A Multi-purpose Image Counter-anti-forensic

Method Using Convolutional Neural Networks

Jingjing Yu, Yifeng Zhan, Jianhua Yang, and Xiangui Kang(B)

Guangdong Key Lab of Information Security, School of Data and Computer Science,
Sun Yat-Sen University, Guangzhou 510006, China
isskxg@mail.sysu.edu.cn

Abstract. During the past decade, image forensics has made rapid
progress due to the growing concern of image content authenticity. In
order to remove or conceal the traces that forensics based on, some far-
sighted forgers take advantage of so-called anti-forensics to make their
forgery more convincing. To rebuild the credibility of forensics, many
countermeasures against anti-forensics have been proposed. This paper
presents a multi-purpose approach to detect various anti-forensics based
on the architecture of Convolutional Neural Networks (CNN), which can
automatically extract features and identify the forged types. Our model
can detect various image anti-forensics both in binary and multi-class
decision effectively. Experimental results show that the proposed method
performs well for multiple well-known image anti-forensic methods.

Keywords: Convolutional Neural Networks · Counter anti-forensics ·

Multi-purpose

1 Introduction
With the popularity of digital cameras and powerful image processing software
tools, it is easy to record, edit and share photos. In law enforcement, digital image
content plays an important role in deciding a case. Since the digital image can be
easily altered by the forgers without leaving perceptible artifacts, its authenticity
and reliability must be verified. As a result, image forensics has raised more
and more attention over the last decade [1]. Various digital forensic techniques
[5,7,8,12,13] are proposed to detect the image processing operations, e.g., JPEG
compression, median filtering, resampling and contrast enhancement, which are
considered in our experiments. On the other hand, the farsighted forgers attempt
to fool the investigators by using anti-forensic techniques [2,4,6,9,10,14,15] to
remove or hide the traces that they may leave after certain operations. To restore
authenticity and rebuild the credibility, many countermeasures [3,11,22–24] have
been proposed to detect different anti-forensics.
X. Kang—This work was supported by NSFC (Grant nos. 61379155, U1536204,
61502547, 61332012, 61272453 and NSF of Guangdong province (Grant no.
s2013020012788).

c Springer International Publishing AG 2017
Y.Q. Shi et al. (Eds.): IWDW 2016, LNCS 10082, pp. 3–15, 2017.
DOI: 10.1007/978-3-319-53465-7 1
4 J. Yu et al.

Up to now, most counter-anti-forensic methods focus on a binary decision,

which targets only one type of image anti-forensics, and are difficult to extend
to counter other diverse image anti-forensics. For example, the method to detect
JPEG anti-forensics (anti-JPEG) is not applicable for identifying resampling or
contrast enhancement anti-forensic (short for anti-Res and anti-CE) operations.
Additionally, some existing detectors assume that they know the possible anti-
forensic type of the questionable images, which is not reasonable since no prior
information is provided in real-life scenario, the detector needs to have knowledge
of as many counter-anti-forensics as possible, which may cost plenty of effort to
seek out and then detect the specific anti-forensic technique. Hence, a multi-
purpose method is needed in this case.
Convolutional Neural Networks (CNN) [19], which belongs to deep learning
[16–21], has recently enjoyed a great success in speech and image recognition.
Its shared weights network was inspired by the biological neural network, which
reduces both the complexity of models and the numbers of weights. Moreover,
CNN can automatically learn features jointly with the classification, while most
existing counter-anti-forensic techniques have to separate the feature extraction
and classification. The latter may degrade the total detection performance, as
they cannot be optimized simultaneously. Therefore, we adopt CNN as our basic
architecture in this work.
In this paper, we propose a multi-purpose method to detect various image
anti-forensics using Convolutional Neural Networks, which can automatically
extract features and identify various image anti-forensics. Compared with some
existing specific counter measures, the proposed method can not only achieve
better detection performance, but also be used to extend to classify multiple
image anti-forensic operations. The rest of this paper is organized as follows.
In Sect. 2, we briefly review works on the anti-forensics involved in this paper.
Section 3 describes the proposed CNN architecture. Section 4 presents the exper-
imental results, and the conclusions are drawn in Sect. 5.

2 Background
In this section, we briefly review the image anti-forensic processing operations
and its traces left.

2.1 JPEG Anti-forensics

JPEG is the most commonly used compression standard in digital cameras

and image editing tools. Due to the nature of lossy transform coding, JPEG
introduces characteristic traces in the compressed images, e.g., the quantization
artifact in the DCT domain and the blocking artifact in the spatial domain.
Subsequently, anti-forensics [2,4] have been proposed to erase these traces. To
remove the quantization artifact, the authors of [2] added dither in the DCT
coefficients to restore the DCT coefficient histogram. The effectiveness of this
anti-forensic technique can be seen in Fig. 1. In order to detect the tampered
 A Multi-purpose Image Counter-anti-forensic Method 5

Fig. 1. DCT coefficient histogram of an image (a) before JPEG compression, (b) after
JPEG compression, (c) after JPEG anti-forensic operation.

traces, the authors [3] proposed a countering JPEG anti-forensic method. In [4],
JPEG blocking artifact is eliminated by median filtering followed by the dither.
This method can significantly disguise the traces left by JPEG compression and
decrease the detection accuracy of the aforementioned work [3]. To detect such
anti-forensic method, another countering method is proposed by estimating the
noise level of the questioned images [22].

2.2 Median Filtering Anti-forensics

Median filtering is frequently used in image processing for image enhancement
and anti-forensic purposes. Many median filtering detectors [12,13] and anti-
forensic (anti-MF) methods [14,15] have been developed to identify or mitigate
the operating traces. In [23], a specific countermeasure has been proposed to
counter anti-forensics via analyzing the periodicity of the added noise. How-
ever, this method loses effectiveness when facing another median filtering anti-
forensics [14], which left no periodical footprint.

2.3 Resampling Anti-forensics

Resampling traces are caused by linear dependencies among pixels. Popescu and
Farid [5] detect the traces based on its periodic artifacts by a probability map.
Subsequently, some farsighted forgers remove the periodic artifacts by irregular
sampling [6]. To detect the new clue which leaves behind this anti-forensics, the
authors in [24] proposed a new method using partial autocorrelation coefficients.

2.4 Contrast Enhancement Anti-forensics

The evidence left by contrast enhancement can be detected by measuring the
impulsive peaks and gaps in the image pixel value histogram [7,8]. As a result,
a variety of anti-forensics have been proposed to remove the fingerprints by
introducing noise in the contrast enhancement procedure [10] or into the contrast
enhanced image [9].
6 J. Yu et al.

3 The Proposed CNN Model for Countering

Anti-forensics

Convolutional Neural Networks (CNN) [17] is a new approach to discover highly

correlated information, which includes several types of layers, such as convolu-
tional layers, pooling layers and fully-connected layers. The convolutional layer
is the core building block of a CNN, and its output volume can be interpreted as
holding neurons arranged in a 3D volume. The parameters of the convolutional
layer consist of a set of learnable filters. Each filter is small spatially (along
width and height), but extends through the full depth of the input volume. The
pooling layer is able to reduce the spatial size of the representation, decrease the
amount of parameters and computation on the network, and hence also control
overfitting. Neurons in a fully connected layer have full connections to all activa-
tions in the previous layer, and their activations can be computed with a matrix
multiplication, followed by a bias offset.
It is well-known that CNN shows an extraordinary ability for object recog-
nition [17]. The major difference between object recognition and image anti-
forensics is the signal strength, since anti-forensic image detection, unlike object
recognition, has very insignificant differences compared to the original image.
Thus, some methods should be used during the training process in order to
make CNN work for image anti-forensics. In the following, we will explain why
using this network in anti-forensic classification.

3.1 Convolution

In this paper, we recall the major concepts of CNN, which is a deep learning
network that has proved its efficiency in image classification competitions. The
most important operation of CNN is convolution, which is done between the
input image and a filter. There are many filters in a convolutional layer, and
each one leads to a filtered image. Then the second and third steps are applied,
leading to a new image called feature map. Compare to fully connected layer,
convolutional layer shows much better performance in extracting feature because

Fig. 2. Overall architecture of the proposed method.

 A Multi-purpose Image Counter-anti-forensic Method 7

of parameter sharing. Moreover, parameter sharing can dramatically reduce the

number of parameters which leads to much less training time. Suppose an input
volume had a size of 16×16×20. If the size of receptive field is 3×3, every neuron
in the convolutional layer would have a total of 3 × 3 × 20 = 180 connections
(much less than 16 × 16 × 20 = 5120) to the input volume. Filter size is critical
for the network, and a more suitable receptive filter results in a better extracted
feature. In our experiment, we accept a size of 3 × 3 filter for each receptive
field, which has been proved very efficient in [17], and also shows the satisfied
performance in feature extraction in the anti-forensic classification.
CNN can catch the desired feature (anti-forensic operation) by neural net-
work training. The theoretical basis given as follows. Formally, let I (0) denote
the input image, Fk denote the k th filter from layer l = 1, ..., L with L being the
(1)

number of convolutional layers. A convolution from the first layer with the k th
(l)
field leads to a filtered image, denote Ik which also been called feature maps),
such that:
Ik = I (0) ∗ Fkl
(l)
(1)
Generally, a convolutional layer is made of three steps, i.e. convolution, acti-
vation, and pooling. These three consecutive steps can be summarized by exam-
ining the link from the feature map of one layer to that of its previous layer:
l−1
i=K

Ikl Iil−1 ∗ Fk,i
l
(l)
= pool(f (bk + )) (2)
i=1

(l)
with bk being a scalar used for setting a bias to the convolution, f () being the
activation function applied pixel per pixel to the filtered image, and the pooling,
pool(), which pools a local neighborhood, and K l being the number of filters
the lth layer has. Note that the filter kernel (weights), and the bias have to be
learned and are modified by back-propagation of the error.
Since convolution part shows above and anti-forensic operation can both be
presented through a combination of linear and non-linear function, the proposed
convolutional layer is supposed to be able to extract the anti-forensic feature.
In order to see the feature map actually extract useful feature with increasing
depth of convolutional layers, the feature maps of the proposed CNN network
is displayed in Fig. 3. Figure 3(a)–(d) are the feature maps of an original image
obtained from the convolutional layer 1, 2, 3, and 4 respectively. Figure 3(a) and
(b) have 32 feature maps, (c) and (d) have 40 feature maps. The bright area in
a feature map indicates large weights and vice versa.
The feature maps in Fig. 4 are generated by the 4th convolutional layer with
original and anti-forensic images test in our experiments. 40 feature maps are
included in one subgraph. We can see perceptible difference of units in the same
position of certain feature map between original and anti-forensic images. Median
filtering and JPEG operation will cause the image fuzzy phenomenon, and their
anti-forensics both altered by adding corresponding noises, thus it will make
their images details blurred. As seen in Fig. 4(a)–(c), the features of anti-JPEG
and anti-MF are similar and both fuzzy compared to the original image. Anti-CE
8 J. Yu et al.

Fig. 3. Feature maps of original image (a)–(d) are obtained from the convolutional
layer 1, 2, 3, 4 respectively.

is aimed to falsify the forensics and achieve the effect of contrast enhancement.
There is a sharp contrast in the feature maps of anti-CE image compared to
the original. In the operation of resampling, the image will resize according to
the specified scaling factors. Seen in Fig. 4(e)–(f), the feature of the up-sampling
image is just like an amplifier of the original one, while the down-sampling
feature includes more textures than the original. The analysis above shows that
our network can extract useful and decisive features when dealing the counter-
anti-forensic task during the training process.

3.2 Pooling
Pooling layers in CNN summarize the outputs of previous layers and operates
independently on each depth slice of the input, as well as resizing it spatially.
Pooling layer can not only effectively reduce training complexity by eliminating
parameters, but also play an important role in preventing overfitting. Pooling
layers usually use MAX operation. Normally, the neighborhoods summarized by
adjacent pooling units do not overlap, but when it is applied on image anti-
forensics, it is necessary to preserve the adjacent area for better performance.
Based on our experiment, overlapping max pooling layers reduce the error rate
by 2% or more.

3.3 Activation
The Rectified Linear Units (ReLU) is used in our work due to its fast conver-
gence in large datasets [27]. It also increases the nonlinear properties of the
 A Multi-purpose Image Counter-anti-forensic Method 9

Fig. 4. The feature maps of (a) Original image, (b) Anti-JPEG image, (c) Anti-MF
image, (d) Anti-CE image, (e) Anti-RES image (up-sampling) and (f) Anti-RES image
(down-sampling) from the last convolutional layer respectively.

decision function and the overall network. The convolutional and non-linearity
transformation can be denoted as:
n
xkj = g( xik−1 ∗ wij
k−1
+ bkj ) (3)
i=1

where ‘*’ denotes convolutional operation; xkj is the jth output feature map in
k−1
the kth layer; wij is the weight at layer k − 1, i, j position; bkj is the bias
parameter, and g denotes non-linearity transformation where ReLU has been
used. ReLU, which has been proved to have better convergence properties than
the sigmoid and tanh functions [17], can be expressed as:
g(x) = max(0, x) (4)

3.4 Dropout
The classification layer consists mainly of two parts: the softmax layer and
the fully connected layer. We adopt a widely used technique called dropout to
avoid overfitting, which randomly sets certain output of fully connected layers to
zero with a probability of 0.5. The softmax layer, trained using a cross-entropy
scheme, is used for classification, which is essentially a nonlinear multinomial
logistic regression. Back propagation algorithm is used to fine-tune weights and
biases for training the parameters in the proposed CNN. Consequently, CNN is
able to use the classification result to adjust the extracted features and build a
better learning mechanism for measuring and classifying anti-forensic methods
automatically.
10 J. Yu et al.

3.5 Overall Architecture

Figure 2 is the overall architecture of the proposed CNN model, the net contains
five layers with weights, the first four are convolutional layers and the fifth
is a fully connected layer. Unlike some deep convolutional networks in image
classification, the 5-layer architecture can prevent the diffusion of gradients, and
performs ably in our experiment. The architecture with less layers cannot extract
useful feature base on our experiments. The very small 3 × 3 receptive fields are
used as filters throughout the whole net. The output of the last fully-connected
layer is fed to an n-way softmax, which produces a distribution of n-class labels.

4 Experimental Result
In this section, we first show the network settings of the proposed CNN architec-
ture. Then, the proposed method is tested on detecting six anti-forensic methods
separately in Sect. 4.2. Finally, the detection performance for the multi-class clas-
sification of anti-forensics is given. A total of 10000 original images from BOSS-
base [18] are cropped from the center to a size of 128 × 128 pixels. Without loss
of generality, grayscale images are adopted in all of our experiments. The tam-
pered images are created via different anti-forensics manipulations mentioned in
Sect. 2.

4.1 Network Settings

In our work, we load images of size 128 × 128 as input to the CNN model, and
the first convolutional layer filters the input data with 32 kernels of size 3×3 and
a stride of 1. The second convolutional layer takes the output of the previous
layer as input with 32 kernels of size 3 × 3 and a stride of 1. Subsequently, it
follows a max pooling operation. The third and fourth convolutional layers also
take the output of their respective previous layers as input but with 40 kernels
of size 3 × 3, and a max pooling operation is used in the fourth convolutional
layer, as demonstrated in Fig. 2. Consequently, Fig. 3(a) and (b) have 32 feature
maps, (c) and (d) have 40 feature maps. The ReLU is applied to every output
of the convolutional layers. The fully connected layer has 700 neurons and each
neuron connects to the output layer through a softmax function. In the fully
connected layer, the dropout operation is used to delete the neurons randomly
to prevent the problem of overfitting. In all of the experiments, four-fifths of the
images are used for training and the remainder for testing. All experiments are
repeated 10 times and the average results are reported.

4.2 Binary Classification

In the first part, the proposed method is evaluated on detecting the aforemen-
tioned anti-forensic operations separately. 20000 images are available for each
anti-forensic operation detection, including 10000 original images and 10000 cor-
responding anti-forensically modified images.
 A Multi-purpose Image Counter-anti-forensic Method 11

Table 1. Detection accuracy (%) for original and Anti-JPEG images.

Anti-method Countermeasure
[3] [22] Proposed
Anti-JPEG [2] 80.0 55.78 98.83
Anti-JPEG [4] 58.02 85.87 99.95

4.2.1 Anti-JPEG Detection

The two measured anti-JPEG databases are created as follows: the original
images are first JPEG compressed using a quality factor randomly chosen from
55 to 95 with a step of 10, then modified with corresponding anti-forensics meth-
ods [2,4]. The comparative results are shown in Table 1. Seen from Table 1, the
proposed method attains better detection accuracy, nearly 14% higher than the
two specific counter-anti-forensic methods for comparison. It is also observed
that the detection accuracy of the specific counter-anti-forensic method declined
rapidly when different anti-forensic method is used by the forger. For example,
the detection accuracy of the countermeasure [22] achieves 85.76% when detect
the forgery [4], and it degrades to only 55.78% in detecting the anti-JPEG of
[2]. According to the experiment results, the proposed method operate well with
both the two forged types.

4.2.2 Anti-MF Detection

The original images are first median filtered with a 3 × 3 window and then
modified with the specific anti-forensic methods [14,15] to produce two anti-MF
datasets respectively. From Table 2, it is observed that our proposed method
achieve almost perfect performance against both anti-MF methods, whereas
countermeasure [23] can only detect the case of anti-MF [15]. As mentioned
in Sect. 1, many countermeasures target only one kind of image anti-forensics,
and the result of [23] exemplifies this statement.

4.2.3 Anti-RES Detection

Anti-Res dataset are created by first selecting a scaling factor from 0.6 to 2.0
randomly, then setting the strength of geometric distortion σ = 0.4 to generate
resampling images [6]. Seen in Table 3, the detection accuracy of the proposed

Table 2. Detection accuracy (%) for original and Anti-MF images.

Anti-method Countermeasure
[23] Proposed
Anti-MF [14] - 99.38
Anti-MF [15] 98.45 99.35
12 J. Yu et al.

Table 3. Detection accuracy (%) for original and Anti-RES images.

Anti-method Countermeasure
[24] Proposed
Anti-RES [6] 97.67 99.38

method reaches 99.38%, 1.6% higher than the state-of-art specific countermea-
sure [24].

4.2.4 Anti-CE Detection

Anti-CE dataset are produced by first adding uniform noise and followed by
gamma correction [10]. The performance on anti-CE detection is 92.73% in
our experiments. To our knowledge, no other countermeasure against this anti-
forensics has been proposed.
In conclusion, our proposed method is effective in detecting the aforemen-
tioned anti-forensics according, which demonstrates that the CNN model works
well to detect anti-forensic operations separately.

4.3 Multi-class Classification

In this experiment, the proposed CNN model is used as a multi-classifier. The
results are presented in Table 4. Six kinds of the anti-forensic images mentioned
above are included, and a total of 70000 images are used for training and testing.
Table 4 presents the accurate prediction and error prediction on our test dataset
in one epoch. ‘*’ represents the prediction accuracy below 1%. The horizontal
direction denotes the predicted anti-forensics type, and the vertical direction
denotes the realistic type. Seen from Table 4, the detection accuracies of these six
anti-forensics performs well in the multi-class classification. The total detection
accuracy of the multi-class classification is 96.9%. It is clear that our proposed
model is effective in detecting the multi-class image anti-forensics.

Table 4. Prediction accuracy (%) for classifying multi-class anti-forensic.

Test/prediction Original Anti-JPEG [2] Anti-JPEG [4] Anti-MF [15] Anti-MF [14] Anti-CE Anti-Res
Original 94.15 * * 0 * 2.35 2.5
Anti-JPEG [2] 1.6 97.1 * 0 0 * *
Anti-JPEG [4] 0 * 99.3 * 0 0 *
Anti-MF [15] 0 * * 99.4 * 0 *
Anti-MF [14] * 0 0 0 99.5 * *
Anti-CE 6.05 * * 0 * 91.75 0
Anti-RES * * * * 1 * 97.35

We also test the proposed method when the database is changed. The new
test database is created as follows: we use 1000 original images from UCID with
 A Multi-purpose Image Counter-anti-forensic Method 13

the size of 128 × 128, and create the six corresponding anti-forensic images, 6000
forged images in total. Then we use the model trained with BOSSbase to classify
the database created from UCID. The detection accuracy is 94.7% in this case,
which demonstrates that the proposed method is not strongly related to the
database.

4.4 Practical Cross Database Test

Four different anti-forensic (anti-JPEG [2], anti-MF [15], anti-RES [6], anti-CE
are included) images are used to create 10000 forged images, each type responsi-
ble for 2500. We first train a classifier with 10000 original images from BOSSbase
and the mentioned forged image dataset. Then, we create two test dataset with
the anti-forensic methods (anti-JPEG [4] and anti-MF [14], respectively) that
are not included in the trained dataset. 1000 original images from UCID and
1000 corresponding anti-forensic images are used to create the test dataset. The
accuracy of detecting the forgery of [4] is 98.7%, and the forgery of [14] is 98.65%
respectively, which indicates that the proposed method is able to extend to other
diverse image anti-forensics without much prior information.

5 Conclusion

In this paper, a CNN-based method is proposed for detecting image anti-

forensics, which can automatically extract features and identify various image
anti-forensics. Instead of addressing a certain type of manipulations, it pro-
vides a multi-purpose approach to detect diverse anti-forensically modified
images, which suits numerous scenarios. To the best of our knowledge, it is
the first time that a model for detecting image anti-forensic operations based
on the CNN architecture has been proposed. Experimental results show that
our method achieves satisfactory performance in detecting the six well-known
image anti-forensic methods mentioned above. Compared to some state-of-art
specific counter-anti-forensic methods, the proposed method achieves better per-
formance. In further studies, we will extend our method to more types of anti-
forensic modifications and normal signal processing operations.

References
1. Stamm, M.M.C., Wu, M., Liu, K.J.R.: Information forensics: an overview of the
first decade. In: IEEE Access, vol. 1, pp. 167–200, May 2013
2. Stamm, M.M.C., Tjoa, S.K., Lin, W.S., et al.: Anti-forensics of JPEG compression.
In Proceedings of IEEE International Conference on Acoustics, Speech, and Signal
Processing, pp. 1694–1697, March 2010
3. Valenzise, M.G., Tagliasacchi, M., Tubaro, S.: Revealing the traces of JPEG com-
pression anti-forensics. IEEE Trans. Inf. Forensics Secur. 8(2), 335–349 (2013)
4. Stamm, M.M.C., Liu, K.J.R.: Anti-forensics of digital image compression. IEEE
Trans. Inf. Forensics Secur. 6(3), 1050–1065 (2011)
14 J. Yu et al.

5. Popescu, A.A.C., Farid, H.: Exposing digital forgeries by detecting traces of resam-
pling. IEEE Trans. Signal Process. 53(2), 758–767 (2005)
6. Kirchner, M.M., Böhme, R.: Hiding traces of resampling in digital images. IEEE
Trans. Inf. Forensics Secur. 3(4), 582–592 (2008)
7. Stamm, M.M.C., Liu, K.J.R.: Forensic detection of image manipulation using sta-
tistical intrinsic fingerprints. IEEE Trans. Inf. Forensics Secur. 5(3), 492–506 (2010)
8. Stamm, M.M.C., Liu, K.J.R.: Blind forensics of contrast enhancement in digital
images. In: Proceedings of IEEE International Conference on Image Processing,
San Diego, CA, pp. 3112–3115, October 2008
9. Cao, G.G., Zhao, Y., Ni, R., Tian, H.: Anti-forensics of contrast enhancement in
digital images. In: Proceedings of ACM Workshop Multimedia and Security, pp.
25–34 (2010)
10. Kwok, C.-W., Au, O.C., Chui, S.-H.: Alternative anti-forensics method for con-
trast enhancement. In: Shi, Y.Q., Kim, H.-J., Perez-Gonzalez, F. (eds.) IWDW
2011. LNCS, vol. 7128, pp. 398–410. Springer, Heidelberg (2012). doi:10.1007/
978-3-642-32205-1 32
11. Valenzise, G.G., Tagliasacchi, M., Tubaro, S.: Revealing the traces of JPEG com-
pression anti-forensics. IEEE Trans. Inf. Forensics Secur. 8(2), 335–349 (2013)
12. Yuan, H.H.: Blind forensics of median filtering in digital images. IEEE Trans. Inf.
Forensics Secur. 6(4), 1335–1345 (2011)
13. Kirchner, M.M., Fridrich, J.: On detection of median filtering in digital images. In:
Memon, N.D., Dittmann, J., Alattar, A.M., Delp, E.J. (Eds.) Media Forensics and
Security II, part of the IS&T-SPIE Electronic Imaging Symposium, Proceedings,
vol. 7541 of SPIE Proceedings, San Jose, CA, USA, 18–20 January 2010, p. 754110,
SPIE (2010)
14. Dang-Nguyen, D.D.T., Gebru, I.D., Conotter, V., et al.: Counter-forensics of
median filtering. In: 2013 IEEE 15th International Workshop on Multimedia Signal
Processing (MMSP), pp. 260–265, September 2013
15. Wu, Z.Z.H., Stamm, M.C., Liu, K.J.R.: Anti-forensics of median filtering. In:
Proceedings of IEEE International Conference on Acoustic, Speech, and Signal
Processing, pp. 3043–3047, Vancouver, Canada, May 2013
16. Simonyan, K.K., Zisserman, A.: Very deep convolutional networks for large-scale
image recognition. In: Proceedings of ICLR (2015)
17. Krizhevsky, A.A., Sutskever, I., Hinton, G.: Imagenet classification with deep con-
volutional neural networks. In: Advances in Neural Information Processing Sys-
tems, pp. 1097–1105 (2012)
18. Bas, P., Filler, T., Pevný, T.: “Break our steganographic system”: the ins and
outs of organizing BOSS. In: Filler, T., Pevný, T., Craver, S., Ker, A. (eds.)
IH 2011. LNCS, vol. 6958, pp. 59–70. Springer, Heidelberg (2011). doi:10.1007/
978-3-642-24178-9 5
19. Lecun, Y.Y., BoUou, L., Bengio, Y., Haffner, P.: Gradient-based learning applied
to document recognition. Proc. IEEE 86(11), 2278–2324 (1998)
20. Srivastava, N., et al.: Dropout: a simple way to prevent neural networks from
overfitting. J. Mach. Learn. Res. 15(1), 1929–1958 (2014)
21. Nair, V., Hinton, G.E.: Rectified linear units improve restricted boltzmann
machines. In: Proceedings of the 27th International Conference on Machine Learn-
ing (ICML 2010) (2010)
22. Jiang, Y.Y., Zeng, H., Kang, X., et al.: The game of countering JPEG anti-forensics
based on the noise level estimation. In: Proceedings of the Asian-Pacific Signal and
Information Processing Association Annual Submit Conference (APSIPA ASC)
(2013)
 A Multi-purpose Image Counter-anti-forensic Method 15

23. Zeng, H.H., Qin, T., Kang, X., et al.: Countering anti-forensics of median filtering.
In: Proceedings of the IEEE International Conference on Acoustics, Speech, and
Signal Processing, pp. 2723–2727 (2014)
24. Peng, A.A., Zeng, H., Kang, X., et al.: Countering anti-forensics of image resam-
pling. In: Proceedings of the 2015 IEEE International Conference on Image Process-
ing (ICIP), pp. 3595–3599, September 2015