Forgery localization in images based on joint statistics of image blocks with neighbouring blocks

Flawless image forensic analysis necessitates precise identiﬁcation of tampering regions in digital images along with the determination of state of an image (original or forged). Most of the efforts towards localization of forgeries involve localization of information-changing forgeries with less focus towards localization of information-preserving forgeries. This paper proposes a new information-preserving forgery localization method to localize 10 different tampering types exploiting the fact that joint statistics of locally forged regions and neighbouring original regions is disturbed. The proposed 18-dimensional detector is trained using ensemble classiﬁer for ﬁne-grain identiﬁcation of forged regions in post-JPEG compressed images and results are compared with two recent state-of-the-art detectors. The results demonstrate the effectiveness of the proposed detector with signiﬁcant performance gain over existing detectors, particularly for localization in images that are compressed with low quality factors of compression.


INTRODUCTION
With high vulnerability of digital images to be doctored, various image forensic methods are developed in last decade to examine the authenticity of digital images in a passive way. Since, the doctored images are created using various manipulation types, researchers aim to develop forensic methods to uncover different information-changing and information-preserving manipulations. Information-changing manipulations include the forgery types that modify information associated with the original images, for example copy-move forgery and splicing.
On the other hand, information-preserving manipulations do not visually alter images, but are used to destroy the identifiable fingerprints of underlying information-changing manipulations to deceive existing forensic methods. Additionally, such manipulations can be used to create more realistic forged images. In prior works, information-preserving manipulations are used as anti-forensic methods for underlying tampering types [1,2]. Commonly used information-preserving manipulations include image filtering, noise addition and JPEG compression.
In recent years, various forensic methods have been developed for detection of both information-changing and This is an open access article under the terms of the Creative Commons Attribution License, which permits use, distribution and reproduction in any medium, provided the original work is properly cited. © 2021 The Authors. IET Image Processing published by John Wiley & Sons Ltd on behalf of The Institution of Engineering and Technology information-preserving manipulation types, that is copy-move forgery [3], splicing [4], median filtering [5][6][7][8][9], JPEG compression [10], contrast enhancement [11,12] and re-sampling [13]. Such methods are known as dedicated forensic methods that can be used to detect particular forgery types. However, generation of visually realistic forged images persuade the forgers to use a sequence of image processing operations. A dedicated forensic method designed to detect a specific forgery type may not be able to disclose the processing steps of a targeted image. Additionally, in the blind image authentication scenario, it is difficult to identify the suitable use cases of dedicated detectors. Therefore, in order to overcome the limitations of dedicated forensic methods, the focus has been shifted towards the development of generalized image forensic methods [14][15][16][17][18][19][20][21][22] to deal with multiple image processing operations.
Typically, practical forensic scenarios encounter doctored images that are created to incorrectly communicate the information associated with the images. As a general practice, the development of such images uses a careful mix of locally applied (forgeries applied to specific regions in images) informationchanging and information-preserving forgeries. For example, a part of an image can be re-scaled and pasted onto another image to create a spliced image. In this case, information-preserving manipulation (re-scaling) is used to make a convincing match between the size of the object being copied from an image and the image to which it is pasted. The semantics and forgery locations in such forged images can be determined by classifying small regions of an image as pristine or tampered. Postprocessing operations, image spatial domain filtering methods, resizing, rotation and JPEG compression and so forth, are aimed to disguise most obvious artefacts of copy-move and splicing forgeries. In practice, forgeries are applied only in particular regions of an image rather than tampering the complete image. In literature, such forgery is called local forgery in images. Based on the above facts, the importance of general-purpose image forensics and tampering localization in the field of image forensics can be understood.
We are interested in exposing the forged regions of images, tampered with various information-preserving manipulation types. The binary classification label is generated for each nonoverlapping image block to localize the forged region. A novel detector of 18 dimensions, based on relative statistics of an image block with its neighbouring blocks, is proposed for classification of image blocks. Unlike state-of-the-art detectors, the proposed work is employing the joint statistics of image neighbouring blocks for the first time to design a localization detector. However, existing detectors have used the statistics of independent image blocks for forgery localization. The proposed detector is used to localize 10 different information-preserving operations in images. These 10 manipulation types include average filtering, median filtering, contrast enhancement, Gaussian filtering, Wiener filtering, JPEG compression, JPEG 2000 compression, re-scaling, white noise addition and unsharp masking. The main contributions of proposed work as compared to stateof-the-art methods are: (1) development of general-purpose localization detector that can identify 10 different tampering operation types using a single framework, (2) identification of location of forged regions in images when forgery artefacts are manipulated using post-JPEG compression and (3) relatively smaller feature set dimensions (18-dimensions) than state-of-the-art general-purpose detectors [21,22].
The rest of the paper is structured as follows. In Section 2, related work done in the field of general-purpose image forensics is discussed. Section 3 describes the motivation for the proposed work and relative statistics of image blocks with neighbouring blocks. Section 4 discusses the novel feature set followed by feature set analysis in Section 5. The databases and the experimental method are discussed in Section 6. Results are discussed in Sections 7 and Section 8 concludes the work.

LITERATURE REVIEW
Ineffectiveness of dedicated image forensics for blind image verification motivated the researchers to develop general-purpose image forensics. Additionally, localization of informationpreserving forgeries in images unfolds the suspected image regions. In recent years, the field of general-purpose image forensics has emerged to develop forensic methods for both full sized images and small patches in an image. In [14], a manipulation detection framework for image patches of size 512 × 512 is developed by fusing multiple image forensic detectors into an ensemble detector. The multiple forensic detectors are developed by analyzing the derivative correlation features (1536 dimensions) introduced by de-mosaicing algorithm. The detector is able to localize 13 different manipulation types in high resolution images with low probability of error. However, localization performance of the detector for small sized (down to 32 × 32) image patches and for post-JPEG compressed images has not been analyzed. Another general-purpose detector [15] is developed by extracting residual domain image blocks and computing co-occurrence histograms of quantized image residual blocks. Although, the detector can effectively localize four image processing operations in uncompressed images for image block size 128 × 128 but localization performance in compressed images has not been analyzed. Further, in [16], a general-purpose detector is designed using already defined steganalysis based feature sets, subtractive pixel adjacency matrix (SPAM) [23], spatial rich model (SRM) [24] and local binary patterns (LBP) [25]. However, high dimensionality of feature sets SPAM (686-dimensions), SRM (34671dimensions) and LBP (22, 153-dimensions) make simulation of feature sets computationally demanding. The selected features are employed for identification of five different image processing operations. The method does not address the problem of manipulation localization in images. In another work [17], Gaussian mixture model (GMM), corresponding to each of six different manipulation types, is learned for image patches of small resolution (16 × 16) and binary classification results are generated by comparing the average log-likelihood values of original and processed image patches. Although, the method is robust for tampering localization in uncompressed images, but the method does not address the problem in post-JPEG compressed images.
Recently, in [18], the residual-based local features are recasted in form of convolutional neural network (CNN). Here, CNN is utilized to expose five different information-preserving manipulation types in image patches of resolution 128 × 128. Although, the method achieves good localization accuracies in uncompressed images, the problem of forgery localization in post-JPEG compressed images has not been addressed. In another recent work [19], CNN based multiple manipulation detector is proposed by designing filter bank to extract residual images to be input into CNN. The detector is proposed to detect 11 different manipulation types in uncompressed images of resolution 512 × 512. The seven convolutional layers based network pose limitations of large training database requirement and the detector is not explored to localize the forgeries in images.
Another general-purpose detector is proposed in [20] which target to learn features from interpolated images. The interpolated images are used as input into CNN with six convolutional layers and multi-class classification is performed to identify six different tampering operation types. The drawback of the method lies in the inability of the network to perform forgery localization in images. In another recent work [21], features are extracted from high-dimensional steganalysis based feature set SRM (34, 671-dimensional) [24] and reduced to 714-dimensions for the purpose of general-purpose image forensics. The method is capable to detect 11-different manipulation types in uncompressed images. However, the performance is degraded for compressed images and for localization of forgeries in images. Thereafter, in [22], a constrained convolutional layer is proposed to highlight the specific manipulation features and then, CNN is employed to learn the features of five different manipulation types. The method achieves good binary and multi-class classification accuracies for uncompressed images but the performance degrades for compressed images. Furthermore, the method is not verified for forgery localization in images.
Recently, in [26], two CNNs are used in siamese CNN to simultaneously classify two image patches of size 150 × 150 as similarly processed or differently processed. The method addresses the global detection of five different manipulation types in images. In another work [27], the dense connectivity pattern between convolutional layers is used for better feature extraction to identify five different manipulation types in images. Further, in [28], global manipulations are identified using 8-convolutional layers based CNN which requires costly hardware to train the model for images of size 512 × 512. Thereafter, in [29], 11 different image manipulations are identified using a densely connected convolutional layers based CNN which is further utilized for forgery localization in images. Another CNN based general-purpose detector is proposed in [30] which utilizes depth-wise separable CNN to identify 11 different manipulation types.
Further, general-purpose image forensic method proposed in [31] extracts distinguishing features from local binary pattern (LBP) model and auto-regressive (AR) model employed with image residuals. The method is used to identify three different image smoothing operations. Recently, in [32], CNN is trained with reinforcement learning to identify 11 different image processing operations. Another recent method [33] claims that forensic detection accuracies are sensitive to the difference in pre-processing of training and testing images. Thus, a new method Gaussian mixture model resizing adaptation by finetuning (GRAFT) is proposed to identify five different image processing operations in small image patches of size 8 × 8. However, localization of forgeries in images under post-JPEG compression is not addressed.
As general-purpose image forensics is a challenging task, most of the existing methods take benefits either from rich and informative steganalysis based feature sets [16,21,31] or subtle tampering traces are extracted using CNN [18-20, 22, 26-30, 32]. Steganalysis based feature sets (SPAM [23], SRM [24] or LBP [25]) are developed based on noise residuals of images, and are enriched with information about image development process [18]. For this reason, good detection accuracy has been reported for various steganalysis based image forensic methods [5,16,21], but only for high resolution images. However, in [5,16,21], results have either not been reported for small image patches or have deteriorated significantly. Similarly, CNN based methods have extracted tampering artefacts using deep networks which facilitate better classification accuracy to detect multiple manipulations for large resolution images [19,28]. Based on detailed study of existing general-purpose image forensic methods, the limitations of most of the existing works are: (1) high dimensionality of existing feature sets or computationally demanding deep CNN architectures, (2) rarely addressed forgery localization problem in post-JPEG compressed forged images and (3) rarely addressed fine-grain forgery localization (localization using small image patches) problem.

Motivation
Neighbouring pixels of a natural image exhibit inherent statistical correlations [34], the correlations being function of the distance between the pixels in local region of image. These correlations are susceptible to the locally applied informationchanging and information-preserving forgeries. Thus, various image forensic methods for copy-move and splicing forgery localization have been developed by utilizing block feature matching techniques [35,36], keypoint-based techniques [37,38], local inconsistencies (illumination, geometrical and noise inconsistencies) based techniques [39,40] and a combination of these techniques. These methods mainly focus to determine the statistical features of image blocks. Determined block features are matched with features of other blocks of the image to identify the inconsistent regions. Inspired by the success of forensic methods for the localization of information-changing forgeries in images, second-order joint statistics of image neighbouring blocks has been explored in the proposed work aimed at information-preserving forgery localization.
In the field of image forensics, most of the recent forensic methods [7,21,41] utilize residual domain image features rather than grey value domain [42] or difference domain [5,6] image features. In previous works [7,21], it has been demonstrated that content of images and JPEG compression artefacts are suppressed in residual domain as compared to grey value domain and difference domain images. Thus, residual domain images exhibit more clear artefacts of the forgery performed on the images. In the proposed work, the residual domain images are extracted by determining median filtered residual (MFR) [7] of an image. For a spatial domain image I , the MFR of image I can be determined using where I res denotes MFR of image I and m f (I ) denotes median filtering operation, operates by replacing each pixel of image I by the median of all pixel values in the neighbourhood region of size × . In the proposed work, most commonly used window size = 3 is selected to determine residual domain images. Subsequently, joint statistics of residual image blocks with neighbouring blocks is analyzed.
To analyze the efficacy of residual images as compared to grey value images, an example image is selected from BOWS2 [43] FIGURE 1 (a) Locally modified example image (BOWS2 database 33 [43]) created by Gaussian filtering R F × C F sized region and whole image is compressed with JPEG compression quality factor Q = 70, (b) MFR of (a), (c) zero padding the boundaries of (b), (d) 8-adjacent blocks selection (green blocks) for a particular reference block (red block), (e) zero padded MFR of example test image (IEEE IFS-TC database [44]) and (f) forged blocks (yellow) marked in test image database and a locally forged image is created with forged region defined by , R and C being number of rows and columns in pristine example image. The forged region is created by Gaussian filtering the region R F × C F with window size 5 × 5 and standard deviation = 1.1 and then, forged image is JPEG compressed with Q = 70. The locally forged (also compressed) example image is shown in Figure 1 Pixels in natural images exhibit certain statistical relationship with neighbouring pixels in each of the horizontal, vertical and diagonal directions. It is popular as 8-adjacency of a particular pixel p. Such relationship among pixels is destroyed in locally tampered images and consequently, the relative statistics of neighbouring blocks of an image is also disturbed. Thus, in order to extract information about relative statistics of reference block with adjacent blocks, 8-adjacent blocks are selected for each non-overlapping block in an image MFR. For the blocks that exist at the boundary of image MFR, the neighbouring blocks are selected by padding the image MFR boundary with zeros matrix as shown in Figure 1(c). It should be noted that in Figure 1(c), R b and C b denote number of rows and columns in reference block (red block in Figure 1(c)) whereas R and C denote number of rows and columns in image MFR. Figure 1(d) demonstrates the selection of adjacent blocks (green blocks) for a particular non-overlapping reference block (red block).

Joint statistics of residual image blocks and their neighbouring blocks
Considering each non-overlapping block of an image MFR and its 8-adjacent neighbours as a random variable, the joint statistics of the block under investigation and its neighbouring blocks is explored in terms of different association measures, that is cross-correlation and Euclidean distance between normalized histograms of two random variables. Denoting R b × C b sized reference block as B and its i th neighbouring block of same size as i B * in a locally forged image MFR, the cross-correlation between blocks B and i B * is defined as where

FIGURE 2 Flow diagram of proposed method
Here, i = 1, 2, … , 8 correspond to 8-neighbour blocks to a reference block. The size of obtained cross-correlation matrix . In order to extract maximum correlation between the block B and its i th neighbouring block i B * , maximum value is selected from the matrix Cor (B)( i B * ) using the equation In addition to cross-correlation measure, Euclidean distance between normalized histograms of reference block B and its neighbouring blocks i B * (i = 1, 2, … , 8) is also used to analyze the statistical relationship between the neighbouring blocks of image MFR. Denoting h B and h i B * as normalized histograms of block B and its neighbouring block i B * , respectively, the Euclidean distance between h B and h i B * is defined as where For 8-bit images, the histograms are plotted with 256 bins to analyze the grey values of reference block B with respect to grey values of each of its neighbouring blocks i B * .

Comparison with existing approaches for forgery localization
In literature, the problem of general-purpose image forensics is mainly addressed using two approaches: (1) by utilizing rich steganalysis based features and (2) by employing CNN to extract high-level features corresponding to each manipulation type. Both approaches prove beneficial for global image forgery classification because the extracted features are enriched with detailed information about image development process. However, such detectors can be employed for forgery localization in images, considering each image block as an independent image, ignoring the fact that the image block is correlated with its neighbouring blocks. The features are extracted for independent small sized blocks, which suffer lack of available statistical information and result in significant performance drop for small sized image blocks. In contrast, the proposed method follows a significantly different approach and is specifically designed for forgery localization in images by extracting the features from joint statistics of each image block with eight of its neighbouring blocks. Furthermore, to the best of our knowledge, the proposed method is the first information-preserving forgery localization method that utilizes the inherent properties of neighbouring image blocks in terms of joint statistics of the blocks.

PROPOSED FEATURE SET F loc
Based on the analysis given in preceding section, a new feature set is proposed for localization of various informationpreserving manipulation types in images. The proposed feature set of 18-dimensions has following features:

Maximum cross-correlation between reference block and its neighbouring blocks
The cross-correlation based proposed feature subset F 8 includes maximum cross-correlation values of block of image MFR with each of its 8-neighbouring blocks and is defined as Here, (B)( i B * ) denotes the maximum value of crosscorrelation between reference block B and its i th neighbouring block i B * . Cross-correlation based feature subset F 8 can be determined using (2) and (3).

Distance between normalized histograms of reference block and its neighbouring blocks
The similarity measure of locally forged reference blocks with their neighbouring blocks (forged or original) undergo substantial changes as compared to similarity between original blocks and their neighbouring blocks. To explore the similarities between two images, Jensen-Shannon (JS) divergence, Kullback-Leiber (KL) divergence and distance (cityblock, Euclidean and Minkowski) between image normalized histograms are most commonly used measures. In the proposed work, the distance between normalized histograms of image MFR reference block B and its i th neighbouring block i B * is determined using Euclidean distance. The Euclidean distance based 8-dimensional feature subset F 8 D is defined as Here, D (B)( i B * ) represents the distance between normalized histogram of image MFR reference block B and its neighbouring block i B * . The distance is calculated using (4).

Statistical features of the reference block
In addition to the joint statistics of reference block and its adjacent blocks, the statistics of underlying reference block has also been explored in order to construct a robust feature set for forgery localization in images. Thus, in the proposed work, variance F V B and entropy F E B features of reference block B are included in the final feature set. The block variance and entropy based feature subsets F V B and F E B are defined as Here, B x , B and h B denote x th element of reference block B, mean and normalized histogram of reference block B in image MFR, respectively.

Composite feature set
For the purpose of forgery localization in images, the feature subsets defined in Sections 4.1-4.3 are combined to form a 18-dimensional proposed feature set F loc which can be defined as

DETAILS OF COMPARISON METHODS AND FEATURE SET ANALYSIS
The proposed method is compared against a steganalysis feature set based method SRM (T 1,O3,q * ) [21] and a CNN based method MISLnet [22]. The brief description of generalpurpose information-preserving manipulation forensic methods SRM (T 1,O3,q * ) and MISLnet is as follows:

SRM (T 1,O3,q * )
SRM (T 1,O3,q * ) [21] feature set is designed using residual-based features rather than pixel-domain features to suppress the image contents and to enhance the forgery artefacts. The method takes advantage from one of the popular steganalysis based feature sets, spatial rich model (SRM) [24], by reducing its dimensions to 714 as compared to 34, 671 dimensions of original SRM method. The feature set SRM is reduced to SRM (T 1,O3,q * ) by analyzing the average out of bag (OOB) error with respect to feature dimensionality. The reduced feature set is employed for global detection of 11 different manipulation types in different resolution uncompressed images. Results signify the significant performance drop of SRM (T 1,O3,q * ) for images of small resolution, that is 32 × 32 and 16 × 16. Additionally, the detection results using SRM (T 1,O3,q * ) are degraded for images under post-JPEG compression.

MISLnet
MISLnet [22] is a convolutional neural network with a new constrained convolutional layer that facilitates suppression of image contents and enables CNN to learn distinguishing lower-level features for different manipulation types. Further, higher-level features are extracted from these lower-level features using a conventional deep CNN. Deeper convolutional layers in MIS-Lnet use 1 × 1 convolutions to determine additional associations between the feature maps determined from the previous layers. The method is employed for global detection of five different manipulation types in images. Results show that the average detection accuracy obtained using MISLnet is degraded under post-JPEG compression.

Feature sets efficacy comparison
In order to analyze the performance of proposed detector along with SRM (T 1,O3,q * ) [21], linear discriminant analysis (LDA) is performed. To this end, 1338 images are randomly selected from BOWS2 [43] database and left vertical half of images (R F × C F sized region) are tampered using four different manipulation types: contrast enhancement with  Figure 3.
Results shown in Figure 3 demonstrate the efficacy of proposed feature set F loc (Figure 3(a,b)) to classify between original image blocks and tampered image blocks as compared to SRM (T 1,O3,q * ) (Figure 3(c,d)) feature set, despite its smaller feature set dimensions. The same observation has already been made in one of the steganalysis based work [45] that only high dimensionality of employed feature set does not guarantee better performance. Here, LDA projections are determined only for four manipulation types, but similar behaviour can be observed for other manipulations too.

EXPERIMENTAL METHODOLOGY
In this section, the database used for assessment of proposed detector F loc and methodology used to carry out experiments have been discussed.

Image datasets
The proposed feature set F loc is thoroughly evaluated to detect forged regions using images of four different databases: BOWS2 [43], BOSSbase [46], IEEE IFS-TC image forensics challenge [44] database and a public database [47]. The usage of these databases in the proposed work is inspired by state-ofthe-art methods [17,21,22]. BOWS2 and BOSSbase databases contain 10, 000 .pgm format images of resolution 512 × 512, containing vast variety of natural scenes and low frequency images. These databases have been used in 'Break our watermarking system' contest for the first time.   Classification results for compressed (Q) forged blocks of resolution S against compressed original blocks of same resolution. Proposed detector results, in terms of classification accuracy C acc (%), are compared with SRM (T 1,O3,q * ) [21] and MISLnet [22]  Here, , , , Q, Scale, S s and C r refer filtering window size, contrast enhancement factor, standard deviation, JPEG compression quality factor, re-scaling factor, sharpening strength and compression ratio, respectively. Bold marked values of parameters are used to develop results shown in Tables 4, 5 and 6.

Experimental setup
The proposed detector F loc is evaluated by developing the trained models using the datasets CB (DB) S op∕ori+Q and PB (DB) 64 op∕ori+Q where DB∈ {BOWS2, BOSSBase, (IEEE+ HR)}. For dataset CB (DB) S op∕ori+Q , results are presented in terms of 70% − 30% holdout validation accuracies (i.e. 70% images are used for training and 30% are used for testing), achieved using ensemble of decision tree classifiers with bag-ging. To achieve a generalized detector, the results are determined for 21,408, 85,632 and 342,528 image blocks for S = 128 × 128, 64 × 64, 32 × 32, respectively. The proposed detector F loc results are compared with two state-of-the-art detectors SRM (T 1,O3,q * ) [21] and MISLnet [22]. Detector SRM (T 1,O3,q * ) is a 714-dimensional statistical features based multiple manipulation detector whereas MISLnet is a CNN-based multiple manipulation detector.
For compilation of SRM (T 1,O3,q * ) results, the above defined dataset CB (BOWS2) S op∕ori+Q for S ∈ {128 × 128, 64 × 64, 32 × 32} is used to determine 70% − 30% holdout validation results using ensemble classifier [48]. On the other hand, MISLnet, being a CNN based detector, require large number of images to optimize the network parameters. Thus, following the experimental methodology and network settings described in [22], MISLnet is trained for dataset CB (BOWS2) S op∕ori+Q images for S ∈ {64 × 64} with 85632 image blocks. However, for block size S = 128 × 128, number of available blocks (21408) are not sufficient to train MISLnet. Therefore, 1013 large resolution (1024 × 768, 1024 × 683 and 1024 × 585) images are randomly selected from IEEE IFS-TC image forensics challenge [44] database and left vertical half region of each image is tampered with the manipulations (op) listed in Table 1 for both the parameters given. Resulting images are post-JPEG compressed Classification results for compressed (Q) forged blocks of resolution S against compressed original blocks of same resolution. Proposed detector results, in terms of classification accuracy C acc (%) are compared with SRM (T 1,O3,q * ) [21] and MISLnet [22]   Further, in order to obtain more precise localization performance, proposed detector F loc , along with SRM (T 1,O3,q * ) and MISLnet, is trained using partially forged blocks dataset The localization results for proposed detector F loc are reported using MATLAB 2018(a) classification learner application. MISLnet results are compiled using Caffe deep learning framework with python 3.6. Number of training iterations are set to 47,000 and results are determined using two classifiers: softmax and extremely randomized trees (ERT) as mentioned in original manuscript [22].

RESULTS AND DISCUSSION
The forgery localization results in terms of classification accuracies achieved by proposed detector F loc , SRM (T 1,O3,q * ) and MIS-Lnet are reported using the formula Here, TP and TN denote number of true positive and number of true negative, respectively. Also, P and N denote total number of positive and negative samples, respectively. Additionally, the F1-score of classification is also determined using the formula where Precision and Recall are defined as Here, FP and FN denote number of false positive and number of false negative, respectively.

Forgery detection in completely forged/completely original blocks
The localization results for images containing either completely forged blocks or completely original blocks are simulated for CB (BOWS2) S op∕ori+Q dataset images using proposed detector F loc for S ∈ {128 × 128, 64 × 64, 32 × 32}. The proposed detector results are compared with the classification accuracies achieved by existing detectors SRM (T 1,O3,q * ) [21] and MISLnet [22]. The binary classification results are reported for 20 different test case scenarios, including 10 different manipulation types with two parameters each, parameters being listed in Table 1. The results are tabulated in Tables 2 and 3. Results demonstrate that the proposed detector performs better than existing detectors in most of the test case scenarios, specifically for the images compressed with low quality factor of compression (Q = 30). The proposed detector F loc exhibits significant performance improvement for detection of contrast enhancement, unsharp masking, JPEG compression and JPEG2000 compression as compared to state-of-the-art detectors. Additionally, the proposed detector F loc achieves maximum average classification accuracy to localize forged regions in compressed images.
It should be noted that MISLnet results are simulated for block size S ∈ {128 × 128, 64 × 64} as for S = 32 × 32, MIS-Lnet network needs modification. As discussed in the previous section, MISLnet results for S = 128 × 128 are simulated for images of dataset CB (BOWS2+IEEE) 128 op∕ori+Q for 67,810 image blocks to properly train the network.

Robustness of F loc results for different databases and different forged region locations
We have analyzed the robustness of proposed detector F loc results with respect to different databases. To this end, the results are determined for dataset CB (DB) 64 op∕ori+Q30 (creation of CB (DB) 64 op∕ori+Q30 is discussed in Section 6.1) where DB∈ {BOWS2, BOSSBase, (IEEE+HR)}. The 70 − 30% holdout validation results are determined for manipulation types (op) listed in Table 1 for bold marked parameters. The average accuracies and average F1 scores for databases BOWS2, BOSSBase and (IEEE+HR) are shown in Table 4. It can be seen from the table that the results obtained for different databases do not vary much.
Further, the robustness of the proposed detector with respect to different forged region locations is analyzed. This is achieved by determining and comparing the results for previously defined datasets CB (BOWS2) 64 op∕ori+Q30 , CB (BOWS2var1) 64 op∕ori+Q30 and CB (BOWS2var2) 64 op∕ori+Q30 (datasets are discussed in Section 6.1). The 70% − 30% holdout validation results are determined for three datasets for the manipulations (op) listed in Table 1 using bold marked parameters. The average accuracies and average F1 scores for three cases are listed in Table 5 which show that the results are degraded for the dataset CB (BOWS2var1) 64 op∕ori+Q30 when blocks of 669 globally forged images are considered as forged and blocks of other 669 images are considered as original. The reason for performance drop in this case is that training dataset contains examples of forged blocks surrounded by only forged neighbouring blocks and original blocks surrounded by only original neighbouring blocks. For the remaining two cases, training datasets are generalized datasets containing forged blocks with original and forged neighbouring blocks and vice-versa. Thus, we can conclude that dataset created by including forged image blocks and original image blocks from different images is not suitable for forgery localization using F loc , rather it is the most common method to create dataset for global forgery detection in images.

Forgery detection in partially forged/partially original blocks
To analyze the performance of proposed detector for its applicability in real world scenarios, the localization results are determined for compressed images containing partially forged or partially original blocks. In order to achieve this, an ensemble of 30 decision trees has been trained with images of datasets PB (DB) 64 op∕ori+Q30 for DB∈ {BOWS2, BOSSBase, (IEEE+HR)}, containing partially forged and partially original blocks. It should be noted that image blocks with half or more forged region is labelled as forged otherwise labelled as original. Trained models using proposed detector F loc , state-of-the-art detectors SRM (T 1,O3,q * ) [21] and MISLnet [22] are developed for the operations (op) listed in Table 1 with bold marked parameters.  [21] and (f) MISLnet [22] FIGURE 5 (a) Locally forged image (information-changing forgery) from database [44], (b) ground-truth of the image, (c) locally forged compressed (Q = 70) image with red marked median filtered ( = 5) blocks, forgery localization results using (d) proposed detector F loc , (e) SRM (T 1,O3,q * ) [21] and (f) MISLnet [22] The 70 − 30% holdout validation results are determined for proposed feature set F loc along with SRM (T 1,O3,q * ) and MIS-Lnet. The results are compiled in Table 6 in terms of detection accuracies C acc and F1 scores achieved by different methods. Results in Table 6 show that the proposed detector achieves better results as compared to state-of-the-art detectors, especially for the detection of median filtering, contrast enhancement, unsharp masking, JPEG and JPEG2000 compression. Additionally, the proposed detector achieves best average accuracies and average F1-scores for the three databases.
To serve one's purposes, the malicious user usually create locally tampered images by modifying the content of the image and by performing post-processing operations to hide the footprints of underlying forgery. IEEE IFS-TC image forensics challenge [44] database contains images created using copymove or splicing forgery. Two images have been selected from the database and shown in Figures 4(a) and 5(a) along with respective ground-truths in Figures 4(b) and 5(b). These images have been created using copy-move or splicing forgery. Further, the images shown in Figures 4(a) and 5(a) are locally average filtered and median filtered with window size = 5, respectively and complete images are post-JPEG compressed with quality factor Q = 70. The regions for locally applied average filtering and median filtering have been selected such that it correspond   [43] database, (c) locally forged compressed (Q = 70) image with red marked re-scaled (Scale=1.5) blocks, forgery localization results using (d) proposed detector F loc , (e) SRM (T 1,O3,q * ) [21] and (f) MISLnet [22] to minimum covering area for the primary forgery. The average filtered and median filtered blocks are marked with red colour and are shown in Figures 4(c) and 5(c), respectively. It is worth mentioning here that blocks with half or more forged pixels are considered as forged otherwise considered as original. Then, trained models using feature sets F loc , SRM (T 1,O3,q * ) and MIS-Lnet are used to identify locally forged blocks of size 64 × 64 in test images given in Figures 4(c) and 5(c) and results are shown in Figures 4(d-f) and 5(d-f), respectively. Along with the visual results, the detection accuracies (C acc ) and F1 scores for Figures 4(d-f) and 5(d-f) are determined. Results ascertain that the proposed detector F loc outperforms state-of-the-art detectors SRM (T 1,O3,q * ) [21] and MISLnet [22] to localize average fil-tered and median filtered blocks of size 64 × 64 in compressed (Q = 70) images despite its smaller feature set dimensions (18dimensions).
Additionally, to ensure localization of Gaussian filtering and re-scaling in images, two test images are created with local Gaussian filtered and re-scaled regions. To this end, four images are selected from BOWS2 [43] database as shown in Figures 6(a,b)  and 7(a,b). The image in Figure 6(b) is Gaussian filtered with window size = 5, standard deviation = 1.1 and image in Figure 7(b) is rescaled with a factor of 1.5 followed by cropping to same size. Then, a portion of manipulated versions of  Figures 6(c) and 7(c). The red marked blocks in Figures 6(c) and 7(c) denote Gaussian filtered and re-scaled blocks, respectively. The test images, created in this way, are tested using detectors F loc , SRM (T 1,O3,q * ) , MISLnet and results are shown in Figures 6(d-f), 7(d-f) for localization of Gaussian filtered blocks and re-scaled blocks, respectively. Results, in terms of detection accuracies and F1 scores, exhibit better performance of proposed detector F loc with low feature set dimensions (18dimensions) as compared to existing detectors SRM (T 1,O3,q * ) [21] and MISLnet [22].

Results analysis
Based on the results determined in Sections 7.1-7.3, following observations can be made about the efficacy of proposed localization detector F loc as compared to state-of-the-art detectors: 1. For forgery localization in images containing completely forged (or completely original) blocks, the main contribution of proposed detector F loc lies in its better performance for block size 128 × 128 compressed with two quality factors of compression Q (Q = 30, 70). For smaller block sizes 64 × 64 and 32 × 32, performance of detector F loc degrades for specific manipulation types (Tables 2 and 3). This is due to decrease in available information with decrease in block size. However, average accuracies achieved by detector F loc are higher as compared to SRM (T 1,O3,q * ) [21] and MISLnet [22] detectors for all block resolutions (S ∈ {128 × 128, 64 × 64, 32 × 32}) and for both values of compression quality factor Q (Q = 70, 30). Additionally, the proposed detector F loc is robust to images from various databases and from different locations of forged regions in images. 2. For forgery localization in images containing partially forged (or partially original) blocks, the proposed detector F loc exhibits comparable or better performance as compared to existing detectors SRM (T 1,O3,q * ) and MISLnet. The holdout validation (Table 6) and testing results (Figures 4-7) show that the detector F loc is suitable for fine-grain forgery localization in compressed images despite its small dimensions (18-dimensions).

CONCLUSION
Determination of precise location of forgery in images is very crucial from forensic point of view which set-up new research goals to localize information-changing and informationpreserving manipulations in images. In the past years, a lot of work has been done for localization of information-changing manipulations [3,4] whereas localization of informationpreserving manipulations [14,15,17] is still an emerging area of research. This paper presents a new method to localize 10 different information-preserving manipulation types in original, spliced and copy-move forged images of different databases in compressed format. A 18-dimensional new feature set F loc is proposed, by analyzing the joint statistics of image non-overlapping blocks with 8-neighbouring blocks, to localize average filtering, median filtering, Gaussian filtering, Wiener filtering, JPEG compression, JPEG2000 compression, unsharp masking, contrast enhancement, additive Gaussian noise addition and re-scaling operations. The proposed detector F loc results are compared with two recent multiple manipulation detectors SRM (T 1,O3,q * ) [21] and MISLnet [22]. Results demonstrate the effectiveness of detector F loc despite its lower feature set dimensions as compared to high feature set dimensions of SRM (T 1,O3,q * ) (714-dimensions) and complex CNN network of MISLnet (5-layers).