WATERMARKING WITH KNOWLEDGE OF HOSTS ... - CiteSeerX

WATERMARKING WITH KNOWLEDGE OF HOSTS DATABASE Sujoy Roy and Ee-Chien Chang School of Computing National University of Singapore {sujoy, changec}@comp.nus.edu.sg

ABSTRACT We study how to watermark a set of randomly chosen hosts effectively and efficiently. Unlike most formulations, where the watermark or code book are decided before the hosts arrive, in our formulation, the set of hosts to be watermarked are known, either in a static or dynamic setting. The goal of this paper is to study how the additional a-prior knowledge of database could be exploited for better watermarking performance. In the dynamic setting, the host database starts from a single host and grows as more hosts arrive, and thus the watermarking keys are updated frequently. This setting can be applied to applications where the detector has access to the Internet. Interestingly, under the new formulation, the requirements on false-alarm, robustness and distortion can be traded-off with the computational efficiency of the watermark detector. To demonstrate the main idea, we extend a variant of spread-spectrum method to a few schemes under the proposed settings, and compare their performance. Our analysis and experiments show promising improvement in performance by exploiting the a-prior knowledge of hosts database. Similar idea can be incorporated to other watermarking methods. 1. INTRODUCTION A watermarking scheme consists of an encoder and detector. The encoder takes a host sequence I and gives the en˜ such that the distortion from I to I˜ is small. The coded I, detector takes a sequence and declares whether it is watermarked. The scheme should be robust in the sense that even under corruption by noise, the encoded I˜ is still declared to be watermarked. Furthermore, the false alarm should be low in the sense that the probability of a randomly chosen sequence to be declared as watermarked is extremely low. A survey on current watermarking techniques can be found in [1]. In the theoretical models studied by a number of researchers, for example [2, 3, 4], the watermarking schemes know the distribution of the host and noise, which are usually taken as Gaussian. In this paper, in addition to the aprior knowledge of host and noise distribution, the encoder

also knows the set of hosts (database) to be watermarked, either in a static or dynamic manner. On the other hand, the detector does not have access to the whole host database. Instead, it knows a set of keys, which can be viewed as a compact description of the database. Note the differences of our formulation from that on blind verse informed watermarking [1]. We study two settings. In the static setting, the database remains unchanged throughout the embedding and detection process. In this setting, the encoder knows the database before any encoding is performed. The keys, once determined, remain unchanged throughout the process. A possible but inefficient scheme takes the whole database as the keys. In this scheme, nothing is to be done during encoding and thus achieving zero distortion. To decide whether an image is watermarked, the detector searches for the image in question in the database. Although this scheme achieves zero distortion, the key size is too large and thus infeasible. So, an interesting issue is on the trade-off of the efficiency (key’s size) and the performance (distortion, false alarm and robustness). In the dynamic setting, new hosts can be added to the database. The database starts from a single host, and grows as new hosts arrive. The encoding must be done in a “online” manner, that is, when a new host I arrives, the encoder must immediately encode I before the arrival of the next host. Furthermore, previously encoded hosts can not be modified. The keys must be backward compatible, in the sense that the newer keys must be able to detect hosts that arrives earlier. This setting can be applied to situations where the detectors have access to the Internet. For example, a watermarking service provider could keep a dynamic database of images. The detector, with the accessibility of the Internet, can contact the server and retrieve the updated keys. Besides the usual tradeoff between robustness, distortion and false alarm, interestingly, in our formulation, computational efficiency (measured by the key size) also play an important role. Another interesting fundamental issue is on how performance degrades in the dynamic setting compared to the static setting. This issue is closely related with

3.1. Static

the studies of online algorithms[5].

2. FORMULATION Let I = {I1 , I2 , . . . , Im } be a database of m hosts. Each host is a sequence of n coefficients which is generated from a Gaussian source, specifically, n i.i.d. random variables where each is normally distributed with zero mean and variance 1/n. For completeness and clarity, we now give a formal description of false alarm, robustness and distortion. A watermark encoder takes each I ∈ I and gives an ˜ We call the average `-2 distance encoded sequence I. 1 X ˜ 22 kI − Ik m I∈I

the distortion. The false alarm is the probability of a randomly chosen sequence (from the host distribution) is declared as watermarked by the detector. The scheme is robust if, under the influence of additive white Gaussian noise, an encoded host is still declared to be watermarked with high probability (the actual probability is not a concern in this paper). We take the variance of the noise as the measure of robustness. For the purpose of comparison, in the next few sections, we consider a variant of the well-known spread-spectrum method. However, our idea is not restricted to this method. Similar idea of exploiting the a-prior knowledge of host database can be extended to other methods. This variant of spread-spectrum method is parameterized by a watermark key w, a constant threshold T and a constant K. The encoding of I giving I˜ is achieved by I˜ = I + max(0, K − I · w)w

(1)

The scaling factor max(0, K − I · w) is an adjustment so that the encoded I˜ satisfying I˜ · w ≥ K. The w is chosen independently from the database and is normalized so that kwk22 = 1. An image I is declared to be watermarked if w · I ≥ T.

(2)

The false alarm, robustness and distortion of this scheme can be obtained analytically.

3. WATERMARKING SCHEMES In the next few sections, we give and analyze schemes for each setting. We compare the performance with the spreadspectrum method, which can be viewed as an equivalent scheme with no knowledge of the host database.

This section gives two schemes. Both schemes are parameterized by two constants K and T . The encoder of the first scheme computes the normalized sum of the database, that is, X X w= I/k Ik22 , (3) I∈I

I∈I

and takes this as the key. The encoding and detection is same as the spread spectrum method given in (1) and (2). Unlike the spread spectrum method where the key is randomly chosen, in this scheme, w is computed from the host database. Note that the false alarm and robustness can be similarly determined as in the spread spectrum method. Moreover, if both parameters K and T are the same as in the spread spectrum method, then the false alarm and robustness of this scheme are the same as that of the spread spectrum method. Now, by fixing K and T , we want to know which scheme provides lower distortion. To illustrate the reduction in distortion, let us define the baseline B as the average of I · w among the hosts in the database, 1 X B= I · w. m I∈I

The baseline is a good indicator of the reduction in distortion. Note that if w is randomly chosen, then the baseline is expected to be 0. In our scheme, the expected baseline is non-zero. Consider any I ∈ I, the expected value for I · w is r 1 1 I · (I + I1 + I2 + . . .) = E(I · w) = P , 2 k I∈I Ik2 m √ and thus the expected value for baseline is 1/ m. Figure 1 shows the result of an experiment, confirming the gain in performance of using w obtained from (3) against a randomly chosen key. In this experiment, we fix the robustness and false-alarm (that is K and T ), and compare the reduction of distortion. The second encoder in this section further improves the performance by searching for the key w ˜ which minimize the distortion, X max(0, K − I · w). ˜ I∈I

Note that in Figure 1, no significant improvement is achieved by the second encoder. Probably this is because the average (3) is closes to the optimal for Gaussian hosts. We believe that the gain by the iterative method will be significant for some non-Gaussian host distribution.

0.025

Spread Sprectrum

DISTORTION

0.02

0.015

Dynamic Dynamic (2 Key)

0.01

Static Static (Iterative) 0.005

0

Static (2 Key)

0

5

10

15

20

25

30

x e−02

hand, the false alarm will increase by a factor of approximately 2. This is because in the 2-key situation, a sequence I is declared to be watermarked if either I · w1 ≥ T or I · w2 ≥ T . However, note that constant factor growth of the false alarm is insignificant, because the false alarm decreases exponentially as the threshold T increases linearly. Thus, it is desirable to allow more keys, if efficiency is not a consideration. The second encoder searches for a good partition of the the database to minimize distortion. The partition into two subsets H1 and H2 is done as follow: 1. Initially, each H1 and H2 contain one host. Let w1 and w2 be the respective key computed using (3).

m/N

Fig. 1. Distortion verse (m/n). The number of coefficients is fixed at n = 1000, and K = 0.1414. For the 2-key settings, the size of the database is twice of that for the single key settings. For example, at m/n = 0.2, the number of hosts is 200 for the single key setting, and 400 for the 2-key setting.

2. For each host I in I, if I · w1 < I · w2 , add I into H1 and update the key. Similar operations are performed if I · w1 ≥ I · w2 . Our experimental results show that the above simple partition gives an improvement in distortion compares to the first encoder who randomly partition the database. Note that in Figure 1, the graph for static 1-key setting can be treated as the performance of the first encoder.

3.2. Static with multiple keys In this scheme, instead of using a single key, the detector uses a set of keys W = {w1 , w2 , . . . , wk }. A image I is declared to be watermarked if there is a i such that wi · I > T. More keys are desirable for a few reasons. Firstly, with more keys, the distortion decreases. Recall that the performance of the encoders in the static setting degrade as the size m increases. By having more keys, we can divide the database into smaller groups and essentially decrease the size m. Secondly, in the dynamic setting, some encoders might assume the total number of hosts is fixed (this is also known as closed-end in the studies of on-line algorithm). One way of overcoming this limitation is to allow more keys when more than expected number of hosts arrive. On the other hand, more keys requires more computing and network resources. If W is to be sent to the detector via the network, then larger network bandwidth is required for larger W . Furthermore, the detector is required to compute the inner product for each key. Note also that larger k increases the false alarm. We now give two encoders. We will describe the case where k = 2. Other values for k can be easily generalized. The first encoder randomly partitions the database into two subsets of equal size. The key for each subset is generated using (3) by treating each subset as a single database. It is easy to verify √ that the baseline will be improved by a factor of 1/ 2 and thus implies the distortion will be improved by approximately the same factor. On the other

3.3. Dynamic with single key In the dynamic setting, the hosts arrive sequentially. Let the order of arrival be I1 , I1 , I2 , . . . , Im . Let wj be the key computed after the arrival of Ij . The encoding and detection is similarly performed as in (1) and (2). The additional requirement in the dynamic setting is backward compatibility. That is, for any t < j, I˜t · wj ≥ K,

(4)

where I˜t is the encoded sequence for It . There are two interesting issues. The first issue concerns on how backward compatibility is to be enforced. It is also interesting to study the reduction in performance when information is available in the on-line manner, as opposes to the static setting where full knowledge of the database is readily available. We now give an iterative method which searches for a key that satisfies (4). On arrival of the t−th host It , our scheme computes the new key as follow: √ 1. Let wt = wt−1 + (1/ t)It . 2. If there is a r < t such that Ir · w0 < K, then update wt = wt + (K − Ir · w0 )Ir . 3. Repeat step 2 until no such r is found. In our implementation, step 3 halts after some constant number of loops.

3.4. Dynamic with multiple key In this setting, more keys are allowed as is in the static setting (Section 3.2). The encoder employs a combination of the encoders in the dynamic setting and 2-key static setting. That is, on arrival of a new host I, it computes I · w1 and I ·w2 to decide which subset it belongs to. Next, the encoder uses the iterative method to ensure backward compatibility. The graph in Figure 1 shows that this encoder performs better than a 2-key encoder who partitions the database randomly. 4. EXPERIMENT WITH IMAGE DATABASE We conducted an experiment on a database of 100 natural images downloaded from various web-sites. Each image is rescaled to 256 by 256 gray-scaled pixels. Figure 2 shows 3 of these images. This main goal of this experiment is to test our idea on non-Gaussian host distribution. Hence, we do not consider geometric distortion and issues in synchronization. We tested our database using the static single key encoder. The computed key is shown in Figure 3. The average distortion is 0.41233, which is better than the estimated distortion of 1.0946 if we assume the hosts are Gaussian. The improvement is probably due to strong coherence among the images in the database, for example the images in Figure 2.

Fig. 3. Computed watermark. 5. CONCLUSION AND FUTURE WORKS In this paper, we propose a few watermarking models which exploit the a-prior knowledge of hosts database. Such models are realistic because in some applications, the detector has access to the Internet. We also give a few schemes for various settings and analyze their performance based on the assumptions that the host and noise are Gaussian. We also test our main idea on non-Gaussian hosts, which is a set of natural images. Our experiment and analysis show promising improvement in performance by using a-prior knowledge of the host database. Similar idea can be incorporated into other watermarking methods. 6. REFERENCES [1] I.J. Cox, M.L. Miller, and J.A. Bloom, Digital Watermarking, Morgan Kaufmann, 2002. [2] M. Costa, “Writing on dirty paper,” IEEE Trans. on Information Theory, vol. 29, no. 3, pp. 439–441, 1983. [3] W. Zeng and B. Liu, “A statistical watermark detection technique without using original images for resolving rightful ownerships of digital images,” IEEE Trans. on Image Processing, vol. 8, no. 11, pp. 1534–1548, 1999. [4] B. Chen and G. Wornell, “An information-theoretic approach to the design of robust digital watermarking systems,” IEEE International Conference on Acoustics, Speech and Signal Processing, vol. 4, pp. 2061–2064, 1999.

Fig. 2. Three images in the database with the respective encoded images on their right.

[5] P.W. Shor, “The average-case analysis of some on-line algorithms for bin-packing problems,” Combinatorica, vol. 6, no. 2, pp. 179–200, 1986.