Possible to avoid device fingerprinting with imagemagick?

Question

If I took a picture with my mobile phone and wanted to publish that photo without any artefacts connect to me, the first thing I would do is strip all of the image metadata with 'exiftool':

exiftool -all= IMG_1234.JPG

... but it is well understood that even without the exif data, the image size, resolution, compression level, etc., has a lot of identifying information in it that can be tied back to the camera that took it.

What is the optimal why I could break device fingerprinting in a photo after stripping the exif data by processing it in some way with ImageMagick?

A good first start would be to simply resize the image to a random integer percentage:

magick convert image.jpg -resize 95% image2.jpg

... and not only would that change the resolution and the image size, but since nothing was changing but the size (we're not cropping), presumably the entire compression of the image would also change, perhaps eliminating a lot of identifying compression artefacts?

Is that a big step forward or not much of a step at all?

If simply changing the percentage size of the image is not much of a step towards avoiding device fingerprinting, what would be?

What imagemagick transformation - or transformations - would make an image very difficult to tie to a particular camera or to a particular set of already published photographs?

Answer 1

Your stated protections are reasonable, however using ML techniques (given a large enough corpus) would likely defeat them. That could be mitigated by introducing some imperceptible randomness to throw off the model, but that in and of itself is a marker. Also, sensor fingerprinting using something like Camfinger would still allow someone to uniquely identify photos. I can't find any known ways to subvert that, so ... again, introducing an imperceptible random mask (least-significant-bit perhaps?) may be effective.

To directly answer your questions: the random cropping does distort compression and therefore remove that vector of identification, exifdata removal is necessary, and given a motivated enough attacker (for example, The Government) there are too many hardware markers to fingerprint a device that removing all of them is futile or at least very difficult without damaging the image.