1. Introduction

With the rapid development of the Internet and artificial intelligence, making digital images has become a rare thing. This important information carrier is also becoming more and more common in people's lives. The information carried on digital images is very large and dense. In such an environment, digital image tampering has arisen. In order to make others believe in some information that does not exist, people tamper with digital images. One of the classic techniques of image tampering is Copy-Move, also known as Copy-Paste. In the information age where the technology iteration is so fast, the technique of Copy-Move is also growing. In such a background, digital image tampering detection techniques have emerged.

In detection techniques, feature matching based detection methods are mainly for Copy-Move. such methods locate possible tampered regions by extracting feature descriptions of the image and matching these features. Under Copy-Move, the tampered region is highly like the source region in terms of texture, illumination, color, etc., and is rotated, scaled and so on, which makes the detection more difficult. Moreover, the tampered region and the image as a whole may be blurred, noise added, JPEG compressed, etc., and the complex background will increase the difficulty of feature matching in a natural scene; detecting very small tampered regions also requires a more fine-grained In natural scenes, complex backgrounds increase the difficulty of feature matching; detecting very small tampered areas also requires more refined feature extraction and matching methods.

Since 2008, there are mainly nine reviews that have been published in the field of digital image tampering, but literature published in 2008-2014 lack the analysis of new methods in recent years[1-6]. This is outdated in today's rapid technology iteration and will not be elaborated on in detail in this paper. The literature published in 2017 not only summarizes the passive localization methods in natural environment [7], but also reproduces and compares these methods in detail. However, although it is a more complete review of tamper localization methods, it still lacks an analysis of digital image tamper detection methods that incorporate deep learning in recent years. The literature published in 2022 analyzes in detail almost all of the current digital image tamper detection methods [8], but is too comprehensive to be complete under the broad category of feature matching-based detection methods.

The basic process of digital image tampering detection methods based on feature matching is as follows: firstly, local or global features are extracted from the digital image, and the common methods include keypoint matching and block matching; then the similarity between the features is compared to identify the duplicated regions; finally, through geometric constraints, morphology analysis, and other methods, false positives are removed and tampered regions are finally identified. This paper mainly analyzes and compares two major categories of subordinate methods, namely keypoint-based matching and block-based matching, in detail.

2. Manuscript Preparation

Table 1 is several classical datasets commonly used in feature matching based image tampering detection methods, which have been initially organized by the authors, including the explicit procedure, the brief as well as the download address for the readers to take:

Table 1: Dataset Introduction

3. Generalization of the methodology

3.1. Detection method based on image block matching

Among the detection methods based on image block matching, Zernike Moments is a classical detection method[14], which detects rotated copy-paste tampered regions in an image by utilizing the rotational invariance of Zernike moments. Figure 1 shows the basic operation flowchart of the Zernike Moments algorithm: Zernike Moments first performs unit circle cropping to map the image or tampered region to the unit circle, then performs feature extraction to compute the modulus of the Zernike moments of each order∣𝐴𝑛𝑚∣, and finally performs similarity detection by comparing the modulus of the Zernike moments of the image blocks to find out the similar region, labeled as the possible tampering regions. However, Zernike Moments feature extraction involves complex mathematical computations, especially time-consuming when dealing with large resolution images, and is mainly designed for rotational invariance, with limited ability to deal with other attacks (e.g., JPEG high compression, Gaussian noise and blurring). In the literature[15], a method combining Fast Fourier Transform, Singular Value Decomposition and Principal Component Analysis is proposed to extract features: the FFT-SVD-PCA cascade method.

Figure 1: Zernike Moments Forgery Detection Process (Picture credit : Original)

Figure 2 shows the basic flowchart of the algorithm: firstly, the input image is divided into overlapping blocks of fixed size, each representing a candidate detection unit, and secondly, features are extracted using Fast Fourier Transform (FFT), Singular Value Decomposition (SVD) and Principal Component Analysis (PCA) for each block of image respectively. The extracted features are then matched using a cascade filtering strategy to identify possible tampering regions. Finally, by filtering the false matches, the tampered regions are identified and the detection results are outputted as black and white images. The FFT-SVD-PCA cascade method not only makes a threshold-free design that does not require multiple thresholds to be set manually and avoids performance degradation due to improper threshold selection, but also significantly improves its computational efficiency compared to Zernike Moments. Robustness compared to Zernike Moments also maintains high detection accuracy under multiple attacks (e.g., JPEG compression, noise, blurring) in a highly coupled FFT, SVD, and PCA process, achieving more than 97% accuracy even when the JPEG quality factor is as low as 20.

Figure 2: FFT-SVD-PCA Forgery Detection Process (Picture credit : Original)

3.2. Detection method based on keypoint matching

In keypoint-based, SIFT[16] is a classical detection method which extracts the SIFT descriptors of keypoints in the image which are robust to scale, rotation, noise and illumination variations, and then locates the tampered region by matching between the descriptors to achieve the effect of detecting the tampered region in the image.

Figure 3 brackets the process of SIFT algorithm: firstly, find the extreme points at different scales, secondly, filter out the unstable keypoints and keep only the keypoints with high contrast and accurate localization, then assign the direction to each keypoint to ensure the rotation invariance, and finally generate 128-dimensional feature vector based on the local gradient distribution of keypoints. And then feature matching is performed: the similarity between feature descriptors is calculated using Euclidean distance, and a distance ratio threshold is set to filter out the optimal matching pairs. If multiple matching pairs are found to be concentrated in a certain region and match the pattern of tampering, it is determined that the image may have been copy-paste tampered.

Figure 3: SIFT Keypoint Detection and Matching Process (Picture credit : Original)

However, the computational complexity of SIFT is high, the process of keypoint detection and matching is computationally intensive, especially on high-resolution images, and the accuracy of keypoint extraction and matching decreases in high-noise and low-contrast environments, and the matching effect of SIFT does not show high performance for subtle tampered regions. However, in the literature[17] the authors design another detection method based on keypoint matching: BusterNet.The network architecture of BusterNet is divided into three parts: tamper detection branch, similarity detection branch and fusion module. Compared with the traditional SIFT, this structure not only avoids the complexity of manual feature design and matching and saves most of the time, but also works better for low-texture regions or scenes with weak tampering traces. The tamper detection branch uses the first four convolutional blocks of VGG16 to extract features, which are restored to the original resolution by the up-sampling module (inverse convolutional layer or interpolation operation), and outputs a binary mask indicating the tampered region. The similarity detection branch extracts features using VGG16 and computes the similarity of each pixel to other pixels in the feature space, generating an autocorrelation feature map. This branch also adds quantile pooling for extracting statistical information about the similarity distribution to enhance robustness, and finally outputs a binary mask representing the similar region as in the tamper detection branch. The fusion module is used to combine the outputs of the tamper detection branch and the similarity detection branch to generate the final triple classification mask. The triple classification result is generated: 0: real region. 1: source region. 2: target region. Figure 4 shows the basic flowchart of the BusterNet algorithm.

Figure 4: BusterNet Forgery Detection Process (Picture credit : Original)

BusterNet's detection method comparing to the traditional SIFT keypoint extraction not only realizes end-to-end learning of tampering features automatically by deep learning without manual parameter tuning, but also distinguishes between source/target regions, provides fine-grained tampering detection results, and is highly adaptive to complex geometric transformations and post-processing operations. However, it does not demonstrate high performance in detecting small tamper regions and detailed tampering, but in literature[18] a method of applying a two-stage detection framework is proposed: the Hybrid Forgery Detection Framework. Hybrid Forgery Detection Framework is based on the traditional keypoint detection method and the deep learning detection method, which divides the detection into two stages to improve the efficiency, as shown in Figure 5: In the first stage, a deep learning network (e.g., VGG16) is used to extract the image multiscale features, analyzes them by correlation and quickly generates a coarse mask of the tampered region, providing a preliminary prediction of the tampered region and narrowing the scope of subsequent processing. The second stage optimizes keypoint matching, extracts local keypoint features using traditional methods, refines tampered region localization through keypoint matching and region verification, eliminates false positives using morphological operations, and improves pixel-level accuracy.

Figure 5: Hybrid Forgery Detection Framework Process (Picture credit: Original)

4. Conclusion

In this paper a detailed categorization of feature matching based methods for detecting image tampering and a detailed analysis and comparison of their subordinate classical and latest methods based on feature point matching and block matching are presented. In this paper, it is found that the latest and high-performance methods are all hybrid detection frameworks of deep learning and traditional methods. Deep learning techniques have significant advantages in automated feature extraction, detection efficiency and fine-grained tampering recognition, but small tampered region detection is still a major challenge in image tampering detection at present. Detection techniques that efficiently fuse traditional and deep learning methods should be further explored in the future to cope with more complex and fine-grained tampering scenarios.