Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
×
Graphics Security IT

New Technique For Making JPEG Images Copy-Evident 139

Posted by CmdrTaco from the believe-it-when-you-see-it dept.
Gunkerty Jeb writes "The days of wondering whether those drunken sex party photos are indeed the Olsen Twins, or if they are just the Mary-Kate and Ashley's faces photo-shopped on the bodies of Lindsay Lohan and Amy Winehouse are OVER! A group of academic researchers at the University of Cambridge has developed a new technique for making JPEG images copy-evident, so that users can tell whether an image has been recompressed and copied."
This discussion has been archived. No new comments can be posted.

New Technique For Making JPEG Images Copy-Evident More

New Technique For Making JPEG Images Copy-Evident

Comments Filter:

  • Image protected, but is it useful? (Score:5, Interesting)

    by Rashkae ( 59673 ) on Monday February 07, 2011 @12:25PM (#35127726) Homepage

    If the image can't be re-encoded or re-scaled without the watermark becoming visible, then it probably can't be resized for viewing either. So the only images can can really make use of this 'tech' are the ones that are already shrunk to their smallest desirable viewing size. I'm not sure how much use this will really have.

    • Re: (Score:3)

      by Hatta ( 162192 )

      The only images you're going to want to protect are the ones you've distributed on the web.* Those are going to be the ones that are already scaled down. You do scale down your images before you host them, right?

      *if you've decided to be a dick about copying, you're probably not going to be distributing your high res source image

      • You do scale down your images before you host them, right?

        Of course. Everyone posting their copyrighted images to Flickr, Tumblr, and other sites missing vowels always resize their images first, including making their own thumbnails. No one relies on the site to make its own thumbnails or show the image at various sizes.

        • Re: (Score:2)

          by Hatta ( 162192 )

          If you're using a remote app to resize your files, then the remote app can apply this filter at the same time. No big deal. The point is that there's no reason for the end user to have the source file, especially if you're only delivering a low res copy of it.

      • If somebody is copying it for a "friendly" reason, why not use a link? If they can't embed a link, then they can have a watermark. Still not good enough? Well how about asking? That's not being a dick. That's preventing others from being dicks.

    • Re: (Score:1)

      by cdpage ( 1172729 )
      If you take a photo of Prince William with some other woman kissing. You would send not a low res image to a newspaper you would send a small cropped edited one with this invisible water mark. If the Paper wants to use it they would need to ask you for the image in the given size. If they try to edit that they see the water mark and can't print/put to the web.

      When they do post this image to the web with out altering it, and you see that Huffington post has this photo, you copy image to your desktop, open it

    • Re:Scaling should not be affected (Score:5, Informative)

      by b4dc0d3r ( 1268512 ) on Monday February 07, 2011 @01:25PM (#35128514)

      If you read the article, they are depending on the JPEG compression artifacts for the watermark display. Resizing should not cause this because you are deling with the uncompressed image data.

      Resizing and then saving as a JPEG will result in re-compression and the watermark appearing. Saving as anything else bypasses this completely.

      This is only useful when you know what conditions will be applied. The example they give near the end, uploading to youtube, will apply only as long as youtube does not change their settings. Then you have to change your thresholds and all of your protected videos in the wold are unprotected.

      • Actually, after playing with it a little bit, it becomes readily apparent that resizing (at least in Opera) affects this the exact same way that re-compressing the data as a jpeg does. As I run through the compression qualities in paint.net, I see the exact same patterns of compression artifacts in the images that I do when scrolling through zoom levels in my browser. Really, image scaling and compression are very similar problems, so this shouldn't surprise anyone.

        This means two things. First, this tech

      • Re: (Score:2)

        by Lehk228 ( 705449 )
        my guess is if you upsample the image by a large amount, then blur it at the upsampled size, then sownsample again you will strip the signal out. high frequency signals like that are going to be rather fragile because they have to hide in a complessed image and there isn't much excess data space to hide in with a compressed image

    • Re: (Score:2)

      by Danh ( 79528 )

      The original image can be resized without showing the watermark, see their demo page [cam.ac.uk] (and press Ctrl +/- if you browse with Firefox). But so can the re-encoded picture, it shows the watermark only at the zoom level of 100%.

      From this I suppose that there is also one zoom level at which the original picture shows the VOID watermark (you better choose it to be an odd value)!

    • I'm not sure what the method in TFA does since I didn't read it, but this isn't cold fusion.

      Watermarking has been available for a while, even as a standard Photoshop filter. Just for a test, I applied the Digimarc watermark to a 18MP shot of my dog, and then resized it to 40% of the original size. The result? The watermark could be still read, albeit with a lower indicated watermark strength. Likewise, resaving it multiple times as a JPEG just slightly decreases the strength. If you aren't an idiot and don'

    • Except it doesn't work with resizing. They seem to be assuming that you're editing the picture as-is and saving it again in a JPEG format. I guess it would help make you suspicious of a PNG or some other uncommon format, but they are specifically targeting the JPEG quantizer. It's cool and everything, but that compression mechanism is highly specific to JPEG's. A wavelet compressor or an RLE compressor would completely ignore/miss it.

  • identification of transcodes is very well-worn technology among MP3 users. Where people will take a 128kbps and transcode it to 320 and cause a small riot when people get upset getting a 320 that sounds like crap.

    I imagine this is not really any different. Just look for the telltale squared loss and clipping, but in the image spectrum instead of the audio spectrum.

  • Not ready for commercialization (Score:5, Informative)

    by ColoradoAuthor ( 682295 ) on Monday February 07, 2011 @12:25PM (#35127730) Homepage
    From the original paper [cam.ac.uk]: "The technique now needs to be extended to handle arbitrary photographs, not just uniform regions."

    • "The technique now needs to be extended to handle arbitrary photographs, not just uniform regions."

      Great, I've always wanted some way to tell if the blank wall in the background had been edited and replaced by another blank wall...

      • Actually, that's exactly what you couldn't detect. The VOID only would appear in uniform areas, which means that in addition to all other stated problems with this technique, you can still photoshop Ryan Reynold's head onto a porn star's body as long as you use a magic wand tool and/or a paint bucket on any uniform areas of the image.

  • Slightly Misleading (Score:2, Insightful)

    by sltd ( 1182933 )
    If you're really serious about putting Mary Kate and Ashley's head on Lindsay Lohan and Amy Winehouse's bodies, like it says in TFS, you'd use RAW. Then, you can compress everything together. Besides, if you upload that to photo sharing websites (especially Facebook) there's a high chance your picture would be recompressed, so it would have the compression artifacts whether it's been altered or not.

    Fail.

    • Re:Slightly Misleading (Score:5, Insightful)

      by jeffmeden ( 135043 ) on Monday February 07, 2011 @12:35PM (#35127874) Homepage Journal

      If you're really serious about putting Mary Kate and Ashley's head on Lindsay Lohan and Amy Winehouse's bodies, like it says in TFS, you'd use RAW. Then, you can compress everything together. Besides, if you upload that to photo sharing websites (especially Facebook) there's a high chance your picture would be recompressed, so it would have the compression artifacts whether it's been altered or not.

      Fail.

      Have access to RAW files of the aforementioned act involving Lindsay and Amy, along with ideally angled shots of the Olsen's faces? Didn't think so. So, you go to google images and start digging. What you find (in the ideal world this paper is picturing (ugh no pun intended)) is that every content creator (from the pr0n guys to the papparazzi that took the olsen's picture) have applied this filter to their work, and as such your efforts are for not. Don't get me wrong, there are tons of problems with this whole idea, but saying "well raw doesnt have artifacts anyway" is a bit of a fail.

      • Re: (Score:2)

        by taustin ( 171655 )

        Very true. Changing the format to, say, BMP, before doing the shopping, however, has a certain potential. Plus, TFA says this only applies if you change the compression level. So don't change the compression level. (Plus, I suspect it will be about ten minutes before somebody comes up with a Photoshop script that will strip this out, assuming existing watermark removing scripts won't already.)

      • Re: (Score:2)

        by Spykk ( 823586 )
        Or you just hit the Print Screen button to fill your clipboard with what is displayed on the screen sans watermark.

    • Re: (Score:1)

      by Anonymous Coward
      Yes, the only thing this is useful for, is misleading a Judge into thinking that a digital picture may not be altered. It's past when pictures were able to be used as evidence. It's now really hard to rely on images, but many people would still believe in them.

      I brief computer graphics class can show you how easy is to fake pictures. It doesn't matter if you have a "certificate" or some authority to mark the pictures, because that could probably be faked too.

    • If you're really serious about putting Mary Kate and Ashley's head on Lindsay Lohan and Amy Winehouse's bodies, like it says in TFS, you'd use RAW.

      No, you would not, unless you took all of those photos yourself. You will not find any RAW downloads of those anywhere on the web.

    • Re:Slightly Misleading (Score:4, Insightful)

      by MobileTatsu-NJG ( 946591 ) on Monday February 07, 2011 @01:15PM (#35128382)

      If you're really serious about putting Mary Kate and Ashley's head on Lindsay Lohan and Amy Winehouse's bodies, like it says in TFS, you'd use RAW.

      Uh, yeah, by 'use RAW' you mean: "take photos of these celebrities yourself".

      ...so it would have the compression artifacts whether it's been altered or not.

      Unless you took the RAW photos yourself, there would still be different artifacts from each of the pictures you used to do the composite. More artifacts won't change that. Besides that, Facebook resizes the image THEN saves it, again altering the new artifacts in a not-so-subtle way.

      You haven't shot this down at all and it's obvious that people with mod points don't understand this topic.

  • Sigh, another pointless arms race brought on by businessman-academics selling snake-oil.

    I wonder how long it will take to overcome the "message appears when a particular specific combination of recompression settings is chosen" anti-fraud-or-something technique. I mean, it's such a novel idea and there are so few alternative combinations of recompression settings.

    • How long before browsers automatically low-pass filter these broken jpegs? If not, then the browser is going to have a hard time resizing the jpeg if this high frequency noise is so large in amplitude that it causes clipping in the jpeg calculations.

      • Re:social problem, technical solution (Score:4, Informative)

        by coolsnowmen ( 695297 ) on Monday February 07, 2011 @08:26PM (#35132920)

        I don't think you understand what they mean by clipping in this sense. In JPEG compression, the DCT is performed, the matrix is formed, the coefficients are scaled, quantized(clipped), and then Losslessly compressed. The scaling/clipping(from quantization) IS the core of the low/med quality JPEG compression compression. It is not like "clipping" in the audio sense where it is horribly distorted due to over amplification, the quantization is intentional and in DCT space.

        Also, as stated elsewhere on this forum, when a browser resizes a picture, the cache is not recompressed, which is when this intentional dithering becomes apparent.

    • Consider this: with several different HD sizes in frequent use, and even more computer screen geometries, for any given video you're going to find a lot of legitimate users viewing a radically resized version, so indiscriminate interference is unworkable. So who is this "specific combination" aimed at? YouTube. Could YouTube change their settings to get round this? Yes. Would YouTube change their settings to get round this? No. Because they would then be actively facilitating piracy and in breach of

    • I wonder how long it will take to overcome the "message appears when a particular specific combination of recompression settings is chosen" anti-fraud-or-something technique.

      This is basically what happened when the RIAA tried to impose audio watermarking on CDs; the idea was that if a watermark was destroyed by MP3 compression, the CD player would refuse to play the track. Clearly, this was a stupid idea, since people just played the MP3 file from their computer (did anyone actually think people would spend their time and money burning MP3 files to CD?), and it did not take long before people had Internet connections that could be used to quickly download less compressed (hi

  • Mung bits, continue with faux slash fanfic.

  • The technique described in the article sounds like it would be defeated by applying a filter to the image before re-compressing it. It sounds like it is very dependent on having the encoder stumble over very specific bits in the image, and messing with those bits is likely to mess up the effect. Worse, if someone goes and finds your message (by encoding the image several times), it seems like it should be pretty easy to reverse the effect.

    • And even if that doesn't help it'll be easy to design a filter that removes the spatial frequencies they use. Or a small median filter.

  • "New Technique For Making Copy-Evident JPEG Images no longer Copy-Evident"

    Seriously, I didnt sit in on the JPEG meetings or anything but it seems like this is a clever idea that could be so very easily circumvented. Recompress the picture, identify the regions exhibiting a "high frequency pattern" (which should be evident) and reverse the frequency of those pixels in the original file prior to recompressing.

  • geez i hope they don't do this to movies. it will sabotage all those netflix dvds i "tivo to my harddrive" for "research purposes."

  • ...just make sure you save as png, not jpeg.

    • Re: (Score:2)

      by jameson ( 54982 )

      On second thought, someone else could re-encode as jpeg. So you may want to resize and perhaps blur a little. Either way I don't see why this wouldn't be trivial to defeat.

  • Doesn't Work (Score:5, Informative)

    by nattt ( 568106 ) on Monday February 07, 2011 @12:39PM (#35127930)

    So I downloaded their test image here: http://www.cl.cam.ac.uk/~abl26/copy-google.jpg [cam.ac.uk] that they claim gets a message on it when compressed by google proxy http://www.google.com/gwt/x/i?u=http%3A%2F%2Fwww.cl.cam.ac.uk/~abl26/copy-google.jpg&wsi=223e8e5df695e99c&ei=6ixQTebOCoPoxQW8rYlv&wsc=yq&whp=012e012f72be [google.com]

    But when I take the original and re-save it in Photoshop CS5 I don't see the void lettering. I reduced the JPEG quality and kept trying and at quality 1, the lowest setting I was starting to see a pattern, but no words appeared.

    I'd say their idea is nice, but doomed to failure, not least they mention "If you can’t see the message in the recompressed image, make sure your browser is rendering the images without scaling or filtering." which would be the obvious source of attack on such a method should it actually work in practise.

    • I think the idea is there's some method for taking a munged picture and going, "Watch, I'll run an algorithm and... oh, look, a message with a hole cut in it where your ex-girlfriend's head is sucking that black man's cock..."

    • Re:Doesn't Work (Score:4, Informative)

      by marcansoft ( 727665 ) <(hector) (at) (marcansoft.com)> on Monday February 07, 2011 @01:04PM (#35128256) Homepage

      Apparently it only works at very specific quality settings. Re-saving with GIMP, I can see the message at quality 24, 38, 41 (barely), 43, 60, 65 (barely), 69 (barely), 72 (barely), and a few others even less.

      As far as I can tell (I haven't read the paper), it works by setting up a static hard to compress pattern, and then slightly altering that pattern in certain macroblocks so that they just push the boundary into a different kind of compression artifact at certain quality/quantizer levels. So the entire image is compressed one way at one quality, a different way at another quality, and at the threshold between them there's a quality level where the message blocks compress differently and you can see them.

      Also, recompressing has a high chance of destroying the effect permanently. For example, saving at quality 51 destroys the message, and re-compressing at any quality level no longer makes it visible.

    • I tried it with gimp and it worked. Open the image, save at 60% quality, and the VOID is quite visible. Perhaps it's libjpeg's compression they're relying on. (I assume that's what gimp uses; I haven't actually checked.)

      However, the method is easily defeated. Open the image, scale it to twice its size, then scale back down to the original size, and save at 60%. No watermark appears.

    • Re: (Score:1)

      by bouldin ( 828821 )

      I also tried recompressing the test image, and was only able to see the watermark around the 60-65 quality range for JPEG.

      However, the goal presented in the paper is to provide a "targeted mark" that will be visible given a predictable recompression scheme. So, if you know a particular photo site (or WAP gateway) recompresses at 60, you can mark the picture to target quality rating of 60.

      The paper concludes with "untargeted marks" as a future research opportunity. The authors describe an untargeted mark a

  • As usual this can be easily defeated by re-sampling or noise filtering. If you're targeting web media and have a high enough resolution source image then you have plenty of redundant pixels to play with to wipe out the watermark.

    A better solution for authenticity verification would be digitally signed checksums.

    Our algorithm works by adding a high-frequency pattern to the image with an amplitude carefully selected to cause maximum quantization error on recompression at a chosen target JPEG quality factor. The amplitude is modulated with a covert warning message, so that foreground message blocks experience maximum quantization error in the opposite direction to background message blocks. While the message is invisible in the marked original image, it becomes visible due to clipping in a recompressed copy,

  • I can see this if your concern is a pre-canned compression such as a specific proxy run by someone that doesn't care if the images it produce appear "marked."

    If the goal is to prevent end-users from re-scaling the image in an arbitrary way, it's not going to be very useful.

  • This is why I ALWAYS do all of my drunken photo editing in .png!
  • My job is image processing, and we are all well aware of the "quirks" of storing images as JPEG. Since it typically uses frequency information, converting to a BMP for a photo editor, and then converting back with some minor modifications introduces all sorts of artifacts into the JPEG coefficients upon recompression. These artifacts can be detected by a program looking for them, and I'm surprised such algorithms are not in use in existing software. And the detection would be able to ignore image resizin

  • Completely irrelevant tech. I've seen a few photoshops in my time, and I can tell by the pixels whether it's photoshopped or not....

  • I think you'll find that when it comes to Drunken Sex Party Photos, most of us who are going out of our way to look at them really don't care whether or not they have been edited.

  • Knowing whether a photo or video has been digitally altered is important for images used as legal evidence. I would not be surprised to see makers of digital cameras and editing software embed a digital signature that can be used to detect alteration. Perhaps with software like Photoshop, it might even record what types of modification were done. There would be little reason to mistrust a photo that was merely rescaled, for example.

    Keep in mind that some digital technology already embeds data to prevent cou [pcworld.com]

    • Re: (Score:2)

      by Rich0 ( 548339 )

      Many higher-end cameras do in fact include technology to authenticate original photos. I cannot vouch for how well-implemented they are.

      However, all of them are susceptible to the DRM weakness - the guy with the camera has physical possession of everything necessary to generate a faked photo, including the keys. Sure, the keys might be locked up in some chip where they are theoretically difficult to access. However, they are still vulnerable to interception. If you extract the keys then you can make any

    • Except that if such information is stored with the photo, it can by definition be altered when the photo is altered.

      • You can alter whatever you want, but without the manufacturer's private key [wikipedia.org], you can't digitally sign the result.

      • Except that if such information is stored with the photo, it can by definition be altered when the photo is altered.

        Yeah, but I imagine you could use some kind of encryption so that even if you can alter that information, you can't easily make it appear original.

        But I don't know anything about that stuff.

    • Re: (Score:2)

      by lgw ( 121541 )

      That would only make it hard to alter digital photographs by someone who did not have access to the camera (since the camera must contain the signing key), which doesn't help any in a legal chain-of-custody question. Unless the signing was done by a FIPS140-2 level 4 component, and those are remarkably expensive - but then for a special purpose forensic camera, it would make a lot of sense.

  • They where not kidding about the specific quality settings. I tried it with the demo image and and The Gimp to reveal the message. I was only able to have it appear only remotely recognizable at 3 of the 101 quality setting

  • "The days of wondering whether those drunken sex party photos are indeed the Olsen Twins, or if they are just the Mary-Kate and Ashley's faces photo-shopped on the bodies of Lindsay Lohan and Amy Winehouse are OVER!"

    You mean that poster next to my Olsen Twin poster is a fake? (Rushes off, and rips a poster off the wall).

    I bet you can't guess which poster I removed!

  • Our algorithm works by adding a high-frequency pattern to the image with an amplitude carefully selected to cause maximum quantization error on recompression at a chosen target JPEG quality factor.

    The key here is JPEG quality factor. This only works on a specific quality factor. Just pick a different one. I just tried it using their example image. At some quality factors you can see somthing funny going on (spots on image). But, at any factor you would use to actually compress a photo (above 90) the image looks fine.
    This could work for the bandwith-saving proxy mentioned in the article since they will have low quality factors. But what would be the point then? Mangling images when viewed on

  • You know, it's not her fault that her fame-whoring parents pushed her into the kind of child stardom that would leave anyone at least a little warped. It's not her fault that too much fame too fast led to a parade of leeches and "friends" who were all-too-happy to feed her addictions while using her for their own ends. It's not her fault that paparazzi follow her everywhere just waiting for her to make the slightest mistake so they can get a picture of it and make money.

    How many of you wouldn't have ended u

    • Re: (Score:2)

      by Minwee ( 522556 )

      How many of you wouldn't have ended up in the exact same straights (or worse) if that had been YOUR life?

      Through it all, at least Lindsay knows how to spell straits [thefreedictionary.com].

  • I-Swear-It-Is-Real.PNG

  • Olsen Twins, or if they are just the Mary-Kate and Ashley's faces photo-shopped on the bodies of Lindsay Lohan and Amy Winehouse

    It would be more amusing to really transform the heads of Arnold Schwartenegger's and Martin Sheen's onto bodies Lindsay Lohan and Amy Winehouse.

    Plastic surgeons in California can do that with Botox, can't they?

    The cops would be too afraid to arrest a Arnold Schwartenegger headed Lindsay Lohoan. Poor Martin Sheen headed Amy Winehouse would hear from the traffic cops:

    "I'm sorry Mr. Sheen, but are those two and a half double D's on your chest?"

  • 1. See interesting but slightly too small pic on web page
    2. scroll wheel to zoom the page
    3. IMAGE NO LONGER VIEWABLE BECAUSE ASSHATS ARE AFRAID YOU'LL COPY IT.
  • This thread is useless without pictures.

  • Their sample image is here: http://www.cl.cam.ac.uk/~abl26/copy-background.jpg [cam.ac.uk]
    Their sample image after recompressing is here: http://www.cl.cam.ac.uk/~abl26/copy-background-recomp.jpg [cam.ac.uk]
    According to them, the sample recompressed image is saved "with particular quality settings".

    So I opened the original image file in GIMP, went to save it as a JPEG, made sure the preview was turned on, and saw nothing.
    Of course, this is because I save every jpeg at 1x1, floating point, 100 quality.

    So I reduced the quality. A

  • No joke, I've noticed a trend where more and more sites have these javascript or some other such crap to display the image. They begin with a insy tinsy image, when you click it shows enlargement but resolution is not great (and of course the right button and various commands are disabled). It is not that I will pirate images but it pains me to no end when I find a fantastic photo of i.e. Gina Lollobrigida (in one her beautiful dresses from "Beautiful But Dangerous" or "Fast and Sexy") and I want to save i

  • If you know the watermark technique, then you can erase the original watermark and write a new unified watermark.

    In fakes (including Tron 2), the main issue is that the lighting is never right.

    In reality, the mouse cable is reflecting dark grey light at you. Each key on the keyboard is reflecting a mixture of black and and white at you. The screen is shining orange, green, blue, large masses of white, and grey on you.

    If the person next to you has a blue dress, that blue is reflecting off you.

    It's unholy r

  • I can tell from some of the pixels and from seeing a few shops in my time. What, are they borrowing an algorithm from 4chan?

  • It sounds like it would be relatively easy to detect this willful corruption and counter it... not a 100% inverse transformation, but it should be pretty damn easy to run a mock recompression, make note of the spots where it clips hard, and apply some kind of smoothing. Or, you know, I could smudge your evil pixels into oblivion.

    It's an interesting piece of academia, but its reliance on what is effectively a glitch in the common JPEG algorithm means this technique will be trivially neutered by the very peo

  • 1. Fake Celebrity nude
    2. Fake Watermark
    3. Celebrity porn website with "real watermarked legit photos"
    4. Profit

  • At least based on the "VOID" test image they released, I did a bit of analysis and found that the pixels in the word "VOID" were only off by one compared to the rest of the image (whether light or dark pixels). This suggests that this technique (at least in its current form) may be defeated easily (while still recompressing as JPG) if you are willing to quantize each RGB value to either the nearest even or odd value (such that these small variations can be removed). While this reduces the color space quite

  • From the article:

    Our algorithm works by adding a high-frequency pattern to the image with an amplitude carefully selected to cause maximum quantization error on recompression at a chosen target JPEG quality factor.

    So...if I compress it as a TIF, a JPEG-2000, PNG, GIF, or BMP or else run a blur filter, resize, upsample, downsample, any image effects, or cropping 1 pixel off the top row/column (thereby ruining JPEG block alignment) then I can still edit images to my heart's content? Okay...so this is good for catching stupid people?

Slashdot Top Deals

When your work speaks for itself, don't interrupt. -- Henry J. Kaiser

Close