Estimation of primary quantization matrix for steganalysis of double-compressed JPEG images

A JPEG image is double-compressed if it underwent JPEG compression twice, each time with a different quantization matrix but with the same 8 × 8 grid. Some popular steganographic algorithms (Jsteg, F5, OutGuess) naturally produce such double-compressed stego images. Because double-compression may sig- nificantly change the statistics of DCT coefficients, it negatively influences the accuracy of some steganalysis methods developed under the assumption that the stego image was only single-compressed. This paper presents methods for detection of double-compression in JPEGs and for estimation of the primary quan- tization matrix, which is lost during recompression. The proposed methods are essential for construction of accurate targeted and blind steganalysis methods for JPEG images, especially those based on calibra- tion. Both methods rely on support vector machine classifiers with feature vectors formed by histograms of low-frequency DCT coefficients. 1. MOTIVATION In this paper, we consider a JPEG image double-compressed if it was compressed twice, each time with a different quantization matrix. The quantization matrix used in the first compression is called the primary quantization matrix, the quantization matrix used in subsequent (second) compression is called the secondary quantization matrix. Since the JPEG image file does not keep information about the compression history, only the latest (secondary) quantization matrix is stored within the file and the primary quantization matrix is lost. Detection of double-compression is important in steganalysis as well as in forensics because the fact that an image was double-compressed indicates that it was manipulated. By determining double-compression history in smaller regions, we may discover traces of malicious manipulation. For example, when pasting an object into a decompressed JPEG and resaving with a different JPEG quality factor, the pasted object may exhibit different repetitive JPEG compression artifacts than the rest of the image. Some steganographic algorithms (e.g., F5, to estimate the statistics of the cover image. It is absolutely essential to adjust the calibration to mimic what happened during embedding. To do so, we need to accurately detect double-compressed images and estimate their primary quantization matrix, otherwise the steganalytic