Skip to content

Steganalysis

Steganalysis is the study and detection of steganography—the practice of hiding information (typically secret messages) within other media such as images. While steganography is used for secure communication, steganalysis techniques also detect image forgery and manipulation because tampering disturbs the statistical properties of digital images.

Relationship to image forensics

Although steganography and image tampering are distinct problems, steganalysis features are highly effective for detecting tampering. The reason is that both processes disturb the normal statistical properties of images:

  • Steganography embeds hidden data by slightly modifying pixel values in a pseudo-random pattern
  • Image tampering (splicing, face swapping) introduces a region from a different source image, which has different noise characteristics and in-camera processing artifacts

Both disturbances are detectable through co-occurrence analysis of pixel differences and noise residuals.

Key steganalysis concepts

Rich models: Statistical features that capture diverse local patterns in images, including: - Co-occurrence statistics of pixel differences computed from linear and non-linear filters - Local noise residuals derived from prediction errors - Histograms of pixel differences at various scales

CFA-aware features: Color Filter Array (CFA) aware steganalysis features leverage the fact that digital cameras apply CFA patterns during in-camera processing. When a spliced face from a different camera is inserted, its CFA pattern may differ from the background, creating a detectable anomaly.

Embedding impact: Steganalysis models measure how much a region's statistical properties deviate from the "natural" distribution expected for authentic images. Large deviations indicate potential tampering or steganography.

Applications to image tampering detection

Steganalysis features have become standard tools for detecting image splicing and face tampering:

  • Local noise analysis: Extracting noise residuals from image regions and comparing their statistical properties to detect spliced regions with different noise characteristics
  • Triplet network refinement: Learning an embedding space where patches from the same image cluster together while patches from different images are far apart (as in Two-Stream Neural Networks for Tampered Face Detection)
  • Anomaly detection: Treating spliced regions as anomalies in the steganalysis feature space

Key papers and resources

  • Fridrich & Kodovsky (2012): "Rich models for steganalysis of digital images" — foundational work on rich steganalysis features
  • Goljan & Fridrich (2015): "CFA-aware features for steganalysis of color images"
  • Two-Stream Neural Networks for Tampered Face Detection — applies steganalysis features with triplet network for face tampering detection

Connections