Steganalysis models excel on benchmark datasets but struggle in the wild when analyzed images are produced by a processing pipeline unseen during training. This problem known as Cover Source Mismatch (CSM) is particularly hard in realistic settings where practitioners (1) have access to only a small, unlabeled dataset, (2) are unsure of the processing techniques applied to these images, and (3) lack information on the proportion of covers and stegos in that set. To answer this challenge, we introduce TADA (Target Alignment through Data Adaptation), a framework learning to emulate the unknown processing pipeline from a small unlabeled target set. This architecture is trained with a loss combining residual covariance alignment, residual distribution matching, and a ℓ^2 loss constraining the emulator to produce realistic images. Across toy and operational targets, TADA yields substantial gains in robustness to CSM and improves operational generalization compared to strong holistic and atomistic baselines. Additional resources are available at this link: https://github.com/RonyAbecidan/TADA

This paper investigates the detectability of popular imagein-image steganography schemes [1, 2, 3, 4, 5]. In this paradigm, the payload is usually an image of the same size as the Cover image, leading to very high embedding rates. We first show that the embedding yields a mixing process that is easily identifiable by independent component analysis. We then propose a simple, interpretable steganalysis method based on the first four moments of the independent components estimated from the wavelet decomposition of the images, which are used to distinguish between the distributions of Cover and Stego components. Experimental results demonstrate the efficiency of the proposed method, with eight-dimensional input vectors attaining up to 84.6

Neural watermarking has been on the rise as a simple tool for marking generated multimedia content in a robust way. This simplicity, however, comes at a cost. While it is easy to enforce robustness in a training loss through various data augmentations, it is currently unknown how to include the security aspect of watermarking. Consequently, these black-box schemes are easily breakable by targeted attacks. In this work, we show how to remove a watermark from a recently proposed WAM [16] image watermarking model. Consistent with Kerckhoffs’s principle, we show that the absence of a secret key, combined with the requirement for robustness, creates an exploitable weakness. This manifests as nearperiodic patterns in one principal color component of the image. We show that these patterns can be accurately estimated even from a single image, and erased by manipulating a single component of the image in its Fourier representation. Furthermore, we demonstrate that the same watermark can be manually injected, yielding noticeably higher image fidelity than when using WAM for watermarking. The code used in this work will be made available upon acceptance of the paper.

Steganographic schemes dedicated to generated images modify the seed vector in the latent space to embed a message. Whereas most steganalysis methods attempt to detect the embedding in the image space, this paper proposes to perform steganalysis in the latent space by modeling the statistical distribution of the norm of the latent vector. Specifically, we analyze the practical security of a scheme proposed by Hu et al. for latent diffusion models, which is both robust and practically undetectable when steganalysis is performed on generated images. We show that after embedding, the Stego (latent) vector is distributed on a hypersphere while the Cover vector is i.i.d. Gaussian. By going from the image space to the latent space, we show that it is possible to model the norm of the vector in the latent space under the Cover or Stego hypothesis as Gaussian distributions with different variances. A Likelihood Ratio Test is then derived to perform pooled steganalysis. The impact of the potential knowledge of the prompt and the number of diffusion steps is also studied. Additionally, we show how, by randomly sampling the norm of the latent vector before generation, the initial Stego scheme becomes undetectable in the latent space.

Despite recent progress in splicing detection, deep learning-based forensic tools remain difficult to deploy in practice due to their high sensitivity to training conditions. Even mild post-processing applied to evaluation images can significantly degrade detector performance, raising concerns about their reliability in operational contexts. In this work, we show that the same deep architecture can react very differently to unseen post-processing depending on the learned weights, despite achieving similar accuracy on in-distribution test data. This variability stems from differences in the latent spaces induced by training, which affect how samples are separated internally. Our experiments reveal a strong correlation between the distribution of latent margins and a detector's ability to generalize to post-processed images. Based on this observation, we propose a practical strategy for building more robust detectors: train several variants of the same model under different conditions, and select the one that maximizes latent margins.

The present paper deals with the problem of the detection of AI-generated images. It first proposes a forensic analysis, based on spatial correlations of the noise present in images, that can be used as fingerprints of both real and generated images. In particular, fingerprints can be extracted in each color channel, and complement each other during detection. The proposed detection scheme is a 3-step classifier, consisting only of a set of simple log-linear classifiers. This scheme is shown to perform much better than a standalone detector. The performance of the method is first assessed in an In-Distribution scenario, where an error probability of less than 1% is achieved on uncompressed images. It is then compared to state-of-the-art detectors in an out-of-distribution scenario, where significant performance gains are achieved. Results highlight the good generalization performances to unseen generators and the liability of color channels, specifically the chrominance CbCr for current state-of-the-art generators. A robustness analysis to JPEG compression also shows promising results for our method.

We introduce DinoLizer, a DINOv2-based localizer of manipulated areas in generative inpainting. The model is trained to focus on semantically altered regions by treating reconstructed areas outside the inpainted mask as a separate class, which yields significant improvements w.r.t. the conven- tional approach. We train the model with LORA on the Query and Value of the transformer blocks and simply add 1 linear layer on top of the backbone to predict manipulations on a 14 x 14 patch resolution. Because DINOv2 only accepts fixed- sized images, we use a sliding window approach to aggregate the predictions on larger images. Empirical results show that DinoLizer outperforms state-of-the-art methods on our proposed dataset and SOTA inpainting datasets. Furthermore, it is very robust to JPEG (double) compression. On average, DinoLizer achieves a 20

Deep steganalysis has been crucial in detecting hidden messages in digital media for nearly a decade. However, its common security evaluation criterion-the probability of error under equal prior-fails to reflect real forensic challenges. In practice, low False Positive (FP) rates matter most but are only adjusted empirically post-training. Standard classifiers, trained with cross-entropy loss, optimize balanced error rates rather than minimizing FPs. We propose a framework that integrates the likelihood ratio test into the loss function to optimize deep classifiers for low FP rates. Our method outperforms standard cross-entropy and other modern approaches, as demonstrated on the BOSSBase dataset across FP rates of 10−3 to 10−1 in both uncompressed and JPEG domains.

Understanding the mechanisms that lead to false alarms (erroneously detecting cover images as containing secrets) in steganalysis is a topic of utmost importance for practical applications. In this paper, we present evidence that a relatively small number of pixel outliers introduced by the image acquisition process can skew the soft output of a data driven detector to produce a strong false alarm. To verify this hypothesis, for a cover image we estimate a statistical model of the acquisition noise in the developed domain and identify pixels that contribute the most to the associated likelihood ratio test (LRT) for steganography. We call such cover elements LIEs (Locally Influential Elements). The effect of LIEs on the output of a data-driven detector is demonstrated by turning a strong false alarm into a correctly classified cover by introducing a relatively small number of "de-embedding" changes at LIEs. Similarly, we show that it is possible to introduce a small number of LIEs into a strong cover to make a data driven detector classify it as stego. Our findings are supported by experiments on two datasets with three steganographic algorithms and four types of data driven detectors.

An antecedent of a JPEG image is any pixel-valued image that gets compressed to this JPEG image. This paper presents a novel robust JPEG steganography method based on a JPEG antecedent search of a given stego image. This method can be used whenever Alice is able to upload on an online platform a pixel-valued stego image and when the platform compresses the image. Since the antecedent search can be in some cases rather long for specific JPEG blocks, we heuristically restrict the number of search steps per block to a given threshold. Nevertheless, we show that even with this limitation, we can achieve errorless robustness against JPEG compression for payloads as big as 0.5 bpnzac for various quality factors. Not only can we ensure errorless robustness for uncompressed and compressed images, but we also show that the proposed robustness update of a given steganographic algorithm increases its undetectability. We then verify that this security improvement comes from preventing embedding changes in DCT blocks with saturated pixels. Finally, we demonstrate that the proposed method outperforms previous state-of-the-art robust steganography in terms of security with feature-based and deep-learning detectors.

This paper deals with the Cover-Source Mismatch (CSM) problem faced in operational steganalysis.Based on a multivariate Gaussian model of the distribution of the noise contained in natural images, it provides proxies for the two important empirical measures of CSM: intrinsic difficulty and regret.The former can be modeled with the determinant of the covariance matrix of the noise present in an image.The latter can be predicted with a modified Kullback-Leibler divergence between the distribution of the noises of images coming from different cover-sources.We first recall the reasoning behind the multivariate Gaussian model of the noise, and detail how to compute the statistic of the distribution of the noise.Then, our proposed models are compared to empirical data with a specifically designed cover-source generation process.For both quantities, very high correlation coefficients between the model and the observations are obtained.Finally, realistic cover-sources are used to further illustrate the relevance of our model.

Robust steganography is a technique of hiding secret messages in images so that the message can be recovered after additional image processing. One of the most popular processing operations is JPEG recompression. Unfortunately, most of today's steganographic methods addressing this issue only provide a probabilistic guarantee of recovering the secret and are consequently not errorless. That is unacceptable since even a single unexpected change can make the whole message unreadable if it is encrypted. We propose to create a robust set of DCT coefficients by inspecting their behavior during recompression, which requires access to the targeted JPEG compressor. This is done by dividing the DCT coefficients into 64 non-overlapping lattices because one embedding change can potentially affect many other coefficients from the same DCT block during recompression. The robustness is then combined with standard steganographic costs creating a lattice embedding scheme robust against JPEG recompression. Through experiments, we show that the size of the robust set and the scheme's security depends on the ordering of lattices during embedding. We verify the validity of the proposed method with three typical JPEG compressors and the Slack instant messaging application. We benchmark its security for various embedding payloads, three different ways of ordering the lattices, and a range of Quality Factors. Finally, this method is errorless by construction, meaning the embedded message will always be readable.

Given a JPEG pipeline (compression or decompression), this paper shows how to find the antecedent of a 8 x 8 block. If it exists, the block is compatible with the pipeline. For unaltered images, all blocks are always compatible with the original pipeline; however, for manipulated images, this is not always the case. This article demonstrates the potential of compatibility concepts for JPEG image forensics. It presents a solution to the main challenge of finding a block antecedent in a high-dimensional space. This solution relies on a local search algorithm with restrictions on the search space. We show that inpainting, copy-move, or splicing applied after a JPEG compression can be turned into three different mismatch problems and be detected. In particular, when the image is re-compressed after the modification, we can detect the manipulation if the quality factor of the second compression is higher than the first one. Our method can pinpoint forgeries down to the JPEG block with great detection power and without False Positive. We compare our method with two state-of-the-art models on localizing inpainted forgeries after a simple or a double compression. We show that under our working assumptions, it outperforms those models for most experiments.

This article presents a refined notion of incompatible JPEG images for a quality factor of 100. It can be used to detect the presence of steganographic schemes embedding in DCT coefficients. We show that, within the JPEG pipeline, the combination of the DCT transform with the quantization function can map several distinct blocks in the pixel domain to the same block in the DCT domain. However, not every DCT block can be obtained: we call those blocks incompatible. In particular, incompatibility can happen when DCT coefficients are manually modified to embed a message. We show that the problem of distinguishing compatible blocks from incompatible ones is an inverse problem with or without solution and we propose two different methods to solve it. The first one is heuristic-based, fast to find a solution if it exists. The second is formulated as an Integer Linear Programming problem and can detect incompatible blocks only for a specific DCT transform in a reasonable amount of time. We show that the probability for a block to become incompatible only relies on the number of modifications. Finally, using the heuristic algorithm we can derive a Likelihood Ratio Test depending on the number of compatible blocks per image to perform steganalysis. We simulate the result of this test and show that it outperforms a deep learning detector e-SRNet for every payload between 0.001 and 0.01 bpp by using only 10% of the blocks from 256x256 images. A Selection-Channel-Aware version of the test is even more powerful and outperforms e-SRNet while using only 1% of the blocks.

Despite advancements in splicing detection, practitioners still struggle to fully leverage forensic tools from the literature due to a critical issue: deep learning-based detectors are extremely sensitive to their trained instances. Simple post-processing applied to evaluation images can easily decrease their performances, leading to a lack of confidence in splicing detectors for operational contexts. In this study, we show that a deep splicing detector behaves differently against unknown post-processes for different learned weights, even if it achieves similar performances on a test set from the same distribution as its training one. We connect this observation to the fact that different learnings create different latent spaces separating training samples differently. Our experiments reveal a strong correlation between the distributions of latent margins and the ability of the detector to generalize to post-processed images. We thus provide to the practitioner a way to build deep detectors that are more robust than others against post-processing operations, suggesting to train their architecture under different conditions and picking the one maximizing the latent space margin.

The present paper deals with the cover-source mismatch (CSM) problem in operational steganalysis. It first investigates the distribution of the noise in natural images, and shows how this property can be used to build a fingerprint of the cover- source, to address the issue of source identification from a single image. In particular, fingerprints from different noise extraction techniques are studied. Results show that these fingerprints can be complementary. The method proposed in the present paper aggregates them in a unique forensic feature to build a more accurate source identification algorithm than when using steganalysis features, such as the discrete cosine transform residual (DCTR). Last, the paper exploits the proposed forensic tool to mitigate CSM via "atomistic steganalysis". Used together with steganalysis methods, experimental results highlight the superiority of our approach, as compared to other atomistic mitigation strategies. The relevancy of these results is further studied on out- of-camera images coming from Flickr and the ALASKA dataset. We show that for some devices, our approach gives results superior to the omniscient scenario.

The proliferation of image manipulation for unethical purposes poses significant challenges in social networks. One particularly concerning method is Image Steganography, allowing individuals to hide illegal information in digital images without arousing suspicions. Such a technique pose severe security risks, making it crucial to develop effective steganalysis methods enabling to detect manipulated images for clandestine communications. Although significant advancements have been achieved with machine learning models, a critical issue remains: the disparity between the controlled datasets used to train steganalysis models against real-world datasets of forensic practitioners, undermining severely the practical effectiveness of standardized steganalysis models. In this paper, we address this issue focusing on a realistic scenario where practitioners lack crucial information about the limited target set of images under analysis, including details about their development process and even whereas it contains manipulated images or not. By leveraging geometric alignment and distribution matching of source and target residuals, we develop TADA (Target Alignment through Data Adaptation), a novel methodology enabling to emulate sources aligned with specific targets in steganalysis, which is also relevant for highly unbalanced targets. The emulator is represented by a light convolutional network trained to align distributions of image residuals. Experimental validation demonstrates the potential of our strategy over traditional methods fighting covariate shift in steganalysis.

In this paper, we tackle the problem of detecting the so-called Adobe pattern. Recent research [4] showed that RAW and 16-bit images developed with the Lightroom or CameraRaw software into 8-bit formats are modified by an imperceptible periodical pattern. This 128 x 128 pattern is influenced by the 16-bit valued content and is incorporated in the 16-bit domain, making it impossible to estimate perfectly from real 8-bit images. Furthermore, as this periodic pattern can be perceived as a bias shared among different users and camera models, it has led to inaccurate camera attribution when working with the Photo-Response Non-Uniformity (PRNU). To effectively eliminate this bias, it is therefore imperative to have an accurate method of detecting the Adobe pattern. We model the content-dependent Adobe pattern as a deterministic pattern corrupted by uniform noise, which enables us to frame the detection of the Adobe pattern as a hypothesis test. Using the Likelihood Ratio Test, we demonstrate that for images without the Adobe pattern, a meticulously designed test statistic follows a zero-mean Gaussian distribution with a constant variance. Moreover, the detection accuracy exceeds 90% at false positive rate of 10(-4) for 128x128 images JPEG compressed with quality 80, and improves with higher image quality. Finally, we find that around 16% of images in the FFHQ dataset [9] of real faces contain the Adobe pattern.

If the extraction of sensor fingerprints represents nowadays an important forensic tool for sensor attribution, it has been shown recently that images coming from several sensors were more prone to generate False Positives (FP) by presenting a common "leak". In this paper, we investigate the possible cause of this leak and after inspecting the EXIF metadata of the sources causing FP, we found out that they were related to the Adobe Lightroom or Photoshop softwares. The cross-correlation between residuals on images presenting FP reveals periodic peaks showing the presence of a periodic pattern. By developing our own images with Adobe Lightroom we are able to show that all developments from raw images (or 16 bits per channel coded) to 8 bits-coded images also embed a periodic 128x128 pattern very similar to a watermark. However, we also show that the watermark depends on both the content and the architecture used to develop the image. The rest of the paper presents two different ways of removing this watermark, one by removing it from the image noise component, and the other by removing it in the pixel domain. We show that for a camera presenting FP, we were able to prevent the False Positives. A discussion with Adobe representatives informed us that the company decided to add this pattern in order to induce dithering.