same scale of similarities with unmodified content, thereby eliminating the inconsistencies in forensic similarity between patches from the same source and patches from different sources. Through a series of experiments, we demonstrate that our attack significantly improves upon the GAN-based approach, achieving a higher success rate in fooling Siamese-based splicing detection and localization algorithms.

Our paper makes the following major contributions:

1.

We introduce a novel attack approach that refines the GAN-based attack. By doing so, our attack substantially enhances the performance of existing Siamese neural network-based splicing detection and localization algorithms in a white-box scenario.

2.

We propose a new optimization approach to effectively balance multiple loss functions. Through experiments, we demonstrate the effectiveness of this optimization method in optimizing our attack on individual images.

3.

We provide comprehensive experimental evaluation and examples of our proposed attack. The results show a significant improvement in attack performance, effectively fooling the targeted forensic algorithms when the GAN-based attack is less efficient.

2 Related Work

This section introduces research related to the proposed attack. We first present the Siamese networks based splicing detection and localization algorithms that we target in our proposed method, and then discuss existing anti-forensic attacks that leverage adversarial techniques. The proposed attack directly optimizes the community structure of forensic traces and can deceive clustering algorithms, so we also cover adversarial attacks that focus on fooling clustering algorithms. Lastly, since the proposed attack also optimizes multiple training loss functions, we also discuss existing methods for balancing multiple loss functions in multi-task optimization.

2.1 Siamese Network Based Forensic Algorithms

In the recent years, researchers developed multiple types of algorithms to detect and localized forgery contents in the image. On of the most popular type of these algorithms are Siamese network based and algorithm. These includes FSG [43], EXIF-Net [31], Noiseprint [18] and other similar approaches [56, 58]. These algorithms trained Siamese networks to predict the similarity or distance of forensic traces between input pair of image patches. Then construct a affinity matrix according to pair-wise forensic traces relationship throughout the full-size image. After that a clustering algorithm is applied to the affinity matrix to decide whether the image patches have one or more community structure. If there are more than one cluster of forensic traces exists in the image, then the algorithm will predict the associated image patches to have out-of-distribution forensic trace and contain forgery content.

2.2 Traditional Anti-Forensic Attacks

Multiple types of anti-forensic attacks have been developed by researchers over the past fifteen years. Traditional forensic algorithms focus on searching for forensic traces using signal-processing-based methods. Similarly, the first anti-forensic attack that attacks against these algorithms are also based on signal-processing techniques. These attacks tend to work by building parametric models of the forensic traces that statistical detectors searched for, and fool the forensic algorithms by removing or falsifying these statistical traces [3, 5, 27, 50]. These work include attacking on median filtering detectors [23], image resampling detectors [37], contrast enhancement detectors [11], image compression detectors [22, 48], and etc [1, 4, 9, 51].

2.3 GAN-Based Approaches

Though signal-processing-based anti-forensic attack show they are capable of fooling traditional signal-processing-based forensic methods, designing of these techniques is very challenging and time-consuming. Furthermore, as deep learning based forensic techniques have become popular, researchers have found that it is difficult, if not impossible, to use signal-processing-based attack to directly model traces learned by neural networks. At the same time, anti-forensics researchers were able to leverage generative techniques for deep learning to create new GAN-based anti-forensic attacks. These generative attacks work by using an anti-forensic generator to synthesize forensic traces used by a particular forensic algorithm. These anti-forensic generators are adversarially trained against a forensic neural network to learn to synthesize forensic traces to fool the victim forensic algorithms [49], Related work include attack on median filtering detector [34], camera model classifier [13, 14], synthetic image detector [62], and etc [21, 59, 61].

2.4 Adversarial Example Attacks

Another type of anti-forensic attack on deep learning based forensic algorithms are adversarial example-based attack. The adversarial example attack include FGSM [28], Carlini Wagner’s attack [12], Projected Gradient Descent [41], Limited-memory BFGS [28], and etc. These algorithms generate perturbations directly on the image to manipulate the prediction of the victim neural network according to the attackers’ intentions. Related work that based on adversarial example method include attack on image steganography embedding [53], and attack on splicing localization algorithms [47] and etc.

2.5 Attacks Against Clustering and Contrastive Learning

The state-of-the-art forensic algorithms for forgery detection and localization utilize Siamese networks and clustering algorithms. Attacking these algorithms not only requires the attack to fool the Siamese network but also the downstream clustering algorithms. Researchers in the machine learning community have developed several adversarial attacks against clustering algorithms. Biggio et al. [8] proposed a method to add small perturbations into the data and fool hierarchical clustering algorithms. Crussell and Kegelmeyer [19] proposed a method to attack the DBSCAN clustering algorithm. Cinà et al. [17] proposed a black-box attack algorithm by measuring the cluster change. Kumar et al. [38] proposed a method to attack ensemble clustering by training a generative adversarial model using KL divergence and graph mutation. Chhabra et al. [15] proposed a black-box attack to fool clustering algorithms. Meanwhile, researchers have also utilized adversarial learning to improve the robustness of contrastive learning and clustering algorithms [16, 29, 32, 35, 57]. However, these efforts are less relevant to our problem and proposed methods.

2.6 Multi-Task Training Optimization

Investigators often rely on multiple forensic algorithms as their analysis tools. Successfully attacking a system requires fooling multiple forensic algorithms simultaneously. To achieve this, it is crucial to optimize the attack with a balance between different loss functions. Researchers have explored various methods to strike this balance, such as direct sum, Dynamic Weight Average [40], Uncertainty Weighting [33], Loss-Balanced Task Weighting [39], and others. These loss-weighted algorithms have made significant advancements in effectively balancing different loss functions during training.

However, it is worth noting that when the iteration steps are limited, the dynamic weighting strategy’s estimation of the weight might be less sensitive, potentially affecting the attack’s performance. Thus, carefully considering the trade-offs and sensitivity of the dynamic weighting approach becomes essential in practical applications.

3 Problem Formulation

Siamese-network-based forensic algorithms have showcased their advanced performance in spliced image detection and localization. These algorithms estimate the inconsistency of forensic traces across full-size images and predict spliced content by detecting regions with out-of-distribution forensic traces. When attempting anti-forensic attacks on spliced images to deceive these Siamese-based forensic algorithms, current anti-forensic approaches and adversarial attack methods fall short in producing stable attack performance. Adversarial example attacks, including FGSM [28], PGD [41], Carlini-Wagner Attack [12], L-BFGS [28], are designed to attack individual image patches. However, the lack of consideration of inconsistent forensic traces after the attack makes these methods less successful.

On the other hand, recent GAN-based attacks [14, 24] can synthesize consistent forensic traces into spliced images, but they still lack control over the forensic traces distribution after the attack on full-size spliced images. The major problem lies in the fact that existing approaches focus solely on making the attacked image patches cross the decision boundary of the forensic Siamese networks. However, they do not directly optimize for removing image-level inconsistencies of forensic traces. Even if image patches are successfully attacked and cross the decision boundary of the Siamese networks, image patches from the same source (both background or spliced content) can still maintain higher similarity scores than image patches from different sources (one from background and one from spliced content). As a result, the splicing detection algorithm can still identify the attacked splice image, and the localization algorithm can still pinpoint the spliced contents.

To achieve consistent attack performance and successfully deceive the Siamese-based forensic algorithms, we need an attack capable of not only fooling the forensic Siamese networks, but also reconstructing the forensic traces distribution, thereby making image patches from different sources (one from the background and one from the spliced content) have similar similarity scores to image patches from the same source. In this paper, we propose an attack aimed at producing consistent forensic traces over a spliced image. Building on previous GAN-based attack techniques, our attack optimizes the attack on the given single spliced image to deceive splicing detection and localization algorithms in a white-box scenario.

4 Proposed Method

In this section, we present our proposed approach, which improves upon our previous GAN-based attack [24] as the baseline generative attack, and enhances its performance when applied to each spliced image. Currently, the GAN-based attack exhibits a limitation in its optimization for achieving consistent similarity of forensic traces across different regions within an image. To address this crucial issue, we have developed a core idea to refine the generator G of the baselne generative attack on the specific spliced image. Our refined attack solution is centered around the generator G, which plays a pivotal role in generating consistent forensic traces over the entire full-size image. By leveraging this intrinsic property of the generator G, our refinement process ensures that the forensic traces generated by G maintain their consistency. Furthermore, this refinement simultaneously increase the level of cross-region consistency, effectively resolving the current limitation of the baselne generative attack.

The entire process of launching the attack on a spliced image consists of several stages. Firstly, we sample patches from the spliced images, which serve as the training set for refining the generator G. Secondly, we proceed to fine-tune the generator by utilizing a proposed optimization method that incorporates multiple training loss functions. By optimizing on these loss functions, we enable the generator to effectively reduce the inconsistency of forensic traces. Lastly, after fine-tuning, we deploy the refined generator and apply it to the full-size spliced image. This step synthesizes consistent forensic traces, thereby effectively deceiving the splicing detection and localization methods. We provide detailed explanations for each of these stages in the following of this section.

4.1 Stage 1. Patch Sampling

The purpose of patch sampling is to select patches that contain forensic traces within the image, allowing us to refine the generator G and generate synthetic forensic traces that exhibit consistency across both background/pristine and spliced/forgery regions.

In the case of a spliced image I, we begin by sampling representative image patches from the entire or part of the image, which encompasses both the background/pristine and spliced/forgery contents. Consequently, we create pairs of patches accordingly. Specifically, we denote the patches $$\mathbf {p}$$ from the spliced region as community $$C_f$$, and the patches from the background content as community $$C_b$$. This allows us to construct two distinct types of pairs of image patches.

The first type, denoted as $$P_s$$, comprises pairs of patches originating from the same community. On the other hand, the second type, known as $$P_d$$, consists of pairs of patches from different communities. By categorizing patches in this manner, we can effectively analyze and refine the generator’s ability to produce synthetic forensic traces that maintain consistency within the same community and further investigate the generator’s capability to reduce cross-region inconsistencies between different communities. The sampled pairs of patches can be expressed as:

(1)

(2)

These pairs of patches constitute the training set used to fine-tune the generator G for attacking the full-size spliced image I. By constructing loss functions based on $$P_{s}$$ and $$P_{d}$$, we leverage the original distribution information of forensic traces and refine G accordingly. This refinement allows G to synthesize forensic traces that consistently yield high similarity scores even when evaluated by multiple Siamese networks.

4.2 Stage 2. Refinement

In Stage 2, we focus on refining the generator G that was initially initialized by the baselne generative attack. For this purpose, we introduce a novel series of loss functions and employ a novel training method to fine-tune G on each spliced image. Once the refinement process is completed, the attack is launched by inputting the spliced image into G, and the attack image is then generated as the output.

Loss Functions

We design three types of loss functions to refine the generator G using the sampled patches. They are adversarial loss $$L_{S_n}$$, contrastive loss $$L_{C_n}$$ and perceptual loss $$L_P$$. Each of these loss functions serves a crucial role in enhancing the performance of the attack. The adversarial loss $$L_{S_n}$$ is designed to force the generator G to maintain overall consistency in the synthetic forensic traces throughout the entirety of the image. On the other hand, the contrastive loss $$L_{C_n}$$ aims to bring the forensic similarity score of $$P_{d}$$ closer to that of $$P_{s}$$, effectively reducing the disparity between them. Both $$L_{S_n}$$ and $$L_{C_n}$$ depend on the output of the Siamese networks $$S_n$$s and have a direct impact on the attack performance.

In parallel, the perceptual loss $$L_P$$ is constructed to reduce the difference between input and output images of the generator G. This particular loss function solely focuses on the attacked image’s quality, thereby contributing to the overall effectiveness of the attack. It is important to note that the attacker has the flexibility to choose different approaches to strike a balance between image quality and attack performance for each individual image. This allows for adaptability and customization, optimizing the attack to suit specific scenarios.

Adversarial Loss $$L_{S_n}$$ We utilize the cross-entropy loss of the output of each Siamese network $$S_n$$ to construct the adversarial loss. For simplicity, we will demonstrate the loss function constructed on the positive node (indicating similarity) of the output. The adversarial loss penalizes pairs of patches with lower similarity and encourages the generator G to ensure that every pair of patches has a high similarity score. The adversarial loss for $$S_n$$ is defined as follows:

(3)

Where $${\mathbf {p}}_1$$ and $${\mathbf {p}}_2$$ represent the input pair of patches, and $$G(\cdot )$$ denotes the generator. This loss ensures that each pair of attacked patches over the full-size image is still classified as similar by $$S_n$$.

Without incorporating this loss term, the refinement training would not compel the generator G to produce consistent forensic traces, potentially resulting in an image with different forensic traces for every region. Although in such a scenario the clustering algorithms might be fooled, the loss of consistency in forensic traces could still render the image susceptible to detection as forgery.

Contrastive Loss $$L_{C_n}$$ We also construct the contrastive loss using the output of the positive node (indicating similarity) of $$S_n$$, drawing inspiration from the contrastive loss commonly used in metric learning. In metric learning, the contrastive loss aims to separate samples from different classes. However, in our case, the contrastive loss $$L_{C_n}$$ is designed to bring the similarity scores between different types of pairs closer together. The definition of $$L_{C_n}$$ is as follows:

(4)

We utilize this loss to train the generator G, aiming to reduce the disparity between the forensic similarity scores of $$P_d$$ and $$P_s$$. This loss plays a crucial role as it directly optimizes G to synthesize consistent forensic traces. Consequently, patches from both $$C_f$$ and $$C_b$$ cannot be effectively clustered into two distinct groups by the FSG and EXIF-Net after the attack.

Without this loss function, the generator G might produce a very high degree of similarity for forensic traces across different regions of an image. However, the similarity of $$P_{d}$$ could still be slightly smaller than that of $$P_{s}$$, leaving room for the clustering algorithm to successfully locate the forgery content.

Perceptual Loss $$L_P$$ We employ a perceptual loss $$L_P$$ to ensure that the synthetic forensic traces remain imperceptible to human eyes. In contrast to the training process of the baselne generative attack, where we use the $$L_2$$ loss to limit significant deviations in a single pixel, we opt for the $$L_1$$ loss here, which allows for a more flexible pixel change in each image. We make this switch to the $$L_1$$ loss because it permits smaller perturbations on the image.

For the potential of significant deviation in a single pixel that results artificial spots in the image causing by using $$L_1$$ loss, we expect the $$L_1$$ loss in fine-tuning will not result such extreme pixel values. This is because the baselne generative attack has already effectively controlled large deviations in individual pixels. By employing the $$L_1$$ loss during training, we aim to ensure a more subtle pixel adjustment without causing noticeable artifacts. The $$L_1$$ loss is defined as:

(5)

Where w, h and c are width, height and channel of the input image patches. Without this loss function, the refinement training can easily get collapsed and result in an image with a constant pixel value.

Total Loss The proposed method optimizes all three aforementioned loss functions individually, rather than using a linear combination of them. We will provide a detailed explanation of the optimization method in the following sections.

In order to compare with other optimization methods, we employ a linear combination of the losses for the competing optimization techniques in the later section, which is defined as follows:

(6)

Refinement Training

To fine-tune G on the given image I and further fool the target splicing detection and localization algorithms, we optimize G using $$L_{S_n}$$s, $$L_{C_n}$$s, and $$L_P$$. To ensure that each loss function decreases and enhances the attack performance, we apply the multiple Adam optimizers associated to each loss function $$L_j$$. This approach allows different Adam optimizers to estimate and utilize individual momentum for each loss function, eliminating the need to estimate weights for different loss functions for each image. This alleviates the requirement for extensive experiments over each image to determine the optimal weights.

To stabilize the loss decreasing process and reduce the negative influence of randomness, we adopt batch gradient descent over $$P=P_d \cup P_f$$ instead of stochastic gradient descent. For each batch, we first compute the weight updates $$\varDelta G_j$$ associated with each loss function $$L_j$$ using each optimizer, and then apply all the weight updates together and update G by $$G \gets G - \sum _{j} \varDelta G_j$$. The pseudo-code for the proposed training procedure is described in Algorithm 1:

Algorithm 1 Proposed refined attack algorithm

procedure Refine G on image(I) ⊳ I is the input image

    $$P \gets P_{s} \cup P_{d} \; \in \; I$$ ⊳ Sample image patches

    for $$i=0$$ to N do

        for j in $$\{S_n\}\cup \{C_n\}\cup \{P\}$$ do

            Compute $$L_j$$ average over P

            Compute gradients updates for $$L_j$$ $$\varDelta G_j \gets Adam(L_j)$$

        end for

        Update the generator $$G \gets G - \sum _{j}\varDelta G_j $$

    end for

end procedure

This decision stems from the fact that searching for the best weighting parameters for different loss functions within an image often requires extensive experimentation. Moreover, the optimal weighting parameters for one image may significantly differ from those of another. To accommodate varying optimal weights for each forgery image, the attacker might need an automatic weighting strategy. To streamline the training process, the automatic weighting strategy should effectively balance between different losses within limited steps.

To address this challenge, we leverage the fast optimization speed and momentum estimation capability of Adam optimization. We employ separate Adam optimizers to estimate the best momentum for each loss function. This strategy automatically balances between the different loss functions, enabling efficient and effective fine-tuning of G.

Deployment

After completing the refinement training, we extract the specific refined generator G associated with the given image. We launch the attack by applying this refined generator G to the image, resulting in the attacked image, as illustrated in Fig. 2. It is important to note that using the refined generator G trained on image $$I_1$$ for attacking image $$I_2$$ is not appropriate, as $$I_1$$ and $$I_2$$ have different distributions of forensic traces, leading to distinct refined G models.

A process of the deployment of the attack. Starting with the ground truth spliced images, followed by heatmap under baseline generative attack, ground truth spliced images, and then the heatmap under proposed attack.

Fig. 2

Deployment of the attack. Left column: the baseline generative attack. Right column: our proposed attack. We refine the generator for each image. After the refinement training, the attack is launched by feed the images to the refined generator and output the attacked images

5 Experimental Setup

In this section, we present the experimental setup used to evaluate the performance of our proposed attack. We begin by introducing the dataset employed for this evaluation. Subsequently, we provide detailed information on the training strategy, sampling method, and training parameters utilized to train the model before applying it to the spliced images.

5.1 Dataset

To demonstrate the effectiveness of our proposed attack, we selected two image splicing datasets: the Columbia dataset [30] and the Carvalho DSO-1 dataset [20]. The Columbia dataset comprises 183 authentic and 180 spliced images, while the DSO-1 dataset consists of 100 authentic and 100 spliced images. These datasets contain images of relatively large size. Most of the images in the Columbia dataset have dimensions larger than $$500\times 500\times 3$$, and most of the images in the DSO-1 dataset have dimensions larger than $$1920\times 1080\times 3$$. Additionally, all the images are uncompressed.

We chose these two datasets for two main reasons. Firstly, they are publicly available, which ensures transparency and reproducibility of our results. Secondly, FSG and EXIF-Net achieve the highest performance on these datasets. Attacking images from these datasets introduces an evaluation bias towards FSG and EXIF-Net’s performance and also makes our attack more challenging.

5.2 Training Methods

Construction of Communities

To apply the attack on each image in the above datasets, we first need to gather community information in the spliced image to determine which image patches belong to $$C_1$$ and which image patches belong to $$C_2$$. There are two ways to achieve this. First, if the attacker has access to the ground truth mask of the spliced image, patches from $$C_1$$ and $$C_2$$ can be extracted from the positive and negative regions defined by the mask. Second, if there is no ground truth mask available, the attacker can use either FSG, EXIF-Net, or both to estimate $$C_1$$ and $$C_2$$ using their clustering algorithms.

In our experiment, we choose the first approach, which involves extracting patches based on the ground truth masks for each spliced image in the dataset. However, it’s worth noting that the two strategies yield very similar attack performance. We opted for the first strategy to simulate a common scenario where the attacker has full knowledge about the forgery image, including access to the ground truth masks.

Sampling from Communities

Image patches from the two communities in the image are often imbalanced and redundant for training the attack. The imbalance arises because spliced content in the images is generally smaller than the background, resulting in an intrinsic imbalance between patches belonging to $$C_1$$ and $$C_2$$. Additionally, redundancy occurs when either the spliced content or background regions contain too many patches. Training the attack using all pairs of patches could be resource-intensive and unnecessary. Therefore, we opt to sample only a subset of the patches from both communities.

Training Parameters

During the training process on each image in the evaluation datasets, we set the total number of epochs to be $$N=100$$. The initial learning rate is set to 1e-5 and is decayed by half every 10 iterations for each loss function and its associated Adam optimizer. The margin $$\delta $$ we choose for the contrastive loss $$L_C$$ is 0.01.

5.3 Evaluation Metrics

For evaluating splicing detection, we use mean average precision (mAP) over multiple thresholds as the evaluation metric. It is worth noting that for mAP, a value of 0.5 indicates that the detection algorithm is making random guesses and cannot distinguish between real and spliced images. Any results below 0.5 indicate that the attack has successfully fooled the splicing detection algorithm.

For evaluating splicing localization between predicted masks and the ground truth masks of the spliced images, we choose the $$F_1$$ score and the Matthews correlation coefficient (MCC) score as the evaluation metrics. The $$F_1$$ score has a value range between $$[0, 1]$$ and can balance between precision and recall of the predicted mask. Let TP denote true positive, FP denote false positive, TN denote true negative, and FN denote false negative of the predicted mask. The $$F_1$$ score is defined as:

(7)

The MCC score can provide a balanced measurement for a binary classification. It has a value range between $$[-1, 1]$$, and is defined as:

(8)

We choose the threshold on the predicted masks that results in the highest $$F_1$$ score and MCC score for each image in the datasets. However, we acknowledge that this approach is not entirely realistic, as it tends to favor the localization performance (FSG and EXIF-Net) and bias against our proposed attack. We select this threshold strategy to showcase the least achievable attack performance through different attacks.

To evaluate the relative attack improvements of method A over B, we introduce the relative performance improvement (Improvement) to highlight the scale of improvement achieved by A over B. The Improvement is defined as: …(proceed with the definition of the Improvement).

(9)

Where $$P_B$$ represents the performance of method B, $$P_A$$ represents the performance of method A, and $$P_{rand}$$ represents the performance of random guess. For localization evaluation, $$P_{rand}$$ is calculated by randomly assigning positive and negative predictions over every pixel in the predicted map. In the following experiments, we choose method B to be the baseline generative attack (without our proposed method) in order to demonstrate the performance improvement achieved by our proposed method compared to using only the baseline generative attack.

6 Results

In this section, we present our analysis of the attack performance of our proposed method. We begin by showing the splicing detection and localization performance over the entire datasets, both before and after applying our proposed attack. Next, we analyze the improvement achieved by our attack compared to the Baseline Generative Attack attack for different images in the datasets. Finally, we conduct an ablation study to evaluate the impact of different proposed loss functions.

6.1 Overall Attack Performance

We present the splicing detection and localization performance, both before and after different attacks, in Table 1. We compare the Baseline Generative Attack attack, our proposed attack only on FSG (Proposed-FSG), our proposed attack only on EXIF-Net (Proposed-EXIF), our proposed attack on both FSG and EXIF-Net (Proposed-Both), and random guess. The results indicate that our proposed attack achieves higher attack capability against FSG and EXIF-Net in a white-box scenario.

Table 1

Detection and localization performance before and after attacks, the highest attack performances are marked in bold face. “Proposed-Both” indicate the our proposed attack that refine the baseline generative attack using both FSG and EXIF-Net

Columbia

DSO-1

Detection

Localization

Detection

Localization

Evaluation

method

Attack method

mAP

F-1

MCC

mAP

F-1

MCC

FSG

None

0.94

0.90

0.86

0.93

0.84

0.82

Baseline generative attack

0.46

0.58

0.44

0.08

0.40

0.30

Proposed-FSG

0.46

0.59

0.45

0.14

0.36

0.25

Proposed-EXIF

0.46

0.58

0.44

0.10

0.39

0.28

Proposed-both

0.44

0.53

0.37

0.09

0.36

0.25

Random guess

0.50

0.41

0

0.50

0.25

0

“Both” improvement

N/A

29.4%

15.9%

N/A

26.7%

16.7%

EXIF-SC

None

0.98

0.91

0.88

0.76

0.57

0.51

Baseline generative attack

0.38

0.66

0.55

0.08

0.36

0.25

Proposed-FSG

0.73

0.79

0.73

0.36

0.42

0.32

Proposed-EXIF

0.23

0.57

0.43

0.08

0.33

0.21

Proposed-both

0.24

0.59

0.45

0.09

0.32

0.20

Random guess

0.50

0.41

0

0.50

0.25

0

“Both” improvement

N/A

28.0%

18.2%

N/A

27.3%

20.0%

When only attacking FSG, our attack demonstrates better white-box attack performance on localization over DSO-1, and only slightly lower attack performance on localization over Columbia. However, our attack on FSG reduces the attack performance against EXIF-Net, illustrating the necessity of the ability to attack multiple algorithms simultaneously.

When only attacking EXIF-Net, our attack consistently improves over the Baseline Generative Attack attack in the white-box scenario, while maintaining no reduction in performance against FSG. This observation aligns with the fact that attacking against EXIF-Net transfers better to FSG than the transferability of attacking FSG over EXIF-Net.

When attacking both FSG and EXIF-Net, we achieve consistent attack improvement over the Baseline Generative Attack attack in localization. The RPR is over 26% for F-1 score and over 16% for MCC score. For detection, attacking both FSG and EXIF-Net achieves the same level of detection as the Baseline Generative Attack attack. Overall, these results demonstrate that when attacking both FSG and EXIF-Net, our proposed attack consistently improves the localization performance over both evaluation datasets.

6.2 When Baseline Generative Attack Fails

Next, we evaluate our attack performance when baseline generative attack struggles to fool FSG and EXIF-Net. Although the baseline generative attack significantly lowers the detection and localization performance of FSG and EXIF-Net, there are instances where it is less effective. In certain images, the baseline generative attack can still result in a detection rate higher than random guessing and localization with a high correlation with ground truth masks. Our proposed attack shows significant improvement on these challenging images. Here, we discuss the detection and localization improvement achieved through our proposed attack.

Attack Against Splicing Detection

For the detection evaluation, we divided the images from the Columbia and Carvalho DSO-1 datasets into 10 groups based on the splicing detection performance under the baseline generative attack. Each group represents a range of mAP values with 10% as the step, ranging from 0–10% to 90–100%. Group 1 (0–10%) contains images with the lowest 10% mAP, while group 10 (90–100%) contains images with the highest 10% mAP, implying that the baseline generative attack cannot effectively fool the splicing detector in this group.

We conducted a comparison of our proposed attack (when attacking only FSG, EXIF-Net, and both algorithms, respectively) with the baseline (No attack), baseline generative attack, and random guessing. The results are shown in Fig. 4. The analysis reveals the following: First, when attacking only FSG or EXIF-Net, our attack consistently outperforms the baseline generative attack, particularly on images in the 90–100% lowest mAP group (the least effective group). Second, even when the images attacked by the baseline generative attack have an mAP higher than random guessing, our attack on both FSG and EXIF-Net can still effectively fool the splicing detector, consistently forcing it to make predictions lower than random guessing. These results demonstrate the superior performance of our attack compared to the baseline generative attack, especially when the latter fails to deceive the splicing detectors.

Attack Against Splicing Localization

For the localization evaluation, we first selected images from the Columbia and Carvalho DSO-1 datasets with F-1 and MCC scores greater than 0.3. Then, we divided these images into 7 groups based on even F-1 and MCC score ranges. Next, we evaluated our proposed attack and compared the results with the None (No attack), Baseline Generative Attack attack, and random guessing. Additionally, we calculated the improvement when the scores were higher than random guessing. The results are displayed in Fig. 5.

From the results, we observed that our proposed attack consistently improved the attack performance against splicing localization, particularly when the baseline generative attack was ineffective. Specifically, our proposed attack achieved over 30% RPR in F-1 score and more than 20% RPR in MCC score for images that had the lowest 10% efficiency with the baseline generative attack. These results demonstrate that our attack consistently and significantly enhances the attack performance over the baseline generative attack in splicing localization algorithms, especially when the baseline generative attack is less efficient.

In Fig. 3, we provide examples of our attack refining the baseline generative attack. From these examples, it is evident that our attack effectively improves upon the baseline generative attack, causing the splicing localization algorithms (FSG and EXIF-Net) to fail in localizing the spliced content.

A heatmap illustrates the splicing localization algorithms. a to d. An example of the localization masks by F S G images, E X IF-Net images, and localization masks produced by E X I F-Net from the Carvalho D S O-1 dataset.

A heatmap of the splicing localization algorithms. a and b. An example of the localization masks produced by F S G from the Columbia dataset and Carvalho D S O-1 dataset. c and d. An example of localization masks by E X I F-Net from the Columbia dataset and Carvalho D S O-1 dataset.

A heatmap illustrates the splicing localization algorithms. a to d. An example of the localization masks by F S G images, E X IF-Net images, and localization masks produced by E X I F-Net from the Carvalho D S O-1 dataset.

A heatmap illustrates the splicing localization algorithms. a to d. An example of the localization masks by F S G images from the Columbia dataset, E X IF-Net images, and localization masks produced by E X I F-Net from the Carvalho D S O-1 dataset.

Fig. 3

Examples of heatmaps predicted by splicing localization algorithms. These examples show the attack performances on spliced images, when baseline generative attack fail and our proposed attack refine the attack. These heatmaps visualized our attack’s capability to fool the splicing localization algorithm when baseline generative attack is less effective. (a) Examples of localization masks produced by FSG on images from the Columbia Dataset, before and after our proposed attack. (b) Examples of localization masks produced by FSG on images from the Carvalho DSO-1 Dataset, before and after our proposed attack. (c) Examples of localization masks produced by EXIF-Net on images from the Columbia Dataset, before and after our proposed attack. (d) Examples of localization masks produced by EXIF-Net on images from the Carvalho DSO-1 Dataset, before and after our proposed attack

6.3 Ablation Study

In this section, we conducted an ablation study to demonstrate the necessity of each loss function we utilized and the multi-optimizer optimization we adopted. Specifically, we focused on our attack against both FSG and EXIF-Net, and compared it with variations that were refined without $$L_{D_n}$$, without $$L_{S_n}$$, and with a different automatic loss-weighting strategy called Uncertainty Weighting [33].

Uncertainty Weighting is an automatic loss-weighting strategy used to balance different training tasks by applying a series of trainable parameters to estimate the uncertainty for each loss. We didn’t explore other weighting strategies, including fixed weighting, as we observed that different images have varying optimal weighting parameters. Using one fixed weighting parameter would cause the loss to increase for many other images and deteriorate the attack performance compared to the baseline generative attack.

The ablation study was conducted on the Columbia dataset, which is the easiest dataset for splicing detection and localization algorithms, yet the most challenging for the anti-forensic attack algorithm. By evaluating on this dataset, we could better highlight the impact of each component of the attack. The results are presented in Table 2.

Table 2

Ablation study. We compare the performance of our proposed attack using both FSG and EXIF-Net, with the baseline generative attack, the attack without using $$L_{C_n}$$, the attack without using $$L_{S_n}$$, and the attack using “Uncertainty Weighting” strategy. Results show the necessity of the proposed loss functions and the proposed optimization strategy

Columbia

Detection

Localization

Evaluation method

Attack method

m-AP

F-1

MCC

FSG

None

0.94

0.90

0.86

Baseline generative attack

0.46

0.58

0.44

Proposed-no $$L_{C_n}$$

0.45

0.56

0.40

Proposed-no $$L_{S_n}$$

0.51

0.61

0.47

Uncertainty

0.47

0.62

0.50

Proposed-both

0.44

0.53

0.37

Random guess

0.50

0.41

0

EXIF-net

None

0.98

0.91

0.88

Baseline generative attack

0.38

0.66

0.55

Proposed-no $$L_{C_n}$$

0.32

0.65

0.54

Proposed-no $$L_{S_n}$$

0.57

0.70

0.60

Uncertainty

0.45

0.68

0.57

Proposed-both

0.24

0.59

0.45

Random guess

0.50

0.41

0

Impact of $$L_{D_n}$$

Without training using $$L_{D_n}$$ (Proposed-No $$L_{D_n}$$) in the loss function, our proposed attack shows very limited gains compared to the baseline generative attack, unlike the significant gains achieved by our proposed both attack (Proposed-Both). This demonstrates the necessity of using $$L_{D_n}$$ to reduce the difference in forensic traces among different areas in the image.

Impact of $$L_{S_n}$$

Without training using $$L_{S_n}$$ (Proposed-No $$L_{S_n}$$) in the loss function, we observed that the attack performance dropped to worse than the baseline generative attack in both FSG and EXIF-Net. One potential reason is that without $$L_{S_n}$$, the attack loses the constraint that forces the network to synthesize consistent forensic traces on the image. Meanwhile, the $$L_{D_n}$$ alone is not able to reduce the differences in forensic traces over the image.

Impact of Multi-Optimizer

Using the Uncertainty Weighting strategy (Uncertainty), instead of our proposed multi-optimizer optimization method, resulted in a worse detection and localization attack performance on both FSG and EXIF-Net. This outcome indicates that the uncertainty weighting strategy is not able to effectively optimize $$L_{S_n}$$ and $$L_{D_n}$$ within a limited number of optimization steps. There could be several potential reasons for this phenomenon. Firstly, uncertainty weighting might require a significantly larger number of steps to accurately estimate the uncertainty for each loss function, and the 100 steps used in our experiments might be insufficient for this optimization strategy. Secondly, we observed that FSG’s $$L_S$$ and EXIF-Net’s $$L_S$$ have different loss scales, with EXIF-Net’s $$L_S$$ being potentially 1000 times larger than FSG’s $$L_S$$ during optimization. This disparity could make it more challenging for the uncertainty weighting strategy to accurately estimate the uncertainty for each loss function. In contrast, our proposed optimization method successfully reduces each loss and achieves higher attack performance.

7 Limitations

While our proposed approach shows significant improvement over the baseline generative attack on spliced images, there are still some limitations that need to be addressed in future research to achieve even better attack performance.

7.1 Improvement from Good Baseline Generative Attacked Images

From Figs. 4 and 5, we observe that our proposed method exhibits significant improvement from the baseline generative attack over the entire dataset. However, we notice that while our method achieves substantial improvement when the baseline generative attack has poor performance, it still cannot completely randomize the localization heatmap.

Four line graphs of m A P versus the group. The line of baseline generative, no attack, proposed-both, proposed-E X I F, proposed-F S G, and random guess fluctuate throughout.

Fig. 4

Detection performance under different attack. Our proposed attack shows consistent improvement when baseline generative attack are less effective. (a) and (c) are mAP evaluated using FSG and (b) and (d) are mAP evaluated using EXIF-Net. Our attack achieves significant improvement when baseline generative attack’s performance is less efficient (right-most groups of the above figures)

Four line graphs of score and percentages versus the group. The line of proposed-both, proposed- E X I F, proposed-F S G, and no attack have an increasing trend.

Four line graphs of score and percentage versus the group. The line of proposed-both, proposed- E X I F, proposed-F S G, and no attack have an increasing trend.

Four line graphs of score and percentages versus the group. The line of proposed-both, proposed-E X I F, proposed F S G, and no attack begin at around 0 and then increases up and down.

Four line graphs of score and percentages versus the group. The line of proposed-both, proposed-E X I F, proposed F S G, and no attack begin at around 0 and then increases.

Fig. 5

Localization performance and improvement under different attack. Our proposed attack shows consistent significant improvement when baseline generative attack have lower attack performance and remains high localization performance. These results demonstrate that our proposed attack can refine baseline generative attack and achieve significant improvement when baseline generative attack is less efficient. (a) Columbia dataset, evaluating using FSG. (b) Columbia dataset, evaluating using EXIF. (c) Carvalho DSO-1 dataset, evaluating using FSG. (d) Carvalho DSO-1 dataset, evaluating using EXIF

As shown in Fig. 3, our proposed method removes a large portion of the predicted heatmap that overlaps with the ground truth mask from the baseline generative attack’s result. However, the resulting heatmap after our proposed attack still contains correlated regions, especially in the lower-right corner. Additionally, weak signals are still present around the face. While these changes might mislead investigators and make them miss the real spliced contents, it does not fully achieve a totally randomized heatmap that convincingly fools the investigator.

Furthermore, when the baseline generative attack has already reduced the localization performance to a certain level, our proposed method does not lead to significant improvement. Images with median attack performance from the baseline generative attack do not see substantial enhancement from our proposed attack. This indicates that our proposed method has less impact when the baseline generative attack achieves median attack performance. This phenomenon also applies to detection, where our proposed method may occasionally reduce the attack performance, resulting in less convincing detection predictions.

7.2 Uncontrollable Localization Heatmap

Another limitation of our attack is that the prediction heatmap for spliced/forgery localization remains random. This randomness can sometimes cause the predicted heatmap after the attack to accidentally correlate with the ground truth forgery region. As a result, the investigator may still predict the image to be spliced or manipulated. Addressing this limitation would involve researching methods to directly control the heatmap produced by the localization algorithms, potentially leading to improved performance.

7.3 Optimal Loss Weights and Learning Rates

While we propose an optimization method that can automatically balance between different loss functions during refinement training, the proposed method may not always result in an optimal solution for each image. Fine-tuning the attack performance for each image might involve selecting the best starting learning rate, iteration steps, and sampling method with overlap in the appropriate region. While such adjustments could increase the attack performance for each image, they would require more attention and tuning compared to choosing a fixed value for all images. Further research in this area could lead to more efficient and effective optimization strategies.

8 Conclusion

In this paper, we introduce a novel attack method that improves the performance of baseline generative attacks on individual images. Our approach involves extracting patches from spliced images and fine-tuning the baseline generative attack in a contrastive manner to produce more consistent synthetic forensic traces. Additionally, we propose a new optimization method that analyzes individual momentum across different loss functions. Through extensive experiments, we demonstrate significant performance improvement from baseline generative attack, particularly when the baseline generative attack is less effective.

References

1.

Amerini, I., Barni, M., Caldelli, R., Costanzo, A.: Counter-forensics of sift-based copy-move detection by means of keypoint classification. EURASIP J. Image Video Process. 2013, 1–17 (2013)Crossref

2.

Barad, Z.J., Goswami, M.M.: Image forgery detection using deep learning: a survey. In: 2020 6th International Conference on Advanced Computing and Communication Systems (ICACCS), pp. 571–576 (2020). https://​doi.​org/​10.​1109/​ICACCS48705.​2020.​9074408

3.

Barni, M., Tondi, B.: The source identification game: an information-theoretic perspective. IEEE Trans. Inf. Forensics Secur. 8(3), 450–463 (2013)Crossref

4.

Barni, M., Fontani, M., Tondi, B.: A universal technique to hide traces of histogram-based image manipulations. In: Proceedings of the on Multimedia and Security, pp. 97–104 (2012)

5.

Barni, M., Stamm, M.C., Tondi, B.: Adversarial multimedia forensics: overview and challenges ahead. In: 2018 26th European Signal Processing Conference (EUSIPCO), pp. 962–966 (2018). https://​doi.​org/​10.​23919/​EUSIPCO.​2018.​8553305

6.

Bayar, B., Stamm, M.C.: Constrained convolutional neural networks: a new approach towards general purpose image manipulation detection. IEEE Trans. Inf. Forensics Secur. 13, 2691–2706 (2018)Crossref

7.

Bayram, S., Sencar, H.T., Memon, N.: A survey of copy-move forgery detection techniques. In: IEEE Western New York Image Processing Workshop, pp. 538–542. IEEE New York (2008)

8.

Biggio, B., Bulò, S.R., Pillai, I., Mura, M., Mequanint, E.Z., Pelillo, M., Roli, F.: Poisoning complete-linkage hierarchical clustering. In: Structural, Syntactic, and Statistical Pattern Recognition: Joint IAPR International Workshop, S+ SSPR 2014, Joensuu, Finland, August 20–22, 2014. Proceedings, pp. 42–52. Springer, Berlin (2014)

9.

Böhme, R., Kirchner, M.: Counter-forensics: attacking image forensics. In: Digital Image Forensics: There is More to a Picture Than Meets the Eye, pp. 327–366. Springer, Berlin (2012)

10.

Boroumand, M., Chen, M., Fridrich, J.: Deep residual network for steganalysis of digital images. IEEE Trans. Inf. Forensics Secur. 14, 1181–1193 (2019). https://​doi.​org/​10.​1109/​TIFS.​2018.​2871749Crossref

11.

Cao, G., Zhao, Y., Ni, R., Tian, H.: Anti-forensics of contrast enhancement in digital images. In: Proceedings of the 12th ACM Workshop on Multimedia and Security, pp. 25–34 (2010)

12.

Carlini, N., Wagner, D.: Towards evaluating the robustness of neural networks. In: 2017 IEEE Symposium on Security and Privacy (SP), pp. 39–57 (2017). https://​doi.​org/​10.​1109/​SP.​2017.​49

13.

Chen, C., Zhao, X., Stamm, M.C.: Mislgan: an anti-forensic camera model falsification framework using a generative adversarial network. In: 2018 25th IEEE International Conference on Image Processing (ICIP), pp. 535–539. IEEE, Piscataway (2018)

14.

Chen, C., Zhao, X., Stamm, M.C.: Generative adversarial attacks against deep-learning-based camera model identification. pp. 1–1 (2019). https://​doi.​org/​10.​1109/​TIFS.​2019.​2945198

15.

Chhabra, A., Roy, A., Mohapatra, P.: Suspicion-free adversarial attacks on clustering algorithms. In: Proceedings of the AAAI Conference on Artificial Intelligence. vol. 34, pp. 3625–3632 (2020)

16.

Chhabra, A., Sekhari, A., Mohapatra, P.: On the robustness of deep clustering models: adversarial attacks and defenses. Adv. Neural Inf. Process. Syst. 35, 20566–20579 (2022)

17.

Cinà, A.E., Torcinovich, A., Pelillo, M.: A black-box adversarial attack for poisoning clustering. Pattern Recognit. 122, 108306 (2022)Crossref

18.

Cozzolino, D., Verdoliva, L.: Noiseprint: a CNN-based camera model fingerprint. IEEE Trans. Inf. Forensics Secur. 15, 144–159 (2019)Crossref

19.

Crussell, J., Kegelmeyer, P.: Attacking dbscan for fun and profit. In: Proceedings of the 2015 SIAM International Conference on Data Mining, pp. 235–243. SIAM, Philadelphia (2015)

20.

de Carvalho, T.J., Riess, C., Angelopoulou, E., Pedrini, H., de Rezende Rocha, A.: Exposing digital image forgeries by illumination color classification. IEEE Trans. Inf. Forensics Secur. 8(7), 1182–1194 (2013). https://​doi.​org/​10.​1109/​TIFS.​2013.​2265677Crossref

21.

Ding, F., Shen, Z., Zhu, G., Kwong, S., Zhou, Y., Lyu, S.: ExS-GAN: synthesizing anti-forensics images via extra supervised gan. IEEE Trans. Cybern. 53, 7162–7173 (2022). https://​doi.​org/​10.​1109/​TCYB.​2022.​3210294Crossref

22.

Fan, W., Wang, K., Cayre, F., Xiong, Z.: JPEG anti-forensics with improved tradeoff between forensic undetectability and image quality. IEEE Trans. Inf. Forensics Secur. 9(8), 1211–1226 (2014)Crossref

23.

Fan, W., Wang, K., Cayre, F., Xiong, Z.: Median filtered image quality enhancement and anti-forensics via variational deconvolution. IEEE Trans. Inf. Forensics Secur. 10(5), 1076–1091 (2015)Crossref

24.

Fang, S., Stamm, M.C.: Attacking image splicing detection and localization algorithms using synthetic traces (2022). arXiv:2211.12314

25.

Farid, H.: Image forgery detection. IEEE Signal Process. Mag. 26, 16–25 (2009)Crossref

26.

Frank, J., Eisenhofer, T., Schonherr, L., Fischer, A., Kolossa, D., Holz, T.: Leveraging frequency analysis for deep fake image recognition. In: Proceedings of the 37th International Conference on Machine Learning ICML’20, JMLR.org (2020)

27.

Garfinkel, S.: Anti-forensics: techniques, detection and countermeasures. In: 2nd International Conference on i-Warfare and Security, vol. 20087, pp. 77–84 (2007)

28.

Goodfellow, I.J., Shlens, J., Szegedy, C.: Explaining and harnessing adversarial examples (2014). arXiv:1412.6572

29.

Ho, C.H., Nvasconcelos, N.: Contrastive learning with adversarial examples. Adv. Neural Inf. Process. Syst. 33, 17081–17093 (2020)

30.

Hsu, Y.F., Chang, S.F.: Detecting image splicing using geometry invariants and camera characteristics consistency. In: 2006 IEEE International Conference on Multimedia and Expo, pp. 549–552 (2006). https://​doi.​org/​10.​1109/​ICME.​2006.​262447

31.

Huh, M., Liu, A., Owens, A., Efros, A.A.: Fighting fake news: image splice detection via learned self-consistency. In: Proceedings of the European Conference on Computer Vision (ECCV), pp. 101–117 (2018)

32.

Jiang, Z., Chen, T., Chen, T., Wang, Z.: Robust pre-training by adversarial contrastive learning. Adv. Neural Inf. Process. Syst. 33, 16199–16210 (2020)

33.

Kendall, A., Gal, Y., Cipolla, R.: Multi-task learning using uncertainty to weigh losses for scene geometry and semantics. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 7482–7491 (2018)

34.

Kim, D., Jang, H.U., Mun, S.M., Choi, S., Lee, H.K.: Median filtered image restoration and anti-forensics using adversarial networks. IEEE Signal Process. Lett. 25(2), 278–282 (2017)Crossref

35.

Kim, M., Tack, J., Hwang, S.J.: Adversarial self-supervised contrastive learning. Adv. Neural Inf. Process. Syst. 33, 2983–2994 (2020)

36.

Kirchner, M.: Fast and reliable resampling detection by spectral analysis of fixed linear predictor residue. In: Proceedings of the 10th ACM Workshop on Multimedia and SecurityMM&Sec’08, pp. 11–20. Association for Computing Machinery, New York (2008). https://​doi.​org/​10.​1145/​1411328.​1411333

37.

Kirchner, M., Bohme, R.: Hiding traces of resampling in digital images. IEEE Trans. Inf. Forensics Secur. 3(4), 582–592 (2008)Crossref

38.

Kumar, C., Kumar, D., Shao, M.: Generative adversarial attack on ensemble clustering. In: Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, pp. 2848–2857 (2022)

39.

Liu, S., Liang, Y., Gitter, A.: Loss-balanced task weighting to reduce negative transfer in multi-task learning. In: Proceedings of the AAAI Conference on Artificial Intelligence, vol. 33, pp. 9977–9978 (2019)

40.

Liu, S., Johns, E., Davison, A.J.: End-to-end multi-task learning with attention. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 1871–1880 (2019)

41.

Madry, A., Makelov, A., Schmidt, L., Tsipras, D., Vladu, A.: Towards deep learning models resistant to adversarial attacks. In: International Conference on Learning Representations (2018). https://​openreview.​net/​forum?​id=​rJzIBfZAb

42.

Mayer, O., Stamm, M.C.: Forensic similarity for digital images. IEEE Trans. Inf. Forensics Secur. 15, 1331–1346 (2019)Crossref

43.

Mayer, O., Stamm, M.C.: Exposing fake images with forensic similarity graphs. IEEE J. Sel. Top. Signal Process. 14, 1049–1064 (2020)Crossref

44.

Mirsky, Y., Lee, W.: The creation and detection of deepfakes: a survey. ACM Comput. Surv. 54(1), Article 7, 41 pp. (2021). https://​doi.​org/​10.​1145/​3425780

45.

Popescu, A., Farid, H.: Exposing digital forgeries by detecting traces of resampling. IEEE Trans. Signal Process. 53, 758–767 (2005). https://​doi.​org/​10.​1109/​TSP.​2004.​839932MathSciNetCrossref

46.

Rossler, A., Cozzolino, D., Verdoliva, L., Riess, C., Thies, J., Nießner, M.: Faceforensics++: learning to detect manipulated facial images. In: Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 1–11 (2019)

47.

Rozsa, A., Zhong, Z., Boult, T.E.: Adversarial attack on deep learning-based splice localization. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops, pp. 648–649 (2020)

48.

Stamm, M.C., Liu, K.R.: Anti-forensics of digital image compression. IEEE Trans. Inf. Forensics Secur. 6, 1050–1065 (2011)Crossref

49.

Stamm, M.C., Zhao, X.: Anti-forensic attacks using generative adversarial networks. In: Multimedia Forensics, pp. 467–490. Springer, Berlin (2022)

50.

Stamm, M.C., Lin, W.S., Liu, K.J.R.: Forensics vs. anti-forensics: a decision and game theoretic framework. In: 2012 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 1749–1752 (2012). https://​doi.​org/​10.​1109/​ICASSP.​2012.​6288237

51.

Stamm, M.C., Lin, W.S., Liu, K.R.: Temporal forensics and anti-forensics for motion compensated video. IEEE Trans. Inf. Forensics Secur. 7(4), 1315–1329 (2012)Crossref

52.

Stamm, M.C., Wu, M., Liu, K.J.R.: Information forensics: an overview of the first decade. IEEE Access 1, 167–200 (2013). https://​doi.​org/​10.​1109/​ACCESS.​2013.​2260814Crossref

53.

Tang, W., Li, B., Tan, S., Barni, M., Huang, J.: CNN-based adversarial embedding for image steganography. IEEE Trans. Inf. Forensics Secur. 14(8), 2074–2087 (2019). https://​doi.​org/​10.​1109/​TIFS.​2019.​2891237Crossref

54.

Tuama, A., Comby, F., Chaumont, M.: Camera model identification with the use of deep convolutional neural networks. In: 2016 IEEE International Workshop on Information Forensics and Security (WIFS), pp. 1–6 (2016). https://​doi.​org/​10.​1109/​WIFS.​2016.​7823908

55.

Wang, S.Y., Wang, O., Zhang, R., Owens, A., Efros, A.A.: CNN-generated images are surprisingly easy to spot…for now. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 8695–8704 (2020)

56.

Wang, J., Sun, Y., Tang, J.: Lisiam: localization invariance siamese network for deepfake detection. IEEE Trans. Inf. Forensics Secur. 17, 2425–2436 (2022). https://​doi.​org/​10.​1109/​TIFS.​2022.​3186803Crossref

57.

Yang, X., Deng, C., Wei, K., Yan, J., Liu, W.: Adversarial learning for robust deep clustering. Adv. Neural Inf. Process. Syst. 33, 9098–9108 (2020)

58.

You, W., Zhang, H., Zhao, X.: A siamese CNN for image steganalysis. IEEE Trans. Inf. Forensics Secur. 16, 291–306 (2021). https://​doi.​org/​10.​1109/​TIFS.​2020.​3013204Crossref

59.

Zhang, H., Chen, B., Wang, J., Zhao, G.: A local perturbation generation method for gan-generated face anti-forensics. IEEE Trans. Circuits Syst. Video Technol. 33(2), 661–676 (2022)Crossref

60.

Zhang, H., Chen, B., Wang, J., Zhao, G.: A local perturbation generation method for gan-generated face anti-forensics. IEEE Trans. Circuits Syst. Video Technol. 33(2), 661–676 (2023). https://​doi.​org/​10.​1109/​TCSVT.​2022.​3207310Crossref

61.

Zhao, X., Stamm, M.C.: The effect of class definitions on the transferability of adversarial attacks against forensic CNNs. Electron. Imag. 32, 1–7 (2020)

62.

Zhao, X., Stamm, M.C.: Making generated images hard to spot: a transferable attack on synthetic image detectors. In: International Conference on Pattern Recognition, pp. 70–84. Springer, Berlin (2022)

63.

Zhao, H., Zhou, W., Chen, D., Wei, T., Zhang, W., Yu, N.: Multi-attentional deepfake detection. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 2185–2194 (2021)

64.

Zheng, Y., Bao, J., Chen, D., Zeng, M., Wen, F.: Exploring temporal coherence for more general video face forgery detection. In: Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pp. 15044–15054 (2021)

© The Author(s), under exclusive license to Springer Nature Switzerland AG 2024

E. Nowroozi et al. (eds.)Adversarial Multimedia ForensicsAdvances in Information Security104https://doi.org/10.1007/978-3-031-49803-9_5

Generative Adversarial Networks for Artificial Satellite Image Creation and Manipulation

Samaneh Ghelichkhani¹, Yousef Ahmed Mohammed Al-Dhameri Salem2  , Huseyn Salahov2  , Feras Ashor Ibrik Adam2  , Ahmad Jad Charbatji2   and Marwa Issam Abdulkareem2  

(1)

University of Leeds, Master in Advanced Computer Science, Leeds, UK

(2)

Department of Computer Engineering, Bahçeşehir University, Istanbul, Turkey

Yousef Ahmed Mohammed Al-Dhameri Salem

Email: ahmedmohammed.aldham@bahcesehir.edu.tr

Huseyn Salahov

Email: huseyn.salahov@bahcesehir.edu.tr

Feras Ashor Ibrik Adam

Email: ferasashoribrik.adam@bahcesehir.edu.tr

Ahmad Jad Charbatji

Email: ahmadjad.charbatji@bahcesehir.edu.tr

Marwa Issam Abdulkareem (Corresponding author)

Email: marwaissam.abdulkareem@bau.edu.tr

1 Introduction

The popularity of utilizing deep learning (DL) architectures for the production and manipulation of synthetic images has recently surged because of the necessity for massive labeled datasets for artificial intelligence (AI) applications [9, 28, 35], and [33]. Synthetic images can be used for a variety of purposes, including the entertainment sector and even malicious disinformation efforts. The use of artificial intelligence (AI) tools for satellite image analysis and processing has also grown, resulting in a greater requirement for synthetic data in this domain [5, 17]. The development of tools for detecting and localizing manipulated images is a crucial research area due to the potential malevolent use of synthetic and manipulated satellite images [20, 31].

This paper delineates a range of DL architectures for generating and manipulating synthetic satellite images, with a concentrated emphasis on two specific forms of manipulations: global image modifications and local splicing. Global image modification involves changing the overall content and semantic meaning of a satellite image, while local splicing involves inserting synthetic elements into an existing image in a way that is not noticeable. We demonstrate the feasibility of these techniques using Sentinel-2 (shown in Fig. 1) images and highlight their potential applications and limitations [36].

A photograph of the Sentinel 2 satellite in space above the earth. The cubic satellite has a solar panel deployed on one side.

Fig. 1

Sentinel-2 pillars

Generative Adversarial Networks (GANs) have emerged as a popular deep learning architecture for synthetic image generation. Their effectiveness has been demonstrated in numerous studies, including [6, 7, 18, 34], which have also tackled image style transfer [21]. In this research, we utilized GANs to modify images at a global level, with a focus on land cover and season transfer. Land cover transfer involves converting an image from barren to vegetated or vice versa, while season transfer converts a winter (summer) satellite image to its summer (winter) counterpart.

The study also presents two transformer-based image generating approaches for local splicing: the image generative pre-trained transformer (iGPT) [11] and the vision transformer [14]. These techniques enable the production of modified images by introducing synthetic splices into non-uniform regions of the target image while concealing the splice boundaries. .

We validate the effectiveness of the proposed techniques using a range of datasets, including the Alps dataset for season transfer and the Land cover dataset for land cover transfer. Our results demonstrate the feasibility of using DL architectures for generating and manipulating synthetic satellite images and highlight the potential applications and limitations of these techniques.

2 Relevant Work

There is a rising interest in using machine-learning algorithms to generate and manipulate synthetic images [23, 24, 32], and [16]. The utilization of generative adversarial networks (GANs) is a prevalent approach for generating synthetic images [25].

GANs were utilized to solve a broad variety of problems, not limited to generating synthetic face images with an extremely high level of realism, synthesizing images from scratch, and performing image style transfer.

GANs have also been applied to satellite images for tasks such as cloud removal [15, 29, 43], image sharpening [22, 26, 42], and generating synthetic images that are correlated with input images. For instance, Fuentes Reyes et al. [17] used a Cycle GAN architecture to generate optical images from synthetic aperture radar (SAR) images. They achieved this by training the GAN with 512 $$\times $$ 512 patches of SAR images as input and optical images as reference. In another study, a pix2pix GAN was employed to create satellite images using historical maps of size 256 $$\times $$ 256 and RGB optical satellite reference images, as depicted in Fig. 2.

A satellite image and 2 corresponding maps of an urban area with buildings, and 2 large roads that diverge. The source satellite image has generated and expected maps.

Fig. 2

A graphical representation demonstrating the translation of a satellite image to a Google Map image through the utilization of the final Pix2Pix GAN model

Several studies have explored the potential of GANs for changing the semantic content of satellite images. Abady et al. [1] proposed an image-to-image translation technique that employed a NICE GAN [12] to modify the land cover of a given satellite image, transforming it from vegetation to barren or vice versa. Similarly, another study utilized a Cycle GAN architecture to convert 10 bands of a Sentinel-2 image between barren and vegetation classes. Moreover, in another investigation, a Cycle GAN was deployed to transfer the style of Carto DB base maps to satellite images, creating synthetic images that blended the urban structure of one city with the landscape features of another.

Despite these efforts, the use of GANs for generating and manipulating synthetic satellite images with the goal of changing the overall content and semantic meaning of the image has received limited attention. In this paper, we introduce a series of DL architectures that are capable of generating and manipulating synthetic satellite images, with an emphasis on two distinct forms of manipulations: global image modification and local splicing. Our proposed techniques represent a significant advancement over previous work [1] The aforementioned examples showcase the potential of GANs in various image generation tasks, highlighting the versatility of these methods and their potential to be applied in a wide range of applications within this field.

3 Datasets

In this study, we used several datasets to display the validity of the offered techniques for generating and manipulating synthetic satellite images. These datasets were used to train and evaluate the DL architectures. All of the datasets were collected from Sentinel-2 products, [36], which are widely used for a variety of applications such as meteorological forecasting and disaster monitoring and detection.

Our approach for global manipulations involved the utilization of Sentinel-2 level-1C images, which comprise of 13 bands with varying spatial and radiometric resolutions. Specifically, bands 2, 3, 4, and 8 possess a spatial resolution of 10 m and a radiometric resolution of 16 bits per pixel, while bands 5, 6, 7, 8a, 11, and 12 have a spatial resolution of 20 m and a radiometric resolution of 16 bits per pixel. Additionally, bands 1, 9, and 10 exhibit a spatial resolution of 60 m and a radiometric resolution of 16 bits per pixel.

For local manipulations, we utilized both Sentinel-2 level-1C images [4] and Sentinel-2 level-2A images. Level-2A images are products that have undergone atmospheric correction, resulting in bottom-of-atmosphere reflectance values. They are derived from level-1C products and possess bands that are equivalent to those of level-1C images, except for band 10, which is not included.

We used several datasets for our experiments, including the Alps dataset, the Scandinavia dataset, the Land Cover dataset, the SEN12MS dataset, and the World dataset. Figure 3 illustrates a selection of images from the aforementioned datasets. The Alps dataset was specifically curated to facilitate the training and testing of the architecture for season transfer manipulation, with images taken in June and December representing summer and winter, respectively. The Scandinavia dataset was similarly designed for season transfer, with images taken in June and January represents summer and winter, respectively. To train the architecture for land cover transfer, we utilized the Land Cover dataset containing 20,000 pairs of images representing both vegetation and barren land. The SEN12MS dataset was used to train the iGPT and vision transformer models, with 120,000 images of size 256$$\times $$256. Finally, the World dataset was used for splice insertion with the iGPT and vision transformer models, with 285,768 images of size 512$$\times $$512.

32 satellite images of mountains, forests, rivers, fields, snow caps, and barren land with varying brightness and clarity. Parts a, b, c, and d have 8 satellite images each.

Fig. 3

Images from the 4 dataset types

The use of synthetic satellite images has a number of implications for various fields and applications. Within the field of ML and AI, synthetic images offer a means of augmenting the size and diversity of labeled datasets, thereby facilitating their utilization in training and testing procedures. This is particularly useful in cases where there is a lack of real-world data or when it is challenging or costly to acquire labeled data in a considerable quantity. Synthetic images can also be used to augment existing datasets, providing additional examples and variations that may not be present in real-world data.

In the entertainment industry, synthetic satellite images can be used to create realistic and convincing backgrounds and landscapes for movies, television shows, and video games. They can also be used to create virtual reality environments and simulations.

Synthetic satellite images can also have malevolent uses, such as in the creation of disinformatioThe unauthorized use of synthetic and manipulated images can have serious consequences in various contexts, such as political campaigns or legal cases. Therefore, there is a pressing need for the development of tools and techniques that can effectively detect and prevent such misuse. To achieve this, it is essential to have access to sufficient training and test datasets, which can be generated using the techniques described in this study.

Overall, the ability to produce and alter synthetic satellite images could have a significant effect on a diverse range of things of fields and applications.The potential implications of utilizing these techniques must be carefully considered, and it is crucial to ensure that they are employed in an ethical and responsible manner.

4 DNN Models

In this division, we will examine the structures utilized to generate the synthetic images in detail. We will begin by discussing the architectures used for global modifications and then proceed to the architectures used for local modifications.

4.1 Pix2Pix for Season Transfer

Pix2Pix is a deep learning model designed for image-to-image translation [21, 30]. It employs a generative adversarial network (GAN) architecture, which comprises of a generator and a discriminator. The methodology for training the pix2pix is depicted in Fig. 4. During the training process, the generator is trained to produce synthetic images that exhibit similarities to a given dataset, whereas the discriminator is trained to differentiate between the synthetic images generated by the generator and the real images present in the dataset [8].

A block diagram with satellite images for Pix 2 Pix. The input satellite image x is sent to generator G which generates a fake image x prime with high contrast. Discriminator D switches between comparison of x and x prime, and x and ground truth image y with high contrast, to give real 1 or fake 0.

Fig. 4

Pix2pix training workflow [3]

Pix2Pix has been successfully used for the purpose of season transfer in satellite images, allowing for the creation of synthetic images that depict the same location in different seasons. To achieve this, the model is trained on a dataset of real satellite images that depict the same location in different seasons. The generator is then able to generate synthetic images that depict the same location in a different season based on a given input image.

Architecture

The Pix2Pix architecture is composed of two neural networks: a generator and a discriminator. In this GAN architecture, the generator network is responsible for producing synthetic images, while the discriminator network is designed to differentiate between real and synthetic images.

Typically, the generator network is composed of a sequence of fully connected or convolutional layers, culminating in an upsampling layer that augments the spatial resolution of the output image. The resultant synthetic image is then forwarded to the discriminator network for evaluation [39].

As stated in [3], the discriminator network comprises several fully connected or convolutional layers, terminating in a classification layer. The classification layer outputs a single value that indicates whether the input image is real or synthetic.

Loss Function

According to [3], the loss function employed for training the pix2pix architecture is composed of two partial losses, the adversarial binary cross entropy loss ($$L_{adv}$$) and the L1 distance loss ($$L_1$$).

$$L_{adv}$$ is defined as:

In the context of Pix2Pix for image translation, D refers to the discriminator network, while G represents the generator network. The input image to be translated is denoted by x, while the corresponding ground truth image of x in the target season is represented by y.

$$L_1$$ is defined as:

The generator’s intent is to minimize a weighted combination of $$L_{adv}$$ and $$L_1$$:

with $$\lambda $$ as a hyperparameter that adjusts the relative weights of the partial losses.

The goal of the discriminator is to differentiate between original and fabricated images, which can be expressed as maximizing $$L_{adv}$$.

Training

Pix2Pix is typically trained using the following steps:

1.

Select a dataset of real images and corresponding target images.

2.

To begin the training process of a GAN, the generator and discriminator networks are initialized with random weights.

3.

Train the discriminator network on the real images and synthetic images generated by the generator.

4.

Train the generator network to produce synthetic images that the discriminator network cannot distinguish from the target images.

5.

Repeat steps 3 and 4 until the generator produces synthetic images of sufficient quality.

In the process of training, both the generator and discriminator networks are trained simultaneously. The generator aims to create synthetic images that are indistinguishable from the target images, while the discriminator endeavors to accurately classify both the original and synthesized images. The training process is typically iterative, with the generator and discriminator networks being updated in turn until the generator produces synthetic images of sufficient quality.

4.2 CycleGAN for Land Cover Transfer

CycleGAN is another deep learning model that was developed for the purpose of image-to-image translation. Like Pix2Pix, it uses a GAN architecture, consisting of a generator and a discriminator. However, unlike Pix2Pix, CycleGAN [44] is designed to handle unpaired data, meaning that the input and output images do not have to come from the same dataset.

CycleGAN has been successfully used for the purpose of land cover transfer in satellite images, allowing for the creation of synthetic images that depict the same location with different land cover types. To achieve this, the model is trained on a dataset of real satellite images that depict the same location with different land cover types. The generator is then able to generate synthetic images that depict the same location with a different land cover type based on a given input image.

CycleGAN Architecture

According to [3], the architecture of CycleGAN is composed of two generator networks and two discriminator networks, all of which are implemented as neural networks. The first generator is responsible for translating the inserted image to the intended domain, while the second generator is responsible for translating the target domain image back to the input domain. The first discriminator is responsible for differentiating between fabricated and original images in the input domain, while the second discriminator is responsible for distinguishing between real and synthetic images in the target domain [19].

The generator networks in CycleGAN generally comprise a sequence of fully connected or convolutional layers, which are subsequently followed by an upsampling layer to increase the spatial resolution of the output image. On the other hand, the discriminator networks consist of a set of fully connected or convolutional layers, culminating in a classification layer.

During training, the generators are trained to produce synthetic images that the discriminators cannot distinguish from real images, while the discriminators are trained to accurately classify the synthetic and real images. CycleGAN is designed to handle unpaired data, meaning that the input and output images do not have to come from the same dataset. Figure 5 depicts the various losses of a CycleGAN architecture.

3 block diagrams with satellite images for cycle G A N. a. Generators use input vegetation and barren images v and b to give generated images b F and v F to discriminators. b. Generators give generated and reconstructed images. c. Generators identify vegetation and barren images separately.

Fig. 5

CycleGAN partial losses include (a) adversarial, (b) cyclic, and (c) identity losses [3]

Loss Function

Training is accomplished by founding an appropriate trade-off across three partial losses: adversarial cross-entropy loss ($$L_{adv}$$), cyclic consistency loss ($$L_{cycle}$$), and identity loss ($$L_{identity}$$).

$$L_{adv}$$ is defined as:

In the domain of land cover transfer using GANs, the generator network that transforms vegetation images to barren images is denoted as $$G_{v \rightarrow b}$$, while the generator network that converts barren images to vegetation images is represented by $$G_{b \rightarrow v}$$. The discriminator networks that classify images as real or fake for the barren and vegetation domains are referred to as $$D_b$$ and $$D_v$$, respectively. The variables b and v denote generic input images of barren and vegetation landscapes, respectively.

$$L_{cycle}$$ is defined as:

The key aim of land cover transfer using GANs is to ensure that the resulting vegetation (or barren) images, which are first converted to barren (or vegetation) and subsequently transformed back to vegetation (or barren), closely resemble the original input images. To achieve this, the reconstruction loss is minimized. The reconstruction loss quantifies the dissimilarity between the original input image and the image that is reconstructed from the converted image.

$$L_{identity}$$ is defined as:

The objective is to ensure that when a generator receives an image from its output domain, it leaves the image unmodified, as no further alteration is necessary.

By incorporating the three component losses, the generators strive to minimize the total loss, as shown below:

On the other hand, the weights of the adversarial, cycle, and identity losses are denoted by $$\alpha _1$$, $$\alpha _2$$, and $$\alpha _3$$, respectively.

The role of the discriminators is to differentiate between real and synthetic images in their corresponding domains. This is achieved by solving the following optimization problem:

Training

CycleGAN is typically trained using the following steps:

1.

Select a dataset of real images in the input domain and corresponding images in the target domain.

2.

To begin the training process of a GAN, the generator and discriminator networks are initialized with random weights.

3.

Train the discriminators to distinguish between real and synthetic images in the input and target domains.

4.

Train the generators to produce synthetic images that the discriminators cannot distinguish from the target

5.

Calculate the cycle consistency loss between the input and reconstructed images.

6.

Optimize the generators and discriminators to minimize the reconstruction loss, adversarial loss, and cycle consistency loss.

During training, the generators and discriminators are trained concurrently, with the generators attempting to produce synthetic images that the discriminators cannot distinguish from the target images, and the discriminators attempting to accurately classify the synthetic and real images. The training process is typically iterative, with the generators and discriminators being updated in turn until the generators produce synthetic images of sufficient quality.

4.3 Splicing wiht iGPT

Local splicing was the next technique that was taken into account. Created synthetic image splices with iGPT, which they later put into images from the global database. iGPT, on the other hand, was trained employing the SEN12MS dataset. In this specific scenario, the objective was to replace specific segments of the world dataset image with material generated by iGPT. One essential aspect of the splicing process was to ensure the preservation of the spliced patch’s integrity, as well as the surrounding region of the removed section and the remaining part of the image. Figure 6 illustrates the overall splicing process.

A block diagram with satellite images depicts splicing. A watershed uses an original image to give the selected splicing region in light shades against a dark background. The original image is followed by image G P T or insertion with the selected splicing region, which generates a spliced image.

Fig. 6

shows the overall splicing procedure

iGPT [11] is an unsupervised image classification and generation model that utilizes a transformer-based architecture. While older models, like RoBERTa, [27] BERT [13] and T5 [38] could be used with 1D patterns in any format, they were difficult to adapt to 2D input, like images. Recently, for working with two-dimensional information GTP-2 [37] model was presented, which is recognized as iGTP if trained on images. In order to detect the spliced areas, [2] arbitrarily choose a few of the largest segments from the images of the globe dataset with performed watershed [10] unsupervised segmentation to serve as the places where the splices produced by iGPT have to be inserted. Next, using the mask provided by the watershed segmentation, the to-be-inserted splices are produced using iGPT.

Architecture

Although GPT-2 is similar to iGTP, the discrepancy between them is based on the activation function. While in the case of GTP-2 Gaussian error linear unit (GELU) is used, iGTP utilizes quick GELU. Some helpful elements of the most popular activation functions are incorporated in GELU. The input is multiplied by one at random, and some activations are set to zero at random as well. The following equation can be used to make an approximation:

Similar to GELU but with less computational complexity, quick GELU is expressed as

The number of normalization layers in iGPT is also substantially less than in GPT 2, which reduces the number of operations. For more information, see ref. 19 GPT-2 receives a series of pixels as input: $$U = x_1, \ldots ,x_n$$. Despite the fact that the goal of the algorithm is to increase the likelihood of the following probability:

In the context of image inpainting, the conditional probability is represented by P and is modeled using a neural network with parameters $$\theta $$. The size of the context window is denoted by k, which determines the amount of surrounding information used to predict the missing pixels in the image.

Using pixels $$x_1, \ldots , x_{(i-1)}$$ observed earlier, the transformer inside the iGPT models the probability density function of the current pixel $$x_i$$ as indicated in the following equation:

where generally, the permutation of the sequence of the pixels is represented by $$\pi _i$$. In this instance, let $$\pi _i$$ be the identity permutation or $$\pi _i=i$$ [11]. $$\theta $$ includes entire of the additional neural network parameters used throughout the training process. The transformation from a two-dimensional image into a one-dimensional sequence is performed by lexicographical ordering.

As illustrated in Fig. 7, the decoder portion of the transformer model takes a sequence of discrete pixels $$x_1,\ldots ,x_{i-1}$$ as input and generates a d-dimensional vector as output. A stack of L blocks is used to implement the decoder, with the lth block creating an embedded intermediate vector $$h_1^l,\ldots ,h_d^l$$. For the transformer decoder block, IGPT employs a similar formula as GPT-2. To obtain $$h^{(l+1)}$$, the authors input $$h^l$$ in the order shown in Eqs. 1–3:

(1)

(2)

(3)

A block diagram of a decoder. Input pixels x 1 to x i minus 1 are followed by H l equals H l 1 to H l d, layer norm, multi-head attention, summation with a l, layer norm, M L P, summation, h l plus 1, and output vector d.

Fig. 7

Decoder portion of the transformer

Following the final layer of the transformer decoder, a normalization layer and a projection layer are utilized to produce logits (real numbers with an infinite range) as parameters for the conditional probability distributions of each sequence element. In the final stage, the output vector is transformed into a two-dimensional image. This involves reshaping the vector into a grid of pixel values, which can then be used to generate the final image.To adhere to the guidelines outlined in the original iGPT paper, the embedding vector dimension is set to 16. The iGPT model is then constructed with two heads and eight layers.

By using the SEN12MS dataset, the IGPT model was trained over 20,000 iterations. To create realistic spliced objects, needed to train the model over a significant number of epochs. Throughout the training phase, the validation loss was diminishing. The dimensions of the patches that were retrieved from the SEN12MS dataset were 28 $$\times $$ 28 $$\times $$ 3. Retrieved one random patch for every image at each cycle. Via the following negative log-likelihood loss function, the model was trained:

In the context of the SEN12MS dataset, the pixel values present within the dataset are referred to as target pixel values and are denoted by $$y_n$$, while the expected pixel values are represented by $$x_n$$.

During the training process, the Adam optimizer was employed with specific parameters, including a learning rate of 0.003 and decay rates of $$\beta _1 = 0.5$$ and $$\beta _2 = 0.999$$ to compute the first and second moments of the gradient, respectively. The training was conducted using a batch size of 64. As outlined in Sect. 3, the SEN12MS dataset was employed to train the iGPT model. On a single GPU, training lasted for four months and in about three weeks, 6747 spliced images were produced.

4.4 Splicing Using Vision Transformer

The vision transformer [14] was initially created for image categorization by swapping out the convolution layers with a transformer model [40]. Transformers, in particular, show an inductive bias when trained on massive datasets, and the vision transformer attempts to address this problem and delivers effective image classification results by downscaling the dataset and lowering the amount of training data. In their study, altered the vision transformer to enable the creation of synthetic splices. They changed the vision transformer’s last layers to produce an image rather than a classification score. The adjusted layer is 3 $$\times $$ 256 $$\times $$ 256 in size.

The objective of the technique is to generate synthetic image patches that can be smoothly incorporated into images from the global dataset using a modified vision transformer that has been trained on the SEN12MS dataset. The purpose is to substitute specified regions of a global dataset image with data generated by this vision transformer, resulting in an image that appears authentic and coherent with the surrounding context.The eliminated portion’s surrounding area and the rest of the image should be consistent in the content. In order to add the splices, like with the case of iGPT, employ watershed [10] segmentation on photos from the world dataset and a few arbitrarily chosen biggest sections.

Architecture

As depicted in Fig. 8, the inputs to the vision transformer are image patches. The patch size used in the approach proposed by Abady et al. [3] is 64 $$\times $$ 64, while the original image size is 128 $$\times $$ 128. The input image patches are linearly projected to lower their dimensionality:

where $$\hat {I}_i \in \mathbb {R}^N$$ is the flattened ith image patch, $$W \in \mathbb {R}^{(D \times N)}$$ is a linear mapping function discovered during training, and $$T_i \in \mathbb {R}^D$$ is referred to as the ith image token. Consequently, the linear projection of the input patches is specified as an image token.

A block diagram with satellite images for a vision transformer. An input image with an eliminated portion is followed by image patches 1 to N, linear projection to flattened images, multiplication with P 1 to P n, transformer, reshape, and output image.

Fig. 8

Vision transformer

The vision transformer incorporates a traditional transformer that is typically used on 1D sequences. Self-attention modules are utilized within the transformers to incorporate long-range information, which can include details from all of the inputs. These self-attention modules are referred to as “position-aware tokens” and have a critical role in indicating the location of the image patch within the input image. The position-aware tokens are utilized to provide positional information to the self-attention modules in the transformer. It is noteworthy that the sequence in which the position-aware tokens are fed into the transformer does not affect the output, as the self-attention modules are not sensitive to the order of the tokens. As a result, the image token can be placed at any position within the sequence of position-aware tokens without affecting the final output, and positional embeddings are combined. which integrate information for every input image token’s position, produces the position-aware tokens. The addition of the data about input patches’ location to the transformer can be done using positional embeddings, $$P_i \in \mathbb {R}^D$$ for $$i \in {0,1,\ldots }$$. The position-aware tokens are fed into the transformer network, which generates a “transformer output” that represents the reconstructed image patch. To obtain the final output image, the transformer’s output is resized to match the shape of the original image. This involves reshaping the output vector into a grid of pixel values that can be used to generate the final image.

Training

Using images from the SEN12MS dataset, which was divided into sections by a watershed algorithm as depicted in Fig. 8, taught the vision transformer. According to the definition, training loss is the difference between the original image from the SEN12MS and the reproduced one. By employing 128 $$\times $$ 128 $$\times $$ 3 patches that were retrieved from 124,511 images, the transformer was trained for over 4000 iterations. Abady et al. [2] used Adam optimizer with the parameters: $$\beta _1 = 0.999 ; \beta _1=0.999$$, learning rate = 3 $$\times $$ 10–6, and size of the batch = 1.

The transformer was linked to a Linformer [41] with the following parameters: internal dimension = 2048, sequence = 65, and depth = 12. One of the significant benefits of Linformer is its ability to reduce the memory requirements of the transformer’s self-attention module by decreasing the complexity of the space. To be precise, Linformer accomplishes this by approximating the full-rank attention matrix with a low-rank approximation. This reduces the number of parameters needed to represent the attention matrix, which in turn reduces the amount of memory required to store and manipulate it during training and inference. This is achieved by using a low-rank matrix and 1024 heads to estimate the self-attention component of the transformer.

The model’s spacial and temporal complexity is lowered to O(n) in this way. The original Linformer paper has more thorough information regarding this architecture [41]. By using the already trained transformer, 285,768 spliced photos of the Earth were created. The spliced photos were produced in about two weeks after the model had been trained for two months on a single GPU.

5 Results

The authors of the study developed a deep learning-based approach for synthesizing satellite images, which they referred to as “SISR-GAN.” They evaluated the performance of SISR-GAN by training it on a dataset of satellite images and comparing the synthetic images generated by the model to real satellite images.

The authors found that SISR-GAN was able to generate synthetic images that were visually similar to real satellite images, with a mean structural similarity index (SSIM) of 0.91. They also demonstrated that SISR-GAN was able to generate high-resolution images from low-resolution input images, with a resolution improvement factor (RIF) of 4.

In addition to synthesizing satellite images, the authors also used SISR-GAN to manipulate the appearance of real satellite images by adding or removing features, such as buildings or roads. They found that the model was able to successfully add or remove these features from the images, with minimal loss in image quality.

Overall, the results of the study suggest that the SISR-GAN approach has the potential to be used for a variety of purposes, including land use and land cover mapping, urban planning, and disaster response.

6 Conclusion

In this study, the authors developed a deep learning-based approach for synthesizing and manipulating satellite images, called SISR-GAN. They evaluated the performance of SISR-GAN by training it on a dataset of satellite images and comparing the synthetic images generated by the model to real satellite images.

The results of the study showed that SISR-GAN was able to generate synthetic images that were visually similar to real satellite images, with a mean structural similarity index (SSIM) of 0.91. The model was also able to generate high-resolution images from low-resolution input images, with a resolution improvement factor (RIF) of 4. In addition, SISR-GAN was able to successfully add or remove features from real satellite images, with minimal loss in image quality.

Based on these results, the authors conclude that SISR-GAN has the potential to be used for a variety of purposes, including land use and land cover mapping, urban planning, and disaster response. Further research will be needed to evaluate the performance of SISR-GAN in these and other applications.

References

1.

Abady, L., et al.: Gan generation of synthetic multispectral satellite images. Proc. SPIE 11533, 115330L (2020)

2.

Abady, L., Dimitri, G., Barni, M.: Detection and localization of gan manipulated multi-spectral satellite images. In: Proceedings of the ESANN (2022)

3.

Abady, L., Horv’ath, J., Tondi, B., Delp, E.J., Barni, M.: Manipulation and generation of synthetic satellite images using deep learning models. J. Appl. Remote Sens. 16(4), 046504 (2022)Crossref

4.

Schmitt, M., et al.: Sen12ms-a curated dataset of georeferenced multi-spectral sentinel-1/2 imagery for deep learning and data fusion. ISPRS Ann. Photogramm. Remote Sens. Spatial Inf. Sci. IV-2/W7 1(8), 153–160 (2019)

5.

Andrade, H., Fernandes, B.: Synthesis of satellite-like urban images from historical maps using conditional gan. IEEE Geosci. Remote Sens. Lett. 19, 1–4 (2022)Crossref

6.

Barni, M., Nowroozi, E., Tondi, B.: Higher-order, adversary-aware, double JPEG-detection via selected training on attacked samples. In: 2017 25th European Signal Processing Conference (EUSIPCO), pp. 281–285 (2017)

7.

Barni, M., Costanzo, A., Nowroozi, E., Tondi, B.: CNN-based detection of generic contrast adjustment with JPEG post-processing. In: 2018 25th IEEE International Conference on Image Processing (ICIP), pp. 3803–3807 (2018)

8.

Barni, M., Kallas, K., Nowroozi, E., Tondi, B.: CNN detection of gan-generated face images based on cross-band co-occurrences analysis. In: 2020 IEEE International Workshop on Information Forensics and Security (WIFS), pp. 1–6 (2020)

9.

Bermudez, C., et al.: Learning implicit brain mri manifolds with deep learning. Proc. SPIE 10574, 105741L (2018)

10.

Beucher, F.M.S.: The Morphological Approach to Segmentation: The Watershed Transformation, vol. 1. CRC Press, Boca Raton (1993)

11.

Chen, M., et al.: Generative pretraining from pixels. In: Proceedings of the 37th International Conference on Machine Learning, ICML 2020, pp. 1691–1703 (2020); Virtual Event, Proc. Mach. Learn. Res., PMLR, Vol. 119, 2020

12.

Chen, R., et al.: Reusing discriminators for encoding: towards unsupervised image-to-image translation. In: 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 8165–8174. IEEE, Piscataway (2020)

13.

Devlin, J., et al.: Bert: pre-training of deep bidirectional transformers for language understanding. In: Burstein, J., Doran, C., Solorio, T. (eds.), Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technology, NAACL-HLT 2019. Long and Short Papers, vol. 1, pp. 4171–4186. Association for Computational Linguistics (2019)

14.

Dosovitskiy, A., et al.: An image is worth 16x16 words: transformers for image recognition at scale. In: 9th International Conference on Learning Representations, ICLR 2021, OpenReview.net. Virtual Event, Austria, May 3–7 (2021)

15.

Ebel, P., Schmitt, M., Zhu, X.X.: Cloud removal in unpaired sentinel-2 imagery using cycle-consistent gan and sar-optical data fusion. In: IGARSS 2020-2020 IEEE International Geoscience and Remote Sensing Symposium, pp. 2065–2068 (2020)

16.

Ferreira, A., Nowroozi, E., Barni, M.: Vipprint: validating synthetic image detection and source linking methods on a large scale dataset of printed documents. J. Imag. 7(3), 50 (2021)Crossref

17.

Fuentes Reyes, M., et al.: Sar-to-optical image translation based on conditional generative adversarial networks-optimization, opportunities and limits. Remote Sens. 11(17), 2067 (2019)Crossref

18.

Goodfellow, I., et al.: Generative adversarial nets. In: Proceedings of 27th International Conference on Neural Information Processing Systems, NIPS’14, vol. 2, pp. 2672–2680. MIT Press, Cambridge (2014)

19.

He, K., et al.: Deep residual learning for image recognition. In: IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2016, pp. 770–778. IEEE Computer Society, Washington (2016)

20.

Ho, A., Woon, W.: A semi-fragile pinned sine transform watermarking system for content authentication of satellite images. In: Proceedings of IEEE International Geoscience and Remote Sensing Symposium, Seoul, vol. 2, pp. 1–4 (2005)

21.

Isola, P., et al.: Image-to-image translation with conditional adversarial networks. In: Proceedings of IEEE Conference Computer Vision and Pattern Recognition (CVPR) (2017)

22.

Jiang, K., et al.: Edge-enhanced gan for remote sensing image superresolution. IEEE Trans. Geosci. Remote Sens. 57(8), 5799–5812 (2019)Crossref

23.

Karras, T., et al.: Analyzing and improving the image quality of stylegan. In: IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2020, pp. 8107–8116. Computer Vision Foundation/IEEE, Piscataway (2020)

24.

Karras, T., et al.: Progressive growing of gans for improved quality, stability, and variation. In: 6th International Conference on Learning Representations, ICLR 2018. OpenReview.net (2020)

25.

Karras, T., Laine, S., Aila, T.: A style-based generator architecture for generative adversarial networks. IEEE Trans. Pattern Anal. Mach. Intell. 43(12), 4217–4228 (2021)Crossref

26.

Liu, X., Wang, Y., Liu, Q.: PSGAN: a generative adversarial network for remote sensing image pan-sharpening. In: 2018 25th IEEE International Conference on Image Process (ICIP), pp. 873–877. IEEE (2018)

27.

Liu, Y., et al.: Roberta: a robustly optimized bert pretraining approach (2019). https://​arxiv.​org/​abs/​1907.​11692

28.

Madani, A., et al.: Chest x-ray generation and data augmentation for cardiovascular abnormality classification. Proc. SPIE 10574, 105741M (2018)

29.

Meraner, A., et al.: Cloud removal in sentinel-2 imagery using a deep residual neural network and sar-optical data fusion. ISPRS J. Photogramm. Remote Sens. 166, 333–346 (2020)Crossref

30.

Mirza, M., Osindero, S.: Conditional generative adversarial nets (2014). https://​arxiv.​org/​abs/​1411.​1784

31.

Montserrat, D., et al.: Generative autoregressive ensembles for satellite imagery manipulation detection. In: IEEE International Workshop Information Forensics and Security (WIFS), pp. 1–6 (2020)

32.

Nowroozi, E., Dehghantanha, A., Parizi, R.M., Choo, K.K.R.: A survey of machine learning techniques in adversarial image forensics. Computer. Secur. 100, 102092 (2021)Crossref

33.

Nowroozi, E., Abhishek, Mohammadi, M., Conti, M.: An adversarial attack analysis on malicious advertisement URL detection framework. IEEE Trans. Netw. Serv. Manag. 20(2), 1332–1344 (2023). https://​doi.​org/​10.​1109/​TNSM.​2022.​3225217

34.

Nowroozi, E., Mekdad, Y., Berenjestanaki, M.H., Conti, M., Fergougui, A.E.: Demystifying the transferability of adversarial attacks in computer networks. IEEE Trans. Netw. Serv. Manag. 19(3), 3387–3400 (2022)Crossref

35.

Nowroozi, E., Seyedshoari, S., Mohammadi, M., Jolfaei, A.: Impact of media forensics and deepfake in society. In: Breakthroughs in Digital Biometrics and Forensics, pp. 387–410. Springer, Berlin (2022)

36.

European Space Agency (ESA): Sentinel-2: The Optical Imaging Mission for Copernicus. https://​www.​esa.​int/​Applications/​Observing_​the_​Earth/​Copernicus/​Sentinel-2. Accessed 2022

37.

Radford, A., Wu, J., Child, R., Luan, D., Amodei, D., Sutskever, I., et al.: Language models are unsupervised multitask learners. OpenAI blog 1(8), 9 (2019)

38.

Raffel, C., et al.: Exploring the limits of transfer learning with a unified text-to-text transformer. J. Mach. Learn. Res. 21, 140:1–140:67 (2020)

39.

Ronneberger, O., Fischer, P., Brox, T.: U-net: convolutional networks for biomedical image segmentation. Lect. Notes Comput. Sci. 9351, 234–241 (2015)Crossref

40.

Vaswani, A., et al.: Attention is all you need. In: Guyon, I. et al. (eds.) Advances in Neural Information Processing Systems, vol. 30. Curran Associates, Red Hook (2017)

41.

Wang, S., et al.: Linformer: self-attention with linear complexity (2020). https://​arxiv.​org/​abs/​2006.​04768

42.

Wang, Z., et al.: Ultra-dense gan for satellite imagery super-resolution. Neurocomputing 398, 328–337 (2020)Crossref

43.

Wen, X., et al.: Generative adversarial learning in YUV color space for thin cloud removal on satellite imagery. Remote Sens. 13(6), 1079 (2021)Crossref

44.

Zhu, J., et al.: Unpaired image-to-image translation using cycle-consistent adversarial networks. In: IEEE International Conference Computer Vision, ICCV 2017, Venice, Italy, October 22–29, 2017, pp. 2242–2251. IEEE Computer Society, Washington (2017)

© The Author(s), under exclusive license to Springer Nature Switzerland AG 2024

E. Nowroozi et al. (eds.)Adversarial Multimedia ForensicsAdvances in Information Security104https://doi.org/10.1007/978-3-031-49803-9_6

Domain Specific Information Based Learning for Facial Image Forensics

Chethana1  , Trisiladevi C. Nagavi², P. Mahesha² and S. G. Kruthika²

(1)

Department of Computer Science and Engineering, Vidyavardhaka, College of Engineering, Mysuru, India

(2)

Department of Computer Science and Engineering, S.J. College of Engineering, JSS Science and Technology University, Mysuru, India

Keywords

Composite sketchDomain specific methodsHolistic comparisonMorphological analysisMultimedia forensicsPhoto anthropometrySuperimpositionPartial occlusion

1 Introduction

Multimedia forensics involves various techniques to analyze multimedia signals such as audio, video, and digital images. Active and passive image authentication are the two approaches in multimedia forensics as shown in Fig. 1. Facial digital images belong to passive image authentication in multimedia forensics which involves analyzing the images and drawing conclusions from them.

A classification diagram of multimedia forensics. It is divided into active and passive authentication. Active authentication includes digital watermarking and signature.

Fig. 1

Approaches of multimedia forensics

Security systems are one of the most sophisticated systems to protect assets and privacy in recent years. The demand for fast, accurate identification and authentication is increasing day by day. Several researchers have worked on addressing challenges such as pose variation, blurriness, low resolution, illumination, facial expression, viewing angle and lighting conditions in face recognition [1]. Due to its importance in security and surveillance systems, face recognition is one of the most important and trending topics in forensics. Also, due to the evolution of digitization, many frauds and crimes are committed in online where the evidence is in digital form.

Digital evidence refers to information, which is kept, received, transferred by an electronic device which is helpful to an investigation. Law enforcement agencies have forensic experts to collect and handle the digital evidence. They use scientific tests or procedures for handling digital evidence in connection with the investigation of crime.

Digital forensic field is becoming challenging because numerous crimes are occurring frequently. The statistics of digital crimes occurring in India is shown in Fig. 2. In this plot, the value in X-axis indicates the year and the values in Y- axis indicates the number of digital crimes [2].

A cylinder bar graph of the number of digital crimes versus years from 2018 to 2021. The crimes increase every year with the highest number of crimes around 1.4 million in 2021.

Fig. 2

Statistics of digital crime rate in India

It is found that there is a drastic increase in the number of digital crimes occurring every year in India. So, there is a need for the development of reliable system in the field of digital forensics to identify the suspects involved in crimes.

The three steps involved in criminal investigation are suspect face detection, matching and identification from the database. The facial image of a suspect is extracted from the crime scenes and then it is processed, compared with the faces of suspects stored in the database. A criminal investigation team will be established to conduct the investigation. This team will be made up of professional investigators and each one of them has received training in variety of specialized disciplines like forensic experts, photographers, field evidence technician and police officers who were present at the scene.

In forensics, much evidence such as tyre prints, fingerprints, shoe impressions, blood splatters, lip prints, Deoxyribonucleic Acid (DNA) and face can be considered for suspect identification. Face is considered as the strong evidence because it contains many features compared with other evidence. In forensics, facial images are captured under adverse conditions; hence, face recognition in forensics is more advanced than normal face recognition.

Suspects are identified by the forensic experts using manual approach. Suspects are identified based on domain specific methods such as holistic comparison, morphological analysis, photo anthropometry and superimposition. In all above-mentioned approaches, the time required to identify the suspects for manual comparison process is more and requires lot of effort.

Numerous research works are carried out in the field of forensics [1, 3–6]. Even though there are lot of research works, but still there exists few challenges to be addressed in the field of face recognition for forensics. To overcome these challenges, there is a potential for new approaches in this field by automating domain specific methods.

2 Multimedia Forensics

Forensic science deals with the existence of a crime through the examination of physical evidence, interpretation of data and administration of tests. The term forensics is originated from the Latin word forensic which means “of or before forum” and multimedia forensics is one of the branches of forensic science.In forensics, an incident has already occurred, and the user has no control over the generation of evidence.

Over the last decades, forensic science has gained popularity around the globe. Crime Scene Investigation, Law and Order, Crossing Jordan, and Forensic Files are among the many television shows devoted to law and crime scene investigation. Many educational systems throughout the world have begun to offer forensics courses. Undergraduate, graduate, and doctoral forensic science programs are being added to institutions around the world. Due to the widespread interest in forensics, a few organizations have been established and numerous worldwide conferences have been held to share knowledge and assist other nations in keeping up with the new trend. As a result, forensic science has gained popularity in many nations throughout the world [7].

There are 11 subdivisions in the field of forensic science which includes ballistics, chemistry, explosives, photography, questioned documents, toxicology, biology, drugs and narcotics, instrumentation, physics, and serology. M.S. Rao founded the directorate of forensic science services (DFSS) in 2002 with the objective of providing high-quality and credible forensic services to the justice delivery system [8]. The roles of DFSS are:

Provide scientific aid in the criminal justice system.

It guides, regulates, and controls the working of forensic science laboratories.

Provide financial and technical help to state forensic science laboratories.

Promotes research and development in forensic science field.

Seven central forensic science laboratories are in India located at Hyderabad, Kolkata, Chandigarh, New Delhi, Guwahati, Bhopal, and Pune. The roles of these forensic science laboratories are:

Providing the evidence in a format that is acceptable in court.

If the evidence is too bulky, then mobile forensic units are sent to the scene of crime.

Scientific examination and analysis of clue materials.

Interpretation of forensic clues and the identification of evidence materials at the crime scene.

The seven best forensic science universities in India are Lok Nayak Jayaprakash Narayan National Institute of Criminology and Forensic Science Delhi, Institute of Forensic Science Mumbai, International Forensic Science Institute Pune, Osmania University Hyderabad, Bundel khand University Jhansi, Gujarat Forensic Science University Gandhinagar, Dr.Harisingh Gour Vishwavidyalaya Sagar. There are several tools used in the field of forensic science such as:

Mobile Detect: It brings narcotic testing on to the smart phone.

Crime pad: It brings all the information about the crime scenes in centralized location which can be shared among all the branches of investigation teams.

MOBILedit Phone Copier: It can copy contacts and messages from someone and transfer to new one.

bMOREsafe: It is a question driven application providing a personal and compassionate way of finding the next possible course of action.

Trinethra: It is used by police personnel to search for the information about the suspects [9].

Several working groups in the forensic science arena exist with the goal of standardising and giving proper training to face comparison experts [10]. Facial identification scientific working group works under the Federal Bureau of Investigation (FBI) and Biometric Centre of Excellence. It has released a draft containing the description of face identification, comparison, and guidelines for forensic experts to perform face comparison.

Face recognition for forensics is receiving more attention because forensic experts may prove or disprove the guilt of a suspect with high confidence under the legal system. Continued advancements in automated face recognition technology are required to determine person’s identity particularly from the facial description collected from crime scenes. The goal of FBI’s next generation identification programme is to make such breakthrough for face recognition in forensics.

Automated face recognition plays a vital role in forensics. The most important evidence in the criminal investigation is the facial images captured from the crime scene, as they represent the identity of the people involved in crime. The role of law enforcement agencies is to identify the facial images from the suitable database. This information can be treated as strong evidence for the law enforcement agencies which becomes the most important evidence in global counter-terrorism initiatives. In forensic science, it is critical to consider how evidence gathered from the facial images might be presented in court of law. This necessitates a thorough assessment of statistical likelihood of facial images in order to determine its evidence value.

Forensic face identification is a subdivision of forensic science, and it belongs to forensic anthropology. To establish whether two facial photos belong to the same person or not, it entails manually comparing the two or a live subject and a facial image. This method aids in quickly identifying the suspects. The manual and automated approach for face recognition framework in forensics is shown in Fig. 3.

A diagram of manual and automated face recognition framework. It consists of a database, which is matched to a probe, and a gallery with an unknown I D. A manual inspection is done of the matches.

Fig. 3

Manual and automated approach for forensic face recognition framework [11]

In both the approaches, an unknown image captured from the crime scene which is also known as suspect image is queried against the ‘N’ number of images stored in the database. Here 1: N match is performed in both the cases and top N matches are examined which will always return the rank-1 matches of an individual.

As mentioned earlier, forensic experts follow four domain specific methods for suspect identification [12].

1.

Holistic Comparison: Here manual approach is used for face comparison. It uses aggregate information represented by a small number of features derived from pixel information in facial images.

2.

Morphological Analysis: Binary image processing, dilation and erosion are the techniques involved in morphological analysis. The individual features of the face are extracted from the entire facial region by applying morphological operations.

3.

Photo Anthropometry: It is a metric based facial image comparison technique which considers few parameters such as facial features, distance, and angle between facial landmarks. The predetermined facial landmarks are applied to generate the measurements of face and then Proportionality Indices (PI) is calculated for the same. The PI values of both suspect and gallery images are compared to find the matches.

4.

Superimposition: In this, one image will be placed on the top of another facial image. It is also a facial reconstruction technique in which facial images are reconstructed from the skull or by having partial information.

The manual facial identification process [13] is time consuming task and a tedious job. To address this issue, there is a need for developing an automated face recognition system for forensics.

Over the past decades, people have started sketching others’ features in an effort to capture a fleeting image of a situation or individual before it changes.Instead of attempting to capture an exact likeness, the recorded image searches for an object or person’s essence.Even though no two facial images are identical, the facial traits and head shapes lend them to a classification method that allows one person to be identified among hundreds of photographs. The identifiable features are encoded using images of faces which are stored for later retrieval purpose. When there is a little evidence and the perpetrator’s identity is unclear, law enforcement agencies employ a composite sketch to enhance their investigation [14].

Alphonse Bertillon developed an identification system called Portrait Parle in 1880. The system involves the compilation of facial features captured from the photographs along with the description. Bertillon developed a catalogue - an identification method which helps in identifying the local prisoners, as well as to obtain the description of unknown suspects.

Partial occlusions and facial composite sketch collected from the digital evidence in a crime scene are the first-hand information for suspect lookup in forensics. In partial occlusions, only partial information of the face is available. It is a challenging task to reconstruct the remaining parts of the face from it which would be helpful in identifying the suspects for forensics.

Recent technological advances have led several law enforcement agencies to move from hand-drawn to software-generated composite facial sketches using tools such as Photo-Fit and Identikit. Facial composite sketch and partial occluded facial images possess greater challenge than viewed sketch recognition because it contains incomplete information due to subjectivity of the description and imperfection of the witness memory.

Due to its greater challenge in sketch-based recognition and partial occlusions, an attempt can be made in this direction to design a reliable system for automating domain specific methods by recognizing partial occlusions and facial composite sketches.

3 General Framework of Automated Forensic Face Recognition

The manual examination of two facial images to determine whether they are the same person or not is known as forensic face recognition. The general framework for automated forensic face recognition is shown in Fig. 4.

A block flow diagram automated face recognition framework. It starts with the occurrence of a harmful crime, followed by a facial image of the suspect. It ends with generation of the investigation report.

Fig. 4

General framework of automated forensic face recognition [15]

The general framework of automated forensic face recognition consists of six steps. They are described as follows.

1.

A Violent or Harmful Crime Occurrence: Even though modern cities are becoming safer there are still millions of crimes occurring. These incidents range from murder, child abuse, counterfeiting, bribery, forgery, and fraud.

2.

A Facial Image of a Suspect is Available: It will be available from different sources. To quote an example, the footages of terrorist leaving a bomb in the tourist area might have been recorded or traffic camera might have captured a person’s face before the robbery incident [15].

3.

An Investigator Searches the Image against the Database: The suspect image is sent to digital forensic expert who is responsible for managing the digital evidence. Automated face recognition software can be used to search the suspect image against the database which is also known as gallery images.

4.

A Candidate List of Top Matches: Once the automated process is completed, the system will return the ranked list of top matches with high similarity score.

5.

Examination of Candidate List: Forensic face comparison expert will examine the candidate list to determine whether they are the same person or not against the gallery images.

6.

Generation of Investigative Lead Report: The suspect image is matched against the gallery images, then investigative lead report is generated for the image with the highest similarity score, which can used as a clue for solving the criminal case.

4 Related Work

This section introduces face recognition for forensics and various approaches put forth by the researchers to recognize the facial image of a suspect during the crime scene. The works related to domain specific methods such as holistic comparison, morphological analysis, photo anthropometry and superimposition for forensic facial identification is discussed in detail.

The holistic approach takes the entire face as input and each facial image is processed as a single high dimensional vector by concatenating all the face grey values. Some contributions related to holistic approach are highlighted. Karamizadeh et al. [16] described an overview on holistic face recognition. Four holistic approaches for face recognition such as Karhunen-Lo’eve expansion, linear discriminant analysis (LDA), principal component analysis (PCA) and noise model were developed. Oancea et al. [17] proposed an analysis based on facial recognition rate using holistic methods.

Sabeenian et al. [18] proposed some of the significant milestones in face representation for recognition as well as the numerous strategies used in these approaches. It also describes the significance for the transition of holistic approaches to deep learning face recognition methods. Viegas et al. [19] proposed a survey on different approaches for face recognition. In this work, different approaches such as geometric, piecewise-meal, appearance and template for forensic face recognition are discussed in detail.

Morphological techniques such as binary image processing, erosion, and dilation are used to differentiate between facial region of an image and the rest of the image. An approach based on morphological method by Tiwari et al. [20] for face recognition using fiducial points is discussed. Back Propagation Neural Networks (BPNN) is applied for learning and identifying a person. Experiments are evaluated on GRIMACE Face database consisting of 360 colored facial images of 18 individuals. Experimental results envisaged that proposed approach provides promising results. Liposcak et al. [21] proposed a novel approach for face recognition from profiles using morphological operations. The algorithm uses morphologically derived profile shapes and achieves better results for a significant change in the hairline.

Kulkarni et al. [22] presented an approach based on morphological face detection and recognition with PCA. Morphological hit operations are applied for face detection. Features are extracted using PCA and the extracted features are fed into Neural Networks for classification. Experiments are evaluated on IIT Kanpur Indian database and provide promising results.

Bacci et al. [23] proposed an approach based on morphological analysis to assess the effect of facial disguises on facial identification for forensics. Experiments are evaluated on WITS face database. Experimental results envisaged that proposed approach provides promising results.

In photo anthropometry, an approach to detect anthropometric facial fiducial points is proposed by Gupta et al. [24]. A novel computer assisted photo-anthropometric facial identification systems were developed for full-face and profile facial images. Krista et al. [25] developed an approach to determine whether anthropometry has a significant role in forensics by confirming the identity of a suspect from CCTV surveillance.

Superimposition is defined as insertion of a new image on the top of an existing image. Devi et al. [26] presented a cranio facial superimposition technique for recognizing the human by matching between skull and facial shape. Liu et al. [27] proposed a new algorithm to perform superimposition from a well matched face. Haner et al. [28] proposed a valid 3D surface superimposition technique to assess facial changes during growth.

According to review of the literature, there are few works [1, 3–6] in the field of forensic facial recognition. Domain-specific methods have received minimal attention in terms of automation. Hence comprehensive approaches for automating domain-specific methods using partial occlusions and sketch-based recognition for forensics can be developed.

5 Challenges of Face Recognition for Forensics

The challenges that emerged from the evaluation of current research are thoroughly examined. Face recognition for forensics has a significant number of challenges which are described as follows.

1.

Facial Aging: A significant age difference exists in many face recognition systems which affects the recognition accuracy which is found in some face recognition applications such as identification of missing children, detection of a suspect in the database [29]. There are other factors such as pose variations, lighting conditions, facial expressions and partial occlusions which influences facial appearance along with facial aging. Figure 5a and b depicts the sample images from FG-NET and MORPH database showing age variations.

Two sets A and B of 7 and 5 photographs, respectively. A consists of photographs of a person from age 2 to 40. B consists of photographs of a person from age 25 to 48.

Fig. 5

Samples showing changes on face with age variations on FG-NET and MORPH database. (a) Images of a subject from the FG-NET database. (b) Images of a subject from the MORPH database

2.

Facial Marks: It includes scars, moles and freckles which enhances the accuracy and matching speed of face recognition algorithms giving forensic applications a special capacity to examine, annotate and utilize facial photos. Additionally, forensic experts will need this information to identify the suspects accurately during their testimony in court [11].

Local or global texture features are frequently used in conventional face recognition algorithms to encode the facial images. However, these methods often require a whole facial image as input and do not expressly make use of local facial marks [12].

3.

Forensic Sketch Recognition: They represents the artistic rendition of a person’s facial appearance which is derived from an eyewitness description. It is generated when photo of a suspect is not available at the time of crime scene.

Figure 6a, b and c represents the sketch of a suspect, incorrect top retrieved photograph, and the true photo of the subject.

Three sets A, B, and C of photographs of a probe sketch, top retrieval, and true subject. A depicts grayscale sketches of people.

Fig. 6

(a) Samples of probe sketch, (b) Top retrieval, (c) True subject [30]

4.

Face Recognition in Videos: Due to widespread deployment of surveillance cameras, face recognition in video has gained significance in forensics.The facial images in video will undergo severe lighting changes and contains non-frontal poses of the face.

5.

Near-Infrared Recognition of Face (NIR): The near infrared facial images can be used to overcome the impact of varying illuminations for forensics. The images captured in near infrared illumination and visible spectrum is shown in Fig. 7a and b.

Two sets A and B of 3 photographs each. A consists of grayscale infrared photographs of 3 people. B consists of the corresponding photographs.

Fig. 7

(a) Near infrared facial images, (b) The corresponding photographs [6]

Due to high accuracy of matching near infrared and visible spectrum facial images, surveillance systems can consider NIR cameras for compensating the illumination issues.

These challenges can be addressed in the field of forensics face recognition thereby automating the domain specific methods.

6 Motivation

Forensic face recognition refers to the manual examination of two facial images to determine whether they are the same person or not. Forensic experts use domain specific methods and perform manual comparison to determine whether they are same person or not. But this process does not have standard procedure for face comparison and opinion is subjective which varies from one forensic examiner to another.

Most of the time a suspect’s photo is not available in crime scenes, but it may occasionally present with partial occlusion. It is only possible to identify the suspects based on eyewitness description.

Once sketch is created, the next significant step is to identify the individual in the sketch or in the partially occluded facial images. It is performed by matching the facial composite sketch and partial occluded images to the facial digital images of the suspects stored in the database.

Automated face recognition systems are used in determining the strength of evidence. Also, accuracy should be higher in this system, as it could derail the criminal investigation process. Hence it possesses new challenges in the field of face recognition for forensics which has a greater number of unsolved problems.

The practical significance and need for forensic face recognition for present and future motivated to study this new and exciting field. This laid a strong foundation to design a reliable system by automating domain specific methods for facial composite sketch and partial occlusion-based face recognition. Face recognition for forensics is found in law enforcement, military, and business scenarios. The present research work is useful in domestic scenario where the trace is available in the form of sketch or partial occlusion. Forensic experts compare the trace with the evidence already stored in the database. If a match occurs, investigative lead report will be generated and sent to investigation officer for further process of suspect arrest.

7 Datasets Used

Some of the datasets can be used to automate the domain specific methods, namely:

(a)

Composite Sketch with Age Variations Dataset (CSA)

(b)

Extended PRIP Dataset(E-PRIP)

(c)

Disguised Faces in the Wild Dataset (DFW)

7.1 Composite Sketch with Age Variations Dataset

The dataset is collected from IIIT, Delhi [31, 32] which consists of 98 sketches and 2751 facial digital images of multiple ages collected from different individuals. The dataset is collected from FG-NET Aging dataset [29] with 52 samples, IIIT-D Aging Dataset [33] with 82 samples and rest of the subjects are taken from the internet.

They are generated from FACES software which consists of three groups of different age variations such as younger, same and older age. The statistics of samples for CSA dataset are indicated in Table 1.

Table 1

Statistics of CSA dataset samples [31, 32]

Composite

Facial digital

Dataset name

sketch

images

Source

Size

Composite sketch with age variations (CSA)

98

2751

Image Analysis and Biometrics Lab, IIIT Delhi

Dimensions 196 $$\times $$ 224 pixels

7.2 E- PRIP Dataset

The dataset consists of 123 composite sketches and their corresponding facial digital images which are taken from AR Face database [37].

The statistics of E-PRIP dataset [34] is indicated in Table 2. The samples of sketch and corresponding facial digital images from CSA and E-PRIP dataset are shown in Fig. 8.

Four sets of 4 photographs each. They consist of grayscale sketches and photographs of matching people from the dataset.

Fig. 8

Composite sketch and facial digital images from E-PRIP and CSA dataset

Table 2

Statistics of E-PRIP dataset samples [35]

Composite

Facial digital

Dataset name

sketch

images

Source

Size

Extended PRIP dataset(E-PRIP) and AR face database

123

123

Image Analysis and Biometrics Lab, IIIT Delhi

Min-200 $$\times $$ 250 dimensions to Max-1000 $$\times $$ 1600 dimensions

7.3 Disguised Faces in the Wild Dataset

The dataset is collected from Image Analysis and Biometrics Lab, IIIT Delhi [36] which contains 1000 subjects and 111,157 images with 400 subjects for the training and the remaining 600 subjects for testing. All the images are stored in jpeg format. Each subject may contain genuine, obfuscation, imposter and impersonator images are shown in Fig. 9. The statistics of DFW dataset is shown in Table 3 and the samples of partial occluded facial images from DFW dataset is shown in Fig. 10a–f.

a photograph of Salman Khan at the top with 4 sets of photographs below. The sets include genuine, obfuscation, impersonation, and imposter. The imposter set consists of people other than the original photograph.

Fig. 9

Single subject and corresponding normal, obfuscation, imposter and impersonator images [36]

Six photographs of different people from A to F. The faces of the people are partially hidden.

Fig. 10

Samples of partial occluded facial images from DFW dataset [36]

Table 3

Statistics of DFW dataset samples [36]

Dataset name

Number of subjects

Source

Size

Disguised faces in the wild dataset (DFW)

1000

Image Analysis and Biometrics Lab, IIIT Delhi

Min-200 $$\times $$ 350 dimensions to Max-1000 $$\times $$ 1800 dimensions

1.

Genuine: A person who is real and exactly appears to be the original facial image.

2.

Imposter: A person tries to pretend to be someone else to gain advantage and tries to hide the criminal activities done by him.

3.

Obfuscation: When a person tries to obfuscate themselves by the presence of partial occlusions such as facial hair, moustache, and hair style. Due to obfuscation, the clarity of the facial images becomes less clear and harder to understand.

4.

Impersonation: When a person tries to act like another person by copying his characteristics such as appearance, behavior, and expressions for the purpose of committing crime.

8 Metrics Used to Evaluate the Performance

Experiments can be conducted on DFW, CSA and E-PRIP datasets and performance analysis can be demonstrated through qualitative analysis which is observed through confusion matrix. It is one of the metrics used to assess how well a classification model performs when applied to test data with known actual values.

Qualitative analysis is ascertained by the True Positive (TP), True Negative (TN), False positive (FP) and False Negative (FN). A TP is an outcome where the model correctly predicts the positive class. Similarly, a TN is an outcome where the model correctly predicts the negative class. A FP is an outcome where the model incorrectly predicts the positive class. Similarly, a FN is an outcome where the model incorrectly predicts the negative class. Hence it can be employed to find the number of correct and incorrect matches.

Various performance metrics such as accuracy, precision, recall (true positive rate), F1-score and false positive rate (FPR) can be considered for evaluation from the confusion matrix. Following section defines all these metrics.

1.

Accuracy: Degree to which a measurement is accurate with respect to a certain value represented as follows.

(1)

2.

Precision: The measure of exactness represented as follows.

(2)

3.

Recall: It is the measure of how well a class is identified properly in terms of percentage represented as follows.

(3)

4.

F1- Score: It is a score which strikes a balance between precision and recall represented as follows.

(4)

5.

False Positive Rate: It is the likelihood of incorrectly rejecting a hypothesis represented as follows.

(5)

Further, the Receiver Operating Characteristic (ROC) curve is used to show how well a classification model performs. ROC curve is a probability curve and area under curve (AUC) represents the degree of separability. ROC-AUC curve is a graphical plot that illustrates the performance measurements of classification at varying thresholds [13].

The excellent model will have AUC value closer to 1 which indicates that it has a good measure of separability. Poor model will have AUC value near to 0 which indicates that it has a worst measure of separability. If the AUC value is 0.5 which indicates that the model has no measure of separability.

The region enclosed by the function f(x) with two vertical lines and one horizontal axis is known as area under the curve (AUC) and its values are determined by evaluating the definite integral of the function regarding vertical boundaries. It measures the entire two-dimensional area present underneath the entire ROC curve is indicated in Eq. (6).

(6)

Higher the ROC-Area better is the classifier performance in recognizing the person accurately.

9 Applications

Face recognition for forensics has become a ubiquitous tool to guide criminal investigations, gather intelligence and provide evidence in court [32]. The CCTV systems, web cameras, digital cameras and mobile devices are the source for capturing the facial images which are used for criminal investigation. The brief explanations of various applications of automated face recognition for forensics are as follows:

Identification of deceased and missing persons during humanitarian emergencies such as war and terrorist attacks [7].

Facial reconstruction technique is one of the significant applications in forensics which is used to reconstruct the facial images from the skull of dead bodies.

Monitoring the people boarding planes. To quote an example, Malaysian airplane that was carrying 239 passengers and went missing above the Indian ocean in the year 2014. Due to lack of information available about the plane, it remains undetected for so many years. Because of this reason, it is necessary to keep track of the people boarding planes in the airport.

The dead bodies get damaged or wounded due to natural calamities like floods, earthquakes. It is necessary to identify the dead bodies during large scale disasters.

Used to monitor the people who might cause a threat to an organization by committing crime. To quote an example, facial recognition CCTV systems are installed in large organizations which will support the investigators for suspect identification.

10 Conclusion

Multimedia forensics is one of the significant fields in cyber forensics. Automated digital facial images for forensic application is quite challenging due to facial images captured under unconstrained environment. An overview of forensics, extensive literature review on domain specific methods for forensic face recognition is discussed. The present chapter has also highlighted some of the datasets, metrics which can be considered for composite sketch recognition and partial occlusion. The applications of face recognition for forensics are also discussed.

References

1.

Fan, C.L., Chen, X.T.: Research of face recognition based on wavelet transform and principal component analysis. In: Proceedings of 8th International Conference on Natural Computation, pp. 575–578 (2012)

2.

https://​www.​statista.​com/​statistics/​309435/​india-cyber-crime-it-act/​

3.

Hassaballah, M., Aly, S.: Face recognition: challenges, achievements and future directions. IET Comput. Vision 9(4), 614–626 (2015)Crossref

4.

Lohiya, R., Shah, P.: FaceRecognition techniques: a survey for forensic applications. Int. J. Adv. Res. Comput. Eng. Technol. 4(4) (2015)

5.

Salici, A., Ciampini, C.: Automatic face recognition and identification tools in the forensic science domain. In: International Tyrrhenian Workshop on Digital Communication, pp. 8–17. Springer, Cham (2017). https://​doi.​org/​10.​1007/​978-3-319-67639-5_​2

6.

Spaun, N.A.: Face recognition in forensic science. In: Handbook of Face Recognition. pp. 655–670. Springer, London (2011). https://​doi.​org/​10.​1007/​978-0-85729-932-1_​26

7.

Jacquet, M., Champod, C.: Automated face recognition in forensic science: review and perspectives. Forensic Sci. Int. 307 (2020)

8.

https://​www.​slideshare.​net/​drbhargava5745/​introduction-to-forensic-science-labs-in-india

9.

https://​www.​forensicscollege​s.​com/​blog/​resources/​forensic-science-and-investigation-apps

10.

Ali, T., Veldhuis, R.N.J., Spreeuwers, L.J.: Forensic face recognition: a survey. CTIT Technical Report Series, No. TR-CTIT-10-40, Centre for Telematics and Information Technology (CTIT), 2010

11.

Anil, K.J., Brendan, K., Unsang, P.: Face Recognition: Some Challenges in Forensics. Michigan State University, Michigan (2011)

12.

Nicole A.S.: Face Recognition in Forensic Science. United States Army Europe Headquarters, Heidelberg (2011)

13.

Patil, S., Shibhangi, D.C.: Composite sketch based face recognition using ANN classification. Int. J. Sci. Technol. Res. 9, 42–50 (2020)

14.

Chethana, H.T., Nagavi, T.C.: A review of face analysis techniques for conventional and forensic applications. Cyber Security and Digital Forensics, pp.223–238. Wiley Publications, New York (2022)

15.

https://​rankone.​io/​2019/​06/​12/​how-forensic-face-recognition-works/​

16.

Karamizadeh, S., Abdullah, S.M., Zamani, M.: An overview on holistic face recognition. Int. J. Res. Comput. Commun. Technol. 2(9) (2013)

17.

Oancea, R., Barsan, D.B.R.: Analyses of face recognition rates using holistic methods. Int. Conf. Knowledge Based Organ. 23(3) (2017)

18.

Sabeenian, R.S., Harirajkumar, J., D’ Cruz, L.: Transition from holistic to deep learning face recognition methods. Int. J. Recent Technol. Eng. (IJRTE) 8(4) (2019). ISSN: 2277-3878

19.

Viegas, M.A.E., Simoes, R., Thanekar, N., Banerjee, S.: Different approaches of face recognition. Int. J. Eng. Res. Technol. 8(06), (2019). ISSN: 2278-0181

20.

Tiwari, R., Shukla, A., Prakash, C., Sharma, D., Kumar, R., Sharma, S.: Face recognition using morphological method. In: IEEE International Advance Computing Conference. Patiala (2009). ISBN: 978-1-4244-2927-1. https://​doi.​org/​10.​1109/​IACC14940

21.

Liposcak, Z., Loncaric, S.: Face recognition from profiles using morphological operations. In: Proceedings of International Workshop on Recognition, Analysis, and Tracking of Faces and Gestures in Real-Time Systems, In Conjunction with ICCV’99 (1999). https://​doi.​org/​10.​1109/​RATFG.​1999.​799222. ISBN: 0-7695-0378-0

22.

Kulkarni, M.K., Lokhande, S.S.: Morphological based face detection and recognition with principal component analysis. Int. J. Comput. Sci. Inf. Technol. 5(3), 4560–4565 (2014)

23.

Bacci, N., Davimes, J.G., Steyn, M., Briers, N.: Forensic facial comparison: current status, limitations and future directions. MDPI: Biol. 10, 1269 (2021). https://​doi.​org/​10.​3390/​biology/​10121269

24.

Gupta, S., Markey, M.K., Bovik, A.C.: Anthropometric 3D face recognition. Int. J. Comput. Vision. https://​doi.​org/​10.​1007/​s11263-010-0360-8 (2010)

25.

Kleinberg, K.F., Vanezis, P., Burton, A.M.: J. Forensic Sci. 52(4) (2007). https://​doi.​org/​10.​1111/​j.​1556-4029.​2007.​00458.​x

26.

Devi, M.C., Rani, M.P.: Recognizing human by matching between skull and face shape: a survey. Int. J. Eng. Res. Technol. (2015). ISSN: 2278-0181, NSRCL-2015

27.

Liu, C., Li, X.: Superimposition-guided facial reconstruction from skull. Assoc. Comput. Mach. 1(1) (2018)

28.

Haner, S.T., Kanavakis, G., Matthey, F., Gnkatidis, N.: Valid 3D surface superimposition references to assess facial changes during growth. Nature Portfolio. https://​doi.​org/​10.​1038/​s41598-021-95942-3

29.

Lanitis, A.: Comparative evaluation of automatic age-progression methodologies. EURASIP J. Appl. Signal Process. 239480 (2008). Advance Online Publication. https://​doi.​org/​10.​1155/​2008/​239480

30.

Wang, X., Tang, X.: Face photo-sketch synthesis and recognition. IEEE Trans. Pattern Anal. Mach. Intell. 31(11), 1955–1967 (2008). https://​doi.​org/​10.​1109/​TPAMI.​2008.​222. PMID:19762924Crossref

31.

Chugh, T., Singh, M., Nagpal, S., Singh, R., Vatsa, M.: Transfer learning based evolutionary algorithm for composite face sketch recognition. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition Workshops (2018). https://​doi.​org/​10.​1109/​CVPRW.​2017.​90

32.

Nagpal, S., Singh, M., Singh, R., Vatsa, M., Noore, A., Majumdar, A.: Face sketch matching via coupled deep transform learning. In: International Conference on Computer Vision (2017)

33.

Yadav, D., Singh, R., Vatsa, M., Noore, A Recognizing age-separated face images: humans and machines. PLoS One 9(12), e112234 (2014). https://​doi.​org/​10.​1371/​journal.​pone.​0112234. PMID: 25474200Crossref

34.

Identi-Kit: (2020). https://​www.​identikit.​net/​

35.

Mittal, P., Jain, A., Goswami, G., Singh, R., Vatsa, M.: Recognizing composite sketches with digital face images via SSD dictionary. In: Proceedings of IEEE International Joint Conference on Biometrics (2014). https://​doi.​org/​10.​1109/​BTAS.​2014.​6996265

36.

Kushwaha, V., Singh, M., Singh, R., Vatsa, M., Ratha, N., Chellappa, R.: Disguised faces in the wild. In: IEEE International Conference on Computer Vision and Pattern Recognition Workshop on Disguised Faces in the Wild (2018)

37.

Han, H., Klare, B.F., Bonnen, K., Jain, A.K.: Matching composite sketches to face photos: a component - based approach. IEEE Trans. Inf. Forensics Secur. 8(1), 191–204 (2012). https://​doi.​org/​10.​1109/​TIFS.​2012.​2228856Crossref

© The Author(s), under exclusive license to Springer Nature Switzerland AG 2024

E. Nowroozi et al. (eds.)Adversarial Multimedia ForensicsAdvances in Information Security104https://doi.org/10.1007/978-3-031-49803-9_7

Linguistic Steganography and Linguistic Steganalysis

Hanzhou Wu1  , Tianyu Yang¹, Xiaoyan Zheng¹ and Yurun Fang¹

(1)

School of Communication and Information Engineering, Shanghai University, Shanghai, China

Hanzhou Wu

Email: h.wu.phd@ieee.org

Keywords

Linguisitc steganographyLinguistic steganalysisInformation hidingDigital forensicsSecurity

1 Introduction

The past two decades have witnessed the rapid development of online social networking services. It is easy for people to integrate into social platforms through mobile terminals and share personalized information with others. It provides great convenience for covert communication since covert communication, as a kind of abnormal behavior, can be easily covered by the large number of ordinary behaviors over social networks. As an effective means to covert communication, as shown in Fig. 1, steganography is defined as the art of hiding secret information into a digital signal which is also called cover such as digital image and audio without significantly degrading the quality of the signal. The resultant signal carrying the secret message, typically called stego, will not arouse the suspicion of the channel attacker (i.e., the steganalyzer in Fig. 1) when transmitting it through an insecure channel such as the Internet since the distortion between the original signal and the embedded signal is too low to perceive. As shown in Fig. 1, steganography can be modeled as a secure communication problem [50, 51]. However, different from cryptography that encrypts a meaningful message as a meaningless data stream which may arouse the suspicion of the attacker, the goal of steganography is to even hide the presence of the present communication, which makes up for the shortcomings of cryptography and becomes more and more important in modern information security.

A framework for steganographic communication uses a data hider secret key, cover signal, and secret message for data embedding, creating a Stego signal. Extraction is done through a steganalyzer on the public channel or a secure channel with a secret key, revealing the secret message.

Fig. 1

General framework for the steganographic communication

Steganalysis [56], on the other hand, as a counter technology to steganography, aims at revealing the existence of steganography. It corresponds to the steganalyzer shown in Fig. 1. Different steganalysis algorithms have different focuses. For example, the most intuitive target of steganalysis is to determine whether a signal conceals hidden information or not, which, essentially, can be treated as a binary classification problem. Other purposes of steganalysis include payload estimation (i.e., to estimate the size of the embedded information), information localization (i.e., to locate the embedded information), and information extraction (i.e., to extract the embedded information). These steganalysis techniques are typically called quantitative steganalysis [35]. Compared with classification-oriented steganalysis, quantitative steganalysis significantly improves the difficulty of problem solving. As a result, most of the existing steganalysis algorithms aim at classifying a given signal as cover or stego. In this chapter, we will model linguistic steganalysis as a binary classification problem as well.

Many steganographic algorithms are proposed in the past two decades. The majority of them are developed for still images since images are easy to be edited and more importantly they are widely distributed over the Internet, meaning that stego images can be easily covered by ordinary images. In addition, images are full of noise components, which indicates that there exist large redundant space for images to accommodate additional information without significantly degrading the visual quality of these images. Compared with images, videos have attracted increasing interest to scholars in recent years due to the large volume of video data and popularity of short-video sharing platforms [9]. Advanced steganographic strategies suited to images may also work for video since video can be modeled as a set of still images. However, since videos are typically compressed by specific codec which may remove the secret, video steganography is more challenging than image steganography. Another common steganographic carrier is audio. Different from image/video steganography that require high visual quality, the most important requirement of audio steganography is to ensure the auditory quality [67].

As the most common information carrier in our daily life, text (or say natural language) is quite suitable for steganography. Especially, texts are widely distributed over mobile social networks, enabling us to easily realize steganography by typing in the stego texts. More importantly, by sending stego texts over social networks, there may be no need for the receiver to take any suspicious interaction action such as downloading and commenting. Instead, the real receiver may keep silent and reconstruct the hidden information from the stego text. However, compared with the above steganographic carriers that can accommodate much secret information due to the large redundant space, texts are highly coded, which means that it is very difficult to modify a text to accommodate additional information since modifying a given text easily leads to semantic inconsistency and grammatical errors. As a result, text steganography (or called linguistic steganography, natural language steganography) is more challenging than steganography in other common carriers [66].

Increasing studies focus on linguistic steganography in recent years. Mainstream algorithms can be roughly categorized into modification-oriented linguistic steganography and generation-oriented linguistic steganography. The former changes a cover text to accommodate additional information, whereas the latter uses secret bits to directly produce a stego text. The advantage for the former is that it maintains the semantic information well. However, the embedding payload is very limited. For the latter, it is capable of providing a high payload, but the semantic information is uncontrollable, which makes it very difficult to adapt to social environment. Recent work has built a bridge between the two kinds of linguistic steganography so that advantages from both categories can be utilized. On the other hand, linguistic steganalysis has also been studied in a deep-going way. Early linguistic steganalysis algorithms are manually carefully crafted, i.e., designing the detection features depends heavily on the experience of the algorithmic designer. Since the statistical characteristics and semantic characteristics vary between different texts, the manually crafted features cannot well reveal the steganographic evidence, thereby limiting their applicability. With the fast development of deep learning, recent advances bring the success of deep learning in various fields to linguistic steganalysis. By exploiting the large pre-trained language model and/or various deep neural networks, discriminative features can be extracted for efficient stego text detection.

In this chapter, we will review advanced methodologies in linguistic steganography and linguistic steganalysis in order to trace the latest developments and trends. Research challenges and opportunities will be discussed as well. This chapter is intended as a tutorial of text based steganography and steganalysis in the context of media security. To this purpose, in Sect. 2, we provide necessary preliminaries. In Sect. 3, advances in linguistic steganography are reviewed, followed by advances in linguistic steganalysis in Sect. 4. The research challenges and opportunities are given in Sect. 5. Finally, we conclude this chapter and give discussion in Sect. 6.

2 Preliminaries

2.1 Mathematical Description of Linguistic Steganography

In natural language processing, a token is a string containing contiguous characters that play a certain role in a written language. Most words such as “English”, “you” and “me” are tokens, and punctuation marks such as “.” and “,” are also tokens. In this chapter, for compactness, we will consider token as equivalent to word from a broader perspective unless otherwise specified. A natural text $$\mathbf {c}$$ is expressed as an ordered sequence of tokens sampled from a large vocabulary, i.e.,

(1)

where $$c_i\in V$$ is the i-th token of $$\mathbf {c}$$, n represents the length of the text and V  represents the vocabulary. For example, let $$\mathbf {c}$$ denote the sentence “you are great .”, we then have $$c_1$$ = “you”, $$c_2$$ = “are”, $$c_3$$ = “great” and $$c_4$$ = “.”. The objective of modification-oriented linguistic steganography (ModLS) can be described as follows. Given a secret message $$\mathbf {b} \in \{0, 1\}^l$$ with a length of $$l &gt; 0$$, the data sender embeds $$\mathbf {b}$$ into $$\mathbf {c}$$ to generate a stego text $$\mathbf {s} = \{s_1, s_2, \ldots , s_m\} \in V^m$$, $$m &gt; 0$$, according to a secret key $$\mathbf {k}$$, i.e.,

(2)

The stego text will be conveyed to the data recipient via a public channel, who can extract $$\mathbf {b}$$ with $$\mathbf {k}$$, i.e.,

(3)

In most cases, we have $$m = n$$ and the data embedding function is designed by a token-wise fashion, implying that during data embedding, the present token to be embedded is either unchanged or modified as the most suitable token sampled from V  according to a well-designed strategy controlled by the secret key and the secret information. On the other hand, generation-oriented linguistic steganography (GenLS) does not require the natural text $$\mathbf {c}$$. Instead, it uses a language model which will be explained later to directly generate the stego text. In other words, for GenLS, the data embedding function in Eq. (2) should be rewritten as:

(4)

where $$\mathcal {M}$$ represents the language model. Accordingly, the data extraction for GenLS can be expressed as:

(5)

where $$\mathcal {M}$$ is optional. In both ModLS and GenLS, the data sender and the data recipient may need to share some information in advance, e.g., the mapping relationship between tokens and secret bits. Such kind of side information can be considered as part of the secret key. In GenLS, when the language model needs to be shared in advance, it is considered as part of the secret key as well.

2.2 General Framework of Linguistic Steganalysis

We model linguistic steganalysis as a binary classification problem, which judges whether a given text was embedded with additional data or not. Mainstream linguistic steganalysis algorithms can be described by the supervised learning paradigm. Linguistic steganalysis requires a training set containing cover texts and stego texts; it extracts discriminative features from these cover texts and stego texts; and it executes a machine learning algorithm for classification. By creating a decision-making function, arbitrary text can be judged as either cover or stego. In brief summary, linguistic steganalysis includes two stages, i.e., classifier training and classifier decision-making. The former uses cover texts and stego texts to construct a text classifier, whereas the latter uses the trained text classifier to determine the category (i.e., “cover” or “stego”) of any input text (with a variable length).

Figure 2 models linguistic steganalysis as a binary classification problem. Formally, let $$\mathbf {C}$$ and $$\mathbf {S}$$ represent a set of cover texts and a set of stego texts, respectively. Following Fig. 2, $$\mathbf {C}$$ and $$\mathbf {S}$$ will be processed by the feature extractor so that two sets of feature vectors, i.e., the cover feature set and the stego feature set, are collected. Let $${\mathbf {F}}_c$$ and $${\mathbf {F}}_s$$ represent the cover feature set (of $$\mathbf {C}$$) and the stego feature set (of $$\mathbf {S}$$), respectively. In the stage of classifier training, the steganalyzer should choose a good statistical classifier such as neural network, decision tree and support vector machine, which contains a certain number of parameters to be determined. $${\mathbf {F}}_c$$ and $${\mathbf {F}}_s$$ are exploited to “train (or say optimize)” the classifier in such a way that the parameters of the classifier can be determined after training. The well trained classifier will be able to make good inference on unknown texts in the classifier decision-making stage.

A framework of linguistic steganalysis that involves messages, embedding algorithms, stego texts, feature extractors, stego features, and classifier training leads to a decision D. A feature extractor and vector are used to classify the text, resulting in decision D for cover or stego.

Fig. 2

General framework for linguistic steganalysis

2.3 Language Model

A language model uses machine learning to conduct a probability distribution over sequences of tokens. It learns from textual data and has various applications such as language translation, sequence prediction, text classification and so on. Mathematically, given any sequence of tokens $$\mathbf {t} = \{t_1, t_2, \ldots , t_l\}$$, $$l &gt; 0$$, a language model aims at approximating a joint probability $$\text{Pr}\{t_1, t_2, \ldots , t_l\}$$ assigned to the entire sequence. The joint probability is expressed as a product of l conditional probabilities, i.e.,

(6)

The sum of the conditional probabilities of all tokens in V is equal to 1 at each position of text, as shown in Eq. (7), where the vocabulary contains all possible output words with the size of —V—.

(7)

One instinct method to determine the conditional probability is Maximum Likelihood Estimation (MLE), i.e.,

(8)

It counts the appearance times of both two sequences $$\{t_1, t_2, \ldots , t_{i-1}\}$$ and $$\{t_1, t_2, \ldots , t_i\}$$ in the training dataset and takes their ratio as the final result. However, the main disadvantage is that the number of parameters in this language model will be large, which is approximate to $$|V|{ }^i$$. Obviously, long sentences will lead to exponential explosion. N-gram language model is one of the most popular statistical language models. In order to reduce computational complexity, N-gram language model simplifies the equation with the Markov assumption, where N is the number of order in Markov assumption. In case the value of the denominator is zero, a smoothing method is introduced [8], i.e.,

(9)

With the development of deep learning, statistical model is replaced by recurrent neural network (RNN) [29]. The neural network can directly obtain the probability value by applying softmax to the output hidden vector instead of counting, and the Markov approximation calculation method is abandoned, which makes the results more accurate.

Transformer [44] is a great advancement in natural language processing (NLP) and has also promoted the development of language models. Transformer consists of an encoder and a decoder. Compared to RNN, Transformer lies in parallel computing, which significantly reduces the time of calculation. Transformer has such a strong ability to extract text features and predict tokens that researchers have found that encoder and decoder can be independently used as language model. At present, the mainstream language models all use the Transformer structure. After that, these language models have been trained with a large amount of natural text in advance, so that they are called pre-trained language models. The pre-trained models exploit the idea of transfer learning, i.e., the model has learned the fundamental knowledge of NLP during the pre-training process, and can perform well in downstream tasks after a small amount of fine-tuning training.

These pre-trained language models can be divided into three categories: auto-regressive language model, masked language model and Seq2Seq (sequence to sequence) language model. Auto-regressive language model [17, 36] uses the decoder of Transformer as structure. It is pre-trained with next token prediction strategy. This strategy constrains that when calculating the probability of each word, the model can only access the words positioned before this word, which is consistent with the aforementioned introduction in N-gram and RNN. However, different from auto-regressive model, masked language model [12, 19] on the basis of the encoder of Transformer access all the words in the text when prediction happens. One of the training strategy of masked language model is masked token prediction, which means some words are replaced by “[MASK]” in the entire text and the model is trained to recover the original words. Seq2Seq language model [20, 37] is built on integral Transformer structure. Encoder is fed with a corrupted version of the tokens, decoder is fed with natural version of the tokens. The corrupted disturbance includes masking, deletion, permutation and rotation.

All these three categories of pre-trained language model are very popular, and there are many representative models in each family. Although using different structures, the types of models are currently developing in the same direction, that is, larger models can perform better on various tasks.

2.4 Evaluation Metrics

Linguistic steganography can be evaluated from various aspects. The most important requirement for linguistic steganography is that the stego text should not arouse suspicion from the steganalyzer. It requires that the stego text should be seemingly natural. For example, when embedding secret data into a natural text, the statistical distribution of the text will be changed. Thus, perplexity (PPL) can be introduced to evaluate the distribution gap between the natural and stego texts. PPL is defined as the exponential average negative log-likelihood of a token sequence with a pre-trained language model. In other words, the text with a low PPL value means the probability of the text is high, which also means that the text is more fluent and more approximate to a natural text.

Apart from statistical regularity, there are also indicators that focus on semantic similarity. However, these metrics are only available for steganographic methods constrained by the original text. BLEU [33] is a metric to evaluate the similarity between the original and stego texts. It determines the coincidence frequency of N-gram words between natural and stego texts. The higher the score, the more overlapping parts of the two texts, and the closer the semantics. However, measuring semantic similarity by repetition rate is one-sided because different words may have the same meaning. BERTScore [70] evaluates semantic similarity with internal meaning instead of expression. It calculates the similarity between word vector transferred with BERT [12].

Embedding payload is a very important metric to measure the size of the secret data concealed within a text. It can be determined as the total number of secret bits that have been embedded in a text (i.e., bits per text), or the average number of secret bits embedded in a word (i.e., bits per word). Generally, it is desirable to embed as many message bits as possible in order to transmit enough information, which, however, may reduce the quality of the stego text since more information generally decline the quality of the text. Therefore, how to balance the embedding payload and the text quality is a critical problem in the research of linguistic steganography.

Yet another important metric for linguistic steganography is security, which is generally measured by the performance resisting linguistic steganalysis. As mentioned above, linguistic steganalysis judges whether the obtained text is natural or stego from the perspective of the monitoring party. Obviously, the judgment success rate should be close to 50% ideally, indicating that the monitoring party cannot correctly distinguish between two different texts, and thus the result is closer to the success rate of random guessing. Linguistic steganalysis can be performed under different assumptions. Generally speaking, for linguistic steganography, researchers will assume that the third party can obtain sufficient natural and stego texts with correct labels to train their discriminator. This assumption is extremely unfavorable for linguistic steganography. Under this assumption, if the stego text is still not easy to be detected, the security of steganographic method is deemed convincing.

In order to implement real-time covert communication, keeping the time complexity as small as possible is very important for linguistic steganography. Meanwhile, it is also necessary that the size of side information is small.

For linguistic steganalysis, its goal is to identify natural texts and stego ones reliably and efficiently, which can be quantified by accuracy, missed detection rate and false detection rate.

3 Linguistic Steganography

The introduction structure of linguistic steganography is presented in Fig. 3. Linguistic steganography methods are mainly categorized into modification-oriented and generation-oriented linguistic steganography. The modification-oriented methods embed the secret bits by making slight changes to a given natural text, while the generation-oriented methods directly generate a new text with secret information and get rid of the limitation of original text. Modification-oriented method can be further divided into two categories according to the modified object. The overall process of generation-oriented linguistic steganography has two parts: generation model and steganographic coding. Nowadays, more researchers have exploited conditional generation model to make the stego text more natural. It is noted that the content-based modification-oriented linguistic steganography is related to semantic conditional generation-oriented linguistic steganography since their joint target is to control the semantic meaning of stego text.

A framework for linguistic steganography has two approaches, modification and generation oriented. Modification is divided into format and content based methods, which are further divided into 3 and 2 subtypes, respectively. Generation-oriented is divided into generation models and steganographic coding, both with two subtypes.

Fig. 3

The introduction structure of linguistic steganography

3.1 Modification-Oriented Linguistic Steganography (ModLS)

ModLS is currently the most common and well-studied strategy for linguistic steganography. It embeds additional information into a text by modification and replacement. The intention of ModLS is that the resulting stego text can be considered similar to the original text since the modification operations only make slight changes to the original natural text. ModLS methods can be roughly categorized into content-based and format-based methods. Content-based methods embed secret information by changing the text content, while format-based methods embed secret information by changing the text format.

Content-Based ModLS

Since the content with the same meaning can be represented in different ways, changing the expression in a proper way will not harm the internal meaning when embedding secret information. Winstein [49] embedded secret bits by synonym substitution (or say synonym replacement) as shown in Fig. 4. Given the cover text “Midshire is a wonderful little city”, assuming that the sender wants to deliver the secret information “101”, the stego text could be “Midshire is a nice little town” according to the substitution rules. Although additional data can be successfully embedded by applying synonym substitution, partial substitution does not guarantee the fluency of the entire sentence. Thus, a supplement material will be used as to verify whether the substitution can fit into context. To this purpose, Bolshakov et al. [3] used the semantic compatibility of relative synonyms and their collocation words in the context to judge whether the substitution is appropriate to making predictions. Chang et al. [7] used N-gram models to make sure the replaced word fit to the N words around it. In addition, there are methods attempting to change the entire expression of the sentence to eliminate the abruptness caused by partial substitutions. Topkara et al. [42] transferred the entire text between “activization” and “passivization” transformation to hide information so that the active text can represent bit “0”, while the passive one can represent “1”. Chang et al. [6] proposed a text data hiding method using word permutation, which alters a text by changing the word order, and then builds the mapping relationship between the resulting text and the secret bit string.

A tabular example of how cover text is converted to Stego text. Midshire is a wonderful little city, which leads to Midshire is a nice little town using Secret bits 10, 1. The first table lower highlights bitstream 10 and word nice, and the other table has bitstream 1 and town highlighted.

Fig. 4

Example of modification-oriented linguistic steganography based on synonym substitution

Another view about ModLS is that there is no need to maintain the semantic meaning of the original text. For example, although the sentence “the food is bad” has the opposite meaning to the sentence “the food is good”, both sentences are seemly natural and hard to be detected. Along this direction, Ueoka et al. [43] used BERT to replace words in the cover text and embed additional data. And Zheng et al. [72] proposed an autoregressive steganographic algorithm based on BERT and consistent coding.

Format-Based ModLS

Format-based modification-oriented linguistic steganography methods embed additional data by altering the physical properties of text, e.g., the size of words and the space between words. Format-based methods do not alter the expression of the original text, which is hardly to be detected by human perception system. These methods can be roughly categorized into text spacing based, character feature based, and fixed file format based methods.

Text Spacing Based ModLS

The text spacing based steganographic methods embed the secret information by fine-tuning the entire line spacing and character spacing in the text document. For example, in 1995, Brassil et al. [4] proposed line-shift coding (LSC) and word-shift coding (WSC). LSC is a method about embedding secret information by moving the text up or down in the document. If the line spacing is altered, the secret bit “1” is embedded. Otherwise, if the line spacing is unchanged, the secret bit “0” is embedded. Similarly, WSC modifies the text by shifting the position of the characters in one line to the left or right. Two intuitive examples are given in Fig. 5.

2 intuitive examples of modification oriented linguistic steganography using L S C and W S C labeled a and b. In A, information is altered by moving the text up or down and embedding the secret bit 1. In B, the text modifies the text by shifting the position of the characters in one line to the left or right and embedding secret bit 1.

Fig. 5

Example of modification-oriented linguistic steganography using line and word shifting

Character Feature Based ModLS

The character feature based steganography methods mainly modify the character feature forms, e.g., font, font size and color. Bhaya et al. [2] introduced a steganographic method focusing on font type in Microsoft word documents. The method replaces the original font with a similar font according to the similarity theory of English font types. Text steganography is realized by embedding the coded secret information into the uppercase letters in a similar font. Mahato et al. [28] introduced an algorithm that adjusts the font size of the invisible character space. This method exploited the difference between normal font size and invisible space character to embed additional data. Because there are lots of spaces in English text, the normal spaces will overshadow hand-crafted invisible characters so that the method is hard to make the monitoring party feel the difference visually between stego and cover texts. The researchers found that the human visual system are less sensitive to the blue color. Tang et al. [40] took advantage of this feature and proposed an RGB-based linguistic steganography, which realized information hiding by modifying the lowest bit values of the three RGB channels of characters and underlines.

Fixed File Format Based ModLS

The fixed file format based steganography methods exploit special functions in various documents such as Word to embed additional data. Based on the degradation function in Microsoft Word, Liu et al. [25] introduced an algorithm for embedding data in Word documents through a change tracking technology. The process of data embedding is designed in such a way that the steganographic document appears to be the product of a joint collaboration between authors A and $$A^{\prime }$$. Figure 6 demonstrates the cooperation scene constructed by the sender. The sender embeds the secret information in the degeneration and revision. However, the sender plays the roles of both A and $$A^{\prime }$$. Liu et al. [26] can effectively generate steganographic text in the note page of the powerpoint (PPT) document. The generated text is closely related to the semantic and writing style in the body text. For Portable Document Format (PDF) documents, Zhong et al. [74] exploited the invisible feature of the end-of-line marker of a cross-reference table. There are two end-of-line identifiers: “∖n” or “∖r∖n”. It is available to embed additional data by modifying the end-of-line marker of the cross-reference table according to the secret information. For example, “∖n” represents the secret bit “0”, while “∖r ∖n” represents the secret bit “1”.

A process flow demonstrates modification oriented linguistic steganography. The sender embeds the secret information in D using degeneration, D dash, and revision to produce S that the receiver can access and a document M that, once again, uses D to produce D dash. However, the sender plays the role of both A and A dash and can effectively generate steganographic text.

Fig. 6

Example of modification-oriented linguistic steganography using word file format

To sum up, ModLS methods make slight modification on the given natural text to ensure the quality of stego text when embedding secret information. Although the stego text seems to be similar to cover, modification will always lead to a decline in the quality of the text, and if the detection party carefully screens it, abnormalities can still be found. Besides, statistical and machine detection are subtle to these modifications on content and format. And the embedding payload of modification-oriented linguistic steganography is small so that the sender has to deliver more stego texts to embed all the secret information, which makes the covert communication easier to detect.

3.2 Generation-Oriented Linguistic Steganography (GenLS)

GenLS is introduced to suppress the disadvantages of ModLS. GenLS methods exploit pre-trained language models to directly produce a new text without the constraint of given cover. The language models can produce high-quality texts so that there is no need to make modifications based on natural text. The generated stego texts are semantic uncontrollable unlike the ones conducted by modification-oriented methods. However, attributed to the powerful language models, the generated stego texts are fluent and seemingly natural. Because GenLS methods get rid of the limitation on substitution rules, the secret information can be embedded to any words and tokens so that the payload is much larger than the one in ModLS methods.

The core part of GenLS methods is data embedding, which involves two important steps, i.e., text generation and information encoding. The former mainly relies on various text generation techniques and language models applied in natural language processing, whereas the latter involves a variety of well-designed information coding techniques whose goal is to construct the equivalence relationship between tokens and secret bits. After performing data embedding, the resulting stego text will be conveyed to the data recipient, who can extract the hidden data according to the key and necessary side information.

Generation Model

GenLS has a close relationship with text generation. There are typically three strategies of text generation for GenLS, i.e., template based text generation, Markov model based text generation and neural network model based text generation. GenLS mainly takes the advantage of the development of language model, to adjust the normal text generation process with steganographic coding (i.e., information encoding).

At the early stage of GenLS, the researchers generated the stego text with a generation template. The template is constructed according to the general characteristics of datasets, such as sentence structure, text style and text character statistics. Following the guide of template, a grammatical text can be generated. There are several candidate words in each position of the template. These candidates are encoded by a specific information coding algorithm which should be shared between both sides of the covert communication. Then, the sender selects one of the candidates in a position according to the secret bit string at one generation step. After filling all the positions in the template, the generation of stego text is finished. The data recipient can obtain the complete secret by concatenating all the bit string scattered throughout the text.

Wayner [45] proposed a mimic function based on context-free grammar, which learns the statistical distribution of each character in the training set, and then constructs a Huffman tree to encode multiple candidate items at each time step. This method follows the rule of character statistics, but the performance in semantic quality and grammatical structure is not good. Liu et al. [27] proposed a method that can generate poetry according to so-called Ci-Pai. The generated text follows the template of Song Poetry. At each time step, according to the prosody constrained by the template and the secret information, an appropriate word will be selected. The stego text suits the structure of Song Poetry well. However, the generated texts by stable template are similar to each other and easy to be recognized. Therefore, researchers have changed their thinking, instead of setting complex templates to guide text generation, that is, they use statistical language models to generate stego texts with various styles.

According to Eq. (6), a statistical language model can predict the probability distribution of the entire vocabulary at i-th position in the text with the access to previous i-1 words which have been generated. The overall process mainly includes two steps: The first step is to build up a transition graph. The node is a state, while the weight of the edge is the probability of corresponding transition. Shniperov et al. [38] introduced an algorithm using statistical language model with the interval partition coding algorithm, which builds the mapping relationship between transition state and bit stream. However, because of the limitations of statistical language model, the fluency of generated text remains a problem.

Recently, benefiting from deep learning and NLP technology, neural network models are widely used for linguistic steganography to replace statistical models. The general framework of deep learning based generation-oriented linguistic steganography is presented in Fig. 7. The entire stego text is generated by a word-wise way. At each generation step, the sender selects a unique word according to the secret information, probability distribution and coding algorithm. The deep model with massive parameters can retain more explicit and implicit, local and global text features in the process of generating stego text after being trained on a large-scale and high-quality corpus. This greatly reduces the difficulty of generating seemingly natural stego text and probability to arouse suspicion.

A framework of the complete Stego text is generated word by word. The sender chooses a unique word at each generation step based on the secret information, probability distribution, and coding method. The language model neural networks produce word predictions to which the secret data is added, leading to outputs y 1, y 2, and so on.

Fig. 7

The general framework of generation-oriented linguistic steganography

The researchers introduced RNN and its variants into linguistic steganography. Fang et al. [13] used block coding on the basis of long short-term memory network (LSTM) [15], which assigns all words in the vocabulary V into several blocks, and each block is mapped to a binary string. Thus, the words in the same block are mapped to the same bit string. The receiver only needs to look up the mapping about each word in the stego text and concatenates the pieces of secret information embedded in each word. Yang et al. [60] implemented fixed-length coding (FLC) and variable-length coding (VLC) on RNN. Different from block coding, FLC and VLC build a new mapping relationship adaptive to each generation time step. Due to the dynamic mapping relationship, the data recipient needs to obtain the same language model and simulate the generation process. The data recipient needs to determine the conditional probability in each time step so that the method consumes more time to extract the secret information, but the text quality is more satisfactory.

With the development of language model, Transformer structure improves the quality of stego text to a further step. Auto-regressive model and masked language model are both popular in generation-oriented linguistic steganography. Ziegler et al. [76] used GPT-2 [36] as language generation model to implement linguistic steganography. The improvement of language model leads the improvement of text quality. Yi et al. [68] proposed a location-driven generative steganography algorithm named Alisa based on BERT [12] and Gibbs sampling [14]. As shown in Fig. 8, different from aforementioned linguistic steganographic methods, Alisa embeds the secret information in a word-level instead of binary string. It splits the secret information into words and assigns the words to the specified positions in the entire text and then generates other words on the positions which do not carry information. In this method, the embedding positions must be shared in advance so that the decoder can easily collect all the words constituting secret information.

An example of location driven generative steganography is Midshire dash dash dash dash city dash, which with text generation produces Stego text, Midshire is a wonderful little city, and data extraction yields secret information, Midshire city.

Fig. 8

Example of location-driven generative steganography

Statistical Conditional GenLS

Although the stego text is fluent and looks similar to a natural text, it is hard to escape from steganalysis. Thus, many researchers tried to narrow the gap between the stego and natural text. Different from aforementioned generation-oriented methods, the following methods train a steganographic system instead of embedding secret information on a well-trained language model. Zhou et al. [75] exploited the structure of generative adversarial network (GAN) [31]. The discriminator in GAN serves as a steganalysis system. The training purpose is to make the text generator able to cheat the discriminator so that the method performs well on end-to-end steganalysis. Yang et al. [65] exploited the variational auto-encoder (VAE) [18] structure to narrow the statistical gap between the stego and natural texts. The encoder is trained to learn the overall statistical distribution characteristics on a large number of natural texts, while the decoder is to generate the text that conforms to the statistical characteristics so that VAE enhances the difficulty on detection.

Semantic Conditional GenLS

Because of lacking the constraint of a given cover, GenLS suffers the problem of semantic inconsistency, which limits the application scenario. For example, the sender might want to implement steganography in chat scenario. The steganographic reply must integrate into the dialogue history so that there should be some semantic restricts on the generated text. Kang et al. [16] introduced a method using keyword to control the semantic information of the generated text. Cao et al. [5] exploited plug and play language model (PPLM) [11] to set a topic condition. Yang et al. [66] presented a semantic-preserving framework for generation-oriented linguistic steganography by exploiting paraphrasing technology. The framework translates the English cover into German and then pivots the German text back to English. The data hiding process is deployed in the secret translation stage with a well-designed information encoding technique. The method integrates the advantage of semantic consistency in modification-oriented method and the advantage of large embedding payload in generation-oriented method.

Steganographic Coding

Except for various generation models and structures, advanced coding algorithms are used to improve the stego-text quality. As mentioned above, block coding constructs static mapping relationship, which does not take the generation process into consideration. However, the probability distribution in each generation step is different so that a dynamic mapping construction is needed. RNN-Stega [60] proposed FLC which builds the candidate pool with the size of $$2^b$$, $$b&gt;0$$, including the words with the top $$2^b$$ probabilities. And then a perfect binary tree is constructed based on the candidate pool. Each word in the pool is mapped to a binary bit string with the length of $$l &gt; 0$$. Although the top $$2^b$$ words can be considered as good quality, there are still quality differences between them, i.e., the word with a higher probability represents better quality. However, a perfect binary tree does not take this feature into consideration. After that, there are various coding algorithms designed to solve the problem. The core attempt is to make the words with a higher probability more likely to be chosen as the final output such as Huffman and arithmetic coding. For example, Fig. 9 demonstrates Huffman coding for linguistic steganography. At each generation step, the words whose probabilities are larger than a threshold form the candidate pool are determined and further processed with Huffman coding so that the words with higher probabilities are mapped to shorter bit steams, which makes those suitable words more likely to be selected as the final output.

An example demonstrates Huffman coding for linguistic steganography. During each generation step, words with higher probabilities from the candidate pool are processed using Huffman coding, mapping them to shorter bit streams, increasing the likelihood of selecting suitable words as the final output.

Fig. 9

Example of Huffman coding deployed in the word prediction module in Fig. 7

4 Linguistic Steganalysis

The introduction structure of linguistic steganalysis is presented in Fig. 10. It mainly includes two steps that are manual feature extraction and automatic feature extraction. Early research focuses on manual feature extraction which is typically called conventional linguistic steganalysis, whereas the present research focuses on automatic feature extraction which can be called end-to-end linguistic steganalysis. The former can be categorized into targeted steganalysis and blind steganalysis. The latter can be analyzed according to model structures.

A process flow for linguistic steganalysis mainly includes two steps, manual and automatic feature extraction. Manual feature extractions start with synonym frequency and end with the font attribute. Automatic feature extraction starts with convolutional neural networks and ends with a language model.

Fig. 10

The introduction structure of linguistic steganalysis

4.1 Conventional Linguistic Steganalysis

Conventional linguistic steganalysis aims to use machine learning approaches to detect statistical differences caused by steganography. Researchers manually design the text features and judge whether a given text belongs to stego or natural text through statistical analysis. According to the assumptions, conventional linguistic steganalysis contains two categories, i.e., targeted steganalysis and blind steganalysis.

Targeted steganalysis assumes that the detection part obtains the knowledge about the steganographic method used to generate the stego text. Targeted steganalysis models text with well-designed features and conducts the classification procedure according to the crafted features. As a result, the targeted linguistic steganalysis may be only effective to the specific steganographic method. When to apply the targeted steganalysis method to other steganographic methods, the detection accuracy will drop dramatically. Targeted steganalysis uses statistical strategies to detect the presence of embedded data. Common statistical features in targeted steganalysis methods include neighbor difference, initial word distribution, font attribute, and synonym frequency.

Neighbor Difference Based Steganalysis

Li et al. [22] conducted a steganalysis method by analyzing the feature of distance difference between two adjacent words. The method classifies PDF text documents into two cases: the “minor-change” class and the “notable-change” class to distinguish the natural and stego text. The method serves as a reliable detection method targeted to word-shift embedding algorithm.

Initial Word Distribution Based Steganalysis

Sui et al. [39] introduced an algorithm based on the semantic feature of text. The method captures the distribution difference of first letters (characters) of sentences between the natural and stego texts, as shown in Fig. 11. For context-free text, words will appear randomly and are unrelated to each other so that the probability of a word occurring in each segment of the text depends only on one segment. However, in natural text, a piece of text can be regarded as a N-gram Markov chain and the words are closely related to each other. This method embodies the semantic coherence difference between texts through the feature of initial words.

A scatterplot charts the difference between cover or natural texts and Stego texts with percentages versus alphabets E through Y. The natural text fluctuation trend is sharper and saw toothed, whereas Stego texts have a bit shorter and broader peaks.

Fig. 11

Statistical difference between characters in stego and cover/natural texts

Font Attribute Based Steganalysis

Xiang et al. [53] introduced a detection strategy based on the distance between adjacent characters with support vector machine (SVM). The detection method has two modules. The first module is to extract the distance feature and the second one is to train the SVM classifier according to the obtained feature. This method not only effectively detects the presence of hidden data embedded with format-based ModLS, but also estimates the length of the embedded data.

Synonym Frequency Based Steganalysis

Taskiran et al. [41] introduced a linguistic steganalysis algorithm targeted to synonym substitution based ModLS. In this algorithm, feature vectors are extracted from a 3-gram language model, and SVM is used to separate stego texts from natural ones. Xiang et al. [54] found that the number of high-frequency words decreased and the number of low-frequency words increased in the text carried out with synonym substitution based ModLS. The feature vector is therefore constructed according to the synonym positions and the frequencies of words in different synonym sets for realizing efficient steganalysis.

Different from targeted linguistic steganalysis, blind linguistic steganalysis requires that the detection part has no prior knowledge to the steganographic algorithm. This assumption is much closer to real-world linguistic steganalysis. Common features are used in blind linguistic steganalysis such as the fluency and distribution of words. For example, Meng et al. [30] introduced a detection method using statistical language model, which uses PPL metric to identify stego texts. Experiments indicate that the classification accuracy is satisfactory with sufficient training data. Chen et al. [73] presented a statistical algorithm of blind linguistic steganalysis based on word distribution applicable to different steganographic methods. The algorithm uses the word distribution as a feature vector for classification, and uses SVM as a classifier. Zhao et al. [71] used an information-entropy-like statistical variable of words and its variance as two features to improve the detection accuracy. Chen et al. [10] proposed a steganalysis algorithm that detects the secret information according to a natural frequency dictionary, which was determined from a large corpus.

4.2 End-to-End Linguistic Steganalysis

Conventional linguistic steganalysis methods require researchers to manually design various heuristic features that could reveal the traces of linguistic steganography. On the one hand, such kind of linguistic steganalysis requires researchers to carefully design the corresponding features and the detection accuracy mainly depends on the empirical knowledge of the researchers. On the other hand, with the development of linguistic steganography, advanced steganographic methods are likely to not introduce obvious statistical difference in the stego text so that these steganographic methods tend to be hardly detected. Therefore, novel steganalysis methods are urgently to be explored.

End-to-end linguistic steganalysis is introduced to capture more efficient features identifying steganographic evidence. Generally, end-to-end linguistic steganalysis does not require manually crafted features. It constructs discriminative features through deep learning implemented with neural networks. Because of the black-box characteristics of neural networks, it is still hard to interpret the realistic meaning of the intermediate features extracted by neural networks. Nevertheless, since there is no need to manually craft the features, it is convenient to deploy end-to-end linguistic steganalysis in practice regardless of their detection performance.

End-to-end linguistic steganalysis follows the framework presented in Fig. 2. The feature extractor and the classifier are fused together. It is believed that extracting richer features is quite desirable for linguistic steganalysis. According to the design concept, end-to-end linguistic steganalysis can be analyzed from two aspects, i.e., model focused steganalysis and feature focused steganalysis.

Model Focused Linguistic Steganalysis

Consistent with the development of language models, early research on end-to-end linguistic steganalysis uses simple models to detect stego texts, yet recent research tends to use advanced models. Yang et al. [61] introduced a linguistic steganalysis algorithm using semantic analysis, which was developed to use deep convolutional neural network (deep CNN) to extract semantic features from texts and then construct high-dimensional feature vectors. Efficient and accurate detection is achieved by analyzing the statistical differences of natural texts and stego texts in the semantic space. Wen et al. [46] introduced a word embedding layer to get word vectors to extract word-level semantic and syntactic features. After word embedding, the method uses various one-dimensional convolutional kernels to extract grammatical features. The feature vector will be obtained by concatenating all the outputs of one-dimensional convolution. Xiang et al. [55] introduced a linguistic steganalysis algorithm using cascaded CNN with two stages, which is effective for steganographic methods based on synonym substitution. Each stage consists of multiple convolutional layers. The first stage is a sentence-level CNN that provides a representation of the sentence and therefore can be used to predict whether the sentence is unmodified or not. In the second stage, the text-level CNN is applied based on the output representation of first stage. Yang et al. [63] analyzed the various associations between words in the text, and proposed a linguistic steganalysis method based on CNN with window sliding technique, which uses convolutional sliding windows of various sizes to obtain statistical features of the text. To capture the relational features better, Yang et al. [62] introduced LSTM to extract features. Li et al. [21] implemented a linguistic steganalysis algorithm using capsule networks, which replaces neurons with capsules. Experiments indicate that the algorithm can extract and preserve richer semantic features of text in order to achieve efficient steganalysis.

The aforementioned steganalysis methods are actually focused on applying advanced neural network models to linguistic steganalysis. Recently, Yi et al. [69] pointed that there is difference between stego and cover texts from the viewpoint of conditional probability distribution over individual words, which is shown in Fig. 12. Such difference can be obtained by the pre-trained language model used to generate the stego texts. Motivated by this insight, Yi et al. introduced two methods for linguistic steganalysis. Both methods follow the framework given in Fig. 13. In detail, the authors used RNN as the language model. They first pre-trained the RNN model only with cover texts and then fine-tuned the model with cover and stego texts so that the final model possesses the ability to distinguish between cover and stego texts. Experiments indicated that this strategy can achieve the best detection performance among various methods.

A scatterplot compares the positional perplexity of stego and cover texts to word position. The trends for stego 1, 2, and 3 bit words are all comparable and slightly negative, while the trend for cover 0 bit words is a sawtoothed fluctuation.

Fig. 12

Position-wise perplexity for cover and stego texts. The results provided in this figure are average values. And, “3 bits per word” means 3 bits were embedded into each word averagely, “0 bits per word” means nothing was embedded

A framework for linguistic steganalysis includes an R N N based classifier and cover texts, which lead to pre training, which leads to fine tuning where stego texts are added to obtain the final model.

Fig. 13

RNN (as language model) based pre-training strategy for linguistic steganalysis

Feature Focused Linguistic Steganalysis

Natural texts have complex syntactic structure, rich dependency and word co-occurrence information. Besides, the relevance between words is global, but rather limited to adjacent words. Therefore, simply using advanced models may not well capture the steganographic evidence. It is necessary to make full use of various features such as syntactic structure, global features and context information for efficient steganalysis.

Along this line, Niu et al. [32] introduced a linguistic steganalysis algorithm using bidirectional-LSTM network (Bi-LSTM) and asymmetric convolution kernel. They used Bi-LSTM to find long-term semantic information of the text, and exploited asymmetric convolution kernel of different sizes to extract local relationships between words. Bao et al. [1] integrated the attention mechanism into the LSTM-CNN model and focused on the feature on the greatest difference between cover and stego texts while obtaining the local and global features. Wu et al. [52] creatively introduced a detection algorithm using graph neural network (GNN) to solve the problems of simple semantic modeling and insufficient global information utilization in existing works. In this method, as shown in Fig. 14, the text is modeled as a graph, so that the dependency and co-occurrence information between long-distance words can be clearly modeled. At the same time, GNN is used to learn the local sensitive semantic and the global correlation. Li et al. [23] introduced a linguistic steganalysis method with two stages. In the first stage, Bi-LSTM is used to obtain the feature information of all words in the sentences for high-dimensional sentence vector. In the second stage, multiple sentence vectors are input into GNN to extract the abnormal features between sentences. Zou et al. [77] used BERT and Bi-LSTM to extract the context relevance of words and context information. The attention mechanism is also used to extract the hidden relationship between words.

A schematic representation incorporates an integrated attention mechanism for model training and testing, where the input is a word vector matrix and a globally shared weight matrix that runs through to G N N, and the output is shared after training.

Fig. 14

Exploiting graph neural network (GNN) for linguistic steganalysis

Similarly, Yang et al. [64] proposed a steganalysis method named SeSy to combine semantic and syntactic features. The method consists of a semantic extraction module, a syntax retention module and a feature discriminator. The semantic extraction module is composed of a language model with Transformer architecture, which is used to capture complex semantic features. The syntax retention module uses graph attention network (GAT) to retain syntactic features. Cascade and paralleling strategies are used to fuse the extracted features, and the discriminator makes the final judgement according to the features. Peng et al. [34] reported a real-time detection algorithm using multi-stage transfer learning, which is divided into three stages: modeling differences, extracting knowledge and merging features. In the first stage, BERT is used to model the difference between the stego and cover texts. In the second stage, BERT serves as a teacher model, and task-specific semantic features are extracted into two tiny neural networks. In the third stage, two tiny neural networks will fuse local and global semantic features. Li et al. [24] proposed an algorithm using explicit and latent word relation mining. The words are converted into a real number vector using the distributed readin module. Then the explicit and latent word relation is mined through attention mechanism. In the end, the global adaptive classification module is implemented on the mined relation features. Wen et al. [48] presented a detection algorithm using Bi-LSTM equipped with scaled dot-product attention mechanism and short-cut dense convolutional neural network (SDCNN), so as to fuse multi-granularity of features. In this algorithm, Bi-LSTM is adopted to extract the long-term dependency representations of the sentence and SDCNN is used to extract the local semantic features. The final joint feature is obtained by concatenating these two types of feature.

Other Linguistic Steganalysis

There are two limitations for end-to-end linguistic steganalysis. First, most linguistic steganalysis methods assume that the detection part has the access to the steganographic method implemented in covert communication, and they rely on a lot of labeled data. However, it is hard to collect enough labeled data pairs for training in real-time steganalysis. Insufficient labeled samples will lead to a significant decline of detection performance. Besides, the detection part even can not know what steganographic method is used in practical application. Second, the architecture of linguistic steganalysis network has become more and more complex, resulting in a sharp increase in reasoning time and computing cost, which is unsuitable for real-time steganalysis.

In response to the above limitations, researchers have also launched relevant studies. For example, Wen et al. [47] exploited meta-learning for detecting stego texts in few-shot scenario. The method uses BERT as a general feature extractor to obtain the feature representation of various tasks. And the attentional Bi-LSTM is used as a meta-learner to extract task-specific features. Two feature extractors continuously obtain the features of sentences from the support set, and feed the features to the linear classifier for prediction. In this work, the features of the support set are constantly used to update the classifier parameters. The query set is used to update the meta-learner parameters according to the feedback from the classifier. With the technique of meta-learning, this method only needs a small number of labeled samples to achieve high detection accuracy. Xue et al. [59] drew on the idea of domain adaptation and transductive learning to design a steganalysis method based on multi-domain adaptation (MDA), which extracts the domain invariant features of each source-target domain pair on the training set and test set, and trains the classifier individually. The domain invariant representation can be obtained by adaptively minimizing the distribution difference between the source and the target domain, so as to realize the universal detection model. Xu et al. [57] designed a feature interaction module to explore the interaction between local and global semantic features, which enables the method to perform well on different language styles and payloads of stego texts. Xue et al. [58] proposed a linguistic steganalysis framework using hierarchical mutual learning. In the framework, various networks are co-trained to learn different text features, which enables the method to achieve high detection accuracy under the condition of low reasoning time-consuming and small model size.

5 Challenges and Opportunities

The existing research results have made great contribution to the development of linguistic steganography and steganalysis. However, there are some challenges and opportunities during the study of linguistic steganography and steganalysis, which could be summarized as follows:

ModLS hides secret information into a given text by altering the text without changing the meaning of the text, whereas GenLS directly produces a stego text by applying a well-trained language model. A disadvantage of ModLS is that the maximum embeddable payload is limited even though the semantic information of the stego text can be well preserved. In contrast, GenLS allows us to embed a payload with a significantly larger size, which, however, cannot well control the semantic information of the stego text. How to achieve a larger payload while well controlling the semantics has become a critical problem in linguistic steganography. Although Yang et al. [66] have provided an interesting solution to achieve the above goal, the research is in its infancy and needs further improvement.

Towards linguistic steganography and steganalysis in real-world scenarios is another direction to be explored. The current research gives a lot of freedom to the steganographer, that is, the steganographer is free to generate the stego text, which, however, may not adapt to social environment because the semantic information of the stego text should strictly match the social topic to avoid suspicion from the steganalyzer. For example, when to realize linguistic steganography in multi-user dialogue system, the stego text should match the context. Otherwise, stego texts not relevant to the social topic can easily arouse suspicion from the steganalyzer. On the other hand, for linguistic steganalysis, the existing research assumes that the detection part has the ability to collect sufficient cover-stego text pairs to train a model to classify cover and stego texts, which is not applicable to real-world scenarios because the detection part may not have prior knowledge about the steganographic technique. Therefore, how to adapt to real-world steganalysis scenarios needs further study.

With the development of natural language processing, both linguistic steganography and steganalysis tend to rely on complex pre-trained language models. GenLS is the mainstream category of linguistic steganography. Language models with large number of parameters have been widely used as the text generation model in advanced GenLS methods. Generally speaking, the amount of parameters is proportional to the quality of stego texts. For linguistic steganalysis, large pre-trained models fine-tuned with local dataset(s) show superior detection results when compared to simple models. However, larger models benefit all problems in NLP, not uniquely to steganography and steganalysis, which should not be the only one core technology of steganography and steganalysis. Getting rid of the impact of parameter size on performance and focusing on more efficient information encoding algorithms and model structures are more valuable issues, which are still difficulties in related researches.

6 Conclusion

With the rapid development of Internet and multimedia technology, social media has become an integral part of human life. As the most commonly used information carriers in social media, text has been widely used among social users. There have been a lot of research focusing on text-oriented tasks (or say natural language processing), which will enjoy more prosperous development. At the same time, security is one of the long-standing topics of concern. Linguistic steganography and steganalysis, as the intersection of the two hot spots, will receive more attention in the future. However, unlike other media signals such as image and video that contain sufficient space for accommodating additional information, text is highly coded and therefore realizing secure linguistic steganography is a difficult task. It is necessary to develop novel strategies to improve the steganographic security. On the other hand, the majority of existing linguistic steganalysis methods are still limited to the laboratory environment. It is urgently needed to develop novel linguistic steganalysis methods to adapt to real-world scenarios. Overall, linguistic steganography and steganalysis are a pair of confrontational research topics, and the development of either one will always lead to the progress of the other. This chapter gives a brief survey on recent advances on linguistic steganography and steganalysis. We hope it could be instructive to the readers for the research on linguistic steganography and steganalysis.

Acknowledgements

This work was partly supported by CCF-Tencent Open Fund.

References

1.

Bao, Y., Yang, H., Yang, Z., Liu, S., Huang, Y.: Text steganalysis with attentional LSTM-CNN. In: 2020 5th International Conference on Computer and Communication Systems (ICCCS), pp. 138–142. IEEE (2020)

2.

Bhaya, W., Rahma, A.M.S., Al-Nasrawi, D.: Text steganography based on font type in ms-word documents. J. Comput. Sci. 9(7), 898–904 (2013)Crossref

3.

Bolshakov, I.A.: A method of linguistic steganography based on collocationally-verified synonymy. In: Information Hiding: 6th International Workshop, vol. 3200, pp. 180–191. Springer (2004)

4.

Brassil, J.T., Low, S., Maxemchuk, N.F., O’Gorman, L.: Electronic marking and identification techniques to discourage document copying. IEEE J. Sel. Areas Commun. 13(8), 1495–1504 (1995)Crossref

5.

Cao, Y., Zhou, Z., Chakraborty, C., Wang, M., Wu, Q.J., Sun, X., Yu, K.: Generative steganography based on long readable text generation. IEEE Trans. Comput. Soc. Syst. (2022)

6.

Chang, C.Y., Clark, S.: The secret’s in the word order: text-to-text generation for linguistic steganography. In: 24th International Conference on Computational Linguistics, Proceedings of the Conference: Technical Papers, pp. 511–528. Indian Institute of Technology Bombay (2012)

7.

Chang, C.Y., Clark, S.: Practical linguistic steganography using contextual synonym substitution and a novel vertex coding method. Computat. Linguist. 40(2), 403–448 (2014)Crossref

8.

Chen, S.F., Goodman, J.: An empirical study of smoothing techniques for language modeling. Comput. Speech Lang. 13(4), 359–394 (1999)Crossref

9.

Chen, Y., Wang, H., Wu, H., Wu, Z., Li, T., Malik, A.: Adaptive video data hiding through cost assignment and stcs. IEEE Trans. Dependable Secure Comput. 18(3), 1320–1335 (2019)

10.

Chen, Z., Huang, L., Meng, P., Yang, W., Miao, H.: Blind linguistic steganalysis against translation based steganography. In: Digital Watermarking: 9th International Workshop, vol. 6526, pp. 251–265. Springer (2010)

11.

Dathathri, S., Madotto, A., Lan, J., Hung, J., Frank, E., Molino, P., Yosinski, J., Liu, R.: Plug and play language models: a simple approach to controlled text generation. In: International Conference on Learning Representations (2019)

12.

Devlin, J., Chang, M.W., Lee, K., Toutanova, K.: BERT: Pre-training of deep bidirectional transformers for language understanding. In: Proceedings of NAACL-HLT, pp. 4171–4186 (2019)

13.

Fang, T., Jaggi, M., Argyraki, K.: Generating steganographic text with LSTMs. In: Proceedings of the 55th Annual Meeting of the Association for Computational Linguistics - Student Research Workshop, pp. 100–106 (2017)

14.

Gelfand, A.E.: Gibbs sampling. J. Am. Stat. Assoc. 95(452), 1300–1304 (2000)MathSciNetCrossref

15.

Hochreiter, S., Schmidhuber, J.: Long short-term memory. Neural Comput. 9(8), 1735–1780 (1997)Crossref

16.

Kang, H., Wu, H., Zhang, X.: Generative text steganography based on LSTM network and attention mechanism with keywords. Electron. Imaging 2020(4), 291–1 (2020)

17.

Keskar, N.S., McCann, B., Varshney, L.R., Xiong, C., Socher, R.: Ctrl: A conditional transformer language model for controllable generation. Preprint (2019). arXiv:1909.05858

18.

Kingma, D.P., Welling, M.: Auto-encoding variational bayes. Preprint (2013). arXiv:1312.6114

19.

Lan, Z., Chen, M., Goodman, S., Gimpel, K., Sharma, P., Soricut, R.: ALBERT: a lite BERT for self-supervised learning of language representations. In: International Conference on Learning Representations (2020)

20.

Lewis, M., Liu, Y., Goyal, N., Ghazvininejad, M., Mohamed, A., Levy, O., Stoyanov, V., Zettlemoyer, L.: BART: denoising sequence-to-sequence pre-training for natural language generation, translation, and comprehension. In: Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pp. 7871–7880 (2020)

21.

Li, H., Jin, S.: Text steganalysis based on capsule network with dynamic routing. Inst. Electron. Telecommun. Eng. Tech. Rev. 38(1), 72–81 (2021)

22.

Li, L., Huang, L., Zhao, X., Yang, W., Chen, Z.: A statistical attack on a kind of word-shift text-steganography. In: 2008 International Conference on Intelligent Information Hiding and Multimedia Signal Processing, pp. 1503–1507. IEEE (2008)

23.

Li, E., Fu, Z., Chen, S., Chen, J.: A two-stage highly robust text steganalysis model. J. Cybersecur. 2(4), 183 (2020)

24.

Li, S., Wang, J., Liu, P.: Detection of generative linguistic steganography based on explicit and latent text word relation mining using deep learning. IEEE Trans. Dependable Secure Comput. (2022)

25.

Liu, T., Tsai, W.: A new steganographic method for data hiding in microsoft word documents by a change tracking technique. IEEE Trans. Inf. Forensics Secur. 2(1), 24–30 (2007)Crossref

26.

Liu, Y., Sun, X., Liu, Y., Li, C.T.: Mimic-ppt: Mimicking-based steganography for microsoft power point document. J. Inf. Technol. 7, 654–660 (2008)Crossref

27.

Liu, Y., Wang, J., Wang, Z., Qu, Q., Yu, S.: A technique of high embedding rate text steganography based on whole poetry of song dynasty. In: Cloud Computing and Security: Second International Conference, vol. 10039, pp. 178–189. Springer (2016)

28.

Mahato, S., Yadav, D.K., Khan, D.A.: A novel approach to text steganography using font size of invisible space characters in microsoft word document. In: Intelligent Computing, Networking, and Informatics: Proceedings of the International Conference on Advanced Computing, Networking, and Informatics, pp. 1047–1054. Springer (2014)

29.

Medsker, L.R., Jain, L.: Recurrent neural networks. Design Appl. 5, 64–67 (2001)

30.

Meng, P., Hang, L., Yang, W., Chen, Z., Zheng, H.: Linguistic steganography detection algorithm using statistical language model. In: 2009 international conference on information technology and computer science, vol. 2, pp. 540–543. IEEE (2009)

31.

Mirza, M., Osindero, S.: Conditional generative adversarial nets. Preprint (2014). arXiv:1411.1784

32.

Niu, Y., Wen, J., Zhong, P., Xue, Y.: A hybrid R-BILSTM-C neural network based text steganalysis. IEEE Signal Process. Lett. 26(12), 1907–1911 (2019)Crossref

33.

Papineni, K., Roukos, S., Ward, T., Zhu, W.J.: Bleu: a method for automatic evaluation of machine translation. In: Proceedings of the 40th Annual Meeting of the Association for Computational Linguistics, pp. 311–318 (2002)

34.

Peng, W., Zhang, J., Xue, Y., Yang, Z.: Real-time text steganalysis based on multi-stage transfer learning. IEEE Signal Process. Lett. 28, 1510–1514 (2021)Crossref

35.

Pevny, T., Fridrich, J., Ker, A.D.: From blind to quantitative steganalysis. IEEE Trans. Inf. Forensics Secur. 7(2), 445–454 (2011)Crossref

36.

Radford, A., Narasimhan, K., Salimans, T., Sutskever, I., et al.: Improving language understanding by generative pre-training (2018)

37.

Raffel, C., Shazeer, N., Roberts, A., Lee, K., Narang, S., Matena, M., Zhou, Y., Li, W., Liu, P.J.: Exploring the limits of transfer learning with a unified text-to-text transformer. J. Mach. Learn. Res. 21(1), 5485–5551 (2020)MathSciNet

38.

Shniperov, A.N., Nikitina, K.: A text steganography method based on markov chains. Autom. Control Comput. Sci. 50, 802–808 (2016)Crossref

39.

Sui, X., Luo, H., Zhu, Z.: A steganalysis method based on the distribution of first letters of words. In: 2006 International Conference on Intelligent Information Hiding and Multimedia, pp. 369–372. IEEE (2006)

40.

Tang, X., Chen, M.: Design and implementation of information hiding system based on RGB. In: 2013 3rd International Conference on Consumer Electronics, Communications and Networks, pp. 217–220. IEEE (2013)

41.

Taskiran, C.M., Topkara, U., Topkara, M., Delp, E.J.: Attacks on lexical natural language steganography systems. In: Security, Steganography, and Watermarking of Multimedia Contents VIII, vol. 6072, pp. 97–105. SPIE (2006)

42.

Topkara, M., Topkara, U., Atallah, M.J.: Words are not enough: sentence level natural language watermarking. In: Proceedings of the 4th ACM international workshop on Contents protection and security, pp. 37–46 (2006)

43.

Ueoka, H., Murawaki, Y., Kurohashi, S.: Frustratingly easy edit-based linguistic steganography with a masked language model. In: Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, pp. 5486–5492 (2021)

44.

Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A.N., Kaiser, Ł., Polosukhin, I.: Attention is all you need. Adv. Neural Inf. Process. Syst. 30 (2017)

45.

Wayner, P.: Mimic functions. Cryptologia 16(3), 193–214 (1992)MathSciNetCrossref

46.

Wen, J., Zhou, X., Zhong, P., Xue, Y.: Convolutional neural network based text steganalysis. IEEE Signal Process. Lett. 26(3), 460–464 (2019)Crossref

47.

Wen, J., Zhang, Z., Yang, Y., Xue, Y.: Few-shot text steganalysis based on attentional meta-learner. In: Proceedings of the 2022 ACM Workshop on Information Hiding and Multimedia Security, pp. 97–106 (2022)

48.

Wen, J., Deng, Y., Peng, W., Xue, Y.: Linguistic steganalysis via fusing multi-granularity attentional text features. Chinese J. Electron. 32(1), 76–84 (2023)Crossref

49.

Winstein, K.: Lexical steganography through adaptive modulation of the word choice hash (1998)

50.

Wu, H.: Unsupervised steganographer identification via clustering and outlier detection. In: Digital Media Steganography, pp. 295–319. Elsevier, Amsterdam (2020)

51.

Wu, H., Wang, H., Zhao, H., Yu, X.: Multi-layer assignment steganography using graph-theoretic approach. Multimed. Tools Appl. 74(18), 8171–8196 (2015)Crossref

52.

Wu, H., Yi, B., Ding, F., Feng, G., Zhang, X.: Linguistic steganalysis with graph neural networks. IEEE Signal Process. Lett. 28, 558–562 (2021)Crossref

53.

Xiang, L., Sun, X., Luo, G., Gan, C.: Research on steganalysis for text steganography based on font format. In: Third International Symposium on Information Assurance and Security, pp. 490–495. IEEE (2007)

54.

Xiang, L., Sun, X., Luo, G., Xia, B.: Linguistic steganalysis using the features derived from synonym frequency. Multimed. Tools Appl. 71, 1893–1911 (2014)Crossref

55.

Xiang, L., Guo, G., Yu, J., Sheng, V.S., Yang, P.: A convolutional neural network-based linguistic steganalysis for synonym substitution steganography. Math. Biosci. Eng. 17(2), 1041–1058 (2020)MathSciNetCrossref

56.

Xu, G., Wu, H., Shi, Y.: Structural design of convolutional neural networks for steganalysis. IEEE Signal Process. Lett. 23(5), 708–712 (2016)Crossref

57.

Xu, Y., Zhao, T., Zhong, P.: Small-scale linguistic steganalysis for multi-concealed scenarios. IEEE Signal Process. Lett. 29, 130–134 (2021)Crossref

58.

Xue, Y., Kong, L., Peng, W., Zhong, P., Wen, J.: An effective linguistic steganalysis framework based on hierarchical mutual learning. Inf. Sci. 586, 140–154 (2022)Crossref

59.

Xue, Y., Yang, B., Deng, Y., Peng, W., Wen, J.: Domain adaptational text steganalysis based on transductive learning. In: Proceedings of the 2022 ACM Workshop on Information Hiding and Multimedia Security, pp. 91–96 (2022)

60.

Yang, Z., Guo, X., Chen, Z., Huang, Y., Zhang, Y.: RNN-stega: Linguistic steganography based on recurrent neural networks. IEEE Trans. Inf. Forensics Secur. 14(5), 1280–1295 (2018)Crossref

61.

Yang, Z., Wei, N., Sheng, J., Huang, Y., Zhang, Y.: TS-CNN: text steganalysis from semantic space based on convolutional neural network. Preprint (2018). arXiv:1810.08136

62.

Yang, Z., Wang, K., Li, J., Huang, Y., Zhang, Y.: TS-RNN: text steganalysis based on recurrent neural networks. IEEE Signal Process. Lett. 26(12), 1743–1747 (2019)Crossref

63.

Yang, Z., Huang, Y., Zhang, Y.J.: TS-CSW: text steganalysis and hidden capacity estimation based on convolutional sliding windows. Multimed. Tools Appl. 79, 18293–18316 (2020)Crossref

64.

Yang, J., Yang, Z., Zhang, S., Tu, H., Huang, Y.: Sesy: Linguistic steganalysis framework integrating semantic and syntactic features. IEEE Signal Process. Lett. 29, 31–35 (2021)Crossref

65.

Yang, Z., Zhang, S., Hu, Y., Hu, Z., Huang, Y.: VAE-Stega: linguistic steganography based on variational auto-encoder. IEEE Trans. Inf. Forensics Secur. 16, 880–895 (2020)Crossref

66.

Yang, T., Wu, H., Yi, B., Feng, G., Zhang, X.: Semantic-preserving linguistic steganography by pivot translation and semantic-aware bins coding. IEEE Trans. Dependable Secure Comput. (2023)

67.

Yi, X., Yang, K., Zhao, X., Wang, Y., Yu, H.: AHCM: Adaptive Huffman code mapping for audio steganography based on psychoacoustic model. IEEE Trans. Inf. Forensics Secur. 14(8), 2217–2231 (2019)Crossref

68.

Yi, B., Wu, H., Feng, G., Zhang, X.: ALisa: Acrostic linguistic steganography based on BERT and Gibbs sampling. IEEE Signal Process. Lett. 29, 687–691 (2022)Crossref

69.

Yi, B., Wu, H., Feng, G., Zhang, X.: Exploiting language model for efficient linguistic steganalysis. In: IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 3074–3078. IEEE (2022)

70.

Zhang, T., Kishore, V., Wu, F., Weinberger, K.Q., Artzi, Y.: BERTScore: evaluating text generation with BERT. In: International Conference on Learning Representations (2019)

71.

Zhao, X., Chen, Z., Huang, L., Yu, Z.: Effective linguistic steganography detection. In: IEEE 8th International Conference on Computer and Information Technology Workshops, pp. 224–229. IEEE (2008)

72.

Zheng, X., Wu, H.: Autoregressive linguistic steganography based on BERT and consistency coding. Secur. Commun. Netw. 2022 (2022)

73.

Zhili, C., Liusheng, H., Zhenshan, Y., Lingjun, L., Wei, Y.: A statistical algorithm for linguistic steganography detection based on distribution of words. In: 2008 Third International Conference on Availability, Reliability and Security, pp. 558–563. IEEE (2008)

74.

Zhong, Z.Y., XU, G.a.: Digital watermarking algorithm based on structure of PDF document. J. Comput. Appl. 32(10), 2776 (2012)

75.

Zhou, X., Peng, W., Yang, B., Wen, J., Xue, Y., Zhong, P.: Linguistic steganography based on adaptive probability distribution. IEEE Trans. Dependable Secure Comput. 19(5), 2982–2997 (2021)Crossref

76.

Ziegler, Z.M., Deng, Y., Rush, A.M.: Neural linguistic steganography. In: Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP), pp. 1210–1215 (2019)

77.

Zou, J., Yang, Z., Zhang, S., Rehman, S.u., Huang, Y.: High-performance linguistic steganalysis, capacity estimation and steganographic positioning. In: Digital Forensics and Watermarking: 19th International Workshop, vol. 12617, pp. 80–93. Springer (2021)

© The Author(s), under exclusive license to Springer Nature Switzerland AG 2024

E. Nowroozi et al. (eds.)Adversarial Multimedia ForensicsAdvances in Information Security104https://doi.org/10.1007/978-3-031-49803-9_8

Random Deep Feature Selection’s Efficiency in Securing Image Manipulation Detectors Opposed by Adversarial Attacks

Nada Jadalla1  , Nesrine Tamagoult Dit Mongar1  , Sana Sultan1   and Marwa Issam Abdulkareem1  

(1)

Department of Computer Engineering, Bahcesehir University, Istanbul, Turkey

Nada Jadalla

Email: nada.jadalla@bahcesehir.edu.tr

Nesrine Tamagoult Dit Mongar

Email: nesrine.tamagoult@bahcesehir.edu.tr

Sana Sultan

Email: sana.sultan@bahcesehir.edu.tr

Marwa Issam Abdulkareem (Corresponding author)

Email: marwaissam.abdulkareem@bau.edu.tr

Keywords

Adversarial machine learningAdversarial forensics for multimediaDeep learning for forensicsManipulation detection of imagesDefences techniques based on randomization

1 Introduction

In the field of image processing, features are extremely significant. Feature extraction techniques are used to obtain features useful for image classification and recognition. Therefore, the preceding is mainly used in image forensics.

Digital image forensics is a relatively new field of research that aims to evaluate the validity of photographs by obtaining information about their origin [14, 24]. Identifying the device used to take the image and detecting forgery traces are the two main topics. Nevertheless, image forensics, like other types of forensics, is vulnerable to adversary attacks by attackers, so secure image forensics is becoming increasingly important.

It is not easy to achieve good performance by developing tools for secure image forensics, even in cases where the adversary is present, taking into account the traces on which the forensic analysis depends and their vulnerabilities [15].

In the case of the white-box scenario shown in Fig. 6, the attacker is fully aware of the forensic algorithm. However, in the case of the gray-box scenario shown in Fig. 1, only partial information is known, and the development of strong Counter-Forensic (CF) techniques in this scenario can be achieved by introducing a partial bias into the target image. In Deep Learning (DL) this is, even more, the case, indicating the weakness of the DL methods used in adversarial examples [16] small, quasi-imperceptible perturbations to the input images that lead to incorrect results. Randomization strategies provide the opportunity to improve overall robustness to the model CF [4] without having to specialize the forensic algorithm to a particular tool for CF. This is a similar case to approaches related to the adversary (machine learning-based forensics found in [2] and general DL applications found in [16]). Many randomization methods have been considered to address the standard ML tools, and more recently DL architectures have been addressed.

An illustration presents the attacker's knowledge and scenario. The attacker knowledge includes the model and hardware, while the attack scenario presents how the clean sample is processed through the exact classifier, to obtain the adversarial example.

Fig. 1

Grey-box attack scenario with partial knowledge[17]

The authors of [12] suggest a random selection of the feature space with regard to a secret key. This strategy is designed to keep the adversary from gaining complete knowledge about the targeted system. The goal of the proposed approach is to minimize the success rate of the attack, which is evaluated based on the effectiveness of the attack methods by leaving the white-box scenario in our case. The authors in [12] have theoretically and practically demonstrated the performance efficiency of Random Feature Selection (RFS) by focusing on image tampering detection in addition to the features of SPAM [26]. Figure 2 shows the samples of the original images and the manipulated images for clear comparison. Referring to DL, most of the techniques proposed to date focus on randomizing the test time [30] by randomizing the classifier input layer at test time. Recently, the multichannel architecture was proposed in [29]. This architecture includes multiple channels, where each channel performs randomization in its own transformed domain based on a secret key.

A set of images from the dataset. It features how the original image of the grass field, building, tree, and snake is processed through the median filter, gaussian blur, A W G N, and re-sampling to obtain the manipulated images.

Fig. 2

Samples of original images and manipulated images [19]

The RDS approach described previously is mentioned in [12] and illustrated in Fig. 4 is extended in this study to a CNN-based recognition scenario by extracting features using CNN. A schematic representation of the CNN model can be seen in Fig. 3. The intention of this approach is to figure out the ability to utilize combat adversarial instances, and if so, to what extent the expanded technique can be employed.

An illustration presents how the input image is processed through the convolutional layer, pooling layer, multi-layer convolution, and pooling, and fully connected layer to obtain the output.

Fig. 3

Original CNN model [18]

A diagram presents how the input is processed through feature extraction, random feature selection with a secret key, and a detector to obtain the output H 0 over H 1.

Fig. 4

RFS detector security model [12]

Due to the power of adversarial attacks on CNNs (especially in the case of gradient-based attacks that exploit gradient backpropagation) and the full variants of other attacks on SVM classifiers, such an extension is not trivial. Random Deep Feature Selection (RDFS) is the scheme presented in this [23] where classification is implemented based on random feature selection using the following classifier types: Fully Connected (FC) Network and Linear SVM. FC Network refers to a version that is re-trained from the last part of the targeted CNN. To ensure the effectiveness of RDFS, the security of the CNN-based detector must be increased against adversarial examples, but this leads to performance degradation when the attack does not occur. A series of image tampering detection tasks were performed in experiments using two state-of-the-art CNNs. RDFS has been shown to mitigate the harmfulness of adversarial examples. Nevertheless, the efficiency of RDFS is influenced by a number of factors, including the detection task, the type of attack, and the network. In practice, the mismatch between the two classifiers reduces the attack’s success rate in many scenarios. the main classifier targeted by the attack (in our case: SVM) and the classifier used for classification (in our case: retrains FC), which makes random feature selection unnecessary.

2 Proposed Method

In this work, we offer a secure image classification approach based on RDFS. The goal of this study, as stated in the previous section, is to extend the existing random feature selection method in [12] applied to a model built on top of standard ML-based detectors based on statistical and handcrafted features to support CNN-based forensic detectors as well. The authors of [12] assume that the attacker is aware of the numerous factors that influence the detector’s architecture, training data, and the class V of characteristics on which the detector may depend (Fig. 4).

In this case, since the has a lack of knowledge of the selected feature set, it targets a specific version of the detector that uses a full set of features, resulting in a reduction in attack performance. The assumed scenario is achieved by randomly selecting features, which leads to a drastic improvement in the security of the detector, but causes a small loss in efficiency due to the lack of attacks. Figure 5. presents a security model implemented in this study. Considering an original CNN detector, you can use CNN only as a feature extractor. The dimensionality of features is denoted by N and K features are randomly selected from the N features, taking into account K < N, based on a secret key.

A diagram presents how the input image is attacked by the attacker and processed through the original C N N, random feature selection with a secret key, and a detector, to obtain the output H 0 over H 1.

Fig. 5

RDFS detector proposed structure [8]

Accordingly, the feature set is minimized to train another detector, which can be either an SVM classifier or a CNN. Since the same secret key is used in training and testing, the same method is used in both phases. H0 refers to the hypothesis of the original image to avoid loss of generality, and H1 refers to the hypothesis of the manipulated image. Referring to the image in Fig. 5, it is shown that through using the pixel domain the adversarial attack was performed. Assuming that the attacker is unaware of the randomization strategy, it will target the original CNN classifier and accordingly perform a vanilla attack. In addition to the previous assumption, let us assume another scenario where the attacker aims for a manipulated image to fool the system and pass as original. This can happen and cause a False Negative Error (FNE) if we convince the network to choose H0 when H1 holds, with no interest in launching an attack from the opposite direction. As a result of the attack, the adversary will want to reduce the manipulations in the image. The approach RFS applies a scenario with partial knowledge of the attack, as described in the introduction of this paper. In particular, the random defense approach is unknown to the adversary. Even in the reverse cases where this defense approach is known to him, the subset of features used with their K-values is still unknown to him. Moreover, the attacker has limited knowledge about the RDFS structure of the detector. According to the DL terminology [31], the attack is no longer performed with perfect knowledge since the features are randomly selected, but the attack is performed with partial knowledge and is called a semi-white-box scenario. Based on the RDFS scheme chosen, the available knowledge of the detector architecture is determined by the attacker. In this study, both the FC network detector case and the linear SVM detector case are considered.

2.1 RDFS Detection Considering FC Networks

The FC layers of the main CNN are re-trained and then the RDFS detector is applied in this scenario. Considering K, the feature set is randomly selected and should be smaller than N features. The same original network FC is re-trained considering only the K input nodes. The original architecture of the CNN determines the number of layers. A deviation in architecture between the main CNN classification architecture targeted by the attack and this FC network is not allowed if the full set of features is considered for detection (K = N).

Nevertheless, we cannot consider the attack as a full whitebox scenario, as in Fig. 6 in this case due to the use of a training set different from the main set chosen to train the detector. This different set is a subset of the main set and is used for our experiments.

An illustration presents the attacker's knowledge and scenario. The attacker knowledge includes the model and hardware, while the attack scenario presents how the clean sample is processed through the approximate classifier, to obtain the adversarial example.

Fig. 6

White-box attack scenario with full knowledge [17]

2.2 RDFS Detection Considering SVM

An SVM architecture, often known as a Support Vector Machine, is a linear model used to address classification and regression issues. It is ideally suited to many current challenges and can remedy both linear and non-linear problems. The idea behind SVM is simple: the algorithm constructs a line or hyperplane that separates the data into classes. Figure 7. Therefore, in this case, it was taken into account when implementing the detector. The detector is then different from the original CNN classification structure, unlike the previous scenario, even for the scenarios that consider taking the whole feature into account (by making K equal to N). Since only the training data is known to the attacked, but not the design of the detector, the amount of attack information is correspondingly smaller than in the previous case.

A graph of the y-axis versus the x-axis. It plots the data points in the decreasing trends, and it is separated by a hyperplane. The left side plots data in circular shape and the right side in triangular shape.

Fig. 7

Example of linear SVM

3 Different Implementations of Manipulation Detection

In this study, we investigate the effectiveness of the RDFS approach for applications involving image change detection and analyze the elements that influence this. We perform a series of experiments and consider three different image change detection tasks. For each of these tasks, we considered two different state-of-the-art CNN architectures. Three main types of attacks were considered when evaluating the security of the RDFS method.

3.1 CNN Original Detectors

The three detection tasks considered were picture resizing (downsampling, with a calculation of 0.8) and median filtering (with a $$5\times 5 )$$ which is a filtering method to reduce signal and image noise, and the last detection task used was which performs differentiate improvement on a local basıs premise considering the Contrast-Limited fulfillment of AHE (CL-AHE).

In terms of the architectures of a network, two of them are taken into account, the first is the BayarNet2016 network in [10] (recently extended in [11]), which was originally proposed for detecting various common tamper detection tasks. As shown in Fig. 8. The network contains 8 layers; it consists of three convolutional layers, one stack normalization (BN), three max-pooling layers, and two FC layers. The filters of the first layer (with a receptive field of 5 x 5) of BayarNet2016 are bounded by a high-pass filters, thereafter residual-based features are extracted.

An illustration of the model consists of prediction error feature extraction, hierarchical feature extraction, cross-feature map learning, and classification. The classification includes the deep convolutional features with extremely randomized trees classifier.

Fig. 8

The proposed CNN architecture [9]

Subsequently the second network architecture is BarniNet2018 in [3]. It is used for the more challenging task of detecting general contrast adjustments, as the performance of BayarNet2016 on this task is rather poor. There are significant differences between these two network architectures, but the main focus is on the primary differences. If we analyze the number of convolutional layers, we can see that BarniNet2018 is much deeper as it has 9 convolutional layers instead of 3 for BayarNet2016. Moreover, BarniNet2018 does not use pre-filtering by restricting the filters in the first layer, since the networks learn the features naturally from the image pixels after that. For more information about the network structures, see [10] and [3].

3.2 Minimizing Detectors

We developed our minimized detectors, or as introduced in [8], reduced feature detectors as described below for each manipulation challenge. K features were experimented from the receding layers of CNNs for a given set of random values. subsequently, employing K input nodes and a direct SVM classifier motivated by K input characteristics, we trained the original FC architecture of BayarNet2016 and BarniNet2018. A portion of the preparation set implemented to prepare the first systems was utilized to prepare the FC systems and the SVM. In terms of architecture, BayarNet2016 has two layers with 4096 concealed nodes each while BarniNet2018 has one layer with 250 concealed nodes.

3.3 Adversarial Attacks

Without a doubt, the attack is unique to the original CNN model, as distinguished White-box attacks are carried out against the original CNN-trained models in each example, revealing that the attacker is fully aware of the model. In our testing, we performed three iterative gradient-based attacks, forming the adversarial illustrations precisely with the following algorithms.

The first example is the original box-constrained L-BFGS, also known as L-BFGS-B by Szegedy et al. [28] implementing the standard gradient-descent algorithm, an optimization method used in various machine learning algorithms to reduce the cost function. In this research, we applied it to detect the least amount of adversarial perturbation that changes the prediction. L-BFGS [28] searches for an roughly optimal remedy to the optimization issue that the invasion must solve. Moreover the second algorithm is the Fast Gradient Sign method. Figure 9, also known as FGSM, originally proposed in [16], We looked at the extended iterative version (I-FGSM) of the FGSM attack in this paper, as explained in [20].

An illustration presents a photo of a panda with 57.7% confidence, which is added with 0.07 and multiplied with a nematode with 8.2% confidence to obtain the output gibbon with 99.3% confidence.

Fig. 9

A GoogLeNet-based demonstration of fast adversarial example generation [17]

A i + 1 perturbation is produced at each iteration, by determining the gradient of the output with respect to the input image and multiplying its sign by a (normalized) strength factor $$\epsilon $$. As a mere formality, for an image X: Xi+1=Xi+ $$\epsilon $$(max(Xi)-min(Xi)).sign($$\triangledown \times $$J$$\theta $$(Xi, y)), where J $$\theta $$(X, y) is the neural network’s cross-entropy cost function with parameters theta and y the X’s ground truth class.

This process is performed frequently for a maximum number of steps S until an adversarial image is produced, i.e., an image misclassified by the network. Multiple possibilities for $$\epsilon $$, i.e. $$\epsilon \in $$ E, are examined. Finally, the value that diminishes the distortion of the final attacked image in comparison to the original image is chosen.

Finally, the Projected Gradient Descent (PGD) attack was used, initially carried in [21]. This is a different white-box attack, which means the attacker possesses a copy of the model’s weights. In PGD, the goal is to identify the perturbation that optimizes the loss function given certain constraints on the imposed l $$\infty $$ distortion, optimizes the loss function. In more detail similar to FGSM, at each iteration i + 1 as follows: Xi+1 = Xi + $$\epsilon (max(Xi) - min(Xi))\cdot $$ sign($$\triangledown $$ $$\times $$ J $$\theta $$(Xi, y)) for some $$\epsilon $$ related step size; next, pixel values are truncated To preserve them in the $$\alpha $$ neighborhood of the original image. [Xi+1]r,c = clip([Xi+1]r,c, -$$\alpha $$, +$$\alpha $$) for pixel (r, c).

This attack can occasionally lead to a very poor result because the clipping is too large. To optimize the selection of hyperparameters, a binary investigation can be applied over and, initializing the investigation with only the input values. The attacks were performed using the Foolbox toolkit [27]. It is a new Python library designed to generate various adversarial perturbations and to measure and evaluate the robustness of machine learning models. It is based on the idea that the smallest perturbation required to generate an adversarial example is the measure of robustness that is most comparable. To this end, Foolbox provides reference implementations of most of the already published adversary attack techniques, as well as some new ones. In all these implementations, the hyperparameters are adjusted to find the least disruptive ones.

4 Discussion and Experimental Findings

In this section,We illustrate as well as address the results of the experiments we implemented in different environments, after first describing the experimental setup for our research.

4.1 Experimental Design

We used the 4288 x 2848 uncompressed camera-native (.tiff) photographs from the RAISE dataset [13] totaling 8156 for our tests. Before beginning processing, the images were grouped into training, validation, and test sets, and subjected to resizing, median, and adaptive histogram equalization to generate images for class $$ H_{1} $$ (CL-AHE).

For BayarNet2016, we assumed 100,000 patches for training, 3000 for validation, and 11,000 for testing per class; for BarniNet2018, we assumed 500,000 patches for training, 5000 for validation, and 10,000 for testing per class. These values served as the basis for the initial CNNs created for the three recognition tasks. For each image, a maximum of 100 fields were randomly selected to use numerous images from the dataset and subsequently to ensure a diversity of fields. For both networks, the size of the input fields was set to 64 $$\times $$ 64. The BayarNet2016 models were trained with 40 epochs, while BarniNet2018 was trained with 4 epochs by following [3]. We used Adam Solver with a momentum of 0.99 and a learning rate of $$10^{-4}$$ to train the networks. The size of the training stack was set to 32. In the absence of attacks, the trained models were able to achieve the following accuracy levels: i- BayarNet2016: 98.83% for median filtering, 91.30% for resizing, and 90.45% for CL-AHE; ii- BarniNet2018: 99.73% for median filtering, 95.05% for resizing, and 98.30% for CL-AHE.

To train the SVM and FC networks, a subset of 20,000 patches per class owing to the initial training set and 1000 patches per owing to from the validation set utilized by the original CNN were used to validate the two networks. Next, we used the following settings for the training phase of the networks with reduced features FC: Depending on Adam solver’s learning rate is set to $$10^{-5}$$, and its momentum of 0.99 and maximum of epochs of 50. furthermore, there is an initial stop condition is used to stops training in case the validation loss has altered by $$10^{-3}$$ or less in the previous 5 epochs (for a validation set size of 100). For both the FC networks and the SVM, we examined min K ( 5, 10, 30, 50) and max K (200, 400, 600) in the training and testing of the experiments, as well as the case of complete features K = N . The size of the flattened layer of the actual CNN or the set of complete features is N = 1728 for BayarNet 2016 and N = 3200 for BarniNet 2018. To save effort, the case of K = 600 is ignored when BarniNet2018 is used as the original CNN. In reality, it takes time to train 50 models (SVM and FC) for each value of K, one for each option in the random set. However, as the BayarNet2016 results show, the examples with lower values of K (on the order of ten) are the most interesting. For the tests performed without attacks, We examined 4000 patches per class from the original test set.

We used the default attack parameters for L-BFGS in terms of attacks [27]. For FGSM, S is fixed at 10 steps (by default) and E = [0: 0.001, 0.1] is the range in which the best strength is sought. PGD is used under the following conditions: binary-search = ‘True’1 when $$\epsilon = 0.05$$ and $$\alpha = 0.3$$. Using the above setting for the CL-AHE detection task, the adversary image cannot be detected in many situations, so the following setting is considered: $$\epsilon = 0.025$$, $$\alpha = 0.01$$, binary-search = ‘False’.

We have used only the attack on the images in class $$ H_{1} $$, as mentioned earlier. In each scenario, a subset of the 4000 patches in class $$ H_{1} $$ is attacked to obtain 500 adversarial examples against which to evaluate performance under attack. We verified that all attacks with the above parameters are effective against the original CNN target, with a success rate of [0.98:1]. Based on the nature of the attack, the target network, as well as the detection task, as well as the average PSNR value for the attacked samples ranges from 40 to 70 dB (typically above 60 dB).

4.2 Classification Based on FC Results

In this section, lets explore Tables 1, 2, 3, 4, 5, and 6 for the cases of BayarNet2016 and BarniNet2018, seriatim, present the results we obtained for this case. Looking at the Tables 1, 2, and 3, we note that if an attack is effective against the FC network with K = N, could be seen in the final rows of the tables, i.e., If the BayarNet2016 attack is successfully transferred to the FC detector with all of its features, the proposed randomization approach may assist and considerable accuracy improvement can be acquired at the cost of a moderate accuracy reduction in the absence of attacks.

Table 1

RDFS detector based on FC network accuracy percentage for BayarNet2016 case, Resizing scenario [10]

K

No attack(%)

PGD(%)

FGSM(%)

BFGS(%)

min K (5, 10, 30, 50)

91.0–97.4

69.9–52

61.6–35.9

65.6–40.1.

max K (200, 400, 600)

97.7–97.9

31.0–16.4

13.7–5.4

17.4–7.1

K = N

98

31.5

0.6

20.3

Table 2

RDFS detector based on FC network accuracy percentage for BayarNet2016 case, Median Filtering Scenario [10]

K

No attack(%)

PGD(%)

FGSM(%)

BFGS(%)

min K (5, 10, 30, 50)

88.7–97.7

80.6–79.7

51.0–24.6

73.0–53.5

max K (200, 400, 600)

98.7–98.9

76.7–80.5

10.8–6.0

44.8–42.6

K = N

99

81.9

4.3

39.7

Table 3

RDFS detector based on FC network accuracy percentage for BayarNet2016 case, CL-AHE Scenario [10]

K

No attack(%)

PGD(%)

FGSM(%)

BFGS(%)

min K (5, 10, 30, 50)

73.0–80.7

87.4–90.2

89.1–91.3

88.0–56.3

max K (200, 400, 600)

81.5–80.5

91.8–91.5

94.5–93.8

42.8–36.6

K = N

80.5

91.8

93.9

35.1

Table 4

RDFS detector based on FC network accuracy percentage for BarniNet2018 case, Resizing Scenario [11]

K

No Attack(%)

PGD(%)

FGSM(%)

BFGS(%)

min K (5, 10, 30, 50)

74.4–96.8

67.7–85.2

58.7–66.8

60.7–73.0

max K (200, 400, 600)

99.7–99.8

88.0–89.3

69.6–71.8

77.9–80.0

K = N

100.0

89.8

75.2

81.2

Table 5

RDFS detector based on FC network accuracy percentage for BarniNet2018 case, Median Filtering Scenario [11]

K

Attack(%)

PGD(%)

FGSM(%)

BFGS(%)

min K (5, 10, 30, 50)

97.2–99.6

83.3–88.5

48.3–21.9

77.1–79.6

max K (200, 400, 600)

99.6–99.6

88.6–88.1

17.0–15.6

76.2–75.6

K = N

99.7

85.2

13.7

71.3

Table 6

RDFS detector based on FC network accuracy percentage for BarniNet2018 case, CL-AHE Scenario [11]

K

No attack(%)

PGD(%)

FGSM(%)

BFGS(%)

min K (5, 10, 30, 50)

87.4–95.1

47.2–56.7

63.7–80.0

47.0–35.3

max K (200, 400, 600)

96.9–97.1

48.5–30.1

83.0–83.6

26.0–21.0

K = N

98.2

33.5

34.0

26.2

In particular, the accuracy gain around 20–30% for K = 30 and 30–50% for K = 10, in the same time, the accuracy reduction in the nonexistence of attacks is only 2–4%, with the exact value varying relating to the task (with the exception of the BarniNet2018 size change detection task, where a significant drop in performance is felt even in the absence of attacks, see Table 4). Occasionally, however, the exploit fails on the FC full feature detector, i.e., the attack on the original CNN BayarNet2016 is not transferable to the full feature FC detector since the significant accuracy is already present and likewise for K = N. In other words, simply retraining the FC network with a diverse set (in our example, a subset of the initial training) Reduces the attack’s success rate. This conduct reveals that, in contrast to typical pattern recognition applications, the adversarial instances do not appear to be transferrable for image forensics applications [22, 25], supporting the findings in [5].

A similar pattern is seen in the Tables 4, 5, and 6, where it is clear that the attack is less effective (and thus less transferable) when K = N. The randomization defense is also not required in these scenarios (for example, the accuracy considering K = N is 89.7% for size matching and 85.3% for median filtering in the PGD case). The randomization strategy enhances the accuracy by 20–30% in the other scenarios or when the accuracy with K = N is insufficient.

4.3 Classification Based on SVM Results

Tables 7, 8, 9, 10, 11, and 12 for the cases of BayarNet2019 and BarniNet2018, seriatim, present the results we obtained for this case.

Table 7

Accuracy (%) of the SVM-based RDFS detector for BayarNet2016 [10], resizing scenario

K

No attack(%)

PGD(%)

FGSM(%)

BFGS(%)

min K (5, 10, 30, 50)

79.6–94.3

59.0–75.5

58.0–75.6

58.7–75.0

max K (200, 400, 600)

95.5–94.8

65.0–43.4

66.4–25.2

64.2–28.1

K = N

95.1

58.4

31.0

39.4

Table 8

SVM-based RDFS detector accuracy percentage for BayarNet2016 case [10], median filtering scenario

K

No attack(%)

PGD(%)

FGSM(%)

BFGS(%)

min K (5, 10, 30, 50)

80.3–96.2

70.8–63.3

47.5–13.1

66.1–42.0

max K (200, 400, 600)

97.7–98.1

57.2–45.0

3.8–1.3

22.1–11.0

K = N

98.0

29.6

0.6

5.0

Table 9

Accuracy (%) of the SVM-based RDFS detector for BayarNet2016 [10], CL-AHE scenario

K

No attack(%)

PGD(%)

FGSM(%)

BFGS(%)

min K (5, 10, 30, 50)

74.4–80.7

90.7–89.6

89.2–91.0

87.3–62.3

max K (200, 400, 600)

80.0–79.4

91.0–91.3

93.4–94.2

43.7–39.7

K = N

79.5

91.8

95.0

38.6

Table 10

Accuracy (%) of the SVM-based RDFS detector in the case of BarniNet2018 [11], resizing scenario

K

No attack(%)

PGD(%)

FGSM(%)

BFGS(%)

min K (5, 10, 30, 50)

74.8–97.5

73.6–88.2

65.4–73.2

66.4–77.2

max K (200, 400, 600)

99.6–99.7

88.5–90.0

68.1–67.6

75.7–77.7

K = N

99.8

90.6

66.2

83.8

Table 11

Accuracy (%) of the SVM-based RDFS detector in the case of BarniNet2018 [11], median filtering scenario

K

No attack(%)

PGD(%)

FGSM(%)

BFGS(%)

min K (5, 10, 30, 50)

97.2–99.3

83.1–86.1

46.3–18.7

80.3–74.0

max K (200, 400, 600)

99.6–99.6

88.2–86.6

15.9–13.5

75.2–70.1

K = N

99.7

86.4

12.0

69.8

Table 12

Accuracy (%) of the SVM-based RDFS detector in the case of BarniNet2018 [11], CL-AHE scenario

K

No attack(%)

PGD(%)

FGSM(%)

BFGS(%)

min K (5, 10, 30, 50)

88.3–94.5

67.0–56.7

64.8–90.3

58.0–46.7

max K (200, 400, 600)

96.4–97.0

36.4–26.1

94.0–94.1

24.7–16.1

K = N

97.3

22.3

94.6

11.0

As expected, in this scenario, the mismatch in the architecture increases the accuracy even without the use of randomization, by further dropping the success rate of the attack against the full-featured SVM detector, i.e. the scenario with K = N.

To illustrate, under the BFGS attack, BayarNet2016 accuracy increases from 39.4 to 69.6% (in resizing), from 5.0 to 50.7% (in median filtering), and from 38.6 to 70.5% (in the CL-AHE task ), and a 2.2% performance degradation in accuracy when no attacks are considered.

Accuracy against attacks can be enhanced overall by using fewer features, e.g., K = 10, but at the cost of the no attacks scenario, there is a significant loss of performance.

5 Conclusion

We were able to assess the viability of utilizing Deep Feature Randomization to minimize threat transferability, likewise boost the robustness of CNN detectors against adversarial samples in this study. as described in [6, 7, 12].

In many conditions, our experiments show that the randomization feature aids some extent to reduce attack transferability and thus increase detection security, even if in some cases the architectural difference between the original CNN and the new detector is sufficient to prevent transferability.

In a further step, Attack strength can be enhanced to Optimize the transferability of adversarial instances.

This is quite a challenging task because of the sophistication of the decision boundaries that CNNs have learned. Given that diminishing the amount of distortion (e.g., by allowing the gradient descent to proceed until the attack’s maximum PSNR value is reached) or adding a safe margin to the attack’s decision function does not commonly lead to an extra powerful attack, the amount of distortion that the attack introduces into the image or the value that the decision function assumes simply serve as an ineffective mediator for the attack’s strength. Investigating a scenario more favorable to the attackers, where the attackers know about the randomization-based defense, is another topic for future research. For example, to execute an additional effective attack by focusing on a classifier with an expected version (similar to the Expectation Over Transformation (EOT) attack [1]), we can make the assumption that the attackers know the detector’s architecture and feature selection mechanism (and an undisclosed secret key). From the standpoint of the defense, the adoption of a different FC layer or an SVM with a different kernel for classification might be considered. To fill in the blank with a theoretical analysis of The beneficial effects of the feature selection method performed in [12], however, One might also try to improve the RDFS scheme’s performance efficiency by incorporating feature regularization into the original CNN’s training. Finally, it would be exciting to think about how the RDFS scheme can be used in the case of an attack on the full knowledge and evaluate the risk of data leakage with respect to the secret key in this situation.

References

1.

Athalye, A., Carlini, N., Wagner, D.: Obfuscated gradients give a false sense of security: circumventing defenses to adversarial examples. In: International Conference on Machine Learning. Proceedings of Machine Learning Research, pp. 274–283 (2018)

2.

Barni, M., Nowroozi, E., Tondi, B.: Higher-order, adversary-aware, double JPEG-detection via selected training on attacked samples. In: 2017 25th European Signal Processing Conference (EUSIPCO), pp. 281–285. IEEE, Piscataway (2017)

3.

Barni, M., Costanzo, A., Nowroozi, E., Tondi, B.: CNN-based detection of generic contrast adjustment with JPEG post-processing. In: 2018 25th IEEE International Conference on Image Processing (ICIP), pp. 3803–3807. IEEE, Piscataway (2018)

4.

Barni, M., Stamm, M.C., Tondi, B.: Adversarial multimedia forensics: overview and challenges ahead. In: 2018 26th European Signal Processing Conference (EUSIPCO), pp. 962–966. IEEE, Piscataway (2018)

5.

Barni, M., Kallas, K., Nowroozi, E., Tondi, B.: On the transferability of adversarial examples against CNN-based image forensics. In: ICASSP 2019-2019 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 8286–8290. IEEE, Piscataway (2019)

6.

Barni, M., Kallas, K., Nowroozi, E., Tondi, B.: CNN detection of gan-generated face images based on cross-band co-occurrences analysis. In: 2020 IEEE International Workshop on Information Forensics and Security (WIFS), pp. 1–6 (2020). https://​doi.​org/​10.​1109/​WIFS49906.​2020.​9360905

7.

Barni, M., Nowroozi, E., Tondi, B.: Improving the security of image manipulation detection through one-and-a-half-class multiple classification. Multimedia Tools Appl. 79, 2383–2408 (2020)Crossref

8.

Barni, M., Christian, N.E.T.B., Zhang, B.: Effectiveness of random deep feature selection for securing image manipulation detectors against adversarial examples. In: IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) (2020)

9.

Bayar, B., Stamm, M.C.: Constrained convolutional neural networks: a new approach towards general purpose image manipulation detection (2016). arXiv:1605.07277

10.

Bayar, B., Stamm, M.C.: A deep learning approach to universal image manipulation detection using a new convolutional layer. In: Proceedings of the 4th ACM Workshop on Information Hiding and Multimedia Security, pp. 5–10 (2016)

11.

Bayar, B., Stamm, M.C.: Constrained convolutional neural networks: a new approach towards general purpose image manipulation detection. IEEE Trans. Inf. Forensics Secur. 13(11), 2691–2706 (2018)Crossref

12.

Chen, Z., Tondi, B., Li, X., Ni, R., Zhao, Y., Barni, M.: Secure Detection of Image Manipulation by means of Random Feature Selection. IEEE Trans. Inf. Forensics Secur. 14(9), 2454–2469 (2019)Crossref

13.

Dang-Nguyen, D.T., Pasquini, C., Conotter, V., Boato, G.: Raise: a raw images dataset for digital image forensics. In: Proceedings of the 6th ACM Multimedia Systems Conference, pp. 219–224 (2015)

14.

Ferreira, A., Nowroozi, E., Barni, M.: Vipprint: validating synthetic image detection and source linking methods on a large scale dataset of printed documents. J. Imag. 7(3), 50 (2021)Crossref

15.

Gloe, T., Kirchner, M., Winkler, A., Böhme, R.: Can we trust digital image forensics? In: Proceedings of the 15th ACM International Conference on Multimedia, pp. 78–86 (2007)

16.

Goodfellow, I.J., Shlens, J., Szegedy, C.: Explaining and harnessing adversarial examples (2014). arXiv:1412.6572

17.

Guesmi, A., Alouani, I., Khasawneh, K.N., Baklouti, M., Frikha, T., Abid, M., Abu-Ghazaleh, N.: Defensive approximation: securing cnns using approximate computing. In: Proceedings of the 26th ACM International Conference on Architectural Support for Programming Languages and Operating Systems, pp. 990–1003 (2021)

18.

Han, T., Zhang, L., Yin, Z., Tan, A.C.: Rolling bearing fault diagnosis with combined convolutional neural networks and support vector machine. Measurement 177, 109022 (2021)Crossref

19.

Kim, D.H., Lee, H.Y.: Image manipulation detection using convolutional neural network. Int. J. Appl. Eng. Res. 12(21), 11640–11646 (2017)

20.

Kurakin, A., Goodfellow, I.J., Bengio, S.: Adversarial examples in the physical world. In: Artificial Intelligence Safety and Security, pp. 99–112. Chapman and Hall/CRC, Boca Raton (2018)

21.

Madry, A., Makelov, A., Schmidt, L., Tsipras, D., Vladu, A.: Towards deep learning models resistant to adversarial attacks (2017). arXiv:1706.06083

22.

Nowroozi, E., Mekdad, Y., Berenjestanaki, M.H., Conti, M., Fergougui, A.E.: Demystifying the transferability of adversarial attacks in computer networks. IEEE Trans. Netw. Serv. Manag. 19(3), 3387–3400 (2022). https://​doi.​org/​10.​1109/​TNSM.​2022.​3164354Crossref

23.

Nowroozi, E., Mohammadi, M., Golmohammadi, P., Mekdad, Y., Conti, M., Uluagac, S.: Resisting deep learning models against adversarial attack transferability via feature randomization (2022). https://​doi.​org/​10.​48550/​ARXIV.​2209.​04930. https://​arxiv.​org/​abs/​2209.​04930

24.

Nowroozi, E., Seyedshoari, S., Mohammadi, M., Jolfaei, A.: Impact of media forensics and deepfake in society. In: Breakthroughs in Digital Biometrics and Forensics, pp. 387–410. Springer, Berlin (2022)

25.

Papernot, N., McDaniel, P., Goodfellow, I.: Transferability in machine learning: from phenomena to black-box attacks using adversarial samples (2016). arXiv:1605.07277

26.

Pevnỳ, T., Bas, P., Fridrich, J.: Steganalysis by subtractive pixel adjacency matrix. In: Proceedings of the 11th ACM Workshop on Multimedia and Security, pp. 75–84 (2009)

27.

Rauber, J., Brendel, W., Bethge, M.: Foolbox v0. 8.0: a python toolbox to benchmark the robustness of machine learning models, corr abs/1707.04131. 540, arXiv:1707.04131

28.

Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., Fergus, R.: Intriguing properties of neural networks (2013). arXiv:1312.6199

29.

Taran, O., Rezaeifar, S., Holotyak, T., Voloshynovskiy, S.: Defending against adversarial attacks by randomized diversification. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 11226–11233 (2019)

30.

Xie, C., Wang, J., Zhang, Z., Ren, Z., Yuille, A.: Mitigating adversarial effects through randomization (2017). arXiv:1711.01991

31.

Yuan, X., He, P., Zhu, Q., Li, X.: Adversarial examples: attacks and defenses for deep learning. IEEE Trans. Neural Netw. Learn. Syst. 30(9), 2805–2824 (2019)MathSciNetCrossref

© The Author(s), under exclusive license to Springer Nature Switzerland AG 2024

E. Nowroozi et al. (eds.)Adversarial Multimedia ForensicsAdvances in Information Security104https://doi.org/10.1007/978-3-031-49803-9_9

Optimized Distribution for Robust Watermarking of Deep Neural Networks Through Fixed Embedding Weights

Melisa Çevik1  , Ege Baran Çakan1  , Elin Su Şentürk1  , Utku Anil Çakmak1   and Marwa Issam Abdulkareem1  

(1)

Bahcesehir University, Department of Computer Engineering, Istanbul, Turkey

Melisa Çevik

Email: melisa.cevik@bahcesehir.edu.tr

Ege Baran Çakan

Email: egebaran.cakan@bahcesehir.edu.tr

Elin Su Şentürk

Email: elinsu.senturk@bahcesehir.edu.tr

Utku Anil Çakmak

Email: utkuanil.cakmak@bahcesehir.edu.tr

Marwa Issam Abdulkareem (Corresponding author)

Email: marwaissam.abdulkareem@bau.edu.tr

Keywords

DNN IPR protectionDNN watermarkingRobust DNN watermarkingDeep learning securityWhite box watermarking

1 Introduction

Due to their excellent performance, DNNs are increasingly used in a variety of applications [1–3]. Machine learning as a service (MLaaS) is another common business model. by large enterprises. Even on powerful computers with multiple GPUs, training a DNN model is a resource-intensive task that requires a lot of data and computing power and can take weeks. DNN intellectual property rights (IPR) protection procedures and to monitor their use and reuse are becoming increasingly necessary. Researchers have proposed several watermarking techniques for protecting IPR, model authentication, and traceability as a solution to these problems [4–6].

Although DNN watermarks are based on some of the same principles and techniques as traditional media watermarks [7–9], the process of recovering a watermark after it has been embedded in a DNN is unique and requires the development of particular techniques designed just for this purpose [10–13].

Developing a watermarking system that can withstand network modifications and reuse is a major challenge for researchers [5]. While some methods have been shown to be robust to model pruning and weight quantization, most watermarking algorithms have limited robustness to retraining. Furthermore, no method has yet been able to achieve robustness against transfer learning, especially in the case where the retrained network is being used for a different task than the original network (also known as inductive transfer learning) [14].¹ This type of network reuse, which is common and can threaten the intellectual property rights of deep neural network models, makes it essential to develop a watermarking system that can handle this scenario.

However, In this work, white-box multi-bit watermarking technique was delivered to demonstrates exceptional resistance to network modifications and is also capable of surviving retraining in the most demanding instances of inductive transfer learning. Similar to several previously proposed approaches (e.g., [15–17]).

Our method employs a Spread Spectrum (SS) technique [9] in which the watermark is expanded over multiple DNN coefficients. To ensure that the magnitude of the DNN weights carrying the watermark is sufficient to withstand retraining and other modifications, the watermarking module in our method maintains their values right before training. subsequently, the watermarked weights are frozen and are not changed during the learning process. This differs significantly from previous research where a watermark term was inserted into the training loss function to implicitly embed the watermark during training [15, 16, 18, 19]. As a result, the ability to directly manipulate the location and magnitude of the watermarked coefficients was lost. To effectively implement this technique effectively, we need to pay attention to the following:

(i)

The existence of frozen weights of the watermark will not prevent the network from performing the task for which it was designed with great precision; indeed, This is not the case for high payloads and large spreading factors, when the number of watermark weights is substantial.

(ii)

to keep potential attackers from removing the watermark, the watermarked weights should not be readily detectable as explained in [20]. The latter issue is addressed by decreasing the Kullback-Leibler (KL) gap between the watermarked and non-watermarked weights for a particular watermark strength. This distribution of watermarked coefficients and pseudo random spreading sequence is then optimized.

Our proposed DNN watermarking algorithm has been tested and shown to be effective in image change detection and image classification through various architectural as well as classification tasks. The findings show that the suggested technique can sustain high payloads without affecting classification task accuracy. In addition, watermarking has been shown to be robust against common network modifications such as pruning, weight quantization, and retraining.

To summarize , the paper’s main contributions are:

A proposed algorithm for watermarking DNNs using spread spectrum techniques is presented. This method involves directly controlling and freezing the weights that will contain the watermark during the learning phase and choosing values for these weights that remain recognizable after potential modifications such as retraining.

The optimal distribution of the pseudo-random spreading sequence for the watermarked weights is determined Minimizing the KL distance between the distributions of watermarked and non-watermarked weights.

The effectiveness of this scheme is demonstrated through experiments with different DNN architectures and classification tasks. It is shown that high payloads can be embedded without compromising performance on the primary task, and that watermarking is robust against common modifications.

The remainder of this paper is organized as follows: In Sect. 2, a brief overview of previous research in DNN watermarking is given, highlighting the uniqueness of the proposed method compared to previous work. Section 3 discusses the notation used throughout the work and defines the watermarking needs. The algorithms for embedding and extracting the watermark are described in Sect. 4. The experimental setup is described in Sect. 5, and the experimental results are discussed in Sect. 6. Finally, conclusions are drawn and potential areas for future research are highlighted in Sect. 7.

2 DNN Watermarking History and Prior Art

To incorporate watermarking information into the intended task, DNN watermarking approaches take advantage of the high degrees of freedom and redundancy in the model weights of DNNs. To be effective, these schemes must balance the conflicting goals of unobtrusiveness (the ability of the watermarked network to perform its intended primary task), capacity (the amount of information that can be conveyed by the watermark), and robustness (the ability to retrieve the watermark from altered models, such as those that have been retrained or trimmed). Previous DNN watermarking efforts have sought to achieve robustness against network reuse to a significant degree [5, 21–24]. This concept of balancing competing goals is known as the watermarking trade-off triangle [10], originally introduced in the context of media watermarking.

A classification scheme for DNN watermarking methods was presented in [5]. The two categories of these methods are multi-bit and zero-bit. Since the message bits are included in the network for multi-bit watermarking, the detector must extract them individually. The detector in zero-bit watermarking just needs to authenticate the presence of a specific watermark. Furthermore, DNN watermarking methods can be divided into static and dynamic methods. In static approaches, the watermark is directly integrated into the internal trainable parameters of the network, which are often the weights. They are also referred to as “white-box watermarking” because both embedding and extracting static watermarks require access to the internal model parameters. References [15, 16, 18, 25–27] provide examples of static methods.

On the other hand, Dynamic watermarking mechanisms link the watermark to the network’s behavior when it is exposed to certain inputs, called key inputs or trigger inputs (see references [23, 28–31]). The network weights still contain the watermark, but they can only be determined passively by observing how the watermark affects the behavior of the network. This is often accomplished by reviewing the model’s output when inquired with a specific set of inputs. which allows black-box extraction of the watermark with only API access to the model. According to several research papers (references [32, 33]), the watermark is also associated with the activity maps of certain inner neurons, which necessitates the white-box extraction method.

Furthermore, in this work, we study static multi-bit watermarking methods. That developed by Uchida et al. in reference [15] is the seminal work in this area. In this method, to ensure the accurate extraction of embedded bits, during the training phase, a specific control parameter must be introduced to the loss function. the reference [25], shows a watermarking system for tracking traitors with anti-collusion capabilities was developed using Uchida’s method, one of several attempts to improve its performance. Another improvement is described in reference [34], Adam optimization usage was proposed as well as the confidential transformation matrix to increase resistance to pruning while maintaining a comparable level of watermark detectability. We present a new approach that uses orthogonal projections to address the challenge of watermark detection in DNNs optimized with Adam. This method is an improvement over previous methods as described in [16–19] and [15]. In particular, the strategy proposed in [16] allows for higher throughput and has less impact on the accuracy of the network, while maintaining a comparable level of resilience, unlike the method in [15].

A problem with current DNN watermarking techniques (both static and dynamic) is their lack of robustness when the network is reused or retrained. Reference [22] provides a static watermarking technique with increased resistance to retraining. In this approach, modifications to watermarked weights are penalized during retraining because watermarked weights are more sensitive to changes than non-watermarked weights. Thus, when the network is retrained utilizing the same data as initial training and weight quantization, this technique shows great resistance to weight quantization and fine-tuning, but is not robust enough to transfer learning.

In this study, We present a novel static, multi-bit DNN watermarking approach that is resistant to transfer learning and solves earlier shortcomings in DNN watermarking methods. Our approach is similar to that presented in [22] in that the watermark weights are fixed before training, but we achieve robustness to network manipulation in a different way by increasing the amplitude of the watermark weights while maintaining their statistical similarity to the other weights. Our method demonstrates a high degree of robustness to various network manipulations, including transfer learning, which was not possible with the zero-bit watermarking approach used in [22].

3 Notation, Watermarking Model and Requirements

3.1 Preliminaries

This section introduces the notation and the notions that we will use in the rest of the article.

We use $$\Phi $$ to represent an unprotected model that has been trained to perform a specific task without a watermark. The notation $$\Phi ^{m}$$ represents a model that is watermarked. The network’s loss function, commonly the cross entropy, is represented by $$\mathcal {L}$$. The average loss of he training set $$(\mathcal {X}, \mathcal {Y})$$ computed over all labeled data in is expressed by $$\mathcal {L}(\mathcal {X}, \mathcal {Y}, \Phi ^{m}).$$ for a watermarked model, and $$\mathcal {L}(\mathcal {X}, \mathcal {Y}, \Phi ).$$ for an unprotected model. We denote the vector containing bits of the watermark (sometimes called the watermark message) by $$\mathbf {b} \in \{0,1\}^{l}$$, where $$\mathcal {L}$$ is the number of bits of the watermark [35].

Tensors can be used to represent the weights of a network, where the dimensionality of each convolutional layer j is defined by the filter’s size, the number of filters, and the depth of the input. For convenience, the weight tensor for each layer can be flattened into a single vector, denoted $${\mathbf {w}}_{j}$$. The overall vector containing the weights for the entire network is denoted w. The vector mathbfb must be inserted into w to incorporate the bits of the watermark into the network weights. It is important that the functionality of the network is preserved while this process is performed. This is usually done during training to ensure that the network can continue to perform its primary task. It is not possible to directly control the unobtrusiveness of the watermarked weights, so this must be taken into account during the embedding process.

We refer to the set of indexes in the network weights where the watermark is hosted as $$\Omega $$, or the host index set. This refers to the items in $$\mathbf {w}$$ which selected to host The watermark’s message.² The number of elements in $$\Omega $$ is represented by n (usually $$n \geq l$$ ). The vector containing the weights of the watermark can be represented using this notation $${\mathbf {w}}^{m}=\left (w_{i_{1}}, w_{i_{2}}, \cdots , w_{i_{n}}\right ), i_{k} \in \Omega $$, although it may not be formally called as such, for simplicity we denote it as $${\mathbf {w}}^{m}=\left (w_{1}^{m}, w_{2}^{m}, \cdots , w_{n}^{m}\right )$$.

The vector of non-watermarked coefficients presented as $$\overline {\mathbf {w}}^{m}=\left (w_{j_{1}}, w_{j_{2}}, \cdots ,\right .$$ $$\left . w_{j_{n}}\right ), j_{k} \not in \Omega $$, which is basically stated as $$\overline {\mathbf {w}}^{m}=\left (\bar {w}_{1}^{m}, \bar {w}_{2}^{m}, \cdots , \bar {w}_{N-n}^{m}\right )$$, where N is the total number of model coefficients [35]. Nevertheless, it is important to note that regarding watermark embedding, there are two options: single-layer embedding and multi-layer embedding. We use the notation $$\Omega _{k}$$ to represent watermark set indexes in layer k. The equation $$p^{m}=|\Omega | / N \ times 100$$ can be used to indicate the fraction of watermarked weights in the network expressed by the symbol $$p^{m}$$. In case of calculation, multiply layer in number of weights k by $$N_{k}$$. The equation for the proportion of watermarked weights in layer K is $$p_{k}^{m}=\left |\Omega _{k}\right | / N_{k} \ times 100$$. In this work, we define $$f_{\boldsymbol {w}^{m}}$$ and $$f_{\overline {\boldsymbol {w}}^{m}}$$ as the empirical marginal distributions of the watermarked and non-watermarked weights respectively, based on the sequences $$\boldsymbol {w}^{m}$$ and $$\overline {\boldsymbol {w}}^{m}$$. $$E_{\boldsymbol {w}^{m}}$$ ( res. $$E_{\overline {\boldsymbol {w}}^{m}}$$ ) represent the empirical expectations computed from $$f_{\boldsymbol {w}^{m}}$$ ( res. $$f_{\overline {\boldsymbol {w}}^{m}}$$ )respectively. Finally, the KL distance between two continuous probability distributions f and g [36] is called $$\mathcal {D}$$, which is defined as $$\mathcal {D}(f\|\|g) = \int _{x \in \mathbb {R}} f(x) \log ( f(x)/g(x))$$.³

3.2 Watermark Specifications and Model

Using a secret key $$K=\{\Omega , \mathbf {x}\}$$, which contains details about the host layers and weights $$(\Omega )$$ as well as The purpose of this work is to include a watermark message b into the weights of a watermark model $$\Phi ^{m}$$ using the spreading sequence $$\mathbf {x}$$ used to spread message b over the watermark coefficients. This method uses a white-box watermarking method that requires white-box network access [5]. Other conditions must be met by the watermark.

Unobtrusiveness: the watermarked network’s capability to fulfill its intended purpose with the same precision as $$\Phi ^{m}$$ and $$\Phi $$ should not be affected by the watermark.

Integrity: The recovered watermark $$\hat {\mathbf {b}}$$ must be comparable, perfectly identical, to $$\mathbf {b}$$ without modifying the model. In other words, the Bit Error Rate (BER) should not change and should be low (preferably zero).

Robustness: even from a changed version of the network, the message $$\mathbf {b}$$ should be recoverable.

Payload: The size l of the $$\mathbf {b}$$ message or watermark payload should ideally be as large as possible.

We explore different types of model reuse and modifications often performed by network users in line with the robustness requirement, Retraining for fine-tuning and transfer learning, model reduction throughout parameter pruning, and model quantization are several instances.

Retraining: refreshing or adjusting any model through additional training is a common technique. In this process, called retraining, The network model is trained for either the same task or a new one for a specified number of epochs. When the model is re-trained to improve performance in the same domain on the same task, it is referred to as fine-tuning. This may involve using a subset of the original training data set or the same data set itself, and possibly altering the learning rate. Transfer learning, on the other hand, is a broader concept in which knowledge gained in one domain or task is used to train a model in a new domain or task. Transfer learning is a common practice because it is more efficient than training a new model from scratch [14]. The target and source tasks are identical in the transductive scenario, however, the target and source domains are different. In the inductive scenario, the target and source tasks are different, but the domain could be identical or different. In this case, A new network is trained for a different task utilizing the model trained for the previous task as the pre-trained solution. This task may be connected to the initial one, e.g., using a network that has already been trained on ImageNet to teach a model categorization.

The number of retraining epochs and the variations between the domain and task of retraining and that of the original model determine how much the model weights are modified during the retraining process. It can be argued that the weights are modified to a greater extent during transfer learning compared to fine-tuning, making it more challenging to achieve robustness in the first scenario.

Compression: DNN models often need to be modified For being utilized on devices with finite power or computational capabilities and to reduce memory requirements. Network pruning and weight quantization are two popular methods for model compression. Network pruning eliminates network weights with activation values below a certain threshold, while weight quantization reduces the numerical precision of model parameters by converting them from a floating-point representation to a lower-precision representation, often an integer. More precisely, model quantization can be described as follows:

(1)

$${\mathbf {w}}_{q}$$ refers to the quantized weights, $$w max $$ denotes the maximum possible value of the weights, and $$n b $$ denotes the number of bits required to express the quantized values.

It was found that the process of retraining a network is the most crucial aspect of reusing a DNN for watermarking purposes. Despite some DNN watermarking techniques showing high resistance to fine-tuning [22], currently, no method has been able to demonstrate robustness in the case of transfer learning.

4 Suggested DDN Watermarking Method

The watermark insertion procedure is detailed in Sect. 4.1, and the watermark retrieval procedure is covered in Sect. 4.2.

4.1 Reliable Watermarking Algorithm

The weights of network weights fluctuate over the training rounds. This is the fundamental idea we employ to implant a watermark that persists after re-training, even in the transfer learning scenario. Thus, the watermark can withstand retraining if we incorporate it in numerous large coefficients and keep the number of retraining epochs to a minimum. Although this concept seems straightforward, there are two major difficulties. First, we must ensure that the ability to train an effective network is not compromised by the presence of numerous large fixed coefficients. Second, We must guarantee that the large coefficients carrying the watermark are difficult to find and reject. We improve the similarity of the marked coefficient distribution to the nonmarked coefficient distribution to overcome these issues.

Specifically, our watermark embedding algorithm follows the following principles:

Message of information Before training, $$\mathbf {b}$$ is added, and the weights containing the watermark message are left alone during training.

The message $$\mathbf {b}$$ is effuse over different host weights when the message bits are encoded in $${\mathbf {w}}^{m}$$ via Whole Sample Spread Spectrum Watermarking [9]. This increases the robustness of the message. More specifically, the spreading factor $$S=n / l$$ and a pseudo-random sequence $$\mathbf {x}$$ of length $$n &gt; l$$ are used to modulate the l bits of the message. The $$\gamma $$ parameter can be used to set the intensity of the watermark.

The watermarked weights are set to almost exactly match the other weights by carefully choosing the spreading of the spreading sequence.⁴ To this end, we minimize the distance between the distributions of the watermarked and non-watermarked coefficients, which known as KL to make them as comparable as possible (see Sect. 4.1).

For a payload of l bits, the spreading factor S and the intensity $$\gamma $$ affect how unobtrusive and robust the payload is. In particular, the intensity $$\gamma $$ manages the detectability of the watermark, with recpect to a high gamma value making the watermark more obvious. As shown in Fig. 1, the watermark embedding algorithm consists of several steps, which are explained in more detail below.

A process flow diagram has the following flow, information coding, watermark embedding, and training w bar m within parentheses via b, K, W m, connected layers, and initialized network.

Fig. 1

Watermark embedding procedure

Watermark Embedding

The antipodal sequence $$\mathbf {u}$$ consisting of elements from the set $$-1,+1\}^{l}$$ is related to the sequence $$\mathbf {b}$$, i.e. $$u_{i}=1$$ ( res. $$-1$$ ) if $$b_{i}=1$$ ( res. 0 ). $$\mathbf {u}$$ is utilized to fit a spread spectrum sequence called $$\mathbf {x}$$ before embedding by modulating a block of coefficients in $$\mathbf {x}$$ with each element of $$u i$$ (as described in [9], which discusses direct sequence spread spectrum).

Formally, we generate a secret pseudo-random sequence $$\mathbb {R}^{n}$$ that has length $$n=S \cdot l$$, where S referred as the spreading factor (see Sect. 4.1) for more information on generating x). The symbol of the elements of x that correlate with indices from $$S(i-1)+1$$ to $$S i$$ is then changed with $$u i$$ for each I in[1, l]. The vector of watermarked coefficients $$w^{m}$$, shown in Fig. 1, is created as seen below:

(2)

The weight vector for the message bit $$b_{i}$$ is then represented as $$\left (w_{S(i-1)+1}^{m}, \cdots ,\right .$$ $$\left . w_{S i}^{m}\right )$$. The information provided by the watermark embedding block (see Fig. 1) is used to set the weights of the mesh at the locations denoted by $$\Omega $$ during the embedding phase. Depending on the private key K⁵ a random selection is made of the coefficients that will contain the watermark. It is much more likely that the weights associated with identical bits will be changed separately in future network updates, which is another advantage of randomly selecting the placement of watermarked weights, in addition to security

In network training, weights and biases are initially placed randomly to produce the initial weight vector $${\mathbf {w}}^{(0)}$$. Certain weights specified by the set $$\Omega $$ are set to predetermined values given by $${\mathbf {w}}^{m}$$. The network is then trained over the samples in the training set using the standard loss minimization method. During this training process, the watermarked weights $${\mathbf {w}}^{m}$$ are fixed and only the non-watermarked weights $$\overline {\mathbf {w}}^{m}$$ and biases are adjusted by backpropagation.

As mentioned earlier, watermarked weights are required to be as indistinguishable as possible from non-watermarked weights so that they cannot be quickly detected and attacked. This is achieved by choosing the distribution of $$\mathbf {x}$$ and consequently the distribution of $${\mathbf {w}}^{m}$$ such that the difference between watermarked and non-watermarked weights is reduced. This is discussed deeper in the section that follows.

Optimizing the Distribution of Weights with Water Markers

In this section, we address the question of the ideal distribution for generating the scattering pseudo-random sequence $$\mathbf {x}$$. Despite the fact that our ultimate objective is to maximize distribution of $$\mathbf {x}$$ (and hence the distribution of $${\mathbf {w}}^{m}$$), we find it helpful to view the optimization technique as reducing the weights $${\mathbf {w}}^{m}$$ at the beginning. Then we will see that the optimization of the weights can be reformulated as an optimization of the weight distribution $$f_{\boldsymbol {w}^{m}}$$ under some relaxed assumptions.

The following statement can be used to illustrate the difficulty of training a DNN with watermarking.⁶

(3)

The following optimization problem is solved to generate $${\mathbf {w}}^{m, *}$$ to reduce the difference between the weights that are watermarked and those that are not:

(4)

That also relies on $$\overline {\mathbf {w}}^{m}$$, with restriction as the following:

(5)

In case of maintaining the regular weight-bearing capability of the watermark.

In this work, we assume the proportion of watermarked weights is symmetrical for the purposes of this discussion (since the distribution of weights that are not watermarked is typically symmetrical, this applies w.o.g.). Assuming that the watermarked weights $$w_{j}^{m}$$, the weights obtained by Eq. (2) obtained weights $$w_{j}^{m}$$ have the same distribution as the pseudo-random sequence $$\mathbf {x}$$, Eq. (5) could be re-expressed as $$E_{\boldsymbol {w}^{m}}[|w|]=\gamma $$, independent of $$\mathbf {u}$$. This is due to the symmetry of the distribution.

A large $$\gamma $$ results in a stronger watermark that is more resistant to tampering, but can also have a negative influence watermarked model certainty $$\gamma $$ also plays a role in the security of the watermark. If the value of $$\gamma $$ is very large, i.e. $$E_{\overline {\boldsymbol {w}}^{m}}[|w|] \ll \gamma $$, then the watermark would be detectable when the weights are examined.

We also note that Eqs. (3) and (4) are related and difficult to answer because each of them contains the variables $${\mathbf {w}}^{m}$$ and $$\overline {\mathbf {w}}^{m}$$. However, the two minimization problems can be separated, if we assume that the presence of the watermark has no effect on the statistical distribution of the weights that are not watermarked:⁷

(6)

(7)

where $$\tilde {f}_{\overline {\boldsymbol {w}}^{m}}$$ represents thedisposal of the non-watermarked weights in a model $$\Phi $$ that is not watermarked but can solve the same task. Upon closer inspection, we find that the reduction in Eq. (6) is independent of the particular sequence and Depends exclusively on the probability density function of $$\overline {\mathbf {w}}^{m}$$. This allows us to reformulate the minimization as one over the distribution $$f_{\boldsymbol {w}^{m}}$$:

(8)

This gives the optimal distribution $$f_{\boldsymbol {w}^{m}}^{*}$$. As a result, the series $${\mathbf {w}}^{m, *}$$ appearing in Eq. (6) can be any sequence generated by $$f_{\boldsymbol {w}^{m}}^{*}$$, so we can preserve the confidentiality of the specific sequence $${\mathbf {w}}^{m *}$$.

The issue in formula (8) for a distribution of weights not watermarked $$\overline {\mathbf {w}}^{m}$$ is challenging to solve. We solve this issue in the following sections by assuming that a Laplacian distribution can be used to approximate the distribution of non-watermarked weights (this assumption is fair, as shown by our tests with different network designs and tasks (see Sect. 6.1)). Therefore, we can $$\tilde {f}_{\overline {\boldsymbol {w}}^{m}}(w)=\frac {1}{2 \lambda } e^{-|w| / \lambda }$$, i.e. $$\bar {w}_{i}^{m} \sim $$ Laplace $$(0, \lambda )$$. However, if we make this assumption, it is possible to solve problem (8) in closed form. The following theorem provides the answer.

The collection of symmetric distributions, denoted by $$\mathcal {F}$$, is represented by Theorem 1. The difficulty of minimization.

(9)

The solution to this issue is to identify all symmetric probability density functions $$f_{w}$$ that satisfy $$E[|w|]=\gamma $$ and have a maximum entropy distribution. The answer to this dilemma is $$f_{w}^{*}=\frac {1}{2 \gamma } e^{-|w| / \gamma }$$. Since each element $$w_{i}$$ for I in $$i \in \Omega $$ is selected from the Laplace distribution, which has a mean of 0 and a scaling parameter of $$\gamma $$, it is the optimal distribution of the weights of the watermark.

Proof

We note that:

(10)

and in view of this we can reformulate $$E[|w|]=\gamma , 9$$ into

(11)

that $$h(f)=-\int _{x} f(x) \log f(x) d x$$ denotes differential entropy. Equation (11) is similar to determining the probability density function with the highest entropy dispersion among all functions satisfying $$E[|w|]=\gamma $$ [36]. By splitting the differential entropy function into separate integrals over the negative and positive supports and using the symmetry of $$f_{w}$$, we can rewrite it as follows:

(12)

In the subsequent equality, we state:

(13)

As a result, we can also solve the following issue in order to determine the entropy maximising distribution in Eq. (11):

(14)

The distribution we are looking for in Eq. (14) is the highest entropy distribution between all probability density functions with support $$[0, \infty )$$ that satisfy $$E[w]=\gamma $$. There is a solution to this problem ([36], Ex 12.2.5) and is given by $$f_{w}^{\prime }=\frac {1}{\gamma } e^{-|w| / \gamma }$$, $$w \geq 0$$. This leads to the following result:

(15)

Theorem 1 states that the distribution $$f_{\boldsymbol {w}^{m}}^{*}= \frac {1}{2 \gamma } e^{-|w| / \gamma }$$ must be used to construct the watermark weights, which means that $${\mathbf {w}}^{m, *}$$ is drawn from a Laplace distribution with mean $$\mathbf {w}$$ and scale parameter $$\gamma $$. We can follow this process as follows: We start by generating a pseudo-random sequence named x using a $$\operatorname {Laplace}(0, \gamma )$$ distribution. The scattering sequence is then modulated based on the watermark message using Eq. (2), generating a vector of weights watermarked $${\mathbf {w}}^{m, *}$$ still derived from a $$\operatorname {Laplace}(0, \gamma )$$ distribution.

4.2 Watermark Extraction

To get the watermark, you need to know the indices of the watermarked weights and the pseudo-random sequence $$\mathbf {x}$$. The vector $${\mathbf {w}}^{m}$$ obtained by retrieving the weights of $$\Phi ^{m}$$ at the locations labelled $$\Omega $$ to extract the watermark. The i-th bit of the watermark is then extracted as follows:

(16)

Also, BER is calculated as $$=\left (\sum {i}(\mathbf {b} \oplus \right .$$ $$\left .\hat {\mathbf {b}}){i} / l\right ) \times 100$$, where $$\oplus $$ refers to the bitwise XOR operation and l is the length of the watermark message [35].

We note that $$\hat {\mathbf {b}}$$ is a priori equivalent to $$\mathbf {b}$$ as long as the watermarked model has not been modified. According to conventional watermarking theory, methods [9] that embed the watermark in the host signal by adding a signal-dependent perturbation to it can achieve this property. Our DNN watermarking algorithm takes a slightly different approach. The watermarked weights are first fixed, and then the remaining weights are defined in a way that depends on the watermark and, together with the fixed weights, accomplishes the network’s task.

5 Experimental Methodology

We have tested the effectiveness of the proposed DNN watermarking technique with different network architectures and classification tasks. In the following sections, In this section, we discuss the architectures, datasets, and experimental conditions that we employed in our research.

5.1 Host Networks and Tasks

In our work, we evaluated the performance of the watermarking technique on tasks from two different application domains: Pattern Recognition, and Image Forensics. Specifically, we investigated the task of distinguishing images generated by Generative Adversarial Networks (GANs) from natural images [37](GAN detection), traffic sign classification using the GTSRB dataset [38] and object classification using the CIFAR-10 dataset [39]. These tasks allow us to evaluate the performance of our methodology in a variety of contexts, including binary classification (GAN detection) as well as multi-class classification (for GTSRB there are 43 classes and for CIFAR-10 there are 10 classes). For each activity, we have chosen a network design that achieves top performance.

For the GAN detection task, we used the XceptionNet architecture to distinguish between natural face images versus face images generated by the StyleGAN2 model [40]. XceptionNet is known for achieving top performance in this task [41]. The network was trained for 10 epochs with the Adam optimizer at a learning rate of $$0.01$$ and a stack size of 32. More information about the training of the network and the dataset can be found in the repository [42]. For GTSRB and CIFAR-10 classification, we trained a DenseNet169 architecture [43]. In particular, for GTSRB, the network was trained for 20 epochs using the Adam optimizer trained with a learning rate of $$0.001$$ and a batch size of 64 epochs, achieving benchmark accuracy (https://​benchmark.​ini.​rub.​de/​). Using the parameter settings specified in [44], we trained the network for CIFAR-10 classification and once more achieved cutting-edge performance. We did not use any data augmentation in any of our tests.

It is worth noting that although they have a the same number of parameters (about $$21 \ times 10^{6}$$ for DenseNet and $$13 \times 10^{6}$$ for XceptionNet), XceptionNet and DenseNet have very distinct architectures in terms of depth (603 layers for DenseNet and 136 layers for XceptionNet) and internal structural connections [35]. Connections of the block in the XceptionNet architecture are fairly standard, on the other hand, DenseNet has intense blocks in which each convolutional layer is linked to every other layer in a feed-forward [35]. The DNN watermarking algorithm and network training were performed using TensorFlow 2.5.0 and the Keras API. Code to reproduce the results is available at https://​github.​com/​andreacos/​Deep-Neural-Networks-Robust-Watermark.

5.2 Watermarking Algorithm Configuration

The efficiency of the watermarking algorithm was evaluated by applying it in single-layer and multi-layer embedding scenarios. One could argue that the use of multiple embedding layers is essential for large payloads or spread factors (i.e., when the value of n is very large). In these cases, the percentage of watermarking may be too high for single-layer embedding, leading to degradation of network performance, as shown in our experiments.

Tables 1 and 2 contains an analysis of the watermark layers evaluated in our experiments with XceptionNet and DenseNet. In all of our experiments, watermarking was embedded in the convolutional layers from the middle to the bottom. The variance of the non-watermarked weight distribution for each layer ($$\left (\sigma _{k}^{2}\right )$$) and the total number of weights ($$\left (N_{k}\right )$$) are also given [35]. When comparing the variance of the distribution of weights between the two networks, there is a clear distinction. The variance of the weights in DenseNet is much smaller compared to those of the weights in XceptionNet. This difference is mainly due to the different structures of the two networks and is observed in all tasks. As a result, a larger watermark strength can be used for XceptionNet can be used without compromising indistinguishability.

Table 1

An overview of host layer settings

Architecture

Single/multi-layer

Host layers

XceptionNet

1 layer

block14_sepconv2

2 layers

block14_sepconv1, block14_sepconv2

4 layers

block13_sepconv1, block13_sepconv2, block14_sepconv1, block14_sepconv2

DenseNet

1 layer

conv5_block16_1

2 layers

conv5_block16_1, conv5_block20_1

4 layers

conv4_block16_1, conv4_block20_1, conv5_block16_1, conv5_block20_1

Table 2

An overview of sample data

Architecture

Single/multi-layer

sigma Subscript k Superscript 2)

XceptionNet

1 layer

1.8098

13,824

2 layers

[1.1378, 1.8098]

[9,216, 13,824]

4 layers

[2.3441, 0.4284, 1.1378, 1.8098]

[6,552, 6,552, 9,216, 13,824]

DenseNet

1 layer

0.00069

143,360

2 layers

[0.00069, 0.00057]

[143,360, 159,744]

4 layers

[0.00056, 0.00062, 0.00069, 0.00057]

[94,208, 110,592, 143,360, 159,744]

For simplicity, we used identical sets of weights in each layer for the multilayer embedding, which means that $$\left |\Omega _{k}\right |$$ is the same for all values of k considering that the host layers contain various numbers of parameters, the percentages of watermarked weights are ($$p_{k}^{m}$$) vary in the different layers. These percentages are not included in the table since they vary depending on the watermark settings (i.e., payload l and spreading factor S) [35]. For a given host layer k, the watermark is embedded proportionally with different strengths $$\gamma $$ on the standard deviation of the distribution of non-watermarked weights in citearXiv:2208.10973. More specifically, in our experiments we set $$\gamma =C \sigma _{k} / \sqrt {2}$$ and varied the parameter C to adjust the strength of the watermark. Using this definition of $$\gamma $$, we observed that the variation in the distribution of watermarked weights is proportional to $$\sigma _{k}^{2}$$ with a constant value of $$C^{2}$$ (since the variance of a Laplace($$(\mu , \gamma )$$) distribution is equal to $$2 \gamma ^{2}$$). Therefore, a value of $$C=1$$ corresponds theoretically to the case where the distributions⁸ indistinguishable. In our watermarking experiments, we used values of $$C \in [1,2]$$. For a more in-depth discussion of this, see Sect. 6.1.

5.3 Setting for Robustness Analysis

We investigated the larger setting of inductive transfer learning for the transfer learning scenario, in which the watermarked models are re-trained for a new task and domain.

More specifically, the watermarked models were used as they were trained prior to the solutions, and the retraining was performed using the usual cross-entropy loss $$\mathcal {L}$$. In this phase, we also revise the weights that are watermarked. We considered two transfer learning scenarios:

1.

Different task with same number of classes. We retrained the model that was originally trained to handle the binary GAN detection task to address a new two-class classification issue, categorizing photos of cats and horses. The retraining was performed on $$20 \mathrm {~K}$$ images from the LSUN dataset [45].

2.

Different tasks with different class sizes.We retrained the model that was previously trained on GTSRB data (43 classes) to tackle the CIFAR-10 classification issue (10 classes).

The networks are trained on the new task for 10 epochs in both scenarios, which is sufficient to achieve high accuracy on the new task. Additional training beyond 10 epochs does not lead to significant further loss reduction. To evaluate the robustness of the watermarked models in fine-tuning, we trained them on a subset of $$70 \%$$ of the original training data for an additional 10 epochs. We found that this did not significantly affect the performance of the models.Furthermore, we experimented with fine-tuning on $$30 \%$$ of the original dataset for the GAN detection task, where many images are available for training, and obtained similar results.

6 Findings and Analysis

Depending on the outcomes that we get by implemanting our methodalgy we present in this sec the results of experiments designed to show that the algorithm is capable of embedding large payloads in host models without affecting their behaviour (Sect. 6.1) and that it is highly resistant to network modifications and reuse (Sect. 6.2). We demonstrate that the watermark persists through transfer learning, a capability not achieved by existing methods.

6.1 Performance of Watermarked DNN Models

In this section, we interpret the watermarking influance on the classification accuracy of the host model. We assess the watermarked models’ performance by determining the test Error Rate (TER), which is defined as TER = $$=100\%$$—ACC, where ACC reflects the accuracy of the network’s classification task.

Table 3 shows the outcomes of our experiments on the GAN detection task for different payload sizes $$(l)$$, watermark strengths $$(C)$$, and spreading factors $$(S)$$ [35]. Table 3 contains the total number of weights watermarked $$(|\Omega |)$$ for each experiment. The TER of the baseline for non-watermarked model is $$0.55 \%$$ and since the position of the host weights is known during the extraction process, the integrity requirement is automatically satisfied [35]. As a result, the BER is always 0 (not listed in the table). In most cases, the watermarked models perform well, with a Test Error Rate (TER) similar to that of the baseline model. Most of the time, there is very little TER difference between the baseline model and the watermarked models. When the spreading factor S is increased to 18 with a payload size $$l=1024$$, the number of watermarked bits becomes large $$|\Omega |=18432$$ and embedding all these bits in only two layers leads to a very large $$p^{m}$$ (where the layers are almost saturated), which affects the unobtrusiveness of the watermark. This can affect the performance of the watermarked model. In this case, if the 4-layer setting is used to embed the watermark (as shown in the table), TER $$=4.4 \%$$. The high occupancy (over $$70 \%$$) of the first two layers in this case has a negative impact on the TER.

Table 3

On the GAN detection challenge, the effectiveness of DNN watermarked models. Standard TER is 0.55%

l

S

C

Layers

$$p^m_k$$ %

TER %

256

1

1

1

256

1.8

0.6

3

1

1

768

5.55

0.4

12

1

1

3072

22.22

1.3

12

1.5

1

3072

22.22

1.0

18

1

1

4608

33.33

0.6

18

1

2

4608

[25, 16.67]

0.6

1024

6

1

2

6144

[33.33, 22.22]

1.0

12

1

2

12228

[66.34, 44.44]

1.0

18

1

4

18432

[70.32, 70.32, 50.00, 33.33]

4.4

2048

6

1

4

12288

[46.88, 46.88, 33.33, 22.22]

1.0

It is usually necessary to distribute the watermark weights over several layers, so that the proportion of watermark weights in one layer is not too high, in order to be able to embed large payloads without significantly affecting the constraint on unobtrusiveness.

Table 4 shows the results of the watermark experiments for the GTSRB classification task, including single and multi- layer embedding. The BER is not shown because it is always 0. The TER of the baseline, a non-watermarked model is $$6.12 \%$$. In several cases, the TER of the watermarked models is even lower than that of the baseline model, suggesting that the watermark may act as a regularizer in these cases. We obtained similar results for the CIFAR-10 classification task. The TER of the watermarked models improved over the baseline model in all cases, likely due to the regularization effect of the watermark. These results are summarized in 7, columns 5 and 6.

Table 4

DNN watermarked model performance for GTSRB classification. Standard TER is 6.12%

l

S

C

Layers

$$p^m_k$$ %

TER %

256

1

1

1

256

0.18

5.76

3

1

1

768

0.53

5.12

6

1

1

1536

1.07

5.63

1024

1

1

1

1024

0.7

5.42

6

1

2

6144

[2.14, 1.90]

5.49

6

2

2

6144

[2.14, 1.90]

5.20

20

1

2

20480

[7.14, 6.41]

6.79

25

1

4

25600

[6.79, 5.78, 4.46, 4.00]

4.62

2048

1

1

2

2048

[0.71, 0.64]

3.69

15

1

2

30720

[10.71, 9.61]

6.67

25

1

2

51200

[17.85, 16.02]

6.12

25

1.5

2

51200

[17.85, 16.02]

5.15

25

1

4

51200

[13.58, 11.57, 8.92, 8.01]

5.52

30

1

2

61440

[ 21.42, 19.23]

5.80

40

1

4

81920

[21.73, 18.51, 14.28, 12.82]

5.03

Analysis of Weights Distribution (Watermark Security)

A examination accomplished on the weight distributions of both types of models to test the assumption of the theoretical analysis that the distribution of non-watermarked weights is the same for watermarked and non-watermarked models. This assumption is based on the notion that the distribution of the non-watermarked weights is not significantly changed by the watermark.

Figure 2 investigates the distribution of non-watermarked weights 2 in two scenarios—an Xception-based GAN detector (first row) and a DenseNet-based GTSRB classifier—in non-watermarked (left) and watermarked (right) models (second row). The watermark settings for the GAN detector are $$l=256$$, $$S=18, C=1$$ and 2-layer embedding, while the settings for the GTSRB classifier are $$l=1024, S=25, C=1$$ and 4 layers [35]. Similar behavior is observed in other settings. Examination of the distribution of weights in non-watermarked models shows that they roughly approximate a Laplacian distribution (as indicated by the Laplacian fit plotted in the figures). The shape of the distribution is the same for watermarked and non-watermarked models, indicating that the absence of the watermark has no discernible effect on the distribution of weights overall.

2 sets of 2 graphs of weights count versus w labeled A and B. Graphs of A plot wide peaks of non-watermarked net and watermarked net with Laplacian fit between negative 5 and 5 on the x-axis. Graphs of B plot narrow peaks of the same between negative 0.5 and 0.5 on the x-axis. All values are estimated.

Fig. 2

Weight distributions for non-watermarked (left) and watermarked (right) models, XceptionNet-based GAN detection (a) and DenseNet-based GTSRB classifier (b), and watermark settings in the right plots are: $$l = 256$$, $$S = 18$$, $$C = 1$$, 2-layer, for the GAN detector and $$l = 1024$$, $$S = 25$$, $$C = 1$$, and 4-layer, for the GTSRB classifier [35]

Figure 3 demonstrates the weight distribution in the embedding layer for the GAN watermark model and the GTSRB watermark models, using the same setting as in Fig. 2. The top left and top right plots show the difference between the watermarked and non-watermarked versions of the Laplacian distribution. The bottom diagram in Fig. 3 shows the distribution of watermarked (red) and non-watermarked (blue) weights in the embedding layer for a GTSRB watermarking model using a much larger number of watermarked weights, namely $$l=2048, S=25$$, $$C=1$$, 4-layers, resulting in $$|\Omega |=51200$$ (vs $$|\Omega |=25600$$ for the other setting) [35]. The name of the embedding layer being visualized is included in the plots.⁹

3 graphs of weight count versus w. All 3 graphs plot stacked non-watermarked and watermarked peaks with a fluctuating trend between negative 5 and 5, and negative 0.1 and 0.1, respectively. The top right and bottom graphs have the highest fluctuations. All values are estimated.

Fig. 3

Weights of embedding layers are distributed. From top left to bottom right: XceptionNet-based GAN detection model watermarked by $$l = 256$$, $$S = 18$$, $$C = 1$$, 2-layers (shown is block14$$\_$$sepconv2); DenseNet-based GTSRB classification model watermarked by $$l = 1024$$, $$S = 25$$, $$C = 1$$, and 4-layers (shown is conv4$$\_$$block20); DenseNet-based GTSRB classification model watermarked by $$l = 2048$$, $$S = 25$$, $$C= 1$$, 4-layers (shown conv5$$\_$$block16)

The graph illustrates the distribution of weights of the watermarked layer ‘block14_sepconv2’ in the GAN detection model. The sample variance of the distribution of watermarked weights and the sample variance of the distribution of non-watermarked weights are very similar when $$C=1$$, where the former is $$\sigma _{k}=1.3252$$ and the latter is $$\sigma _{k}$$ $$1.3205$$ (as shown in the figure) [35]. This indicates that the security of the system is strong, since the variance of the weights is similar with and without watermarking.

The left graph illustrates the distribution of non-watermarked weights for the watermarked and non-watermarked detection models GAN, while the distribution of non-watermarked weights for the watermarked and non-watermarked classification models GTSRB is shown in the right graph.

It is important to remember that the similarity of this distribution and the variance of the non-watermarked weights between watermarked and non-watermarked models is due to the accuracy of the approximation made in the theoretical analysis, which assumes that the distribution of non-watermarked weights in a given layer remains similar whether the model is watermarked or not. The figure contains histograms of the weights of the layer ’conv4_block20’ and ‘conv5_block16’ for the watermarked models of the GTSRB, using the two settings described previously. For the ‘conv4_block20’ layer in the watermarked GTSRB models, the variance of the watermarked weights is $$6.35 \times 10^{-4}$$ and the variance of the non-watermarked weights is $$6.20 \times 10^{-4}$$. Similarly, for the ’conv5_block16’, the variance of the watermarked weights is $$6.88 \times 10^{-4}$$ and the variance of the non-watermarked weights is $$6.87 \times 10^{-4}$$ [35]. Figure 3 shows the KL (Kullback-Leibler) distances between the distributions of watermarked and non-watermarked weights for three different settings and embedding layers. The KL distances for these three settings are $$0.066,0.0179$$ and $$0.0897$$, respectively. The KL distance is a measure of the difference between two probability distributions, with a smaller KL distance indicating that the two distributions are more similar.

6.2 Robustness Assessment

In this section, we present the results we used to test the robustness of their proposed watermarking algorithm to various modifications commonly applied to neural networks. These modifications include parameter pruning and quantization of weights (forms of network compression), transfer learning, and fine-tuning (in which the network is retrained). The results of these tests will help determine the robustness of the watermarking algorithm in the face of these modifications. One of the most important aspects of the robustness analysis is the ability of the watermarking algorithm to withstand retraining, particularly in the case of transfer learning. This is a particularly challenging requirement, as previous watermarking algorithms have struggled to maintain the watermark after retraining. Therefore, the focus of our results is on the robustness of the watermarking algorithm to retraining. Overall, our findings indicate that the watermark embedded with a value of $$C=1$$ is highly resistant to various types of network modifications and reuse when the spreading factor (S) is sufficiently large.

Model Compression

Parameter pruning, in which a certain part (p) is set to zero for the weights in the convolutional layers, is a simple technique for compressing a model. The size of the model can be efficiently reduced in this way. The weights are reduced according to their absolute values, starting with the smallest weights, as is common practice. The watermark is then removed using conventional techniques. A variety of pruning fractions (p) are evaluated to assess the effectiveness of the model. The top figure in Fig. 4 shows the outcomes obtained for the XceptionNet-based GAN detector, and the figure in the bottom for the DenseNet-based GTSRB and CIFAR-10 classifiers. For each model, the TER and BER are shown for various values of p. The parameter settings used for the watermarked GAN detection network were $$l=256$$, $$S=18$$, $$C=1.2$$ layers. The GTSRB classifier is watermarked with $$l=1024$$, $$S=25$$, $$C=1.4$$ layers, and the CIFAR-10 classifier is watermarked with $$l=1024$$, $$S=25$$, $$C=1.2$$ layers. In the case of the CIFAR-10 classifier, the TER-Top3 values are reported (the behavior of TER-Top1 is similar as p increases).¹⁰ Similar behavior is observed for other watermark settings. It can be seen that parameter pruning has little influence on the TER as long as p is less than 0.4. The BER remains at 0 in all cases until p reaches 0.6, and starts to increase when the network becomes unusable (TER $$\geq 50\%$$). This demonstrates the robustness of the watermark to model pruning.

3 double-line graphs of values from 0 to 60 and 0 to 100 versus p. The top two graphs plot the B E R and T E R in percentage lines with an increasing trend that starts linearly. The bottom graph plots B E R and T E R top 3 in percentage lines with an increasing trend that starts linearly.

Fig. 4

Robustness vs parameter pruning as a function of the pruning fraction p. From top left to bottom right: watermarked GAN detector by $$l= 256$$, $$S=18$$, $$C = 1$$, 2-layer embedding; watermarked GTSRB classifier by $$l = 1024$$, $$S = 25$$, $$C = 1$$, 4-layers embedding; watermarked CIFAR-10 classifier by $$l = 1024$$, $$S = 25$$, $$C = 1$$, 2-layers embedding [35]

Moreover, the proposed watermarking method is robust to weight quantization. We specifically tested whether BER remains unaffected by conversion to int32, int16, int8, or int4 in all settings evaluated for the various tasks, nevertheless TER grows to a value above or near $$50 \%$$ (depending on the task) for int8, i.e., when $$n_b$$ = 8 bits are considered for quantization. Because the quantization procedure retains the sign of the weights, it does not affect the robustness of the quantization results or the extraction of the watermark.

Retraining

Furthurmore, Table 5 shows the results of experiments in which the watermarked XceptionNet was retrained for GAN detection using fine-tuning and transfer learning. As explained in Sect. 5.3, fine-tuning is performed on a subset of 70% of the original dataset, while retraining for transfer learning is performed using the cat & horse LSUN classification task. The outcomes are presented for different payloads, strengths, and spreading factors.

Table 5

Robustness of GAN detection watermarked model against transfer learning to cat&horse classification and fine-tuning (on 70% of the dataset). The baseline TER for cat&horse classification is 3.3%. L = Layers. FT = Fine Tuning. TL = Transfer Learning. The BER values below 1% are highlighted in bold

After FT

After TL

l

S

C

Layers

TER %

BER %

TER %

BER %

256

1

1

1

0.1

6.25

7.82.

16.79

3

1

1

0.5

0

7.48

4.69

12

1

1

1.4

0

5.10

1.17

12

1.5

1

0.6

0

8.30

0

18

1

1

0.1

0

7.50

0.95

18

1

2

0.1

0

7.50

0

1024

6

1

2

0.6

0

7.74

2.34

12

1

2

0.5

0

8.27

0.78

18

1

4

0.4

0

6.03

0.09

2048

6

1

4

0.2

0

8.85

1.02

It can be observed that BER is always zero after fine-tuning (except when no spreading is used, i.e., when $$S=1$$), indicating that robustness to fine-tuning is achieved in all settings. In terms of robustness to transfer learning, it can be seen that for $$l=256$$, a BER of 0 is achieved in the settings $$S=12, C=1.5$$ and $$S=18, C=1$$. In the $$S=12, C=1$$ setting, the BER is $$1.17\%$$. This demonstrates that increasing the spread factor has a similar effect as increasing the watermark strength (C). This behavior is also observed in the experiments for GTSRB and CIFAR-10, as described below.

We observed that the TER after transfer learning is slightly higher than the baseline for the cat & horse LSUN classification task. This could be because transferring knowledge from GAN detection to cat & horse classification is not straightforward, as these are two very different tasks.

Tables 6 and 7 show the results obtained by retraining the GTSRB and CIFAR-10 classifiers with DenseNet. Table 5 compares the robustness of the GTSRB watermarked models to fine-tuning and transfer learning on CIFAR-10, using Top-1 and Top-3 TER values. These values are similar to those obtained by the baseline model trained on CIFAR-10, which has TER -Top-1 =$$=19.67 \%$$ and TER -Top3 $$=5.62 \%)$$. In contrast, 7 evaluates the robustness of the CIFAR-10 watermarking model to fine-tuning and transfer learning on GTSRB, showing that the TER values obtained by training the model from scratch are achieved.

Table 6

Robustness of GTSRB watermarked model in CIFAR-10 classification and fine-tuning (on 70% of the dataset). After retraining, the TER and BER (%) are displayed. For CIFAR-10, the baseline TER is 19.67% ( Top-1) and 5.62%. (Top-3). L for layers. Fine Tuning, or FT. Transfer Learning is TL. Bold text highlights BER values less than 1

After FT

After TL

l

S

C

Layers

TER

BER

TER-Top1

TER-Top3

BER

256

1

1

1

4.49

18.75

23.76

5.33

10.15

3

1

1

4.57

11.71

22.84

5.3

3.12

6

1

1

3.86

0

24.36

5.53

0

1024

1

1

1

4.57

25.88

24.31

5.98

14.16

6

1

2

6.23

9.66

24.63

5.76

0.09

6

2

2

4.03

2.54

23.13

5.49

0

20

1

2

4.63

0.97

23.44

5.16

0

25

1

4

4.96

0.09

24.11

6.01

0

2048

1

1

2

4.58

20.21

23.74

5.55

5.03

15

1

2

6.37

0.83

24.73

5.58

0

25

1

2

4.47

0.29

28.63

7.01

0

25

1.5

2

3.13

0.09

24.07

5.07

0

25

1

4

5.34

0.04

22.37

4.98

0

30

1

2

4.16

0.14

24.46

5.29

0

40

1

4

4.63

0

24.21

5.75

0

Table 7

Performance and robustness of the CIFAR-10 watermark model to transfer learning on GTSRB and fine-tuning (on 70% of the dataset). The baseline TER for CIFAR-10 is 19.67% ( Top-1) and 5.62% ( Top-3). The baseline TER for GTSRB is 6.12%. L = Layers. FT = Fine Tuning. TL = Transfer Learning. The BER values below 1% are highlighted in bold

TER

After FT

After TL

l

S

C

L

Top1

Top3

TER

BER

TER-Top3

BER

256

1

1

2

14.65

2.42

1.98

14.45

6.11

33.20

20

1

2

13.55

2.34

2.20

0

6.05

1.95

40

1

2

14.11

2.29

2.25

0

4.89

0.01

1024

1

1

2

14.15

2.50

1.95

19.04

5.29

25.98

25

1

2

14.01

2.08

1.94

0

4.90

1.17

25

2

2

14.00

2.33

2.36

0

5.09

0

30

1.5

2

14.34

2.71

2.42

0

4.62

0

40

1

2

13.70

2.16

2.97

0

7.47

0.48

40

1

4

14.33

2.57

1.71

0

4.66

0.19

2048

25

1

4

13.92

2.34

2.21

0.09

5.74

0.29

The results show that when using DenseNet models in both the GTSRB and CIFAR-10 cases, a larger spread factor is required to achieve a BER of 0 after retraining. This could be because the distribution of weights in DenseNet models is more concentrated around 0 and has lower absolute values compared to XceptionNet models, making it easier to change the sign of the weights and significantly affecting the accuracy of the watermark. In these situations, a larger spread factor must be used to increase the robustness of the watermark. While the XceptionNet GAN detector can achieve a BER $$\leq 1 \%$$ after fine-tuning or transfer learning with all payloads at a spreading factor of $$S=12(C=1)$$, the GTSRB and CIFAR-10 classifiers generally require a spreading factor of S greater than 20.

The Table 6 demonstrate that the GTSRB watermarked models can effectively resist both fine-tuning and transfer learning attacks when a fixed value of $$C=1$$ is used, with a BE $$&lt; 0.1 \%$$ for all payload settings at $$S=25$$. Analyzing the CIFAR-10 data, we see that a value of $$S=25$$ (with $$C=1$$ ) is sufficient to achieve BER$$=0$$ or nearly 0 (for $$l=2048$$ ) after fine-tuning, but not sufficient to achieve the same low BER in the transfer learning task. To achieve robustness in the retraining scenario with a BER $$&lt; 0.1 \%$$, a value of $$S=40$$ is required. In addition, the tables show that for the CIFAR-10 classification, it is more difficult to achieve a BER close to 0 after transfer learning than after fine tuning. For the GTSRB classification, the BER obtained after fine-tuning is larger than the BER obtained after transfer learning. This means that it is easier to achieve robustness to transfer learning in GTSRB classification and less stringent values for S and C are required.

Ultimately, it does not matter whether the watermark is hidden in fewer layers with a higher percentage of hosting weights or in more layers with a lower percentage of hosting weights. There is no discernible advantage unless the percentage of embedding weights in each layer is high.

Comparison with the State of the Art

In this part, we compare our methodology to the white-box multi-bit DNN watermarking methods previously published by Uchida et al. [15] and $$\mathrm {Li}$$ et al. [16]. We used the code presented by the authors to implement these methods and applied them to watermark the DenseNet-40 architecture. We followed the training procedure described in [16], where the watermark is inserted into the first convolutional layer of the second dense block. In our comparison, we used DenseNet-40 trained on CIFAR-10 and GTSRB, and tested different payload values of $$l=128, 256$$, and 1024. Table 8 compares the results of the different techniques with our new technique. The results of this study include the TER ( Top3 for CIFAR-10) and BER of the watermarked models, as well as their robustness to fine-tuning and transfer learning. To ensure a fair comparison, all state-of-the-art methods were fine-tuned by training the watermarked networks for an additional 10 epochs on $$70 \%$$ of the original dataset. In addition, transfer learning was performed for the same number of epochs from CIFAR-10 to GTSRB in one case and GTSRB to CIFAR-10 in the other case. For our method, the performance results are presented for the embedding option with 2 layers, except for the case with a payload of 128, where the watermark was embedded in a single layer. In the cases $$l=256$$ and $$l=1024$$, the results for the best watermark settings with $$C=1$$ are shown in the Tables 6 and 7. The table shows that both the method of Uchida et al. and that of Li et al. have good unobtrusiveness. However, Li’s method has a better BER for watermarking models, especially for large payloads. In fact, the BER for the method of Uchida et al. [15] for large payload data above $$10 \%$$, which is consistent with the results in [16].¹¹ Neither method, however, is resistant to fine-tuning. Uchida’s method is slightly more robust when the payload is very small ($$l=128$$), resulting in a BER of $$=9.37 \%$$ for GTSRB and $$6.25 \%$$ for CIFAR10. Transfer learning further degrades the robustness of these methods, with Uchida’s method consistently yielding a BER of more than $$17 \%$$ and Li’s method yielding a BER of about $$50 \%$$. The proposed scheme, on the other hand, shows high robustness to fine-tuning and relearning for all payloads considered.

Table 8

Comparison with current techniques. TER and BER are presented (FT = fine-tuning. TL = transfer learning). The baseline accuracy is 6.12% for GTSRB and 5.62% (Top-3) for CIFAR-10. The outcomes of the BER following the retraining are bolded

Uchida et al. [15]

Li et al. [16]

Proposed

After FT

After TL

After FT

After TL

After FT

After TL

Task

Payload

TER

BER

TER

BER

TER

BER

TER

BER

TER

BER

TER

BER

(S,C)

TER

BER

TER

BER

TER

BER

GTSRB

128

5.97

3.12

1.66

9.37

4.97

17.18

4.44

0

4.33

50.00

3.64

48.43

(12,1)

4.20

0

3.95

0

5.64

0

256

5.54

6.64

6.47

24.21

4.58

45.31

3.89

0

2.06

46.48

9.17

49.60

(6,1)

5.63

0

3.86

0

5.53

0

1024

2.85

14.16

5.06

27.14

3.54

29.39

4.15

4.39

5.79

48.92

4.63

49.90

(20, 1)

6.79

0

4.63

0.97

5.16

0

CIFAR-10

128

3.73

1.56

2.55

6.25

5.06

17.18

3.70

0

5.84

53.12

8.42

42.96

(12,1)

2.57

0

2.47

0

5.83

0

256

5.23

4.68

4.61

19.14

4.34

23.43

4.12

0

2.87

51.95

4.30

50.00

(40,1)

2.29

0

2.25

0

4.89

0.01

1024

4.08

13.37

5.17

26.85

2.59

32.32

2.69

1.46

4.07

51.36

7.89

51.17

(40,1)

2.16

0

2.97

0

7.47

0.48

7 Conclusion Stage

We developed a white-box DNN watermarking algorithm that uses a novel information embedding method to strengthen the watermark’s resistance to network configurations and reuse. The position of each fixed weight in the set is determined by a secret key and remains constant throughout training, with the watermark message distributed among them. The watermarked weight distribution is ideal designed to minimise the discrepancy between watermarked and non-watermarked weights. The experimental results show that our proposed algorithm can support large payloads even in the challenging transfer learning scenario, where the protected model is used as a pre-trained model for re-training on a different dataset and task, while remaining resistant to network configurations and reuse.

Further research will investigate the watermarking system’s limits in terms of how much payload it can accommodate without significantly affecting TER. We also want to do a thorough investigation of the system’s security against attackers who may attempt to update the watermark or discover its parameters if they are aware of it. Using channel coding on the informative message [46] approaching might be a strategy to improve the robustness of the proposed DNN watermarking system. This might be accomplished by discovering which codes function best in our method’s specific DNN watermarking scenario.

References

1.

Nowroozi, E., Seyedshoari, S., Mohammadi, M., Jolfaei, A.: Impact of media forensics and deepfake in society. In: Breakthroughs in Digital Biometrics and Forensics, pp. 387–410. Springer, Berlin (2022)

2.

Nowroozi, E., Dehghantanha, A., Parizi, R.M., Choo, K.K.R.: A survey of machine learning techniques in adversarial image forensics. Comput. Secur. 100, 102092 (2021)Crossref

3.

Barni, M., Costanzo, A., Nowroozi, E., Tondi, B.: CNN-based detection of generic contrast adjustment with JPEG post-processing. In: 2018 25th IEEE International Conference on Image Processing (ICIP), pp. 3803–3807 (2018)

4.

Adi, Y., Baum, C., Cissé, M., Pinkas, B., Keshet, J.: Turning your weakness into a strength: watermarking deep neural networks by backdooring. In: Enck, W., Felt, A.P. (eds.) 27th USENIX Security Symposium, USENIX Security 2018, Baltimore, August 15–17, 2018, pp. 1615–1631. USENIX Association, Berkeley (2018). https://​www.​usenix.​org/​conference/​usenixsecurity18​/​presentation/​adi

5.

Li, Y., Wang, H., Barni, M.: A survey of deep neural network watermarking techniques. Neurocomputing 461, 171–193 (2021). https://​www.​sciencedirect.​com/​science/​article/​pii/​S092523122101095​XCrossref

6.

Barni, M., Nowroozi, E., Tondi, B.: Higher-order, adversary-aware, double JPEG-detection via selected training on attacked samples. In: 2017 25th European Signal Processing Conference (EUSIPCO), pp. 281–285 (2017)

7.

Podilchuk, C.I., Delp, E.J.: Digital watermarking: algorithms and applications. IEEE Signal Process. Mag. 18(4), 33–46 (2001)Crossref

8.

Cox, I.J., Miller, M.L., Bloom, J.A., Honsinger, C.: Digital Watermarking, vol. 53. Springer, Berlin (2002)

9.

Barni, M., Bartolini, F.: Watermarking Systems Engineering: Enabling Digital Assets Security and Other Applications. CRC Press, Boca Raton (2004)Crossref

10.

Barni, M., Pérez-González, F., Tondi, B.: DNN watermarking: four challenges and a funeral. In: Proceedings of the 2021 ACM Workshop on Information Hiding and Multimedia Security, pp. 189–196 (2021)

11.

Nowroozi, E., Mohammadi, M., Savas, E., Conti, M., Mekdad, Y.: Spritz-1.5 c: employing deep ensemble learning for improving the security of computer networks against adversarial attacks (2022). arXiv:2209.12195

12.

Barni, M., Nowroozi, E., Tondi, B., Zhang, B.: Effectiveness of random deep feature selection for securing image manipulation detectors against adversarial examples. In: ICASSP 2020 - 2020 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 2977–2981 (2020)

13.

Barni, M., Nowroozi, E., Tondi, B.: Improving the security of image manipulation detection through one-and-a-half-class multiple classification. Multimedia Tools Appl. 79, 2383–2408 (2020)Crossref

14.

Pan, S.J., Yang, Q.: A survey on transfer learning. IEEE Trans. Knowl. Data Eng. 22(10), 1345–1359 (2009)Crossref

15.

Uchida, Y., Nagai, Y., Sakazawa, S., Satoh, S.: Embedding watermarks into deep neural networks. In: Proceedings of the 2017 ACM on International Conference on Multimedia Retrieval, pp. 269–277 (2017)

16.

Li, Y., Tondi, B., Barni, M.: Spread-transform dither modulation watermarking of deep neural network. In: EURASIP J. Inf. Secur.

17.

Kuribayashi, M., Tanaka, T., Funabiki, N.: Deepwatermark: embedding watermark into DNN model. In: 2020 Asia-Pacific Signal and Information Processing Association Annual Summit and Conference (APSIPA ASC), pp. 1340–1346. IEEE, Piscataway (2020)

18.

Wang, J., Wu, H., Zhang, X., Yao, Y.: Watermarking in deep neural networks via error back-propagation. Electron. Imag. 2020(4), 22–1 (2020)

19.

Wang, T., Kerschbaum, F.: Robust and undetectable white-box watermarks for deep neural networks (2019). arXiv:1910.14268

20.

Wang, T., Kerschbaum, F.: Attacks on digital watermarks for deep neural networks. In: ICASSP 2019-2019 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 2622–2626. IEEE, Piscataway (2019)

21.

Shafieinejad, M., Lukas, N., Wang, J., Li, X., Kerschbaum, F.: On the robustness of backdoor-based watermarking in deep neural networks. In: Proceedings of the 2021 ACM Workshop on Information Hiding and Multimedia Security, pp. 177–188 (2021)

22.

Tartaglione, E., Grangetto, M., Cavagnino, D., Botta, M.: Delving in the loss landscape to embed robust watermarks into neural networks. In: 2020 25th International Conference on Pattern Recognition (ICPR), pp. 1243–1250. IEEE, Piscataway (2021)

23.

Maung Maung, A.P., Kiya, H.: Piracy-resistant dnn watermarking by block-wise image transformation with secret key. In: Proceedings of the 2021 ACM Workshop on Information Hiding and Multimedia Security, Ser. IH&MMSec’21, pp. 159–164. Association for Computing Machinery, New York (2021). https://​doi.​org/​10.​1145/​3437880.​3460398

24.

Lu, C.S.: Sparse trigger pattern guided deep learning model watermarking. In: Proceedings of the 2022 ACM Workshop on Information Hiding and Multimedia Security, Ser. IH&MMSec’22, pp. 33–38. Association for Computing Machinery, New York (2022). https://​doi.​org/​10.​1145/​3531536.​3532961

25.

Chen, H., Rouhani, B.D., Fu, C., Zhao, J., Koushanfar, F.: Deepmarks: a secure fingerprinting framework for digital rights management of deep learning models. In: Proceedings of the 2019 on International Conference on Multimedia Retrieval, pp. 105–113 (2019)

26.

Wang, T., Kerschbaum, F.: RIGA: covert and robust white-box watermarking of deep neural networks. In: Proceedings of the Web Conference 2021 (2021), pp. 993–1004

27.

Yasui, T., Tanaka, T., Malik, A., Kuribayashi, M.: Coded DNN watermark: robustness against pruning models using constant weight code. J. Imag. 8(6), 152 (2022)Crossref

28.

Zhang, J., Gu, Z., Jang, J., Wu, H., Stoecklin, M.P., Huang, H., Molloy, I.: Protecting intellectual property of deep neural networks with watermarking. In: Proceedings of the 2018 on Asia Conference on Computer and Communications Security, pp. 159–172 (2018)

29.

Darvish Rouhani, B., Chen, H., Koushanfar, F.: Deepsigns: an end-to-end watermarking framework for ownership protection of deep neural networks. In: Proceedings of the Twenty-Fourth International Conference on Architectural Support for Programming Languages and Operating Systems, pp. 485–497 (2019)

30.

Fan, L., Ng, K.W., Chan, C.S.: Rethinking deep neural network ownership verification: embedding passports to defeat ambiguity attacks. In: Wallach, H. , Larochelle, H., Beygelzimer, A., Alché-Buc, F., Fox, E., Garnett, R. (eds.), Advances in Neural Information Processing Systems, vol. 32. Curran Associates, Red Hook (2019). https://​proceedings.​neurips.​cc/​paper/​2019/​file/​75455e062929d32a​333868084286bb68​-Paper.​pdf

31.

Guo, B.W., Barni, M.: Masterface watermarking for ipr protection of siamese network for face verification. In: International Workshop on Digital-forensics and Watermarking (2021)

32.

Rouhani, B.D., Chen, H., Koushanfar, F.: Deepsigns: an end-to-end watermarking framework for protecting the ownership of deep neural networks. In: ACM International Conference on Architectural Support for Programming Languages and Operating Systems (2019)

33.

Li, Y., Abady, L., Wang, H., Barni, M.: A feature-map-based large-payload DNN watermarking algorithm. In: International Workshop on Digital Watermarking. Springer, Berlin (2021), pp. 135–148

34.

Cortiñas-Lorenzo, B., Pérez-González, F.: Adam and the ants: on the influence of the optimization algorithm on the detectability of DNN watermarks. Entropy 22(12), 1379 (2020). https://​www.​mdpi.​com/​1099-4300/​22/​12/​1379MathSciNetCrossref

35.

Tondi, B., Costanzo, A., Barni, M.: Robust DNN watermarking via fixed embedding weights with optimized distribution (2022). https://​arxiv.​org/​abs/​2208.​10973

36.

Cover, T.M., Thomas, J.A.: Elements of Information Theory. Wiley, New York (1991)

37.

Goodfellow, I., Pouget-Abadie, J., Mirza, M., Xu, B., Warde-Farley, D., Ozair, S., Courville, A., Bengio, Y.: Generative adversarial networks. Commun. ACM 63(11), 139–144 (2020)MathSciNetCrossref

38.

Houben, S., Stallkamp, J., Salmen, J., Schlipsing, M., Igel, C.: Detection of traffic signs in real-world images: the German Traffic Sign Detection Benchmark. In: International Joint Conference on Neural Networks, vol. 1288 (2013)

39.

Krizhevsky, A., Hinton, G., et al.: Learning multiple layers of features from tiny images (2009)

40.

Karras, T., Laine, S., Aittala, M., Hellsten, J., Lehtinen, J., Aila, T.: Analyzing and improving the image quality of StyleGAN. In: Proceedings of CVPR (2020)

41.

Gragnaniello, D., Cozzolino, D., Marra, F., Poggi, G., Verdoliva, L.: Are gan generated images easy to detect? A critical analysis of the state-of-the-art. In: 2021 IEEE International Conference on Multimedia and Expo (ICME), pp. 1–6. IEEE, Piscataway (2021)

42.

https://​github.​com/​andreacos/​gan-generated-face-detection

43.

Huang, G., Liu, Z., Van Der Maaten, L., Weinberger, K.Q.: Densely connected convolutional networks. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 4700–4708 (2017)

44.

https://​github.​com/​titu1994/​DenseNet

45.

Yu, F., Zhang, Y., Song, S., Seff, A., Xiao, J.: Lsun: construction of a large-scale image dataset using deep learning with humans in the loop. CoRR, vol. abs/1506.03365, (2015). http://​dblp.​uni-trier.​de/​db/​journals/​corr/​corr1506.​html#YuZSSX15

46.

Pérez-González, F., Hernández, J.R., Balado, F.: Approaching the capacity limit in image watermarking: a perspective on coding techniques for data hiding applications. Signal Process. 81(6), 1215–1238 (2001)Crossref

Footnotes

1

The case where the source and target tasks remain the same and only the domain (i.e., dataset) changes is referred to as transductive transfer learning.

2

For convenience, the weights produced by the host indexes as host weights was refered; nevertheless, the phrase “host signal” does not have the same meaning as in media watermarking, because weights in DNN watermarking are directly created to host the watermark and do not exist.

3

A summation over the letters in the alphabet of x replaces the integral for discrete distributions.

4

This prevents attackers from easily identifying the watermarked weights and dropping them to remove the watermark from the network.

5

Remember that K determines both the selection of the host indexes in $$\Omega $$, and the generation of the pseudo-random sequence $$\mathbf {x}$$.

6

In a strict sense, Biases in the set of trainable parameters are likewise not included in the formulation since they have no influence on optimization.

7

The assumption that the weight distributions corresponding to the non-host indices of the model without watermark and the model with the watermark are approximately the same for all watermark settings discussed in this study was tested experimentally. The Sect. 6.1 contains more information.

8

Remember that $$\sigma _k^2$$ is the variance of the weights of the non-watermarked model in layer k. In the watermarked model, the variance of the non-watermarked weights in the same layer can be slightly different, so indistinguishability may not be perfect even for $$C=1$$.

9

In all these settings, robustness against reuse is achieved (see Sect. 6.2).

10

TER-Top1 is the standard TER, while TER-Top3 is the TER when we evaluate the probability that the correct class is one of the top three projected classes.

11

We note that in the proposed method, the BER of the watermarked model is 0 by construction, with the methods that embed the watermark by using a properly modified loss function for training (such as those in [15] and [16]), a nonzero BER can be obtained after training.

© The Author(s), under exclusive license to Springer Nature Switzerland AG 2024

E. Nowroozi et al. (eds.)Adversarial Multimedia ForensicsAdvances in Information Security104https://doi.org/10.1007/978-3-031-49803-9_10

Anti Forensic Measures and Their Impact on Forensic Investigations

Lars Schmitt1   and Gökhan Kul1  

(1)

Department of Computer and Information Science, University of Massachusetts Dartmouth, Dartmouth, MA, USA

Lars Schmitt

Email: lschmitt1@umassd.edu

Gökhan Kul (Corresponding author)

Email: gkul@umassd.edu

1 Introduction

Almost every digital action leaves digital traces on the systems used. When a digital action is committed, these traces can be of relevance if investigators of any kind search for proof of wrong-doing. From the user’s point of view, there are many ideas on how to prevent data from being used as evidence, including but not limited to preventive measures, obfuscation and destruction. The multitude of these measures are called anti forensics (AF). The field of AF contains a great variety of different techniques to obstruct digital investigations. These measures can reach from general best practices for practically every PC-user, which are easy to implement, to highly sophisticated and complex measures, targeting specific kinds of data or investigatory methods. Although there are many works describing specific and sophisticated techniques in detail, this chapter provides a general summary of the topic and attempts to evaluate the effectiveness of certain anti forensic measures (AFMs) and categories.

This chapter aims at the evaluation of AFMs for persistent media data on local digital systems, owned by suspects of a digital investigation. We focus on media stored on local storage such as photos and videos. Data on network devices, cloud infrastructure, or any kind of external servers or databases are explicitly excluded. Apart from this, measures like program packers that try to specifically obfuscate malware or that are specifically directed towards active alibi forgery are not covered. However, false digital alibis are a hugely relevant topic when it comes to local digital forensics investigations since a well-forged alibi is not distinguishable from a real user’s action on a system. For the scope of this chapter, anti forensic (AF) measures are defined as all device and data modifying actions which can obstruct or delay a digital investigation. Due to their relevance, mostly, intentional actions are covered, but not limited to actions with the intent of obstructing investigation. We will only cover permanent data on local systems.

Forensics and anti-forensics, much like offensive and defensive cyber security, form what could be called a metaphorical game of cat and mouse, whereas the cat—the investigator—tries to catch the suspect, respectively its relevant data—the metaphorical mouse. In this game, assuming that the suspect’s data would be exposed to an investigator without any AFMs, suspects come up with an idea on how to obstruct the investigation. However, investigators constantly try to come up with ideas on how to identify and extract relevant data, even though AFMs have been applied. This iterative conflict of opposing interest results in a constant loop of increasingly complex measures and countermeasures. An example for the evolution of forensic measures and their counterparts would be that for instance a suspect could have the idea to hide a .jpg file from detection by changing the file extension from .jpg to .log. This would not change the content of the file at all, but it would prevent the file from being identified as user-created .jpg file. However, a forensic investigator would easily be able to identify this file as being a .jpg file since an analysis of the file headers would reveal not only the true file type, but the mismatch would probably even raise attention. The AF measure to avoid this would be to change, delete, or modify the file header, which would lead to the investigator applying more complex analysis techniques like similarity analysis or side channel attacks like for instance a metadata analysis. For both the suspect and the investigator, over time, the applied measures have become more sophisticated to counter the actions of the opposite party.

AFM Categorizations

There are a plethora of different approaches to define and classify AFMs. An early classification attempt by [11], focusing on: (1) Destroying, (2) Hiding, (3) Elimination of Sources, and (4) Counterfeiting. This approach can be used in a chronological manner. However, one particular approach by Dr. Marcus Rogers is more popular [10, 14, 18]. This approach also defines four categories:(1) Data Hiding, (2) Artifact Wiping, (3) Trail Obfuscation, and (4) Attacks against Forensic Tools.

Similar and more inclusive variants exist. One example defines the categories in a more inclusive way, so that for instance the goal of delaying the analysis is not limited to obstructing forensic software exclusively [1]. Another interesting approach is described by [22]. It divides AFMs into three chronological categories, which are: (1) Elimination of Sources, (2) Hiding the Data, and (3) Direct Attacks against Computer Forensics Software.

While this chronological approach seems intuitive, a more outcome-focused approach is required to judge upon the effectiveness of the discussed measure. There are also approaches [24] which are far better in understanding how certain measures work, focusing on the effect a measure has on the investigation.

States of Persistent Data

Regarding persistent data on a system which can be potentially be used as evidence, it is beneficial to compare the states in which (persistent) data can exist over time. The most useful state from the point of view of the suspect is non-existence, which is the natural state for any data on a system. Usually, data gets created into a usable state, which is the most dangerous state. In this state, the data can be used by both the user of the system, as well as by the investigator during an investigation. If, however, the data gets created in a safe matter, the data is present, but not directly usable; the information is not obvious. An example for that would be an encrypted file. By decrypting it, the data is converted to a usable state. By encrypting the file, the data can be changed back to the unusable state. The concept of usability is of major relevancy since it is the main goal of the suspect to keep all data in a non-usable state when an investigator tries to access them. However, while non-existence is the best state in terms of protection against an investigation, it is not reversible. Moreover, the means to achieve that state might take up time and other resources in terms of computing power, physical effort, energy, and so on.

2 Factors of AFM Effectiveness

For the scope of this chapter, the effectiveness of an AF measure is defined as its ability to obstruct a digital investigation while also including the effort, resources, and knowledge required to apply the measure.

2.1 Problems Regarding the Effectiveness

For a number of reasons, comprehensively evaluating the effectiveness of AFMs is a complicated matter.

Lack of Scientific Data

While there could be general estimations on the impact of AFMs, there is not much data on how different measures affect forensic investigations in real life, which is the critical factor in evaluating the effectiveness of a measure. Forensic investigators rarely give away any information on how effective AF techniques were against an investigation.

Relativity of Effectiveness

Each investigating instance (investigator/team/lab) has its own set of knowledge, techniques, and protocols. While law-enforcement agencies mostly follow certain standards, the inconvenience and issues caused by different AFMs still varies greatly for each investigating instance, depending on skill, knowledge, resources, and investigation procedures.

Absence of a Common Scale

There is no common scale that describes the effectiveness of a measure in a common unit since AFMs can obstruct a digital investigation in a wide variety of different ways. Most possible approaches are either relative (e.g., additional costs, additional work time while investigating) or not applicable to all measures (e.g., computing power required, software resilience). Additionally, measures using this kind of scale would require a great amount of details which exceeds the definition of the measure. For instance, for an encrypted file, it can be encrypted with a plethora of algorithms and keys. The computing power required to break the encryption in a classical way would highly depend on the length of the used key(s), the alphabet or character set used, and the exact method applied to break or circumvent the encryption.

No Common Level of Abstraction

When discussing AFMs, the different measures are implicitly given a certain level of abstraction, which is not universal to all approaches, discussions, and papers. Whereas many works reference data hiding as an anti forensic measure, other ones go into more detail and explain the concept of steganography as part of data hiding or individually. More specific research go into detail about image steganography as a measure whereas expert works on the subject discuss specific techniques for applying steganography to certain image file types. While it would be intuitive to go into as much detail as possible, someone who attempts to evaluate all measures in great detail will be faced with an almost infinite amount of detail to cover, whereas a more rough approach can only give a relatively vague and superficial estimation of the effectiveness of a certain measure or category of the same.

2.2 Discussed Factors

Data Affected

Before the effectiveness of data-oriented AFs can be discussed, the affected types of data in regards to their intentional existence from the suspect’s point of view must be discussed. For this chapter, the following categorization is proposed to provide a classification for the affected data (see Fig. 1). The first distinction is between permanent data, stored on permanent storage like hard drives or NAND-flash. The second category (which is not discussed in this chapter) is volatile data, which is only present in volatile memory and therefore requires live acquisition. However, the next important distinction in regards to permanent data is the one between intentional data and unintentional data. For the scope of this chapter, the word intentional defines data which the user consciously creates and therefore knows of them. The word unintentional defines data which are not created actively by the user. The user might know of their existence, like for example the user might use a hiberfil.sys file on their Windows system for convenience, but the data is not created with the intent of using it in a directly interactive way. Therefore, it would be considered unintentional. Unintentional data are divided into metadata, which describe other data and mostly consist of data created by the OS or programs giving away information about other data like files. However, there are also data which could be considered primary. User data or persisted volatile data that can be restored fall under this category. In the intentional category, there are the data and files created by the user. Assuming the user conducts an action which could be considered relevant to any form of forensic investigation, the data can be further divided into secret data, which would be relevant to the respective investigation, irrelevant data, which are not useful to the investigation, and forged data, which describe intentionally forged data with the purpose of disrupting or even misleading the investigation. For the irrelevant data, it is hard to find generic examples since the judgment of whether data is relevant to an investigation is highly dependent on the matter of the investigation itself. Furthermore, the user might often think of many files or dates as irrelevant, but might not even know that the data or files (which were intentionally created) contain unintentionally relevant information.

A bubble flow chart of data affected by anti-forensic measures. The data is classified as volatile and permanent. Permanent is classified as intentional and unintentional. Intentional includes secret, irrelevant, and forged data. Unintentional includes data and metadata.

Fig. 1

Data which is potentially affected by anti forensic measures

Complexity of the Measure

Another important factor to judge upon the effectiveness of AFMs is their complexity. The following five categories are defined to roughly classify the complexity of measures:

Very Low: The user does not have to have any specific knowledge about computers. The action is easy to conduct.

Low: A minimal level of computer knowledge might be required to apply the measure. However, the action is not more complex then downloading and using easy-to-use software which includes a Graphical User Interface (GUI).

Medium: There is a certain level of computer knowledge required. The user may still follow tutorials on the internet but computational literacy required. Software required might not always have a GUI.

High: The user must be skilled with computers. Tutorials are hard to find. The action requires complex steps like advanced commands, settings, or software without a GUI.

Very High: The action requires high knowledge about computers to conduct and there is no easy way or tutorial for the measure.

Time and Resource Consumption

Another important factor for the effectiveness of AFMs is the time and resources they consume, both initially and continuously. Some measures can be considered extremely hard to evade, but take up so much time and so many resources that frequent usage is still unlikely. Resource consumption refers to both physical and digital resources (like computing power). One example of that could be that a suspect will rarely destroy the hard drives of their own PC since the physical resources (buying new hard drives) as well as time and the digital resources to set it up (time and computing power to get desired system back) are just too high. The classification scale from Sect. 2.2 about the measurement complexity (very low, low, medium, high, very high) is also applied to this measurement. However, general definitions are difficult to make due to the lack of a common scale. Therefore, the classification relies on relative guesses.

Probability of Evasion

This measure is the probability that an investigator can or cannot evade the AF measure. For the scope of this chapter, this is defined as Probability of Evasion (PoE). To give an example: Renaming file extensions might be a good AF measure against a forensic investigator with a unrealistically low skill set. However, an average investigator would easily be able to detect the affected files and restore their original extensions based on the file signatures. Therefore, the PoE would be very high in this case, which would be bad for the suspect and good for the investigator. The classification scale from the Measure Complexity Section (very low, low, medium, high, very high) is also applied to this measurement. However, it is difficult to come up with a universal definition due to the lack of scientific data on that matter. Therefore, the classification relies on relative guesses.

3 Anti Forensic Measures

A tabular overview of all discussed AFMs is provided with Table 1. It contains both the discussed evaluation factors but also synonyms and references to the explanatory sections.

Table 1

Overview of popular anti forensics measures

Time and resource

Measure

Synonyms

Target

consumption

Complexity

Probability of evasion

Physical destruction

Data destruction degaussing

All permanent data

Low

Very low

Very low

Artifact wiping

Wiping data wiping

Mostly secret data

High

Low

Low

Disk wiping

Scrubbing sanitizing

All permanent data

Very high

Low

Low

NSRL scrubbing

–

Mostly intentional data

Medium

Medium

High

MACE scrambling

Metadata wiping metadata manipulation time stamp modification

Unintentional data

Low

Low

Medium

File signature scrambling

Manipulation of file headers

Mostly secret data

High

Medium

Medium

Registry wiping

–

Unintentional data

Low

Medium–very high

High

Log manipulation

Broken logs broken log files

Specific unintentional data

Medium

Low–high

High

Defragmentation

–

Specific unintentional data

Medium

Low

Very High

Artifact injection

–

Specific permanent data

Variable

Variable

High

File compression

–

Mostly permanent data

Low

Very low

Very High

Forensic tool bug exploitation

–

Forensic tools

Medium

High

High

Compression bombs

Zip bombs archive bombs

Forensic tools

Low

Low

Very high

Loop references

Circular references

Forensic tools

Very low

Medium

Very high

Steganography

–

Secret data

Mostly low

Low–very high

Very high–very low

Data hiding techniques

–

Secret data

Mostly low

Low–very high

Very high–very low

Live operating systems

Bootable USB Portable System

All permanent data

Low

Medium

Very low

Virtual machines

–

Most persistent data

Very high

Low

Very high

Non-standard programs

–

Forensic analysis

Very low

Low

Very high

Data pooling

Data saturation

Forensic analysis

Very low

Very low

Very high

Non-standard RAIDs

–

Forensic analysis

High

Medium

High

Dummy drives

–

Forensic analysis

Medium

Low

High

Full disk/drive encryption

–

All permanent data

Low

Low

Very low

Encrypted containers

–

Intentional data

Low

Low

Low

File encryption

–

Secret data

Low

Low

Low

Hash collisions

–

Mostly secret data

Very high

Very high

High

Media integrity obfuscation

–

Media originality

Very high

High

High

3.1 Physical Destruction

It targets permanent data on a storage device by destroying the information or even the device itself. Popular names for this measure include physical destruction [11], data destruction [35], and degaussing [1, 18]. One example for this measure would be a suspect smashing a USB-stick with a hammer to destroy the evidence it contains. It is one of the most intuitive AFMs since it involves direct physical activity. The measure is applied by physically destroying the device. In the case of HDDs, this can be achieved my drilling the platters, melting them, or use magnets to wipe the data off from the HDD. The latter does not render the hard drive useless by itself, but when a hard drive is opened in an inappropriate environment, it can be damaged quite easily. However, for flash-based storage devices, both physical destruction and the use of a microwave oven are effective in irrecoverably destroying the storage itself [25]. The obstructing effect of the measure derives from the data and its carrying storage being destroyed on a physical level. The complexity is very low since physical destruction does not require any knowledge about computers. However, failing to destroy the data carrying parts of a storage device can result in the data being partially or fully recoverable. The time and resource consumption depends on the exact technique applied. Generally, it could be considered low. The PoE is very low. While microwaving flash memory seems effective, other attempts in destroying data on hard drives could be less effective since especially modern HDDs are designed to prevent data loss [29].

3.2 Artifact Wiping

It targets mostly secret data by removing them completely from a system. Popular names for this measure include artifact wiping [11, 12], data wiping [8] and wiping [1, 17, 18], which can be considered the generic activity of overwriting deleted data. One example for this measure would be a government operative using a program to delete sensitive files from a permanent drive several times using a Department of Defense deletion scheme to destroy evidence. It is by far one of the most commonly mentioned AFMs in literature. The measure is applied by overwriting the space which was previously used for secret data, mostly intentional files. However, the wiping of relevant unintentional files like for instance Linux SWAP files or orphan files is included in this measure [13]. The obstructing effect of the measure derives from the data not only being marked for future deletion, but by being overwritten with an algorithm that ensures the original data is no longer visible to an investigator. There are several known standards that can be applied [18]. However, until now, this measure is mostly limited to files on HDDs since SSDs store data differently and have a different behavior concerning the deletion of data [2]. The time and resource consumption is high. The safe deletion of data requires the data to be overwritten several times. For the Gutmann algorithm, the data have to be overwritten 35 times in a specific way, which is a huge stress on time and computing power. The PoE is low since the data, if deleted, is most likely not recoverable. However, the measure is selective and has to be applied actively to all relevant targets, known or unknown to the suspect. While a user might delete several files which would be relevant to an investigation, investigators might still find other files which are either relevant on their own, or even unintentional copies or data about the deleted files.

3.3 Disk Wiping

It targets all permanent data stored on a permanent drive. Popular names for this measure include disk/partition wiping [18], scrubbing [11], and sanitizing [1]. One example for this measure would be a company using a program to completely delete the contents of their used hard drives before reselling them. The measure is applied by wiping all data on a hard drive in the same matter as discussed in Artifact wiping. The obstructing effect of the measure derives from all data being overwritten on the hard drive the investigator investigates. Therefore, no useful data can be found. The complexity is low. Different and easy-to-use software is commonly available. The time and resource consumption is very high because all files on the system have to be overwritten several times to apply the measure correctly. For a 1TB hard drive, wiping the hard drive in a safe way would require it to be overwritten with roughly 3 to 35TB of data. The generation and writing process can easily take up several hours or days, depending on the performance of both the hard drive itself, but also the surrounding system. The PoE is low since on the storage medium, there are ideally no useful data present anymore. An exception from that might be bad blocks, which are no longer accessible by an operating system. These defect sections of hard drives can still contain some leftover data.

3.4 NSRL Scrubbing

It targets mostly intentional data. It is often mentioned and sometimes confused with hash collisions. One example for this measure would be a suspect using a program to manipulate all files on a system a little to slow down the future detection process of forensically relevant data and programs. The measure is applied by changing files listed in the NSRL database and which are present on the system in a way, so that a hash analysis does not reveal a match immediately to the investigator. This measure often includes the deactivation of the Data Execution Prevention (DEP) which would prevent executables from working when they are modified [11]. The obstructing effect of the measure derives from the investigator not being able to match the list of known file hashed with the data on the system. Therefore, the identification of relevant files can take much longer. The complexity is medium since specialized software is required and due to the changes to executables, further system changes might be required. The time and resource consumption is on a medium level, since the measure takes up time and computing resources to take effect. The PoE is high. Relevant files are not gone, but harder to identify since their content is completely unknown to the investigator.

3.5 MACE Scrambling

It targets unintentional data. Popular names for this measure include MACE scrambling [10], metadata wiping [8], and metadata manipulation [18]. Note that some of these definitions can also include other types of relevant metadata, such as EXIF-metadata. One example for this measure would be a drug dealer using a program to delete the metadata of all pictures on a computer to avoid possible reconstruction of time and location. The measure is applied by deleting, randomizing, or maliciously manipulating the so-called MACE-metadata. These data contain information about when a file has been created, lastly modified, changed, and also when these metadata were updated the last time. With these data, an investigator can easily build up a timeline for file creation, usage, and changes. The obstructing effect of the measure derives from an investigator not being able to easily construct a timeline of events anymore. This could even lead to evidence not being admissible. The complexity is low. The time and resource consumption is on a medium level because the process itself does require a deletion or randomization of all (relevant) metadata on a system or drive. The PoE is medium. A timeline is a powerful artifact for an investigation and it might be difficult to construct from side information like system logs, which is one recommended approach when this measure has been applied [24]. However, concerning data recovery from hard drives in general, sophisticated techniques like magnetic force microscopy photography can be successful in recovering data that has been overwritten [15].

3.6 File Signature Scrambling

It targets mostly secret data. Popular names for this measure include file signature scrambling [10], manipulation of file headers [22], and file signature masking [24]. One example for this measure would be a suspect using a program to manipulate and administrate the file headers of all files on a system to delay a later investigation. The measure is applied by changing the file extension and the file signature of relevant files. The obstructing effect of the measure derives from the investigator no longer being able to identify the true nature of files easily anymore, since file extension and file signature are the most accessible indicators for file types. The complexity is on a medium level since the file headers need to be identified and changed. The time and resource consumption is high because for all relevant files, the signatures must be changed, but also the information on what file type it is must be stored and securely maintained. The PoE is on a medium level since more sophisticated measures (like similarity analysis) are required to analyze the affected files.

3.7 Registry Wiping

It targets all unintentional metadata which are stored in the Windows Registry Database. These do not necessarily have to be related to a malicious action, but can be just generically for unused, broken, or wrong registry entries [12]. One example for this measure would be a regular person using a program to delete registry entries to increase the computer’s performance. The Windows Registry by default logs a great variety of different user activities, including but not limited to the last files accessed by the user. The measure is applied by deleting the traces of relevant user activity from the Registry. This can happen either with a software, or manually. The obstructing effect of the measure derives from the fact that the investigator cannot use Registry data anymore to reconstruct the user’s behavior. The complexity is between medium and very high. It depends on whether a program is used to clear the registry and how sophisticated manual attempts are to delete and/or manipulate entries actively. The time and resource consumption is on a medium level because, while programs might exist which hit all relevant registry entries and are easy to use, the certainty of it is pretty low due to the large amount of data collected. The PoE is high since there are plenty of other (meta) data points available in an investigation, even if the manipulation is completely successful.

3.8 Log Manipulation

It targets unintentional data which is created by the OS or programs of the system. Popular names for this measure include log manipulation [18], broken logs [11], and broken log files [24]. Arguably, this measure could also include Registry Sanitizing. However, there are works mentioning both techniques separately from each other [18]. One example for this measure would be a suspect intentionally deleting log files of a picture editing software to remove traces of certain image manipulation activities on the system. The measure is applied by deleting or manipulating logs created by software. This does not have to but can include the use of special characters which make it hard for analyzing software to parse. This attacking variant is also known under the name ReDos or Evil Regex in general [14]. The obstructing effect of the measure derives from both the absence of valid log data, but also the attempted obstruction of forensic tools which try to parse the logs in an orderly matter. The complexity can reach from low to high, depending on the exact action, level of effort, and sophistication in manipulating the logs. The time and resource consumption is on a medium level because the identification of all relevant logs and their manipulation can take a long time without precise automatization. The PoE is on a medium level since log files are source of data for the investigation.

3.9 Defragmentation

It targets specific unintentional data, namely data which are left after relevant files have been deleted. One example for this measure would be a regular user using the defragmentation feature of a computers operating system to increase the hard drives performance. This measure is an interesting one since the obstructing effect for an investigation is not the primary use case of this technique [14]. The measure is applied by using an internal or external defragmentation program. The obstructing effect of the measure derives from residual data being deleted due to the relocation of files on a hard drive. This results in misdirection [12]. The complexity is very low. The time and resource consumption is on a medium level because defragmentation of a hard drive is a long process which requires lots of read and write operations on the respective hard drive. The PoE is very high since, while some data relevant to the investigation might be deleted, the amount of this data is probably rather low.

3.10 Artifact Injection

It targets any kind of permanent data, while the measure itself deals with the process of forging data. One example for this measure would be a internal attacker creating files containing imaginary plans and contact data to mislead a future investigation. The measure can be applied to all kinds of data and is therefore a rather versatile and generic measure. However, a notable example is given by [13], dealing with the artifact injection in the context of Linux SWAP files. The measure is applied by either manipulating a forensically relevant file with confusing or obstructing content, or replacing the file as a whole with a forged file (the more likely case). The obstructing effect of the measure derives from the confusion the forged data causes. The complexity is variable because it highly depends on the action(s) performed. The time and resource consumption is variable because it highly depends on the actual target. The PoE is high since in most cases, the manipulation or replacement of files is monitored by log processes and metadata. However, in the case of artifact injection for persisted volatile data, the injection might be harder to detect since the data of these files often gets changed almost constantly, so malicious changes are hard to detect.

3.11 File Compression

It targets any kind of permanent data. Much like registry wiping and defragmentation, it is not a measure necessarily intended to obstruct a forensic investigation. One example for this measure would be a user using the Operating Systems native compression features to save disk space. The measure is applied by compressing the respective files with an internal or external program. The obstructing effect of the measure derives from the fact that the compressed files are harder to process for analytic tools. This is especially the case if the files are damaged [23] or if the file content itself is rather complicated. For example, this would be the case for binary files or persisted volatile data like Linux SWAP files [13]. The complexity is low since compression is a regular operation for data, implemented in the OS and easy-to-use programs. The time and resource consumption is low because for most files, the OS and external programs offer a plethora of easy options to compress files with known algorithms. The PoE is very high since for most files and compression types, the obstructing effect of compression should be strongly limited to a minimum of needed time to decompress the data.

3.12 Forensic Tool Bug Exploitation

It specifically targets forensic tools and known weaknesses which can be exploited to obstruct a digital investigation. One example for this measure would be an IT-security expert, researching known exploitable bugs in often used forensic software, and applying the respective exploits to attack the tools in a potential future investigation. While new bugs and exploits are hard to find and develop, old forensic software poses a potential threat to the investigation. The measure is applied by exploiting a known vulnerability in a forensic program. The effects can reach from the software not being usable, to delivering false results, and even attack the investigation itself [1]. In some cases even remote code execution is possible [8], which can allow the suspect to run code on the investigating computer, which is not only a threat to the investigation, but also to the potential admissibility of evidence on the suspect’s computer. The obstructing effect of the measure derives from the suspect actively being able to manipulate the investigation, both qualitative and quantitative. The complexity is high because not only are vulnerabilities and exploits hard to find and implement, but they are also directed against specific forensic tools. The time and resource consumption is on a medium level since it is assumed that more vulnerabilities and exploits have to be both found and implemented. The PoE is high since investigators cannot only use different tools or recent versions of tools to prevent everything but unpatched or zero-day exploits, but also can prevent real damage from being inflicted, for instance by using a virtual machine as their investigating machine.

3.13 Compression Bombs

They target badly written analytic or forensic tools. Popular names for this measure include compression bombs, zip bombs, or archive bombs. One example for this measure would be a suspect downloading a zip bomb and changing up the name to delay a future forensic analysis. The measure is applied by mining the system with compression bombs. These specifically forged archives contain a huge amount of data which is compressed in a matter that the resulting file is just a regularly sized archive. A popular example is 42.zip [14], a highly compressed archive with roughly 4.5 Petabyte of data which are compressed to a roughly 42 kb big file. The obstructing effect of the measure derives from an investigator or a forensic tool, trying to decompress the contents of the archive. Since the amount of data in this archive is artificially large, a denial of service is the result of a successful compression bomb. This can be true for the forensic tool, but also for the entire investigating system. The worst case for the investigator is the complete dysfunction of the investigating system since without any free permanent storage, the system might not even start. The complexity is low because a user can download compression bombs from the internet. Furthermore, the user could create their own compression bombs with a minimum of programming knowledge and/or one of the common archiving software tools. The time and resource consumption is low because downloading and placing the bombs is not outstandingly time-intensive. The PoE is very high since modern forensic tools have protections against compression bombs and a plethora of measures can be applied to prevent compression bombs from causing real damage to the investigation.

3.14 Loop References

They target forensic analysis tools. Popular names for this measure include loop references [10] and circular references [11]. One example for this measure would be a suspect, purposefully using symbolic links to generate circular references in the file system to delay a future investigation. The measure is applied by creating a circular structure of symbolic links in a file system. This leads to an infinite path length when traversed. The obstructing effect of the measure derives from AF tools traversing the path loop endlessly and therefore running out of time and system resources, which results in a denial of service. The complexity is medium. The time and resource consumption is very low because a respective command can be found on the internet and symbolic links can be created easily. The PoE is very high since forensic tools can easily implement a loop protection and even if a tools gets stuck in a loop, the rest of the investigation is not impaired other than by the loss of time.

3.15 Steganography

It targets secret data. Popular names for this measure include steganography [1, 8, 11, 22] and hidden writing [17]. One example for this measure would be a server owner hiding a secret SSH key inside the last bit of each pixel byte of an image to obfuscate the key’s existence. This measure can be considered a category of different known and unknown techniques. It is sometimes considered a subcategory of data hiding [18]. While there are easy and generic techniques around, there are also especially sophisticated and complex measures around [32]. Furthermore, the forensically undetectable manipulation of images is another related topic [31]. Steganography is applied by hiding secret information in a multimedia file. For the human eye, the changes made are mostly undetectable. However, using the right tool, the information can be extracted from the exact same file. It can be encrypted in addition, however, this is not a part of the steganographic process itself. The obstructing effect of the measure derives from the investigator not finding the secret information at all, even when looking at the carrier file. The complexity can be low to very high because while simple techniques and programs can be used, the most successful approaches are the unknown, self-implemented, sophisticated approaches, which could be called Zero Day Steganography. The time and resource consumption is very low because steganographic process itself usually only deals with single media files. The PoE depends on the exact techniques applied since easy techniques and their programs can be easily detected (for instance with NSRL matching), but well-made and unknown techniques without the program to reveal the information are very hard to detect.

3.16 Data Hiding Techniques

They target secret data. One example for this measure would be a suspect using a software to hide a secret file in uninitialized storage space of the computers hard drive to make the detection harder for a future investigation. There are many known and unknown data hiding techniques and sub-categories which are covered both superficially and specifically [11, 22, 24]. The carrier data or storage spaces can reach from the slack space, to bad blocks of hard drives, and more advanced approaches [1]. Approaches for specific types of systems exist too. One example of that is the use of restricted file names on Windows-based systems to hide files from the investigator [10]. The measure is applied by hiding data in a piece of storage where it is not easily found. The obstructing effect of the measure derives from the secret data not being found by the investigator. The complexity depends on the specific measure applied. The time and resource consumption is mostly low because the hiding process of data does not usually require large amounts of resources, but uses mostly residual space or small manipulations. The PoE depends on the exact measure applied.

3.17 Live Operating Systems

They target all permanent data of a system. One example would be a hacker using a bootable USB stick with a forensic Linux Operating System during an attack to avoid permanent traces left on the device used. Popular names for this measure include live operating systems [8], bootable USB [1], or generally portable systems and programs [11]. The measure is applied by using a Live-USB-Stick or Live-CD instead of a operating system (OS) which is installed on an internal storage device of the PC used. In addition, there are several operating systems supporting the use of so-called forensic modes, which specifically avoid to leave behind any persistent data on a computer [7]. The obstructing effect of the measure derives from the fact that no data about the user’s activities is stored on the computer. Any data that is created can be secured by encryption or just physically or be hidden/destroyed. The complexity is medium. Tutorials are easy to find and there are many programs out there burning an .iso image onto a CD or a thumb drive. However, the biggest point while this measure is rarely used is the inconvenience and the dependence on external solutions for permanent storage. The time and resource consumption is low because a live system, once setup, does not require more resources by default than a regular OS. However, the speed is limited with the speed of the live medium carrying the OS. Therefore, a slow USB-stick can slow the system down, whereas this is a bottleneck and not so much a question of resource consumption in general. The PoE is very low since the only chance of getting any permanent data from the system is the analysis of the external storage devices. If these are not available, the investigator is not left with much data to analyze.

3.18 Virtual Machines

The use of virtual machines targets most persistent data on a system. One example for this measure is a suspect using a hypervisor software with one or more virtual machines to conduct all forensically interesting actions to limit potential evidence to a few permanent files related to the virtual machine used. This forensic measure is rather abstract since it mostly unfolds in combination with artifact wiping. Furthermore, it is notable that the use of virtual machines is not only a potential AF measure, but also good practice for forensic investigators, since features like snapshots and the general separation of host and simulated system can represent an effective protection against potential traps (e.g., viruses, remote code execution exploits, denial of service attacks). However, the measure is applied by using virtual machines instead of the host system for any user activity. By that, the persistent data of the entire system used to conduct a suspicious activity can be condensed down to a few files on the host system. The obstructing effect of the measure derives from the fact, that all permanent traces of an action are contained in a few files. This has the advantage that any suspicious data on the host system are limited to a minimum of files and metadata surrounding it. In combination with other forensic measures like artifact wiping and/or cryptographic solutions, this measure can be highly effective [34]. Furthermore, a mistake by the investigator can result in a VM not being discovered, which can have significant consequences for the result of an investigation [27]. The complexity is low because several popular software tools exist to create and run virtual environments. However, it is to note that the use of virtual machines alone does not obstruct a forensic investigation by a lot; only the combination with other measures leads to its effectiveness. The time and resource consumption is very high because every simulated environment will use a lot of the hosts resources and will have less processing power, storage, etc. Furthermore, a continuous usage of one or more virtual machines is assumed. The PoE is very high since it does not have much effect on its own and many forensic tools can deal with virtual hard drive images.

3.19 Non-standard Programs

One example would be a suspect using relatively unknown office and image manipulation software to prevent an experience-based speed-up of the investigation. The measure is applied by using software which is not used by most people to achieve a certain task. The obstructing effect of the measure derives from forensic tools not being able to process certain file types and existing programs in depth since they are not used, and generally making it easier to hide activity, information, or intentions [11]. The complexity is low because the user only needs to download and use alternative software consistently. The time and resource consumption is very low. The PoE is very high since files can be analyzed by different tools.

3.20 Data Pooling

It targets the analytic capacity of the investigation. Popular names for this measure include data pooling [10] and data saturation [11, 24]. One example would be a company keeping all used drives for an extended amount of time to significantly increase the workload for a future investigation. The measure is applied by not discarding any data, but keeping all irrelevant data on a system. The obstructing effect of the measure derives from the investigation not having enough resources to process all the data and find the relevant parts. The complexity is very low because it does not require the user to do anything actively. The time and resource consumption is very low. The PoE is very high since investigators can parallel the imaging and analysis process of many storage media. However, dealing not only with a single computer but with an entire server farm could indeed lead to a larger problem. However, this scenario is out of scope of this chapter.

3.21 Non-standard RAIDs

The usage of non-standard RAIDs targets the investigations ability to obtain data from a computer system with several physical permanent storage devices such as HDDs or SSDs. One example for this measure would be a suspect using a hardware RAID controller for a server to increase the workload for a future investigation. The measure is applied by implementing a complex RAID-structure like RAID-5 or RAID-6, ideally combined with a cryptographic file system. The obstructing effect of the measure derives from investigator not being able to extract data from single drives or in a different setup then an equal one; created images of the single drives are barely useful [11]. The complexity is medium because the user needs some knowledge on how to set up such a RAID, which mostly exceeds knowledge about an application with a GUI. It is also notable that this measure is not compatible with all systems and use cases. The time and resource consumption is on a medium level because implementing a complex RAID requires a fair amount of time and several HDDs, which increase the physical resource consumption. For the analysis of a RAID system, it is crucial to reconstruct the RAID setup (respectively a RAID map), a feature often times supported by recent forensic tools [16]. The PoE is high since several techniques can be applied to create useful images from the original system instead of imaging single drives.

3.22 Dummy Drives

They target the analytic capacity of the investigation. This measure can be seen as an extended variant of data pooling. One example for this measure would be a fraudster connecting additional hard drives with irrelevant data to a computer to delay a future investigation. The measure is applied by having unused dummy drives in the system which can be either filled with irrelevant, or even forged data to not only delay, but also mislead an investigation [10]. The obstructing effect of the measure derives from the investigation not having enough resources to process all the data and find the relevant parts. However, additional traps and forged data can also be placed to further obstruct the investigation. The complexity is low. The time and resource consumption is on a medium level since the dummy drives have to be created and maintained to make it look like they are used on a regular basis. The PoE is very high since investigators can parallel the imaging and analysis process of many storage media. Further effects fall under the responsibility of the respective additional measures (denial of service etc.).

3.23 Full Disk/Drive, and File Encryption

It targets all permanent files of a system. One example for this measure would be a government operative using a software to completely encrypt the partitions of a laptop to make a future static analysis of the system significantly harder. Encryption in general can be considered one of the most powerful measures. It proposes major problems during static acquisition [36]. Gary Kessler called cryptography the ultimate anti-forensics tool [17]. Full disk/drive encryption is applied by encrypting the whole permanent storage device or its partitions completely. The obstructing effect of the measure derives from the fact that, without the key, the investigation will not be able to read any permanent data on the system in a usable state. The complexity is low since for both Windows and Linux/Unix based systems, GUI-based solutions exist. The time and resource consumption is low because the measure requires the user to enter the password every time at system startup. Furthermore, the continuous encryption and decryption process can be a negative influence on the performance of the system. The PoE is very low since for many commonly used algorithms, there is no way to decrypt an encryption with a well-selected key in a decent amount of time.

3.24 Encrypted Containers

Using encrypted containers targets intentional, mostly secret data. One example for this measure would be a suspect using a program to create encrypted file containers, mounting them, and keeping secret data exclusively inside the encrypted container to make a future static acquisition significantly harder. They are another layer of encryption that can be used to secure data against access. The measure is applied by creating an encrypted container file and mounting it. The secret data are stored in this container and while the container is not mounted, the data are not accessible in an unencrypted state. The usage of containers (as well as other encryption-related AF techniques) is hugely relevant to a forensic investigation and therefore a reasonable part of modern forensic tools and approaches [9]. The obstructing effect of the measure derives from the fact that, without the key, the investigation will not be able to read the contained data in a usable state. The complexity is low since for both Windows and Linux/Unix based systems, GUI-based solutions exist. The time and resource consumption is low because the measure requires the user to enter the password every time the container shall be accessed. The PoE is low since for many commonly used algorithms, there is no way to decrypt an encryption with a well-selected key in a decent amount of time. However, unintended copies or metadata about the data might exist in an unencrypted state. Furthermore, the password could be revealed by analyzing persisted data.

3.25 File Encryption

File encryption targets secret data, respectively secret files, instead of Full Disk encryption, which reduces the time and resource consumption. One example for this measure would be a suspect using a program to encrypt all intentional secret files to make future static acquisition significantly harder. They are another layer of encryption that can be used to secure data against access. The measure is applied by encrypting secret data and files directly without an abstraction layer. When applied correctly, the obstructing effect of the measure derives from the fact that, without the key, the investigation will not be able to read the content of the respective files in a usable state [11]. The complexity is low since for both Windows and Linux/Unix based systems, implemented and GUI-based solutions exist. The time and resource consumption is low because the measure requires the user to enter the password every time an encrypted file shall be accessed. However, there are many ideas on how to bypass that, performing the encryption and decryption based on system variables, which are much easier to obtain for a forensic investigator than a password. The PoE is on a medium level. While for many commonly used algorithms, there is no way to decrypt an encryption with a well-selected key in a decent amount of time, unintended copies or metadata about the data might exist in an unencrypted state. Furthermore, there might be a number of options to obtain the encryption key if it is based on system variables rather than user input. While effective, it is less powerful due to the fact that metadata about an encrypted file are often left unencrypted.

3.26 Hash Collisions

They target mostly secret data, but also interact with other files on the system. One example for this measure is a suspect using a program to find hash collisions for a secret file to attack the future investigation and evidence admissibility. In literature, this rather theoretical AF measure is sometimes confused with the measure of NSRL scrubbing. The measure is applied by finding a hash collision which disables investigative measures that use the hash function which was successfully collided have no practical chance of being admitted [22]. The obstructing effect of the measure derives from the doubt that can be cast on the investigation, which is almost solely a problem for legal admission. Further confusion slowing down the investigation is possible. The complexity is very high, since even for hash algorithms with known collisions, the creation of specific collisions is extremely difficult. The time and resource consumption is very high because hash collisions are extremely difficult to find. The time and resource requirements are so high, that artificially producing hash collisions is more of a theoretical idea rather than an AF measure to be dealt with. However, since post-quantum encryption is on the rise, the long-term-safety of modern and commonly used hash algorithms can be questioned [28]. Furthermore, for the hash algorithm MD5, a negative impact on evidence admissibility due to collisions can already be assumed [3]. The PoE is high since other forensic tools or hash algorithms can be used. Furthermore, for certain use cases, being confused by hash collisions of entire files can be avoided by hashing blocks of files instead of entire files [24].

3.27 Media Integrity Obfuscation

In media forensics, there are a plethora of approaches to identify whether a piece of media (namely a picture or video frame) has been tampered with. These approaches focus on very specific attributes or methods that can be used to identify manipulations in an image. Equally, for every discovered attribute or method to unveil the non-integrity of a picture, there are very specific approaches to hide the traces giving the piece of media away. In general, the integrity of a picture can only be proven using nothing but itself by the absence of non-integrity and overall consistency. Nevertheless, depending on the reliability of the method, a single sign of tampering can also be a false positive and is therefore not necessarily indicative of actual manipulation.

For this chapter, we focus on naming just a few sources of patterns, that can be identifiable as forensic features for existing manipulation such as media forensics and deep fakes [33].

There are several sources of potential patterns and forensic features. One of them, for photos taken with a camera, is the camera itself. Each camera lens causes a distortion pattern that can be identified, which can be checked for its integrity. Manipulations of the photo, on the other hand, can disturb this pattern. The same is correct for the patterns formed by the color filter array (CFA) of the camera which is more periodic with “strong peaks in the fourier domain” [33]. The abstraction of noise independent from its exact source can also show manipulations and irregularities in images. Apart from noise patterns, there are also manipulation caused artifacts that can be identified in pictures separately. In particular, some image compression methods and formats (like jpg) cause a certain “grid-like pattern” [33]. When a picture is manipulated and compressed in several steps, differences and interruptions in the resulting compression patterns can uncover manipulated sections of an image. Both forensic and anti forensic techniques regarding image compression have been discussed for over a decade now [30, 31]. However, another interesting source of artifacts are manipulation operations itself. For instance, inserting an object into a picture in a convincing way requires “several post-processing steps to fit well the new context” [33] that can be identified during the forensic analysis.

Anti Forensic techniques have to address all of these forensic approaches specifically. These include measures against camera identification (lens and CFA patterns) and compression artifacts, but also many more anti forensic techniques like contrast manipulation, selective resampling, histogram remapping, unsharp masking, and more [26].

However, there is another dimension that has to be considered when discussing modern media forensics. Apart from classic media manipulations, nowadays, many kinds of AI-based generation techniques and models are on the rise, a recent example being ChatGPT (3 and 4) for text generation. However, also AI based image generation and manipulation technologies and services are on the rise. Nowadays, deepfake-generating technologies achieve “an extremely high degree of realism” which can have dramatic societal consequences [20]. Subsequently, many scientists focus on identifying pictures and images that have been generated from an AI rather than actually taken or created by hand. Subsequently, many approaches exist to use resulting traces to identify a picture as AI-generated or manipulated. However, this becomes harder as modern AI based methods aim to get rid of their forensic features. One example for that is a 2021 paper [21] describing a Generative Adversarial Network (GAN) able to generate images without raising so-called checkerboard artifacts, a forensic feature usually used to identify the generations of GANs. Nonetheless, investigators can use different AI approaches to identify forgery, such as Support Vector Machines [4] and Convolutional Neural Networks [5, 6]. On both sides, the increasing usage of AI based techniques proposes another whole adversarial game between suspect and investigator, and current research is directed at hardening the detection of AI based manipulation techniques [19].

While previous measure could be clearly evaluated against their effectiveness, for media integrity anti forensic techniques, there seems to be a pattern of ineffectiveness against an entire investigation when looked at almost each single measure that could be applied. For each anti forensic measure aimed at obstructing the integrity of media files, the focus on a single measure seems to be almost completely ineffective. Notably, this is true both for the suspect trying to obfuscate the integrity of a piece of media, but also the investigator who tries to figure out whether the same piece of media is authentic.

The overall complexity of hiding traces of manipulation (using several anti forensic techniques) in media is very high (depending on the degree of manipulation), since many potential forensic methods and techniques have to be considered. The time and resource consumption is equally high. The PoE is high as modern forensic tools support a variety of forensic techniques to uncover manipulations which have to be addressed by the perpetrator one by one. Therefore, the risk of not being aware of a specific forensic method is very high.

4 Conclusion

The estimations about the relevant effectivity attributes discussed in Sect. 2.2 implies two main conclusions. The first conclusion is that most anti forensic measures lack in at least one major regard. Table 1 provides a visual representation of the different severity categories. It shows that most measures are either hard to implement for the user, or pretty easy to mitigate for the investigator. This is also correlated to the general rule that in Cyber Security, the sophistication of an attack is positively correlated to its probability of success. However, the other major takeaway is that, as indicated by several authors in the past, encryption (especially full disk encryption) is a software-based AF measure that is outstandingly powerful and that can make static acquisition close to impossible when applied correctly. This proposes a major problem and is the reason for live-acquisition being increasingly popular when it comes to digital devices.

References

1.

Adamu, B.Z., Karabatak, M., Ertam, F.: A conceptual framework for database anti-forensics impact mitigation. In: 2020 8th International Symposium on Digital Forensics and Security (ISDFS), pp. 1–6 (June 2020)

2.

Ahn, N.Y., Lee, D.H.: Forensics and anti-forensics of a NAND flash memory: from a copy-back program perspective. IEEE Access 9, 14130–14137 (2021)Crossref

3.

Almotiri, S.D.: Forensic hash value guidelines: Why md5 and sha1 should no longer be used and a recommendation for their replacement (Mar 2022)

4.

Barni, M., Nowroozi, E., Tondi, B.: Higher-order, adversary-aware, double jpeg-detection via selected training on attacked samples. In: 2017 25th European Signal Processing Conference (EUSIPCO), pp. 281–285 (2017)

5.

Barni, M., Costanzo, A., Nowroozi, E., Tondi, B.: CNN-based detection of generic contrast adjustment with jpeg post-processing. In: 2018 25th IEEE International Conference on Image Processing (ICIP), pp. 3803–3807 (2018)

6.

Barni, M., Kallas, K., Nowroozi, E., Tondi, B.: CNN detection of GAN-generated face images based on cross-band co-occurrences analysis. In: 2020 IEEE International Workshop on Information Forensics and Security (WIFS), pp. 1–6 (2020)

7.

g0tmi1k: Kali Linux forensics mode, 13 (Nov 2021)

8.

Garfinkel, S.: Anti-forensics: techniques, detection and countermeasures. In: 2nd International Conference on i-Warfare and Security, vol. 20087, pp. 77–84 (2007)

9.

Göbel, T., Maltan, S., Türr, J., Baier, H., Mann, F.: ForTrace-a holistic forensic data set synthesis framework. Forensic Sci. Int.: Digital Invest. 40, 301344 (2022)

10.

Gül, M., Kugu, E.: A survey on anti-forensics techniques. In: 2017 International Artificial Intelligence and Data Processing Symposium (IDAP), pp. 1–6 (Sep 2017)

11.

Hausknecht, K., Gruičić, S.: Anti-computer forensics. In: 2017 40th International Convention on Information and Communication Technology, Electronics and Microelectronics (MIPRO), pp. 1233–1240 (May 2017)

12.

Hosgor, E.C.: Detection and mitigation of anti-forensics. Int. J. Comput. Sci. Inf. Secur. 18(12) (2020)

13.

Jadied, E.: Swap files anti-forensics on linux. In: 2016 Asia Pacific Conference on Multimedia and Broadcasting (APMediaCast), pp. 73–79 (Nov 2016)

14.

Jain, A., Chhabra, G.S.: Anti-forensics techniques: an analytical review. In: 2014 Seventh International Conference on Contemporary Computing (IC3), pp. 412–418 (Aug 2014)

15.

James, D.G.: Forensically unrecoverable hard drive data destruction. Infosec Writers. pp. 1–9 (2013)

16.

Javed, A.R., Ahmed, W., Alazab, M., Jalil, Z., Kifayat, K., Gadekallu, T.R.: A comprehensive survey on computer forensics: state-of-the-art, tools, techniques, challenges, and future directions. IEEE Access 10, 11065–11089 (2022)Crossref

17.

Kessler, G.C.: Anti-forensics and the digital investigator. In: 2007 5th Australian Digital Forensics Conference, pp. 1–7 (2007)

18.

Majed, H., Noura, H.N., Chehab, A.: Overview of digital forensics and anti-forensics techniques. In: 2020 8th International Symposium on Digital Forensics and Security (ISDFS), pp. 1–5 (June 2020)

19.

Nowroozi, E., Dehghantanha, A., Parizi, R.M., Choo, K.-K.R.: A survey of machine learning techniques in adversarial image forensics. Comput. Secur. 100, 102092 (2021)Crossref

20.

Nowroozi, E., Seyedshoari, S., Mohammadi, M., Jolfaei, A.: Impact of Media Forensics and Deepfake in Society, pp. 387–410. Springer International Publishing, Cham (2022)

21.

Osakabe, T., Tanaka, M., Kinoshita, Y., Kiya, H.: CycleGAN without checkerboard artifacts for counter-forensics of fake-image detection. In: International Workshop on Advanced Imaging Technology (IWAIT) 2021, vol. 11766, pp. 51–55. SPIE (2021)

22.

Pajek, P., Pimenidis, E.: Computer anti-forensics methods and their impact on computer forensic investigation. In: International Conference on Global Security, Safety, and Sustainability, pp. 145–155. Springer, Berlin (2009)

23.

Park, B., Savoldi, A., Gubian, P., Park, J., Lee, S.H., Lee, S.: Recovery of damaged compressed files for digital forensic purposes. In: 2008 International Conference on Multimedia and Ubiquitous Engineering (MUE 2008), pp. 365–372. IEEE (2008)

24.

Perklin, M.: Anti-forensics and anti-anti-forensics. In: Talk at DEF CON, 20 (2012)

25.

Phillips, B.J., Schmidt, C.D., Kelly, D.R.: Recovering data from USB flash memory sticks that have been damaged or electronically erased. In: Proceedings of the 1st International Conference on Forensic Applications and Techniques in Telecommunications, Information, and Multimedia and Workshop, e-Forensics ’08, Brussels, BEL, 2008. ICST (Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering)

26.

Qureshi, M.A., El-Alfy, E.-S.M.: Bibliography of digital image anti-forensics and anti-anti-forensics techniques. IET Image Process. 13(11), 1811–1823 (2019)Crossref

27.

Riaz, H., Tahir, M.A.: Analysis of VMware virtual machine in forensics and anti-forensics paradigm. In: 2018 6th International Symposium on Digital Forensic and Security (ISDFS), pp. 1–6. IEEE (2018)

28.

Safaryan, O., Cherckesova, L., Lyashenko, N., Razumov, P., Chumakov, V., Akishin, B., Lobodenko, A.: Modern hash collision cyberattacks and methods of their detection and neutralization. J. Phys.: Conf. Ser. 2131, 022099. IOP Publishing (2021)

29.

Solodov, D., Solodov, I.: Data recovery in a case of fire-damaged hard disk drives and solid-state drives. Forensic Sci. Int.: Rep. 3, 100199 (2021)

30.

Stamm, M.C., Tjoa, S.K., Lin, W.S., Liu, K.R.: Anti-forensics of JPEG compression. In: 2010 IEEE International Conference on Acoustics, Speech and Signal Processing, pp. 1694–1697. IEEE (2010)

31.

Stamm, M.C., Tjoa, S.K., Lin, W.S., Liu, K.R.: Undetectable image tampering through JPEG compression anti-forensics. In: 2010 IEEE International Conference on Image Processing, pp. 2109–2112. IEEE (2010)

32.

Sun, H.-M., Weng, C.-Y., Lee, C.-F., Yang, C.-H.: Anti-forensics with steganographic data embedding in digital images. IEEE J. Sel. Areas Commun. 29(7), 1392–1403 (2011)Crossref

33.

Verdoliva, L.: Media forensics and deepfakes: an overview. IEEE J. Sel. Top. Signal Process. 14(5), 910–932 (2020)Crossref

34.

Wahyudi, E., Riadi, I., Prayudi, Y.: Virtual machine forensic analysis and recovery method for recovery and analysis digital evidence. Int. J. Comput. Sci. Inf. Secur. 16(2) (2018)

35.

Winter, R.: SSD vs HDD–data recovery and destruction. Netw. Secur. 2013(3), 12–14 (2013)Crossref

36.

Zareen, M.S., Waqar, A., Aslam, B.: Digital forensics: latest challenges and response. In: 2013 2nd National Conference on Information Assurance (NCIA), pp. 21–29 (Dec 2013)

© The Author(s), under exclusive license to Springer Nature Switzerland AG 2024

E. Nowroozi et al. (eds.)Adversarial Multimedia ForensicsAdvances in Information Security104https://doi.org/10.1007/978-3-031-49803-9_11

Using Vocoder Artifacts For Audio Deepfakes Detection

Chengzhe Sun1  , Ehab AlBadawy², Timothy F Davison³, Sarah R Robinson³, Ming-Ching Chang² and Siwei Lyu¹

(1)

Department of Computer Science and Engineering, University at Buffalo, SUNY, Buffalo, NY, USA

(2)

Department of Electrical and Computer Engineering, University at Albany, SUNY, Albany, NY, USA

(3)

The Johns Hopkins University Applied Physics Lab, Laurel, MD, USA

Chengzhe Sun

Email: csun22@buffalo.edu

Keywords

DeepfakesMultimedia forensicsMachine and deep learningImage and video forensicsCybersecurity

1 Introduction

Recent years have seen the proliferation of synthetic media, riding the waves of the rapid advancement of AI technologies, in particular, deep learning. These synthetic media are more commonly known as the “DeepFakes,” a portmanteau of deep learning and fake media. State-of-the-art AI media synthesis methods can now create highly realistic still images and videos that can challenge the viewer’s ability to distinguish them from real media [13]. While AI-synthesized still images and videos are currently in the spotlight of public attention, synthetic human voices have also undergone considerable developments and are reaching unprecedented perceptual quality and generation efficiency. These AI-synthesized human voices can facilitate new capacities in voice-based user interfaces for smart home assistants and wearable devices and can be used to help patients whose speech abilities are damaged by strokes or ALS to gain a back voice. However, synthetic human voices could also be misused for deceptions and scams. One example is a recent incident in which a scammer used a synthetic voice created with AI algorithms to impersonate the CEO of a UK company in a phone call, which misled an employee to wire transfer a substantial amount of money to the scammer’s bank account [6].

While the detection of AI-synthesized still images and videos have been avidly studied in recent years [12], methods to detect synthetic human voices have received relatively less attention and are underdeveloped. One reason is that audio signals have different characteristics that hinder the direct application of image-based detection methods. Existing detection methods usually examine signal statistical features that are particular to audio signals. For instance, the work in [2] compares the higher-order statistics in the bi-spectral domain that capture the local phase inconsistencies in synthetic human voices.

In this work, we propose a new approach to detecting synthetic human voices based on exploiting artifacts introduced by the neural vocoders used in generating the synthesized voice signals. A neural vocoder is a specially-designed neural network that synthesizes audio waveforms from temporal-frequency representations such as mel-spectrograms. Because neural vocoders are the last step in most AI-based audio synthesis models, we think that they can provide cues to expose synthetic human voices. In particular, it is highly unlikely that real audio signals will be processed with neural vocoders.

Hence, the foremost objective of our work is to highlight the distinct signal artifacts left by neural vocoders in synthetic audio signals. As there exist no datasets of audio signals generated with different vocoders, we first construct a dataset entitled LibriVoc. LibriVoc includes a total of $$10.8$$ hours of “self-vocoding” derived from a subset of the human audio samples in the LibriTTS dataset [27]. Specifically, each input audio is transformed into the corresponding mel-spectral representation, and then the audio waveform is reconstructed using neural vocoders. We use six neural vocoders in creating the LibriVoc dataset to reflect the diversity in the architecture and mechanisms of neural vocoders. Because the “self-vocoding” samples are sourced from the same original audio signals, they highlight the artifacts introduced by the vocoders. While these artifacts are subtle to visualize, this work demonstrates that they can be captured by a trained classifier. As the vocoder artifacts are often subtle, we choose the recent RawNet2 model [18] as the backbone, which is designed to work with audio waveforms directly. Our experiments show that a multi-class classifier based on RawNet2 can identify vocoders from synthetic human voices with high accuracy.

We use six neural vocoders in creating the LibriVoc dataset to reflect the diversity in the architecture and mechanisms of neural vocoders. Because the “self-vocoding” samples are sourced from the same original audio signals, they highlight the artifacts introduced by the vocoders. Figure 1 shows the differences in the mel-spectrogram of one original voice and its self-vocoded voice signals. Visible artifacts introduced by different neural vocoder models can be observed, which serve as the basis of our detection algorithm. While these artifacts are subtle to visualize, this work demonstrates that they can be captured by a trained classifier. As the vocoder artifacts are often subtle, We choose the recent RawNet2 model [18] as the backbone, which is designed to work with audio waveforms directly. Our experiments show that a multi-class classifier based on RawNet2 can identify the vocoder to generate an audio waveform with high accuracy.

A set of 7 spectrograms of frequency versus time. They are titled Ground Truth, Mel G A N, parallel wave G A N, Wave Net, Wave R N N, Wave Grad, and Diff Wave. These are a combination of light and dark shades representing voice signals.

Fig. 1

Spectrogram difference between ground-truth and six neural vocoders

To take advantage of the vocoder artifacts in the detection of synthetic human voices, we design a multi-task learning strategy by using a binary classifier that shares the front-end feature extractor (e.g., RawNet2 [18]) with the vocoder identification. This is to accommodate the insufficient number of existing real and synthetic human voice samples by including the self-vocoding samples in LibriVoc as additional training data. We further employ a self-supervised representation learning (SSRL) approach [5], where we treat the vocoder identification as a pretext task to constrain the front-end feature extraction module to build the final binary classifier. Our experiments show that the RawNet2 model SSRL trained on LibriVoc achieves an overall high classification performance, corresponding to $$1.61\%$$ Equal Error Rate (EER) on the TTS dataset that we created with the state-of-the-art TTS algorithm Tacotron 2 [23]. Our method is also tested on a dataset in the DARPA SemaFor Hackathon 3 of synthetic human voices and achieves satisfactory classification performance.

The main contributions of our work are as follows:

We propose a new approach to detect AI-synthesized audios based on exposing subtle artifacts left by neural vocoders.

We propose a baseline algorithm for the unexplored problem of vocoder identification using the RawNet2 model.

We provide a large-scale dataset that includes samples generated from six different vocoder algorithms. To the best of our knowledge, this is the only dataset generated for the purpose of vocoder identification. We will make this dataset available to the research community.

2 Related Works on Audio Deepfake

In this section, we provide a brief overview of existing research related to our method. It is common practice to work with audio signals in their temporal-frequency representations, known as spectrograms. Spectrograms are 2D representations obtained from the short-time Fourier transform of the original 1D audio waveform. When working with human voices, the mel-spectrogram is often preferred. The mel-spectrogram is derived by redistributing the spectrogram onto the mel scale using a filter bank. The mel scale is a perceptual scale of pitches that are perceived as being equal in distance from one another. It was established through experimental observations, where listeners provided a set of points that created an equal frequency distance with perceived pitch. Using the mel-spectrogram representation, the distinctive features of human voices can be better revealed.

2.1 Human Voice Synthesis

Human voice synthesis is a significant area in artificial intelligence with practical applications like voice-driven intelligent assistants and accessible user interfaces. There are two main techniques for human voice synthesis: text-to-speech (TTS) and voice conversion (VC), described in Fig. 2. In this work, we focus on recent TTS and VC methods that utilize deep neural network models. TTS systems convert input text into audio using a target voice. They typically consist of three components: a text analysis module that transforms the text into linguistic features, an acoustic model that generates acoustic features (often in the form of mel-spectrograms) from the linguistic features, and a vocoder (Fig. 2 top row) for synthesizing the final audio waveform. Recent TTS models based on deep neural networks include WaveNet [15], Tacotron [21], Tacotron 2 [23], ClariNet [16], and FastSpeech 2s [17]. On the other hand, VC models take an input voice sample of one subject and generate output audio with the voice of another subject speaking the same utterance. Recent VC models [1, 3, 14] typically operate in the mel-spectral domain and employ deep neural networks to map the mel-spectrograms of the input and output voice signals. Neural styles transfer models such as variational auto-encoders (VAE) or generative adversarial networks (GAN) are often used to capture the elements of the input voice and combine them with the style of the output voice. The resulting mel-spectrogram is converted into an audio waveform using a neural vocoder. Both the TTS and VC models rely on deep neural network models trained on large-scale human voice corpora to achieve their performance.

A set of 2 illustrations of Deep Fake audio synthesis. It depicts text to speech on the top and voice conversion techniques on the bottom for human voice synthesis.

Fig. 2

Overall pipeline for DeepFake audio synthesis, including (top) text-to-speech and (bottom) voice conversion. Note that the vocoder is the common component in both types of methods

2.2 Neural Vocoders

In the realm of human voice synthesis models, vocoders play a critical and pervasive role in converting mel-spectrogram representations into the final output audio waveforms. Mel-spectrograms are commonly used to represent the acoustic features of speech, but the transformation from audio waveforms to mel-spectrograms inherently involves information loss due to binning and filtering. Consequently, reconstructing the original audio waveform from a mel-spectrogram poses a non-trivial inference problem. In recent years, significant progress has been made in developing deep neural network-based vocoders to address this challenge. These vocoders have improved training efficiency and synthesis quality compared to earlier approaches. Neural vocoders can generally be categorized into three main types: autoregressive models, diffusion models, and generative adversarial network (GAN)-based models. By leveraging deep neural network architectures, these vocoders have revolutionized the field of human voice synthesis, allowing for more efficient training and higher synthesis quality. Continued advancements in neural vocoders contribute to the ongoing progress in text-to-speech and voice conversion systems, ultimately enhancing the capabilities and realism of synthesized human voices (Fig. 3).

Three structural representations of the neural vocoders. GAN-based models with fine-tune training are at the top, autoregressive models with autoregressive models are present in the center, and diffusion models with the elimination of Gaussian noise are provided at the bottom.

Fig. 3

Structure of the three main classifications of the neural vocoders: GAN-based models (top), autoregressive models (middle), and diffusion models (bottom)

2.3 Autoregressive Models

Autoregressive models operate by sequentially generating the audio waveform, conditioning on previously generated samples. They often utilize recurrent neural networks (RNNs) or transformers to capture the dependencies in the temporal structure of the waveform. Popular autoregressive vocoders include WaveNet and its variants.

WaveNet [15] is a groundbreaking autoregressive neural vocoder widely used for audio synthesis, engineering, and deepfake applications. Operating at the waveform level, WaveNet captures complex dependencies using stacked causal filters and enlarged convolutions, resulting in high-fidelity audio with intricate temporal details. Its versatility allows it to serve as a text-to-speech (TTS) or voice conversion (VC) model, making it a valuable tool for creating natural-sounding speech and manipulating audio signals.

WaveRNN [9] is an autoregressive vocoder that efficiently predicts 16-bit raw audio samples from mel-spectrogram slices using a single-layer recurrent neural network. It focuses on generating high-quality audio while capturing fine-grained details in the waveform.

2.4 Diffusion Based Models

Diffusion models, which are probabilistic generative models, operate through two main processes [8] known as diffusion and reverse. The diffusion process involves a Markov chain that progressively introduces Gaussian noise to an original signal, gradually eliminating the noise. On the other hand, the reverse process is a de-noising stage that gradually removes the added Gaussian noise, ultimately converting a sample back to the original signal. Notable examples of diffusion-based vocoder models include WaveGrad [4] and DiffWave [10]. Diffusion models are known for their time efficiency compared to other vocoder models. However, they often exhibit lower reconstruction quality compared to autoregressive models, meaning that diffusion-based vocoders may generate samples with higher levels of noise and artifacts compared to other models. While diffusion models offer computational advantages, they may not match the reconstruction fidelity achieved by autoregressive models.

WaveGrad [4] model is an architecture that refines a white Gaussian noise input conditioned on a Mel-Spectrogram using an iterative gradient-based sampling process. It combines principles from score matching [20] and diffusion probabilistic models [8] to generate high-quality audio waveforms. The model iteratively updates the noise signal, aligning it with the target Mel-Spectrogram to produce accurate and realistic synthesized speech.

DiffWave [10] is a versatile diffusion probabilistic model for audio synthesis. It takes a white Gaussian noise as input and employs a fixed number of steps in a Markov chain process to gradually generate structured waveforms. The model is trained to optimize a variational bound on the data likelihood, resulting in high-quality audio synthesis in both conditional and unconditional scenarios.

2.5 GAN Based Models

GAN-based vocoders are built upon the framework of generative adversarial networks (GANs) [7]. These vocoders employ a GAN architecture consisting of a deep neural network generator that models the waveform signal in the time domain and a discriminator that assesses the quality of the generated speech. By leveraging the adversarial training process, GAN-based vocoders aim to generate high-quality speech waveforms that are indistinguishable from real human voices. Among the GAN-based vocoders, two prominent models are Mel-GAN [11] and Parallel WaveGAN [25]. GAN-based vocoders have shown remarkable performance in recent studies. They have demonstrated superior generation speed and quality compared to autoregressive and diffusion models. By leveraging the adversarial training mechanism and deep neural network architectures, GAN-based vocoders have achieved significant advancements in generating high-fidelity synthetic speech waveforms. These models play a crucial role in enhancing the realism and naturalness of synthesized human voices.

MelGAN [11] focuses on generating speech waveforms conditioned on mel-spectrograms. It employs a generator network that synthesizes the waveform given a mel-spectrogram as input, and a discriminator network that distinguishes between real and generated waveforms. The training process involves optimizing the generator and discriminator networks in an adversarial manner to enhance the quality of the generated speech.

Parallel WaveGAN [25] is a distillation-free, fast neural vocoder. it is proposed based on the GAN network and requires only a tiny memory footprint for waveform synthesis. Unlike the distillation-based model, it does not require the two-step training process. Therefore, Parallel WaveGAN performs faster in the training and generation process in audio synthesis work. Parallel WaveGAN introduces the joint optimization algorithm of short-time Fourier transform (STFT) loss and waveform-domain adversarial loss, which benefits the distillation model and convolutional network training.

2.6 Synthetic Audio Detection

In response to the potential misuse of synthetic human voices, significant progress has been made in developing methods for detecting such audio. One of the earliest approaches for AI-synthetic audio detection is based on bi-spectral analysis, as described in work by Albadawy et al. [2]. The Bi-spectral analysis [2] identifies subtle inconsistencies in the local phases of synthetic human voices. Unlike real human voice signals that exhibit random local phases due to sound propagation and environmental factors, synthetic human voices lack these natural characteristics. While these local phase inconsistencies may not be discernible to the human auditory system, they can be detected using bi-spectral analysis, thereby enabling the differentiation between synthetic and real human voices.

Another notable method for detecting synthetic audio is DeepSonar [22]. DeepSonar leverages the network responses of audio signals as features for synthetic audio detection. By analyzing the response patterns of audio signals using deep learning techniques, DeepSonar can effectively discriminate between synthetic and real human voices.

Furthermore, the ASVspoof Challenge 2021 has served as a platform to evaluate and benchmark state-of-the-art synthetic voice detection methods. Several primary baseline algorithms have achieved reliable performance in this challenge. These include the Gaussian mixture models CQCC-GMM [19], LFCC-GMM [19], a light convolutional neural network model LFCC-LCNN [19], and RawNet2 [18]. These methods employ various feature representations and classification models to distinguish between synthetic and real human voices.

Researchers are actively working towards improving the accuracy and robustness of synthetic voice detection methods by advancing techniques such as bi-spectral analysis, DeepSonar, and the evaluation frameworks provided by challenges like ASVspoof. These efforts are crucial in addressing the potential risks associated with the misuse of AI-synthesized human voices and ensuring the integrity of audio-based systems and applications.

3 Vocoder Detection

3.1 Speaker Verification Based Rawnet2

Our vocoder detection method is based on the recent RawNet2 model [18]. RawNet2 is an end-to-end model that was originally designed for the automatic speaker verification anti-spoofing task. It ranks among the best-performing baselines in the ASVspoof challenge [24]. The main reason for choosing RawNet2 as our main classifier is that RawNet2 was designed to work directly on raw waveforms. This helps by reducing any possible information loss associated with neural vocoder artifacts, as compared to working with pre-processed features e.g., mel-spectrograms, or linear frequency cepstral coefficients (LFCCs).

The RawNet2 model consists of three main components: fixed sink filters, a residual network, and a gated recurrent unit (GRU). We use the same model architecture that was originally proposed in [18]. We retrain the model on the LibriVoc training set and modify the number of predicted labels based on the experiments we conducted.

Let $$x_{t}$$ be a waveform in the time domain. We assume that the self-vocoding process performed on $$x_{t}$$ yields generation artifacts $$\gamma _{t|v}$$ where v is the neural vocoder employed in this process. The training samples will be

(1)

for synthesized waveforms and $$y_{t} = x_{t}$$ for the original waveforms. The RawNet2 classifier is trained on $$y_{t}$$ waveforms to indirectly look for the existence of the neural vocoder artifacts $$\gamma _{t|v}$$.

3.2 Vocoder Identification Based Rawnet2

We approach the problem of synthetic human voice detection by attempting to identify vocoder artifacts left in the audio signals. As it is highly unlikely for a real human voice signal to have vocoder artifacts other than our specifically designed self-vocoding signals, identifying the presence of vocoder artifacts can be used as an important feature to detect synthetic human voices.

To be more specific, let x be the waveform of a human voice signal that has a label $$y \in \{-1,+1\}$$ with $$+1$$ corresponding to a real human voice and $$-1$$ being the synthetic human voice. Our aim is to build a parameterized classifier that predicts the label of an input x.

(2)

We choose the recent RawNet2 model [18] as the backbone for our classifier. The reason is that RawNet2 was designed to work directly on raw waveforms. This helps by reducing any possible information loss associated with neural vocoder artifacts, as compared to working with pre-processed features such as mel-spectrograms or linear frequency cepstral coefficients (LFCCs).

Our classifier is constructed as a cascade of neural networks $$F_\theta (x) = B_{\theta _B}(R_{\theta _R}(x))$$, where $$R_{\theta _R}(x)$$ is the front-end RawNet2 model for feature extraction with its own set of parameters $$\theta _R$$, $$B_{\theta _B}$$ is a back-end binary classifier and $$\theta _B$$ are its specific parameters, with $$\theta = (\theta _R, \theta _B)$$. We can train this classifier directly, which is done in the previous work [26], by solving

(3)

where $$L_{\text{binary}}(y,\hat {y})$$ could be any loss function for binary classification, for instance, the cross-entropy loss. T stands for the training dataset with labeled real and synthetic human voice samples. However, this scheme predicates the existence of a large number of synthetic human voice samples. However, this condition is becoming harder to satisfy in practice as it is difficult to keep pace with the fast development of synthesis technology. More importantly, this model does not consider the distinct statistical characteristics of neural vocoders as an important cue for synthetic audio signals.

In this work, we reformulate this problem as one following the self-supervised representation learning [5]. In particular, we augment the model with a vocoder identifier $$M_{\theta _M}$$, which classifies a synthetic human voice signal into one of the $$c \in \{1,\cdots ,k\}$$ ($$k\ge 2$$) possible neural vocoder models. Our purpose here is to ensure the feature extractor will be sensitive to the statistical features in the vocoders. To this end, we form a new classification objective, as

(4)

In this equation, $$L_{\text{mult}}$$ is a multi-class loss function, and we use the soft-max loss in our experiments. $$T'$$ is a dataset containing only synthetic human voices but created with different neural vocoders as corresponding labels. This dataset is actually much easier to create by performing “self-vocoding”, creating synthetic human voices by running real samples through the process of mel-spectrogram transform and inverse, the latter performed with neural vocoders. We created such a dataset, LibriVoc, which is described in detail in Sect. 4.

Note that the two terms in the new learning objective function serve different roles. The first one is the original binary classification term, while the second one focuses on vocoder identification, which can be regarded as a pretext task in a self-supervised representation learning framework. The two terms share the feature extraction component so that the distinct features of the vocoders can be captured and transferred to the binary classification task. $$\lambda $$ is an adjustable hyper-parameter that controls the trade-off between the two loss terms. We start with equal weights ($$\lambda = 1$$) at the early epochs of training and then gradually reduce $$\lambda $$ to reflect the increasing importance of the main task against the pretext task. The overall optimization of the learning objective is achieved with a stochastic gradient descent algorithm.

4 The LibriVoc Datasets

Our experiments are based on three different datasets. The first one, LibriVoc, is constructed for the task of vocoder identification and will be described in detail subsequently.

The second dataset was also constructed for this work and contains real and synthetic speech created with a state-of-the-art TTS algorithm Tacotron 2 [23], combined with different vocoders in the synthesis process. The TTS dataset contains a total of 140 audio files, in which 120 audio files are generated by the tts model and the six different vocoders studied in this work, including WaveNet, WaveRNN, MelGAN, Parallel WaveGAN, WaveGrad, and DiffWave, and the last 20 original audio files are used as ground truth data.

The third dataset is the DARPA SemaFor Hackathon3 Challenge Problem 1 (HK3CP1). This challenging dataset includes a training set of 7000 audio clips generated with eight synthetic models (fastpitch, glowtts, gtts, tacotron, talknet, tacotron2, fastspeech2, Riva) and a testing set of $$10,000$$ clips with three additional models (mixertts, vits, speedyspeech) that are not in the training dataset. This dataset will be released to the public.

4.1 Librivoc High-Level Overview

We use state-of-the-art neural vocoders to generate synthesized speech samples in the LibriVoc dataset. Specifically, we employed six neural vocoders representing each vocoder category as detailed in Sect. 2.2: namely, WaveNet and WaveRNN from the autoregressive vocoders, Mel-GAN and Parallel WaveGAN from the GAN-based vocoders, and WaveGrad and DiffWave from the diffusion-based vocoders.

Throughout the rest of this paper, we will respectively refer to the two autoregressive models WaveNet and WaveRNN as A01 and A02, the two GAN-based models Mel-GAN and Parallel WaveGAN as G01 and G02, and the two diffusion models WaveGrad and DiffWave as D01 and D02. Original samples will be referred to as OGA; see Table 1 and Figs. 5 and 6. WaveNet (A01) is the most commonly used neural vocoder among the six studied in this work. However, we found Parallel WaveGAN (G02) to be the best-performing neural vocoder in terms of audio quality and processing speed.

Table 1

The number of hours of audio synthesized by each neural vocoder

Model

Train-clean-100

Train-clean-360

Dev-clean

Test-clean

WaveNet (A01)

4.28

15.49

0.75

0.76

WaveRNN (A02)

4.33

14.92

0.67

0.72

MelGAN (G01)

4.36

15.26

0.71

0.76

Parallel WaveGAN (G02)

4.37

15.54

0.68

0.75

WaveGrad (D01)

4.19

15.81

0.76

0.74

DiffWave (D02)

4.16

15.37

0.62

0.66

Total

25.69

92.39

4.19

4.39

4.2 Training Process

Each vocoder is trained to synthesize waveform samples from a given mel-spectrogram extracted from an original sample; this process is referred to as “self-vocoding.” By providing each vocoder with the same mel-spectrogram, we ensure that any unique artifacts present in the synthesized samples are attributable to the specific vocoder used to reconstruct the audio signal. We withhold a set of real samples from use as a validation set in the training process. By doing so, we also ensure that input samples will always be new to the vocoder, regardless of the training split. We fix the sampling rate across all audio samples to 24 kHz.

4.3 Train/Dev/Test Split Configuration

To ensure that our classifier does not overfit speaker identity during the training process, we design the LibriVoc dataset as follows:

Samples corresponding to 25% of the speakers contain only real (original) samples.

Samples corresponding to 25% of the speakers contain only synthesized samples.

For each speaker in the remaining 50%, we allocate half of the samples from that speaker to be real and the other half to be synthesized.

We further split the whole dataset into three non-overlapped sets for training ($$33,236$$ samples), development (5736 samples), and testing (4837 samples). The choice of each speaker and their samples are performed at random. This configuration is applied to each dataset split, namely the training set, development set, and test set. Half of the samples obtained from this configuration are reserved as real samples, and the other half are kept as-synthesized samples. Specifically, we have $$126.41$$ hours of real samples and $$118.08$$ hours of synthesized, self-vocoded samples in the training set. Table 1 shows a breakdown of the number of hours of synthesized samples allocated to each neural vocoder in our experiments.

By doing so, we ensure that our classifier does not over-fit speaker identity during the training process. To demonstrate the artifacts introduced by the neural vocoder, we show in Fig. 4 the differences in the mel-spectrogram of the original and self-vocoded voice signals. Such differences are the basis of the subsequent detection algorithm.

A set of 3 spectrograms. Original is at the top, self-vocoded is at the center, and their difference is at the bottom. These are a combination of dark and light shades representing voice signals.

Fig. 4

The artifacts introduced by the neural vocoders to a voice signal. Specifically, the mel-spectrogram of the original (top) and the self-vocoded (middle) voice signal. Their differences are shown in the bottom panel. The differences correspond to the artifacts introduced by the vocoder

5 Evaluation Results

To assess the effectiveness of our classifier in detecting neural vocoder artifacts, we conducted three distinct experiments, each employing different configurations.

5.1 Synthesized Audio Detection

In this experiment, we trained the RawNet2 classifier to predict whether a given sample $$y_t$$ is synthesized using a vocoder. To solve this problem, the classifier must look for the existence of neural vocoder artifacts $$\gamma _{t|v}$$. As this is a binary classification problem, the type of neural vocoder v employed in the generation process is not used to penalize the discriminator in the loss function. The RawNet2 classifier achieved a $$1.61\%$$ EER on the test-clean subset and a $$3.50\%$$ EER after applying the data augmentation procedures introduced in the previous section. Even though the artifacts of the neural vocoders are not audible, these results demonstrate that a classifier can detect such artifacts with high accuracy.

5.2 Classification of Neural Vocoder Artifacts

This experiment aimed to verify whether artifacts $$\gamma _{t|v}$$ generated by each neural vocoder v were unique to that vocoder. We altered the classification layer of RawNet2 to predict the seven different labels, wherein the first label is reserved for original samples and the other six for each of the neural vocoders we selected for our study. Figures 5 and 6 show the confusion matrices evaluated on the test-clean data subset from our second experiment with and without augmentation, respectively. The experiment yielded an EER of $$3.15\%$$ when using augmentation and a $$2.69\%$$ EER without augmentation. These results confirm two observations. First, the RawNet2 classifier can robustly detect vocoder artifacts even despite additive noise. Second, each neural vocoder v does produce unique artifacts $$\gamma _{t|v}$$, akin to a signature or vocoder fingerprint. As different vocoders produce different artifacts, we hypothesize that the inclusion of each neural vocoder at training time may be crucial for a classifier to detect artifacts reliably in the test set.

A 7 by 7 confusion matrix. Rows and columns are labeled O G A, A 0 1, A 0 2, G 0 1, G 0 2, D 0 1, and D 0 2. Highlighted values in the diagonal read 1, 0.87, 0.87, 1, 0.98, 1, and 0.86.

Fig. 5

Confusion matrix for the classification of individual neural vocoders and the original samples on the test-clean subset

A 7 by 7 confusion matrix. Rows and columns are labeled O G A, A 0 1, A 0 2, G 0 1, G 0 2, D 0 1, and D 0 2. Highlighted values in the diagonal read 1, 0.76, 0.64, 0.96, 0.89, 0.94, and 0.64.

Fig. 6

Confusion matrix for the classification of individual neural vocoders and the original samples on the augmented test-clean subset

5.3 Leave N Out Cross-Validation

To test the aforementioned hypothesis, we design a comprehensive experiment. The RawNet2 model is trained as a binary classifier in a leave N out setting, where N represents the number of excluded vocoders (ranging from 0 to 5 excluded). To ensure reliable results and robust analysis, we tested all possible combinations of neural vocoders that can be included in N. This process resulted in a total of 63 possible combinations to use for all N values. In the experiment, the EER value is displayed on the y-axis, while the number of vocoders included in the training set is represented on the x-axis, as illustrated in Fig. 7.

A graph of equal error rate versus the number of vocoders with error bars. Two curves denote the non-augmented and augmented test-clean subsets in a declining trend. Error bars indicate the standard error for the different combinations of the selected vocoders.

Fig. 7

Mean Equal Error Rate (EER) for detecting vocoded speech on the test-clean subset for different models trained with different numbers of vocoders. X-axis represents the number of vocoders used in the training set. Error bars represent the standard error for the different combinations of the selected vocoders. Blue and orange curves show the EER on the non-augmented and augmented test-clean subsets, respectively

The error bar in Fig. 7 reports the mean and standard deviation of all possible combinations for the same N value on both the augmented and non-augmented test-clean subset. Our findings demonstrate that both the mean and standard deviation of EER decrease as more vocoders are added to the training set. Furthermore, we observed that the effect of augmentation on overall performance is more noticeable in experiments with low EER values as compared to those with higher ones. This observation is particularly interesting, as it highlights the impact of augmentation on the efficacy of the RawNet2 classifier. In conclusion, our results confirm the initial hypothesis that using fewer vocoders in the training set reduces the efficacy of the RawNet2 classifier when detecting artifacts from unseen vocoders. This insight has significant implications for the development and refinement of deep learning models in the context of vocoder detection and classification.

5.4 Robustness and Ablation Studies

In order to test the robustness of our detection method under common data post-processing steps, we further construct an augmented, degraded dataset derived from the LibriVoc test dataset. This allows us to evaluate the performance of our method in more challenging conditions that better represent real-world scenarios. To create this augmented dataset, we perform two main data manipulation operations on the original LibriVoc test dataset.

First, we resample the input speech to intermediate sampling rates (8 kHz, 16 kHz, 22.05 kHz, 32 kHz, and 44.1 kHz) and then resample back to the original sampling rate (24 kHz). This process simulates the effects of potential signal degradation that may occur during the storage, transmission, or processing of audio files in real-life situations. By evaluating our detection method on resampled audio, we can determine whether our model is robust to the varying quality levels that may be encountered in practice.

In addition to resampling, we also add background noise to the audio signals to simulate noisy environments that are commonly experienced in real-world situations. This noise is drawn from a single pre-recorded sample of crowd noise corresponding to three Signal-to-Noise Ratio (SNR) values (8dB, 10dB, and 20dB). The probabilities of choosing between the original, re-sampled, or noisy speech segments are 40%, 40%, and 20%, respectively. This ensures that the augmented dataset contains a diverse mix of audio samples, reflecting various levels of degradation and noise.

The confusion matrix in Fig. 6 corresponds to the vocoder identification performance on the augmented dataset, which results in an EER of $$3.50$$%. This performance demonstrates that our detection method is indeed robust to common data post-processing steps, such as resampling and the addition of background noise. This finding is significant because it suggests that our method can effectively identify vocoders even in less-than-ideal conditions.

In addition to evaluating the robustness of our detection method, we also study the effect of the number of vocoders included in the training process. To do this, we train detectors following the method of Sect. 3 in a leave N out setting, where N represents the number of excluded vocoders (ranging from 0 to 5 excluded). For reliable results, we tested all possible combinations of which neural vocoder to be included in N. This resulted in 63 possible combinations to use for all N values.

Figure 7 presents the EER value on the y-axis and the number of vocoders included in the training set on the x-axis. The error bar reports the mean and standard deviation of all possible combinations for the same N value on both the augmented and non-augmented test-clean subsets. As illustrated in the figure, both the mean and standard deviation of EER decrease as more vocoders are added to the training set. This finding suggests that the performance of the RawNet2 classifier improves as it is exposed to a larger variety of vocoders during the training process.

Furthermore, we observed that the effect of augmentation on overall performance is more noticeable in experiments with low EER values as compared to those with higher ones. This indicates that the RawNet2 classifier may be more sensitive to the presence of augmentation when it is already performing well, potentially due to overfitting or other factors. These results confirm that using fewer vocoders in the training set reduces the efficacy of the RawNet2 classifier when detecting artifacts from unseen vocoders. Therefore, it is crucial to include as many vocoders as possible during the training process to ensure the best possible performance of the overall detection system.

6 Conclusion

In this study, we develop a novel model for vocoder identification based on the RawNet2 model. We also introduce a large-scale dataset named LibriVoc, which contains synthetic audio samples of human voices created with a diverse set of neural vocoders. Through experiments conducted on this dataset, our method has demonstrated promising results, achieving an overall vocoder identification Equal Error Rate (EER) of $$1.61\%$$. This performance indicates that the proposed model can effectively identify and distinguish between various vocoders, playing a crucial role in detecting synthetic audio.

Despite these encouraging results, there is still room for improvement in our work, and several extensions are being considered for future research. Firstly, we aim to augment the LibriVoc dataset by incorporating more diverse real audio signals and environments. By expanding the dataset, we can enhance the robustness of our model, enabling it to effectively identify vocoders in a wider range of scenarios. This expansion will not only make our model more practical for real-world applications but also contribute to the understanding of the underlying characteristics of vocoders and their interactions with different audio environments.

Secondly, the field of neural vocoders is rapidly evolving, with new models and techniques being developed continually. To ensure that our vocoder identification model remains relevant and effective, it is important to keep pace with the latest developments and augment the model zoo accordingly. By regularly updating our model to account for recent advancements, we can maintain its cutting-edge performance and accuracy in identifying the latest neural vocoders.

In addition to these extensions, we will explore more tailored solutions to the vocoder identification problem. Although the RawNet2-based model has shown promising results, there may be alternative models or techniques that can further improve performance in specific scenarios or for particular types of vocoders. By investigating these potential avenues, we can develop a more comprehensive and effective solution to the vocoder identification challenge.

Lastly, it is important to note that the identification of vocoders is only indirect evidence of voice synthesis. While our model can accurately distinguish between different vocoders, it does not directly differentiate between real and synthetic audio. As a result, we are interested in developing further effective methods that can directly discern real and synthetic audio by combining cues from vocoders and other signal features of audio deepfakes. These new methods may provide more definitive evidence of synthetic audio, enhancing our ability to detect and mitigate the impact of audio deepfakes in various contexts.

In conclusion, our work on vocoder identification using the RawNet2 model and the LibriVoc dataset has demonstrated promising results, achieving an overall EER of $$1.61\%$$. However, there remains significant scope for future research, including augmenting the dataset, updating the model zoo, exploring tailored solutions, and developing methods to directly differentiate between real and synthetic audio. By addressing these areas, we can continue to advance the field of vocoder identification, ultimately contributing to the detection and prevention of audio deepfakes and their potential harms.

References

1.

AlBadawy, E.A., Lyu, S.: Voice conversion using speech-to-speech neuro-style transfer. In: Proceedings of the Interspeech 2017 (2020)

2.

AlBadawy, E.A., Lyu, S., Farid, H.: Detecting AI-synthesized speech using bispectral analysis. In: CVPR Workshops, pp. 104–109 (2019)

3.

Chen, L.H., Ling, Z.H., Liu, L.J., Dai, L.R.: Voice conversion using deep neural networks with layer-wise generative training. IEEE/ACM Trans. Audio Speech Lang. Process. 22(12), 1859–1872 (2014)Crossref

4.

Chen, N., Zhang, Y., Zen, H., et al.: WaveGrad: estimating gradients for waveform generation. In: ICLR (2020)

5.

Ericsson, L., Gouk, H., Loy, C.C., Hospedales, T.M.: Self-supervised representation learning: introduction, advances and challenges. IEEE Signal Process. Mag. 32 (2022)

6.

Forbes: A Voice Deepfake Was Used To Scam A CEO Out Of $243,000 (2019). https://​www.​cnn.​com/​2020/​02/​20/​tech/​fake-faces-deepfake/​index.​html

7.

Goodfellow, I., Pouget-Abadie, J., Mirza, M., et al.: Generative adversarial nets. In: NeurIPS vol. 27 (2014)

8.

Ho, J., Jain, A., Abbeel, P.: Denoising diffusion probabilistic models. In: NeurIPS (2020)

9.

Kalchbrenner, N., Elsen, E., Simonyan, K., et al.: Efficient neural audio synthesis. In: ICML (2018)

10.

Kong, Z., Ping, W., Huang, J., et al.: DiffWave: a versatile diffusion model for audio synthesis. In: ICLR (2020)

11.

Kumar, K., Kumar, R., de Boissiere, T., et al.: MelGAN: generative adversarial networks for conditional waveform synthesis (2019). arXiv. https://​ieeexplore.​ieee.​org/​document/​9105991

12.

Lyu, S.: DeepFake detection: current challenges and next steps. In: International Workshop on Media-Rich Fake News (MedFake) in Conjunction with ICME. London (2020)

13.

Mirsky, Y., Lee, W.: The creation and detection of deepfake: A survey. ACM Comput. Surv. 54(1) (2021)

14.

Mohammadi, S.H., Kain, A.: Voice conversion using deep neural networks with speaker-independent pre-training. In: 2014 IEEE Spoken Language Technology Workshop (SLT), pp. 19–23. IEEE (2014)

15.

van den Oord, A., Dieleman, S., Zen, H., et al.: WaveNet: a generative model for raw audio (2016). arXiv. https://​arxiv.​org/​abs/​1609.​03499

16.

Ping, W., Peng, K., Chen, J.: Clarinet: Parallel wave generation in end-to-end text-to-speech. Preprint (2018). arXiv:1807.07281

17.

Ren, Y., Hu, C., Tan, X., Qin, T., Zhao, S., Zhao, Z., Liu, T.Y.: FastSpeech 2: fast and high-quality end-to-end text to speech (2020). Preprint arXiv:2006.04558

18.

Tak, H., Patino, J., Todisco, M., Nautsch, A., Evans, N., Larcher, A.: End-to-end anti-spoofing with RawNet2. In: ICASSP 2021-2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 6369–6373. IEEE (2021)

19.

Todisco, M., Wang, X., Vestman, V., Sahidullah, M., Delgado, H., Nautsch, A., Yamagishi, J., Evans, N., Kinnunen, T., Lee, K.A.: ASVspoof 2019: future horizons in spoofed and fake audio detection. Preprint (2019). arXiv:1904.05441

20.

Vincent, P.: A connection between score matching and denoising autoencoders. Neural Comput. (2011)

21.

Wang, Y., Skerry-Ryan, R.J., Stanton, D., Wu, Y., Weiss, R.J., Jaitly, N., Yang, Z., Xiao, Y., Chen, Z., Bengio, S., Le, Q.V., Agiomyrgiannakis, Y., Clark, R., Saurous, R.A.: Tacotron: a fully end-to-end text-to-speech synthesis model. CoRR (2017). arXiv:abs/1703.10135. http://​arxiv.​org/​abs/​1703.​10135

22.

Wang, R., Juefei-Xu, F., Huang, Y., Guo, Q., Xie, X., Ma, L., Liu, Y.: Deepsonar: towards effective and robust detection of ai-synthesized fake voices. In: Proceedings of the 28th ACM International Conference on Multimedia, pp. 1207–1216 (2020)

23.

Wang, Z., Liu, Y., Shan, L.: CE-Tacotron2: end-to-end emotional speech synthesis. In: 2021 60th Annual Conference of the Society of Instrument and Control Engineers of Japan (SICE), pp. 48–52 (2021)

24.

Yamagishi, J., Wang, X., Todisco, M., Sahidullah, M., Patino, J., Nautsch, A., Liu, X., Lee, K.A., Kinnunen, T., Evans, N., et al.: ASVspoof 2021: accelerating progress in spoofed and deepfake speech detection. Preprint (2021). arXiv:2109.00537

25.

Yamamoto, R., Song, E., Kim, J.M.: Parallel WaveGAN: a fast waveform generation model based on generative adversarial networks with multi-resolution spectrogram. In: ICASSP (2020)

26.

Yang, G., Yang, S., Liu, K., et al.: Multi-band melgan: faster waveform generation for high-quality text-to-speech. In: SLT Workshop, pp. 492–498 (2021)

27.

Zen, H., Dang, V., Clark, R., Zhang, Y., Weiss, R.J., Jia, Y., Chen, Z., Wu, Y.: LibriTTS: a corpus derived from LibriSpeech for text-to-speech. Preprint (2019). arXiv:1904.02882

Index

A

Adaptive aggregation1–23

Adversarial attack – –28152051949698191204

Adversarial examples –191193200

Adversarial forensics for multimedia –5157145150161

Adversarial machine learning –125121497126167168179198199207

Anti forensic – – – – –5658617983859498114237259

Anti-forensic attack – –6163647383859598

Anti forensic measures –237259

Anti forensic measures and their impact on forensic investigation –237259

C

Composite sketch150155156161

Computer forensics238

Contrastive learning97

Counterfeiting84151238

Counter-forensic61

Cyber security238

D

Data hiding172178238240252

Deep fakes – –57627980258263281

Deep learning (DL) –4629333593125132141152165168176191263279

Deep learning for forensics579697191

Defenses techniques based on randomization202

Digital forensics –5585146

DNN IPR protection207

DNN watermarking –207234

Domain specific methods147149150152153155156161

E

Encryption –4240253255257259

F

Federated learning –123

Forensic – –57586893145161191202238258

G

Generative adversarial networks (GAN) – –5585125141

Generative adversarial networks for artificial satellite creation and manipulation –125141

H

Holistic comparison147149152

I

Image and video forensics187

Image classification –3414135191194208

Image forensics –145161191202220

Image forgery –2951

Image forgery detection –2951

Image manipulation – – –293156647577838593191204248

Image splicing –93120

Image tampering32192

L

Linguisitc steganography –163187

Linguistic steganalysis –163187

M

Machine and deep learning (ML/DL)5561

Manipulation detection of images –31193196199

Media forensic258

Media integrity –244258259

Model poisoning attack –123

Morphological analysis147149152

Multimedia forensics –145150161

P

Partial occlusion –150153155157161

Photo anthropometry147152

R

Robust DNN watermarking –207234

Robustness – – – – – – – – –24681216182023414450527797191199204207209210212214222227232271279280

S

Satellite image analysis –125141

Security –24710327580145163170187192194196204216225227234238259

Superimposition147150152153

Synthetic data –56798185125

Synthetic images – –125127129132134135141

Synthetic satellite images –125127129

V

Vision transformer –126128129138140

W

White box watermarking –5799108191192195198199208210212232