PRNU Extraction, Matching, and the PCE Statistic

The PRNU residual from a single image is computed as:

W_hat = I - F(I)

where I is the original pixel array and F(I) is the denoised version produced by a filter F. The residual contains the PRNU component (which is spatially correlated and fixed across images) plus random shot noise (which is independent across images and will average away). The quality of the residual depends entirely on how well F removes scene content without also removing the PRNU.

Two denoising approaches dominate the literature. Wavelet-based denoisers, commonly the Daubechies 8-tap filter used in the original Lukáš et al. implementation, operate by thresholding wavelet coefficients at each scale. They are computationally fast and work well for natural images. BM3D, introduced by Dabov et al. in 2007, achieves markedly better scene-content removal by exploiting self-similarity across the image through block matching. BM3D denoising residuals have a higher signal-to-noise ratio for PRNU than wavelet residuals, particularly for images with strong textural content, and it has become the preferred denoiser in high-accuracy PRNU systems.

The reference PRNU pattern for a camera is estimated by averaging the residuals from N images taken by that camera:

K_hat = (1/N) · sum(W_hat_i)

Because the random noise in each residual is independent, it averages toward zero with a rate proportional to 1/sqrt(N). The PRNU component, being constant across images, accumulates linearly. The signal-to-noise ratio of the reference therefore grows as sqrt(N), so doubling the number of images improves it by about 41 percent.

The images used for reference estimation should be varied in scene content: outdoor, indoor, bright, dark, textured, smooth. Using images that are too similar to each other (for example, a sequence of near-identical shots) means the scene-content residuals may partially correlate across images rather than cancelling, biasing the reference. In practice, casework analysts often work with whatever natural images are stored on a seized device, which tends to provide adequate variety.

• Flat-field images (uniformly lit surface): maximise PRNU signal per image (bright uniform field keeps the multiplicative term high); 10-20 flat-field images can match 100+ natural images in reference quality.
• Natural images (typical photographs): available on any seized device; 50-200 images needed for reliable attribution at resolutions of 8-24 megapixels.
• Video frames: individual frames can be extracted and used as natural images; consecutive frames are highly correlated so spacing (every 10th frame or more) is needed to avoid bias.

Given a query noise residual W_hat_q and a reference pattern K_hat_c for candidate camera c, the normalised cross-correlation is:

NCC = corr(W_hat_q, K_hat_c) / (||W_hat_q|| · ||K_hat_c||)

This ranges from -1 to +1. For a true source-camera match on an uncompressed image, NCC values above about 0.01 are considered significant (the absolute scale is low because the signal rides on top of much larger random noise). For a non-source camera the value hovers near zero. The NCC threshold for a positive attribution decision depends on the resolution and the desired false-positive rate.

PCE improves on raw NCC by asking not just 'is the correlation high?' but 'how prominent is the correlation peak relative to the surrounding surface?' The cross-correlation is computed in the frequency domain (via FFT), yielding a two-dimensional correlation surface. PCE is the peak value of that surface divided by the energy of the rest of it:

PCE = peak^2 / ((1/(MN-1)) · sum_rest(values^2))

A sharp, isolated peak against a flat background gives a high PCE. A broad, noisy correlation surface with no clear peak gives a low PCE. For true camera matches, PCE values in the hundreds or thousands are common. For non-source cameras, PCE typically stays below 60. These distributions overlap only at the low end of the true-match distribution, which is precisely the regime that requires careful interpretation.

Camera attribution is framed as a binary hypothesis test. The null hypothesis H0 is that the query image was not taken by the candidate camera. The alternative H1 is that it was. The analyst sets a threshold PCE_threshold, and the decision rule is: if PCE >= PCE_threshold, attribute to this camera; otherwise do not.

The threshold is calibrated empirically by testing a validation set of true matches (images of known source) and non-matches (images from different cameras). The distribution of PCE values under H0 is estimated from non-source pairs, and PCE_threshold is set so that the false-positive rate (attributing to the wrong camera) is acceptably low. In forensic practice, false-positive rates of 1 in 10,000 or lower are targeted, with the exact rate depending on the size of the candidate pool.

The number of reference images required for reliable attribution is not fixed. It depends on image resolution, JPEG quality, and the false-positive rate targeted. Several empirical studies have converged on practical guidance.

• For a 12-megapixel sensor at JPEG quality 90+: 50 natural images are typically sufficient for a PCE-based attribution decision at a false-positive rate of 1 in 10,000. Reference quality saturates around 200-300 images for most sensors.
• For a 3-megapixel sensor: more images are needed to compensate for the smaller pixel count. Studies suggest 100-200 images for comparable reliability.
• For JPEG quality around 80: each image carries roughly 50-60% of the PRNU signal it would carry uncompressed. More reference images partially compensate, but the query residual is also weaker, so the PCE for a true match is lower and the distribution overlaps more with non-matches.
• For JPEG quality below 70: PRNU signal is severely degraded in query images. Attribution becomes unreliable unless the candidate pool is small and additional corroborating evidence exists.

Resolution matters because more pixels means more PRNU samples per image, and more independent samples improve the correlation statistic. This is why smartphones with small sensors and then-lower resolutions in the early 2010s presented more challenging attribution cases than contemporary 20-megapixel cameras, even though their PRNU physics is identical.

Video files present two complications for PRNU analysis: inter-frame compression and temporal correlation. Modern video codecs (H.264, H.265) compress most frames as motion-compensated differences from a reference frame rather than as independent images. Only I-frames (key frames) are encoded like independent JPEG images. P-frames and B-frames have different noise statistics and lower PRNU content.

The practical approach is to extract I-frames from the video and treat them as natural images for both reference estimation and query testing. Consecutive I-frames at typical video bit rates still contain enough PRNU signal for attribution, but the effective JPEG quality equivalent is often in the 70-85 range, meaning more frames are needed than photographs at the same nominal resolution. Studies by Taspinar et al. and others have confirmed that PRNU attribution from video I-frames is feasible with 200-500 frames and that the PCE distributions for true and false matches retain the same structure as still-image attribution.