Image Forgery Detection

Course Image Forensics

FCS482
By
Dr Mai Kamal El Den Mohamed
Lecturer, Computer Science Department,
Faculty of Computers and Artificial
Intelligence, Benha University
Image Forensics

Introduction
Lecture 2
Digital Image Forensics
Image Forensics

• Forgery is creating a fake image.

• Forensics is detecting and analyzing fakes.

Image Forgery vs. Image Forensics
• What is Image Forgery?
• The act of manipulating or altering an image to deceive or
mislead.
• Used for fake news, propaganda, fraud, entertainment, or
artistic purposes.
• Common techniques: Photoshopping, splicing, cloning,
deepfake creation.

• What is Image Forensics?

• The process of analyzing images to detect tampering and verify
authenticity.
• Helps in identifying fake images in media, legal cases, and
cybersecurity.
• Uses techniques like error level analysis (ELA), metadata
examination, pixel analysis, AI detection.
Common Image Forensics
Techniques
• Error Level Analysis (ELA) – Identifies edited areas
by detecting compression differences.
• Metadata (EXIF) Analysis – Extracts hidden
information like device, location, and timestamps.
• Pixel & Noise Analysis – Examines inconsistencies
in pixel structure and lighting.
• AI & Machine Learning Detection – Uses deep
learning models to identify tampered images.
• Reverse Image Search – Helps trace original
sources to verify authenticity.
Real-Life Examples
• Fake Political Images – Altered photos
used in propaganda or elections.
• Celebrity Deepfakes – AI-generated fake
videos/images causing misinformation.
• Fraudulent Documents – Fake passports,
ID cards, or financial records.
• Historical Image Manipulation – Editing
history by removing or adding people in
photos.
Importance of Image Forensics
• Detects fake news and misinformation.
• Prevents fraud in legal and financial sectors.
• Enhances cybersecurity by verifying digital evidence.
• Ensures authenticity in journalism and social media.
• Protects privacy and identity from deepfake misuse.
General Structure for Image Forgery
Detection
General Structure for Image Forgery
Detection
General Structure for Image Forgery
Detection
Feature Extraction
• Feature extraction is a crucial step in machine learning,
image processing, and data analysis. It involves reducing
the raw data into a set of informative and non-redundant
features, which enhances computational efficiency and
improves model performance.
• Feature extraction refers to the process of transforming raw
data into numerical features that can be processed while
preserving the information in the original data set. It yields
better results than applying machine learning directly to the
raw data.
 Feature Extraction
• Feature extraction is an essential step in data processing
that helps in improving model accuracy, reducing
dimensionality, and increasing efficiency. Different
techniques are applied based on the nature of the data
and the application domain.
• Feature extraction can be accomplished manually or
automatically:
- Manual feature extraction requires identifying and describing the
features that are relevant for a given problem and implementing a
way to extract those features.

- Automated feature extraction uses specialized algorithms or deep

networks to extract features automatically from signals or images
without the need for human intervention.
Types of Feature Extraction
Feature Extraction
• Feature extraction techniques can be broadly
classified into the following categories:
1) Statistical-Based Techniques
2) Transform-Based Techniques
3) Structural-Based Techniques
4) Model-Based Techniques
 Statistical-Based Techniques
• These techniques extract statistical properties
from data, such as mean, variance, skewness,
and entropy.
• Examples:
– Histogram of Oriented Gradients (HOG): Used for
object detection.
– Gray-Level Co-occurrence Matrix (GLCM): Used for
texture analysis.
– Mean and Standard Deviation: Used in biomedical
image analysis.
 Statistical-Based Techniques
Histogram of Oriented Gradients
(HOG)
• Task:
 Texture Feature
• Texture In the field of Image Processing, we can
consider the spatial changes of the brightness
intensity of the pixel as the texture of the image.
 Grey Level Co-occurrence
Matrix (GLCM)
• GLCM (Grey Level Co-occurrence Matrix) is a common and
basic statistical approach for texture analysis. The GLCM
features are based on second-order statistics, and are used
to gain insight into the average degree of correlation between
pixels from the view of uniformity, homogeneity, etc.
• GLCM gives information about how pixels of an image are
related to each other and this relationship helps us classify
the texture based on multiple features that are extracted from
GLCM.
• The matrix gives information about the position of pixels
which have similar intensity.
• The set of possible intensity values are rows and columns
labels of the 2-D array (P).
Grey Level Co-occurrence
Matrix (GLCM)
• A GLCM P𝒹[i,j] is first initialized by specifying a displacement vector 𝒹=
(dx, dy) and counting all pairs of pixels separated by 𝒹 in the angle of the
displacement vector, having grey levels j and i (where j is a column and i
is a row).
• In general, GLCM is represented as P𝒹[i,j ] = nᵢⱼ, where nᵢⱼ is the number
of occurrences of the pixel values (i,j) lying at distance 𝒹 in the image.
The co-occurrence matrix P𝒹 has dimension n*n, where n is the number
of grey levels in the image.
• GLCM is calculated based on the distance and angle as mentioned in the
displacement vector. For a pixel ‘x’ we can compute the GLCM value in 8
different directions.
 Grey Level Co-occurrence
Matrix (GLCM)
 (GLCM) Example
2 1 2 0 1
0 2 1 1 2 • For example, if d=(1,1)
0 1 2 2 0
• If the angel is 135.
1 2 2 0 1
2 0 1 0 1 • There are only 3 gray level so the matrix will be
3*3.
• GLCM Matrix is:
 Grey Level Co-occurrence
Matrix (GLCM)
 (GLCM) Example
2 1 2 0 1
0 2 2
0 2 1 1 2
2 1 2
0 1 2 2 0
2 3 2
1 2 2 0 1
2 0 1 0 1

• there are 16 pairs of pixels in the image which satisfy this spatial
separation.
• Gray level co-occurrence matrices capture properties of a texture but
they are not directly useful for further analysis, such as the
comparison of two textures.
• This matrix can further be used to numerically compute the global
textual features such as correlation, energy, entropy, homogeneity,
contrast, prominence, and shade.
 Grey Level Co-occurrence
Matrix (GLCM)
0 2 2

 (GLCM) Example
2 1 2
2 3 2

0 2/16 2/16
2/16 1/16 2/16
2/16 3/16 2/16

0 0.125 0.125
0.125 0.0625 0.125

• Normalize GLCM (Probability Matrix):

0.125 0.1875 0.125

• Total count=0+2+2+2+1+2+2+3+2=16
Grey Level Co-occurrence
Matrix (GLCM)
• Find the values of all of them on the previous
example.
 Local Binary Pattern (LBP)
• Local Binary Pattern (LBP) is a popular technique
used for texture descriptor in image processing.
• LBP compute a local representation of texture.
This local representation is constructed by
comparing each pixel with its surrounding
neighborhood of pixels.
• It used for face detection and face recognition.
How (LBP) Work
• The first step in constructing the LBP texture descriptor is to convert the image to grayscale.

• For each pixel in the grayscale image, we select a neighborhood of size r surrounding the
center pixel.

• LBP works in 3x3 (it contain a 9-pixel value ). Local binary pattern looks at nine pixels at a time.
Using each 3x3 window in the digital image, we can extract an LBP code.

• A LBP value is then calculated for this center pixel and stored in the output 2D array with the
same width and height as the input image.
 (LBP) Example
Output LBP Image
• Input Image

5 4 2 2 1
3 5 8 1 3
2 5 4 1 2
4 3 7 2 7
1 4 4 2 6

• Input Image

5 4 2 2 1
3 5 8 1 3
5 8 1
2 5 4 1 2
5 4 1
4 3 7 2 7
3 7 2
1 4 4 2 6

• we take the center pixel (highlighted in green) and

threshold it against its neighborhood of 8 pixels.

• Threshold it’s neighborhood pixel value to 1 if its

1 1 0
value is greater than or equal to center pixel value
1 0
otherwise threshold it to 0.
0 1 0

• With 8 surrounding pixels, we have a total of 2 ^ 8 =

256 possible combinations of LBP codes.
(LBP) Example
1 1 0
1 0
• we need to calculate the LBP value for the 0 1 0
center pixel.

• We can start from any neighboring pixel and

work our way clockwise or counter-clockwise,
but our ordering must be kept consistent for all
1 1 0 0 0 1 0 1
pixels in our image and all images in our
dataset. 2^7 2^6 2^5 2^4 2^3 2^2 2^1 2^0

128+64+4+1 = 197
• Given a 3 x 3 neighborhood, we thus have 8
neighbors that we must perform a binary test
on.

• we start at the top-left point and work our Output LBP Image
way clockwise accumulating the binary string
as we go along.
197

• We can then convert this binary string to

decimal, yielding a value of 197.
(LBP) Example
• Input Image
Output LBP Image
5 4 2 2 1
8 13 23 11 7
3 5 8 1 3
120 148 0 255 0
2 5 4 1 2
124 104 197
4 3 7 2 7
1 4 4 2 6
Transform-Based Techniques
• These techniques transform the data into another
domain for feature extraction.
• Examples:
– Fourier Transform (FT): Extracts frequency-based
features.
– Wavelet Transform (WT): Provides multi-resolution
analysis.
– Principal Component Analysis (PCA): Reduces
dimensionality while retaining variance.
 Principal Component Analysis (PCA)
• Principal Component Analysis (PCA) is a powerful technique
used for dimensionality reduction and feature extraction in
images. It helps by reducing the number of features while
preserving the most important information.
• Steps to Apply PCA on an Image:
1) Load the Image: Convert it to grayscale if needed.
2) Flatten the Image: Convert the 2D image into a 1D vector.
3) Compute the Covariance Matrix: Measures the relationships
between pixel intensities.
4) Compute Eigenvalues & Eigenvectors: Identify principal
components.
5) Project the Image onto Principal Components: Reduce the
dimensions while retaining important features.
 Principal Component Analysis (PCA)
• Example: Image Matrix (4×4 Pixels) Consider the following
grayscale image (each number represents pixel intensity):

• Sol.
1) Compute the Mean of Each Column Mean of each column:

2) Now, subtract the mean from

each column:
 Principal Component Analysis (PCA)
• Sol.
3) Compute the Covariance Matrix: The
covariance matrix measures how features (columns) are related:

Now, :
 Principal Component Analysis (PCA)
• Sol.
4) Compute the Eigenvalues :λ
– The eigenvalues of a matrix C are found by solving the characteristic
equation: det(C−λI)=0 where I is the identity matrix and λ represents
the eigenvalues.
Principal Component Analysis (PCA)

• Find the eigenvalues and eigenvectors in

your example.
Structural-Based Techniques
• Structural methods extract features based on
the geometric or topological properties of the
data.
• Examples:
– Edge Detection (Sobel, Canny): Extracts edges from
an image.
– Shape Descriptors (Hu Moments, Zernike Moments):
Extracts object shapes.
– Skeletonization: Reduces objects to their skeletal
form.
 Sobel Edge detection operator
• How the Sobel Operator Works :
 The Sobel Operator uses kernels to detect
edges in an image.
 A kernel to approximate intensity change in the
x-direction (horizontal)  Gx
 A kernel to approximate intensity change at a
pixel in the y-direction (vertical)  Gy.
The gradient magnitude:

Or
 Sobel Edge detection operator
( Example )
Original Image with size (n,n) = (5,5)

10 9 9 4 0
0 6 6 2 2
5 9 8 4 3
7 5 5 4 3
8 10 8 5 0

We start the calculation of (Gx , Gy ) at all pixels then compute |G|.

Following is the gradient magnitude:

But, what is size of output image ?

Law : new_row = n – f +1 , new_col = n – f +1 Or
 n= 5 , f = 3 , new_row = 5-3+1=3 , new_col =3
Sobel Edge detection operator
( Example ) 10
0
9
6
9
6
4
2
0
2
5 9 8 4 3
7 5 5 4 3

First compute (Gx , Gy ,|G|) at point (1,1): 8 10 8 5 0

Gx (1,1) = -10+0+9+0+0+12-5+0+8= 14
Gy (1,1) = 10+18+9-5-18-8= 6
|G| (1,1) = Gx2 + Gy2 = 142 + 62 = 15.2 ≈ 15
10 9 9 4 0

0 6 6 2 2

5 9 8 4 3

7 5 5 4 3

14 -18 -22 8 10 8 5 0

Gx = 10 -15 -16

-1 -12 -17

15.2 18.1 22.0 15 18 22 0 1 1

6 2 -2

 G 10.7 15.0 16.4 11 15 16 Edges 0 0 1

Gy = -4 1 -4
≈ 
5 -2 1 = 5.0 12.1 17.0 5 12 17
(output )
0 0 1
=

Compute Threshold (T): MEAN f(i,j) > T  true (1)

(15+18+22+11+15+16+5+12+17)/9=131/9=14.5≈15 f(i,j) <= T  false (0)
Sobel Edge detection operator
( Real Example )

Real Image in gray scale The result of combining the Gx and Gy (c)

Gx of image (a) Gy of image (b)

Structural-Based Techniques
Canny Edge Detection
• Task: