Content Authentication for Neural Imaging Pipelines: End-to-end Optimization of Photo Provenance in Complex Distribution Channels

TL;DR

This paper proposes a neural imaging pipeline that jointly optimizes photo quality and forensic traceability, significantly improving digital photo provenance verification even after heavy post-processing.

Contribution

It introduces an end-to-end neural imaging pipeline that replaces traditional camera internals and is optimized for both high-fidelity image development and reliable forensic analysis.

Findings

Increased manipulation detection accuracy from 45% to over 90%.

Demonstrated the feasibility of joint optimization for image quality and provenance.

Encouraged further research into provenance-guaranteeing imaging pipelines.

Abstract

Forensic analysis of digital photo provenance relies on intrinsic traces left in the photograph at the time of its acquisition. Such analysis becomes unreliable after heavy post-processing, such as down-sampling and re-compression applied upon distribution in the Web. This paper explores end-to-end optimization of the entire image acquisition and distribution workflow to facilitate reliable forensic analysis at the end of the distribution channel. We demonstrate that neural imaging pipelines can be trained to replace the internals of digital cameras, and jointly optimized for high-fidelity photo development and reliable provenance analysis. In our experiments, the proposed approach increased image manipulation detection accuracy from 45% to over 90%. The findings encourage further research towards building more reliable imaging pipelines with explicit provenance-guaranteeing properties.

Figures

Tables

Table 1. Table 1: Digital cameras used in our experiments

Camera	SR1	#Images2	Source	Bayer
Canon EOS 5D	12	864 dng	MIT-5k	RGGB
Canon EOS 40D	10	313 dng	MIT-5k	RGGB
Nikon D5100	16	288 nef	Private	RGGB
Nikon D700	12	590 dng	MIT-5k	RGGB
Nikon D7000	16	$>$1k nef	Raise	RGGB
Nikon D750	24	312 nef	Private	RGGB
Nikon D810	36	205 nef	Private	RGGB
Nikon D90	12	$>$1k nef	Raise	GBRG
1 Sensor Resolution in Megapixels [Mpx]
2 RAW file formats: nef (Nikon); dng (generic, Adobe)

Table 2. Table 2: Considered neural imaging pipelines

	INet	UNet	DNet
# Parameters	321	7,760,268	493,976
PSNR	42.8	44.3	46.2
SSIM	0.989	0.990	0.995
Train. speed [it/s]	8.80	1.75	0.66
Train. time	17 - 26 min	2-4 h	12 - 22 h

Table 3. Table 3: Typical confusion matrices (Nikon D90). Entries ≈ 0 absent 0 \approx{}0 are not shown; entries ⪅ 3 % absent percent 3 \lessapprox 3\% are marked with (*).

(a) standalone FAN optimization (UNet) $\to$ 44.2%
	nat.	sha.	gau.	jpg	res.
native	27	24	18	20	11
sharpen	*	93	3	*	*
gaussian	7	4	59	12	18
jpg	26	23	18	21	12
resample	14	7	38	20	21
(b) joint FAN+NIP optimization (INet) $\to$ 55.2%
	nat.	sha.	gau.	jpg	res.
native	41	16	22	18	4
sharpen	7	85	3	4	*
gaussian	18	8	54	10	10
jpg	41	16	21	19	4
resample	5	*	14	*	77
(c) joint FAN+NIP optimization (UNet) $\to$ 94.0%
	nat.	sha.	gau.	jpg	res.
native	90		*	9
sharpen		100
gaussian			97	*	*
jpg	13		3	84
resample			*		99

Table 4. Table 4: Fidelity-accuracy trade-off for joint optimization.

Camera	PSNR [dB]	SSIM	Acc. [%]
	UNet model
D90	42.7 $\to$ 35.9	0.990 $\to$ 0.960	0.45 $\to$ 0.91
D7000	43.0 $\to$ 35.6	0.990 $\to$ 0.955	0.42 $\to$ 0.91
EOS 40D	42.8 $\to$ 36.1	0.990 $\to$ 0.962	0.39 $\to$ 0.92
EOS 5D	43.0 $\to$ 36.2	0.989 $\to$ 0.961	0.45 $\to$ 0.89
	INet model
D90	43.3 $\to$ 37.2	0.992 $\to$ 0.969	0.44 $\to$ 0.55
D7000	40.6 $\to$ 35.4	0.985 $\to$ 0.959	0.43 $\to$ 0.53
EOS 40D	41.6 $\to$ 33.1	0.985 $\to$ 0.934	0.38 $\to$ 0.50
EOS 5D	41.5 $\to$ 40.7	0.986 $\to$ 0.984	0.42 $\to$ 0.42

Equations

$${\theta }_{\text{nip}}^{\ast }$$

$$\displaystyle+\sum_{c}\text{log}\big{(}\text{fan}_{c}(d_{c}(\text{nip}(x_{n}~{}|~{}\theta_{\text{nip}}))~{}|~{}\theta_{\text{fan}})\big{)}\Big{)}$$

$$\theta_{\text{fan}}^{*}=\underset{\theta_{\text{fan}}}{\operatorname{argmin}}~{}\sum_{n}\sum_{c}\text{log}\big{(}\text{fan}_{c}(d_{c}(\text{nip}(x_{n}~{}|~{}\theta_{\text{nip}}))~{}|~{}\theta_{\text{fan}})\big{)}$$

$$\rho (x)=x-\frac{\text{sin}(2\pi x)}{2\pi }$$

$$\frac{1}{6}\left[\begin{array}{ccc}-1& -4& -1\\ -4& 26& -4\\ -1& -4& -1\end{array}\right]$$

Full text

1 Introduction

Ensuring integrity of digital images is one of the most challenging and important problems in multimedia communications. Photographs and videos are commonly used for documentation of important events, and as such, require efficient and reliable authentication protocols. Our current media acquisition and distribution workflows are built with entertainment in mind, and not only fail to provide explicit security features, but actually work against them. Image compression standards exploit heavy redundancy of visual signals to reduce communication payload, but optimize for human perception alone. Security extensions of popular standards lack in adoption [20].

Two general approaches to assurance and verification of digital image integrity include [24, 30, 32]: (1) pro-active protection methods based on digital signatures or watermarking; (2) passive forensic analysis which exploits inherent statistical properties resulting from the photo acquisition pipeline. While the former provides superior performance and allows for advanced protection features (like precise tampering localization [38], or reconstruction of tampered content [25]), it failed to gain widespread adoption due to the necessity to generate protected versions of the photographs, and the lack of incentives for camera vendors to modify camera design to integrate such features [4].

Passive forensics, on the other hand, relies on our knowledge of the photo acquisition pipeline, and statistical artifacts introduced by its successive steps. While this approach is well suited for potentially analyzing any digital photograph, it often falls short due to the complex nature of image post-processing and distribution channels. Digital images are not only heavily compressed, but also enhanced or even manipulated before, during or after dissemination. Popular images have many online incarnations, and tracing their distribution and evolution has spawned a new field of image phylogeny [13, 14] which relies on visual differences between multiple images to infer their relationships and editing history. However, phylogeny does not provide any tools to reason about the authenticity or history of individual images. Hence, reliable authentication of real-world online images remains untractable [39].

At the moment, forensic analysis often yields useful results in near-acquisition scenarios. Analysis of native images straight from the camera is more reliable, and even seemingly benign implementation details - like the rounding operators used in the camera’s image signal processor [1] - can provide useful clues. Most forensic traces quickly become unreliable as the image undergoes further post-processing. One of the most reliable tools at our disposal involves analysis of the imaging sensor’s artifacts (the photo response non-uniformity pattern) which can be used both for source attribution and content authentication problems [10].

In the near future, rapid progress in computational imaging will challenge digital image forensics even in near-acquisition authentication. In the pursuit of better image quality and convenience, digital cameras and smartphones employ sophisticated post-processing directly in the camera, and soon few photographs will resemble the original images captured by the sensor(s). Adoption of machine learning has recently challenged many long-standing limitations of digital photography, including: (1) high-quality low-light photography [9]; (2) single-shot HDR with overexposed content recovery [15]; (3) practical high-quality digital zoom from multiple shots [37]; (4) quality enhancement of smartphone-captured images with weak supervision from DSLR photos [18].

These remarkable results demonstrate tangible benefits of replacing the entire acquisition pipeline with neural networks. As a result, it will be necessary to investigate the impact of the emerging neural imaging pipelines on existing forensics protocols. While important, such evaluation can be seen rather as damage assessment and control and not as a solution for the future. We believe it is imperative to consider novel possibilities for security-oriented design of our cameras and multimedia dissemination channels.

In this paper, we propose to optimize neural imaging pipelines to improve photo provenance in complex distribution channels. We exploit end-to-end optimization of the entire photo acquisition and distribution channel to ensure that reliable forensics decisions can be made even after complex post-processing, where classical forensics fails (Fig. 1). We believe that imminent revolution in camera design creates a unique opportunity to address some of the long-standing limitations of the current technology. While adoption of digital watermarking in image authentication was limited by the necessity to modify camera hardware, our approach exploits the flexibility of neural networks to learn relevant integrity-preserving features within the expressive power of the model. We believe that with solid security-oriented understanding of neural imaging pipelines, and with the rare opportunity of replacing the well-established and security-oblivious pipeline, we can significantly improve digital image authentication capabilities.

We aim to inspire discussion about novel camera designs that could improve photo provenance analysis capabilities. We demonstrate that it is possible to optimize an imaging pipeline to significantly improve detection of photo manipulation at the end of a complex real-world distribution channel, where state-of-the-art deep-learning techniques fail. The main contributions of our work include:

The first end-to-end optimization of the imaging pipeline with explicit photo provenance objectives; 2. 2.

The first security-oriented discussion of neural imaging pipelines and the inherent trade-offs; 3. 3.

Significant improvement of forensic analysis performance in challenging, heavily post-processed conditions; 4. 4.

A neural model of the entire photo acquisition and distribution channel with a fully differentiable approximation of the JPEG codec.

To facilitate further research in this direction, and enable reproduction of our results, our neural imaging toolbox is available at https://github.com/pkorus/neural-imaging.

2 Related Work

Trends in Pipeline Design

Learning individual steps of the imaging pipeline (e.g., demosaicing) has a long history [21] but regained momentum in the recent years thanks to adoption of deep learning. Naturally, the research focused on the most difficult operations, i.e., demosaicing [17, 35, 23, 34] and denoising [6, 40, 26]. Newly developed techniques delivered not only improved performance, but also additional features. Gharbi et al. proposed a convolutional neural network (CNN) trained for joint demosaicing and denoising [17]. A recent work by Syu et al. proposes to exploit CNNs for joint optimization of the color filter array and a corresponding demosaicing filter [34].

Optimization of digital camera design can go even further. The recently proposed L3 model by Jiang et al. replaces the entire imaging pipeline with a large collection of local linear filters [19]. The L3 model reproduces the entire photo development process, and aims to facilitate research and development efforts for non-standard camera designs. In the original paper, the model was used for learning imaging pipelines for RGBW (red-green-blue-white) and RGB-NIR (red-green-blue-near-infra-red) color filter arrays.

Replacing the entire imaging pipeline with a modern CNN can also overcome long-standing limitations of digital photography. Chen et al. trained a UNet model [31] to develop high-quality photographs in low-light conditions [9] by exposing it to paired examples of images taken with short and long exposure. The network learned to develop high-quality well-exposed color photographs from underexposed raw input, and yielded better performance than traditional image post-processing based on brightness adjustment and denoising. Eilertsen et al. also trained a UNet model to develop high-dynamic range images from a single shot [15]. The network not only learned to correctly perform tone mapping, but was also able to recover overexposed highlights. This significantly simplifies HDR photography by eliminating the need for bracketing and dealing with ghosting artifacts.

Trends in Forensics

The current research in forensic image analysis focuses on two main directions: (1) learning deep features relevant to low-level forensic analysis for problems like manipulation detection [3, 41], identification of the social network of origin [2], camera model identification [11], or detection of artificially generated content [27]; (2) adoption of high-level vision to automate manual analysis that exposes physical inconsistencies, such as reflections [33, 36], or shadows [22]. To the best of our knowledge, there are currently no efforts to either assess the consequences of the emerging neural imaging pipelines, or to exploit this opportunity to improve photo reliability.

3 End-to-end Optimization of Photo Provenance Analysis

Digital image forensics relies on intrinsic statistical artifacts introduced to photographs at the time of their acquisition. Such traces are later used for reasoning about the source, authenticity and processing history of individual photographs. The main problem is that contemporary media distribution channels employ heavy compression and post-processing which destroy the traces and inhibit forensic analysis.

The core of the proposed approach is to model the entire acquisition and distribution channel, and optimize the neural imaging pipeline (NIP) to facilitate photo provenance analysis after content distribution (Fig. 1). The analysis is performed by a forensic analysis network (FAN) which makes a decision about the authenticity/processing history of the analyzed photograph. In the presented example, the model is trained to perform manipulation detection, i.e., aims to classify input images as either coming straight from the camera, or as being affected by a certain class of post-processing. The distribution channel mimics the behavior of modern photo sharing services and social networks which habitually down-sample and re-compress the photographs. As will be demonstrated later, forensic analysis in such conditions is severely inhibited.

The parameters of the NIP are updated to guarantee both faithful representation of a desired color photograph ($L_{2}$ loss), and accurate decisions of forensics analysis at the end of the distribution channel (cross-entropy loss). Hence, the parameters of the NIP and FAN models are chosen as:

[TABLE]

[TABLE]

where: $\theta_{\text{nip/fan}}$ are the parameters of the NIP and FAN networks, respectively; $x_{n}$ are the raw sensor measurements for the $n$-th example patch; $y_{n}$ is the corresponding target color image; $\text{nip}(x_{n})$ is the color RGB image developed by NIP from $x_{n}$; $d_{c}()$ denotes a color image patch processed by manipulation $c$; $\text{fan}_{c}()$ is the probability that an image belongs to the $c$-th manipulation class, as estimated by the FAN model.

3.1 The Neural Imaging Pipeline

We replace the entire imaging pipeline with a CNN which develops raw sensor measurements into color RGB images (Fig. 2). Before feeding the images to the network, we pre-process them by reversing the nonlinear value mapping according to the camera’s LUT, subtracting black levels from the edge of the sensor, normalizing by sensor saturation values, and applying white-balancing according to shot settings. We also standardized the inputs by reshaping the tensors to have feature maps with successive measured color channels. This ensures a well-formed input of shape ($\frac{h}{2},\frac{w}{2},4$) with values normalized to [0, 1]. All of the remaining steps of the pipeline are replaced by a NIP. See Section 4.1 for details on the considered pipelines.

3.2 Approximation of JPEG Compression

To enable end-to-end optimization of the entire acquisition and distribution channel, we need to ensure that every processing step remains differentiable. In the considered scenario, the main problem is JPEG compression. We designed a dJPEG model which approximates the standard codec, and expresses its successive steps as matrix multiplications or convolution layers that can be implemented in TensorFlow (see supplementary materials for a detailed network definition):

• •

RGB to/from YCbCr color-space conversions are implemented as $1\times 1$ convolutions.

• •

Isolation of $8\times 8$ blocks for independent processing is implemented by a combination of space-to-depth and reshaping operations.

• •

Forward/backward 2D discrete cosine transforms are implemented by matrix multiplication according to $DxD^{T}$ where $x$ denotes a $8\times 8$ input, and $D$ denotes the transformation matrix.

• •

Division/multiplication of DCT coefficients by the corresponding quantization steps are implemented as element-wise operations with properly tiled and concatenated quantization matrices (for both the luminance and chrominance channels).

• •

The actual quantization is approximated by a continuous function $\rho(x)$(see details below).

The key problem in making JPEG differentiable lies in the rounding of DCT coefficients. We considered two approximations (Fig. 3a). Initially, we used a Taylor series expansion, which can be made arbitrarily accurate by including more terms. Finally, we used a smoother, and simpler sinusoidal approximation obtained by matching its phase with the sawtooth function:

[TABLE]

We validated our dJPEG model by comparing produced images with a reference codec from libJPEG. The results are shown in Fig. 3bcd for a standard rounding operation, and the two approximations, respectively. We used 5 terms for the harmonic rounding. The developed module produces equivalent compression results with standard rounding, and a good approximation for its differentiable variants. Fig. 3e-h show a visual comparison of an example image patch, and its libJPEG and dJPEG-compressed counterparts.

In our distribution channel, we used quality level 50.

3.3 The Forensic Analysis Network

The forensic analysis network (FAN) is implemented as a CNN following the most recent recommendations on construction of neural networks for forensics analysis [3]. Bayar and Stamm proposed a new layer type, which constrains the learned filters to be valid residual filters [3]. Adoption of the layer helps ignore visual content and facilitates extraction of forensically-relevant low-level features. In summary, our network operates on $128\times 128\times 3$ patches in the RGB color space and includes (see supplement for full network definition):

• •

A constrained convolutions layer learning $5\times 5$ residual filters and with no activation function.

• •

Four $5\times 5$ convolutional layers with doubling number of output feature maps (starting from 32). The layers use leaky ReLU activation and are followed by $2\times 2$ max pooling.

• •

A $1\times 1$ convolutional layer mapping 256 features into 256 features.

• •

A global average pooling layer reducing the number of features to 256.

• •

Two fully connected layers with 512 and 128 nodes activated by leaky ReLU.

• •

A fully connected layer with $N=5$ output nodes and softmax activation.

The network has 1,341,990 parameters in total, and outputs probabilities of 5 possible processing histories (4 manipulation classes & straight from camera).

4 Experimental Evaluation

We started our evaluation by using several NIP models to reproduce the output of a standard imaging pipeline (Sec. 4.1). Then, we used the FAN model to detect popular image manipulations (Sec. 4.2). Initially, we validated that the models work correctly by using it without a distribution channel (Sec. 4.3). Finally, we performed extensive evaluation of the entire acquisition and distribution network (Sec. 4.4).

We collected a data-set with RAW images from 8 cameras (Table 1). The photographs come from two public (Raise [12] and MIT-5k [7]) and from one private data-set. For each camera, we randomly selected 150 images with landscape orientation. These images will later be divided into separate training/validation sets.

4.1 Neural Imaging Pipelines

We considered three NIP models with various complexity and design principles (Table 2): INet - a simple convolutional network with layers corresponding to successive steps of the standard pipeline; UNet - the well-known UNet architecture [31] adapted from [9]; DNet - adaptation of the model originally used for joint demosaicing and denoising [17]. Details of the networks’ architectures are included in the supplement.

We trained a separate model for each camera. For training, we used 120 full-resolution images. In each iteration, we extracted random $128\times 128$ patches and formed a batch with 20 examples (one patch per image). For validation, we used a fixed set of $512\times 512$ px patches extracted from the remaining 30 images. The models were trained to reproduce the output of a standard imaging pipeline. We used our own implementation based on Python and rawkit [8] wrappers over libRAW [28]. Demosaicing was performed using an adaptive algorithm by Menon et al. [29].

All NIPs successfully reproduced target images with high fidelity. The resulting color photographs are visually indistinguishable from the targets. Objective fidelity measurements for the validation set are collected in Table 2 (average for all 8 cameras). Interestingly, the trained models often revealed better denoising and demosaicing performance, despite the lack of a denoising step in the simulated pipeline, and the lack of explicit optimization objectives (see Fig. 4).

Of all of the considered models, INet was the easiest to train - not only due to its simplicity, but also because it could be initialized with meaningful parameters that already produced valid results and only needed fine-tuning. We initialized the demosaicing filters with bilinear interpolation, color space conversion with a known multiplication matrix, and gamma correction with a toy model separately trained to reproduce this non-linearity. The UNet model was initialized randomly, but improved rapidly thanks to skip connections. The DNet model took the longest and for a long time had problems with faithful color rendering. The typical training times are reported in Table 2. The measurements were collected on a Nvidia Tesla K80 GPU. The models were trained until the relative change of the average validation loss for the last 5 dropped below $10^{-4}$. The maximum number of epochs was 50,000. For the DNet model we adjusted the stopping criterion to $10^{-5}$ since the training progress was slow, and often terminated prematurely with incorrect color rendering.

4.2 Image Manipulation

Our experiment mirrors the standard setup for image manipulation detection [16, 3, 5]. The FAN simply decides which manipulation class the input patch belongs to. This approximates identification of the last post-processing step, which is often used to mask traces of more invasive modifications.

We consider four mild post-processing operations: sharpening - implemented as an unsharp mask operator with the following kernel:

[TABLE]

applied to the luminance channel in the HSV color space; resampling - implemented as successive 1:2 down-sampling and 2:1 up-sampling using bilinear interpolation; Gaussian filtering - implemented using a convolutional layer with a $5\times 5$ filter and standard deviation 0.83; JPG compression - implemented using the dJPEG module with sinusoidal rounding approximation and quality level 80. Fig. 5 shows the post-processed variants of an example image patch: (a) just after manipulation; and (b) after the distribution channel (as seen by the FAN module).

4.3 FAN Model Validation

To validate our FAN model, we initially implemented a simple experiment, where analysis is performed just after image manipulation (no distribution channel distortion, as in [3]). We used the UNet model to develop smaller image patches to guarantee the same size of the inputs for the FAN model ($128\times 128\times 3$ RGB images). In such conditions, the model works just as expected, and yields classification accuracy of 99% [3].

4.4 Imaging Pipeline Optimization

In this experiment, we perform forensic analysis at the end of the distribution channel. We consider two optimization modes: (F) only the FAN network is optimized given a fixed NIP model; (F+N) both the FAN and NIP models are optimized jointly. In both cases, the NIPs are pre-initialized with previously trained models (Section 4.1). The training was implemented with two separate Adam optimizers, where the first one updates the FAN (and in the F+N mode also the NIP) and the second one updates the NIP based on the image fidelity objective.

Similarly to previous experiments, we used 120 full-resolution images for training, and the remaining 30 images for validation. From training images, in each iteration we randomly extract new patches. The validation set is fixed at the beginning and includes 100 random patches per each image (3,000 patches in total) for classification accuracy assessment. To speed-up image fidelity evaluation, we used 2 patches per image (60 patches in total). In order to prevent over-representation of empty patches, we bias the selection by outward rejection of patches with pixel variance $<$ 0.01, and by 50% chance of keeping patches with variance $<$ 0.02. More diverse patches are always accepted.

Due to computational constraints, we performed the experiment for 4 cameras (Canon EOS 40D and EOS 5D, and Nikon D7000, and D90, see Table 1) and for the INet and UNet models only. (Based on preliminary experiments, we excluded the DNet model which rapidly lost and could not regain image representation fidelity.) We ran the optimization for 1,000 epochs, starting with a learning rate of $10^{-4}$ and systematically decreasing by 15% every 100 epochs. Each run was repeated 10 times. The typical progression of validation metrics for the UNet model (classification accuracy and distortion PSNR) is shown in Fig. 6 (sampled every 50 epochs). The distribution channel significantly disrupts forensic analysis, and the classification accuracy drops to $\approx 45\%$ for standalone FAN optimization (F). In particular, the FAN struggles to identify three low-pass filtering operations (Gaussain filtering, JPEG compression, and re-sampling; see confusion matrix in Tab. 3a), which bear strong visual resemblance at the end of the distribution channel (Fig. 5b). Optimization of the imaging pipeline significantly increases classification accuracy (over 90%) and makes the manipulation paths easily distinguishable (Tab. 3c). Most mistakes involve the native and jpeg compressed classes. Fig. 7 collects the obtained results for both the UNet and INet models. While UNet delivers consistent and significant benefits, INet is much simpler and yields only modest improvements in accuracy - up to $\approx{}55\%$. It also lacked consistency and for one of the tested cameras yielded virtually no benefits.

The observed improvement in forensic accuracy comes at the cost of image distortion, and leads to artifacts in the developed photographs. In our experiments, photo development fidelity dropped to $\approx$36 dB (PSNR) / 0.96 (SSIM). Detailed results are collected in Tab. 4. The severity of the distortions varied with training repetitions. Qualitative illustration of the observed artifacts is shown in Fig. 8. The figure shows diverse image patches developed by several NIP variants (different training runs). The artifacts vary in severity from disturbing to imperceptible, and tend to be well masked by image content. INet’s artifacts tend to be less perceptible, which compensates for modest improvements in FAN’s classification accuracy.

5 Discussion and Future Work

We replaced the photo acquisition pipeline with a CNN, and developed a fully-differentiable model of the entire acquisition and distribution workflow. This allows for joint optimization of photo analysis and acquisition. Our results show that it is possible to optimize the imaging pipeline to facilitate provenance analysis at the end of complex distribution channels. We observed significant improvements in manipulation detection accuracy w.r.t state-of-the-art classical forensics [3] (increase from $\approx{}45\%$ to over 90%).

Competing optimization objectives lead to imaging artifacts which tend to be well masked in textured areas, but are currently too visible in flat regions. Severity of the artifacts varies between training runs and NIP architectures, and suggests that better configurations should be achievable by learning to control the fidelity-accuracy trade-off. Since final decisions are often taken by pooling predictions for many patches, we believe a good balance should be achievable even with relatively simple models. Further improvements may also possible by exploring different NIP architectures, or explicitly modeling HVS characteristics. Future work should also assess generalization capabilities to other manipulations, and more complex forensic problems. It may also be interesting to optimize other components of the workflow, e.g., the lossy compression in the channel.