Photo Response Non-Uniformity (PRNU) Analysis

PRNU arises from manufacturing imperfections in the silicon wafer during CCD or CMOS sensor fabrication. These microscopic variations cause individual pixels to exhibit slightly different sensitivity to the same photon flux, creating a spatially unique, stable pattern that is independent of scene content. This pattern is a multiplicative noise component, meaning its strength scales with the intensity of light hitting each pixel. Because no two sensors—even from the same production batch—have identical defect patterns, PRNU serves as a biometric identifier for the camera. The pattern remains consistent over the sensor's lifetime, surviving firmware updates and moderate physical wear, making it a robust forensic marker.

To verify if a disputed image originated from a suspect camera, the forensic analyst computes the normalized cross-correlation between the image's noise residual and the camera's reference PRNU pattern. A detection statistic, typically the Peak to Correlation Energy (PCE) ratio, is calculated. The PCE measures the sharpness of the correlation peak relative to the surrounding correlation noise floor. A high PCE value (e.g., > 60) provides strong statistical evidence that the image was captured by the specific device. This method is robust against JPEG compression up to moderate quality factors, as the quantization noise does not completely destroy the underlying multiplicative sensor pattern.

Beyond global source identification, PRNU can localize image tampering. If a region of an image was spliced from a different camera or synthetically generated, that region's noise residual will not correlate with the host camera's PRNU. The technique operates by:

• Dividing the disputed image into a grid of overlapping sliding windows.
• Computing the correlation statistic for each block against the reference pattern.
• Generating a heatmap where low-correlation blocks indicate potential forgeries. This method is particularly effective at detecting localized manipulations like object insertion or face swapping, as the inserted region carries the PRNU of a different source or no PRNU at all.

Adversaries can attempt to defeat PRNU analysis through counter-forensic attacks. The most common is flat-fielding, where an attacker estimates the camera's PRNU from a set of benign images and subtracts it from a forged image. Other attacks include:

• Seam-carving: Content-aware resizing that disrupts the spatial alignment of the PRNU pattern.
• Geometric transformations: Rotation or perspective correction that desynchronizes the image grid from the reference pattern, requiring computationally expensive resynchronization.
• Strong adaptive denoising: Applying aggressive filtering that attenuates the high-frequency PRNU signal, though this also degrades image quality. Forensic analysts counter these by testing for the presence of interpolation artifacts that indicate geometric manipulation.

PRNU analysis extends beyond still images to digital video forensics. Each frame of a video contains the sensor's PRNU, but the pattern is often attenuated by temporal noise reduction and video compression codecs. Analysts can:

• Average noise residuals across multiple I-frames to recover a stable video PRNU.
• Use the extracted pattern to link a video to a specific device or to detect frame deletion or insertion by identifying breaks in the temporal consistency of the PRNU signal. In multi-modal forensics, PRNU can be cross-referenced with acoustic microphone fingerprints to verify that an audio-visual recording originated from a single, coherent device, strengthening the chain of custody.

The deterministic high-frequency noise component unique to every camera sensor, caused by microscopic manufacturing imperfections in the silicon wafer. This pattern acts as a robust biometric for identifying the source device.

• Pixel Non-Uniformity (PNU): The dominant component of sensor noise, distinct from random shot noise.
• Stability: Remains consistent over the sensor's lifetime, unaffected by temperature or wear.
• Extraction: Requires averaging multiple flat-field images to isolate the reference pattern.

The process of determining the make and model of the source camera from an image by analyzing proprietary in-camera processing traces, lens distortion, and sensor noise characteristics.

• Proprietary Traces: Identifies the specific demosaicing algorithm and color correction matrix used by the manufacturer.
• Lens Distortion: Analyzes radial distortion patterns unique to specific lens-sensor combinations.
• JPEG Quantization Tables: Examines the compression parameters hardcoded into the camera's firmware.

The forensic estimation of the demosaicing algorithm used by a digital camera's Color Filter Array. Since each pixel captures only one color, the camera interpolates the missing two.

• Correlation Patterns: Legitimate images show consistent periodic correlations between neighboring pixels.
• Tampering Indicator: Deviations from the expected interpolation pattern suggest localized splicing or copy-move forgery.
• Algorithm Fingerprinting: Different manufacturers use distinct interpolation kernels (e.g., bilinear, adaptive homogeneity-directed).

A camera model fingerprint extracted by a deep learning network that captures the local relationships between noise residuals and image semantics to localize forgeries.

• Deep Learning Approach: Uses a Siamese network trained to extract camera-specific artifacts without needing a reference device.
• Localization: Generates a heatmap highlighting regions where the noise pattern deviates from the expected model.
• Blind Method: Does not require the original camera or a database of reference patterns to detect anomalies.

The forensic task of generating a pixel-level binary mask that precisely identifies the manipulated regions within an image, as opposed to providing a single global authenticity score.

• Pixel-Level Output: Produces a binary mask where white pixels indicate forged areas.
• Splicing Boundaries: Detects abrupt transitions in noise statistics at the edges of inserted regions.
• Inpainting Artifacts: Identifies the characteristic interpolation residuals left by content-aware fill algorithms.

A technique that identifies the statistical fingerprints left when a JPEG image is decompressed, manipulated, and saved again, revealing the presence of a primary and secondary quantization table.

• Quantization Table Mismatch: Detects when a region was compressed with different parameters than the rest of the image.
• Benford's Law Analysis: Examines the distribution of first digits in DCT coefficients for anomalies.
• Ghost Artifacts: Identifies residual peaks in the DCT coefficient histogram that indicate a previous compression step.