Image Forensics in Vision
Every edit re-saves pixels through a new history. Forensics reads that history from noise and compression traces instead of trusting what the picture shows.
Why Does This Exist?
A spliced photo inserts an object from another picture. A copy-move forgery clones a region inside the same picture to hide something. Both export as ordinary JPEGs with no edit log, and both defeat a glance test.
Forensics exists because cameras sign their work. Sensor noise, demosaicing, and JPEG quantization leave a consistent pattern across an untouched photo. An edit breaks that pattern locally: the pasted region carries another camera's noise, another compression history, or an impossible duplication. The detector's job is to map where the pattern breaks, under a stated condition of resolution and compression. Pair this with deepfake detection for generated faces; forensics covers edited real photos.
Think of It Like This
A photocopied page with one retyped paragraph
A copied contract page looks uniform until you check the typewriter ribbon wear: every original paragraph shares the same faint letters, while the retyped paragraph has crisp new ones. Then you find the same paragraph twice, word for word.
Copy-move forensics does both checks. It scans for regions whose sensor-noise texture matches each other too well (the duplicated paragraph) and for regions whose compression grid disagrees with the rest (the fresh ribbon). The analogy stops at skilled forgers who re-add noise after editing; then the texture check weakens and only geometry and lighting remain.
How It Actually Works
The pipeline extracts a residual map by subtracting a denoised version of the image from itself, then compares local statistics. Copy-move detection matches blocks by their residual fingerprints: two patches from the same source region correlate near 0.9 even after recoloring. Splicing detection instead segments the image where JPEG block artifacts or camera-noise variance change abruptly. Double-compression analysis looks for periodic gaps in DCT coefficient histograms that single-compressed regions lack.
Worked example
A demo pair of 512 by 512 photos contains 36 cloned patches of 48 by 48 pixels. Residual correlation between true clone pairs averages 0.93; random patch pairs average 0.21. Thresholding at 0.70 matches 34 of 36 clones with 2 false alarms. After one heavy JPEG recompression at quality 60, true-pair correlation falls to 0.58 and matches drop to 22 of 36. The arithmetic is direct: 34 divided by 36 is 0.944 recall clean, 22 divided by 36 is 0.611 recompressed. Report both, or the clean number misleads.
Watch Out For
Reading a heatmap as a verdict
A tamper heatmap lights up the most suspicious region in every image, including untouched ones. The symptom is a glowing blob presented as proof on a pristine photo. Always threshold against calibrated real images at the same compression, and confirm with a second cue before calling a forgery.
The Quick Version
- Splicing inserts foreign pixels; copy-move clones inside one photo; both break camera patterns.
- Residual correlation near 0.93 marks clones, while compression-grid breaks mark splices.
- On the demo pair the check matches 34 of 36 clones clean and 22 of 36 recompressed.
- Heavy recompression is the condition that hides weak traces, so state quality with every score.
- A heatmap alone is screening, never a verdict.