Making JPEG Images Copy-Evident

A group of academic researchers at the University of Cambridge has developed a new technique for making JPEG images copy-evident, so that users can tell whether an image has been recompressed and copied.

A group of academic researchers at the University of Cambridge has developed a new technique for making JPEG images copy-evident, so that users can tell whether an image has been recompressed and copied.

The technique, presented in a paper by Andrew B. Lewis and Markus G. Kuhn, relies on a complex method for inserting a large message into an image, which will only become visible once the image is copied and recompressed at a different level of quality. The idea is to help make it obvious to human eyes that the JPEG they’re seeing isn’t an original.

In a blog post explaining the paper and the technique, Lewis said that the idea came from observing the techniques used to protect paper money and other valuable documents.

“Our algorithm works by adding a high-frequency pattern to the image
with an amplitude carefully selected to cause maximum quantization error
on recompression at a chosen target JPEG quality factor. The amplitude
is modulated with a covert warning message, so that foreground message
blocks experience maximum quantization error in the opposite direction
to background message blocks. While the message is invisible in the
marked original image, it becomes visible due to clipping in a
recompressed copy,” Lewis wrote.

The technique could be used to help copyright owners enforce their rights over specific images if they’re clearly being copied and used for prohibited activities.

“Ideally, we would even like to have control over the conditions under which the embedded
mark becomes visible. In some applications we prefer a targeted mark, which only
becomes visible when one particular a priori known processing step is applied. (Imagine
a video that shows a warning if it has been uploaded to a particular website where all
material is recompressed with fixed settings.) In other applications, we might prefer an
untargeted mark, which becomes visible with high probability as soon as any of a number
of possible processing parameters are applied,” Lewis and Kuhn write in their paper.

The unauthorized use of material such as pictures, video and text has been a major problem online basically since the inception of the Internet. Copyright owners, media companies and others have tried various techniques–mainly variations of one kind or another on digital rights management–most of which have failed badly and quickly. The method developed by Lewis and Kuhn isn’t designed specifically for the purpose of protecting copyrighted material, and it’s not a protection method in the way that DRM techniques are. But it could have applications in that domain.

Suggested articles


  • Anonymous on

    This would work, but ....

    theres always those who will copy by 'printscreen' and therefore would make the image automatically NOT copyproof..


  • Jason on

    Heh, yea. The previous commenter sums it up. This will be largely useless.

  • Brurb on

    You understood NOTHING

    After printscreen, you have to save it as a JPEG again (or the printscreen will do it by itself). THEN the message will appear

    Did you even read the article? Do you have a computer?

  • Dan on

    To those who say this won't work - you're talking about something totally different. The blog title is also wrong - this isn't about making images "copy" evident, but "modify" evident. That is making any sort of changes to the image which requires the image to be compressed again by the JPEG algorithm will result in visual artifacts.

  • chris on

    This could be handy if it were a plug in for photoshop. After i create my artwork, or photgraph my painting, bring it in to PS, add this filter, (idealy in my own frequency choice). export.

    It'll be harder for those who want to copy it.

  • Anonymous on

    Print screen, save as png. then?

  • chris on

    I'd like to see some examples...even if they arn't the real thing.

  • on

    As if saving as png or intermediary BMP/TIFF etc is soooo difficult. JPG has it's own way to compress an image. Any other algorithm would break the copy protection fantasy.



  • Anonymous on

    And what about saving the image as a BMP or PNG?

  • Anonymous on

    This technique has existed in Photoshop for years under name Digimarc.

  • Anonymous on

    So this targets a known jpeg recompression quality factor ?  Goodluck with this being useful.

  • Anonymous on

    Yes, you can save as png but that's a very inefficient format for photos. For that kind of images a png has a larger file size than the equivalent jpeg and file size often matters even nowadays. So the watermark will appear if you eventually have to produce jpegs. If you don't, probably jpegs are not the input you need anyway.

  • Richard Clayton on

    This is not the same as Digimarc at all.

    Digimarc is a digital watermark ... it is intended to be robust under various picture transforms and is readable by special software. The scheme described here is intentionally not robust (the whole point is that the picture is distorted) and most importantly it is visible to the naked eye.

    Hence you learn if your mobile provider is messing with what you're seeing; or if you are a publisher you can ensure that low quality copies become far less useful.

  • Anonymous on

    Seems completely pointless.


    And seems to depend on specific bugs with a specific jpeg engine.    Ya know theres more than one.



  • Anonymous on

    Jesus. Did any of you read the article or comprehend it? They're targeting people who take the image and resave it, which could happen for any number of reasons (uploading to a social media site, etc.) YES, they obviously could save it as a PNG image. And to the genius who wrote, "So this targets a known jpeg recompression quality factor ?  Goodluck with this being useful." -- was it really worth your time to troll this article when you clearly couldn't bear to read the whole G.D. thing? It says -explicitly- that they would like to target known and unknown compression settings. So if you upload it to some social media site which uses a known compression level, you could target images recompressed on that site specifically. Or, if you don't know, the other desired capability would be to target any and all compression levels.

  • Anonymous on

    About the Prnt Scrn issue: First you have to copy the file. Doing a Prnt Scrn does not copy the file rather the image. Read the whitepaper. Secondly, what's to stop a prgm or person from stripping the algorithm from the copied file. Then BLAM-O...circumvented security measure
  • Anonymous on



    Just use any of the high frequency filters before saving it.

    JPEG is a broken/ineffienct format anyway.


  • Anonymous on


    1) printscreen

    2) paste into paintbrush, resize 110%, save as BMP

    3) open in photoshop , select all, resize apply favorite filter (eg blur) grade minimum

    4) resave as BMP

    5) open in paintbrush, save as jpeg , choose whatever compression.

    6) All your copy protection, are belong to us.

  • Anonymous on

    This just goes back to VHS vs BETA...

  • Anonymous on

    um duhh................ PRINT HARD COPY AND SCAN... SAVE IT AS YO MOMMA!


    This reminds me of when, they spent millions of dollars trying to making CD's rip proof.. that worked.LOL

    I guess they forgot you could just record the audio analog into the computer, save as mp3. hahahahahahh....they suck.

  • Anonymous on

    This is retarded.  They want to fuck with the higher frequencies and low-order bits?  Just fucking band pass filter the DCT, problem solved.  It's impossible to give someone a picture without giving them the ability to modify it.  If these "researchers" don't know that, they're idiots, and if they do, they're being dishonest.

    Anyone who knows what a Fourier transform is knows it.  Maybe if we taught useful math in high school, this idiocy would go away.  People on 4chan already use technologies like this to troll people into clicking on (and viewing at full size) images of goat sex...

  • Peet McKimmie on

    I find myself wondering if, as the encoding of the message relies on quantization, what will happen if you view the original, unmodified image on a less-than-truecolour screen such as 16-bit colour on an older Netbook?

  • Anonymous on

    re the doesn't work comment... That's because the demo is a fake.  It uses two images:

  • Dan on

    Everyone is still missing the point! Even if you save in a non-lossy format like PNG, GIF, BMP, whatever, the image will still be comprised of the same exact pixels as the JPG.  Thus as soon as anyone converts the image to JPG the artifacts will appear.  For example, someone is violating copyright and is using your image on their website.  You take them to court, have an "expert" take the image from their website, save it as a JPG, and boom - your hidden watermark appears.  Well, there you go.  This is also useful for checking image manipulation.  If two images are spliced together then the artifacts / watermark will not match.

  • oldfrog on

    I second the fact it doesn't work.  I downloaded the sample image with ps cs5 put a brush stroke in a corner and saved it.  "VOID" did not appear.

  • Anonymous on

    The other thing that this misses is that introducing this high frequency stuff into the image reduces its quality.  JPEG images are of marginal quality anyway...this makes matters worse.   There are of course a dozen ways to remove the mark if you are remotely "in the know" or can read a How-To on a web site.

    I suspect that the only practical use for this is to at least deter people from posting copyrighted images to web sites that re-compress the image...and that's an exceedingly nasty thing to do from a quality perspective anyhow.


  • Anonymous on

    Credit where it's due for their effort but I tried this in GIMP too and had assorted results. I wrote the word "test" on a new layer, saved it as a new jpeg, used the preview to see what the image would look and played around with the compression. I was only able to see the word void at 60% and 65%. I saved the image in 50%, 75% and 100% and opened it with a couple different apps and I couldn't see the void... well I could see it on 100% but only to the aspect that I could see it very lightly on the original too while it still existed on the blog site.

  • jasper on

    On a linux system:

    • wget
    • for q in 40 45 50 55 60 65 70 75 80 85 ; do
    • jpegtopnm copy-background.jpg| pnmtojpeg --quality=${q} > recompressed.${q}.jpg
    • done

    and look at the resulting images - i see VOID clearly at quality=50, so if your trying this for yourself try recompressing at quality=50.



  • Anonymous on

    I don't know if it's foolproof or not, but Geordi LaForge in Star Trek would be proud of how he explained it.  Do they use the main deflector dish to do the conversion?

  • Anonymous on

    It doesn't matter anyhow.  the example in the white paper is faked.   Don't believe me? do this.  save the image, open in paint.  add a line, save void words. 

    Open the original in photoshop. save with a compression of 3...still no void words.  It's all theory but doesn't actually work.

  • Anonymous on

    Write a Perl script that:

    1) loads the image using ImageMagick tools

    2) converts pixel data to floating point

    3) Make the image 8 times larger with a non-linear algorithm

    4) slightly randomize the pixel values

    5) reduce to original size and to original pixel format

    6) write to jpeg file

    7) ???

    8) Profit!

    Optionally repeat method n times

  • Kisa on

    Wow people are missing the point big time.

    "Copy-evident", eg someone takes the image ... makes any change to it, eg pasting someone elses face and their own watermark on it, will be comepletely visible in the recompressed image. That's the point. It's not about making the image completely useless so that people can't steal it or some stealth DRM.

    And yes it's defeatable... by not recompressing the image, but it would still be copy-evident if the image is changed as the areas of the image changed would lack the pattern in the rest of the image.


    Don't worry, the days of making idiot image macros from 4chan over photos are still safe.

  • Caiti Voltaire on

    It is very easy to selectively filter out bad pixels, either manually in Photoshop or algorthimatically in the Postscript source.  This is essentially a lot of hubbub about nothing, and even more DRM-esque stuff that the Internet would be better off without.

  • Anonymous on

    sorry. scheme fail.


    I took the "original" image, which is at   right-clicked, chose "Copy", pasted it into Photoshop, saved it as a .jpg at 50% quality and saved it to

    no "magic message" showed up, if it's that easy to circumvent, then I don't think it has anything near usefulness to it ATM.

  • Mikael on

    This thread is hilarious.

    Most people who paste their face on a picture of Lindsay Lohan, or whatever, probably gets the celebrity's picture from somewhere on the net where it was at some point published as a relatively lossy JPEG. There is virtually no way they can make it unlossy. Conceivably they could do a whole number of things, but if they are about as tech savy as the people posting here... They have no chance of covering their tracks.

  • LindaPinda on

    Thanks for the new vocabulary list. I so enjoy learning stuff. :)

  • Problem? on

    It 's not a "problem" that images can be copied online, that's the point of the internet.  If you don't want your images copied, don't put them on the internet!


    It cracks me up, some sites put up photos, and then whine when thumbnails show up on their google images site.  (Despite that it drives traffic for them). 


    The entire internet works by copying...  When you view a web site:

    1. The web server reads the HTML and image files you ask for from disk and COPIES them into memory.

    2. Then it sends a COPY of those files over the network, where COPIES may be retained by various proxy servers and caches.

    3. Then your web browser recieves a COPY of this data, and normally caches a COPY on the disk and a COPY in memory.

    Then someone comes along and says "Hey! don't copy my stuff!" - they don't really understand how things work, do they?Obviously copies have to be made, that isn't the issue, the problem is more when they are used for evil purposes by those other than the creator - but again, if you're so afraid of that, you should never put them online in the first place.

  • Anonymous on

    so what if I grab it off the screen using something like Snag It?? Then save as different format like .png or whatever?? 

  • Anonymous on

    Unless I am very much mistaken, once the technique is know, it would be pretty easy to develop a filter that removes the high-frequency water-marking data, allowing you to re-compress the image, with a barely-noticeable loss in quality.

  • GT Simo on

    This is great news for photographers.  It would deter a dodgy person using a photographer's full-size image (mine, taken on a 10MP DSLR, are around 3872x2592 and 8MB) without consent.  For a photographer, sometimes the only way to get people to talk to you is to post their work on a Photo-sharing website.

  • Nabil Stendardo on

    There seem to be three kinds of inventions. The first is one that can serve its purpose even if we are the only person using it. The second is one which serves its purpose if other people also use it (the telephone comes to mind, and the fax, the internet, social networks, etc.), while being useless if only one person uses it. The third one, which is the most insidious and useless, serves its purpose only if EVERYONE with no exception uses it (as opposed to any alternatives), and usually there is no incentive to use it. I remember going to an invention fair where I saw some kind of cigarette which can become "locked" in presence of an emitter so that one may have non-smoking buildings. What incentive would the smoker have to get one of those cigarettes. None! So, USELESS. Only a government ordained obligation can make this invention useful (and that is bordering on the abuse of our freedom). This is the same for watermarking images to detect modification. If everyone uses this system (without being able to crack it), it can work. But again, there is no incentive for everyone to do this.

    About this invention (of making modifications self-evident), not only is it useless, it can also easily be cracked. As one commented before, any simple processing will destroy such a mark (such as a 1-pixel crop + optional interpolation, compressing in another format than JPEG, etc.). And since it is visible, that also helps for it to be removed.

    JPEG is a crappy format anyway. The only reason why people use it is that it's (as far as we know) patent free, and JPEG2000 (which I don't think has patent restrictions associated) isn't that good (wavelets have a low visual quality/psnr ratio).

  • dermoth on

    I tested myself using GIMP, the void would show only for a small compression range, and not even a very good one: ~ 55-65% (most visible at 60%, fades out both ways). No one compress willingly JPEG's at 60% anymore...

Subscribe to our newsletter, Threatpost Today!

Get the latest breaking news delivered daily to your inbox.