Looking to implement C2PA? Trufo provides tooling to take care of everything from certificates and timestamping to watermarking and fingerprinting. Learn More

Research

Introducing Differential Analysis

A new type of hash that localizes and classifies content modifications.

Jiaxin Guan · October 21, 2024

When labeling content, one key requirement is that the content labels are accurate. On the encoding side, this means making sure that the information included in the label is trustworthy. On the decoding side, this means making sure that any significant differences between the original version and the observed version are identified.

A photo overlaid in green with unchanged regions and in red where a text overlay and a replaced strip were detected — Example of a differential analysis result.

Identifying these differences is incredibly important: without it, a bad actor can modify or even completely replace the content, resulting in a misleading (and harmful) content label.

Hand-drawn diagram of several honest signers producing validly labeled photos while a forger's attempt is blocked, and a verifier asking which of two claimed sources made an image — Labels should attribute content to its signer — and be unforgeable by anyone else.

The simplest solution is to add a digital signature to the content label. The digital signature can prove that the content has not been changed since it was signed.

Hand-drawn diagram of a signer watermarking a signed hash into an image and a verifier extracting and checking it — Signing and verifying a content label.

If the content is changed in any way, the digital signature breaks.

Hand-drawn forgery game: an adversary receives a signed image from a challenger holding a key pair and must produce a different image that still verifies, which implies a hash collision — The forgery game: producing a different image that still verifies requires breaking the hash.

This allows us to (mostly) trust content labels if the digital signatures are intact.

Hand-drawn flow: a valid watermark implies the watermark was created by the key owner, such as a camera, AP News, or The Onion; whether the image is real then depends on trusting that owner — A valid signature reduces the question to whether you trust its owner.

Digital content, however, is often changed in benign ways. When you export a photo from your iPhone, the file format is changed from HEIC to JPEG (in this case, because HEIC is patent-encumbered). When you attach an image to send via email, the file is compressed and likely resized. And when you crop, clip, or apply a color filter, the content is changed.

Hand-drawn diagram of content passing from sender through internet editors applying crops, filters, compression, and malicious edits before reaching a receiver — Content is routinely edited — benignly and otherwise — on its way to the receiver.

In all of these cases, the digital signature breaks.

Hand-drawn slide titled 'Allowing (benign) changes is non-trivial': a receiver gets both benignly and maliciously edited copies, and verification alone cannot tell which is which — Allowing benign changes is non-trivial: verification alone cannot classify an edit as benign or malicious.

Trufo’s cryptography lab has developed a new type of hash to do exactly this: a differential hash.

While perceptual hashes focus on quantifying how similar two items are, differential hashes focus on identifying differences between two items. As a result, perceptual hashes are most suited for efficiently finding matches in a database (i.e. fingerprinting), such as Google’s reverse image search and YouTube’s copyright infringement detection. In contrast, differential hashes are most suited for localizing and classifying any modifications made after the match has been found.

Hand-drawn equation showing that the difference of two differential hashes approximates the difference between the edited and original images — The differential hash: the difference of two hashes reveals the edits themselves.

We use this new invention, along with other tools, to provide differential analysis.

Three images: a Trufo-watermarked squirrel photo, an inPixio-modified version, and the raw differential analysis highlighting the changes — From left to right: Trufo watermarked, inPixio modified, Trufo raw differential analysis.

As a result, you can quickly see where and what changes have been made — without the privacy concerns of storing (with Trufo or with anyone else) a copy of the original.

And lastly, this means that the authenticity of your content is not completely reliant on every individual and every application that touches your published content to correctly validate and reapply a series of digital signatures. Even if the provenance chain is broken, Trufo’s differential analysis will still work.