IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY 1 A SIFT-based forensic method for copy-move attack detection and transformation recovery Irene Amerini, Lamberto Ballan, Student Member, IEEE, Roberto Caldelli, Member, IEEE, Alberto Del Bimbo, Member, IEEE, and Giuseppe Serra Abstract—One of the principal problems in image forensics is determining if a particular image is authentic or not. This can be a crucial task when images are used as basic evidence to influence judgment like, for example, in a court of law. To carry out such forensic analysis, various technological instruments have been developed in the literature. In this paper the problem of detecting if an image has been forged is investigated; in particular, attention has been paid to the case in which an area of an image is copied and then pasted onto another zone to create a duplication or to cancel something that was awkward. Generally, to adapt the image patch to the new context a geometric transformation is needed. To detect such modifications, a novel methodology based on Scale Invariant Features Transform (SIFT) is proposed. Such a method allows both to understand if a copy-move attack has occurred and, furthermore, to recover the geometric transformation used to perform cloning. Extensive experimental results are presented to confirm that the technique is able to precisely individuate the altered area and, in addition, to estimate the geometric transformation parameters with high reliability. The method also deals with multiple cloning. Index Terms—Digital image forensics, copy-move attack, au- thenticity verification, geometric transformation recovery. I. I NTRODUCTION D IGITAL crime, together with constantly emerging soft- ware technologies, is growing at a rate that far surpasses defensive measures. Sometimes a digital image or a video are incontrovertible evidence of a crime or the proof of a malev- olent action. By looking at a digital content as a digital clue, multimedia forensics aims to introduce novel methodologies to support clue analysis and to provide an aid for making a decision about a crime. Multimedia forensics [1], [2], [3] deals with developing technological instruments operating in the absence of watermarks [4], [5] or signatures inserted in the image. In fact, different from digital watermarking, forensics means are defined as “passive” because they can formulate an assessment on a digital document by resorting only to the digital asset itself. These techniques basically allow the user to determine if particular content has been tampered with [6], [7] or which was the acquisition device used [8], [9]. In particular, by focusing on the task of acquisition device Copyright (c) 2011 IEEE. Personal use of this material is permitted. However, permission to use this material for any other purposes must be obtained from the IEEE by sending a request to pubs-permissions@ieee.org. Manuscript received September 14, 2010; revised January 14, 2011; ac- cepted March 10, 2011. The associate editor coordinating the review of this manuscript and approving it for publication was Prof. Wenjun Zeng. The authors are with Media Integration and Communication Center, Uni- versity of Florence, Italy (e-mail: irene.amerini@unifi.it; ballan@dsi.unifi.it; roberto.caldelli@unifi.it; delbimbo@dsi.unifi.it; serra@dsi.unifi.it). Fig. 1. An example of image tampering that appeared in press in July, 2008. The feigned image (on the right) shows four Iranian missiles but only three of them are real; two different sections (encircled in red and purple, respectively) replicate other image sections by applying a copy-move attack. Fig. 2. A close look at this picture, appearing in press in 2007 (Fars News Agency, Tehran), shows that many elements are cloned over and over. Also in this case the cloned sections are encircled in different colors. identification, two main aspects must be studied: the first is to understand which kind of device generated a digital image (e.g. a scanner, a digital camera or is a computer graphics product) [10], [11], while the second is to determine which specific camera or scanner (by recognizing model and brand) acquired that specific content [8], [9]. The other main multimedia forensics topic is image tamper- ing detection [6], that is assessing the authenticity of a digital image. Information integrity is fundamental in a trial, but it is clear that the advent of digital pictures and relative ease of digital image processing today makes this authenticity un- certain. Two examples of this problem, that recently appeared in newspapers and TV news, are given in Fig. 1 and Fig. 2. Modifying a digital image to change the meaning of what is represented in it can be crucial when used in a court of law where images are presented as basic evidence to influence the judgement. Furthermore, it is interesting, once established that something has been manipulated, to understand exactly what happened: if an object or a person has been covered, if a part of the image has been cloned, if something has been copied from another image, or if a combination of these processes has been carried out. In particular, when an attacker creates his feigned image by cloning an area of the image onto another zone (copy-move attack), he is often obliged to apply a geometric 0000–0000/00$00.00 © 2011 IEEE