Improving the security of image manipulation detection through one-and-a-half-class multiple classification

Abstract

Protecting image manipulation detectors against perfect knowledge attacks requires the adoption of detector architectures which are intrinsically difficult to attack. In this paper, we do so, by exploiting a recently proposed multiple-classifier architecture combining the improved security of 1-Class (1C) classification and the good performance ensured by conventional 2-Class (2C) classification in the absence of attacks. The architecture, also known as 1.5-Class (1.5C) classifier, consists of one 2C classifier and two 1C classifiers run in parallel followed by a final 1C classifier. In our system, the first three classifiers are implemented by means of Support Vector Machines (SVM) fed with SPAM features. The outputs of such classifiers are then processed by a final 1C SVM in charge of making the final decision. Particular care is taken to design a proper strategy to train the SVMs the 1.5C classifier relies on. This is a crucial task, due to the difficulty of training the two 1C classifiers at the front end of the system. We assessed the performance of the proposed solution with regard to three manipulation detection tasks, namely image resizing, contrast enhancement and median filtering. As a result the security improvement allowed by the 1.5C architecture with respect to a conventional 2C solution is confirmed, with a performance loss in the absence of attacks that remains at a negligible level. * The 1.5C code is avaliable on: http://github.com/EhsanNowroozi/ Accessed: 2019-09-05.

A Survey of Machine Learning Techniques in Adversarial Image Forensics

“…In the second category, generally more secure detectors, most anti-CF methods are developed without considering developing a technique that analysts react appropriately against various kinds of attacks. Barni et al [48] proposed a detector against PK attacks through multiple-classifier architecture. The architecture is also known as a 1.5C classifier, consisting of one 2C classifier, two 1C classifiers, and a final 1C classifier.…”

“…Different kinds of attacks to the general ML system can be employed based on the above taxonomy, as done in [48].…”

“…By following the terminologies in [48], an adversarial model is represented by specifying the assumptions about an attacker's goal, knowledge, and capability to corrupt the data or system.…”

“…In contrast, the generator intends to deceive the discriminator by generating data near a pristine one. • Ensemble Method Multiple architecture combination (1.5C) is another strategy to improve the security and robustness against PK attacks in image manipulation detection, which decreases damage caused by an attacker [48]. The 1.5C architecture is achieved by a combination of 2C and 1Cs classifiers, runs simultaneously, and outputs of each classifier feed to the final 1C classifier.…”

“…We see that moving samples from manipulated to the pristine region need a more distortion because of the adjacency of pristine samples to the decision region. To achieve a Figure 22: Scheme of 1C by defining a closed region [48] system that is intrinsically difficult to attack, the classifiers are combined, which has similar accuracy with respect to 2C and high accuracy with respect to 1C. Based on Figure 23, the acceptance region is well-shaped compared to 1C with similar accuracy with respect to 2C [48].…”