Source‐anchored, trace‐anchored, and general match score‐based likelihood ratios for camera device identification

Abstract Forensic camera device identification addresses the scenario, where an investigator has two pieces of evidence: a digital image from an unknown camera involved in a crime, such as child pornography, and a person of interest’s (POI’s) camera. The investigator wants to determine whether the image was taken by the POI’s camera. Small manufacturing imperfections in the photodiode cause slight variations among pixels in the camera sensor array. These spatial variations, called photo‐response non‐uniformity (PRNU), provide an identifying characteristic, or fingerprint, of the camera. Most work in camera device identification leverages the PRNU of the questioned image and the POI’s camera to make a yes‐or‐no decision. As in other areas of forensics, there is a need to introduce statistical and probabilistic methods that quantify the strength of evidence in favor of the decision. Score‐based likelihood ratios (SLRs) have been proposed in the forensics community to do just that. Several types of SLRs have been studied individually for camera device identification. We introduce a framework for calculating and comparing the performance of three types of SLRs — source‐anchored, trace‐anchored, and general match. We employ PRNU estimates as camera fingerprints and use correlation distance as a similarity score. Three types of SLRs are calculated for 48 camera devices from four image databases: ALASKA; BOSSbase; Dresden; and StegoAppDB. Experiments show that the trace‐anchored SLRs perform the best of these three SLR types on the dataset and the general match SLRs perform the worst.


| INTRODUC TI ON
Digital image forensics is a branch of forensic science that analyzes digital photographs and videos. Like many other areas of pattern evidence identified in the 2009 landmark report by the National Research Council [1], multimedia analysis was identified as lacking in probabilis- tested so it will withstand increasing scrutiny in the courts [3]. Scorebased likelihood ratios (SLRs) provide one method for quantifying the probative value of a piece of evidence and are an area in which digital pattern evidence is building its repertoire of evidence-based research findings. In this paper, we develop a framework for calculating three types of SLRs to quantify the weight of evidence for the digital image forensic problem of camera device identification, where the goal is to identify a particular camera device (as opposed to camera model) that captured a questioned image.
In pattern evidence analysis, the investigator is often confronted with a source identification problem. The investigator has two impressions, one impression E u from the crime scene where E u is from an unknown source. The other impression E k is directly acquired from a specific known source, related to the person of interest (POI). The investigator asks: how likely is it that both impressions originate from the specific known source? How likely is it that the crime scene impression does not originate from the specific known source? These questions are often expressed as two competing, specific-source hypotheses [4].
In practice, the prosecution and the defense do not specify these hypotheses, but we will use standard nomenclature and refer to H p as the prosecution's hypothesis and H d as the defense's hypothesis.
An investigator faced with a camera device identification problem might have a digital image I u that contains child pornography and a camera fingerprint F k estimated from images of innocuous content from a POI's camera. (We use a capital letter I to denote images and a capital letter F to denote camera fingerprints. The subscripts denote the camera that created the image or fingerprint, the letter u stands for unknown camera and the letter k stands for the POI's camera, which is also called the specific known device.) The prosecution's hypothesis is that the child pornography image originated from the POI's camera that also created the camera fingerprint, while the defense's hypothesis is that the child pornography image did not originate from the POI's camera.
Most camera device identification methods rely on a camera sensor property called photo-response non-uniformity (PRNU) [5]. The measured response of a camera sensor array to incoming photons slightly varies from pixel to pixel due to the manufacturing process and imperfections in the photodiode. In principle, the spatial placement of these variations from the mean response of the array of pixels provides an identifying characteristic, or fingerprint, of the camera. We will use the terms PRNU and camera fingerprint interchangeably.
In Figure 1, we summarize the algorithm presented in [6,7] to estimate the camera fingerprint F k of device C k , which is given by equation where I j k (j = 1, 2, …, n) are images from C k and X j k (j = 1, 2, …, n) are noise residuals of the images calculated by subtracting a denoised version of the image from the image itself. The image I J k , the noise residual X j k , and the fingerprint F k in Equation (1) can all be represented as matrices of pixel values and multiplication is performed element-wise. Note that we use slightly different notation than that in [6,7]: we use a subscript to denote the camera device to which an image belongs.
H p : the impression E u originated from the specificknown source that created E k , H d : the impression E u originated from a different sourcethan the specific known source.

Highlights
• SLRs convey the strength of evidence in favor of a match or non-match for camera identification.
• The three types of SLRs considered achieve low rates of misleading evidence on the dataset.
• Trace-anchored SLRs outperform source-anchored and general match SLRs on the dataset.
F I G U R E 1 Summary of the PRNU estimation algorithm presented in [6,7] An investigator can estimate the true PRNU of a camera using the above algorithm and a set of images from the POI's camera. If the investigator has one single image, then the PRNU estimate is simply the noise residual of the single image. An assumption made of the extracted PRNU is that it is unique for a camera sensor. A recent paper [8] presents results that show that recent advances in the image processing pipeline such as customized HDR algorithms can cause small similarities in the camera fingerprints from different cameras of the same model. They show that these small similarities can slightly increase the rate of false positives between different cameras of the same model. We invite readers to pursue open questions that arise from this recent publication.
After estimating the camera fingerprint F k from device C k a questioned image I u from unknown device C u is compared with F k using a (dis)similarity score Δ. The value of interest is where multiplication between I u and F k is performed element-wise (See Ref. [6] for an explanation of why the noise residual is compared to the product of the image and the camera fingerprint). Early camera device identification works used the sample correlation as the similarity score [5,6,9,10]. Later the peak-to-correlation energy (PCE) replaced sample correlation because the PCE is robust against a periodic signal called linear pattern that created problems for statistical models that used sample correlation [11]. Most previous work in camera device identification focuses on developing what we term a universal detector [7,9,11,12,13,14,15] where the authors aim to create a single system that works for any questioned image and camera device. Over the years, universal detectors that use the PRNU have been tested against cropping and scaling [13], gamma correction and denoising [6], compression [14], lens distortion [16], and contrast enhancement, histogram equalization, and white balance [15]. Most previous work determines if a questioned image I u came from a specific known camera C k by comparing the value of interest δ = Δ(X u , I u F k ) from Equation (2) to an ad-hoc decision threshold t, where t is typically chosen based on a constructed set of similarity scores between an image and a camera fingerprint known to be from the same camera (matching) and an image and a camera fingerprint known to be from different cameras (non-matching). In the universal detector approach, the researchers' goal is to create a single detector and decision threshold t that can be applied to any image and any camera device. Of particular interest to us, the universal detector approach addresses the common-source hypotheses, which are less pertinent to the decision-makers in criminal justice trials than the specific-source hypotheses (see Ref. [4] for more information on the common/specific-source problems). Furthermore, the universal detector methods aim to classify pairs of images as either matching or non-matching, using pattern recognition and classification methods, such as linear discriminant analysis, to define the decision threshold. This results in a binary decision that gives no information about the strength of the evidence in favor of that decision. These methods differ from the likelihood ratio-style approaches, which aimed to quantify the probability of observing the evidence under two competing hypotheses.
Likelihood ratios (LRs) are used in single source DNA analysis [17] and glass fragment analysis [18,19]. An LR for pattern evidence is defined as the ratio of the likelihoods of observing both impressions under hypotheses H p and H d . More specifically, for an impression E u from a crime scene and an impression E k from a source related to the POI, the LR would be written where P(·) is a joint probability density (or mass) function (PDF) [20].
The PDF in the numerator of the LR describes the likelihood of observing both impressions E u and E k if they originated from the specific known source and the PDF in the denominator would be the likelihood of observing both impressions E u and E k if they were a "random match" and E u came from a different source than the specific known source.
To formulate an LR as in Equation (3), the investigator needs an applicable set of measurements, often called features, where the variability between the features of two impressions from the same source can be distinguished, with high accuracy, from the variability between the features of two impressions from different sources. The representation of many pattern evidence data is often high-dimensional and complex, making such sets of features extremely challenging to identify.
Alternate methods for assessing the weight of the evidence are being explored in various forensic fields, including machine learning with paired feature differences [21] and SLRs [22].
To our knowledge, full-fledged likelihood ratios have not yet been implemented in camera device identification, but Qiao et al. [23,24] employed a related method, a likelihood ratio test (LRT), for camera device identification to determine which of two camera devices C 1 or C 2 captured a questioned image I u from an unknown source. They formulate the problem as a classification problem and consider the following two hypotheses: Note that we use our own notation here to be consistent with the rest of this paper. The authors also address the question of which device from a set of n devices C 1 , C 2 , …, C n took questioned image I u by performing an LRT for each possible pair of devices and declaring the device identified by the most LRTs to be the device that captured the I u [23]. If a case arises in practice where a questioned image is known to have been taken by one of two devices, the likelihood ratio that Qiao et al. treat as the test statistic in their likelihood ratio test could potentially quantify the strength of evidence.
Because their intent was to solve a multi-classification problem by determining which of n classes (cameras) the question image I u came from, this framework does not readily provide a means of quantifying the strength of the evidence when the pool of potential sources of I u is larger than two devices. LRs still remain elusive for camera device identification.
SLRs have appeared in a variety of forensic fields when LRs are unavailable: glass fragments and shoe impressions [22]; handwriting [25]; MDMA tablets [26]; fingerprints [27]; speaker recognition [28]; and facial recognition [29]. SLRs use a similarity score Δ to measure the similarity (or dissimilarity) of two pieces of evidence E u and E k and then calculate the likelihood of obtaining the score Δ(E u , E k ) under hypotheses H p and H d . An SLR is then the ratio of these two likelihoods. A reference set of matching scores between two pieces of evidence known to come from the same source are used to estimate the PDF in the SLR numerator. The PDF in the denominator is estimated from a reference set of non-matching scores between two pieces of evidence known to come from different sources. We In this case, both the numerator and denominator condition on the evidence from the unknown source, unlike Equation (4) that anchors on the evidence from the known source in the numerator and the evidence from the unknown source in the denominator.
Neumann and Ausdemore state an SLR that anchors on the evidence from the unknown source in the numerator is not useful in practice because the investigator would need other objects from the same unknown source as E u to estimate the numerator.
Additionally, Neumann and Ausdemore point out that because the trace-anchored SLR defined by Hepler et al. anchors on two different objects in the numerator and denominator it is highly unlikely that it will converge to the desired Bayes factor. However, this is only a drawback from a Bayesian perspective and the validity of this method for other statistical frameworks has yet to be explored.
The source-anchored method considers similarity scores between the POI's handwriting sample E k and handwriting samples from writers in the alternative population. The source-anchored SLR is defined Neumann and Ausdemore [32] criticize this approach for being incoherent from a Bayesian perspective, but Garton [33] takes a different viewpoint.
The general match method considers similarity scores between handwriting samples from pairs of different writers randomly selected from the alternative population. The general match SLR is defined Like the trace-anchored SLR, the general match SLR also does not anchor on the same object in the numerator and denominator.
Again, this is problematic from the Bayesian perspective, but further research is needed to ascertain whether this is an issue from the perspective of other statistical frameworks. Hepler et al. [25] demonstrate that these three SLR types can lead to different conclusions on the same evidence. Because of this, the method investigators use to build their reference set of non-matching scores is extremely important.
In many situations, SLRs from Equations (4)-(6) are easier to apply than LRs from Equation (3) because similarity scores reduce the dimensionality of the problem. Instead of needing to fit probability distributions in high dimensions, the investigator only needs to fit distributions to lower dimensional similarity scores. One drawback of SLRs is that unlike LRs, they do not account for rarity. For example, if a witness told the police the color, make, and model of the car that fled the crime scene and a person of interest owns a car of the same color, make, and model, an LR would take into account the rarity of that color, make, and model in the general population of cars (e.g., a red Ferrari Portofino is rarer than a black Toyota Corolla).
In contrast, an SLR does not consider the rarity of the car involved (e.g., two red Ferrari Portofino cars are just as similar in color, make and model as two black Toyota Corolla cars). Another drawback of SLRs is that when "pairwise comparison" methods are used, dependency is introduced into the resulting score data. Meaning that any two similarity scores that were created using the same object as one item in the pair will be dependent (e.g., Δ(I 1 , I 2 ) and Δ(I 1 , I 3 ) are dependent because they both involve item I 1 ). Unfortunately, no one knows how to fix this problem yet. Because LRs are as of yet unavailable for camera device identification when more than two devices are considered, despite the limitations, SLRs are the only available alternative.
SLRs have been applied to the digital image forensic problem of camera source identification, where the source being identified is a particular camera device [34,35]. Nordgaard and Höglund [34] (4)
introduce the framework for calculating source-anchored SLRs, one of the available types of SLRs. They perform simulation studies in the case where a questioned image came from one of two cameras, and they discuss how their method could be applied to a larger set of cameras. van Houten et al. [35] addressed the scenario where an investigator knows the make and model of the camera that took a questioned image and wishes to determine which device out of a set of 9 or 10 devices of that make and model captured the image. They present specific-source hypotheses, but they construct SLRs that address common-source hypotheses. The difference between the numerators of a common-source SLR and a specific-source SLR lies in the construction of the reference sets of matching scores used to estimate the numerators' PDFs [31].

| ME THODS
We present a framework for calculating three types of specific-  [42]. We used the MATLAB code.) Each device C i has n = 80 training images I 1 i , I 2 i , … , I n i . (The subscript denotes the camera, and the images are numbered in the superscript.) A denoising filter D is used to extract a noise residual from each image: The n = 80 training images are divided into 8 folds of 10 images each. Camera fingerprint F 1 i calculated with Equation (1) and all training images except those in fold 1, camera fingerprint F 2 i is estimated from all training images except those in fold 2, and so on. This results in 8 camera fingerprints from device C i .
We need a way to measure the similarity (or dissimilarity) between the questioned image I u and the camera fingerprint F k from the POI's device. In other words, we need to choose which similarity score to use in Equation (2). We used peak-to-correlation energy (PCE) in our initial experiments, but we found that the large variance (on the order of 10 6 ) of the observed PCE scores produced many unstable SLR values where the numerator of the SLR is tiny and the denominator is zero. We found that for our dataset the sample correlation has much smaller variance (on the order of 10 −3 ) and thus produced more stable results. We chose to use the correlation distance, which is defined as one minus the sample correlation. For The correlation distance between two images X and Y with dimensions m × n can be calculated by first converting the images to vectors of length mn. The noise residual X u = I u − D(I u ) is obtained by subtracting a denoised version of the image, created with denoising filter D, from the image itself. Then the investigator calculates the correlation distance between the questioned image I u and the camera fingerprint F k from the POI's camera using Equation (2) where multiplication between I u and F k is performed element-wise and X u and I u F k are first converted to vectors.
A trace-anchored, source-anchored, and general match SLR is calculated for each questioned image I u and each of the 48 devices set as the specific known device C k in turn. For a given questioned image I u and a given specific known device C k the correlation distance is calculated between a noise residual X u of I u and the product (element-wise) I u F j k (for j = 1, …, 8) and the results are averaged: By taking the average score over the eight fingerprints, we are adapting the subsampling algorithm used by Hepler et al. [25] for estimating the numerator distribution for the device identification problem by creating "pseudo camera fingerprints." We build reference sets of known matching scores and three sets of non-matching scores -trace-anchored, source-anchored, and general match -to estimate the probability of obtaining the score δ under each hypothesis. The reference set of matching scores is used to estimate the probability of obtaining the score δ if I u and F k originated from the same camera. A matching score is calculated as the correlation distance between the j-th fingerprint F j k and the noise residual X ,j k of image I ,j k , which is the -th image in fold j. Figure 3 illustrates the calculation of matching scores. In total, we calculate 8 × 10 = 80 matching scores for device C k . Note that scores calculated using the same fingerprint or the same noise residual and image are dependent, so we do not have 80 independent scores. Also, note that matching scores do not use the question image I u .
Non-matching scores require a set of alternative camera devices.
In our experiments, we set aside specific known device C k and treat the other 47 devices from our dataset as the set of alternative camera devices. To calculate a trace-anchored non-matching score, we fix the questioned image I u and calculate the correlation distance between its noise residual X u and a camera fingerprint F a from an alternative device C a .
Trace − anchored non − matching score: Δ X u I u F a .

| 981
Reinders et al. Figure 4, we calculate trace-anchored nonmatching scores between questioned image I u and each of the eight fingerprints from each of the 47 alternative devices. This results in 8 × 47 = 376 trace-anchored non-matching scores for questioned image I u . Because some of these scores were calculated with either the same fingerprint or the same noise residual and image these scores are not independent. Notice that trace-anchored scores do not use any information from the POI's device C k . Also, while we F I G U R E 3 Calculating matching scores for specific known device C k . Each camera fingerprint F j k was estimated from all training images except those in fold j. because the images in fold j were not used to estimate fingerprint F j k , matching scores are calculated between fingerprint F j k and the images and corresponding noise residuals in fold j

F I G U R E 4
Calculating trace-anchored non-matching scores for questioned image I u and specific known device C k know that C a and the POI's camera C k are not the same device, the questioned image I u could have originated from C a . However, our hypotheses ask whether I u originated from a device other than C k but do not identify the alternative source of the image. If the investigator wants to evaluate the probability that I u originated from device C a , then new hypotheses should be constructed and a new SLR with C a in place of C k as the specific known device will be calculated.
A source-anchored non-matching score is calculated between a fingerprint F k of specific known device C k and the noise residual X a of a training image I a from alternative device C a .
We calculate source-anchored non-matching scores between each of the 8 camera fingerprints from C k and each of the 80 training images from each of the 47 alternative devices for a total of 8 × 80 × 47 = 30,080 scores. Many of these scores are dependent because they are calculated from either the same fingerprint or the same noise residual and image. Figure 5 illustrates the calculation of these scores. Note that the questioned image I u is not considered in the source-anchored scores.
The last type of non-matching scores are general match nonmatching scores. To calculate one of these scores we randomly select two different devices C 1 and C 2 from the set of 47 alternative devices. Then we calculate the correlation distance between the noise residual X 1 of a training image I 1 from one of the devices with a camera fingerprint F 2 from the other device.
We also calculate Δ(X 2 , I 2 F 1 ) where X 2 is the noise residual of a training image I 2 from device C 2 and F 1 is a camera fingerprint from device C 1 because Δ(X 1 , I 1 F 2 ) is not generally equal to Δ(X 2 , I 2 F 1 ). Figure 6 shows that we calculate a general match non-matching score between the 80 training images of one device and the 8 camera fingerprints of the other device for each pair of alternative devices. This results in 47 × 46 × 80 × 8 = 1,383,680 general match non-matching scores. Again, many of these scores are dependent because they were calculated from either the same fingerprint or the same noise residual. Notice that the general match non-matching scores do not use the questioned image or the specific known device.
We do not know the true PDFs of matching and non-matching scores, so we fit PDF estimates to each set of scores and use these estimates to construct the SLR. We acknowledge that there are several possible methods for estimating these PDFs, including both parametric and non-parametric options. Nordgaard and Höglund [34] use a parametric method due to the relatively low amount of background information (they only have two camera devices to use for comparison). In contrast, we have much more background information (hundreds of images from 48 camera devices), so we chose to explore a non-parametric method. We use kernel density estimation to fit PDFs f m , f trace , f source, and f general to the reference sets of matching, trace-anchored, source-anchored, and general match nonmatching scores, respectively. Similar methods were employed in [43]. We use the MATLAB fitdist function to perform kernel density estimation. (Kernel density estimation can be performed in Python with Scikit-Learn's Nearest Neighbors library.) The kernel density es-

by fitdist is defined as
where n is the sample size, y 1 , …, y n are random samples from the unknown distribution, K is the kernel smoothing function, and h is the bandwidth. In our case, y 1 , …, y n are the scores, K is the normal kernel function [44]. We allow fitdist to choose the optimal bandwidth h.
Generally, this method of naively selecting the bandwidth will undersmooth the estimated PDFs because this method relies on the assumption of independent data, which we know we do not have due to the pairwise nature of creating the matching and non-matching scores.
Source − anchored non − matching score: Δ X a I a F k .
General match non − matching scores: Δ X 1 I 1 F 2 and Δ X 2 I 2 F 1 .

F I G U R E 5
Calculating sourceanchored non-matching scores for specific known device C k However, there is currently no method of fitting better PDF estimates for pairwise dependent data.
All the pieces are in place for us to calculate the trace-anchored, source-anchored, and general match SLRs. The numerator of all three SLR types shown in Equations (4)-(6) are estimated by fitting a PDF f m to the matching scores matching scores reference set using Equation (8) and evaluating f m at the mean similarity score δ from Equation (7). The denominator of the trace-anchored SLR is the PDF f trace fit to the set of trace-anchored non-matching scores using Equation (8) evaluated at δ from Equation (7). The trace-anchored SLR is defined Similarly, the source-anchored SLR is defined where f source is the PDF fit to the source-anchored non-matching scores. Lastly the general match SLR is defined .

| Overall performance
The Tippet plots in Figure 7 (following the convention used in [45]) show the empirical cumulative distribution function of SLR scores

| Evaluating the strength of the evidence
SLRs allow us to quantify the strength of the evidential support for H p or H d . Figures 8 and 9 group all 138,240 general match, sourceanchored, and trace-anchored log 10 (SLR) scores into intervals based on their values. Figure 8 shows log 10 (SLR) values from known matches and of general match, source-anchored, or trace-anchored log 10 (SLR) values that fall into a particular interval. Almost 69% of general match

| CON CLUS IONS
This paper presents a framework for calculating general match, source-anchored, and trace-anchored SLRs to not only address the prosecution's and defense's hypotheses in camera device identification problem, but also to provide a means of quantifying the strength of the evidence in favor of one hypothesis over the other. The dataset consists of digital images from 48 camera devices representing 26 distinct models. It includes digital still cameras, mobile phones, and one tablet. To the best of our knowledge, this is the first time camera device identification experiments using all three types of SLRs have been performed.
General match SLRs performed poorly on the dataset, while both the source-anchored and trace-anchored SLRs performed well, with the trace-anchored SLRs performing the best of the three. If this dataset were to be used as the reference dataset for camera device identification SLRs in practice, trace-anchored SLRs would be recommended for use. One large caveat, however, is that it is unknown if similar results would occur on different datasets.
Before applying SLRs in practice with a new dataset, it would be a good idea to replicate the study presented in this paper on the new dataset.
We only used RAW, center-cropped, auto-exposure, landscape- Previous work has shown that it is possible to distinguish between different models based on image artifacts created by the color filter array and the image processing pipeline [46]. We plan to leverage this in future work with SLRs where we restrict the reference dataset to close non-matches where the cameras in the dataset are the same model or brand as the POI's camera.
Several researchers [25,47] have employed an inconclusive zone where log 10 (SLR) values are considered inconclusive if t 1 < log 10 (SLR) < t 2 for a real-valued constants t 1 and t 2 where t 1 < t 2 .
These researchers considered t 1 = −t and t 2 = t for a constant t > 0.
This type of inconclusive zone gives equal weight to both hypotheses.
Future work could explore methods for choosing the best t 1 and t 2 to minimize the rates of misleading evidence. Additionally, a defense biased inconclusive zone with t 1 = 0 and t 2 = t for a constant t > 0, which places a higher burden of proof on the prosecution while granting the benefit of the doubt to the defense could also be explored.

ACK N OWLED G EM ENTS
Open access funding provided by the Iowa State University Library.