Etienne Levecque

Jan Butora

Patrick Bas

Finding Incompatible Blocks for Reliable JPEG Steganalysis

Keywords: Steganography, Steganalysis, JPEG, Compatibility, Compatibility attacks, Reliability I

This article presents a refined notion of incompatible JPEG images for a quality factor of 100. It can be used to detect the presence of steganographic schemes embedding in DCT coefficients. We show that, within the JPEG pipeline, the combination of the DCT transform with the quantization function can map several distinct blocks in the pixel domain to the same block in the DCT domain. However, not every DCT block can be obtained: we call those blocks incompatible. In particular, incompatibility can happen when DCT coefficients are manually modified to embed a message. We show that the problem of distinguishing compatible blocks from incompatible ones is an inverse problem with or without solution and we propose two different methods to solve it. The first one is heuristic-based, fast to find a solution if it exists. The second is formulated as an Integer Linear Programming problem and can detect incompatible blocks only for a specific DCT transform in a reasonable amount of time. We show that the probability for a block to become incompatible only relies on the number of modifications. Finally, using the heuristic algorithm we can derive a Likelihood Ratio Test depending on the number of compatible blocks per image to perform steganalysis. We simulate the result of this test and show that it outperforms a deep learning detector e-SRNet for every payload between 0.001 and 0.01 bpp by using only 10% of the blocks from 256 × 256 images. A Selection-Channel-Aware version of the test is even more powerful and outperforms e-SRNet while using only 1% of the blocks.

DCT coefficients

Fig. 1. Toy illustration of a 2D JPEG compression illustrating the incompatibility attack. Every block of 2 pixels (left figure) is mapped to a point in the DCT space (right figure) and we can see that the compression is not surjective. It means that some blocks in the DCT space (represented by the holes) do not have any antecedent in the pixel domain. On the other hand, some pixel blocks are mapped to the same DCT block during compression.

The attack exploits the fact that during embedding, some incompatible blocks are created.

In this paper, we present a method that exploits a property of JPEG images compressed using a known compression pipeline, which can be used to detect messages for all steganography algorithms altering JPEG quantized DCT coefficients. The main idea of this property is rather simple: given a (compression) pipeline and an image coded in the JPEG format, we want to know if the coded image is an output of this pipeline. This problem, illustrated in Fig. 1, can be seen as an inverse problem because if we can find an input image of the pipeline that gives as output the observed image, then we can conclude that the output image is compatible with the pipeline. On the contrary, if no input generates the output image, then it is incompatible with this pipeline. In our case, it means that the image under scrutiny has been tampered with by the embedding algorithm and that it is therefore incompatible with the compression scheme.

The incompatibility we study in this paper is related to the JPEG compression pipeline but not only since it can also be used by any coding scheme which uses the DCT transform and quantized DCT coefficients with quantization steps close to or equal to 1. This means that this method can be potentially used on coding schemes such as HEIC for still pictures, or the H26x class of coding schemes for moving pictures.

Note that from a steganalysis perspective, detecting an incompatible image is very interesting since in this case the steganalyst, Eve, does not have to face potential false positives. She is sure that the image is Stego if she has knowledge of the compression pipeline and can find at least one incompatible block in the image. Being able to detect incompatible images is consequently related to performing reliable steganalysis. This notion of incompatibility was one of the first strategies in steganalysis and was introduced in 2001 in Fridrich et al. seminal paper [START_REF] Fridrich | Steganalysis based on jpeg compatibility[END_REF] when the message is hidden in the decompressed JPEG image. In this case, the observed image is a pixel image formerly compressed in JPEG with some potential modifications on pixel values due to steganographic embedding. The studied pipeline is consequently the JPEG decompression scheme. The authors recompress the image and to detect the embedding, they use on one side the difference signal between the test image in the pixel format and on the other side the recompressed-decompressed image.

Several years later, the Reverse JPEG Compatibility Attack (RJCA) was introduced in Butora and Fridrich's paper [START_REF] Butora | Reverse jpeg compatibility attack[END_REF] for the case where the message is embedded into the DCT domain of high-quality JPEGs, i.e. for quality factors equal or close to 100. For this attack, the output image is a JPEGcompressed image and the pipeline is the JPEG compression. The authors use the rounding errors of the decompressed image as a reference signal to detect the embedding, either by simply computing the variance of the signal (which increases after embedding) or using deep neural networks such as e-SRNet [START_REF] Butora | Reverse jpeg compatibility attack[END_REF].

Note that incompatibility has also been used for digital forensics to detect tempering operations. The incompatibility between different types of interpolation used during the demosaicking process was proposed by Kirchner and Böhme [START_REF] Kirchner | Synthesis of color filter array pattern in digital images[END_REF] in 2009. A more general approach to detect resampled signals and incompatibilities related to interpolation pipelines was proposed by Vázquez-Padín et al. [START_REF] Vázquez-Padín | Set-membership identification of resampled signals[END_REF] using set-membership approaches to estimate the resampling factor when the sampling pipeline -here the interpolation kernel -is known.

A common assumption in steganalysis is called Selection-Channel-Aware (SCA) and was used for the first time in Denemark et al. paper [START_REF] Denemark | Selection-channel-aware rich model for steganalysis of digital images[END_REF] to improve an existing detector. This assumption supposes that the agent performing steganalysis knows the probabilities with which the cover elements have been modified during embedding. In our case, those elements are DCT coefficients and this assumption can also be used to select blocks that are more likely to be modified and thus more likely to be incompatible.

The outline of this contribution is illustrated in Fig. 2 where the connections with the different sections of the paper are also highlighted.

• Because the incompatibility stems from the JPEG compression pipeline, different types of compressors are presented in section II with different implementations of the DCT transform together with different rounding functions. The compressor associated with the potential use of an embedding scheme produces blocks that are either Cover or Stego. • The steganalyst analyses the produced image DCT blocks and tries to solve an inverse problem, defined in section III, to find antecedents of the test blocks in the pixel domain. Two methods are presented to find an antecedent. The first one uses a heuristic function which is minimized to find compatible blocks. The second one consists in solving an Integer Linear Programming (ILP) problem which can be easily formulated for one specific JPEG scheme and which can be used to detect incompatible blocks. From the heuristic, it is possible to design a timing attack which can be seen as an extension of the one presented in [START_REF] Levecque | Compatibility and Timing Attacks for JPEG Steganalysis[END_REF] for a different optimization process and different JPEG compressors. • The timing attack can be finally cast as a hypothesis test based on the number of compatible or timed-out blocks found in an image. Different strategies to select a subset of the blocks, and thus be more efficient, are proposed and the detection performance is evaluated and compared with SOTA deep-learning methods in section VI.

Note that to perform steganalysis, the only materials, that Eve needs to have, represented in red in Fig. 2, are:

• The knowledge of the JPEG compressor which can be determined by forensic analysis or assumed to be known according to the Kerckhoffs' principle, • Sample blocks of the test image to analyze,

• Optionally, the knowledge of the embedding scheme can be used to select the best candidate blocks using an SCA approach. This paper has some connections with [START_REF] Levecque | Compatibility and Timing Attacks for JPEG Steganalysis[END_REF] presenting the main feature of compatibility and its potential connections with timing attacks. However, there are also numerous differences, among them are: the fast heuristic approach presented in section III-C and used to provide results in section IV and section VI, the design of a Likelihood Ratio Test in section V-B, the option to have a Selection Channel Aware test using an appropriate prior, and the comparison with the SOTA in deep-learning steganalysis in section VI-B.

Unlike the original work dealing with the RJCA [START_REF] Butora | Reverse jpeg compatibility attack[END_REF], the proposed method is not statistical in nature but exploits the hard constraints of the JPEG format and consequently does not suffer from false positives. Additionally, we show that the proposed Likelihood Ratio Test outperforms in section VI-B the best deep learning detector used for the RJCA.

All our code is available one our git repository. 1

II. JPEG COMPRESSION

The goal of this section is to formalize mathematically the JPEG compression pipeline. This formalization will allow us to search for possible antecedents of JPEG blocks. Notations are first defined, then the different steps of the libjpeg implementation [13], which is the most popular implementation of JPEG compression, are presented.

A. Notation and mathematical formulation

Notations: Every standard letter represents a scalar and bold letters can represent a vector or a matrix. Most of the values are two-dimensional but can be broadcasted to one dimension by flattening the object. Therefore, for simplicity reasons, multiplication and division of matrix and vector are element-wise operations on the flattened objects. The rounding function to the nearest integer toward infinity is written [•]. For example [0.5] = [1.4] = 1 and [-0.5] = -1. The quantization operator with respect to some quantization coefficients stored in a matrix Q is defined by

[•] Q = [ • Q ]. Finally, we define [•]

JPEG compression:

We consider an image divided into non-overlapping blocks of size 8 × 8 pixels. We suppose for simplicity that the image size can be divided by 8. The JPEG compression is applied independently on every block. Let x be one of those pixel blocks. Its DCT coefficients c can be defined using the following notation:

d = f DCT (x) Floating point coefficients, c = [d] Q Integer coefficients,
where f DCT refers to the forward Discrete Cosine Transform function and Q is the quantization table of the same size as a block, which depends on the quality factor (QF) of the compression. A high QF means small quantization steps (at QF100, the quantization steps are all equal to 1).

1 https://gitlab.cristal.univ-lille.fr/elevecqu/incompatible-jpeg-blocks

x d c d ′ y x ′ DCT Pixel Unknown Known f DCT (•) [•] Q Q × • f IDCT (•) [•] [0;255]

JPEG decompression:

The decompression process is almost symmetric and can be defined with the following notation:

d ′ = Q × c Integer coefficients, y = f IDCT (d ′ )
Floating point pixels,

x ′ = [y] [0;255]
Integer pixels clipped.

This pipeline is illustrated in figure 3 with two separations. The horizontal separation refers to the domain of the objects: either DCT (or frequency) or pixel (or spatial). The vertical separation divides the objects into unknown or known from the steganalyst's point of view.

Rounding errors: The main reason why the JPEG compression is not perfectly reversible is because of the lossy rounding operation in the DCT domain. Indeed, the integer DCT coefficients are a close approximation of the exact floating point value, and therefore a bit of information is lost making the whole pipeline irreversible.

We define the DCT rounding error as well as the spatial rounding error which occurs after decompression to obtain integer pixel values, and the compression error:

u = c -d DCT rounding error, e = x ′ -y Spatial rounding error, k = x ′ -x Compression error. (1)

B. Details on implementations (libjpeg)

Libjpeg [13] was implemented in 1991 by the Independent JPEG Group as an open-source software written in C. It rapidly became a building brick for high-level languages to use JPEG compression. The JPEG standards are technical specifications so the JPEG implementation can differ depending on the application. That is also the case in the libjpeg library, which evolved through different versions [START_REF] Benes | Know your library: How the libjpeg version influences compression and decompression results[END_REF]. This paragraph aims to highlight the most important parameters used for our work.

Channels: This paper will consider 3 different types of image channels. Gray-scale is a single-channel image, the compression is directly performed on every block. RGB-JPEG is a 3-channel image but every channel is compressed like a gray-scale image. YCbCr is a transformation of the color into luminance (Y) and chrominance (Cb and Cr) components.

Although the transformation is linear, it is followed by a non-linear quantization toward integers. The luminance and chrominance quantization tables also differ in this setting because the human eye is more sensible to the luminance component. Therefore the chrominance components are optionally subsampled and are quantized more than the luminance component, which is subject to the same compression as a grayscale image.

DCT transforms: The change of domain is the most time-consuming operation during the compression. That is why there exist multiple implementations depending on the quality or speed requirements of the user. There are 3 main implementations in libjpeg: float, islow, and ifast. The float and islow use the same algorithm with floating point and integer values respectively. The islow is therefore faster than float but less precise. The ifast uses a different algorithm on integer values and therefore is even faster than islow. However, the quality of the result can be damaged by the lack of precision especially for high QF values. Both algorithms are presented in [START_REF] Pennebaker | JPEG: Still image data compression standard[END_REF]. Since this work targets high QF, ifast will be ignored. Finally, only islow and naive DCT will be considered. The naive DCT is the mathematical definition using a matrix product that is very close to float but can sometimes differ due to operation ordering [START_REF] Schlögl | Causes and effects of unanticipated numerical deviations in neural network inference frameworks[END_REF].

Rounding functions: The quantization step after the DCT makes the use of a rounding function mandatory to transform floating point values to integers. There exist numerous ways to round a floating point to an integer, including truncation (rounding towards zero) [START_REF] Agarwal | Photo forensics from rounding artifacts[END_REF].

In libjpeg, the rounding function used is the half-up toward infinity implemented with bit shifts. The paper uses the same one. Images compressed with the truncate function are ignored during compression for the float and islow implementations. Note that a rounding function can produce different results depending on the processor of the computer and its instructions [START_REF] Schlögl | Causes and effects of unanticipated numerical deviations in neural network inference frameworks[END_REF]. Now that the different mathematical entities have been presented we can give more insights on the definition and the detection of compatible and incompatible blocks.

III. INCOMPATIBILITY IN JPEG BLOCKS

The incompatibility problem is defined in this section. A paragraph is dedicated to a 2-dimensional toy example which gives a geometrical interpretation of the problem. We use two formulations to derive two algorithms to prove that a block is compatible or not. The first one is based on a heuristic algorithm. The second one relies on stronger assumptions to derive an Integer Linear Programming problem that can be solved by numerical solvers.

A. Definition

A block c is compatible with a forward DCT function f DCT and a quantization function If no integer coordinate falls into this rectangle -for example the orange rectangle on the left plot -it means that there is no solution to the inverse problem and therefore the block is incompatible. On the left, the quantization values are [START_REF] Agarwal | Photo forensics from rounding artifacts[END_REF][START_REF] Agarwal | Photo forensics from rounding artifacts[END_REF] (2D equivalent of QF100), and on the right [START_REF] Agarwal | Photo forensics from rounding artifacts[END_REF][START_REF] Benes | Know your library: How the libjpeg version influences compression and decompression results[END_REF] (2D equivalent of a QF lower than 100). The red dot is the compression error k.

[•] Q if there exists an integer block x such that: c = [f DCT (x)] Q . ( 2
) -1 0 1 -1 0 1 e e -1 0
In other words, c is compatible if it has an antecedent given a compression pipeline. On the contrary, if a block of DCT coefficients does not have any antecedent, then it is defined as incompatible.

The notion of compatibility is very simple but the existence of incompatible blocks is not trivial. It comes from the nonsurjectivity of the pipeline as depicted in Fig. 1: all pixel blocks x have an image by definition but in the space of DCT coefficients, not all blocks c have an antecedent. This is mainly due to the quantization function which is not surjective but also due to several implementations of the DCT which are not always perfectly reversible because of precision errors.

In order to hide a message inside the DCT coefficients, the steganographer needs to change the coefficients of a compatible DCT block c (it was obtained by compressing a pixel block x), but the result c ′ after modification is not guaranteed to be compatible and can be exploited by the steganalyst.

B. Why do we have incompatible blocks?

In this paragraph, we present a simple toy example with blocks of 2 pixels depicted in Fig. 4. The purpose of this illustration is to give the reader intuitions regarding the creation of incompatible blocks.

Let x ∈ 0, 255 2 be a random block of pixels. The naive mathematical definition of the DCT can be generalized to every number of dimensions, therefore we can JPEG compress this 2-dimensional block and define every notation present in Fig. 3. We also define c ′ = c + m which is the same DCT block with a modification m that contains some message embedded in it. If we extract the different errors defined in equation ( 1) we now have two spatial rounding errors e and e ′ . Those errors are shown in Fig. 4 with a blue and orange cross.

To understand the rationale behind the notion of incompatible blocks, which is linked to the dotted rectangles around the error vectors in the figure, we need to derive a simple equation from the three errors:

k = x ′ -x, = x ′ -f IDCT (d), = x ′ -f IDCT ((c -u) • Q), = x ′ -f IDCT (c • Q) + f IDCT (u • Q), = x ′ -y + f IDCT (u • Q), = e + f IDCT (u • Q). (3)
The variable k is the compression error which is the difference between the original pixel block and the decompressed one. If we know the decompressed block and the compression error we can reconstruct an antecedent x of c. Therefore, if this compression error exists, it directly means that we have an antecedent and by definition the block is compatible. However, this compression error needs to respect a constraint, it has to be an integer by definition.

The other important variable, u, is the rounding error in the DCT domain which is unknown and has to be a floating point value in [-0.5, 0.5]. This constraint defines the dotted rectangles around each spatial rounding error. Finally, we end up with two constraints:

1) the compression error k needs to be composed of integer values, 2) k has to be inside the dotted rectangle to respect the constraint on u. We can plot the spatial rounding e error as shown in Fig. 4 with a blue cross. The orange cross corresponds to the spatial rounding error of the same block with modifications to its DCT coefficients.

Note that the size of this rectangle is influenced by the quantization matrix Q. The bigger the quantization steps, the larger the rectangle. Consequently, we can speculate that the larger the quantization step, the larger the probability of staying compatible after embedding, which means there exists a quality factor below which every block is compatible.

C. Finding compatible blocks: the heuristic approach

In order to prove that a block is compatible we need to solve the inverse problem (2) where x is the unknown variable. The variable c is observed and we assume that both the forward DCT function f DCT and the quantization table Q are known. A natural potential solution to this problem is the decompressed image x ′ = f IDCT (Q × c), however most of the time this candidate is not a solution of the problem. For example, in the Alaska dataset [START_REF] Cogranne | The ALASKA steganalysis challenge: A first step towards steganalysis[END_REF] composed of 80k images of 1024 blocks, this trivial candidate is a solution in less than 0.5 % of the blocks with the islow compressor of libjpeg and a naive decompressor.

What is proposed instead, is an algorithm that starts from this candidate and searches for a solution around it by applying small modifications at every pixel position in the block. It behaves like a tree search where each candidate can be extended into new candidates until a solution is found.

For JPEG images compressed at QF100, we can observe that the original pixel block differs from the starting point

(f (n)/Q) == c then return n {n is an antecedent of c} end if v n ← ∥c -f (n)/Q∥ ∞ {DCT error of n} add (v n , n) in
queue {n is an other pixel vector of integer} end if end for end while

x ′ by only a few modifications of ±1. This is not the case for only 1.7 ‰ of blocks in the Alaska dataset but it is the case for every block if we ignore the blocks that have been clipped (the decompressed value is below 0 or bigger than 255). This means that if the image is compatible, we should find a solution by potentially applying only ±1 on very specific pixel positions. Moreover, it also gives us an upper bound on the number of candidates: 3 64 , which is too large for a bruteforce approach.

Instead of brute forcing every solution, we use a metric to orientate the search toward "good" candidates. For every candidate x, the metric g is the following:

g c (x) = c - f DCT (x) Q ∞ , (4)
It corresponds to the infinity norm between the observed DCT block and the DCT block of a candidate. The infinity norm can be motivated by its geometrical form: the set of vectors whose infinity norm is a constant value forms a hypercube. This is exactly what can be observed in the example in Fig. 4. The metric of a candidate is defined as the biggest absolute distance between itself and the DCT block c in the Euclidean DCT space. In particular, if this metric is lower than half of the size of the hypercube, the candidate is inside the hypercube.

In our case, after quantization, the size of the hypercube is 1 so we can briefly show that g c (x) < 1 2 is enough to prove that a block is compatible:

g c (x) < 0.5, ⇔ ∀ i, -0.5 ≤ c i - f DCT (x) i Q i ≤ 0.5, ⇔ ∀ i, c i -0.5 ≤ f DCT (x) i Q i ≤ c i + 0.5, ⇔ ∀ i, f DCT (x) i Q i = c i . (5)
Therefore x is solution of the inverse problem (2) and thus the block c is compatible.

The pseudo-code is written in Algorithm 1 and has some similarity with path-finding algorithms such as A-star [START_REF] Hart | A formal basis for the heuristic determination of minimum cost paths[END_REF] where each candidate is stored in a priority queue depending on the metric g c .

The main advantage of this algorithm is its flexibility to the JPEG pipeline since it is only a called function that can be changed very easily. Moreover, whenever the JPEG pipeline matches the one used to compress the image, it means that by construction if a solution exists it will be found, and therefore it is impossible to have a compatibility error, i.e. a false negative. On the other hand, the main drawback of this heuristic is that blocks can be proven to be incompatible only if each candidate has been explored which is the worstcase scenario and has a complexity similar to a brute force search. In other words, it is impossible to prove that a block is incompatible in a reasonable time using this algorithm.

D. Finding incompatible blocks: the ILP approach

The other approach is similar to the one presented in [START_REF] Levecque | Compatibility and Timing Attacks for JPEG Steganalysis[END_REF]. We use the properties of the DCT rounding error to derive a simple Integer Linear Programming (ILP) problem that can be solved by any solver. To formulate the problem we recall the equation between errors obtained in equation ( 3):

k = e + f IDCT (u • Q)
This equation is only valid under a few assumptions, the forward DCT has to be:

• linear,

• applicable to floating point values since u is not integer,

• the inverse of the IDCT, i.e. f IDCT (f DCT (x)) = x. Those assumptions can sound odd if we think about the mathematical definition of the DCT that checks all three of them, but in reality, lots of different DCT implementations exist and only a few of them can satisfy those assumptions.

Using equation (3) again, we rewrite it to have a formula for the DCT rounding error:

u = f DCT (k -e) Q . ( 6
)
This relation is interesting because it links the compression error k with the DCT rounding error u. Both are unknown variables in our inverse problem but they have two properties:

1) The compression error has to be integer-valued

2) The DCT rounding error has to be bounded inside a unit cube. 5. Empirical probability for a block to become incompatible after a given number of ±1 modifications on DCT coefficients. The blue curve corresponds to blocks proven incompatible using the ILP approach after 3B iterations, it is a lower bound (LB) of the real value. The orange curve shows incompatible and unsolved blocks using the ILP approach again, it is an upper bound (UB) of the real value. Finally, the green curve shows unsolved blocks: another upper bound for 50k iterations of the heuristic approach. Blue and orange used 100 blocks per point and green used 1000 blocks per point.

Therefore we have the following problem:

find k ∈ Z 64 , such that |u| = |f DCT (k -e)| ≤ 1 2 element-wise.
This problem can be solved by any ILP solver, in our case, we used Gurobi through the python Gurobipy module. The worst-case scenario is also reached when the problem is infeasible which means that the block is incompatible. However, the main advantage compared to the heuristic approach is that such a solver can prove in a realistic time that a block is incompatible. The main drawback of this approach is that it will only work with a JPEG pipeline using a mathematical definition of the DCT, i.e. the naive DCT.

To sum up this section, we have seen that the compatibility problem can be formulated as the inverse problem (2). To solve this problem there are two approaches proposed in this paper, the heuristic one is fast for compatible blocks and can deal with every DCT pipeline but it cannot prove that a block is incompatible. The ILP approach is slower and only works with the naive DCT but it can prove that a block is incompatible after a certain amount of time (at least 10h for a single block with Gurobi on an Intel Xeon at 2,2 GHz and 8 threads).

IV. STATISTICS ON INCOMPATIBLE BLOCKS

This section presents two important statistics for the rest of the paper: the probability for a block to become incompatible, and the connections between incompatibility and other features, such as the variance of the spatial rounding error and the position of the modified DCT coefficient inside the block.

A. Probability of becoming incompatible

Using the Alaska dataset, we designed an experiment to track how many blocks can become incompatible depending on the number of modifications. It will give an approximation of the probability for a block to become incompatible after a given number of modifications. This statistic is not the main result of the paper but it will be important to build our steganalysis detector. The experiment is built as follows: we extract a random block x from a random image from Alaska that will be compressed using the naive and islow methods to obtain the DCT block c. Depending on the number of modifications m we select m coefficients without replacement and randomly add ±1. This block is then sent to the two algorithms (ILP and heuristic approach) to try to find an antecedent and try to prove that it is still compatible. The heuristic algorithm runs for 50k iterations (a few minutes in the worst case scenario) and the ILP algorithm runs for 3B iterations of Gurobi (approximately 20h in the worst case scenario). There are 3 possible results:

• if an antecedent is found, the block is compatible,

• if no antecedent is found and the algorithm reaches the time-out value, the block is unsolved, • for the ILP approach, the solver can prove that a block is incompatible because no antecedent exists. In order to understand the future results, we need to introduce some notations. Let H and ILP be used as indexes to identify variables associated with the heuristic algorithm and the ILP approach. Let C H and C ILP be the empirical ratios of proved compatible blocks, I H and I ILP the empirical ratios of proved incompatible blocks, and U H and U ILP the empirical ratios of unsolved blocks. In those last ratios, some of them are compatible CH , CILP and some of them are incompatible ĨH , ĨILP but with unknown values such that: U H = CH + ĨH and U ILP = CILP + ĨILP . All those values depend on the number of iterations, but for the sake of clarity, this value is omitted here. Finally, the true probability to be compatible is approximated by p C = C H + CH = C ILP + CILP and the true probability to be incompatible is approximated by p I = I H + ĨH = I ILP + ĨILP .

For the heuristic algorithm, we use 1k blocks for each number of modification but 100k blocks if there is no modification since all blocks are compatible and the algorithm is very fast in that case. However, there is no incompatible block detected with this approach: I H = 0, so we approximate the probability of incompatible blocks by the ratio of unsolved blocks U H . Because of the time-out value, we can show that this approximation is an upper bound (UB): U H = CH + ĨH ≥ ĨH = p I . But this approximation is only good if the ratio of unsolved compatible blocks CH is small.

For the ILP approach, we use 100 blocks per point (the method is very slow) and we can extract a lower bound and an upper bound of the probability of being incompatible. First, I ILP is an lower bound (LB): I ILP ≤ p I . Second, the ratio of incompatible plus the ratio of unsolved blocks is an upper bound of the probability to be incompatible:

I ILP + U ILP = I ILP + CILP + ĨILP ≥ I ILP + ĨILP = p I .
Finally, we have two upper bounds and one lower bound: p I ≤ U H for the heuristic algorithm and I ILP ≤ p I ≤ I ILP + U ILP for the ILP algorithm.

Results of this experiment are shown in Fig. 5 and we can conclude that the true probability p I of becoming incompatible after a number of modifications is between the lower bound Fig. 6. Variation of unsolved blocks using the heuristic algorithm depending on the number of iterations and modifications. Convergence slows down after 50k iterations, which suggests that the heuristic upper bound is not very far from the real value.

of the ILP approach and the minimum of the two upper bounds. The other interesting result is that for 0 modifications, the ratio of unsolved blocks B of the heuristic algorithm is approximately 0.5%. That gives an idea of the gap between the upper bound of the heuristic and the true probability (which is exactly 0 when there is no modification): the true value is probably closer (give or take a few percent) to the upper bound than to the lower bound. The yellow line shows the upper bound of the heuristic algorithm but using another DCT method which is islow. We can see that this upper bound is always above the one from the naive DCT method even for 0 modification by a significant gap. We propose two interpretations: either the probability of being incompatible is very dependent on the DCT method used, or the heuristic algorithm is not as good at solving the problem with this DCT method. The second interpretation seems more meaningful when we dive deeper into the heuristic algorithm implementation. See Appendix A for more details.

Fig. 6 shows the evolution of the ratios of unsolved blocks U H using the heuristic algorithm depending on the number of iterations. At 50k iterations, those values -and therefore the upper bound on the probability of incompatible -start to stagnate and we can see that with a few iterations more, all 100k blocks with 0 modifications could have been solved.

B. Links with other statistics

The previous paragraph shows a clear correlation between the number of modifications and the probability of becoming incompatible. A natural question that emerges from this result is whether the incompatibility depends on the position of the modification. Is there more chance of becoming incompatible if we modify the DC or an AC coefficient? We ran a similar experiment as before but this time the modifications were not randomly selected. For every block, we try to find an antecedent after applying a single modification in each of the 64 coefficients for +1 and -1 separately. Using the heuristic algorithm we cannot prove that a block is incompatible, but we can use the same approximation as before with the ratio of unsolved blocks U H . The heat map in Fig. 7 shows that this probability is uniform for every position (also the case if we separate the +1 for the -1). We conclude from these results that the incompatibility does not depend on the position of the change or the sign of the change. This can be explained by the fact that the DCT transform can be seen as an arbitrary rotation of the block in the pixel domain to the block in the DCT domain and that there is no reason that one direction is more subject to incompatibility than another. This property will be used in the next section to build a statistical test.

The second feature is the variance of the spatial rounding error. This feature is the cornerstone of the RJCA [START_REF] Butora | Reverse jpeg compatibility attack[END_REF] because we can show that at high QF, the distribution under the cover hypothesis converges toward a wrapped Gaussian with a known variance close to 0.064. But under the stego hypothesis, the same variance increases toward 1 12 ≃ 0.083, the variance of a uniform distribution. In Fig. 8 we observe a very strong correlation between the variance of a single block and the compatibility property. In particular, the variance of the spatial rounding error (a very easy feature to compute) could be used as a proxy for compatibility and also for the number of modifications. Indeed, we can see that for unsolved blocks, the more coefficients are modified, the higher the variance.

V. STEGANALYSIS

In the framework of steganography and steganalysis, by definition, an incompatible block is a block that has been modified. Previous sections have presented algorithms to track the compatibility or not of a block and some statistics about the probability of existence. In this section, we propose two scenarios of steganalysis: the first one uses the ILP approach assuming a lot of resources (time especially) and the second one is a Likelihood Ratio Test using the heuristic approach.

A. Zero False Alarm steganalysis

The main advantage of the ILP approach for finding incompatible blocks is precision: if the solver proves that the ILP problem is infeasible, then the block does not have any antecedent and has been modified by the embedding: this deduction is always true. Therefore, the ILP method gives a perfectly precise classification and does not produce any False Alarm (misclassifying a cover image). However, this precision has an expensive price which is the amount of resources needed in time and processing power.

We will assume that we have infinite resources to carry out our experiments in the form of a simulation since as seen in Section III-D, the detection of a single incompatible block is already very time-consuming. On the Alaska dataset, we embed images of N = 1024 blocks using J-UNIWARD and UERD for different embedding rates. We count the number of modifications m i for every block i = 1, . . . , N , and we use the probabilities p m to become incompatible with the ILP solver obtained in Fig. 5.

The probability P incomp that at least one block of the image is detected as incompatible can be derived as follows:

P incomp = 1 - N i=1 (1 -p mi ) . (7)
For example, using two blocks and using the empirical results of section IV-A, the first with three modifications and the second with one modification, the probability of being detected for at least one block (and thus for the image) is

1 -(1 -p 3 )(1 -p 1 ) = 1 -0.85 × 0.97 ≈ 0.18.
Results of this simulation are shown in Fig. 9, where we can see that the detection increases with the payload and tends toward perfect detection around 0.03 bpp. Notice how UERD is more detectable than LSBM because it modifies more coefficients and thus it is more susceptible to creating incompatible blocks. It should also be remembered that the probabilities used for this simulation are a lower bound of the true probabilities and hence the true detection power should be greater than the one in the graph if more iterations of the algorithm were used. 9. Detection power depending on the embedding rate with the ILP approach for two popular embedding schemes (UERD and LSBM) assuming infinite resources for an image of 1024 blocks. An image is detected as stego if at least one block is incompatible. Note that this detection method does not generate false positives.

B. Likelihood Ratio Test

Proving that a block is compatible is easier than the opposite but it is not sufficient to decide if the image is cover or not.

Instead, we now derive a Likelihood Ratio Test (LRT) on the amount of unsolved blocks in an image. Unsolved blocks are the ones for which there is still no antecedent found after running a given number of iterations of an algorithm. We propose in this subsection to build a statistical test based on the number of unsolvable blocks found in a test image. Since the heuristic algorithm is faster and more versatile, we decided to use it to detect unsolvable blocks.

In order to build our test we introduce a few variables. Let i ∈ {1, . . . , n} be the indices of blocks with n ≤ N an hyper-parameter. We use the heuristic algorithm on every block, but since this algorithm cannot prove that a block is incompatible (because of the complexity of the problem) we observe a vector of variables T = (t 1 , . . . , t n ). If t i = 1 the algorithm reached the timeout value for the block i and did not find any antecedent, it is consequently unsolvable for a given amount of iterations. Otherwise, if t i = 0 the block is compatible. We have seen in the last section that the probability for a block to become incompatible depends only on the number of modifications m i in this block. So, let M = (m 1 , . . . , m n ) be the vector of number of modifications. We define the likelihood for an image to observe a vector T as p

M (T) = p m1 (t 1 ) × • • • × p mn (t n ).
We consider two hypotheses:

H 0 : The image is cover: T ∼ p 0 , H 1 : The image is stego: T ∼ p M , ∀ i, m i ≥ 0. (8)
Because of the independence between blocks, the likelihood ratio for the image is the product of the likelihood ratio of every block:

Λ(T ) = p M (T) p 0 (T) = n i=1 p mi (t i ) p 0 (t i ) = n i=1 64 m=0 P (t i |m i = m)P (m i = m) P (t i |m i = 0) (9)
Finally, the log-likelihood ratio for an image using n blocks is:

log(Λ(T)) = n i=1 log 64 m=0 P (t i |m i = m)P (m i = m) -log(P (t i |m i = 0)) (10)
We now give the analytic form of the prior P (m) and the values of likelihood P (t|m).

Prior. The prior on the number of modifications P (m) can be crucial to yield a powerful test. Therefore, we make a separation of cases:

The easiest case and probably the least powerful is when nothing is known. In this case, the prior on m is a uniform law on [1; 64].

Another alternative happens when the detector is Selection-Channel-Aware [START_REF] Denemark | Selection-channel-aware rich model for steganalysis of digital images[END_REF]: if the map of embedding probabilities (aka the p-map) of the embedding algorithm is known we can use it to derive the approximate number of modifications. The p-map of a block is composed of 64 probabilities (q i ) i∈ [1;64] , one for each coefficient, and represents the probability to be modified. The distribution of the number of modifications is given by the Poisson-Binomial law which is the sum of 64 Bernoulli experiments all with different parameters. We denote this law P B ((q i ) i∈ [1;64] ).

To sum up the different priors we use are:

• nothing is known: we then use the classical uniform prior, i.e. P (m) ∼ U([1; 64]), • the embedding algorithm and the p-map are known:

P (m) ∼ P B ((q i ) i∈[1;64] ).
The likelihoods p m (t) = P (t|m) can be derived from Fig. 5. Note that the likelihood and t depend on a hidden parameter which is the maximum number of iterations. For the sake of simplicity, we do not write the number of iterations explicitly but it is important to take it into account as a parameter that will impact the LRT, hence the classification performances.

C. Selection strategies

The LRT designed in the previous paragraph can scale with the number of blocks available in the image. However, the algorithms solving the inverse problem are costly in time. We are thus facing a trade-off between resources and performance: the image is composed of N blocks but we only have the resources to solve the problem on n < N blocks, how do we choose them to maximize the detection performance?

We present three different strategies to sort blocks of an image so that we increase our chance of selecting blocks susceptible to being modified and thus potentially incompatible.

• Random: The random strategy is the trivial one: the blocks are randomly sorted. It will be used to compare with other strategies. • Variance of the rounding error: The RJCA [START_REF] Butora | Reverse jpeg compatibility attack[END_REF] was built on the study of the variance of the spatial rounding error. In the cover image, this variance should be fixed but under the stego hypothesis, this variance increases. It seems reasonable to think that the same behavior happens for blocks: modified blocks should be more likely to have a bigger variance of the spatial rounding error than cover blocks. This behavior was already observed [START_REF] Butora | Fighting the reverse JPEG compatibility attack: Pick your side[END_REF] for different embedding algorithms and rounding functions. • SCA: Assuming selection-channel-awareness means that we know the probability of modifications for every DCT coefficient. In this case, it is possible to sort blocks depending on the expected modification number. This value is simply the mean of the 64 probabilities of the probability map in a block.

VI. RESULTS

A. Experimental setup

In order to show the main performances of the LRT for small datasets of images we will use a simulation instead of a real run which would take a lot of time and resources. This simulation is possible because we assume that incompatibility only depends on the number of modifications in a DCT block (cf. Fig. 5). In particular, the property does not depend on modification positions (cf. Fig. 7) or the content which means that the embedding scheme does not matter, only the number of modifications matters. We show in one experiment (see Fig. 11) that the simulation is meaningful and very close to classification with image databases.

We used 5000 images of size 256 × 256 from Alaska and embedded them using UERD and LSBM at different payloads between 0.001 and 0.01 bits per pixel (bpp). Instead of running the heuristic on every block, we simulate the output as follows. Let M = (m 0 , . . . , m N ) be the vector of the number of modifications per block for an image composed of N blocks. We want to simulate the output of the heuristic algorithm T = (t 0 , . . . , t N ) to compute the LRT test. To do so, we draw a random vector r ∈ [0; 1] N and by comparing it with the probabilities to be incompatible knowing the number of modifications, we can simulate the output of the algorithm:

∀ i, t i = 1 if r i ≤ P (t = 1|m i ), 0 otherwise. ( 11
)
Where the probabilities P (t = 1|m) are given in Fig. 5.

With this simulation of T we can compute the LR with formula [START_REF] Guo | Using statistical image model for jpeg steganography: Uniform embedding revisited[END_REF]. The vector T can be sub-sampled with a selection strategy of blocks that are more susceptible to being incompatible (cf. section V-C) and the prior of the LR can be adjusted depending the SCA assumption or not.

To show that our simulation is close to reality, we also run the test on a dataset composed of only 600 cover images and 600 stego images embedded at 0.01 bpp with LSBM and UERD.

For comparison w.r.t. deep learning detectors, we selected e-SRNet, the SRNet [START_REF] Boroumand | Deep residual network for steganalysis of digital images[END_REF] trained on the decompression errors e. We split the 25k 256 × 256 Alaska images into training, validation, and testing sets of sizes 19k, 1k, and 5k respectively. We trained the detector on 0.01 bpp for 30 epochs with the rest of the hyperparameters as described in [START_REF] Butora | Analysis and mitigation of the false alarms of the reverse jpeg compatibility attack[END_REF]. The best checkpoint was used to refine the classifier on smaller payloads for additional 15 epochs. We presented two different priors and three selection strategies in sections V-B and V-C, but not every combination is interesting. Assuming selection channel awareness means that the embedding algorithm used and the message length are known, we can therefore compute the probabilities of modifications for every DCT coefficient. The exact prior should be computed with the probabilities of modifications of the cover image. But if this one is not known, we can use the potential stego image to yield a very close approximation of it. On the contrary, if no knowledge is available to perform the steganalysis we can only access the variance of the spatial rounding error. We present the results for four strategies, one with SCA, one without SCA, and two "control" strategies in table I. Finally, we introduce the total probability of error under equal priors that will be used to compare different models and strategies:

Name

P E = min PFA P FA + P MD (P FA ) 2 ,
with P FA the probability of False Alarm (type I error) and P MD the probability of Missed Detection (type II error).

B. Results

Fig. 10 shows the impact of each strategy using images embedded at 0.005 bpp with UERD. Without surprise, with the SCA assumption, the best strategy is to use it to select blocks and to compute the prior in the LRT. But without SCA assumption, in the blind case, the variance of the spatial rounding error seems to be a good metric to select blocks: the bottom left graph shows that using 10% of the blocks out of 1024 is already close to the best performance using all blocks. Selecting blocks randomly is a bad choice if you do not use every block in the image, you are most likely to select compatible blocks that do not show any evidence of stego message. The partial SCA is interesting because it shows that the LRT performs better when using only 10% of the blocks if they are well chosen instead of taking the full image. The intuition behind these results is that the LRT becomes more confident that the image is stego when there is a majority of unsolved blocks with high prior due to the SCA assumption among the solved blocks. If 100% of the blocks are used, there is a majority of solved blocks because the payload is so small that only a few blocks are modified and therefore, the LRT tends to give more weight to the cover hypothesis even if there is still a non-negligible fraction of unsolved blocks.

The shape of the ROC can also be explained due to the small number of blocks used in the LRT. If only 10 blocks are used, there are only 11 possible outcomes of the heuristic: either 0, 1, ..., 9, or 10 blocks are unsolved. Therefore the LRT using 10 blocks only has 11 possible values and thus 11 maximum points in the ROC curves. Most of them are close to the point (1,1). In the case of the SCA assumption, the ROC is smooth because different priors are used for each image which yields different values for the LRT and thus an infinite possibilities of points on the ROC.

Note that using the LSBM embedding, SCA, partial SCA, and Control returns the same results because the probabilities of modifications are equal for all elements and for all images (the message always has the same length) and thus do not give any information about the locations of modifications. With LSBM only the blind strategy is useful and will be used for the next results.

Fig. 11 represents the ROC for 0.01 bpp embedded with LSBM and UERD respectively. The performance of e-SRNet corresponds to the green line and red lines are the simulated result on the same dataset. The blue lines are the results of an experiment without simulation but less images. Dotted lines and dashed lines are the results using only 1% and 10% of the blocks of the image respectively. The main feature of this figure is that both simulation and real experiments are very close to each other when using the full image. There are few differences when using 1% or 10% of the blocks but we recall that this experiment used only 600 stego images and 600 cover images and thus is sensible to the noise. However, one explanation is that for the simulation, the probability of being incompatible for 6 or more modifications per block is supposed equal to the probability with 5 modifications per block, which means that the probabilities of the simulation are underestimated. And, even at 0.01 bpp, we can observe more than 5 modifications in some blocks (especially with the UERD scheme). The figure also shows that our test has better results than e-SRNet even without the SCA assumption (the blind strategy was used).

Moreover, the agreement between the simulated and nonsimulated results is a good argument in favor of our simulation hypotheses. In particular, the fact that the incompatibility property only depends on the number of modifications per block. We recall that for this set of experiments, we decided to use mainly simulations to reduce greatly the computational time, by decreasing it by one order of magnitude, without altering the scientific conclusions. Fig. 12 shows the evolution of the total probability of error under equal prior P E for the blind strategy and different payloads between 0.001 and 0.01 bpp. We can see that even with 1% of the blocks the heuristic algorithm outperforms e-SRNet both on UERD and LSBM embedding schemes. By using more blocks the algorithm tends to perfect detection for bigger payloads. Of course, if the SCA assumption is used, the performance could be even better.

VII. CONCLUSIONS AND PERSPECTIVES

Incompatible JPEG blocks can be created at QF100 with any embedding scheme. This property does not depend on the position of the modifications but only on the number of modifications per block and is very correlated to the variance of the spatial rounding error. The question of differentiating incompatible blocks from compatible ones has been formulated as an inverse problem with or without a solution. Two algorithms were presented to solve this problem: a heuristic algorithm that can use every JPEG pipeline in a black-box setting and can find the solution rather quickly if it exists, and an ILP formulation that can prove that blocks are incompatible with the naive DCT method.

We used the heuristic algorithm combined with a likelihood ratio test to derive a powerful classifier. Using different selection strategies, it can use only a subset of the blocks in the image and yield state-of-the-art results at QF100. It is also possible to improve it with a selection-channel-aware version that is even better than the blind version.

This detector requires knowledge about the JPEG pipeline used to compress stego and cover images and a certain amount of time to solve the inverse problems but the only limit to its performance is the computational power available. With enough power, the detector becomes perfectly reliable with no false alarms.

In the future, with more computational power but also potentially more efficient solvers, attacks based on detecting incompatibilities can become more and more popular. In particular, it could be applied to other data formats such as H26x, HEIC, or any compression standard that uses a DCT method with quantization. Another approach would be to create a steganographic scheme in order to remain compatible with the DCT compression. This was already tried in [START_REF] Butora | Fighting the reverse JPEG compatibility attack: Pick your side[END_REF] by reducing the variance of the spatial rounding error to fool the detector and we now know that the variance can be seen as a proxy to the compatibility property.

to have the same metric. However, this second metric is not perfect since some candidates still have the same first and second metrics. We could opt for the ℓ 2 norm but from our experiments, it performs very poorly to solve our problem because the sphere of the ℓ 2 norm is bigger than the unit cube and thus generates lots of bad candidates.

This issue with quantized DCT transform explains the difference of probabilities between the naive DCT and the islow DCT visible in Fig. 5. The true probabilities are probably very close to each other since both DCTs should yield almost the same result, but the heuristic algorithm is not as good when there are too many ties between different candidates and therefore is less likely to solve compatible blocks.

Fig. 2 .

 2 Fig.2. Framework of our method for finding incompatible blocks of a JPEG compressor. Red contours highlight the materials available to Eve to perform the steganalysis study.

  of rounding and then clipping the values to the range [0; 255].

Fig. 3 .

 3 Fig. 3. JPEG pipeline illustrating the notations. The separation unknown/known refers to what the steganalyzer knows or does not.

Fig. 4 .

 4 Fig.[START_REF] Butora | Fighting the reverse JPEG compatibility attack: Pick your side[END_REF]. Toy illustration in 2D. Starting from a random block of 2 pixels, we extract e the rounding error in the spatial domain and e ′ the rounding error after embedding a message in the DCT coefficients. The dotted contours represent areas where an integer coordinate can be a solution to problem[START_REF] Benes | Know your library: How the libjpeg version influences compression and decompression results[END_REF]. If no integer coordinate falls into this rectangle -for example the orange rectangle on the left plot -it means that there is no solution to the inverse problem and therefore the block is incompatible. On the left, the quantization values are[START_REF] Agarwal | Photo forensics from rounding artifacts[END_REF][START_REF] Agarwal | Photo forensics from rounding artifacts[END_REF] (2D equivalent of QF100), and on the right[START_REF] Agarwal | Photo forensics from rounding artifacts[END_REF][START_REF] Benes | Know your library: How the libjpeg version influences compression and decompression results[END_REF] (2D equivalent of a QF lower than 100). The red dot is the compression error k.

  Fig.5. Empirical probability for a block to become incompatible after a given number of ±1 modifications on DCT coefficients. The blue curve corresponds to blocks proven incompatible using the ILP approach after 3B iterations, it is a lower bound (LB) of the real value. The orange curve shows incompatible and unsolved blocks using the ILP approach again, it is an upper bound (UB) of the real value. Finally, the green curve shows unsolved blocks: another upper bound for 50k iterations of the heuristic approach. Blue and orange used 100 blocks per point and green used 1000 blocks per point.

Fig. 7 .

 7 Fig.7. Heat-map showing the probability for a block to become incompatible after modifying a single coefficient for every one of the 64 positions. The randomness of the pattern tells us that there is no dependence between the position of the modification and the incompatibility of the block.

Fig. 8 .

 8 Fig.8. Correlation between the number of modifications and the variance of the spatial rounding error. Outliers are hidden for the sake of clarity. There is a clear correlation between a high variance and a high probability of being incompatible but also a correlation between the variance and the number of modifications.

  Fig.9. Detection power depending on the embedding rate with the ILP approach for two popular embedding schemes (UERD and LSBM) assuming infinite resources for an image of 1024 blocks. An image is detected as stego if at least one block is incompatible. Note that this detection method does not generate false positives.

Fig. 10 .

 10 Fig. 10. Simulation of ROC for different block selection strategies and prior. Stego images are embedded with UERD at 0.005 bpp. The first term of the title is the selection strategy and the second is the prior.

Fig. 12 .

 12 Fig.[START_REF] Holub | Universal distortion function for steganography in an arbitrary domain[END_REF]. P E for the blind strategy and comparison with e-SRNet.

  Algorithm 1 Heuristic to find pixel antecedents Require: c ∈ Z 64 , Q ∈ Z 64 {DCT coefficients and quantization table} Require: s ∈ Z 64 {Starting point in pixel domain} Require: f {Forward DCT function} Require: M ∈ N {Max iteration} queue ← [(inf, s)] {Priority queue with cost and pixel value} while queue not empty and iter ≤ M do iter ← iter + 1 v p , p ← remove first element of queue {p is a pixel vector of integer} for n in neighbours do if n has not been visited then if round

TABLE I COMBINATION

 I OF BLOCK SELECTION STRATEGIES WITH PRIORS.

ACKNOWLEDGMENTS

The work presented in this paper received funding from the European Union's Horizon 2020 research and innovation program under grant agreement No 101021687 (project "UN-COVER"). We also thank Tomas Pevny (Technical University of Prague) for pointing us to the use of solvers like Gurobi.

APPENDIX

A. Discussion on heuristic metric

The main idea of the heuristic search is to rank neighbors depending on the metric (4) and then explore the "best" candidate. This metric is completely fine for selecting good candidates, however, the algorithm will struggle to converge if most of the candidates have the same metric. The equality case is difficult to solve in most cases but we can reduce it by combining it with a second metric which is less likely to yield the same metric for two candidates. The sorting operation is then done using the first and second metrics in this order. This second metric is the following:

Instead of taking the maximum of the absolute value, we sum every value outside of the cube of size 0.49. This favors the candidate with most of its coordinates inside the cube and not on the border of the cube. If a coordinate is inside the cube, the distance is negative and thus it is clipped to 0. This metric is particularly needed for islow and other integer DCT transforms. Indeed, candidates obtained with islow have quantized coordinate that makes them more likely


Marine Casetta

Jacinthe Caillaud

Sylvie Philippe

Lucie Courcot

David Dumoulin

Vincent Cornille

Véronique Alaimo

Gabriel Billon

Michaël Hermoso

Industrial dust deposition in Gravelines (Northern France): first investigations on trace metal contamination of urban soils

de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Through the discharge of pollutants, urbanization and industrial activities impact all the compartments of the environment and the ecosystems. Consequently, metal pollution of soils and atmosphere has become a significant problem in urban areas.

In the Dunkirk agglomeration (Northern France), the construction of a large seaport during the 20 th century was accompanied by the installation of several metallurgical industries. Dust emissions resulting from their production and storage activities are mainly composed of atmospheric particles of soot, aluminosilicates, silica, calcium or iron. These industrial particles can be associated with specific minor and trace elements : Cr, Cu, K, Mg, Mn, Na, Pb, Ti, Zn or Cl. The composition and the size of the particles determine their fate after emission and influence their toxicity.

This study focuses on sedimentable particles (>20 µm) that cannot penetrate deeply into the respiratory system but can be ingested, especially by children. Due to its location (1 to 2 km South-West of major industries), the city of Gravelines is particularly exposed to dust deposition during North-East windy and dry events.

Among the studies conducted on particles emitted in the Dunkirk area, none was focused on soil matrices. Therefore, the question of the long-term fate of their deposition remains open : what is the influence of these dusts on the chemical quality of the soils of Gravelines ? Which areas of the city of Gravelines are the most affected by metal contamination (potentially associated with dust) ?

Pedological and chemical parameters of topsoils (the first 5 cm) sampled in the city of Gravelines were, first, characterized with the aim to interpret their reactivity to metal inputs. Then, the trace metal concentrations of topsoils and collected dust samples were determined by inductively coupled plasma-mass spectrometry (ICP-MS) to (1) map the areas contaminated by trace metals, (2) assess the levels of environmental pollution, (3) quantitatively characterize the metals associated with dust fallout, and (4) highlight the specific influence of industrial dusts on the potential soil contamination in Gravelines.

The first results on the metal contents measured in the topsoil samples of Gravelines rather reflect a diffuse metallic contamination. The study of the entire topsoil samples may be questioned because of the dilution of the "dust" signal by the soil matrix. The relative youth of the large seaport of Dunkirk (between 30 and 40 years old), as well as the probable re-mobilization of dust by the winds, may partly explain the moderate contamination measured in soils of Gravelines. However, our results show higher levels of contamination (for some specific metals) and a significant Pollution Load Index (PLI) in the soils located near dust emission sources. Moreover, the combined mapping of metal contents and soil parameters allows the identification of possible differences in metal behavior depending on the nature of the matrix considered. This latter aspect will be discussed in particular according to the use of soils and vegetation (e.g. proximity of the vegetable gardens), in order to highlight areas requiring special attention from an ecotoxicological point of view.

Powered by TCPDF (www.tcpdf.org)