Copy-Move Forgery Detection

The foundational detection mechanism partitions an image into overlapping or non-overlapping pixel blocks, then extracts feature vectors from each block for similarity comparison. Key architectural elements include:

• Square block decomposition: Images are divided into fixed-size blocks (typically 8×8 or 16×16 pixels) to create a searchable feature space
• Lexicographic sorting: Feature vectors are sorted to bring similar blocks into proximity, reducing computational complexity from O(n²) to O(n log n)
• Shift vector clustering: Identical blocks separated by the same spatial offset indicate a duplicated region, with clustering algorithms filtering out false matches from uniform textures

Real-world implementations must balance block size against detection sensitivity—smaller blocks detect finer forgeries but increase false positives from natural image self-similarity.

Modern detection systems employ feature descriptors robust to common post-processing operations forgers use to hide duplication traces. Critical invariant features include:

• Zernike moments: Orthogonal moments computed on the unit circle that provide rotation invariance, allowing detection even when copied regions are rotated before pasting
• Scale-Invariant Feature Transform (SIFT): Keypoint-based descriptors that remain stable under scaling, rotation, and illumination changes, enabling detection of resized duplicated regions
• Fourier-Mellin Transform: A frequency-domain approach that decouples rotation and scaling parameters, achieving invariance through log-polar coordinate mapping
• Local Binary Patterns (LBP): Texture descriptors encoding local pixel intensity relationships, providing robustness to contrast adjustments and JPEG compression

These features are essential because sophisticated forgers rarely paste exact pixel copies—they apply geometric transformations to blend the duplicated region seamlessly.

Detection algorithms must withstand deliberate counter-forensic operations applied after duplication. Common attacks and countermeasures include:

• JPEG recompression resistance: Feature extraction in the DCT coefficient domain rather than spatial domain provides inherent robustness, as quantization artifacts are part of the feature representation
• Gaussian blurring mitigation: Multi-scale analysis using Gaussian pyramid decomposition detects duplicated regions even after edge-smoothing operations
• Additive noise handling: Wiener filtering as a preprocessing step estimates and removes noise before block matching, preventing noise injection from breaking feature similarity
• Color space transformations: Converting images to YCbCr or HSV color spaces isolates luminance from chrominance, allowing detection even when color balancing is applied to the duplicated region

The arms race between forgery sophistication and detection robustness drives continuous evolution of invariant feature engineering.

Two competing detection paradigms exist, each with distinct trade-offs for different forgery scenarios:

• Keypoint-based methods: Extract distinctive points (SIFT, SURF) only from high-entropy image regions. Advantages: Computationally efficient, inherently robust to rotation and scaling. Limitations: Fail on smooth, textureless regions where no keypoints are detected—precisely where forgers often duplicate content like sky or walls
• Dense field methods: Process every pixel location using sliding windows or overlapping blocks. Advantages: Complete image coverage, detect forgeries in uniform areas. Limitations: Significantly higher computational cost, more false positives requiring sophisticated post-processing filters

Hybrid architectures now combine both approaches, using keypoint matching for initial candidate region identification followed by dense block verification only in suspicious areas.

Natural image self-similarity—repeating textures like grass, foliage, or architectural patterns—generates abundant false matches that must be filtered. Primary mitigation techniques include:

• Shift vector histogram analysis: Genuine copy-move forgeries produce a concentrated peak in the shift vector histogram at the translation offset, while natural textures produce random, distributed vectors
• Correlation coefficient thresholding: Adjacent matched blocks are tested for spatial coherence—duplicated regions exhibit consistent neighborhood relationships absent in random texture matches
• Morphological post-processing: After generating a binary suspicion map, morphological operations (opening, closing) remove isolated false positive pixels while preserving connected duplicated regions
• Same Affine Transformation Selection (SATS): Clustering matched features that share identical geometric transformation parameters, filtering out matches with inconsistent rotation or scaling

Without these filters, detection precision drops below 40% on images with significant natural texture repetition.

Practical deployment in forensic tools and content moderation platforms requires optimization beyond algorithmic complexity reduction. Production techniques include:

• GPU-accelerated block matching: Parallelizing feature extraction and similarity computation across thousands of CUDA cores reduces processing time from minutes to seconds for high-resolution images
• Discrete Wavelet Transform (DWT) approximation: Applying DWT decomposition and performing detection only on low-frequency sub-bands reduces data volume by 75% while preserving forgery-relevant structural information
• PatchMatch integration: Randomized nearest-neighbor field algorithms approximate block correspondences without exhaustive search, achieving near-linear runtime on gigapixel images
• Integral image preprocessing: Precomputing summed-area tables enables constant-time feature extraction over arbitrary rectangular regions, critical for multi-scale analysis pipelines

These optimizations enable integration into real-time upload filters on platforms processing millions of images daily.

Identifies boundaries where a region from a donor image has been inserted into a host image. Unlike copy-move forgery, the duplicated region originates from a different source file, creating inconsistencies in noise patterns, JPEG compression history, and color profiles at the splice boundary. Detection often relies on noise inconsistency analysis and edge discontinuity metrics.

Forensic identification of image regions reconstructed to remove objects. Inpainting algorithms leave characteristic interpolation artifacts and texture synthesis patterns that differ from natural image statistics. Key detection methods include analyzing local variance consistency and searching for patches with abnormally high similarity to their neighbors, indicating algorithmic reconstruction.

Detects statistical fingerprints left when a JPEG image is decompressed, manipulated, and saved again. The presence of two distinct quantization tables reveals the image's edit history. Detection algorithms analyze first-digit statistics of Discrete Cosine Transform (DCT) coefficients and identify periodic artifacts in the coefficient histograms that indicate recompression.

Compresses an image at a known quality level and analyzes the difference from the original to identify regions with different compression histories. Areas that have been manipulated and resaved exhibit higher error levels than the rest of the image. ELA produces a heatmap visualization where brighter regions indicate potential tampering, though results require careful interpretation to avoid false positives from edges and textures.

Uses the deterministic high-frequency noise unique to every camera sensor as a biometric for source verification. Photo Response Non-Uniformity (PRNU) patterns are caused by manufacturing imperfections in the silicon sensor. If a forged region lacks the host camera's PRNU signature or contains a different sensor's pattern, it indicates tampering. This technique provides pixel-level tampering localization.

Estimates the demosaicing algorithm used by a digital camera's Color Filter Array. Digital sensors capture only one color per pixel; the missing colors are interpolated from neighbors, creating predictable pixel correlation patterns. Deviations from the expected interpolation signature in a localized region suggest that pixels were introduced from an external source or algorithmically generated.