Evaluating an image is disclosed. A plurality of attributes of the image is analyzed. A determination is made that a portion of the attributes of the image imperfectly matches a reference attribute signature corresponding to a device. It is distinguished whether the imperfect match likely corresponds to a modification of the image.