Mitigating S-RAHA: An On-device Framework to Prevent Forwarding of Re-Captured Images
arXiv:2604.12178v1 [cs.CR] 14 Apr 2026
Keshav Sood*[0000-0002-2127-1438] , Iynkaran Natgunanathan*[0000-0003-4215-000X] , Purathani Praitheeshan*[0000-0003-0569-9925] , and Praitheeshan Kirupananthan**[0009-0008-9662-5289] *School of IT, Deakin University, Geelong, VIC 3217, Australia ** Redshield Security Pty Ltd, Sydney, 2000 {s224289198, keshav.sood, iynkaran.natgunanathan}@deakin.edu.au [email protected], [email protected]
Abstract. Protecting sensitive visual content from unauthorized redistribution is a growing challenge for privacy-focused mobile applications, including dating platforms. Screenshot-prevention mechanisms, rely on server-side monitoring or are limited to digital screenshot detection, are commonly deployed to stop forwarding sensitive images. However, an adversary uses another smartphone to take a photo of the mobile-screen, in this scenario the existing solutions offer no protection against psychically screen-recapture attacks. Since the attack happens in the physical plane rather than on a digital plane and shows a void/hole in the existing solutions, we name this the Screen-Recaptured Analog Hole Attack (S-RAHA). Such physically recaptured images bypass digital safeguards and can be freely forwarded, creating substantial privacy, personal-safety, and forensic risks. We present a low computational secure-by-design ondevice framework that aims to detect and prevent the forwarding of recaptured images directly to the user’s device. The proposed system integrates a deep learning–assisted recapture detection model capable of distinguishing original digital content from camera-to-screen captures under diverse environmental conditions, together with an on-device enforcement mechanism that automatically blocks the sharing of suspected recaptured images between applications. We also introduce the concept of an invisible metadata identifier (IMI) that can be embedded into protected images to enable forensic traceability of potential leakage paths. Although the IMI component is explored at a conceptual and feasibility level rather than fully implemented, it demonstrates a promising direction for integrating lightweight, invisible identifiers into client-side security architectures. Keywords: Analog Hole Attack · Re-captured Images · Identify Deception · User Privacy · screen-recaptured
2
Sood et al.
1
Introduction
Mobile devices have become the dominant medium for sharing visual content across social, professional, and personal communication platforms. Applications such as dating apps, telehealth systems, secure law-enforcement communication tools, and private social networks handle highly sensitive images. However, once displayed on a user’s screen, such images are vulnerable to redistribution. Even when an application disables screenshots or prevents direct forwarding, adversaries can bypass these protections through screen-recapture attacks, where the displayed content is photographed using another mobile device. The resulting image is an ordinary photograph and can therefore be freely shared, creating significant privacy, personal-safety, and forensic risks. A high-level illustration of this scenario is shown in Fig. 1 below. We call it the S-RAHA.
Fig. 1: The proposed screen-recapture analog hole attack (S-RAHA).
Early work in screen-recapture detection or image recapture-detection (IRD) has demonstrated that recaptured images exhibit distinctive artifacts caused by the display–camera pipeline, such as texture inconsistencies, illumination non-uniformity, and geometric distortions. Some commonly used approaches are based on moiré patterns [1], texture and blur analyses [2], chromaticity inconsistencies detections [3], specularity distribution checks, and illumination patterns check [4]. Still, the current screen-recaptured image detection currently faces significant challenges as high-resolution 4K/OLED displays technology minimize the physical traces, like moiré patterns, that systems rely on for identification. These forensic tools often struggle with generalization. Also, the lack of diverse, high-quality training datasets and the advances generative tools used by attackers [5], [6] in which they intentionally add noise to mask recapture signatures, make it highly difficult to maintain high detection accuracy in general. The work done by Ke et al. extracted multiple low-level statistical features including blur, color distribution, and texture variation to distinguish recaptured
Title Suppressed Due to Excessive Length
3
images from originals, achieving strong performance across different display and camera combinations [7]. Further, the authors [8] advanced the field by learning discriminative dictionaries of edge profiles to improve robustness against variations in viewing conditions and device types. More recently, domain-generalized and few-shot learning approaches have been proposed, including multi-scale residual feature extraction and attention-based fusion, enabling IRD models to generalize better to unseen devices and recapture settings [9, 10]. Dedicated smartphone recapture datasets have also been developed to support evaluation and training of modern IRD algorithms [11]. Parallel research in digital watermarking aims to embed invisible, robust information into visual content for copyright protection, authentication, and forensic tracing. For instance, Bai et al. introduced SSDeN, a deep watermarking framework specifically designed to resist screen-shooting distortions by modeling realistic camera-to-screen noise [12]. Similarly, Cao et al. proposed a universal deep watermarking method resilient to screen-shooting attacks and deviceinduced degradation [13]. More advanced methods such as scale-adaptive U-Net watermarking with dynamic noise modeling have demonstrated strong robustness even under severe screen-cam distortions [14]. While these approaches [15], [3], [2], [5], [16], [17] enhance post-incident detection and tracing, they do not directly prevent the redistribution of recaptured images (the attack shown in Fig. 1), leaving a gap for secure-by-design preventive mechanisms. In addition, screenshot-prevention flags provided by mobile operating systems can be circumvented using an external camera; server-side monitoring is based on user compliance or network connectivity; and watermark-based forensic pipelines operate after the incident. Our contributions are as follows. – 1) We revisit the analog hole attack problem in modern mobile ecosystems; the problem is almost unexplored at all and we named it the ScreenRecaptured Analog Hole Attack (S-RAHA). No matter how many digital restrictions (screenshot blocks, one time view, etc.) are placed, an adversary can still successfully execute this attack. – 2) We propose a secure-by-design, client-side (on-device) framework that integrates recapture detection, leakage prevention, and conceptual forensic tracing. The framework is robust and capable enough to distinguish digitally rendered images from camera-to-screen captures under varied lighting, angles, and device types. It provides an enforcement mechanism to automatically blocks forwarding of suspected recaptured images. A simplified version of the web application is presented to demonstrate its’ technical feasibility. – 3) We proposed a conceptual IMI and its feasibility as well for future integration which aims to support forensic traceability of leakage paths. Benefits:- The proposed attack highlights the severity of the issue and motivates the need for effective mitigation strategies. The proposed secure-by-design solution brings its own advantages, i.e., a) mitigating the identified issue during the design phase and on-device is far more cost-effective, b) minimize potential entry points for attackers, c) easier to meet stringent standards such as GDPR, ISO 27001, and d) enhanced customer trust.
4
2
Sood et al.
Related Work
We review academic work in interconnected areas: image recapture detection, digital watermarking for screen-shooting robustness, and mobile privacy controls. Image recapture detection:- Early work on recapture detection focused on handcrafted features exploiting artifacts from the screen-camera capture pipeline. Ke et al. [7] combined 136 low-level descriptors (blur, color distribution, texture) with an SVM classifier, achieving 97.2% detection on a smartphone recapture dataset, though the low-resolution images used limit generalizability to modern capture scenarios. Further, Thongkamwitoon et al. [8] argued that edge blurriness is the most scene-independent recapture cue and developed a dictionary-learning approach using K-SVD [18] to classify images based on line spread profiles extracted from sharp edges. Their method achieved >99% true positive rate for recaptured images using only two features, representing a significant advance in parsimony. However, it relies on classical machine learning with hand-engineered features evaluated only on LCD displays under controlled conditions, and is not integrated into any enforcement pipeline. More recently, domain-generalized and few-shot learning approaches have improved IRD robustness across unseen devices. Luo et al. [9] proposed multi-scale residual feature extraction with attention-based fusion for better generalization to unseen display-camera combinations. Hussain et al. [10] framed IRD as a few-shot learning task, enabling reliable detection with scarce labeled data from new device pairs. Dirik et al. [11] released a dedicated smartphone recapture benchmark providing controlled references across handset and display combinations. While these methods advance detection accuracy, they remain standalone classifiers without client-side enforcement integration. Deep watermarking robust approaches:- Bai et al. [12] introduced SSDeN, a deep watermarking network trained with a differentiable screen-shooting noise model. Cao et al. [13] generalized this with a device-agnostic training scheme, and Liu et al. [14] further strengthened robustness via a scale-adaptive U-Net with dynamic noise augmentation. Mobile privacy controls and their limitations:- Current mobile operating systems (OSes) offer screenshot-prevention flags (e.g., Android’s FLAG_SECURE) that block software-based capture but have no effect against physical recapture attacks. Server-side monitoring requires continuous connectivity and platform cooperation, while post-incident forensic pipelines are reactive. These limitations, together with the fact that existing approaches [2, 3, 5, 15–17] do not directly prevent redistribution of recaptured images, motivate the client-side, zero-trust architecture proposed in this paper. Key Gaps:- These approaches are complementary but fundamentally different from our framework: they do not stop S-RAHA and they operate post-incident for attribution, whereas our work also incorporates a conceptual watermarkinginspired component (IMI) as a forensic layer within a preventive architecture. In Table 1, we discuss similar market product’s overlapping capabilities and key differences; and the novelty of our work in Table 2.
Title Suppressed Due to Excessive Length
5
Table 1: A high level comparison with real market products Product Description Overlapping capabilities Key differences VeraSnap Offering cryptographic VeraSnap achieves 96%+ VeraSnap focuses on v1.5 evidence capture with detection accuracy with capture-time verification multi-sensor fraud detec- 5% false positive rate, to prove content authention specifically targeting processing entirely on- ticity, while our proposal screen recapture. device. emphasizes post-capture enforcement to prevent unauthorized redistribution. Truepic It provides digital con- Image authenticity verifi- Based on cryptographic tent authenticity infras- cation, detection of ma- signing and metadata tructure, the vision plat- nipulated content, and analysis rather than form enables remote im- integration with mobile recapture-specific deage verification. capture workflows. tection algorithms, server-dependent verification model vs. client-side enforcement, proving authenticity rather than blocking redistribution. DeepMedia Detects digital harms AI-powered detection of Broader focus on deepAI including deepfakes, manipulated imagery, fakes and synthetic impersonation, and AI- real-time processing ca- media vs. specific recapdriven misinformation pabilities. ture attack detection, across video, audio, and primarily government image media. contract-driven rather than commercial mobile application integration, post-incident analysis orientation vs. preventive enforcement. Magnet Magnet Forensics pro- Digital forensics and evi- Desktop forensic workForensics vides digital investigation dence analysis, image and station tools vs. mobile software for law en- video processing, law en- on-device solution, forcement, government forcement customer base. post-incident investigaagencies, and enterprises. tion focus rather than real-time prevention, comprehensive digital evidence platform vs. specialized recapture detection. Amped Amped Software North Image enhancement and Laboratory/workstation Software America develops foren- tampering detection, environment vs. mobile sic software for image and forensic analysis tools, deployment, manual video analysis in security law enforcement focus. forensic examination and investigative sectors. workflow vs. automated enforcement, post-capture analysis vs. real-time blocking.
6
Sood et al.
Table 2: Novelty assessment of our solution Criteria Description Integrated detection and While multiple vendors offer recapture detection capabilities as disenforcement architecture cussed in Table 1, they verify authenticity at capture time but do not prevent subsequent redistribution (exmaple VeraSnap), they provide post-incident forensic analysis (Magnet Forensics, Amped Software), they rely on server-side monitoring requiring network connectivity (Truepic). Our proposal implements a zero-trust, client-side solution that both identifies recaptured content and blocks its’ forwarding without requiring server validation or user compliance. Mobile-first prevention The digital evidence management systems market focuses predomivs. forensic analysis nantly on post-incident investigation and evidence preservation. Companies like Cellebrite, OpenText, and CentralSquare provide platforms for collecting, storing, and analyzing digital evidence after security incidents occur. Our solution represents a paradigm shift toward preventive security by blocking unauthorized redistribution before it occurs, specifically addressing the threat model of privacy-focused mobile applications (dating platforms, secure messaging, law enforcement sharing systems). Invisible Metadata Identi- The IMI concept introduces a novel forensic capability beyond binary fier (IMI) for traceability detection. While the component remains at conceptual/feasibility stage, it addresses a critical gap: when recaptured content does escape, organizations need to trace leakage paths to identify compromised users or devices. Existing watermarking approaches (forensic watermarking used by Irdeto for content protection) operate postincident and require visible or detectable markers. The IMI concept aims for invisible, lightweight identifiers embedded directly into clientside security architectures. Addressing the screen re- As noted in forensic research, recapture attacks defeat verification capture attack vector systems by creating genuine camera captures of manipulated content, erasing forensic traces that would normally reveal editing. The attack requires no sophisticated equipment — any smartphone can photograph a screen. Most authentication solutions focus on: screenshot prevention (bypass-able with external cameras), metadata consistency (eliminated through recapture), compression artifact analysis (reset by new capture process). Our solution specifically targets this overlooked attack vector with dedicated detection algorithms analyzing physical artifacts (moiré patterns, chromatic aberrations from display backlighting, focus distance characteristics, doubled tone mapping). Commercial application While government and forensic markets are well-served by existing integration gap vendors (Magnet Forensics serves 4,000+ law enforcement customers; DeepMedia AI holds Department of Defence contracts), commercial mobile application integration remains under-served. Social media companies, dating platforms, and secure messaging services require lightweight, privacy-preserving solutions that do not introduce server dependencies or user friction. Our on-device architecture addresses regulatory compliance needs (the technology can help platforms be compliant with regulations) while maintaining user experience. Remarks on the develop- The proposed solution currently sits at concept validated in lab scale, ment stage and commer- with simulation testing completed. To further test it on real-world, cialization considerations ethics approval is needed for further analyses to validate the accuracy and efficiency of the proposal. The potential adopters including Australian Federal Police (and across the globe), government cyber forensic agencies, and social media companies seeking regulatory compliance.
Title Suppressed Due to Excessive Length
3
7
Threat Model and Problem Formulation
Attack scenario:- Consider a mobile application geared toward privacy, such as a dating platform or a secure messaging system, where users exchange sensitive visual content under the assumption that it remains confined to the application environment. Modern mobile operating systems provide mechanisms (e.g., Android’s FLAG_SECURE) to prevent direct digital capture, but these are limited to software-based capture and offer no defense against physical recapture attacks, wherein an adversary photographs the displayed content using a secondary device. The proposed attack (S-RAHA) proceeds in three steps: (1) the victim’s device displays protected content (Iorig ), (2) the adversary uses a camera-equipped Device B to photograph the screen of Device A, producing Irecap , and (3) Irecap , being an ordinary photograph with no forensic markers linking it to the source, is freely redistributed through any channel. This is particularly concerning because the recaptured image bypasses all application-layer controls, embedded watermarks or metadata may be degraded during the screen-camera process, and the adversary requires only commodity hardware. Adversary model:- We consider an adversary with legitimate access to the device displaying protected content and a second smartphone for recapture. The adversary can control lighting, camera positioning, and viewing angles to optimize recapture quality, and may apply basic post-processing (brightness/contrast adjustment, cropping, rotation) before redistribution. The adversary is aware of screenshot-prevention mechanisms and seeks to circumvent them through physical recapture, but does not have white-box access to the detection model (black-box probing remains possible) and uses commodity smartphones rather than professional equipment. Critically, the screen-camera capture process inevitably introduces detectable physical artifacts—moiré patterns, illumination non-uniformity, geometric distortions, reduced sharpness, and color shifts—which form the basis for our detection approach. Security objectives:- The framework aims to: (1) accurately distinguish Iorig from Irecap under diverse conditions (lighting, angles, screen types, devices), (2) automatically block forwarding of detected recaptured images client-side before they leave the device, (3) enable forensic traceability via invisible identifiers surviving the recapture process, (4) maintain usability with low latency and minimal false positives, and (5) resist evasion attempts including post-processing, geometric transformations, and varied capture conditions. Problem formulation:- Let Iorig and Irecap denote the distributions of original and recaptured images. Our goal is to learn a classifier f : RH×W ×3 → {0, 1}, where H and W denote the image height and width in pixels and 3 represents the RGB colour channels, such that:
f (I) =
( 0 1
if I ∼ Iorig (original) if I ∼ Irecap (recaptured)
(1)
8
Sood et al.
minimizing the expected risk, where E denotes the average over the data distribution (expectation): R(f ) = EI∼Iorig [1(f (I) = 1)] + EI∼Irecap [1(f (I) = 0)]
(2)
subject to computational efficiency (< 500ms inference on mobile devices), generalization across unseen device combinations and conditions, and false positive control (FPR < τFPR ). Unlike traditional post-incident image forensics, our framework requires preventive detection integrated directly into the on-device application workflow.
4
The Proposed Framework
The proposed framework, see Fig. 2, comprising: (i) a deep learning-assisted recapture detection module, (ii) an on-device enforcement mechanism, and (iii) a conceptual invisible metadata identifier for forensic tracing.
Fig. 2: A high-level view of the proposed secure-by-design on-device framework.
Stage 1: Image acquisition and pre-validation:- When a user attempts to share an image I within the protected application, it is intercepted by the client-side validation module using RESTFul API and preprocessed (resized to 224 × 224 pixels, normalized) for neural network inference.
Title Suppressed Due to Excessive Length
9
Stage 2: Deep learning-based recapture detection:- The preprocessed image tensor is fed to an Edge-Enhanced Convolutional Neural Network (EECNN) trained to distinguish original from recaptured images. The model outputs a probability distribution p = [porig , precap ]. If precap > θ (a confidence threshold), the image is flagged as recaptured. Stage 3: Enforcement and user feedback:- If original (porig > θ), the image proceeds and an IMI can optionally be embedded for forensic tracing. If recaptured (precap > θ), sharing is immediately blocked with a notification including the confidence score. All enforcement occurs client-side, ensuring zerotrust operation independent of network connectivity. Stage 4: Forensic tracing (conceptual):- For permitted original images, the system can embed an invisible metadata identifier encoding user ID, timestamp, and session information. If leakage occurs through a recapture that evades detection, the IMI enables post-incident tracing. This component is explored conceptually as a direction for future integration. Table 3 summarizes how the framework addresses various threat scenarios. Algorithm 1 formalizes the complete detection and enforcement pipeline described in the above stages. Integration with mobile applications:- The framework integrates via a RESTful API endpoint (/api/validate-image) returning JSON validation results, with WebSocket support for real-time feedback. While our proof-of-concept (PoC) uses a web-based architecture (React frontend, Express.js backend, PyTorch inference), the approach generalizes to native mobile platforms through TensorFlow Lite or Core ML. If the detection model is unavailable, the system defaults to a secure-by-default posture, blocking all uploads. Our approach leverages domain-specific knowledge of recapture artifacts through an Edge-Enhanced CNN that explicitly prioritizes edge information—a key discriminative feature between original and recaptured images.
Table 3: Threat mitigation coverage Threat Screenshot redistribution
Mitigation Prevented by existing platform screenshot-prevention mechanisms and complemented by API-level validation. Physical screen recapture Detected via EE-CNN based on moiré patterns, edge artifacts, illumination non-uniformity. Post-processed recaptured im- Robust feature extraction captures artifacts even after ages brightness/contrast adjustment. Leakage through external API-enforced blocking prevents recaptured images from channels entering the messaging pipeline. Insider threats IMI embedding enables forensic tracing of original images. Model evasion Mitigated through diverse training data; adversarial robustness is discussed further in Section 8.
10
Sood et al.
Algorithm 1 On-Device Recapture Detection and Enforcement Require: Image I selected for sharing, trained EE-CNN model M, confidence threshold θ Ensure: Decision d ∈ {PERMIT, BLOCK} Stage 1: Pre-Validation 1: Validate file type ∈ image/* and size ≤ 10MB 2: Ir ← Resize(I, 224 × 224) 3: In ← Normalize(Ir , µImageNet , σImageNet ) Stage 2: Edge-Enhanced Recapture Detection 4: E ← EdgeEnhance(In ) ▷ Sobel-X, Sobel-Y, Laplacian 5: F ← HierarchicalCNN(E) ▷ 4 conv blocks: 32 → 256 6: p ← Softmax(FC(F )) ▷ p = [porig , precap ] Stage 3: Enforcement Decision 7: if M is unavailable then 8: d ← BLOCK 9: else if precap > θ then 10: d ← BLOCK 11: Notify user with confidence score precap 12: Delete image from temporary storage 13: else 14: d ← PERMIT 15: end if Stage 4: Post-Decision Processing 16: if d = PERMIT then 17: Embed IMI(I, userID, timestamp, sessionID) 18: Transmit I via application channel 19: end if 20: return d
▷ Fail-closed policy
▷ Conceptual
Data collection and pre-processing:- We constructed a balanced dataset of 1,500 original smartphone photographs and 1,500 recaptured images obtained by displaying originals on various screens (LCD and OLED) and re-photographing with different smartphones under varied conditions (indoor/outdoor lighting, angles 15◦ –45◦ , distances 20–50cm, diverse scene content). Images are resized to 224 × 224 pixels and normalized using ImageNet channel statistics. Training augmentation includes random horizontal flips, rotations (±5◦ ), color jittering (±10%), and Gaussian blur (σ ∈ [0.1, 2.0]). Neural network architecture:- The EE-CNN comprises three components. The Edge Enhancement Layer initializes the first convolutional layer (16 filters of size 3 × 3 × 3) with classical Sobel and Laplacian edge detection kernels, with remaining filters learned during training. This design explicitly targets the blurred edges, moiré patterns, and high-frequency artifacts characteristic of recaptured images. The Hierarchical Feature Extraction module consists of four convolutional blocks, each with two convolutional layers, batch normalization,
Title Suppressed Due to Excessive Length
(a) Home screen
11
(b) Image being validated
Fig. 3: The SecureChatDate application. (a) Home screen listing active conversations with message previews and timestamps. (b) An uploaded image undergoing validation with the send button disabled until classification completes.
ReLU activation, and 2 × 2 max-pooling, progressively reducing spatial dimensions from 224 × 224 to 14 × 14 while increasing feature depth from 32 to 256 channels. The Classification Head applies adaptive average pooling, followed by two fully connected layers (512 → 128 neurons) with dropout regularization (p = 0.5, 0.3), producing a two-class softmax probability distribution over original and recaptured classes. Training configuration:- The model is trained using cross-entropy loss with Adam optimizer (α = 10−4 ) and L2 weight decay (λ = 10−4 ), running for 50 epochs with early stopping (patience = 10) on a batch size of 32. The dataset is split into training (70%), validation (15%), and test (15%). Detailed evaluation metrics are provided in Section 7.
5
SecureChatDate Web Application: A Client-Side Enforcement Mechanism
To demonstrate practical applicability, we developed a proof-of-concept dating chat application named as SecureChatDate with integrated image authentication that enforces a zero-trust policy—all shared images undergo mandatory validation before transmission. The application employs a three-tier architecture: a React/TypeScript frontend providing real-time chat via WebSocket with image upload and validation feedback; a Node.js/Express backend exposing two endpoints—/api/validate-image (classification) and /api/upload (storage of validated images only)—with immediate deletion of temporary files; and a PyTorch inference engine that loads the EE-CNN weights once at initialization and returns JSON results containing prediction label, confidence score, and class probabilities. Fig. 3 shows the application interface, including the conversation list and the image validation process. The enforcement pipeline is as follows:
12
Sood et al.
(a) Original image accepted
(b) Recaptured image blocked
Fig. 4: Client-side enforcement in our proof of concept SecureChatDate application. (a) An original photograph passes validation with high confidence, enabling the send button. (b) A recaptured image is detected and blocked, displaying the confidence score to the user.
1. User action: User selects an image file from their device. 2. Client validation trigger: – File type check (must be image/*) and size validation (maximum 10MB) – Local preview generated; send button disabled until validation completes. 3. Server validation: – Image uploaded to /api/validate-image – Server invokes inference script using following python command: python3 inference.py model.pth image.jpg – CNN processes image and returns JSON result 4. Decision point: – If Original (porig > precap ): Server returns {isValid: true}; client displays green checkmark and enables send button – If Recaptured (precap > porig ): Server returns {isValid: false} with confidence score; image deleted from server; client displays error with blocking message; send button remains disabled. – If model unavailable: System defaults to blocking (fail-closed policy) 5. Image transmission (only if validated): – Image uploaded to /api/upload; server stores and generates permanent URL. – WebSocket broadcast notifies the recipient in real-time. Fig. 4 demonstrates the enforcement mechanism in the proof-of-concept application, showing both acceptance and rejection outcomes.
Title Suppressed Due to Excessive Length
5.1
13
Proposed Integration with Mobile Chat Applications
Beyond the web-based PoC, we outline how the framework can be integrated with native mobile chat applications to enforce recapture detection. 1. Android integration:- The framework can intercepts image-sharing at the OS level through three mechanisms: – Share-intent interception:- An IntentFilter for ACTION_SEND with MIME type image/* enables a background validation service to intercept outgoing shares, forwarding the intent only if the image passes validation. – Accessibility service:- An AccessibilityService monitors file picker interactions across protected applications, triggering validation before share actions complete (requires explicit user consent). – Background service and on-device inference:- The model runs as a persistent ForegroundService using a TensorFlow Lite model (∼9MB, INT8 quantized). Inference is dispatched via NNAPI to available accelerators (GPU, DSP, or NPU), achieving 60–150ms latency. A ContentObserver on MediaStore.Images proactively classifies new gallery images before sharing. 2. iOS Apple:- The framework operates within Apple’s sandboxing model: – Share extension:- Intercepts image-sharing actions system-wide for public. image UTI, loading the Core ML model to classify and either forward or block content within Apple’s 120MB extension memory limit. – PHPickerViewController hook:- Validation is injected into the picker’s completion handler, classifying selected PHAsset objects before the application receives image data. – On-device inference via core ML:- The model executes on Apple’s Neural Engine (40–100ms on A14 Bionic or later), with state shared across extensions via App Groups containers. 3. Cross-platform implementation:- Both platforms share three mechanisms: (1) over-the-air model updates without full app releases, (2) local SQLite caching of validation results keyed by SHA-256 content hash, and (3) fully ondevice inference preserving zero-trust operation in offline scenarios.
6
IMI for Forensic Traceability
A complementary forensic layer is needed to trace leakage when recaptured content evades detection. We introduce the concept of an IMI lightweight, imperceptible marker embedded into original images before transmission. The IMI must satisfy three properties: invisibility (imperceptible to the human eye), survivability (persists through the screen-camera recapture process, unlike EXIF metadata), and traceability (encodes sufficient information to link a leaked image to its source). When an original image I passes validation (Algorithm 1, Stage 4), the IMI module encodes a payload P = ⟨userID, timestamp, sessionID⟩
14
Sood et al.
by targeting mid-frequency DCT coefficients robust to display-camera distortion. The embedded image is: Imarked = I + α · W(P)
(3)
where W(·) maps the payload to a spatial-domain perturbation and α balances invisibility against recapture survivability. If a leaked image is discovered, inverse frequency-domain analysis recovers the payload to identify the original recipient and establish the leakage path. This component is explored at a conceptual level, informed by recent works in watermarking: Bai et al. [12] and Cao et al. [13] demonstrated that deep watermarks survive the screen-camera channel, suggesting that embedding a compact 64–128 bit payload is feasible. Further, we have in our previous work [19] demonstrated the feasibility of packet marking using mobile International Mobile Equipment Identity (IMEI number, a mobile hardware number) as unique marks for the traceback purpose. Many open challenges, aim to address in the future, include maintaining embedding latency under 100ms on mobile, surviving adversarial post-processing, and GDPR compliance for user-identifying information.
7
Experimental Evaluation
We employ standard classification metrics: accuracy, precision, recall, F1-score, average confidence, and high-confidence accuracy (predictions with confidence > 0.8). We additionally analyze the ROC curve and AUC across classification thresholds. The held-out test set comprises 450 images (225 original, 225 recaptured) captured with varied smartphones (iPhone 12/13, Samsung Galaxy S21/S22, Google Pixel 6) and recaptured from diverse displays (OLED, AMOLED, Retina, LCD) under systematically varied conditions (indoor/outdoor lighting, angles 15◦ –45◦ , distances 20–50cm). Table 4 summarizes the performance.
Table 4: Model’s performance metrics on the held-out test set (450 images) Metric Value Overall Accuracy 98.89% Precision (Original) 97.83% Recall (Original) 99.11% F1-Score 98.46% Average Confidence 94.57% High-Confidence Accuracy 99.46% False Positive Rate 1.78% False Negative Rate 0.89%
Analysis of results:- The EE-CNN achieves 98.89% accuracy, correctly classifying 445 out of 450 test images. High precision (97.83%) ensures legitimate users are rarely blocked, while recall of 99.11% provides strong protection against
Title Suppressed Due to Excessive Length
15
recaptured content. When restricted to high-confidence predictions (confidence > 0.8), accuracy rises to 99.46%, with only 2–3 misclassifications, confirming that model uncertainty correlates well with prediction difficulty. The FPR of 1.78% (approximately 4 of 225 original images) arises primarily from images with extreme motion blur, photographs taken through glass or reflective surfaces, and images with heavy prior compression artifacts. The FNR of 0.89% (approximately 2 of 225 recaptured images) occurs when recapture is performed with high-end OLED displays at near-perpendicular angles under ambient lighting that closely matches display brightness, minimizing moiré effects. These edge cases approach the theoretical limits of recapture detection. Training dynamics:- Fig. 5 illustrates the training and validation loss and accuracy over 50 epochs. Both training and validation accuracy surge from ap-
Fig. 5: Training and validation loss (left) and accuracy (right) over 50 epochs. The model converges rapidly within the first 15 epochs and maintains stable performance thereafter, with minimal overfitting.
proximately 60% to 90% within the first 5 epochs—indicating strong initial representations from the edge enhancement layer—and stabilize around epoch 15– 20, with validation accuracy slightly exceeding training accuracy (94–95% vs. 92–93%), confirming that dropout, batch normalization, and data augmentation effectively prevent overfitting. Beyond epoch 20, performance remains stable (±1% fluctuation), validating early stopping at epoch 30–40 as sufficient. Qualitative analysis (edge detection effectiveness):- To understand how the model distinguishes original from recaptured images, we visualize the activations of the edge enhancement layer and deeper convolutional blocks. Fig. 6 shows the edge filter responses for an original image and its recaptured counterpart. Original images produce clean, sharp edge transitions corresponding to actual scene boundaries with consistent intensity gradients. Recaptured images, by contrast, exhibit several distinctive artifacts in the edge domain: moiré patterns (wavy, repetitive distortions from sensor-display pixel grid interference, prominent in Sobel responses), grid artifacts (faint structures from the display
16
Sood et al.
Fig. 6: Edge detection filter responses comparing original (top row) and recaptured (bottom row) images. Sobel-X (left), Sobel-Y (middle), and Laplacian (right) filters. Recaptured images exhibit moiré patterns, grid-like interference from the pixel matrix, and inconsistent edge sharpness.
pixel matrix, visible in Laplacian responses), softened edge transitions from the two-step capture-display-recapture pipeline, and amplified high-frequency noise from display refresh and ambient lighting interference. Fig. 7 displays feature map activations from deeper convolutional blocks, revealing how these edge-level cues are progressively abstracted into higher-order discriminative features. Early-layer feature maps (Block 1) respond to basic edge orientations and local contrast variations, with filters 4, 5, 9, and 10 showing strong selective activation on recaptured images, suggesting specialization for high-frequency artifact detection. Mid-layer maps (Block 2) capture more abstract patterns—repetitive moiré structures, grid-like formations, and compound edge-texture signatures—with diverse, complementary activations confirming that the network avoids redundant representations. Comparison with baseline:- We compare against a ResNet-18 baseline (ImageNet pre-trained, fine-tuned on our dataset) without edge enhancement, see Table 5. The EE-CNN outperforms ResNet-18 by 4.67 percentage points in accuracy while using 25% fewer parameters and achieving 34% faster inference, demonstrating that the edge enhancement layer provides a strong inductive bias for recapture detection compared to generic feature extractors. While the model achieves strong performance, several limitations warrant consideration: (1) near-perfect recaptures using professional displays and controlled lighting can occasionally evade detection (FNR = 0.89%); (2) original images with extensive post-processing may trigger false positives (FPR = 1.78%); and (3) the model is trained primarily on smartphone-to-screen-to-smartphone recaptures, and per-
Title Suppressed Due to Excessive Length
17
(a) Block 1 (features.4) — Early layer features responding to edge orientations, texture gradients, and local contrast.
(b) Block 2 (features.10) — Mid-layer pattern detectors capturing moiré structures, grid formations, and compound edge-texture signatures.
Fig. 7: Feature map visualizations from convolutional blocks.
Table 5: Comparison with ResNet-18 baseline Metric ResNet-18 EE-CNN (Ours) Accuracy 94.22% 98.89% Precision 92.15% 97.83% Recall 96.44% 99.11% F1-Score 94.24% 98.46% Parameters 11.7M 8.7M Inference Time (CPU) 680ms 450ms
formance on other scenarios (DSLR cameras, printed photos) requires further validation. Future work should explore multi-scale analysis at different spatial frequencies, frequency-domain augmentation via Fourier or wavelet features, adversarial robustness evaluation, and attention-based explainability mechanisms.
8
Security Analysis and Discussion
1. Resistance to bypass attempts:I. Image post-processing attacks:- Adversaries may apply Gaussian blur, histogram equalization, or adaptive sharpening to suppress recapture artifacts. The EE-CNN’s edge enhancement layer captures structural distortions—doubled edges, frequency-domain aliasing, and illumination gradients—that persist after
18
Sood et al.
moderate filtering. Applying Gaussian blur (σ = 1.5) and contrast enhancement (±15%) to recaptured test images reduced detection accuracy by only 2–3%. II. Format and compression manipulation:- Re-encoding through multiple JPEG compression cycles or format conversion may alter forensic traces. The training pipeline includes JPEG compression at quality levels 70–95 as augmentation, and the EE-CNN operates on spatial-domain edge responses rather than compression-specific artifacts, making its discriminative power largely formatindependent. III. API-Level and protocol attacks:- Adversaries might bypass detection by directly injecting image data into the messaging pipeline. The backend enforces mandatory validation—no image reaches the chat storage or WebSocket layer without a passing classification. API authentication tokens and rate limiting (10 requests per minute per user) prevent automated threshold probing. 2. False positive analysis and mitigation:- The system achieves an FPR of 1.78%, corresponding to approximately 18 false rejections per 1,000 legitimate uploads. False positives concentrate in three scenarios: images under fluorescent/LED lighting (flicker resembling screen backlighting), images with reflective surfaces (specular highlights mimicking screen recapture), and close-range images with shallow depth of field (bokeh resembling screen-camera focus degradation). The framework addresses false positives through: Confidence thresholding—images with confidence ≤ 0.80 are routed to manual review rather than outright rejection; User feedback—rejected users receive explanatory notifications with confidence scores and retry guidance; EXIF Cross-validation— borderline cases with consistent, unmodified EXIF metadata are escalated for review rather than auto-rejected; and Continuous retraining—false positive cases from the review queue are incorporated into subsequent training cycles. 3. Performance overhead and scalability:- The EE-CNN achieves 85ms inference on GPU (NVIDIA Tesla V100) and 450ms on CPU. The other metrics are shown in Table 6. Further, the architecture supports horizontal scaling via containerized deployment (Docker/Kubernetes) with auto-scaling policies. Model quantization (FP32 → INT8) can reduce inference time by 2–3× with <0.5% accuracy drop, and on-device deployment via TensorFlow Lite or Core ML eliminates server round-trips for latency-critical applications.
Table 6: Performance overhead of the detection pipeline Metric Value Model size (serialized) ∼35 MB GPU inference latency 85 ms CPU inference latency 450 ms End-to-end API latency (4G) 800–1,200 ms Peak memory per request ∼200 MB Concurrent requests per GPU 8–12 Preprocessing time ∼15 ms
Title Suppressed Due to Excessive Length
19
4. Privacy and ethical considerations:- The system processes images solely for authentication without extracting biometric identifiers—no facial recognition, identity matching, or demographic inference is performed. Images are analyzed in-memory and discarded after classification. Device bias (older smartphones triggering false positives) and environmental bias (challenging lighting causing false rejections) are mitigated through diverse data processing.
9
Conclusion
We presented a novel screen recaptured analog hole attack (S-RAHA) that circumvents conventional screenshot-prevention mechanisms. We proposed a secureby-design framework for detecting and preventing the forwarding of re-captured images. The framework integrates an EE-CNN model that exploits recapturespecific artifacts—moiré patterns, edge degradation, and illumination non-uniformity— achieving 98.89% detection accuracy on a diverse test set spanning multiple device and environmental configurations. The proposal outperforms a ResNet18 baseline by 4.67% points in accuracy while requiring 25% fewer parameters and 34% faster inference, demonstrating the effectiveness of the proposal. The framework incorporates a client-side enforcement mechanism that blocks sharing of suspected recaptured images before transmission, operating under a zero-trust model with no dependency on network connectivity or server-side validation. A proof-of-concept web application we built demonstrates the practical feasibility of the approach. We further introduced the concept of an invisible metadata identifier for forensic traceability of leakage paths, explored at a feasibility level as a complementary forensic layer. While limitations remain—particularly around high-fidelity recaptures from modern OLED displays and the need for larger, more diverse training datasets—the framework establishes a practical foundation for integrating recapture detection into privacy-focused web and mobile applications. Future work focus on expanding the training corpus, incorporating frequency-domain features, and evaluating adversarial robustness.
References 1. C. Chen, Y. Li, B. Li, W. Yu, B. Chen, B. Li, and J. Huang, “Moire spectral augmentation and masked frequency modeling for document presentation attack detection,” IEEE Transactions on Dependable and Secure Computing, 2025. 2. Y. Ji, Y. Hong, J. Zhan, H. Chen, J. Lan, H. Zhu, W. Wang, L. Zhang, and J. Zhang, “Towards explainable fake image detection with multi-modal large language models,” in Proceedings of the 33rd ACM International Conference on Multimedia, 2025, pp. 4398–4407. 3. C. Chen, L. Lin, Y. Chen, B. Li, J. Zeng, and J. Huang, “Cma: a chromaticity map adapter for robust detection of screen-recapture document images,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024, pp. 15 577–15 586. 4. F. Li, J. Ma, H.-N. Liang, Z. Tian, Z. Wu, T. Wen, and D. Liu, “A comprehensive survey of specularity detection: state-of-the-art techniques and breakthroughs,” Artificial Intelligence Review, vol. 58, no. 7, p. 218, 2025.
20
Sood et al.
5. S. Park, A. Vilesov, J. Zhang, H. Khalili, Y. Tian, A. Kadambi, and N. Sehatbakhsh, “Chimera: Creating digitally signed fake photos by fooling image recapture and deepfake detectors,” in 34th USENIX Security Symposium (USENIX Security 25), 2025, pp. 4305–4324. 6. C. Li, L. Wang, S. Ji, X. Zhang, Z. Xi, S. Guo, and T. Wang, “Seeing is living? rethinking the security of facial liveness verification in the deepfake era,” in 31st USENIX Security Symposium (USENIX Security 22). Boston, MA: USENIX Association, Aug. 2022, pp. 2673–2690. [Online]. Available: https://www.usenix.org/conference/usenixsecurity22/presentation/li-changjiang 7. Q. Ke, X. Li, Y. Shi, and Q. Yan, “Image recapture detection using multiple features,” International Journal of Multimedia and Ubiquitous Engineering, vol. 8, no. 4, pp. 101–114, 2013. 8. T. Thongkamwitoon, H. Muammar, and P.-L. Dragotti, “An image recapture detection algorithm based on learning dictionaries of edge profiles,” IEEE Transactions on Information Forensics and Security, vol. 10, no. 5, pp. 953–968, 2015. 9. J. Luo, J. Guo, W. Qiu, Z. Huang, and H. Hui, “Scale invariant domain generalization image recapture detection,” in Neural Information Processing, T. Mantoro, M. Lee, M. A. Ayu, K. W. Wong, and A. N. Hidayanto, Eds. Cham: Springer International Publishing, 2021, pp. 75–86. 10. I. Hussain, S. Tan, and J. Huang, “Few-shot based learning recaptured image detection with multi-scale feature fusion and attention,” Pattern Recognition, vol. 161, p. 111248, 2025. 11. X. Gao, B. Qiu, J. Shen, T.-T. Ng, and Y. Q. Shi, “A smart phone image database for single image recapture detection,” in Digital Watermarking, H.-J. Kim, Y. Q. Shi, and M. Barni, Eds. Berlin, Heidelberg: Springer Berlin Heidelberg, 2011, pp. 90–104. 12. R. Bai, L. Li, S. Zhang, J. Lu, and C.-C. Chang, “SSDeN: Framework for screenshooting resilient watermarking via deep networks in the frequency domain,” Applied Sciences, vol. 12, no. 19, 2022. 13. F. Cao, D. Guo, T. Wang, H. Yao, J. Li, and C. Qin, “Universal screen-shooting robust image watermarking with channel-attention in DCT domain,” Expert Systems with Applications, vol. 238, p. 122062, 2024. 14. L. Liu, P. Xu, and Q. Xue, “Screen shooting resistant watermarking based on cross attention,” Scientific Reports, vol. 15, no. 1, p. 17016, 2025. 15. C. Wang, B. He, S. Wu, R. Wan, B. Shi, and L.-Y. Duan, “Coarse-to-fine disentangling demoiréing framework for recaptured screen images,” IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 45, no. 8, pp. 9439–9453, 2023. 16. C. Chen, W. Chen, Y. Lin, B. Li, and J. Huang, “Unmask tampering: Efficient document tampering localization under recapturing attacks with real distortion knowledge,” in Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security, 2025, pp. 1694–1708. 17. G. Li, H. Yao, Y. Le, and C. Qin, “Recaptured screen image identification based on vision transformer,” Journal of Visual Communication and Image Representation, vol. 90, p. 103692, 2023. 18. M. Aharon, M. Elad, and A. Bruckstein, “K-SVD: An algorithm for designing overcomplete dictionaries for sparse representation,” IEEE Transactions on Signal Processing, vol. 54, no. 11, pp. 4311–4322, 2006. 19. S. Yu, K. Sood, and Y. Xiang, “An effective and feasible traceback scheme in mobile internet environment,” IEEE Communications Letters, vol. 18, no. 11, pp. 1911–1914, 2014.