Noise and CFA Inconsistency Detection

Noise estimation starts with a problem: most image content is signal, not noise, and the two are mixed together at every pixel. To isolate the noise, analysts look for regions of the image where the signal is approximately constant, so that pixel-to-pixel variation is almost entirely noise. These are called homogeneous patches.

A block-based homogeneity test divides the image into small non-overlapping blocks (typically 8x8 or 16x16 pixels) and computes a gradient or local variance measure for each block. Blocks with low gradient and low local variance are classified as homogeneous candidates. Within each candidate block, the pixel variance is a direct estimate of the noise variance. Aggregating across many homogeneous blocks gives a robust estimate of the noise level for that image.

The estimated noise level is a global statistic for the image. For forgery detection, the key step is to compute local noise estimates across the image, producing a noise-level map. Regions that deviate significantly from the global noise level are anomalous and warrant further investigation. A pasted region from a lower-noise source (for example, from a higher-ISO image or a different camera) will appear as a low-noise patch in an otherwise uniformly noisy field, or as a high-noise patch in a low-noise field.

Real camera noise is not purely Gaussian. Shot noise (Poisson-distributed, arising from the discrete nature of photons) has variance proportional to the signal intensity. Readout noise from the analogue-to-digital converter is signal-independent. The combined noise variance as a function of pixel intensity follows a roughly linear relationship: variance(I) = a * I + b, where I is pixel intensity, a is the shot-noise coefficient, and b is the readout noise floor. This is the camera noise model.

Fitting this model to an image uses homogeneous patches at different brightness levels to sample the variance-versus-intensity curve and estimate a and b. The model is characteristic of the specific sensor and ISO. A forensic analyst with the model for a claimed source device can then test whether every region of the image is consistent with that model.

Local variance maps extend this to forgery localisation. The image is divided into small windows, the local noise variance is estimated in each window, and the result is normalised against the expected variance from the fitted model at the local mean brightness. Windows that show significantly higher or lower normalised variance than predicted are flagged. A clustered region of deviant windows is consistent with compositing.

The Bayer CFA assigns a red, green, or blue filter to each photosite in a repeating 2x2 mosaic. Because a pixel in the demosaiced image has its missing two channels interpolated from neighbours, adjacent pixels are not independent. Specifically, the green channel samples every second pixel in alternating rows and columns, and the interpolated value at a given pixel depends on its neighbours. This produces a periodic spatial correlation in the demosaiced image that peaks at frequencies corresponding to the 2-pixel CFA period.

Popescu and Farid (2005) demonstrated that this periodic correlation can be detected via the autocorrelation of the image or via its 2D Fourier transform, and that it is a reliable signature of CFA-demosaiced images. The specific form of the correlation also encodes the interpolation algorithm used, providing a second level of fingerprinting beyond simply 'was this demosaiced?'

Splicing breaks the CFA pattern in two ways. First, content pasted from an image that used a different interpolation algorithm will have a different correlation structure, detectable by fitting the expected autocorrelation model and measuring the residual. Second, a paste that shifts the CFA phase, because the source image was cropped at a non-even offset, introduces a phase discontinuity at the splice boundary. The phase is detectable locally, and a phase step at a sharp boundary is consistent with splicing.

Rather than setting an ad-hoc threshold on a noise-level map, Bayesian methods frame forgery localisation as a hypothesis test at each pixel or block. The null hypothesis is that the local noise is consistent with the fitted camera noise model. The alternative is that the noise deviates in a way consistent with content from a different source. The likelihood ratio of these two hypotheses, computed from the local noise residual, produces a forgery probability map.

The noise residual at a pixel is the difference between the observed pixel value and a denoised estimate, obtained by applying a denoising filter to the image. If the denoising filter is well-matched to the camera noise model, the residual in authentic regions should look like zero-mean Gaussian noise with variance equal to the model prediction. Regions where the residual has higher or lower variance, or where it has a structured (non-random) pattern, are anomalous.

Noise analysis is used in both steganalysis and forgery detection, but the two tasks are distinct and the noise signatures they look for are different.

Classic spatial-domain steganography (LSB replacement, LSB matching) embeds data by modifying the least-significant bit of pixel values throughout the entire image. The modification is visually imperceptible but disrupts the natural noise distribution. Specifically, LSB replacement causes the histogram of pixel values to become statistically regular in a detectable way (the WS steganalysis method and its successors exploit this). The modification is global, affecting the whole image's noise statistics uniformly, though adaptively-chosen embedding sites in smooth regions may concentrate the modifications.

Compositing forgery produces localised noise inconsistencies concentrated in the inserted region and at its boundary. The rest of the image retains the original camera noise model. This spatial locality is the key discriminator. A noise anomaly that is uniform across the entire image, with no localised region of inconsistency, is more consistent with steganography or global processing than with regional compositing.

• Global noise floor elevation + no local anomaly: consider steganography or global filter application.
• Local noise anomaly at spatially coherent region: consistent with compositing; check boundaries for CFA phase shift and JPEG ghost.
• Local noise anomaly at edges only: consider JPEG blocking artefacts, sharpening, or border effects before concluding compositing.

Noise-based methods have specific failure modes that practitioners must document. In-camera noise reduction applied by modern smartphones can make all regions appear equally smooth, masking both the genuine camera noise fingerprint and the noise inconsistency that would reveal a splice. High ISO images have higher shot noise that can swamp the noise model deviation produced by a carefully-matched pasted region.

Camera models that use computational photography (multi-frame averaging, night mode, HDR fusion) process images from multiple exposures and combine them, producing noise statistics that differ significantly from a single-exposure model. Applying a single-exposure noise model to a computational photograph will produce apparent noise anomalies across the entire image that have nothing to do with manipulation.

The required corroboration is the same across all passive methods: a noise anomaly that appears independently in JPEG compression analysis, CFA correlation analysis, and geometric consistency checks is substantially more reliable than a noise anomaly found by one method alone. A report that presents noise-level inconsistency as a standalone forgery indicator is vulnerable to challenge on all of the above grounds.