Image Processing, IEEE Transactions on

IEEE TRANSACTIONS ON IMAGE PROCESSING, VOL. 10, NO. 5, MAY 2001

755

A New Decoder for the Optimum Recovery of Nonadditive Watermarks Mauro Barni, Member, IEEE, Franco Bartolini, Member, IEEE, Alessia De Rosa, and Alessandro Piva

Abstract—Watermark detection, i.e., the detection of an invisible signal hidden within an image for copyright protection or data authentication, has classically been tackled by means of correlation-based techniques. Nevertheless, when watermark embedding does not obey an additive rule, or when the features the watermark is superimposed on do not follow a Gaussian pdf, correlation-based decoding is not the optimum choice. A new decoding algorithm is presented here which is optimum for nonadditive watermarks embedded in the magnitude of a set of full-frame DFT coefficients of the host image. By relying on statistical decision theory, the structure of the optimum decoder is derived according to the Neyman–Pearson criterion, thus permitting to minimize the missed detection probability subject to a given false detection rate. The validity of the optimum decoder has been tested thoroughly to assess the improvement it permits to achieve from a robustness perspective. The results we obtained confirm the superiority of the novel algorithm with respect to classical correlation-based decoding. Index Terms—Digital watermarking, nonadditive watermarks, optimum detection.

I. INTRODUCTION

D

RIVEN by the need to develop efficient tools for multimedia copyright protection and authentication, a great deal of research has been carried out in the last few years in the field of digital watermarking [1]. According to the watermarking approach, data protection/authentication is accomplished by inserting within the data an invisible signal, i.e., the watermark, conveying information about data ownership, its provenance or any other information that can be useful to enforce copyright laws or prove the authenticity of the document. The watermark must be invisible, so that it does not affect the quality of multimedia data, and it should be difficult for nonauthorized personnel to remove or counterfeit it. Even if a precise list of the requirements a watermarking scheme must fulfill can not be given without taking into account a particular application scenario [2], [3], no doubts exist that the possibility of recovering the watermark with a high degree of reliability is of fundamental importance for all practical applicaManuscript received November 5, 1999; revised January 11, 2001. This work was supported in part by the Italian Ministry of the University and the Scientific and Technological Research (MURST). An Italian patent (FI99A000091) was filed in 1999 by M. Barni, F. Bartolini, V. Cappellini, A. De Rosa, and A. Piva for the method described in this paper. The associate editor coordinating the review of this manuscript and approving it for publication was Dr. Naohisa Ohta. M. Barni is with the Department of Information Engineering, University of Siena, 53100 Siena, Italy (e-mail: [email protected]). F. Bartolini, A. De Rosa, and A. Piva are with the Department of Electronic Engineering, University of Florence, 50139 Firenze, Italy (e-mail: [email protected]; [email protected]; [email protected]). Publisher Item Identifier S 1057-7149(01)03277-8.

tions. This work addresses the problem of optimum watermark detection. More specifically, a watermark detection scheme is presented which permits to minimize the probability of missing the watermark for a given false detection rate. By focusing on image watermarking, existing algorithms can be distinguished according to the domain the watermark is embedded in. From a general perspective we can have: spatial domain watermarking, frequency domain watermarking and hybrid domain watermarking. Techniques operating in the spatial domain [4]–[8] embed the watermark by modifying the gray level of image pixels, whereas frequency domain techniques [9]–[10] insert the watermark in the full-frame DFT or DCT coefficients of the image. Finally, hybrid techniques take into account both the frequency and spatial characteristics of the watermark, e.g., by modifying the block DCT coefficients of the image [5], [11], [12], or by operating in a space-scale domain like the wavelet domain [13]–[15]. Another important distinction can be be made on the basis of the rule used to embed the watermark within the image. More specifically, we can distinguish between additive and nonadditive watermarks. In additive watermarking, the watermark is simply added to a set of image features, e.g., pixels grey levels or frequency coefficients. Additive watermarking is very attractive for its simplicity and it has been used extensively in the literature. In many cases, though, nonadditive watermarking is adopted, either to achieve image-dependent watermarking [16], or to better exploit the characteristics of the human visual system (HVS). The latter is often the case with frequency domain watermarking, where by letting the watermark amplitude depend on the magnitude of the frequency coefficient the watermark is superimposed on, the masking characteristics of the HVS are exploited to ensure the invisibility of the mark [10]. At the decoder side, watermark detection is often based on the correlation between the watermark and the image features the watermark is superimposed on. In addition to simplicity, the rationale for the adoption of correlation-based decoding is that in the additive case (and by assuming host features follow a Gaussian pdf) such a strategy is an optimum one, in that it permits to minimize the error probability [17], [18]. This is not the case if the embedding rule is not additive. In this work the architecture of the optimum decoder for an additive/multiplicative watermark embedded in the DFT domain is derived. As to encoding we will assume that a strategy similar to that proposed in [9] is used. A detailed description of watermark casting is given in Section II, here it only needs to say that the watermark is conveyed by the magnitude of the DFT spectrum and that the amount of modification each

1057–7149/01$10.00 © 2001 IEEE

756


coefficient undergoes is proportional to the magnitude of the coefficient itself as expressed by the following rule: (1) where magnitude of the original DFT coefficient; marked magnitude; th component of the watermark; accounts for the position of the marked coefficient within the frequency spectrum; parameter controlling the watermark strength. As it can be seen, the embedding rule is not additive, besides the host features, namely the magnitude of DFT coefficients, do not follow a Gaussian pdf, thus invalidating the main hypotheses correlation-based decoding relies on. To derive the structure of the optimum decoder for watermarks embedded according to (1) we will proceed as follows. After a brief description of watermark casting (Section II), the exact solution to the problem of optimum watermark detection will be presented (Section III) by relying on Bayes decision theory. In Section IV, a statistical analysis aiming at modeling DFT coefficients will be presented. Such an analysis will be used in Section V to derive the actual structure of the decoder. At the same time, some minor modifications will be introduced to simplify the decoder structure and make it suitable for practical applications. The analysis leading to the optimum detection algorithm does not take into account possible attacks, thus extensive testing has been performed to evaluate the real effectiveness of the detector. The results we obtained are presented in Section VI where the validity of our decoding algorithm is confirmed by comparing its robustness against that achievable through conventional correlation-based decoding. A summary of the work and some conclusions are given in Section VII. II. WATERMARK CASTING To insert the watermark, we use an approach similar to that proposed in [9], where watermark embedding is achieved by modifying a set of full-frame transformed coefficients of the image. The only difference consists in the use of the magnitude of the DFT transform instead of the DCT, since in this way invariance to image translations is automatically obtained [19], thus augmenting the robustness of the watermark. The real watermark consists of a pseudo-random sequence of ; each value being a random numbers number with a uniform, zero mean, probability density function (pdf). As anticipated in the introduction, an additive/multiplicative embedding rule is adopted—(1)—trusting that larger DFT coefficients can convey a larger watermark without compromising invisibility [20]. Since the magnitude of marked coefficients has to be nonnegative, it must be guaranteed that (2)

Fig. 1. Position of the watermarked region in the frequency spectrum. To preserve the symmetry properties of the DFT magnitude spectrum, the watermark is embedded into the first and fourth quadrant first, then the watermarked regions are symmetrically copied into the corresponding positions of the second and third quadrants.

hence, we will assume that s take values in the finite interval , and . Note that more restrictive conditions on the maximum allowable are usually imposed by the invisibility constraint. To allow the blind recovery of the watermark, the mark is always inserted in the same set of coefficients. In Fig. 1 the frequency region hosting the watermark is depicted. In particular, to account for the symmetry properties of the magnitude of the DFT spectrum, to-be-marked DFT coefficients are those th diagonal in the first quadrant and between th and the corresponding symmetricals in the fourth quadrant: these regions are then duplicated in the second and third quadrant. To enhance watermark robustness and invisibility, the characteristics of the Human Visual System can be exploited to adapt the watermark to the host image [21]. The approach followed here is similar to that described in [22], and consists in the construcby pixelwise mixing the tion of another watermarked image original image and its watermarked version according to the rule (3) takes values in the [0,1] interval, where the masking image and gives a pixel by pixel measure of how visible the watermark will be when added to the host image. Several approaches exist [22]. Here, we built it by comto build the masking image puting, at each image location, the local variance over a square ), and by normalizing the resulting image window (e.g., with respect to its maximum value. The value of the mask at each pixel is thus (4)

is the average value of within a window where centered in , and is the maximum value of the local variance over the whole image.

BARNI et al.: NEW DECODER FOR THE OPTIMUM RECOVERY OF NONADDITIVE WATERMARKS

When visual masking is used, the watermark energy across the image depends on the mask; in particular, for a given value of , the average watermark strength is given by (5) where

757

where is the pdf of the random vector conditioned to and are the the event , and , a priori probabilities of and are the losses sustained when a hypothesis is in force and we decide for the other one. The term is called likelihood ratio and is usually denoted by

(6)

(10)

, are reis the average value of the mask image , and spectively the number of columns and the number of rows of the image. In the following sections we will derive the structure of the optimum decoder without taking into account either visual masking or the presence of attacks aiming at removing the watermark from the image. Instead, the effect of visual masking and attacks on the optimum decoder performance will be investigated experimentally in Section VI.

represents the decision threshold and is The term usually indicated by : if the likelihood ratio exceeds , then is accepted, otherwise is accepted. Under the assumption that watermark components are uni, is composed by an infinite formly distributed in number of watermarks, hence, by invoking the total probability can be written as theorem [25], the pdf (11)

III. OPTIMUM WATERMARK DETECTION According to the approach used here, given a possibly watermarked image, the goal of watermark detection is is present in the to verify whether a given watermark image or not (detectable watermarking [23]). By relying on hypothesis testing or decision theory, the problem is one of taking measurements and then estimating in which of a finite number of states an underlying system resides. In particular, the system is the to-be-analyzed image and the system obserof possibly vation variable is the vector marked DFT coefficients. We define two hypotheses: the system contains a certain parameter, namely the watermark (hypothesis ), or the system does ); consequently the not contain this parameter (hypothesis , where parameter space can be defined as and , including that corresponds to a nonmarked image. We look for a test of the versus the composite alternative that simple hypothesis is optimum with respect to a certain criterion. A. Likelihood Ratio In Bayes theory of hypothesis testing, the criterion is minimum Bayes risk, where Bayes risk is defined to be the average of a loss function with respect to the joint distribution of the measurement and the parameter [24]. The decision rule maps each into 0 or 1, corresponding to and , respectively, (

is in force)

(

is in force)

(7)

and are acceptance and rejection regions for hywhere . pothesis or, equivalently, the test , are selected so The region that the Bayes risk is minimized (8) otherwise

(9)

(remember that wawhere termark components are independent variables identically dis). Indeed, for computing , the intributed in instead tegral should be computed over the set , anyway it is known from the theory of measure of that the integrals of a function over two integration domains differing by a set of zero measure are the same1 (as it is our case, is a single point in the continuous given that the watermark space). Finally, inserting (11) in (10) yields

(12)

where we have exploited the assumption that a given DFT coefficient depends only on the corresponding watermark component, and that DFT coefficients are independent each other. B. Threshold Selection For a correct behavior of the watermark detector, it is important to properly choose the decision threshold . A possibility consists in choosing in such a way that the error probais minimized. By letting bility be the probability of revealing the presence when is not actually present (false positive), and of the probability of missing the presence of the mark (false negative), we can write (13) is minimized if From decision theory it is known [27] that (corresponding to the common situation in which 1For

example, such a property can be easily derived from [26, Th. 2].

758


and ). In such a case , that is false positive and false negative probabilities are the same. When attacks are taken into account, though, the above choice of the threshold is not a good one. Experimental results, in fact, show that when the watermarked image is attacked, the probability of missing the watermark becomes considerably larger than the false positive probability [9], [28]. To solve this problem, a different approach to threshold selection is used here, based on the Neyman–Pearson criterion [27]. Instead of minimizing the error probability , the threshold is chosen in such a way that the missed detection rate is minimized subject to a fixed false posi. Stated in another way, amongst all the tive probability, say thresholds that permit to satisfy the constraint

(a)

we choose the one that minimizes the false negative probability , or equivalently, the one that maximizes the correct . From detection theory, we know detection probability has been fixed, the threshold resulting from the that, once Neyman–Pearson criterion can be computed by means of the following relation:

(14) where

is pdf of under hypothesis

(b)

.

IV. PROBABILITY DENSITY FUNCTION OF DFT COEFFICIENTS To implement the watermark decoder by relying on the test defined in (9) and the threshold calculated by function means of (14), the pdf of DFT coefficients must be estimated first. To describe the magnitude of the DFT spectrum, a parametric pdf is needed which is nonzero on the positive real axis only, and which is both flexible and easy to handle from a mathematical point of view. Parametrization should permit the description of random variables characterized by different variance and shape. The solution we adopted is to describe the magnitude of DFT coefficients through a Weibull pdf, defined as

(c) Fig. 2. For = 1, the Weibull pdf degenerates into an exponential pdf, whereas by letting (a) = 2, a Rayleigh probability density function is obtained. The effect of varying (b) and (c) on the shape of the Weibull probability density function is also highlighted.

(15) and are real-valued positive constants conwhere trolling the pdf mean, variance and shape. In particular, the mean and the variance of the Weibull pdf can be expressed as follows: (16) (17) and , when Limit cases are obtained by letting the Exponential and Rayleigh distributions are obtained respectively. The shape of some Weibull pdfs with different values of the parameters and are reported in Fig. 2(a)–(c).

By remembering the watermarking rule, the pdf marked coefficient subject to a watermark value written as

of a can be

(18) indicates the pdf of the original, nonmarked, coefwhere with , the pdf of the magficient. By substituting nitude of a marked coefficient is achieved

(19)


759

V. ACTUAL IMPLEMENTATION OF THE DECODER In this section we will use the analysis carried out in Sections III and IV, to actually implement the optimum watermark decoder. A. Log-Likelihood Function and Threshold Selection As a first step we have to rewrite the likelihood function given in (12) by taking into account the DFT coefficients model introduced in the previous section. By exploiting the assumption on the independence of DFT can be expressed as coefficients, and by using (19),

(20) Then we would have to integrate termarks to obtain the denominator of have to evaluate

over all possible wa, that is, we would

Fig. 3. Schematic representation of the watermark detection system.

theory. The signal space consists of two subspaces, one conand the other with the taining the known watermark code . The noise space contains the vector with nonnull code marked coefficients . Finally, the observations space contains the vector with the marked coefficients . The decision rule permits to pass from the observations space to the decisions space, which is composed by two parts representing the presence and . When is replaced the absence of the watermark , the likelihood function assumes the form of (22) by shown at the bottom of the page. To further simplify the deis used instead of coder, the log likelihood ratio

(23)

(21) and the decision rule can be given the form Unfortunately, the above integrals can not be solved analytically, thus calling for a numerical solution. To simplify the decoder, we have developed an approximate decoding algorithm which couples effectiveness and simplicity. The simplified decoder relies on the assumption that the watermark strength is much lower than 1. Note that this assumption is verified in virtually all practical applications, since the watermark energy has to be kept low due to the invisibility requirement. In the appendix, it is demonstrated that if is reasonably can be approximated by , where by small, the null watermark is meant. Under this hypothesis, the watermark decoder assumes the form sketched in Fig. 3, where decoding is looked at from the point of view of classical detection

(24) Inserting (23) in (24) yields

(25) The term on the left is the sufficient statistic for the test. By letting (26)

(22)

760


and (27) the test is defined by the inequality (28) or equivalently (29) . As to , its value can be fixed by applying where the Neyman–Pearson criterion to the log likelihood ratio, that is by solving (30) , the pdf of The next step requires the calculation of conditioned to the presence of the null watermark , or equiva. When holds , then we can write lently, (31) , i.e., the sign of , According to the sign of is a decreasing or increasing monotonic function; without is positive. By loosing in generality, we will assume that also noting that is nonnegative, the pdf of conditioned to , , can be evaluated by means of the expression [25, p. 93]

Fig. 4. Marked area of the magnitude of DFT spectrum has been divided into 16 zones for the statistical estimation of the coefficients pdf.

watermark, can be assumed to be a normal one, with mean and variance (36)

(37) By inserting the expression of probability is obtained

in (30), the false positive

(32) , is the first where is the root of the equation is the derivative of with respect to computed on , and heavyside step function. Inverting relation (31), and inserting it in (32) yields

erfc

(38) , we obtain

In particular, given

(39) (33)

which finally leads to

is negative. By observing (33), we A similar result holds if can note that the random variable follows an exponential pdf, with mean and variance given by (34) (35) By invoking the central limit theorem [25], the pdf of the random conditioned to the presence of the null variable

(40)

B. Estimation of

and

The statistical test defined by (25), (28), (36), (37), and (40) depends on the values of the parameters and . Though such parameters refer to the pdf of nonmarked coefficient, their actual values can be estimated a-posteriori on the watermarked image supposed that the presence of the watermark does not alter them significantly, that is the watermark strength is sufficiently small


761

TABLE I COMPARISON BETWEEN TARGET AND ACTUAL FALSE DETECTION PROBABILITY. RESULTS HAVE BEEN OBTAINED BY LOOKING FOR A RANDOM SET OF WATERMARKS DIFFERENT FROM THE ONE ACTUALLY EMBEDDED WITHIN THE IMAGE. THE 512 512 Lena IMAGE HAS BEEN USED THROUGHOUT THE EXPERIMENTS, WHEREAS WAS SET TO 0.15

2

( ). As noted in the previous section, this is often the case, since is usually limited by the necessity of ensuring the invisibility of the watermark. The a posteriori estimation of and on the watermarked image is accomplished by splitting the DFT region hosting the watermark into 16 smaller subregions, as shown in Fig. 4; the coefficients of each subregion are assumed to follow the same pdf. Under this hypothesis the parameters and characterizing each sub-region can be evaluated by applying the Maximum Likelihood (ML) criterion to the DFT samples contained in it. Equations (23) and (40) can then be rewritten as

(41)

(a)

(42) where denotes the th sub-region the watermarked area of the is the number of DFT DFT spectrum has been split into, and samples belonging to the th subregion. C. Spatial Masking As briefly outlined in Section II, watermark robustness is usually improved by means of spatial masking. The optimum decoder structure, though, has been derived without taking into account spatial masking. The actual performance of the decoder in presence of masking, then, must be validated experimentally. The results of such a validation are reported in the next section, where optimum decoding is compared to the conventional correlation-based approach. VI. EXPERIMENTAL RESULTS As a first step we verified that by fixing the detection threshold as indicated in Section V, the desired false detection probability is achieved. The results we obtained are reported in Table I, where the actual false detection probability is compared to the target one for different values of the desired false detection rate. As it can be seen, experimental results

(b) Fig. 5. Robustness against nonlinear image smoothing (median filtering): (a) correlation detection and (b) optimum detection. Results refer to the Lena image. The watermark strength has been set to 0.22.

confirm the validity of the theoretical analysis we developed in the previous sections. Note that the results reported in the table have been obtained without considering spatial masking. Extensive testing has been performed to assess the performance of the new decoding scheme from the point of view of robustness, and to compare it against correlation-based decoding. More specifically, we compared the results obtained by the optimum decoder with those achieved by a conventional correlation decoder similar to that one described in [9]. To make the comparison as fair as possible, threshold selection has been accomplished by fixing the false detection probability even for the correlation decoder [28]. In either case the watermark has been embedded in the coefficients belonging to the diagonals

762


(a)

(a)

(b)

(b)

Fig. 6. Robustness against Gaussian noise addition: (a) correlation detection and (b) optimum detection. Results refer to the Lena image. The watermark strength has been set to 0.22.

from the 79th to the 150th, for a total of 16 046 marked coefficients, in addition visual masking has been applied to improve the robustness of the watermark, as described in Section II. As to watermark strength we used the maximum allowable energy under the invisibility constraint. Three groups of tests have been carried out aiming at measuring the robustness of the watermark against standard image processing, lossy compression and geometric manipulations. In all the cases, experiments have been carried out by marking a real world images. More specifically, set of standard the results presented in the following refer to the Lena image; similar results have been obtained on the other images of the test set, namely Bridge, Boat, and Mandrill images. A. Robustness Against Image Processing We have tested the robustness of the watermark against image smoothing (median filtering) and Gaussian noise addition. Each attack has been applied several times, each time increasing the attack strength, e.g., augmenting the power of the noise added to the image. The results we obtained are reported in Figs. 5(a)– 6(b). For each attack the response of the detector for 1000 randomly generated watermarks, including the one

Fig. 7. Robustness against JPEG coding: (a) correlation detection and (b) optimum detection. As it can be noted in the optimum decoding case the curves referring to the true watermark and to the false ones are more spread, thus permitting higher robustness. Results refer to the Lena image. The watermark strength has been set to 0.22.

actually embedded within the image, has been measured. The response relative to the true watermark and the highest response among those corresponding to the other watermarks are plotted along with the detection threshold. In this way both false positive and false negative detection errors are taken into account. As it can be seen the new algorithm permits to obtain a significant improvement with respect to conventional correlation decoding. B. Robustness Against Lossy Compression Robustness against lossy compression is of crucial importance due to the wide diffusion of lossy compression tools. To assess the performance of the optimum decoder from this point of view, we iteratively applied JPEG compression to the watermarked images, each time decreasing the quality factor, i.e., increasing the compression ratio. The results we obtained are summarized in Fig. 7, where the minimum quality factor for which the watermark can still be recovered is highlighted. The above analysis is further confirmed by the results depicted in Fig. 8, where robustness against joint compression and filtering


763

(a)

(a)

(b)

(b)

2

Fig. 8. Robustness against joint median filtering (3 3 window) and JPEG coding: (a) correlation detection and (b) optimum detection. Results refer to the Lena image. The watermark strength has been set to 0.22.

is accounted for. More specifically, the results refer to the case median filin which JPEG compression is preceded by tering. As in Fig. 7, the detector output is plotted versus the JPEG quality factor used to code the images. C. Robustness Against Geometric Manipulations When speaking about geometric manipulations, three main kinds of attacks have to be considered: scaling, extraction of subparts (cropping), and rotation. As to scaling, the algorithm presented in this paper is intrinsically resistant to it, as discussed in [9], [23]. In fact, the effect of spatial scaling on the frequency spectrum corresponds to an inverse geometric transform: the bandwidth of the image spectrum is reduced if the image is enlarged, and the opposite happens when the image is shrinked. In either case, the location of the center of the spectral copies remains fixed, but their separation changes since the spectral component of the image occupy larger or smaller spectral area. In particular, in the case of upscaling such a distance increases, whereas in the downscaling case replicas get closer, eventually leading to aliasing. This effect will corrupt some portion of the watermark in the higher frequency spectrum reducing the chance of successfully

Fig. 9. Robustness against image cropping: (a) correlation detection and (b) optimum detection. On the horizontal axis the size of the cropped image is reported (the original size was 512 512). As explained in text robustness to cropping is achieved only if the original image size is known. Results refer to the Lena image. The watermark strength has been set to 0.22.

2

detecting the watermark. However, if we assume that the downscaling factor is not too large, aliasing does not affect the marked portion of the spectrum and the watermark can be easily recovered. As to cropping, if a subpart of the watermarked image is extracted, the watermark can not be recovered anymore, unless a suitable synchronization signal is inserted which permits to trace back to the original image size [23]. Nevertheless, some experiments have been carried out here to check if the information contained in a subpart of the watermarked image is sufficient to detect the watermark. To this aim, after cropping the extracted image subpart has been framed against a black background. In this way, the watermark can still be recovered and the minimum image size needed to detect it gives an indicative measure of the robustness of the watermark with respect to cropping. An exhaustive description of the results we obtained is given in Fig. 9. Even in this case the superiority of the novel algorithm is evident. With regard to rotation, the watermark survives small rotations (up to 0.5 ). The robustness to small rotations, coupled

764


TABLE II RESULTS WE OBTAINED BY APPLYING THE Stirmark 3.1.79 SOFTWARE TO TEST THE RELIABILITY OF OPTIMUM WATERMARK DECODING IN PRESENCE OF ATTACKS. THE TABLE REFERS TO THE Lena IMAGE

with the robustness to scaling and shifting (due to the shift invariance of the DFT magnitude), allows watermark recovery even after printing, photocopying and scanning. As it is witnessed by the tests we carried out, in fact, the watermark can be recovered even when printing, scanning and photocopying were performed by using poor quality devices. When large rotations are considered, the presence of a synchronization pattern must be envisaged whose retrieval permits to get some information about the rotation angle [29]. No results are reported here about robustness to large rotation, since it ultimately depends on the synchronization mechanism and is not a characteristic of the watermark embedding and retrieval algorithms.

We believe that the results we obtained are a good example of the benefits achievable by casting the watermark problem into a solid theoretical framework. As it is often the case when a new discipline emerges, in fact, many of the first works about watermarking were rather heuristic in nature. We think that times are now ripe to ground watermarking on a solid theoretical background. A better knowledge of items such as the capacity of the watermark channel, the maximum achievable reliability, or the development of an objective way to compare different watermarking techniques and to assess their performance, can pave the way to watermark standardization and to a more effective use of watermarking technology in real world applications. APPENDIX

D. Objective Measure of Watermark Robustness To give an objective measure of the watermark robustness, we adopted the scoring procedure proposed by Petitcolas et al. [30]. Such a procedure is based on the StirMark 3.1.79 software, a watermark-removal package by means of which different attacks can be performed at different strength levels resulting in a final robustness score. To effectively test the performance of the optimum watermark decoder, we added to the watermarking scheme a simple synchronization mechanism which permits to cope with geometric attacks, since it gives to the detector the possibility of estimating the original size and orientation of the watermarked image. A description of how synchronization patterns can be used to cope with geometric attacks can be found in [29], [31]. Moreover, a second step in the detection algorithm has been introduced, where the code is looked for in the flipped version of the image. A summary of the results we achieved is reported in Table II. In particular, the proposed watermarking system breaks down under the following attacks: a 45 rotation, an uniform scaling of 50%, an image cropping of 75% and the random geometrical distortions introduced by the Stirmark attack.

In this Appendix, we demonstrate that under the assumption with that is much lower than 1, we can substitute in the expression of the likelihood function . as In Section IV we wrote (43)

By exploiting the independence of DFT and watermark coefficients and by adopting the Weibull model introduced in Seccan be put in the form tion V, the denominator of

(44) Let us now evaluate the integrals at the denominator under the . Each of the integrals can be rewritten as hypothesis

VII. CONCLUSIONS To improve the performance of classical correlation-based watermark recovery in the case of nonadditive watermarking operating in the DFT domain, we derived a new watermark detection algorithm which is optimum under the Neyman–Pearson criterion. More specifically, the new algorithm permits to minimize the missed detection probability subject to a given constraint on the maximum allowable false detection rate. The new algorithm, which relies on Bayes statistical detection theory and on a new approach to the modeling of DFT coefficients, permits to improve significantly the performance of correlation-based decoders in terms of watermark robustness.

(45) where the index has been omitted for simplicity. By letting (46) the integral (45) assumes the form (47)


We now exploit the assumption that is much lower than 1. Under this hypothesis the integration interval is very small and we can replace the to-be-integrated function with its linear apthe integration interval proximation. By noting that for , we then have is centered in (48) with (49) Substituting approximation (48) in (47), yields

(50) the second integral of the above expression apFor proaches zero. It corresponds, in fact, to the integration of a , over an interval which, for linear function, namely . By solving small values of , is symmetric with respect to the first integral, we find that expression (47) can be rewritten as (51) finally leading to (52) , the last term of the By exploiting again the condition above equation can be neglected, thus permitting us to conclude that

(53) that is the pdf of a generic, nonmarked, DFT coefficient. By repeating the above analysis for all the integrals at the denomi, we can easily prove that nator of (54) REFERENCES [1] M. D. Swanson, M. Kobayashi, and A. H. Tewfik, “Multimedia dataembedding and watermarking technologies,” Proc. IEEE, vol. 86, pp. 1064–1087, June 1998. [2] F. Mintzer, G. W. Braudaway, and M. M. Yeung, “Effective and ineffective digital watermarks,” in Proc. Int. Conf. Image Processing’97, vol. 3, Santa Barbara, CA, Oct. 1997, pp. 223–226. [3] A. Piva, M. Barni, F. Bartolini, and V. Cappellini, “Application-driven requirements for digital watermarking technology,” in Proc. Eur. Multimedia Microprocessor System Electronic Commerce Conf. Exhibition ’98, Bordeaux, France, Sept. 28–30, 1998, pp. 513–520. [4] W. R. Bender, D. Gruhl, and N. Morimoto, “Techniques for data hiding,” Proc. SPIE, vol. 2420, pp. 164–173, Feb. 1995.

765

[5] G. C. Langelaar, J. C. A. van der Lubbe, and R. L. Lagendijk, “Labeling methods for copy protection of images,” in Proc. SPIE Electronic Imaging’97, San Jose, CA, Feb. 1997. [6] I. Pitas, “A method for watermark casting on digital images,” IEEE Trans. Circuits Syst. Video Technol., vol. 8, pp. 775–780, Oct. 1998. [7] J. R. Smith and B. O. Comiskey, “Modulation and information hiding in images,” in Proc. 1st Int. Workshop Information Hiding, vol. 1174, 1996, pp. 207–226. [8] M. D. Swanson, B. Zhu, and A. Tewfik, “Transparent robust image watermarking,” in Proc. IEEE Int. Conf. Image Processing, vol. 3, Lausanne, Switzerland, Sept. 1996, pp. 211–214. [9] M. Barni, F. Bartolini, V. Cappellini, and A. Piva, “A DCT-domain system for robust image watermarking,” Signal Process., vol. 66, pp. 357–372, May 1998. [10] I. J. Cox, J. Kilian, T. Leighton, and T. Shamoon, “Secure spread spectrum watermarking for multimedia,” IEEE Trans. Image Processing, vol. 6, pp. 1673–1687, Dec. 1997. [11] F. M. Boland, J. J. K. ÓRuanaidh, and C. Dautzenberg, “Watermarking digital images for copyright protection,” Proc. Inst. Elect. Eng. Visual Image Signal Processing, vol. 143, pp. 250–256, Aug. 1996. [12] E. Koch, J. Rindfrey, and J. Zhao, “Copyright protection for multimedia data,” in Proc. Int. Conf. Digital Media Electronic Publishing, Leeds, U.K., Dec. 1994. [13] M. Barni, F. Bartolini, V. Cappellini, A. Lippi, and A. Piva, “DWT-based technique for spatio-frequency masking of digital signatures,” Proc. SPIE Security Watermarking Multimedia Contents, vol. 3657, pp. 31–39, Jan. 23–29, 1999. [14] D. Kundur and D. Hatzinakos, “A robust digital watermarking method using wavelet-based fusion,” in Proc. IEEE Int. Conf. Image Processing ’97, Santa Barbara, CA, Oct. 26–29, 1997, pp. 544–547. [15] X. Xia, C. G. Boncelet, and G. R. Arce, “A multiresolution watermark for digital images,” in Proc. IEEE Int. Conf. Image Processing’97, Santa Barbara, CA, Oct. 26–29, 1997, pp. 548–551. [16] I. Cox and M. L. Miller, “A review of watermarking and the importance of perceptual modeling,” in Proc. Electronic Imaging, Feb. 1997. [17] G. F. Elmasry and Y. Q. Shi, “Maximum likelihood sequence decoding of digital image watermarks,” in Proc. SPIE Security and Watermarking of Multimedia Contents, vol. 3657, San Jose, CA, Jan. 23–29, 1999, pp. 425–436. [18] J. G. Proakis, Digital Communications. New York: McGraw-Hill, 1989. [19] J. J. K. ÓRuanaidh and T. Pun, “Rotation, scale and translation invariant digital image watermarking,” in Proc. IEEE Int. Conf. Image Processing, vol. I, Santa Barbara, CA, Oct. 26–29, 1997, pp. 536–539. [20] J. M. Foley and G. E. Legge, “Contrast masking in human vision,” J. Opt. Soc. Amer., vol. 70, no. 12, pp. 1458–1470, Dec. 1980. [21] J. F. Delaigle, C. De Vleeschouwer, and B. Macq, “Watermarking algorithm based on a human visual model,” Signal Process., vol. 66, no. 3, pp. 319–336, May 1998. [22] F. Bartolini, M. Barni, V. Cappellini, and A. Piva, “Mask building for perceptually hiding frequency embedded watermarks,” in Proc. Int. Conf. Image Processing Applications, Chicago, IL, Oct. 1998, pp. I:450–I:454. [23] M. Barni, F. Bartolini, and A. Piva, “Copyright protection of digital images by means of frequency domain watermaking,” in Proc. SPIE Mathematics Data/Image Coding, Compression, Encryption, , vol. 3456, M. S. Schmalz, Ed., San Diego, CA, July 21–22, 1998, pp. 25–35. [24] L. L. Scharf, Statistical Signal Processing: Detection, Estimation, and Time Series Analysis. Reading, MA: Addison-Wesley, 1991. [25] A. Papoulis, Probability, Random Variables, and Stochastic Processes. New York: McGraw-Hill, 1991. [26] A. N. Kolmogorov and S. V. Fomin, Introductory Real Analysis. New York: Dover, 1975. [27] J. V. Di Franco and W. L. Rubin, Radar Detection. Norwood, MA: Artech House, 1980. [28] A. Piva, M. Barni, F. Bartolini, and V. Cappellini, “Threshold selection for correlation-based watermark detection,” in Proc. COST254 Workshop, L’Aquila, Italy, Apr. 1998. [29] D. Fleet and D. Heeger, “Embedding invisible information in color images,” in Proc. IEEE Int. Conf. Image Processing ’97, vol. 1, Santa Barbara, CA, Oct. 26–29, 1997, pp. 532–535. [30] F. A. P. Petitcolas and R. J. Anderson, “Evaluation of copyright marking systems,” in Proc. IEEE Int. Conf. Multimedia Computing Systems’99, vol. I, Florence, Italy, June 7–11, 1999, pp. 574–579. [31] A. Piva, M. Barni, F. Bartolini, V. Cappellini, A. De Rosa, and M. Orlandi, “Improving DFT watermarking robustness through optimum detection and synchronization,” in Proc. ACM Workshop Multimedia Security, Orlando, FL, October 30–31, 1999.

766

Mauro Barni (S’88–M’96) was born in Prato, Italy, in 1965. He graduated in electronic engineering from the University of Florence, Florence, Italy, in 1991, and received the Ph.D. degree in informatics and telecommunications in 1995. From 1995 to 1998, he was a Postdoctoral Researcher with the Department of Electronic Engineering, University of Florence. Since September 1998, he has been with the Department of Information Engineering, University of Siena, Siena, Italy, where he is an Assistant Professor. His main interests are in the fields of digital image processing and computer vision. His research activity is focused on the application of image processing techniques to cultural heritage analysis and preservation, copyright protection of multimedia data (digital watermarking), and transmission of image and video signals in error-prone wireless environments. He has published more than 100 papers on these topics in international journals and conferences. He holds two Italian patents in the field of digital watermarking.

Franco Bartolini (M’96) was born in Rome, Italy, in 1965. In 1991, he graduated (cum laude) in electronic engineering from the University of Florence, Florence, Italy. In November 1996, he received the Ph.D. degree in informatics and telecommunications from the University of Florence. He is now a Postdoctoral Researcher with the University of Florence. His research interests include digital image sequence processing, still and moving image compression, nonlinear filtering techniques, image protection and authentication (watermarking), image processing applications for the cultural heritage field, signal compression by neural networks, and secure communication protocols. He has published more than 80 papers on these topics in international journals and conferences. He holds two Italian patents in the field of digital watermarking. Dr. Bartolini is a member of IAPR.


Alessia De Rosa was born in Florence, Italy, in 1972. In 1998, she graduated in electronic engineering from the University of Florence, Florence, Italy, where she is currently pursuing the Ph.D. degree. She is involved in the research activities of the Image Processing and Communications Laboratory, Department of Electronics and Telecommunications, University of Florence. Her main research interests are in the field of digital watermarking and human perception models for digital image watermarking and quality assessment. She holds an Italian patent in the field of digital watermarking.

Alessandro Piva was born in Florence, Italy, in 1968. In 1995, he graduated (cum laude) in electronic engineering from the University of Florence, from which he received the Ph.D. degree in informatics and telecommunications in 1999. He is now a Postdoctoral Researcher with the University of Florence. His research activity is focused on multimedia systems, digital image sequence processing, image protection and authentication (watermarking), image processing techniques for cultural heritage applications, and secure communication protocols. He has published more than 40 papers on these topics in international journals and conferences. He holds two Italian patents in the field of digital watermarking.