We propose a method to identify the source and target regions of a copy-move forgery so allow a correct localisation of the tampered area. First, we cast the problem into a hypothesis testing framework whose goal is to decide which region between the two nearly-duplicate regions detected by a generic copy-move detector is the original one. Then we design a multi-branch CNN architecture that solves the hypothesis testing problem by learning a set of features capable to reveal the presence of interpolation artefacts and boundary inconsistencies in the copy-moved area. The proposed architecture, trained on a synthetic dataset explicitly built for this purpose, achieves good results on copy-move forgeries from both synthetic and realistic datasets. Based on our tests, the proposed disambiguation method can reliably reveal the target region even in realistic cases where an approximate version of the copy-move localization mask is provided by a state-of-the-art copy-move detection algorithm.

Social Networks (SN) and Instant Messaging Apps (IMA) are more and more engaging people in their personal relations taking possession of an important part of their daily life. Huge amounts of multimedia contents, mainly photos, are poured and successively shared on these networks so quickly that is not possible to follow their paths. This last issue surely grants anonymity and impunity thus it consequently makes easier to commit crimes such as reputation attack and cyberbullying. In fact, contents published within a restricted group of friends on an IMA can be rapidly delivered and viewed on a SN by acquaintances and then by strangers without any sort of tracking. In a forensic scenario (e.g., during an investigation), succeeding in understanding this flow could be strategic, thus allowing to reveal all the intermediate steps a certain content has followed. This work aims at tracking multiple sharing on social networks, by extracting specific traces left by each SN within the image file, due to the process each of them applies, to perform a multi-class classification. Innovative strategies, based on deep learning, are proposed and satisfactory results are achieved in recovering till triple up-downloads.

The majority of news published online presents one or more images or videos, which make the news more easily consumed and therefore more attractive to huge audiences. As a consequence, news with catchy multimedia content can be spread and get viral extremely quickly. Unfortunately, the availability and sophistication of photo editing software are erasing the line between pristine and manipulated content. Given that images have the power of bias and influence the opinion and behavior of readers, the need of automatic techniques to assess the authenticity of images is straightforward. This paper aims at detecting images published within online news that have either been maliciously modified or that do not represent accurately the event the news is mentioning. The proposed approach composes image forensic algorithms for detecting image tampering, and textual analysis as a verifier of images that are misaligned to textual content. Furthermore, textual analysis can be considered as a complementary source of information supporting image forensics techniques when they falsely detect or falsely ignore image tampering due to heavy image postprocessing. The devised method is tested on three datasets. The performance on the first two shows interesting results, with F1-score generally higher than 75%. The third dataset has an exploratory intent; in fact, although showing that the methodology is not ready for completely unsupervised scenarios, it is possible to investigate possible problems and controversial cases that might arise in real-world scenarios.

Clustering images according to their acquisition devices is a well-known problem in multimedia forensics, which is typically faced by means of camera sensor pattern noise (SPN). Such an issue is challenging since SPN is a noise-like signal, hard to be estimated, and easy to be attenuated or destroyed by many factors. Moreover, the high dimensionality of SPN hinders large-scale applications. Existing approaches are typically based on the correlation among SPNs in the pixel domain, which might not be able to capture intrinsic data structure in the union of vector subspaces. In this paper, we propose an accurate clustering framework, which exploits linear dependences among SPNs in their intrinsic vector subspaces. Such dependences are encoded under sparse representations, which are obtained by solving an LASSO problem with non-negativity constraint. The proposed framework is highly accurate in a number of clusters' estimation and image association. Moreover, our framework is scalable to the number of images and robust against double JPEG compression as well as the presence of outliers, owning big potential for real-world applications. Experimental results on Dresden and Vision database show that our proposed framework can adapt well to both medium-scale and large-scale contexts and outperforms the state-of-the-art methods.

Recognizing fake images in online news is a challenging problem. This is especially true in the case of critical situations, when journalists might insert high-impact images to make a piece of news more appealing to the readers, neglecting to check their authenticity and provenance. Given the importance of this task, in the literature, it is possible to find several attempts to solve the problem from different points of view. This paper faces the specific problem of recognizing images in online news which have been modified or mis-contextualized, i.e. images taken in a different place and/or time with respect to the event to which they are associated. To identify image tampering a number of image forensic techniques were exploited and combined. On the other hand, for mis-contextualization detection, a textual analysis approach is proposed based on the extraction of features from the news the image is associated with, and from textual information retrieved online using the image at stake as pivot. The obtained results are rather satisfactory on laboratory data, with results that in some cases improve the state of the art for image forensics. The method was tested on three datasets, one of which already used in the literature, while the others created ad-hoc to further investigate its performances.

Studying the impact of sharing platforms like social networks and messaging services on multimedia content nowadays represents a due step in multimedia forensics research. In this framework, we study the characteristics of images that are uploaded and shared through three popular mobile messaging apps combined with two different sending mobile operating systems (OS). In our analysis, we consider information contained both in the image signal and in the metadata of the image file. We show that it is generally possible to identify a posteriori the last app and the OS that have been used for uploading. This is done by considering different scenarios involving images shared both once and twice. Moreover, we show that, by leveraging the knowledge of the last sharing app and system, it is possible to retrieve information on the previous sharing step for double shared images. In relation to prior works, a discussion on the influence of the rescaling and recompression mechanism - usually performed differently through apps and OSs - is also proposed, and the feasibility of retrieving the compression parameters of the image before being shared is assessed.

In this paper, we propose a novel approach for face spoofing detection using the high-order Local Derivative Pattern from Three Orthogonal Planes (LDP-TOP). The proposed method is not only simple to derive and implement, but also highly efficient, since it takes into account both spatial and temporal information in different directions of subtle face movements. According to experimental results, the proposed approach outperforms state-of-the-art methods on three reference datasets, namely Idiap REPLAY-ATTACK, CASIA-FASD, and MSU MFSD. Moreover, it requires only 25 video frames from each video, i.e., only one second, and thus potentially can be performed in real time even on low-cost devices.