CIMCA 2008, IAWTIC 2008, and ISE 2008
Blind Synthesis Attack on SVD Based watermarking Techniques Rowayda A. Sadek, IEEE Member Faculty of Computer and Information, Helwan University, Email:
[email protected] process of the watermark. There are two kinds of watermark attacks: unintentional attacks such as compression of legally obtained watermarked image, and intentional attacks, such as an attempt by a multimedia pirate to destroy the embedded information and prevent tracing of illegal copies of watermarked digital image [3,4]. SVD is an attractive algebraic transform for image processing, because of its endless advantages, such as maximum energy packing which is usually used in compression [5,6], ability to manipulate the image in base of two distinctive subspaces (data and noise subspaces) [6,7] which could be used in noise filtering and also in watermarking applications [8,6]. Most of the developed SVD based image watermarking techniques utilize the stability properties of singular values (SVs) resultant from SVD transformation of the image [8,9]. They focus in casting the watermark components into the SVs of the host images either in additive way [9,10] or by quantization [11,12]. In accordance with the SVD properties each singular value of image SVD specifies the luminance of the image layer and respective pair of singular vectors (SCs) specifies image geometry [13]. Thoroughly inspection of this property leads to counterfeit any watermarked image that used SVD based technique in casting process. This paper proposes a counterfeiting attack on the SVD based watermarking that uses the SVs in casting. For copyright protection, the proposed ambiguity attack can completely remove or seriously degrades the watermark and the detector can no longer positively detect it. For authentication, the proposed attack can act as a forgery attack to embed a new valid watermark rather than removing one. This allows modifying the protected data and thus making the corrupted image seems genuine. The paper is organized as follows; Section two reviews the watermarking attacks. Section three reviews briefly the SVD based watermarking. A new simple attack is proposed in section four. Sections five and six examine the experimental results and conclusion respectively.
Abstract Singular Value Decomposition (SVD) is robust and reliable orthogonal matrix decomposition. Due to its conceptual and stability properties, it is becoming more and more popular in signal processing area especially in watermarking. Many watermarking and data hiding researches have struck the use of singular values in casting hidden information into the hosted image. This paper introduces a counterfeiting attack for the existed SVD based watermarking techniques that embed the watermark information into the singular values of the hosted image. This paper emphasizes the weakness of this class of techniques due to the vulnerability of singular values to a wide class of image processing operations as well as intentional attacks.
1. Introduction In recent years there has been growing interest in developing effective techniques for securing the digital data such as images, music clips and digital video. The process of digital watermarking involves the modification of the original multimedia data to embed a watermark containing key information such as authentication or copyright codes [1]. Watermarking visual quality, robustness, and capacity compose a three-dimensional trade off relationship. Watermarking applications include broadcast monitoring, proof of ownership, authentication, and covert communication [1,2]. In the digital age, digital forensic research becomes imperative. This leads to a vicious circle of research on developing digital watermarking technologies and on attacking them by attackers. Counterfeiting and falsifying digital watermarks with the goal of making illegal profits or bypassing laws is the main objective for the attackers. Watermarking attack is any processing that may destruct the detection
978-0-7695-3514-2/08 $25.00 © 2008 IEEE DOI 10.1109/CIMCA.2008.53
140
able to be described by a sum of a relatively small set of eigenimages. SVD has the ability to adapt to the variations in local statistics of an image. However, SVD is image adaptive; the transform itself needs to be represented in order to recover the data. A digital image X of size MxN, with M≥N, could be represented by its SVD as follows;
2. Attacks Watermarking as well as all kinds of kindred data hiding techniques in still images are subjected to attacks that may be destruct the detection process of the watermark or communication of the information conveyed by the watermark. In copyright attacking, the aim is modifying the image in order to disable/remove the watermark [1,3]. Integrity attacks tamper the image content by unauthorized parties. In digital forensic, modifications can range from the modification of court evidences to the modification of photos used in newspapers or clinical images. The attacks centered on distributing anonymously illegal copies of watermarked work are a traitor tracing issue. In Forgery attacks, the hacker aims at embedding a new, valid watermark rather than the removed one. It is probably the main concern in data authentication. Modifications that occur during normal image processing such as cropping, resizing, contrast modification and JPEG compression are called unintentional attack [3]. The watermark should remain hidden but recoverable throughout these modifications. Practical data hiding techniques need to be resistant to many of this transformation as possible [4]. On the other hand, attack that attempt to weaken, remove or alter the watermark itself are termed intentional attacks [1]. Generally, the attackers use different methods to either confuse the detection software so the watermark cannot be detected or to completely remove the watermark from the image [3]. The attacking criteria include cost-effectiveness and quality degradation. Certainly, a lot of new attacks can be designed and it is impossible to know what will come out next from hackers’ imagination. In fact, the identification and classification of attacks, as well as the implantation of a standard benchmark for robustness testing are of great importance and will be a key issue in the future development of watermarking [4].
N
X = [U] [S] [V]T =
∑s u v i
T i i
(1)
i =1
Where U is an MxM orthogonal matrix and its columns are called left singular vectors (LSCs). V is an NxN orthogonal matrix and its columns are called right singular vectors (RSCs). S is MxN matrix with the diagonal elements represent the singular values (SVs), si of X. Subscript T denotes the transpose of the matrix.
3.2 SVD based watermarking techniques Most of the developed SVD based watermarking techniques utilizes the stability of singular values (SVs) resultant from SVD transformation of the image [9]. In accordance with these properties each SV of image SVD specifies the luminance of the image layer and respective pair of singular vectors specifies image topology [13]. That is why, the slight variations of singular values could not influence remarkably on the cover image quality. Techniques of embedding watermark are either done by globally computing the SVD of the entire image, or by locally computing SVD on small non-overlapping blocks of the image. Developed SVD based techniques either used all the SVs [8,9,10], largest [13,8] SVs or the lowest SVs to embed the watermark components either additively [9,10] or by using quantization [11,12]. Most of these developed techniques are based on the following approach; 1) Obtain SVD for both of the host image "X" and logo watermark "W"
3. SVD Based Watermarking 3.1 SVD Transformation
X =UhShVhT
(2-a)
W =UwSwVwT
(2-b)
Where Uh and Uw are the LSCs for host image and watermark respectively, Vh and Vw are the RSCs for host image and watermark respectively, Sh and Sw are SVs for host image and watermark respectively. 2) Embedding is usually done by adding the scaled SVs of the watermark to the SVs of the host image.
Singular Value Decomposition (SVD) is a stable and effective method for splitting the signal into a set of linearly independent components [5]. SVD is an optimal matrix decomposition technique in a least square sense that it packs the maximum signal energy into as few coefficients as possible. Digital images are often represented by low rank matrices and therefore,
Sm = Sh + α ∗ Sw
141
(3)
destroy the embedded watermark. On the other hand, the attacker can intentionally destroy the watermark or can overmark/re-watermarking an already watermarked image. The next section shows how and why the intentional and intentional attacks can affect the SVs that enclose the watermark components. SVD-based developed techniques are almost using the SVs in watermark embedding because of its stability [9,10,13]. Since SVs represent the luminance, SVs of two visual distinct images may be almost similar and the U and V are different because they representing image structure. This fact is experimentally validated by using four different images with the same size (512x512) as in Figure 1. Figure 1 has a semilog graph for SVs values resultants from SVD decomposition of the images. It demonstrates the closeness among the SVs of these four different images. Lower left corner of the graph has the zoom of the first 60 SVs for more clear display of the closeness among SVs. Figure(2) validates the effect of changing the SCs and/or SVs on reconstructing the right image. Therefore, Figure 2 shows the trial of reconstruction of the image "I3:Barbara" from different combination of singular values and singular vectors. We used the first 30 truncated SVD components (30 TSVD components) of U,V, and S of different images (I1,I2,I3). Table 1 illustrates the PSNR for each of reconstructed images with different combination of RSCs, LSCs, and SVs that were denoted by V, U and S respectively. Figure 2 and table 1 represent that either replacing U or V without varying the S, results in corrupted meaningless image as in Figure 2c,2d. Replacing both U and V of an image with the corresponding ones of another image without changing S, results in reconstructing another image as in figure2e. Figure 2e uses U1, V1 of "I1:Boats" and the S3 of the "I3:Barabara" to reconstruct the image, unsurprisingly, the resultant image is the "Boats" not the "Barbara". This figure insures that the SCs specify the geometry of the image while SVs specify the luminance of an image layer. Table 1, figure 1 and figure 2 show that an image could be reconstructed with a good quality by using its original SCs and another carefully selected SVs sequence of another image instead of its original SVs sequence. These results drive to suspect of the robustness of all SVD based watermarking techniques which mainly used the SVs to cast the watermark. They are vulnerable to any attack that can affect the SVs values.
Where, Sm is the modified SVs sequence that will be used in watermarked image. 3) Reconstruct the watermarked image "Y" from the modified singular values Sm and the singular vectors (Um, and Vm) of the host image. Y=UhSmVhT
(4)
Most of the developed techniques that followed the above approach, were proposed as robust techniques [9,10,13,14,15]. These techniques were built on being slight variations on the SVs do not affect the visual perception of the quality of the cover image [6,8,9]. V.I.Gorodetski et al. [8] embedded a hidden image through slight modifications of the largest SVs of small blocks of the cover image. Although such technique proved advantages in transparency and capacity, it was not robust against JPEG2000 compression. They claimed to avoid the smallest SVs and the corresponding SCs to avoid high frequencies which usually affected by compression [8]. Therefore, they claimed that superiority of their approach is because of embedding data into low band area of a cover image; in particular into largest SVs makes the technique robust against wide range of distortions and intentionally tampering. D. Chandra [9] additively embedded the scaled SVs of watermark into the SVs of the host image X as described above. Liu et al. [10], proposed an approach for embedding either random sequence or visual watermark by using scaled addition of the watermark elements into the SVs, and then get SVD of the resultant sequence and obtain the modified SVs to be use to reconstruct the watermarked image with the resultant SVs from SVD of the modified SVs sequence in addition to the original singular vectors.
3.3 Vulnerability Techniques
of
SVD
Watermarking
Since each singular value of image SVD specifies the luminance (energy) of the image layer and respective pair of singular vectors specifies image topology (geometry) [13]. That is why slight variations of SVs could not influence remarkably on the cover image quality. Based on this fact, most of the existed techniques use the SVs to embed the watermark components. Hence, most of the SVD based watermarking techniques used all SVs [8,9,10], others used only the largest SVs [8,13] to embed the watermark. This paper proposes the proof of being these techniques fragile. Simple image enhancement operations could unintentionally severely degrade or
142
position of the light source. This attack may include enhancement operations which deals with brightness transformation such as gray scale transformation (e.g., histogram equalization, gamma correction), and brightness correction.
4. A New Simple Attack "Illumination Attack" Every day, a new attack is developed which may provide a new way to remove a watermark illegally. The proposed attack is based on the fact of being luminance represented by SVs in SVD domain which is ascertained in the previous section. Destroying the watermark may be done intentionally or unintentionally. Simply the proposed attack is based on changing or replacing the SVs sequence (layers luminance) of the watermarked image with another created sequence or even faked SVs sequence of another carefully selected image with near structure and illumination. This attack is validated through a set of experiments, and it proves its effectiveness in destroying the watermarks that was added to the SVs without affecting the quality of cover image. Since there is no sharp classification for attacks, the proposed attack could be classified as a removal attack, ambiguity attack or forgery attack. Removal attack aims to completely remove or seriously degrade the watermark embedded in the watermarked image so that a detector can no longer positively detect it [3]. Ambiguity attack tries to embed another watermark into a watermarked data and thus making it difficult to determine the first embedded watermark. Therefore, the attacker can overmark/re-watermarking an already watermarked image with a second watermark, creating uncertainty about which watermark was inserted first or may hide or destroys the original watermark [1,4]. In forgery attack, attacker can modify the protected data and thus making the corrupted image seems genuine.
5. Experimental Results Computer simulations were carried out to evaluate the proposed attack to counterfeit the SVD based image watermarking. Firstly to validate counterfeiting the SVD technique we consider the Chandra's technique [9] that was described in section 3.1. Figure 3 shows the host image; I1 and watermarked image as well as the watermark that used in Chandra's watermarking process. For intentionally destroying the watermark embedded in the watermarked image shown in figure 3b, replace the SVs of the watermarked image by those of I4. Figure 3d shows the watermarked image after replacing its SVs by those of I4. Watermark in this case is completely destroyed intentionally. This intentional attack will be effective in destroying the watermarks without affecting the quality of cover image especially in case of carefully selecting faked SVs sequence of an image with near structure and illumination. This attack is easy to apply especially for remote sensing imagery or for video applications because these kinds of applications always have old or preceding images/frames with the same or near scene, so removing or destroying the watermark which was embedded into the SVs becomes easy. Selecting the suitable image to use its SVs could be done visually, using multi-temporal images, using histograms, etc. Image brightness histogram provides the frequency of the brightness value in the image. On the other hand, unintentionally illumination attacking may include enhancement operations which deals with brightness transformation such as gray scale transformation (e.g., histogram equalization, gamma correction), and brightness correction. Histogram equalization is also examined. Figure 4 shows SVs of watermarked image "I4:Elaine" before and after the histogram equalization. It is obvious that for image illumination enhancements, SVs will be changed significantly which will drastically destroy the embedded watermark. The effect of Gamma Correction on the SVs sequence is also examined in Figure 5 by using a part of the "I1:Boats" image. Figure 5 shows the SVs of both the original and gamma corrected image. The SVs of gamma corrected image is greatly affected. This means that gamma correction which usually used normally to adjust the image illumination for displaying
4.1 Intentional SVD attack An attacker can simply delete, destroy, or replace the watermark with his own watermark and claims that he is the owner of the image. This may be done by changing the SVs of the watermarked till making the watermark undetectable or even replace the SVs of the watermarked image with SVs of another image selected carefully with nearly illumination and structure.
4.2 Unintentional SVD attack Unintentionally change of SVs could be happened due to image manipulations that affect the illumination of the image features which are represented by SVs in SVD domain. Illumination changes could be simply obtained by changing the brightness as well as the
143
purposes could change the SVs drastically and in turn destroying the watermark. Also the low pass filtering affects the SVs greatly which may destroy the embedded watermark severely.
[5] J.F. Yang and C.L. Lu, ”Combined Techniques of Singular Value Decomposition and Vector Quantization for Image Coding,” IEEE Trans. Image Processing, Aug. 1995, pp. 1141 - 1146.
6. Conclusion
[6] Xiaowei Xu, S. Dexter and A. M. Eskicioglu, “ A Hybrid Scheme for encryption and watermarking”, Proceedings of the SPIE Security, Steganography, and Watermarking of Multimedia Contents VI Conf., San Jose, CA, Jan. 2004
Since SVD is promising in many image processing applications and in watermarking, this paper is thoroughly examined the exclusive properties of SVD in images for more efficient using. Particularly, the paper focuses on introducing an attack to counterfeit all the SVD based watermarking techniques that cast the watermark components in singular values of the host image. The proposed ambiguity attack could intentionally destroy the watermark or even could replace it with another watermark. Experimental results also proved the vulnerability of the SVD based watermarking techniques to any kind of brightness transformation or enhancement. The developed attack could be considered as an oracle attack without need of having the watermark detector. Only knowing that the algorithm is SVD based is enough to attack the watermarked image. The proposed attack could be considered as a forgery attack especially in the data authentication. The proposed attack complies with the main criteria required for the efficient attack which are the cost effectiveness and quality degradation. The attack is easier and efficient in applying for remotely sensed images, multi-temporal scenes and for video applications. This paper proves the fragility of the SVD watermarking based techniques that use SVs of the host in casting the watermark.
[7] K. Konstantinides, B. Natarajan, and G.S. Yovanof, ”Noise Estimation and Filtering Using Block-Based Singular Value Decomposition,” IEEE Trans. Image Processing, vol. 6, March 1997, pp. 479- 483. [8] V.I. Gorodetski, L.J. Popyack, V. Samoilov, and V.A. Skormin, ”SVD-Based Approach to Transparent Embedding Data into Digital Images,” Proceedings International Workshop on Mathematical Methods, models and Architecture for Computer Network Security, Lecture Notes in Computer Science, vol. 2052, Springer Verlag, 2001, pp. 263-274. [9] D. V. S. Chandra, “Digital Image Watermarking Using Singular Value Decomposition,” Proceeding of 45th IEEE Midwest Symposium on Circuits And Systems, Tulsa, OK, August 2002, pp. 264-267. [10] R. Liu and T. Tan, “A SVD-Based Watermarking Scheme for Protecting Rightful Ownership,” IEEE Transaction on Multimedia, 4(1), March 2002, pp.121-128. [11] S-C Byun, S-K Lee, A. Tewfik, B-H Ahn, ”A SVDBased Fragile Watermarking Scheme for Image Authentication, Digital Watermarking: First International Workshop, IWDW 2002, Seoul, Korea, Nov. 2002. [12] Kuo-Liang Chung, C. Shen, L. Chang, "A novel SVDand VQ-based image hiding scheme", Pattern Recognition Letters, 2002, pp. 1051-1058
References [1] G.C. Langelaar, I. Setyawan, and R.L. Lagendijk, “Watermarking Digital Image and Video Data, A State-OfArt Overview.” IEEE Signal Processing Magazine, Sept. 2000, pp.20-46.
[13] Ganic, N. Zubair, and A.M. Eskicioglu, "An Optimal Watermarking Scheme based on Singular Value Decomposition," Proceedings of the IASTED International Conference on Communication, Network, and Information Security (CNIS 2003), Uniondale, NY, Dec. 2003, pp. 85-90.
[2] J.I. Cox, M.L. Miller and J.A. Bloom, “Watermarking applications and their properties,” International Conference. on Information Technology, Las Vegas, 2000.
[14] J-M. Shieh, D-Ch. Lou, and M-Ch. Chang, “A Semiblind digital watermarking scheme based in SVD,” Computer Standard & Interfaces 28 (2006), pp.428-440.
[3] S. Voloshynovskiy, S. Pereira, V. Iquise and T. Pun, “Attack Modeling: towards a second generation watermarking benchmark,” Signal Processing vol.81, no.6, Jun. 2001, pp.1177-1214.
[15] B.Ch. Mohan, S. S. Kumar, “A Robust Image Watermarking Scheme using Singular Value Decomposition,“ Journal Of Multimedia, Vol. 3, No. 1, May 2008
[4] I.J. Cox and J.-P.M.G. Linnartz, “Some General Methods for Tampering with Watermarks”, IEEE J. on Selected Areas of Comm., vol.16, no.4, 1998, pp. 587-593.
144
I1: Boat
I2: Goldhill
I3: Barbara
I4: Elaine (a)
(b)
(c)
(d)
Figure 1. Singular Values of different images (I1,I2,I3,I4). Lower Left Corner has a zoom vision for the first 60 SVs
(a)
(b)
(c) (e)
(d)
Figure 4 Histogram Equalization: (a) Original image (b) Equalized image (c) original histogram (d) Equalized histogram (e) SVs of original and equalized images
(e)
Figure 2. SVs and SCs Effect: I3(U3,S3,V3) reconstruct from (a) (U3,S3,V3) (b) (U3,S1,V3) (c) (U3,S3,V1) (d) (U1,S3,V3) (e) (U1,S3,V1) Table 1. PSNR of reconstructed images from different combinations of Singular vectors (U,V) and Singular values (S) of different images PSNR I3(U3,*,V3) PSNR I3(U3,S3,*) PSNR I3(*,S3,V3)
*S1 11.5209 *V1 11.5209 *U1 11.1832
*S2 10.0158 *V2 12.3809 *U2 10.0158
(a)
(b)
*S3 23.5828 *V3 23.5828 *U3 23.5828
(c)
(a)
(b)
(c)
Figure.5. Gamma Correction: (a) Original image (b) Gamma corrected with γ=0.4 (d) SVs of both of (a) and (b)
(d)
Figure 3. (a) Original I1 (b) Watermarked image (c) Watermark (d) watermarked image using S4
145
