Information and Communication Theory Group, Delft University of Technology,. P.O. Box 5031, 2600 GA Delft, The Netherlands. 1. Introduction. Reproduction of ...
Hiding Correlation-Based Watermark Templates using Secret Modulation Jeroen Lichtenauer Information and Communication Theory Group, Delft University of Technology, P.O. Box 5031, 2600 GA Delft, The Netherlands
1. Introduction Reproduction of digital media is very easy. Large commercial use of digital media has driven a great demand for digital watermarking. A digital watermark makes it possible to trace (illegal) digital reproductions and/or to prove copyright ownership of a watermarked work. Digital watermarking is the process of embedding information within the digital media itself, imperceptible to the ‘user’ of the media under normal circumstances. Usually, a noise-like pattern is added to the media. In many applications, the watermarked media may be subject to some kind of distortion. A digital watermark must be able to survive all signal processing that can be expected in its application. In some applications, users might try to deliberately remove the watermark. Such a malicious attack can be any kind of distortion. The only limitation to the distortion is that it does not eliminate the commercial value of the work. The far most challenging problem in distortion robustness of digital watermarks, at this moment, is robustness to de-synchronization. In most watermarking methods, the detection of watermarked information depends on knowing the exact location(s) of the embedded watermark. Hence, watermark detection can be made impossible even without disturbing the watermark itself, by just disturbing the location of the watermark. In image and video watermarking, this means even a very small geometrical distortion, like a translation over a few image pixels, cropping of the image or column/line removal, already confuses the watermark detector completely. Also more complex geometrical transformations can be applied to an image without affecting the perceptible quality. Figure 1 shows a Random Bending Attack (RBA), which is part of the widely used watermark benchmark application called “Stirmark”. The small bending applied to the image is imperceptible, but disastrous for nearly all the currently used watermarking methods.
(a)
(b)
Figure 1. Example of the Random Bending Attack (RBA). Image (b) shows the result of a small geometrical bending of the “Lena” image (a). Research is being conducted on methods that can solve this difficult problem. For watermarking in video sequences, the time axis can be used to obtain watermarking methods that are robust to geometrical distortion. This kind of watermarking is already in an advanced state of research, for instance by X. Niu et. al [2] and A van Leest et. al [3]. But for still images, geometrical distortions remain a very difficult problem in watermarking. To explore methods that can also be applied to still images, the time axis is omitted in this research. For still images, one branch of countermeasure research attempts to develop better imagewatermarking techniques that are robust against different types of geometrical transforms [4],[5]. A complementary branch of countermeasures focuses on inverting the geometrical transform prior to watermark detection, to avoid confusion of the watermark detector. The objective of the inversion of geometrical distortions is to restore as close as possible the original (image) grid on which the watermark was embedded. In all cases reference information is required about the original undistorted pixel grid. This grid reference information is usually either the original nonwatermarked image - leading to non-blind approaches [6] -, or embedded structure or marker information - leading to blind inversion approaches [7]. In this paper we will discuss a way to overcome the problem of geometrical distortion with blind watermark detection by correcting for the applied geometrical transform. Section 2 of this paper
describes the method and problems of exhaustive geometrical searching. In section 3 the method is described that we suggest for obtaining robustness to geometrical distortion in blind image watermarking. Section 4 shows some experimental results of the methods described in section 3. Finally, conclusions are made in section 5.
2. Watermark recovery by exhaustive geometrical search* The event that the watermark detector reports a watermark to be present in an image in which the watermark in fact has not been embedded is called “false positive watermark detection”. Not detecting a watermark that has been embedded is called “false negative watermark detection” or “a miss”. The probabilities of these two events determine the efficiency of the watermarking system. In most watermarking applications, it is obligatory to keep the false positive watermark detection probability below a certain value. For instance in a DVD player that relies on a watermark in deciding whether a DVD contains an illegal copy. If so, the movie will not be shown. False positive watermark detection in a legally recorded DVD will make the movie unplayable. The need for grid reference information in the detection of watermarks in geometrically degraded images is typically motivated by the argument that exhaustively searching all possible geometrical transforms (even within a limited class of transforms) in combination with watermark detection is simply computationally too expensive. In this paper we consider another - often overlooked and in our opinion much more important - problem with the exhaustive search and detection approach, namely the increase of the probability of false positive detection. Performing multiple watermark detections per image (and key, if applicable), like in a geometrical search, can increase the probability of falsely finding the searched watermark in an image at least once. There have been done few studies on predicting false positive detection probability. Linnartz and Kalker [9] provide a model to predict detection error probability in correlation-based watermarking methods and show that a non-white spectrum of a watermark causes the image content to interfere with watermark detection. Miller and Bloom [10] show how detection error probability can be predicted for normalized correlation. These kinds of studies *
This section was published in the proceedings of SPIE, Security and Watermarking of Multimedia Contents V [8]
concentrate on calculating the overall performance of detection error behavior of a watermarking system by regarding the “random-image detection error probability”. This probability is obtained from detection results generated by varying over images. However, varying over geometrical transforms is not the same as varying over images. Three different factors must be distinguished with respect to the detection behavior: the image, the key and the geometrical transform. All three can be varied to determine false positive detection probability. In this paper we will consider the differences that varying over these different factors yields for the detection results. If random-transform or random-key false positive detection probability for a constant image is different from the random-image false positive detection probability, a new problem arises: different images will cause different false positive detection probabilities when the keys or geometrical transforms are varied over a single image. Even though the random-image false positive detection probability of the watermarking system is sufficiently low, it is possible that for one specific image the random-key or random-transform false positive detection probability exceeds the maximum false positive detection probability required for the application. This can for instance forfeit credibility in court for proving ownership of the image. For an image with a too high random-transform or randomkey false positive detection probability, the watermark may be found by just trying a lot of transforms and/or keys until a false positive detection shows up. In section 2.1, the problem of geometrically searching for watermarks is considered in more detail. Section 2.2 contains the descriptions of the watermarking method and the geometrical search that were used to test false positive detection behavior in geometrical searches. The results of four different test settings are shown and discussed in section 2.3. Finally, in section 2.4 conclusions are made about exhaustive geometrical searching.
2.1. Problem definition A watermarking system that deals with geometrical distortions can be represented by the block diagram in figure 1(a). The watermark embedder W embeds the message m into the original image x(i,j). At later time the watermark message has to be detected again by the watermark detector D, but a geometrical distortion G might have occurred between embedding and detection and that will confuse the detector. To solve this problem, prior to the detector the block ‘?’ is placed, which aims to recover the
original image pixel grid prior to detection. In the most recent watermarking methods, ‘?’ uses extra information about the image to estimate and invert G, for instance, by comparing y’(i,j) with x(i,j). When the original cover image is not available, often a watermark template is used to estimate G. In the y(i,j) x(i,j) (a)
W
geometrical search, ‘all possible geometrical distortions’ that the distorted watermarked image might have undergone are considered. The inverse distortions are applied to the image and the watermark detector performs detections on all of the
yˆ (i,j)
y’(i,j)
D
?
G
mˆ
m y(i,j) x(i,j)
W
y’(i,j) G
ˆ -1 G
. . .
. . .
mˆ
D
EXHAUSTIVE (b)
m
Figure 1. Block scheme of a watermarking system containing a geometrical distortion “G” after embedding the message m and a block “?” that represents a possible method to recover the original image grid to make watermark detection possible again (a) and the block scheme where “?” is replaced by a geometrical search (b). resulting images. This is shown in figure 1(b). If G is included in the search, the watermark will be found. In addition to the enormous computational cost required with this method of detecting the watermark, there is another theoretical bound to this method. First we denote N as the number of geometrical distortions that are tried in a geometrical search, P[fp] as the probability of having a false positive detection in a single watermark detection on a non-watermarked image and Af as the number of false positive detections the detector will give for the N detections of the search. Now we can calculate the expected value of Af by
E[ A f ] N P[fp] .
(1)
This means that the larger the geometrical search, the more false positive detections can be expected. The probability that the geometrical search will result in one or more false positive detections, P([fptot;N], is given by: P[fp tot ; N ] P[ A f
1; N ] 1 (1 P[fp]) N
(2)
and when N reaches infinity, this will result in: N lim P[fp tot ; N ] lim 1, 1 (1 P[fp])
N
N
for P[fp] 0 .
(3)
Searching for all possible geometrical transformations is therefore useless. There are an
infinite number of distortions possible and in such a theoretical watermarking system, every image would give a false positive detection for every watermark that is searched for. When a watermark application requires a maximum probability Pmax[fptot] of falsely detecting the occurrence of the watermark in an nonwatermarked image, then P[fp tot ; N ] Pmax [fp tot ] .
(4)
must be met. Hence, the maximal N that can be chosen for the geometrical search is limited by
N
ln(1 Pmax [fp tot ]) . ln(1 P[fp])
(5)
Determining P[fp] can be done by varying over three different factors. We define P[fp | k , i ] , P[fp | g , i ] , P[fp | g , k ]
(6)
as P[fp] determined by varying randomly over geometrical transforms (g), detection keys (k) and non-watermarked images (i) respectively, keeping the remaining factors constant. Cox et. al [11] formulate the following hypothesis where they ignore key and geometrical transform dependency and refer to P[fp] determined by varying over images only: “The probability that at least one of the N versions will cause a false positive is bounded by NxP[fp]. When N is large, this can be unacceptable”. We believe that the literal interpretation of this hypothesis is confusing, and we also want to take into account the possibility that P[fp] depends on the
used key. Hence, to estimate the P[fp] for the overall detector behavior, in our research, images and keys will both be varied. We reformulate the hypothesis as: “The expected value of Af in a geometrical search is equal to NxP[fp|g0]:
E[ A f ] N P[fp | g 0 ] ,
(7)
where P[fp|g0] is determined by varying over keys and images, excluding geometrical transformation (transform g0)”. To test if this hypothesis really holds in practice, we set up the experiment that is described in the sections below.
2.2. Experimental setting To test the hypothesis (7) described in the section above, an experiment was set up to simulate an exhaustive search. The watermarking scheme that was used is described in section 2.2.1 and the used geometrical search specifications are explained in section 2.2.2.
is used and the pattern is added to the image for a bit “1” and subtracted from the image to embed a bit “0”. Exact specifications are given in table 1. To keep watermarked image content within the entire area of detection after geometrically transforming the watermarked image, the detection area of 8x8 image blocks does not completely cover the image size but has margins on all four sides. Table 1. Specifications of the correlation-based watermarking scheme used in the experiments. Test images
512x512 pixels, 8-bit gray valued
Payload
64 bits per image (grid of 8x8 blocks)
Watermark block size per bit
48x48 pixels
Space between watermarked region and image border
64 pixels
Pseudo random pattern values
{-1,1}
Watermark gain factor k
2
k Prior to watermark detection, the image is filtered with a high-pass filter F that suppresses the lower frequencies of the cover image and thus improves detection performance: Figure 2. Description of the applied correlationbased watermarking scheme. A pseudo random pattern, generated by a key and multiplied by k, is added to (for bit “1”), or subtracted from the image (for bit “0”) at 48x48 pixel squares shown by the grid. Detection is done only on the middle 8x8=64 blocks, shown by the white part of the grid. 2.2.1. Watermarking scheme The watermarking system that was used in our research is a simple correlation-based method. This is because it is fast, the implementation is simple and it is still representative for most other watermarking methods because they are often also based on some kind of correlation measurement. Our scheme was derived from the scheme described by Smith et. al [12]. It is schematically shown in figure 2. In the scheme, a pseudo random pattern is generated, depending on a key. This pattern is multiplied with the gain factor k. For each of the bits that must be embedded, a different part of the image
0 .1 0 .1 0 .1 0.1 . F 0.1 1 0 .1 0 .1 0 .1
(8)
Then detection is done by first measuring the correlation Cb of all the individual watermarked blocks of the image with the searched watermark pattern:
åå 48
48
1 Cb 2 ( y b (i, j ) y ,b )( w(i, j ) w ) , (9) 48 i 1 j 1 where yb(i,j) is the 48x48 pixels image block where bit b should have been embedded, y,b is the average pixel value of yb(i,j) and w the average value of the 48x48 values pseudo random pattern w(i,j) generated by the key. The probability density functions of Cb
å
å
m M
m M
64
64
P[fp] P[ N pb m] p N pb (m) ,
(11)
where pNpb(m) is the probability mass function (pmf) of Npb. In all of our experiments, M was fairly arbitrarily chosen to be 50. In our testing environment (MATLAB on a 1GHz Pentium system) each affine transformation of the image and detections with different keys takes two seconds. From this computational point of view, the exhaustive geometrical search was chosen to contain 150,000 watermark detections. To experience a sufficient number of false detections in the experiments, the random-image-random key false positive detection probability P[fp|g0] has to be large enough. We selected P[fp|g0] = 6,7*10-5, which should result in an average number of 10 false positives in the ‘exhaustive’ search. In practical applications, obviously a much lower false positive detection probability is required, but for experimental reasons the false positive detection probability had to be chosen this high.
(a)
(b) Figure 3. Embedding results for the watermarking algorithm (a). These distributions are determined by calculating Cb for all bits in 35 different images and randomly chosen keys. in (b), t is determined by integrating fCb(x), for the nonwatermarked images, from the outside to the desired bit detection threshold P[fpbit], shown by the gray area. for a non-watermarked image, directly after embedding a bit 0 and after embedding a bit 1 respectively are shown in figure 3(a). These distributions are estimated by calculating Cb for all 64 bits multiple times while varying the images and detection keys, to estimate the overall behavior of the watermark detector. Finally Cb is thresholded with threshold t to determine the bit value Vb: if Cb t Vb = 1, if Cb -t Vb = 0, if -t < Cb < t Vb = x,
(10)
where “x” means the correlation is not strong enough and the bit is declared to be absent. A positive bit detection occurs when the detected bit
value Vb Npb as the number of positively detected bits in a single detection of all the 64 watermarking blocks of an image. In this watermarking scheme, the watermark is detected positively if at least M of the 64 bits are detected positively, so if Npb M. Hence, P[fp] can be calculated by
The detection of 64 bits is assumed to be a Bernoulli experiment of 64 trials, where Vb = {0,1} means success and Vb = x means no success. For this assumption, the probability mass function of Npb is given by:
64 p N pb (m) P[fp bit ] m (1 P[fp bit ]) 64 m , (12) m
where P[fpbit] is the probability of false positive detection of a single bit. In that case, P[fp] is equal to the probability of having 50 or more successes in a Bernoulli experiment of 64 trials and is defined by substitution of (12) into (11): P[fp]
å 64
% && 64 ## 64 ! m m . (13) ' $ P[fp bit ] (1 " P[fp bit ])
m 50
m
Based on P[fp|g0] = 6,7*10-5, the required P[fpbit] for the detector will be 0.543. P[fpbit] depends on the detection threshold t, by P[fp bit ; t ] +
ò
)t )(
ò
( * f Cb ( x)dx f Cb ( x )dx ,
(14)
t
where fCb(x) is the probability density function (pdf) of the detected correlations in non-watermarked images. Using fCb(x) determined by multiple detections on varying non-watermarked images with varying keys, shown in figure 3(a) , t can be determined by integrating fCb(x) from the outside until the required P[fpbit] is reached, as shown in figure 3(b). To obtain P[fpbit] = 0.543, t has to be set to 0.106.
(a)
using the same image and key but varying geometrical transforms. Three more geometrical search types can be defined, shown in table 3. (1) is the normal geometrical search (keeping image and key fixed). The results of experiment (4) rate the overall performance of the watermarking system. The results of the four different experiments are described and compared in the following sections.
(b)
Figure 4. The distortion G applied to the watermarked image. The global bending G is applied to (a), which results in (b). 2.2.2. Geometrical transformations For the distortion G of figure 1(b) a small global bending was used, which is shown in figure 4. The geometrical search consisted of rotation, scaling and translation (RST) transforms for which the parameters were chosen between the limits shown in table 2. Because the transformations of the geometrical search do not include the actually applied distortion G, all positive watermark detections will be false, even if the same key as for the embedded watermark is used. The rotation freedom of the used RST transforms is not very significant because in most applications a large rotation of a digital image is not very likely since it will be very disturbing. The translation scale is chosen to completely cover a full period of the watermarking block grid. The minimum scale of 92% is the smallest scale for which the image content will completely cover the watermark detection area for all rotations and translations within the chosen ranges. The 125% maximum scale was arbitrarily chosen. The step sizes of the RST parameters were set to make a total of 150,000 detections in the exhaustive search. Parameter
Minimum
Maximum
Rotation
-5 degrees
5 degrees
Scale
92%
125%
Horizontal translation
-23 pixels
24 pixels
Vertical translation
-23 pixels
24 pixels
Table 2. Ranges of the RST transformations of the exhaustive geometrical search.
2.3. Exhaustive geometrical search in practice We have now set-up our watermarking system according to the random-work-random-key false positive detection probability. In a geometrical search, multiple watermark detections are performed
Constant keys Varying keys Constant images
(1)
(2)
Varying images
(3)
(4)
Table 3. Four different types of geometrical search experiments. 2.3.1. Constant key, constant image In this experiment, one image is geometrically searched using the same key as used for embedding the watermark. The results for the single bit correlation Cb in this experiment are shown in figure 5(a) where fCb(x) is estimated from the correlation results. Large differences can be noticed between the pdf’s for three different images, which shows the significant image dependency of the watermark detector. Image “water” results in the lowest variance of Cb. This low-contrast image contains large flat areas that have almost no correlation with the watermark pattern. Image “ccit1” is an image containing high contrast (black and white), high frequency drawings. This image results in the highest variance in Cb of the three, because the watermark pattern has a larger probability of having a high correlation with high variance image content than low variance content. In a search that excludes the applied distortion of the watermarked image, P[fpbit] is equal to the surface of fCb(x) outside of the detection thresholds, given by equation (14). Since the variance of fCb(x) is different for different images, P[fpbit] will vary depending on the image content. In figure 5(b) the pmf is plotted for the Bernoulli experiment that we used as a model for Npb. This is a binomial distribution. The expected value of the binomial distribution is equal to P[fpbit]x64. Thus, difference of P[fpbit] would result in shifts of the expected value of Npb, which is indeed the case for the different images. The distribution of Npb for “water” even has its peak at zero. Furthermore, besides the image dependent nature of the expected value, we also observe an image dependent variance. For image “baboon”, we observe a larger variance than expected from a binomial pmf for the P[fpbit] corresponding to the observed mean. This is due to
the geometrical transformations that cause different image content for each watermark detection. Just like different images cause changes in the P[fpbit] of the total search, the different image content within the watermark detection area, due to the geometrical transforms, will cause a different P[fpbit] for each detection. This results in the larger variance of Npb over the search. The larger the variance of P[fpbit] within one search, the larger the variance of the resulting pmf will be. The image “baboon” has a large low variance area in the middle, compared to the high variance content at the outer areas. This results in a large variance of P[fpbit] when the scale is varied, which can be seen in figure 5(b) by the larger variance of Npb compared to the other images that contain less diverse image statistics.
Figure 6. The pmf’s of Npb using the key used for embedding and two wrong keys. Obviously, P[fp|k,i] will be different for each image. Also using a different key on the same image results in a different P[fp|k,i], as can be seen in figure 6. Here, the variance of Npb remains the same. Only the expected value changes for different keys. These results clearly show that hypothesis (7) does not hold for the used watermark detector. P[fp|k,i] depends on the used key and image and will therefore be different from P[fp|g0]. We must adjust our hypothesis to:
E[ A f ] N P[fp | k , i ] .
(15)
So the expected value of Af will be different for each geometrical search, when a different image or key is used. (a) 2.3.2. Varying keys, constant image Using random keys on image “boat” results in the pmf of Npb in figure 7, which is both different in mean and variance compared to using only the
(b) Figure 5. Results of the geometrical search with constant key and constant image. The pdf’s of Cb in this experiment are shown for three different images in (a), and the distributions of the number of positively detected bits in each detection Npb of four images are shown in the pmf’s in (b). The binomial distribution belonging to the Bernoulli experiment that was used as a model for the false positive detection results is included in this and the following graphs for reference purposes.
Figure 7. Results of the geometrical search using randomly chosen keys and constant image. The pdf’s of Cb in this experiment are shown for three different images in (a), and the pmf of Npb in searching image “boat” with random keys is compared to searching with the right key (b).
correct key. The shift to the right indicates a larger average P[fpbit] for random keys than for the specific correct key. The larger variance is due to the key dependency, just like image content dependency caused larger variance for image “baboon” in figure 5(b). 2.3.3. Constant key, varying images
the watermark are random variables from a nonstationary process, due to the image and key dependency. For the majority of geometrical P[fp], but there are searches P[fp|k,i] < P[fp|g0] also a few image/key combinations for which P[fp|k,i] >> P[fp]. Like for image “ccit1” and the correct key, in figure 5(b), where a significant area of the pmf of Npb exceeds M.
Varying over images in the geometrical search results in even larger variance of Npb than varying the keys, as can be seen in figure 8. The area of the graphs between 50 and 64 now even becomes clearly visible in the graphs, so a lot more detections occur here than the 10 detections, predicted by the Bernoulli experiment. To give an indication, geometrically searching with the correct key in the 35 images, using 150,000 detections in total, results in 3622 detections.
Figure 9. The probability mass distribution of Npb in the geometrical search using random keys and 35 different images.
2.4. Conclusions
Figure 8. The pmf of Npb in the geometrical search, using a constant key and 35 different images. Note that the shapes of the graphs here are not bell-shaped like the previous graphs. This is because only 35 images were used in this experiment, which is not sufficient to get a good representation of all possible images. 2.3.4. Varying keys, varying images Geometrically searching over varying images using varying keys closely resembles the random-imagerandom-key experiment. The results in figure 9 show the largest variance of Npb of the four experiments. The larger variance means that more occurrences of Npb are shifted into the tails of the distribution. Therefore, the area between 50 and 64 positive bit detections increases, where positive watermark detection occurs. This causes a significantly higher number of false positive detections than was expected when setting the parameters of the watermarking system in section 2.2.1. where the distribution was assumed to be binomial. This assumption is not correct since the individual bit detections that are summed to detect
In hypothesis (7), we provided a bound to the size of a geometrical search to limit the expected number false positive detections. This hypothesis was based on the “random-image-random-key false positive detection probability”. From our experiments, we observed that varying over geometrical transforms results in essentially different properties for the false positive detection probability, and therefore also for the expected number of false positive watermark detections in an exhaustive geometrical search. Because the false positive detections are unevenly distributed over geometrical searches with different images and keys, some images/keys result in a much higher false positive detection probability compared to “random-image” detections, while the majority of images/keys result in a lower false positive detection probability. In our experiments, positive watermark detection was based on the summation of binary random variables. The non-stationarity of the underlying process, due to image and key dependency, resulted in a much higher overall false positive detection probability than expected from the Bernoulli experiment used as the model.
3. Blind geometrical transform estimation In the previous section, it was explained that exhaustive geometrical searching is not a desirable solution for watermark detection in geometrically distorted images. For detection of geometricaltransformation-sensitive watermarks, the watermark detector should be able to get more information about the geometrical transformation of the watermark. In this way, the detector can compensate for the distortion and does not have to perform a large amount of detections. Already a few watermarking methods exist that provide this extra information to the detector. They are described and compared using several criteria in section 3.1. In section 3.2 an implementation of the selected watermarking method is described in detail. Section 3.3 describes a method to increase security of the embedded synchronization information.
3.1. State of the art in blind methods to determine geometrical distortion In the literature, two main methods exist to estimate geometrical distortion of the watermark in a still image, when there is no non-distorted version of the image available. The first method uses a frequency template, the second a spatial template that also contains the information payload.
When the frequency points are found, the affine transform of the image can be determined from the translation of the points from their original to the new positions. Rotations in the frequency spectrum are equal to rotations in the spatial domain and frequencies are inverse proportional to the scale in the spatial domain. 3.1.2. Autocorrelation template watermarking M. Kutter [15] and S. Voloshynovskiy, et. al [7],[16] use the autocorrelation function (ACF) of a repeating watermark to estimate affine distortion. A repeating watermark pattern is implemented in the image that can be used to estimate an undergone affine transformation when the watermark in an image must be detected. A horizontally and vertically repeated pattern (macro block) causes a grid of points in the two-dimensional ACF and the Fourier Magnitude Spectrum (MS) of the watermarked image. The two (vertical and horizontal) grid directions and periods change proportional to the affine transformation that is applied to the watermarked image. The grid can be represented by two grid vectors u and v, see figure 10.
3.1.1. Frequency template watermarking S. Pereira and T. Pun [13] proposed to use an additional template that consists of some (8 in this case) pseudo randomly chosen points in one half of the mid-frequency-band of the frequency magnitude spectrum (MS) of the host image. To estimate an undergone affine transformation, the frequency points are searched in the peaks of the magnitude of the spatial frequency spectrum of the image. This is achieved by performing a constrained exhaustive search. Each 2 points of the searched frequency template points, (x1’,y1’) and (x2’,y2’), are matched to all combinations of two peaks in the measured image spectrum (that meet a certain constraint to limit the search), (pxi’,pyi’) and (pxj’,pyj’), and the corresponding affine transformation for this match is then applied to the remaining searched template points and the number of points that have a match with an MS peak is counted. A match is found when a peak of the image MS lies within a radius r around the template point. If a minimal number of N matches are found, a better estimation of the undergone affine transform is calculated using all matched points such that a mean square estimation error function is minimized.
Figure 10. The grid in the ACF of the watermarked image can be represented by two vectors v and u. The directions of the vectors correspond to the two main grid directions and the magnitudes to the period of the grid in the respective directions. (from [12]) In [11] only 4 large patterns are used that introduce 4 very large peaks in the ACF, but this can only be used to approximate a global affine transform, which results in a severe restriction of the robustness. In [7],[16] more, smaller, patterns are used that are local enough to remain ‘intact’ (affine transformed) even after a (mild) non-linear transformation is applied to the image. The tiled macro block is not only used for affine transform estimation, but the main part actually consists of the (encoded) watermark message bits. A smaller part of the block contains a pseudo random sequence that is known by the watermark detector and is necessary to find the orientation and/or translation of the
watermark blocks. It can also be used to do a geometrical search for the watermark pattern. When as much of the macro blocks are recovered in this way as possible, the unknown data part of the repeated macro block can be estimated by doing a maximum likelihood approximation for the data bits. 3.1.3. Assessment The two template methods mentioned above have much in common. Both methods confine the recovery from geometrical distortion to affine transforms. There is no specific comparison between the methods available yet, so it is difficult to choose the ‘best’ of the two. An attempt to do a comparison, based on all current available information, is done below. The important properties of a watermarking system, that are taken into account, are: imperceptibility (the invisibility of the watermark to the human eye), robustness to distortion, security (resistance to malicious attacks on the watermark and secrecy of embedded information), payload (amount of information that the watermark can carry), cascadability (the ability to embed multiple watermarks in one image with success) and computational complexity (required for embedding and detection of the watermark). Imperceptibility To ensure transparency, at each spatial image location, the watermark must be insignificant enough to be imperceptible. This means that at some locations, for instance with high spatial variation, the watermark strength can be amplified. With the ACF method, local visual masking can be applied in a straightforward manner by just scaling the watermark pattern at each location according to a certain masking model. With the frequency template, visual masking can only be applied globally, since the template is embedded in the frequency domain. Spatial adaptation of the frequency template strength is not possible, since that would mean a modulation of the frequency components and will harm the frequency peaks. Thus when the same watermark energy is embedded, the ACF template will be less visible, since the energy can be concentrated in image locations with good masking properties. Furthermore, the ACF template already contains the watermark payload, but the frequency template still requires an additional payload-carrying watermark, which would introduce more watermark energy and will decrease the imperceptibility under the same robustness constraints. Robustness It is not yet possible to make a judgement about robustness of the template methods to image
processing other then geometrical distortion. Both methods are very good at estimating a global affine distortion because it is a linear operation that also has a linear effect in the frequency domain and the ACF. The situation becomes different for more complex geometrical distortion. Due to the constraint that the distorted material must still have some commercial value, non-linear geometrical distortions can be locally approximated by affine transforms. Both methods can estimate an affine approximation of a non-linear distortion locally to some (unknown) extend, as long as the image quality is not degraded ‘too much’. But for the frequency template an additional payload-carrying watermark must be embedded. Most of these watermarks require the geometrical distortion to be corrected globally, which is very difficult when only local affine approximations can be made. With the ACF method however, the results of local affine registrations can easily be combined. This makes the frequency template method less robust to non-linear distortion. Security The frequency peaks of the frequency template method can be filtered out by local interpolation in the frequency magnitude spectrum, as demonstrated by A.Herrigel et. al [14]. This can be done without degrading image quality. The repeated pattern block of the ACF can be estimated without key knowledge. By embedding the inverted block with the same visual masking as was used for embedding the original watermark, the watermark can also be removed without degrading image quality. Since the watermark block consists of the embedded information, also the information is not secure, but it can be protected by encryption. Another attack, that will probably also be effective with both methods, is applying a geometrical distortion and embedding a new watermark template subsequently. The new template will cover the old one and make the affine estimation of the applied geometrical distortion difficult. Thus, both methods are very insecure. Payload Since both methods can be combined with payload carrying watermarks, no comparison can be made about watermark payload. Cascadability As mentioned in the discussion about security above, embedding a new watermark after applying a geometrical distortion on the first watermark decreases the detection performance. This means low cascadibilty. With the ACF method, embedding a new watermark with the same block size directly on top of the other, without applying a geometrical distortion in between, will not degrade affine
transform estimation when a transformation is applied afterwards. The grid peaks are the same for both watermarks. With the frequency template method however, even this situation would confuse the watermark detector, since the frequency peaks are different for each key. Computational complexity The frequency template method uses an exhaustive search for the affine distortion, and the ACF method computes radon transforms of a large image for small angle steps between 0 and 180 degrees. So watermark detection with both methods is expected to be rather computationally intensive. Watermark embedding will be less intensive. The most intensive part is calculating the forward and inverse wavelet transforms to perform spatially adaptive masking, but, as said above, this cannot be applied to the frequency template. Table 4. Comparison between two different template methods used for estimation and recovery from geometrical distortion. A ‘+’ sign means ‘good’, ‘++’ is ‘very good’, ‘+-‘ means neutral, ‘-‘ means ‘bad’ and ‘--‘ means ‘very bad’.
Global affine distortion
Frequency template
ACF template
++
++
Non-linear geometrical distortion
+-
+
Computational complexity
-
-
Imperceptibility
-
+
Security
--
--
Cascadability
--
-
The expected qualities of the different aspects that we were able to judge are summarized in table 4. In our comparison, that does not take into account actual performance measures, the ACF template method has some important advantages over the frequency template method. Since no disadvantages are known yet, the comparison is trivial and we chose the ACF template method to estimate the geometrical transforms in our research.
3.2. ACF watermarking algorithm
The implementation of the ACF based watermark algorithm is based on the method described in [4], with a few alterations. 3.2.1. Watermark embedding The generation of the watermarked image Y consists of three main steps, see also figure 11. First a square pattern b is generated containing the message m, using a secret key. Secondly, the watermark w is obtained by tiling b like a wallpaper pattern across the entire image surface. Finally, before adding w to the image, it is locally adapted to the content of the original image X according to a visual masking model. This is to ensure invisibility of the watermark, while increasing the watermark strength. !
# $
"
Figure 11. The watermark embedding process. A pattern block b is generated that contains the message m. This block is tiled to cover the entire image surface. The strength of the obtained watermark w is adapted to image content using a visual masking model. The result is added to the image X to retrieve the watermarked image Y. ?
%&'()*+,-& . /012314356 571839 :; YZZ[\Y]^[_ ^_ `a` bcdef
ijk clmn gh o h
rst uvwxxwy pq z
{
@ABCDE FGHDE ? IJKLJMNJ OPQR STU V WX
Figure 12. Generation of the watermark macroblock b. The message m is The encrypted and encoded message m is allocated in M pixels in the NxN block according to a key. The other NxN-M pixels are filled with a pseudo random sequence. The block is upsampled and flipped horizontally and vertically to obtain the macroblock b. The procedure for generating the macroblock b is shown in figure 12. In the original scheme the message m is encrypted for security reasons and encoded to make it robust against bit errors, we omitted this step in our research. Bit values {0,1} are mapped to {–1,1} to make the watermark zeromean. The resulting string is distributed over M pixels of an NxN size block. The remaining pixels of
the block are filled with a pseudo random string. This is called the ‘pilot’ signal and functions as a reference to find the orientation and translation of the pattern in the watermarked image. The block is upsampled by two to make it more robust to downscaling. Because rotations over ±90 and 180 degrees and mirroring of the image are ambiguous when using the regular MS grid for transformation estimation, the block is also flipped horizontally and vertically. Since the flipped block is symmetrical to mirroring and rotation over 180 degrees, the search space for finding the correct orientation and/or translation of the watermark is reduced. The only remaining ambiguity is a rotation of ±90 degrees. 3.2.2. Watermark detection Watermark detection is performed according to the scheme shown in figure 13.
8-79 5 :2*;-,
