WATERMARKING 3D MODELS Thomas Harte and Adrian G. Bors Department of Computer Science University of York, York YO10 5DD, U.K. E-mail:
[email protected] ABSTRACT Copyright protection of graphical objects and models is important for protecting author rights in animation, multimedia, computeraided design (CAD), virtual reality, medical imaging, etc. In this paper we suggest a blind watermarking algorithm for 3D models and objects. A string of bits, generated according to a key, is embedded in the geometrical structure of the graphical object by changing the locations of certain vertices. The criterion to choose these vertices ensures a minimal visibility of the distortions in the watermarked object. A bit encoding 1 is associated with positioning a vertex inside a volume modelled by the geometry of its neighbourhood, while a bit encoding 0 positions the vertex outside such a volume. The proposed watermarking algorithm is applied on various 3D models. 1. INTRODUCTION Digital watermarking is a technique designed to hide information in a certain type of digital data. Embedded watermarks can be used to enforce copyright, data authentication or to add information to the data. Ideally, the watermark should not interfere with the intended purposes of the data. A watermarking technique has two stages: watermark embedding and detection respectively. Most of the research on watermarking has concentrated on watermarking audio data, still images, or video [1, 2, 3]. While audio data consists of one-dimensional time varying signals, images are 2-D mappings of digital data distributed on a rectangular lattice. When applied on still images, the watermarking algorithms can be classified in those which are embedded in the space domain [4] or in a transform domain such as DCT [5]. We consider a 3D model as a wire-frame whose nodes are represented by vertices. A graphical object is described by a set of vertices, defined as 3D vectors, and a set of surfaces, each delimited by a group of vertices. Because of a different nature of the digital data to be watermarked, algorithms employed in still images cannot be used in a straight forward way for graphical objects. Watermarking 3D graphical objects or models is very important in many areas of activity including digital cinematography, virtual reality as well as in CAD design. Graphical characters or graphical layouts of technical objects are initially created by a specific author or designer. Afterwards, they may be handled by a different person in a larger graphical context. However, in such a situation, the author or designer may want to maintain the copyright or the authenticaton of the object. The aim of the authentication watermark is to identify if the graphical object has been altered. Authentication of graphical objects has been studied in [6] and [7]. In order to protect the copyright, the algorithm embeds in the object information related to the owner of the object,
usually an ownership code. A copyright protection watermarking algorithm employing modifications in the histograms of 3D object surface normals is considered by Benedens in [8]. Watermarking of 3D polygonal meshes in spectral domain has been shown to be robust under various attacks in [9]. However, these two approaches need the original object in the detection stage. Such watermarking algorithms can be used only for private key watermarking systems. In this paper we suggest an algorithm for watermarking 3D objects where we do not need the original in the detection stage. The proposed watermarking technique is applied locally and it is essentially geometrical in nature. We can identify two main steps in the watermarking algorithm. In the first step a chain of vertices and their neighbourhoods are selected from the object data. These neighbourhoods are chosen such that we achieve a minimal visibility of the modifications to be performed in the geometry of the object. The selected vertices are ordered according to a distance criterion. In the second stage, bounding volumes are modelled from the selected neighbourhoods and the corresponding vertices are moved inside the bounding volume when embedding a bit or outside, respectively, for embedding a bit of . In the detection stage, the embedded bits are retrieved by checking their relative location with respect to the bounding volumes. The sequence of retrieved bits is matched against the given watermark code. Vertices and their neighbourhoods that do not fulfil the selection condition are not suitable to embed the watermarking code. The proposed watermarking algorithm can be used as a public key watermarking technique. The paper is organised as follows. The requirements for a 3D object watermarking system are provided in Section 2. The procedure for selecting the locations where the watermark is embedded is described in Section 3, while the watermark embedding and detection algorithm is detailed in Section 4. Experimental results are provided in Section 5 while the conclusions are drawn in Section 6.
2. REQUIREMENTS FOR 3D OBJECT WATERMARKING ALGORITHMS The conditions and requirements imposed on watermarking technologies when applied on audio, video or images have been defined in various studies, such as those from [1, 2, 3, 5]. Volumetric images can be produced by computer tomography, MRI or by other processing means. A volumetric image is constituted from an array of voxels located on a 3D lattice. Three-dimensional regions of interest are extracted from such images using segmentation and modelling. A graphical object representation is very suitable for visualisation and interpretation of the data acquired from sensors. Graphical objects are also designed using CAD systems or they can be derived from images using shape-from-shading techniques.
Graphical objects are usually characterised by a set of vertices joined by line segments and by surface patches. For proper shading and texturing, surface normals should be calculated for each surface patch. Usually, in the case of a graphical object we have to deal with a relatively low volume of data which mainly carries geometrical information. Some of 3D graphic object watermarking requirements are similar to those for audio or image watermarking. Such requirements include the non-perceptibility of changes brought to the watermarked model. Additionally, a system must ensure that the watermark is still present in an object which underwent certain transformations. Such transformations may be necessary for the usability of that data or they may be performed by an attacker with the purpose of destroying the watermark. Due to the geometrical nature of graphics data, other requirements must be considered in a 3D graphics watermarking system. Such requirements can be classified as geometrical and topological with respect to the likely transformation. Geometrical transformations include rotation, scaling or their combination and can be local or applied on the entire object. Topological transformations consists of changing the order of vertices in the object description file, polygon simplification, mesh altering or cropping parts of the object. Other processing algorithms include object compression and encoding. From the category of intentional attacks we can mention smoothing algorithms or corruption with noise. There is a trade off between being able to make the watermark survive the above mentioned transformations and the visibility of the watermark. An ideal system requires in the detection stage only the knowledge of the watermark, given by a key, and the watermarked object. Most of the approaches suggested for watermarking graphical objects assume the knowledge of the original un-watermarked object [8, 9]. Evidently, the knowledge of both the original and watermarked objects provides a good basis for detecting the watermark. However, in many applications such an approach is not suitable, particularly in a public key system where we would like to detect the watermark without having the knowledge of the actual original object. In the following we describe a blind approach in which no a priori knowledge about the original object is required in the detection stage. 3. SELECTING THE LOCATION FOR EMBEDDING THE WATERMARK The proposed algorithm embeds a watermark by altering the location of certain vertices. The 3D watermark embedding algorithm has two stages. In the first stage the algorithm identifies the locations which are suitable for embedding the watermark. Such locations are chosen based on the human perceptibility of the modifications brought by the watermark to the 3D object. The second stage consists of the actual object geometry alteration. We suggest a geometrical criterion for selecting the location where to embed the watermark. If we consider , a vertex whose 3D coordinates are given by the vector , from the 3D model , we define its neighbourhood as all the vertices connected to it :
!#"$" % !"'&)(*
(1)
where " " denotes set cardinality and counts the set of points on the line segment joining the two vertices, but excluding the end-points, while denotes the total number of vertices from the neighbourhood . The point is not considered as being part of its own neighbourhood. We derive the ellipsoid which
roughly models the neighbourhood of soid is given by : -
. The center of this ellip-
/. 02143 576 8
+ ,
(2)
while the shape of the ellipsoid can be calculated as the second order moment (variance) of the same set of locations :
9
+ > 8 ; = < < + > @? /. 021:3/5 6
,
(3)
We have to exclude9 the neighbourhoods where we have a singu may happen when all the lar singular matrix . Such situations vertices from the neighbourhood are located in the same plane. The ellipsoid which locally describes the vertices in the neighbourhood of forms a bounding volume which is modelled BA BA by : 9CED + < ? < + FHG (4) A
where 9 is a vector located inside the bounding volume described + by and characterising , and G is a normalization factor. The watermark is embedded in the regions where it is not likely to be easily identified. One criteria which can be considered to select such regions employs the local mesh variation. We consider that the local mesh is significantly modified when we modify vertices representing terminal points of long line-segments. We calculate the distance from a vertex to its neighbourhood as : I O
O
J
O O K /P ; 3 L/. 0M143 5N6
(5)
where represents the length of the line-segment joining and its neighbour . We order all the vertices I in the object according to the distances to their neighbourhood and we consider a certain visibility threshold Q . We select those vertices which have the distance to their neighbourhood smaller than a threshold Q : I (6) FRSQ The threshold Q can be chosen based on a perceptibility criterion which takes into account the complexity of the object to be watermarked and the total number of bits to be embedded. The complexI ity of the object can be measured as the averaging of distances
from all the vertices forming the object to their neighbourhoods. All neighbouring vertices ) are excluded from the set of possible candidates for embedding the watermark. Let us assume that we have a total of TVU sites fulfilling the condition (6). We can easily observe 9 that any change in does not influence the bounding ellipsoid and its center + . Let us consider that we have an watermark code of W bits. The chosen vertices are split in sets of W vertices. The vertices from each set are ranked with respect to the distance between the neighbouring ellipsoids’ centers. Such a distance is measured as :
X
` J C D O + a + Ogf HY%Z![]\M ^:_ K < a b Ddc ab e
(7)
where we consider only the closest W ? < + 7 R)G
(11)
O O O O O < + < + < <
(12)
This procedure is exemplified in Figure 1. A bit is embedded by moving the vertex outside this ellipsoid. No change is per is already located according the given relaformed if the vertex tionship ( or / . The algorithm enforces that geometrical changes produced by (10) and (11) do not modify the order selection of the vertices. This can be ensured by an iterative algorithm
which performs alternatively the two stages, selection of the vertices and embedding, respectively. The algorithm terminates when each bit is embedded in the corresponding vertex from the ordered array of vertices. After embedding all W bits we proceed to embed next W bits, preferably in a different region of the graphical object. Vi
^
Vi µi
Si
Fig. 1. Embedding a 1 bit in the vertex
.
In the detection stage we select the chain of marked vertices and their neighbourhoods as it was explained in Section 3 for the embedding stage. For the chosen vertices and their neighbourhoods we verify the relationship (10) when embedding using bounding volumes delimited by planes or (11) when we consider bounding ellipsoids. A sequence of bits is retrieved from the graphical object when checking the geometrical relations (10) or (11). Eventually, a XOR operation is calculated between the resulting set of bits and the watermark code [4]. The result of the operation shows the number of bit errors and a decision is taken based on an acceptable minimal bit error. 5. EXPERIMENTAL RESULTS We have applied the proposed watermarking algorithm on several 3D objects representing computer graphics characters and industrial models. In the following we present the results when applying the watermarking algorithm on two objects. The first represents a dog and has 649 vertices and 1286 faces. Its frontal view is shown in the left part of Figure 1a while its back view is displayed in the left part of Figure 1b. The watermarked “dog” model using bounding planes for embedding the watermark according to (10) is shown in the right part of the views from Figure 1. In Figure 2 we display the graphical model of a screwdriver which has been watermarked using ellipsoids as bounding boxes as in equation (11). The original is at top and the watermarked object at the bottom of Figure 2. This graphical object has 2060 vertices and 4076 sides. There are 54 vertices where we can embed watermarks according to (6) for the “dog” and 43 possible bit holder vertices for the “screwdriver.” The length of the watermark was considered as W %( in these examples. In order to measure the distortion brought to the object by watermarking we evaluate the mean square error (MSE) between the vertices composing the original and the watermarked object, respectively. MSE can be written as :
T T
K
b D
O
<
O f
(13)
where T is the total number of vertices which make up the graphC"! ical object. The MSE for the “dog” is ' ( while for the C& “screwdriver” is #' $ % ( . Hardly any differences can be observed between the watermarked and the original graphical objects. The watermark was embedded in the object and successfully
recovered when no attack was considered. Due to the geometrical nature of the watermarking algorithm, the watermark can be recovered after scaling, rotation or combinations of geometrical transformations. In the case of a graphical object which contains many vertices it is easier to find several bit-holder vertices in its structure such that no distortions can be observed after embedding the watermark.
Fig. 3. Graphical model of a screwdriver where top represents the original and bottom the watermarked object. of local geometrical changes of the selected vertices according to the geometry of their neighbourhoods. Two different bounding volumes are considered for embedding the code: using separation planes and ellipsoids. A bit is embedded by moving the selected vertex inside the bounding volume while a bit is embedded by moving the vertex outside the bounding volume, ensuring also a minimal distortion in the resulting watermarked model. The watermark algorithm has been applied to both graphical objects and to 3D models of mechanical objects. Additional tests must be performed for assessing the robustness to noise corruption or polygon reduction. A potential area of application for the proposed watermarking algorithm is for watermarking 3D models extracted from volumetric images.
(a) Frontal part of a graphical object representing a dog
(b) Back part of a graphical object representing a dog Fig. 2. The graphical model from left is the original, while that from right represents the watermarked object.
6. CONCLUSIONS In this paper we have presented a public digital watermark algorithm for 3D models and graphical objects. The proposed watermarking algorithm does not require the original object in the detection stage. Using a key we generate a binary code. A set of vertices and their neighbourhoods are selected and ordered according to a minimal distortion visibility threshold. The embedding consists
7. REFERENCES [1] F. Hartung and M. Kutter, “Multimedia watermarking techniques,” Proceedings of the IEEE, vol. 87, no. 7, pp. 1079– 1107, July 1999. [2] F. Petitcolas FAP, R. Anderson, and M. Kuhn, “Information hiding - a survey,” Proceedings of the IEEE, vol. 87, no. 7, pp. 1062–1078, July 1999. [3] G. Voyatzis and I. Pitas, “The use of watermarks in the protection of digital multimedia products,” Proceedings of the IEEE, vol. 87, no. 7, pp. 1197–1207, July 1999. [4] C.D. Coltman and A.G. Bors, “Hierarchical watermarking depending on local constraints,” in Proc. of IEEE Inter. Conf. on Image Proc., vol. III, Thessaloniki, Greece, 7-10 Oct 2001, pp. 1011–1014. [5] A.G. Bors and I. Pitas, “Image watermarking using DCT domain constraints,” in Proc. of IEEE Inter. Conf. on Image Proc., vol. II, Laussane, Switzerland, 16-19 Sep 1996, pp. 231–234. [6] B.-L. Yeo and M.M. Yeung, “Watermarking 3D objects for verification,” IEEE Computer Graphics and Applications, vol. 19, no. 1, pp. 36–45, 1999. [7] C. Fornaro and A. Sanna, “Private key watermarking for authentication of CSG models,” Computer-Aided Design, vol. 32, pp. 727–735, 2000. [8] O. Benedens, “Geometry based watermarking of 3D models,” IEEE Computer Graphics and Applications, vol. 19, no. 1, pp. 46–55, 1999. [9] R. Ohbuchi, S. Takahashi, T. Miyazawa, and A. Mukaiyama, “Watermarking 3D polygonal meshes in the mesh spectral domain,” in Proc. of Graphics Interface, Ottawa, Canada, June 2001, pp. 9–17.
