Detecting Video Forgeries

Researchers can already detect sophisticated tampering in still images, but they are only beginning to tackle the same problem in video.

Some of the early video-forensics efforts are coming out of Dartmouth College, where Hany Farid, professor of computer science, and researcher Weihong Wang have illustrated a method for detecting if a high-quality video has been re-saved–a telltale sign that someone has tampered with the original file.

While Farid’s technique would not work well with low-quality YouTube videos, he says, it is well suited for high-quality video such as that from surveillance cameras. “The tools are becoming increasingly more sophisticated for manipulating video and audio,” Farid says. “We may as well get a jump on it.”

The researchers’ antiforgery tool uses mathematical tricks that exploit the predictable way in which videos are compressed into standard MPEG files. Video compression works on the assumption that there isn’t much movement between a series of video frames, hence keeping every frame isn’t necessary. But the information about the movement is still maintained: the compression algorithm looks at an initial frame and a second frame, and it extracts numbers that represent the motion difference between them. The numbers describe how to regenerate the second frame from the first frame, Farid says, and can be saved without taking up as much storage space as the second frame would. This process is repeated for subsequent frames. As it extends further from the initial high-quality frame, however, more error is introduced. Therefore, Farid says, every twelfth frame of an MPEG video is a high-quality still image that starts the process anew.

Farid says that the high-quality image that appears every twelfth frame is nothing more than a JPEG, an image format that, as he and his team have previously shown, is sensitive to being compressed multiple times. “Imagine you take a video sequence, tamper with it, and re-save it,” he says. “Now you have this double JPEG compression.” Compressing the images twice, Farid says, introduces a statistical signature that is revealed when the video is analyzed with signal-processing software. Detecting the recompression signature of the JPEG within a video proves that the file has been re-saved at least once, indicating tampering.

Farid’s forgery test also examines another aspect of the MPEG compression: the error that’s introduced when motion between frames is estimated. “The motion error turns out to be very valuable to us,” he says. Between each frame of an MPEG file is a predictable type of motion error, but when frames are removed, this alters the error in a noticeable way. The combination of this error detection and the JPEG compression test is “very good at detecting when you delete a handful of frames,” says Farid.

“I think it’s a very interesting approach,” says Edward Delp, professor of electrical and computer engineering at Purdue University, in Lafayette, Indiana. The technique is an extension of the earlier image-forensics work out of Farid’s lab, he says.

“You’re going to see more and more in the future because it’s so easy for people to acquire and process the videos,” Delp says. The legal implications are important, especially in the case of surveillance video, from which a couple of frames featuring a person walking by could easily be removed. “The question going into court is, How do you prove that it’s really the video that came out of the camera?” he says. “And we’re going to need more tools to decide if [the video] has been tampered with and if it’s authentic.”

Farid’s team is collaborating with Adobe, maker of the video-editing software Premier, to get a better understanding of how the company’s editing tools might be reverse engineered.

The Dartmouth approach isn’t foolproof for high-quality videos, however. Deleting frames in multiples of twelve can trick the system. “You can get around it–no doubt about it,” Farid says. This is why he and his team are developing a suite of tools to detect tampering that use differing techniques, which aren’t sensitive to the quirks of MPEG compression. “As with the image forensics, we expect each technique can be circumvented, but circumventing a larger set of tools will become increasingly more difficult,” he adds. The current work, says Farid, is a good starting point, though, and the method will still be useful as an initial test to determine if videos have been doctored by unsavvy editors.