Noise Inconsistency and Lighting Analysis for Image Forgery

A digital camera sensor converts photons into electrical charge. Several independent processes add noise to that conversion. Shot noise arises because photon arrival is a random Poisson process: even a perfectly uniform illumination produces slight pixel-to-pixel variation proportional to the square root of the signal level. Read noise is introduced by the amplifier and analogue-to-digital converter circuits and is approximately Gaussian in distribution. Fixed-pattern noise, of which PRNU is the dominant component, comes from permanent differences in the sensitivity of each pixel due to manufacturing variation in the photodiode size, doping, and microlens alignment.

PRNU is the most forensically useful component. Because it is stable over the camera lifetime and unique to each sensor, it can be estimated by capturing many flat-field images (uniformly illuminated) and averaging them to cancel random noise. The remaining pattern is the PRNU fingerprint. Once the fingerprint of a suspect camera is known, it can be correlated with any image claimed to have come from that camera. A high correlation confirms camera-source attribution; a low or spatially non-uniform correlation in a region claimed to be from the same source is evidence of tampering.

JPEG compression degrades the PRNU signal because the DCT quantisation redistributes energy across frequency bands. At quality factors above 90, PRNU is largely intact. At quality factors below 75, the correlation drops sharply and the method becomes unreliable without enhancement. Repeated compression is a deliberate counter-forensic technique: a compositor who re-saves the final image at low quality can suppress noise inconsistency evidence. Examiners should check the image quality factor and note this limitation explicitly in their report.

Even without access to the camera fingerprint, noise variance mapping can reveal composited regions. The method divides the image into non-overlapping blocks, typically 32x32 or 64x64 pixels, and estimates the noise variance within each block by applying a high-pass filter, such as a Laplacian or the first level of a wavelet decomposition, and computing the variance of the residual. Image content, which is low-frequency, is suppressed by the filter. The residual captures noise plus fine texture.

In a genuine image from one camera, blocks over smooth surfaces (sky, painted walls, skin) should have noise variance consistent with that camera's sensor noise model at the local signal level. A block from a composited region will have a different variance because it came from a sensor with different noise characteristics, or because it was processed (sharpened, blurred, de-noised) before insertion. Blocks over strong textures, such as grass or fabric, will have high variance regardless, which is why the mapping is most informative in smooth regions.

A practical complication is that the compositor may have applied a slight Gaussian blur to the pasted region to smooth the edge, or an artificial grain filter to match the host image noise. These post-paste operations shift the variance of the inserted region toward the host. Skilled compositors do this deliberately. Examiners counter by examining the noise spectrum rather than the variance alone: natural sensor noise has a white spectrum, while Gaussian blur leaves a characteristic low-pass signature, and synthetic grain added by imaging software has spectral peaks at the grain filter's characteristic frequencies.

Lighting analysis exploits the physics of image formation: the brightness of a surface patch is determined by the angle between the surface normal and the illuminant direction. For a Lambertian (matte) surface, brightness is proportional to the cosine of that angle. By observing the gradient of brightness across a curved surface, an examiner can infer the illuminant direction without needing to know the exact surface shape.

Three practical approaches are used in casework. First, specular highlight analysis: on shiny surfaces such as eyes, jewellery, or polished metal, the specular highlight appears at the point where the surface normal bisects the angle between the illuminant and the camera. The highlight position encodes the illuminant direction relative to the surface. When a face composited from one photograph has specular highlights in the eyes inconsistent with the direction of window light visible in the background, the inconsistency is measurable. Second, shadow analysis: cast shadow boundaries have a known geometric relationship with the illuminant direction. If the shadow cast by a person points in a different compass direction from the shadow cast by a nearby lamp post, one of them was photographed under a different light source. Third, shading analysis of convex objects: the pattern of light and dark across a sphere or a human cheek encodes the illuminant direction through the shading gradient.

The quantitative method estimates an illuminant direction vector independently for two or more regions and tests whether those vectors agree within measurement uncertainty. The uncertainty comes from surface normal uncertainty (the surface shape must be estimated, not measured directly), the assumption of single dominant illumination, and the image resolution. Disagreement beyond the uncertainty envelope supports a conclusion of compositing.

Noise analysis and lighting analysis are independent physical tests. When both point to the same region as anomalous, the evidential weight is substantially greater than either alone. A region with both a deviant noise profile and an inconsistent illuminant direction is very unlikely to have arisen through innocent processing. Conversely, when only one method flags a region, the examiner should investigate whether an innocent explanation exists: camera-body replacement in a multi-shot composite, studio lighting, or aggressive post-processing that altered noise without any forgery.

Copy-move forgeries, where a region within the same image is duplicated and pasted elsewhere, present a different noise pattern than splicing from a different image. In a copy-move, the noise in the copied region will match the host camera's PRNU, because both source and destination come from the same sensor. However, the copied region may still show illuminant inconsistency if the duplicated object was in a different part of the scene with a different lighting geometry, and noise variance mapping may reveal subtle JPEG double-compression artefacts if the image was saved after the paste. See the related topic on copy-move and splicing detection for the DCT-domain methods specific to that manipulation type.

AI-generated and deepfake imagery presents new challenges for both methods. Generative adversarial networks and diffusion models do not use real camera sensors, so PRNU is absent. The noise in generated images may look statistically plausible but lacks the fixed-pattern structure of a real sensor. Lighting in generated images is learned from training data: high-quality generators can produce globally consistent illumination, but artefacts in peripheral regions, hair, and background edges often show lighting inconsistencies. The distinction between a deepfake face pasted into a real photograph and a fully synthetic image requires awareness of the generation method. See How Deepfakes are Generated for the technical background.

Several open and commercial tools implement noise and lighting analysis. FotoVerifier (open-source, maintained by the University of Salerno group) includes noise inconsistency analysis, PRNU extraction, and lighting direction estimation. Amped FIVE and Griffeye Analyze DI are commercial forensic platforms with validated implementations of noise analysis. The Error Level Analysis (ELA) tool is widely cited in online resources but has a high false-positive rate and is not an accepted stand-alone method in peer-reviewed forensic practice; it should be used only as a screening step, not as evidence.

A standard casework workflow follows this sequence: (1) preserve the original file and record its hash; (2) extract EXIF and file-format metadata; (3) estimate JPEG quality factor; (4) apply noise variance mapping to identify candidate regions; (5) if a reference camera is available, extract the PRNU fingerprint and correlate; (6) apply illuminant direction estimation to candidate regions and to the background scene; (7) document each step with the tool version, parameters, and intermediate outputs; (8) state conclusions with explicit uncertainty.

Documentation standards differ by jurisdiction. In the United States, Federal Rule of Evidence 702 and the Daubert standard require that the method be published and have a known error rate. Published validation studies for PRNU-based tampering detection report detection rates above 95% at false-positive rates below 5% for high-quality JPEG images. In England and Wales, the Forensic Science Regulator's Codes of Practice and Conduct require that all methods be validated and that uncertainty be quantified. Under India's Bharatiya Sakshya Adhiniyam 2023 (Sections 61-65 for electronic evidence; Section 39 for expert opinion), the examiner must state their qualifications and methodology clearly. The European Union's GDPR does not directly govern forensic analysis of already-seized images, but Directive 2016/680 (Law Enforcement Directive) governs personal data processing in criminal investigations.

No forensic method is infallible. Noise inconsistency analysis can produce false positives when different regions of the same genuine image were processed differently by in-camera algorithms, such as automatic noise reduction applied more strongly to shadow areas. Some cameras apply local tone mapping that creates region-specific noise suppression, producing genuine variance differences that superficially resemble splicing. Examiners must know the image processing pipeline of the camera model under examination before concluding that a variance difference is evidence of forgery.

Counter-forensic techniques targeting these methods include: re-sampling the entire image through a single noise filter to homogenise variance (detectable by checking for over-smoothing in high-frequency residuals); adding synthetic grain matched to the host (detectable by spectral analysis of the grain pattern); using AI-based inpainting which generates plausible noise in the filled region (currently an active research area, with several published detection methods); and downscaling the image before delivery to destroy PRNU correlation.

When presenting findings in court, examiners should distinguish between three levels of conclusion: first, the image contains measurable noise or lighting inconsistency (a factual observation); second, that inconsistency is consistent with, and in the examiner's opinion most probably caused by, splicing of a region from a different source image (an expert opinion); and third, the image as presented does not accurately represent the original scene (a conclusion about meaning). Courts in the UK, US, India, Australia, and EU member states all accept the second form as expert opinion testimony when accompanied by documented methodology. Examiners should avoid the third form unless the evidence is unambiguous, because it invades the fact-finder's role.