A New Hope for PRNU on Modern Smartphones? Evidence That Device-Specific Fingerprints Survive Computational Photography
Authors: Benjamin Loison, Quentin Bammey, Thibaud Ehret, Rafael Grompone von Gioi, Pablo Musé, Marina Gardella
Organizations: Agence Ministérielle pour l'IA de Défense, France · ENS Paris-Saclay, Université Paris-Saclay, CNRS, Centre Borelli, Gif-sur-Yvette, France · Télécom Paris, Institut Polytechnique de Paris, LTCI, Palaiseau, France · IIE, Facultad de Ingeniería, Universidad de la República, Uruguay
Photo Response Non-Uniformity (PRNU) is widely regarded as the most reliable marker for source camera identification. Recent studies, however, report high correlations between images and fingerprints from different modern smartphones, which calls into question the discriminative power of PRNU on these devices. Using 30 recent smartphones under controlled acquisition conditions (e.g., no digital zoom), we investigate whether the fingerprint itself is at fault or the way it is compared. We find that a component shared by all fingerprints of the same model inflates the standard signed peak-to-correlation energy (sPCE). To counter this, we propose ΔsPCE: the sPCE between a query image and a candidate camera's fingerprint, minus the mean sPCE between that image and the fingerprints of the remaining candidates, in the spirit of T-norm score normalization. ΔsPCE improves attribution accuracy, suggesting that the device-specific PRNU signal is still present. Although the limited dataset size and the dependence of ΔsPCE on the candidate camera set currently restrict operational applicability, these results suggest that PRNU-based attribution of modern smartphones remains feasible when fingerprints are compared appropriately.
Figures & tables
Smartphone-software-version
Inst.
Ref. img.
Ref. PRNU
Test img.
Match corr.
Mismatch corr.
Google Pixel 10 Pro XL
4
80
4
80
80
240
Google Pixel 10 Pro
6
120
6
120
120
600
Samsung Galaxy S25 Ultra OS SxxR
5
100
5
100
100
400
Samsung Galaxy S25 Ultra OS Sxx5
3
60
3
60
60
120
Samsung Galaxy S25 Ultra OS SxxB
2
40
2
40
40
40
Apple iPhone 17 Pro Max iOS 26.2
4
80
4
80
80
240
Table 1: Description of the dataset and experiment statistics. The dataset consists of a total of 1 200 images acquired with 30 smartphones of 8 different software versions, among three brands. Mismatching correlations of rotated test images are not counted. For example, for the Google Pixel 10 Pro XL, 4 instances and 40 images per smartphone are collected; these images are split into 20 references images and 20 test images per instance, leading to a total of 4×20=80 reference images and 4×20=80 test images; a reference PRNU is computed per instance, counting 4 in total; for each of the 80 test images, 80 matching correlations can be computed, relative to the corresponding PRNU reference of the same smartphone; for each of the 80 test images, 3×80=240 mismatching correlations can be computed relative to the PRNU references of the 3 other smartphones of the same class. For the Samsung software version, SxxR, Sxx5, SxxB correspond to S938BXXS7BYLR, S938USQSBCZF5, S938USQS8BZBB, respectively.
Camera model
Count of metadata profiles
Google Pixel 10 Pro XL
4 (1), 2 (3) and 1 (10)
Google Pixel 10 Pro
6 (1), 2 (1) and 1 (9)
Samsung Galaxy S25 Ultra
5 (1), 3 (1), 2 (9) and 1 (41)
Apple iPhone 17 Pro Max
4 (2), 3 (1), 2 (3) and 1 (42)
Table 2: Count of users per smartphone model metadata profile with at least 40 images, including 20 portrait ones. X(Y) means that there are Y metadata profiles common to X users.
Figure 1: sPCEs computed per smartphone-software-version. sPCEs between a test image noise residual and an estimated PRNU of the same user are reported in green and sPCEs between a test image noise residual and an estimated PRNU of a different user are reported in red . The sPCE threshold per software version inferred from 5% FPR are drawn in blue . While sPCEs between a test image and an estimated PRNU of the same user are a bit higher than sPCEs between a test image and estimated PRNUs of different users, the Apple iPhone 17 Pro Max show very similar distributions. As a result, setting a sPCE threshold to separate the best both distributions is ineffective.
Figure 2: sPCEs computed for Google Pixel 10 Pro smartphones. sPCEs between a test image noise residual and an estimated PRNU of the same user are reported in green ; sPCEs between a test image noise residual and an estimated PRNU of a different user are reported in red . From one instance to another, there is a very similar distribution of sPCEs between test images and the estimated PRNUs of different users. However, the distribution of sPCEs between test images and the same user’s estimated PRNU varies widely from one instance to another, even when accounting for the two sPCE ranges. This difference is especially visible in instance 3.
Figure 3: Δ sPCEs computed per smartphone-software-version. Δ sPCEs testing the correct source camera are denoted in green , while Δ sPCEs testing an incorrect source camera are denoted in red . The Δ sPCE threshold per software version inferred from 5% FPR are drawn in blue . Apple iPhone 17 Pro Max Δ sPCEs testing the correct source camera are significantly higher than Δ sPCEs testing an incorrect source camera. As presented in Table 3 , this substantially improves the separability of both same source and different source distributions thanks to a Δ sPCE threshold compared to a sPCE threshold shown in Fig. 2 .
Figure 4: ROC curves computed from Google, Samsung and Apple smartphones. The true positive rate with a 5% false positive rate is denoted by a dot. Green ROC curves rely on a Δ sPCE threshold and blue ROC curves rely on a sPCE threshold.
sPCE
Δ sPCE
Smartphone software version
TPR
t
TPR
tΔ
TPR difference
Google Pixel 10 Pro XL
52.5
2 051
77.5
483
25.0
Google Pixel 10 Pro
50.8
2 652
60.0
908
9.2
Samsung Galaxy S25 Ultra OS S938BXXS7BYLR
30.0
1 117
44.0
440
14.0
Samsung Galaxy S25 Ultra OS S938USQSBCZF5
51.7
1 802
63.3
828
11.6
Samsung Galaxy S25 Ultra OS S938USQS8BZBB
47.5
719
70.0
68
22.5
Table 3: Observed TPR (in %) for 5% FPR. When considering a Δ sPCE threshold instead of a sPCE one, all software versions of all models have a significantly higher TPR. For instance, the Apple iPhone 17 Pro Max iOS 26.1 TPR increases from 11.2% to 93.8% by leveraging the Δ sPCE threshold. Δ sPCE TPR - sPCE TPR is denoted as TPR difference measured in %..
Identifying the device that captured a digital image is a central task in image forensics, made more urgent by pervasive smartphone photography and the rise of AI-generated imagery. This paper compares three source camera identification (SCI) approaches - Photo Response Non-Uniformity (PRNU) analysis, JPEG compression artifact analysis, and a convolutional neural network (CNN) - on images from four smartphone devices (Xiaomi Redmi Note 10S, Samsung Galaxy S24, iPhone 13 Pro Max, and iPhone 17 Pro). For each method, discriminative features are extracted (DCT coefficient statistics for JPEG artifacts, denoised noise residuals for PRNU, and learned convolutional features for the CNN) and classified with an SVM (JPEG, PRNU) or trained end-to-end (CNN), using an identical fixed, stratified 70/30 train-test split for direct comparability. The DCT/JPEG-artifact-inspired classifier achieves the highest accuracy (0.90), followed by the PRNU-inspired method (0.71), while the CNN baseline reaches only 0.29. Under this experimental configuration, the DCT/statistical and PRNU-inspired approaches outperform the evaluated CNN baseline. The results motivate evaluation on larger, format-balanced datasets and investigation of hybrid or learned approaches under more robust validation protocols.
Mansur Ozaman
Nazarbayev Intellectual School of Science and Mathematics in Medeu District of Almaty
Passive fingerprints (intrinsic traces naturally left by generators) have been shown to enable attribution in speech deepfake detection, yet their persistence, reproducibility, and content-independence remain unverified. Moreover, no prior work distinguishes perceptible from imperceptible fingerprints, although the two have very different implications for attribution reliability. Perceptible fingerprints, such as emotional expression, are shaped by perceptual quality objectives and may change across model updates, whereas imperceptible fingerprints are not explicitly optimised by current training objectives and are rarely considered in existing dataset design or training strategies, as they have limited influence on downstream applications. We therefore propose a Perceptible-Imperceptible Passive-fingerprint Diagnostic Protocol (PIPDP) to define and separately analyze these two fingerprint types. PIPDP comprises three complementary analyses: multi-evidence fingerprint verification through residual-energy, reproducibility, and saliency analyses, perceptually transparent perturbations preserving audio quality, and prompt-driven emotion change that modifies perceptible fingerprints without model retraining. Experiments across ten speech generators and three attribution detectors show that imperceptible fingerprints provide persistent attribution cues. Perceptually transparent perturbations reduce attribution accuracy by up to 48.2% on HiggsAudioV3, whereas emotion-driven changes leave attribution largely unchanged, with only about a 1.0% accuracy variation across emotions on CosyVoice2 using w2v-bert-MLP. These results suggest that imperceptible fingerprints are more reliable for trustworthy attribution.
Yupei Li, Qiyang Sun, Emmanouil Benetos +2
1Imperial College London · 4Technical University of Munich · 2Queen Mary University of London +1
The objective of this work is to propose a novel methodology for the finger knuckle print recognition, which is essentially a digital photo of the finger-knuckle region. We have employed very simple concepts of visual computing such as a filter based on the Sobel operator for finding edges and a simple noise reduction algorithm. These operations are exceptionally fast and produce binary images, which are very efficient to process and to store. Furthermore, alongside this preprocessing, some similarity measures were also regarded and evaluated for the task. After preprocessing an input finger it is compared to all the images of fingers in the dataset, one by one. We have obtained up to 17.02% of successful recognitions (true positive rate) with a large dataset.
E. O. Rodrigues, T. M. Porcino, Aura Conci +1
*Department of Computer Science, Universidade Federal Fluminense, Rua Edmundo March s/n - Boa Viagem, Niterdi - RJ, 24435-030, Brazil. · Department of Electrical Engineering, Universidade Federal do Maranhão, Av. dos Portugueses s/n - São Luiz - MA, 65085-580, Brazil.