A leak in PRNU based source identification. Questioning fingerprint uniqueness

TL;DR

This study questions the reliability of PRNU-based source identification for recent smartphones and cameras, revealing widespread issues with fingerprint uniqueness due to device processing, which impacts forensic applications.

Contribution

The paper provides extensive empirical evidence that PRNU fingerprint uniqueness is compromised in recent devices, challenging its effectiveness for source attribution.

Findings

Most recent devices show high false alarm rates in PRNU-based identification.

Device processing and artifacts reduce PRNU fingerprint distinctiveness.

The issue is widespread across multiple brands and models.

Abstract

Photo Response Non-Uniformity (PRNU) is considered the most effective trace for the image source attribution task. Its uniqueness ensures that the sensor pattern noises extracted from different cameras are strongly uncorrelated, even when they belong to the same camera model. However, with the advent of computational photography, most recent devices heavily process the acquired pixels, possibly introducing non-unique artifacts that may reduce PRNU noise's distinctiveness, especially when several exemplars of the same device model are involved in the analysis. Considering that PRNU is an image forensic technology that finds actual and wide use by law enforcement agencies worldwide, it is essential to keep validating such technology on recent devices as they appear. In this paper, we perform an extensive testing campaign on over 33.000 Flickr images belonging to 45 smartphone and 25 DSLR camera models released recently to determine how widespread the issue is and which is the plausible cause. Experiments highlight that most brands, like Samsung, Huawei, Canon, Nikon, Fujifilm, Sigma, and Leica, are strongly affected by this issue. We show that the primary cause of high false alarm rates cannot be directly related to specific camera models, firmware, nor image contents. It is evident that the effectiveness of \prnu based source identification on the most recent devices must be reconsidered in light of these results. Therefore, this paper is intended as a call to action for the scientific community rather than a complete treatment of the subject. Moreover, we believe publishing these data is important to raise awareness about a possible issue with PRNU reliability in the law enforcement world.