Detecting Manipulated Images With Forensic Models

Published on 21/04/2024, Updated on 29/08/2026

Introduction

Images have been used to manipulate information since Stalin’s rule of Soviet Russia. Compare an original image of Stalin and Nikolai Yezhov strolling along the Moscow-Volga Canal (left), with an edited version (right) where Yezhov has been completely removed. While Stalin needed a team of artists, modern tools like Photoshop can do this in seconds using advanced algorithms to fill in missing regions of an image by sampling information from the surrounding areas. Deep learning-based methods like generative adversarial networks (GANs) and diffusion models have also become more popular in recent years. Text-guided generative models like Stable Diffusion allow users to manipulate images in almost any way they see fit with a suitable text prompt.

There are many legitimate use cases of image manipulation: removing unwanted objects, repairing old or damaged photos, and editing images for creative purposes. However, it also enables the spread of misinformation. Images are often used to make news appear more credible. A fake image attached to a fake article can be a powerful tool of deception.

Therefore, an effective way to identify whether an image is authentic is vital to stopping the spread of misinformation. Many tools are being developed to detect AI-generated content, but their accuracy is greatly affected when the image in only partially faked. Rather than trying to generate a realistic image, it is far simpler for threat actors to manipulate an existing image. The image above shows “AI or Not”, a popular web-based AI detector, failing to detect an inpainted image. The inpainted regions camouflage within the real regions, highlighting a critical gap in current technology.

During my internship with DSTA’s information programme centre, I was tasked with training a model that was capable of detecting and localising the manipulated regions of images.

Forensic Filters

Some inpainted images might contain blurred or unnatural regions, but high-quality inpainting tools can fill in missing regions seamlessly, making them completely invisible. In these cases, we cannot simply look at the visible features of an image for inpainting detection. We will need to rely on the assumption that inpainted regions have different statistical properties than genuine regions. Recent work discussed 3 forensic filters to extract these properties from an image:

Steganalysis Rich Models (SRM) are one of the earliest and most popular forensic filters. They are simple handcrafted filters that strip away low frequency components in an image. Regular CNNs are unlikely to learn SRM filters because they tend to learn features that represent an image’s content instead of the noise. Bayar and Stamm addressed this by proposing a constrained convolutional layer: the center pixel of each filter has weight -1 and the sum of all other weights is 1. There are also deep learning based approaches such as Noiseprint++, which is a noise sensitive fingerprint extracted using a denoising convolutional neural network (DnCNN). It is trained to capture traces of camera artefacts and post-processing applied to the image.

In our project, we chose to use SRM filters. They are high-pass filters that strip away the low-frequency image content, leaving only the high-frequency noise. This allows our model to focus on the statistical traces of inpainting hidden within the noise. We chose SRM filters as they are the most lightweight options, requiring very little VRAM as they are handcrafted and have no trainable parameters.

Model Architecture

The model is similar to TruFor, an image forgery detection model proposed in 2022. However, we changed the Noiseprint++ forensic filter to SRM filters, and trained the model on an in-house dataset created by DSTA.

The RGB image contains visible features such as colours, textures, and patterns. On the other hand, the forensic filters extract the statistical features not visible to the human eye. The 2 modalities contain complementary information that we can use to identify anomalous regions in an image. To fuse them and create a unified representation of the image, we use the cross-modal fusion framework for RGB-X semantic segmentation (CMX). The CMX encoder is a variant of SegFormer that learns features jointly from 2 modalities.

The localisation decoder is a lightweight multilayer perceptron that returns a segmentation mask containing the probability that each pixel is manipulated. Other than pixel-level predictions, we would also like to classify whether the image as a whole has been manipulated. The simplest way to do this would just be to take the mean value of the pixel-level scores and set a threshold. However, TruFor, which our model is based on, found that the results can be more reliable with some extra steps. We add a confidence decoder that is identical to the localisation decoder, but instead of predicting the segmentation mask, its trained to predict how likely the localisaton decoder would be right at each pixel. When calculating statistics of the segmentation mask, we weigh each pixel based on the confidence score, which allows the model to de-emphasise areas that its not sure of. The other change is that instead of relying on only the mean, we compute 8 different statistics and train a simple classifier to predict the integrity of the image. These 8 statistics are the mean, mean square, maximum, minimum of both the weighted segmentation mask and the confidence map.