An Invisible Watermarking Technique For Image Verification - Image ...

AN INVISIBLE WATERMARKING TECHNIQUE FOR IMAGE VERIFICATION Minewa M. Yeung and Fred Mintzer IBM T.J. Watson Research Center, Yorktown Heights, NY 10598. {yeung,mintzer} @ watson.ibm.com

Abstract

nipulation of the least significant bit (LSB). Walton[3] described techniques to embed long strings of binary bits at a set of randomly generated addresses where the LSB of pixels were changed to match the corresponding bit in the string. The watermarking techniques in which the information is stamped onto the LSB of the image pixel values are unlikely to produce visual artifacts in the image. If an image is altered, the LSB is likely to be changed such that the verification will be able to determine the modification. Such LSB manipulation, however, is not secure against malicious attacks: it is relatively easy to create a system that alters the visual content of an image without changing the LSB of every pixel value, to a degree that the whole image can be modified while the LSB is kept intact. Verification based on the LSB then fails to detect the alterations. Another limitation of some existing techniques is that they cannot determine the exact regions of modification in the verification process; instead, they can only provide a binary answer of whether an image has been modified or not. Such information may be valuable for better security measures.

In this papel; we propose a new method for invisibly watermarking high-quality color and gray-scale images. This method is intendedfor use in image ver$cation applications, where one is interested in knowing whether the content of an image has been altered since some earlier time, perhaps because of the act of a malicious party. It consists of both a watermark stamping process which embeds a watermark in a source image, and a watermark extraction process which extracts a Watermark from a stamped image. The extracted watermark can be used to determine whether the image has been altered. The processing used in the stamping and extraction processes is presented in the papel: We also discuss some advantages of this technique over other invisible watermarking techniques for the veri$cation application; these include a high degree of invisibility, color preservation, ease of decoding, and a high degree of protection against retention of the Watermark after unauthorized alterations. 1. IMAGE VERIFICATlON

2. THE PROPOSED TECHNIQUE

As the Internet and the World Wide Web have gained great popularity, it has become commonplace to make collections of images, stored on Internet-attached servers, accessible to vast number of others through the Internet. However, making the images accessible to others through the Internet has also created opportunities for malicious parties to replace images on Internet servers with forgeries, or to intercept and replace images that have been transmitted to others. In addition, with the sophisticated image editing software now available, many have the tools to alter the content of digital images with ease, and with results that mimic the work of the professionals in the traditional photographic medium. To address these concerns, we need to develop techniques that can protect digital images against malicious attacks and intentional alterations. Several invisible watermarking techniques have been reported for data hiding, the embedding of robust watermarks for copyright protection, or the insertion of fragile watermarks for image verification. We shall focus on invisible watermarking techniques for image verification here. Friedman proposed the Trustworthy Digital Camera[ 11 in which a watermarking scheme was incorporated to determine whether a digital photo had been modified using public-key encryption technology. Schyndel et al.[2]discussed coding undetectable digital signatures onto an image through the ma-

In this paper we propose a new method for quickly verifying that the content of an image has not been changed since the image was watermarked (stamped), via the use of an invisible watermark embedded into the image pixel values. It consists of (1) an invisible watermarking process, that stamps a watermark pattern onto a source image and produces a verification key; and (2)a watermark extraction process that decodes the embedded watermark from a stamped image, based on the verification key. In our scheme the watermark pattern forms an image, which we call a watermark image. An example of a watermark image is shown in Figure 2. The extracted watermark image is then used for image verification: it permits both visual inspection and automatic verification which compares the extracted watermark with the watermark applied previously. The block diagram of the process is illustrated in Figure 1. The components in gray boxes indicate the additional components for a verification system that resides on an image server and oversees image collections.

Invisible image watermarking In the invisible image watermarking process, a binary map b ( i , j ) , of an watermark image W ( i ,j ) , is embedded into the source image, I ( i ,j ) , to produce a stamped image I’(i,j ) . Each pixel in the source image is processed in turn. The

680 0-8186-8183-7/97 $10.00 0 1997 IEEE

WA’I’ERMARK IMAGE

STAMPED

Image WatermarkDIGITAL I\lAGE

,-, ‘a’ .....

STORAGE OF KEYS

...................................................................................................................................................

Comparator WATERMARK

(b)

......................................................................................................................................................................................................

Figure 1: The block diagram of the image verification system with proposed invisible watermarking technique

E ( i ,j ) is initialized to 0. For (i, j)th pixel, the error diffusion steps are as follows:

processing applies a watermark extraction function W X ( * ) to the selected pixel, and tests the extracted watermark value to determine whether it is equal to the desired watermark value. If they are equal, the processing proceeds to the next pixel. If they are not equal, the value of the selected pixel is modified until the value of the extracted watermark is equal to the desired value. The scheme used to modifv.. Dixel values was designed to produce small and random changes. The amount of modification is calculated, and then propagated to pixels not yet processed using a modified error diffusion procedure. This process is repeated until every pixel in ;he source image has been processed. A verification key is produced, together with the stamped image as the final products. The watermark extraction function W X ( * )is a function that is computed from the verification key. The verification key can be generated by using a pseudo-random-number generator and it may be in the form of three sets of binary look-up-tables (LUT) for a color image, one for each color component; and a single LUT for gray-scale image. The LUT’s are combined to form the watermark extraction function WX(*), using the expression:

1. The current pixel value, P ( i , j ) , is the sum of the original image pixel value I ( i , j ) and the value of the diffused error at the pixel location. P ( i , j ) = I ( i ,j ) E ( i ,j ) .

+

2. The output pixel value, I’(i,j ) , is the modified pixel value which gives the bit output matching the desired watermark values. 3. The output error, 6 ( i , j ) , is computed as 6 ( i , j ) = P ( i , j )- I ’ ( i , j ) . 4. At neighboring pixel locations not yet processed, the diffused errors are adjusted by the amounts that are proportional to the output error at the current location as follows: for some ( T , s), E ( i T , j s) +-E ( i T, j s) C ( T , s)6(i,j ) .

+ +

+

+

+

where @ represents XOR operator, for a color image, and b(i, j ) = L U T ( l ( i ,j ) ) for a monochrome image. If the extracted watermark bit from a given image pixel does not match the desired watermark value, the pixel value is altered until the watermark values match given the set of LUT’s. The three color values of a pixel are modified i n a way such that the distortions are minimal. The selection of color component can be done randomly to avoid consistent modification of one color, and level of adjustment can be controlled to prevent significant visual quality degradation. We use a modified error diffusion process, adapted from [4] for our purposes, to diffuse the errors introduced in the

Combiningtheabove, wehaveI’(i,j) = P ( i , j ) - b ( i , j ) = I ( i ,j ) E ( i ,j ) - 6 ( i , j ) . By restricting C(T,s) = 1, we have E ( i ,j ) = 6 ( i ,j ) . Summing this expression over all (i, j ) , we have I’(i,j ) = I ( i ,j ) . This guarantees the average intensity values will be preserved and the proper average color is produced. For the three colors RGB, the error diffusion process in each color is carried out independently. In our implementation, we have used diffusion coefficients C(T,s) = 0.5 for ( T , s) = ( 1 , O ) and ( T , s) = (0, l),and C(T,s) = 0 otherwise. The errors introduced by the watermarking process, in general, are small. They do not cause any color degradation to the image as the errors are spread locally. In addition, the watermark information is embedded by a combination of the source pixel values together with the errors introduced, and such information is hidden in various bit values beyond LSB, that the technique does not suffer the drawbacks of

stamping processing locally, so that proper average color is

LSB manipulation and is more secure against attacks. The

maintained as the modifications are spread and smoothed out. Let E ( i , j ) be the diffused error for a given color.

verification key is difficult to re-engineer, which adds to the security of the system.

+

681

E,,,

to embed a watermark image into the test images without any visible artifacts, and retain faithful color and details. In addition, the embedding process produces bit changes beyond the LSB. For illustration, we show in Figure 2 a sample source image (1095 x 732) and a watermark image (256 x 168). Figure 3 shows the stamped source image with the watermark image embedded, and the extracted watermark image using the proper verification key is shown in Figure 4 which also displays the ownership information. Figure 5 shows an (edited) altered version of the image which appears to be “original” to the naked eye, and the extracted watermark with the regions of alterations automatically identified and segmented is shown in Figure 6. Without the proper key, the watermark is very difficult to extract and impossible to identify. The results presented in Tables 1 show the qualities of test images measured with different keys. Each key is generated randomly. For each test image, we measure the average, maximum and minimum PSNR using 50 watermarked versions of the image, each with a different key. In general, subjective judgements and objective measures show that good image qualities after watermarking are maintained using different keys (tables) as well as different watermark images. We also test the watermarking technique using both restricted and unrestricted tables. The improvements are measured to be about 1.5 to 2 dB by using restricted tables.

Watermark extraction and image verification In the image verification processing, a watermark image, b ( i , j ) , is extracted from a stamped source image, I’(i,j ) . This extraction is achieved by first computing the watermark extraction function, W X ( * ) , from , the verification key, and then applying the function to every pixel I’(i,j ) to produce the extracted watermark pixel b’(i, j ) , as was described earlier. This processing is repeated until every input pixel has been processed. The result is the extracted watermark. This watermark, as it comes in the form of an image, can then be compared visually to detect the artifacts for authentication as well as checking for unauthorized alterations. The verification can also be achieved with automatic computation by comparing with the original watermark to check for discrepancies. The proposed watermarking and the watermark extraction procedures, combined, can determine and localize the regions of image alteration in the verification process. Without knowing the proper verification key, an alteration to a region of pixel values is highly likely to cause the corresponding region of the extracted watermark pixels to also differ, which will show as artifacts in the extracted watermark image. Such verification does not require the existence of an original (unwatermarked) version of the source image, and is computationally efficient as the watermark extraction procedure requires few operations. For an invisible watermarking scheme to be secure for verification, it has to be nearly impossible for an interloper to decide whether an image has been watermarked or not, what and where is the information embedded, such that he or she cannot re-apply the watermark after an alteration to fool the verification process. In our scheme, to correctly decode the watermark, the entries in the three tables must be known. The embedded watermark is hard to detect by simply looking at the LSB’s, or the statistical distributions of pixel values after the watermarking process. In addition, the watermark information is embedded by a combination of the source pixel values together with the errors introduced, and such information is hidden in various bit values beyond LSB, so that the technique does not suffer the drawbacks of LSB manipulation and is more secure against attacks. We have observed that the LSB planes of the watermarked images look as random as those of the original images. As the tables are generated randomly, we can have potentially many consecutive entries of same values. Then the pixel values may have to be adjusted by larger amounts in the watermarking process to get the desired binary value. Restricting the number of consecutive entries can overcome the potentially large adjustment levels. The tables can be created with the restriction that at most N consecutive entries of the same value (N 0’s or N 1’s) are allowed. This is, however, a tradeoff between better quality and more security against unauthorized watermark extraction.

4. CONCLUSIONS We proposed, in this paper, an invisible watermarking technique for image verification. The watermarking process does not introduce visual artifacts and retain the quality of the images. A verification key is produced together with a stamped image. The embedded watermark image can be extracted from the stamped image using a verification key. Alterations to an image induces artifacts on the extracted watermark, which can be visually and automatically identified. The technique offers fast image verification to detect and localize unauthorized image alterations. Our technique provides means of ensuring data integrity, adds to the security of the digital content and allows the recipients of an image to verify the image as well as to display the ownership information of the image.

5. REFERENCES [ 11 G.L. Friedman,

“The trustworthy digital camera: Restoring credibility to the photographic image”, IEEE Transactions on Consumer Electronics, vol. 39, pp. 93103. Nov. 1993.

[2] R. G. van Schyndel, A. Z Tirkel, and C . E Osborne, “A digital watermark“, in Proceedings, IEEE International Conference on Image Processing, vol. 11, pp. 86-90, 1994.

3. RESULTS

[3] S . Walton, “Image authentication for a slippery new

We have tested the proposed watermarking on high-quality color images, gray-scale images, and synthetic images with uniform color, and the results are promising. We were able

age”, DE Dobb’s Journal of Software Toolsfor Professional Programmers, vol. 20, Apr. 1995.

682

Images Avg.

I

Red Max.

I

Min.

11

Avg.

I

Green Max.

I

M in.

11

Avg.

I

Blue

M ax.

Min.

[41 F.C. Mintzer, G. Goertzel, and G.R. Thompson, "Display of images with calibrated color on a system featuring monitors with limited color palettes", in 1992 SZD International Symposium Digest of Technical Papers, pp. 377-380,1992.

Figure 4: Extracted watermark image

Figure 2: (TOP) A high-quality image of Watson Research Lab ( B O n O M ) a typical watermark image.

Figure 5: Altered image

Figure 3: Stamped image

Figure 6: Extracted watermark with detected alterations

683