On Detection of Median Filtering in Digital Images
Matthias Kirchner a and Jessica Fridrich b
a Technische Universita ̈t Dresden, Dept. of Computer Science, 01062 Dresden, Germany
b SUNY Binghamton, Dept. of Electrical and Computer Engineering, Binghamton, NY 13902 ABSTRACT
In digital image forensics, it is generally accepted that intentional manipulations of the image content are most critical and hence numerous forensic methods focus on the detection of such ‘malicious’ post-processing. However, it is also beneficial to know as much as possible about the general processing history of an image, including content-preserving operations, since they can affect the reliability of forensic methods in various ways. In this paper, we present a simple yet effective technique to detect median filtering in digital images—a widely used denoising and smoothing operator. As a great variety of forensic methods relies on some kind of a linearity assumption, a detection of non-linear median filtering is of particular interest. The effectiveness of our method is backed with experimental evidence on a large image database.
Keywords: digital forensics, median filter, processing history, image processing 1. INTRODUCTION
Digital image forensics has recently become a widely studied stream of research in multimedia security. Ubiqui- tous digital imaging devices and sophisticated editing software gave rise to the need for forensic toolboxes that can blindly assess the authenticity of digital images without access to the source image or source device1, 2 or the aid of an auxiliary watermark signal.3 When reasoning about the authenticity of digital images, it is necessary to have at least a rough working definition of what constitutes a manipulation and what is considered to be a ‘legitimate’ post-processing.4 It is generally accepted that intentional manipulations of the image content (e.g., copy & paste operations or image splicing) are more critical and hence numerous forensic methods focus on de- tection of such ‘malicious’ post-processing. However, it is also beneficial to know as much as possible about the general processing history of an image, including content-preserving operations, such as compression,5 contrast enhancement,6 sharpening,7 and denoising.
Even though such image processing primitives typically do not harm the authentic value of an image, they are of interest in a forensic examination of an image since they can affect forensic methods in various ways. First, the actual state of an image prior to manipulation may influence the set of tools we are using to analyze the image or our interpretation of the evidence derived from these tools. This is related to the field of steganalysis, where, for instance, the choice of a suitable spatial-domain detector should be made conditional to the cover properties.8 Second, certain post-processing steps may interfere with or diminish subtle traces of previous manipulations and thus decrease the reliability of forensic methods.
In the course of this paper, we shall focus on the median filter, a well-known denoising and smoothing operator.9 In the line with what was mentioned above, we believe that a detection of median filtered images is of particular interest since a great variety of image forensic techniques rely on some kind of linearity assumption. Because median filtering is a highly non-linear operation, it is likely to affect the reliability of these methods. A typical example is the detection of resampling,10 which employs a local linear predictor of pixel intensities and was shown to be vulnerable to median filtering.11
The rest of this paper is organized as follows: Starting from a short review of basic properties of the median filter in Sect. 2, we will center on the so-called streaking artifacts in Sect. 3 and show how this characteristic can actually be used to detect median filtering in bitmap images. Since forensic methods are generally desired to be robust against lossy post-compression, Sect. 4 will focus on detection of median filtering after JPEG compression. Both sections are underpinned by detailed experimental results from a large database of images. Finally, Sect. 5 concludes the paper.
Further author information: matthias.kirchner@inf.tu-dresden.de, fridrich@binghamton.edu
2. MEDIAN FILTERED IMAGES
Given a set of random variables X = (X1,X2,…,XN), the order statistics X(1) ≤ X(2) ≤ ··· ≤ X(N) are random variables, defined by sorting the values of Xi in an increasing order. The median value is then given as
X(K+1) = X(m) , for N = 2K + 1
median(X)= 1/2 X(K)+X(K+1) , forN=2K, (1)
where m = 2K + 1 is the median rank. The median is considered to be a robust estimator of the location parameter of a distribution and has found numerous applications in smoothing and denoising, especially for signals contaminated by impulsive noise.9
For a grayscale input image with intensity values xi,j, the two-dimensional median filter is defined as yi,j = median(xi+r,j+s) ,
(r,s)∈W
where W is a window over which the filter is applied. For the rest of this paper, we assume symmetric square windows of size M × M with M = 2L + 1, i.e., the median rank m equals m = (M2 + 1)/2. This is probably also the most widely used form of this filter.
In order to describe some characteristics of median filtered images and compare the median filter to other filters, it is useful to study the output distribution of the median filter. Due to its non-linearity, however, theoretical analysis of the general relation between the input and output distribution of the median filter is highly non-trivial. For this reason, it is often assumed that the input samples are i.i.d. The general cumulative distribution function (CDF) FY for output samples yi,j and i.i.d. input samples xi,j with CDF FX is given by12
M2
M2 k M2−k
k [FX(y)] [1−FX(y)] ,
xi,j ∼ N (μ, σ), which was shown to asymptotically (as M → ∞) follow a normal distribution again,13, 14
π σ yi,j ∼ N(μ,σm), where σm = 2 · M .
Since, in filtered images, pixels in a close neighborhood originate from overlapping windows, they are corre- lated to some extent and thus the joint distribution of adjacent pixels is generally of interest. For an M × M median filter with i.i.d. input FX(x), Liao et al.15 derive an expression for the bivariate distribution of two output pixels yp and yq (H pixels window overlap), FY (yp,yq). The formula, which can be found in Appendix A, highlights how cumbersome the theoretical description of median filtered images can become even under the unrealistic assumption of i.i.d. pixel intensities.
For this reason, many studies in the literature have focused on more specific features of interest when analyzing the median filter. As such, the median filter was found to preserve edges better than, for instance, the moving average filter.16 It is also known that median filtered images exhibit regions of constant or nearly constant intensities.17 Afurtherstreamofresearchaddressestheso-calledrootsofthemedian—signalswhichareinvariant to median filtering—as well as the convergence of arbitrary signals to such roots.18