The Adobe Hidden Feature and its Impact on Sensor Attribution

TL;DR

This paper uncovers a hidden Adobe Lightroom watermark pattern in images that causes sensor fingerprint false positives, and proposes methods to remove it, improving sensor attribution accuracy.

Contribution

It identifies a previously unknown Adobe Lightroom watermark pattern affecting sensor fingerprinting and develops techniques to eliminate it, reducing false positives in forensic analysis.

Findings

Adobe Lightroom embeds a periodic watermark pattern in images.

Removing the watermark reduces false positives in sensor attribution.

The watermark depends on image content and development architecture.

Abstract

If the extraction of sensor fingerprints represents nowadays an important forensic tool for sensor attribution, it has been shown recently that images coming from several sensors were more prone to generate False Positives (FP) by presenting a common "leak". In this paper, we investigate the possible cause of this leak and after inspecting the EXIF metadata of the sources causing FP, we found out that they were related to the Adobe Lightroom or Photoshop softwares. The cross-correlation between residuals on images presenting FP reveals periodic peaks showing the presence of a periodic pattern. By developing our own images with Adobe Lightroom we are able to show that all developments from raw images (or 16 bits per channel coded) to 8 bits-coded images also embed a periodic 128x128 pattern very similar to a watermark. However, we also show that the watermark depends on both the content and the architecture used to develop the image. The rest of the paper presents two different ways of removing this watermark, one by removing it from the image noise component, and the other by removing it in the pixel domain. We show that for a camera presenting FP, we were able to prevent the False Positives. A discussion with Adobe representatives informed us that the company decided to add this pattern in order to induce dithering.