Countering the Pooled Triangle Test for PRNU-based camera identification

We analyze the security of the pooled triangle test in [1] against Counter-Forensic attacks. First, a new attack is proposed, relying on a block-wise variance-based estimation of the fingerprint. The new attack permits to reduce greatly the accuracy of the pooled test, thus outperforming state of the art methods which are in general effective only against the single-image version of the test [1]. Then, a randomized version of the newly proposed attack is introduced to increase its security. The randomized version of the attack maintains good performance even when an attack-aware version of the pooled test is applied. Extensive experiments are carried out in a very general setting, also permitting to show that the performance of the pooled triangle test in the presence of attacks greatly depend on the test parameters, and in particular, on the relationship between the number of images used to run the test and the cardinality of the set of images used for the attack.