PRNU: Physics and the Camera Fingerprint

A modern CMOS or CCD image sensor contains tens of millions of photodiodes, each intended to measure the number of photons that fall on it during an exposure. In an ideal world every pixel has the same quantum efficiency: one incoming photon produces one electron of charge with the same probability, everywhere on the chip. In practice that uniformity cannot be achieved.

The root causes are well understood by semiconductor engineers. Doping concentrations in the silicon substrate vary at the sub-micron level, changing the electric field that sweeps photogenerated carriers toward the readout circuit. Gate oxide thickness varies, altering the capacitance of the pixel well. The photodiode area varies slightly from the designed geometry. None of these variations are large, typically less than one percent of the pixel response, but they are stable over the lifetime of the device. The same pixel that runs one percent hotter than its neighbour today will still run one percent hotter five years from now.

This stability is what makes the pattern forensically useful. A scratch on a knife blade is permanent but visible. PRNU is permanent and invisible, which means a photographer using the camera for years had no reason to try to remove it and no way of knowing it was there. The fingerprint accumulates into the photographic record passively, without any cooperation from the camera owner.

The standard PRNU signal model writes the pixel output of any captured image as:

I = I_ref + I_ref · K + noise

Here I is the actual pixel output, I_ref is the ideal noise-free scene value, K is the PRNU component for that pixel (a gain deviation from unity), and the remainder is random noise. More compactly, I = W · I_ref + noise where W = 1 + K is the pixel's gain factor. The key observation is that K multiplies the scene, so the PRNU contribution is proportional to the local brightness. A bright sky region carries more PRNU signal than a dark shadow.

Fridrich and co-authors made this concrete in their 2006 paper by showing that averaging PRNU residuals from multiple flat-field images of a uniform surface causes the random noise to cancel out while the fixed PRNU pattern accumulates. The same principle underlies the reference pattern estimation used in all subsequent camera-attribution systems.

PRNU is often compared to dark current non-uniformity, another fixed pattern in image sensors. They sound similar but behave very differently in practice.

The practical consequence is that DCNU is subtracted out during normal camera operation by dark-frame subtraction, a feature built into most scientific cameras and available in many consumer devices. PRNU is not corrected in standard consumer imaging because doing so would require storing a per-pixel calibration table, and the variation is too small to affect image quality visibly. The camera manufacturer's indifference to PRNU is the forensic analyst's asset: the fingerprint arrives unmodified in every JPEG or RAW file the camera produces.

A critical question in any casework application is whether the PRNU pattern recovered from images taken at one time still matches the same camera years or firmware versions later. The answer is yes, with qualifications that an analyst must know.

• Firmware updates: change signal processing, demosaicing, and noise-reduction algorithms, but they do not alter the silicon. The underlying pixel sensitivity pattern is unchanged. Studies comparing PRNU extracted from images taken before and after firmware updates consistently show strong correlation.
• ISO and exposure settings: camera gain amplifies the sensor signal, including the PRNU component, proportionally. The normalised pattern is ISO-independent because the gain affects signal and PRNU equally. Very high ISOs where noise dominates can reduce the signal-to-noise ratio of the PRNU estimate, but do not change its spatial structure.
• Lens vignetting and optical effects: a fixed lens system adds a low-frequency radial pattern to every image. For cameras with fixed lenses this does contribute to the sensor pattern noise. For interchangeable-lens cameras the lens-dependent component varies across images, and averaging over many images (standard in reference pattern estimation) suppresses it, leaving the sensor-specific PRNU dominant.
• Sensor dust: physical contamination on the sensor or anti-aliasing filter creates dark spots at consistent positions, which appear as part of the sensor pattern noise. This contamination can change if the sensor is cleaned, and it can itself serve as a corroborating identifier in some cases.
• In-camera sharpening and noise reduction: heavy in-camera processing can partially suppress PRNU signal, particularly for JPEGs at low quality settings. Shooting RAW images maximises the PRNU signal available for extraction.

Before 2006, camera identification from images had been attempted using features like JPEG artifacts and lens distortion, but none of those approaches could link an image to one specific camera body rather than one model or manufacturer. Jan Lukáš, Jessica Fridrich, and Miroslav Goljan changed the question by asking not about high-level features but about the noise floor.

Their 2006 IEEE Transactions on Information Forensics and Security paper, 'Digital camera identification from sensor pattern noise', tested 9 cameras of 6 different brands. They denoised each image to strip scene content, estimated a reference PRNU pattern from flat-field images of each camera, and then tested whether a query image's noise residual correlated with the correct camera's reference. The normalised cross-correlation metric correctly identified the source camera across all images in the test set, with no false attributions among the cameras tested. The approach worked on both JPEG and RAW images, though JPEG compression reduced the signal.

Two aspects of that paper deserve particular attention. First, the method required only natural photographic images to build the reference pattern, not calibration images. This is critical for casework: an investigator seizing a device can use any images already on it. Second, the paper articulated the hypothesis-testing framework for camera attribution, making the decision rule quantitative rather than intuitive. Both of those design choices have survived into every subsequent PRNU implementation.

Calling PRNU a fingerprint is useful as a shorthand but slightly misleading if taken literally. A human fingerprint has on the order of 100 to 150 minutiae points, each with position and orientation, making accidental matches between unrelated fingers astronomically unlikely. PRNU operates differently: it is a two-dimensional map with millions of values, but the comparison statistic (normalised cross-correlation or its derivative PCE) collapses those values to a single number. The question is not just 'do these patterns match' but 'by how much, and is that enough to exclude chance?'

For a dataset of a few hundred cameras, the empirical false-positive rate is extremely low. As the pool of candidate cameras grows to many thousands, the probability of a spurious high-correlation match among unrelated devices increases. This is the base-rate problem, and it appears again in the casework limitations topic. The relevant point for physics-level understanding is that the fingerprint's discriminating power depends on the image resolution (more pixels means more fingerprint data), the number of images used to estimate the reference, and the JPEG quality of the query images.

• Higher image resolution: more independent PRNU samples per image, stronger correlation statistics, lower false-positive rate.
• More reference images: better averaging reduces the random-noise component in the estimated reference, sharper fingerprint.
• JPEG quality: JPEG quantisation partially destroys PRNU signal, especially at low quality factors. Very heavily compressed images (quality below about 80) significantly reduce PCE, and extreme compression can make attribution unreliable.