principles of digital watermarking ingemar j. cox, matt l. miller, and jeffrey a bloom

Principles of Digital Watermarking

Ingemar J. Cox, Matt L. Miller, and Jeffrey A Bloom

UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Course outline

Part 1: Introduction and Applications

Part 2: Basic Algorithms and Concepts

Part 3: Advanced Watermarking

Course outline

Part 1: Definitions and Applications

UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Definitions and Applications: Outline

Definitions of watermarking

Properties of watermarking systems

Watermarking applications

Conclusions

Definitions and Applications

Definitions of watermarking


Without common definitions, various approaches and technologies cannot be compared.

UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Definitions of watermarking: Our definition


Watermarking is the practice of unobtrusively modifying a work of art (image, song, software

program, geometric model, etc.) to embed a message about that work.

Multimedia watermarking is the practice of imperceptibly altering a work (image, song, etc.)

to embed a message about that work.

UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Definitions of watermarking: Basic design of a system

Originalwork

Message(regarding

work)

Watermarkembedder

Watermarkedwork

(looks likeoriginal)

Watermarkdetector

Detectedmessage


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Definitions of watermarking: Other definitions

Imperceptibility is not always considered essential (allows for visible watermarking).

Sometimes more broadly defined as any data hiding (i.e. hidden data need not relate to work).

Sometimes more narrowly defined as owner identification (watermarks must indicate identity of owner).


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Definitions of watermarking: Related terms

Data hiding: any technology for preventing adversaries from perceiving or finding data.

Steganography: keeping the existence of messages secret by hiding them within objects, media, or other messages.


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Definitions of watermarking: Related terms

Watermarking is the practice of unobtrusively modifying a work of art (image, song, software program, geometric model, etc.) to embed a

message about that work.

Steganography is the practice of undetectably modifying a work to embed a message.

UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Original

Undetectable

Unobtrusive

Properties of systems

Understanding, comparing, and selecting watermarking approaches or technologies takes place in the context of system properties.


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

List of properties to be discussed Embedding effectiveness

Fidelity

Data payload

Blind vs. informed detection

False positive rate

Robustness

SecurityDefinitions and Applications

UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

A note before we begin …

When we say “random work”, we mean a work drawn from an application-dependent distribution of works. Examples: x-rays, animation, natural image, classical music, speech, etc.

When we say “random watermark”, we mean a watermark message drawn from the set of possible messages.


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Embedding effectiveness

A system’s embedding effectiveness is theprobability it will succeed in embeddinga random watermark in a random work.

Randomwork

Randommessage

Watermarkembedder

Watermarkdetector

MessageMessagedetecteddetectedcorrectly?correctly?


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Embedding effectiveness

Why might embedding effectiveness be less than 100 percent? In some cases, it is not possible to embed required

amount of information imperceptibly. Actual implementations usually involve some

round-off and truncation before watermarked work is stored, which sometimes make watermark undetectable.


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Properties of systems: Fidelity

A system’s fidelity is the perceptual similaritybetween marked and unmarked works.

Randomwork

Randommessage

Watermarkembedder

Watermarkedwork

Humanobserver

worksworksappearappear

sufficientlysufficientlysimilar?similar?


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Properties of systems: Data payload

A system’s data payload is the amount ofinformation that it can embed in asingle work.

Randomwork

Watermarkembedder

Watermarkedwork

Random message


01101001…01101001…

UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Blind vs. informed detection

An informed detector requires someinformation about the original, unwatermarkedwork. A blind detector does not.

Originalwork

Message Watermarkembedder

Watermarkdetector

Required byRequired byinformed detectorinformed detector


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Properties of systems: False positive rate

A system’s false positive rate is thefrequency with which it is expected to detectwatermarks in unwatermarked works.

Random,unwatermarked

work

Watermarkdetector

WatermarkWatermarkdetected?detected?


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Properties of systems: False negative rate

A system’s false negative rate is thefrequency with which it is expected to NOT detectwatermarks in watermarked works.

Random,watermarked

work

Watermarkdetector

WatermarkWatermarkdetected?detected?


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Properties of systems: Robustness

A watermark’s robustness is its ability tosurvive normal processing (e.g. lossycompression, noise reduction, etc.).

Randomwork

Randommessage

Watermarkembedder

WatermarkdetectorNormal

processing



UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Properties of systems: Security

A watermark’s security is its ability toresist hostile attacks, specifically designedto defeat the purpose of the watermark.

Types of attacks Unauthorized embedding (forgery) Unauthorized detection Unauthorized removal


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Security – unauthorized embedding

Randomwork

Forgedmessage

Watermarkdetector

Forged Forged MessageMessagedetecteddetected

WatermarkedworkUnauthorized

embedding by an adversary


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Security – unauthorized removal

Randomwork

Randommessage

Watermarkembedder

WatermarkdetectorHostile

processing by an adversary



UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Security – unauthorized detection


OriginalWork

Message Watermarkembedder

AdversaryAdversarycan detectcan detectmessage?message?

Attempt atdetection by

adversary

Watermarking applications

Watermarking may be appropriate for applications in which data about a work must be imperceptibly embedded. Different applications place different requirements on system properties.


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

List of examples discussed

Broadcast Monitoring

Owner Identification

Proof of Ownership

Transaction Tracking

Content Authentication

Copy Control


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Broadcast monitoring

Watermarkembedder

Watermarkdetector

Broadcasting system

Content wasContent wasbroadcast!broadcast!

Originalcontent


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Broadcast monitoring

Verify advertising broadcasts (1997 scandal in Japan)

Verify royalty payments ($1000 of unpaid royalties to actors per hour of broadcast)

Catch instances of piracy

Monitor when and whether content is transmitted over broadcast channels, such as television or radio


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Owner identification

Originalwork

Distributedcopy

Watermarkdetector

Alice isAlice isowner!owner!

Watermarkembedder

Alice


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus Help honest people identify rightful owner

Notify people of copyright In US, until 1988, such notice was required to

retain copyright Since 1988, presence of notice increases possible

reward in lawsuits


Watermark identifies owner of copyright, similar to a copyright notice


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus


The problem with text: this well-known image …


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus


… is a pirated part of a larger image.


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Proof of ownership

Originalwork

Distributedcopy

Watermarkdetector


Watermarkembedder

Alice

BobDefinitions and Applications

UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Proof of ownership

Differs from owner identification in two ways Intended to carry burden of proof Watermark need not be detectable by anyone

other than owner (allows informed detection)

Watermark is used to prove ownership in a court of law


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Transaction tracking

Originalwork

HonestBob

Watermarkdetector

B:Evil BobB:Evil Bobdid it!did it!

Watermark A

EvilBob

Unauthorizedusage

Watermark B

Alice


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus


Identifying pirates (DiVX corporation)

Identifying information leaks (M. Thatcher, movie dailies)

Watermarks record transaction histories of content, typically identifying first authorized recipient


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus


The MPAA estimates that piracy costs the US film industry $3B per year

One source of material is the annual distribution of Oscar screeners to the 5,803 voting members of the Academy

UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus


Thomson system enabled the MPAA to distribute individually-watermarked VHS and DVD screeners to its 5,803 eligible voting members

Screeners appeared on the internet The Last Samurai Something's Gotta Give Mystic River

Actor Carmine Caridi expelled from MPAA

UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Content authentication

Watermark embedder

Watermark detector


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Content authentication

Exact authentication: work is inauthentic if even one bit has changed

Selective authentication: work is inauthentic only if significantly changed

Tell-tale watermarks/localization: identify what changes have been made

Watermark is used to detect modifications applied to cover work


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Copy control

Record control: recording devices contain detectors and refuse to record copyrighted material

Playback control: players contain detectors and refuse to play pirated material

Watermarks indicate whether content may be copied


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Copy controlCompliantrecorder

CompliantplayerLegal copy

Illegal copy

Playback control

Record control


Non-compliantrecorder

Conclusions


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Conclusions: Stuff not covered

Erasability (whether watermark can be perfectly removed)

Cipher and watermark keys

Modification and multiple watermarks

Cost

UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Conclusions: Take Away

Watermarking may be appropriate for applications in which data about a work must be imperceptibly embedded.

Different applications place different requirements on system properties.

UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus


Key properties include Embedding effectiveness Fidelity Data payload Blind vs. informed detection False positive rate Robustness Security

UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Digression: The politics of DRM

Why does Hollywood care about piracy? Loss in revenue

But some level of piracy actually stimulates sales

Evidence that peer-to-peer file sharing affects sales is mixed But has been used to control the evolution of the digital

market

UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Digression: The politics of DRM

Why do computer and consumer electronics companies care about DRM?

Need content owners to provide content in new digital formats

Conflict of interests Customers don’t want DRM Legal and business contracts impose DRM

UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Course outline



Part 3: Informed Watermarking

Course outline

UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Basic Algorithms and Concepts: Outline

Algorithmic building blocks

Robustness issues

Security issues

Conclusions

Algorithmic building blocksOver the past 5 to 10 years of research, several ideas have emerged as basic building blocks of watermarking systems.

UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

A simple watermark embedder

Given … Watermark pattern, w Cover image co

Embedding strength

Compute watermarked image, cw, as

wcc ow α

Basic Algorithms and Concepts

UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

A watermarked version of this …


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

…looks like this


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Informed detection

Given Possibly watermarked image c Original cover image co

Subtract original to obtain watermark pattern (if present)

present is watermarkif αwccw on


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Linear correlation test

Use linear correlation to determine whether

Linear correlation defined as

If c = co + n, then zlc(wn,w) 0

If c = co + w + n, then zlc(wn,w) zlc(w,w)

wwn α

yxyxNN

zyx

, ,11

,,

lc wwwwww nnn


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Blind detection

If w is chosen so that zlc(co,w) is likely to be close to 0, then zlc (c,w) zlc(wn,w).

No need to subtract out co before computing linear correlation.

White noise pattern tends to have low-magnitude correlation with any image.


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Interpreting system geometrically

Media space – a high-dimensional space in which each point corresponds to a work. 256 256 grayscale image 65,536 dimensions

(one for each pixel). 5 second mono audio clip, sampled at 44,100Hz

220,500 dimensions (one for each sample)


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

2d pictures of media space

Several possible interpretations Abstraction of high-dimensional space (just pretend

media space is really 2d) Projection of media space Slice of media space


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Picture of media space


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Algorithmic building blocks: Watermark in media space


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Geometric interpretation of zlc()

zlc(c,w) is just dot product of c and w divided by N

Dot product of c and w is cosine of angle between them, times their magnitudes

If |w| = 1, then dot product is projection of c onto direction of w

Comparing zlc(c,w) against a threshold leads to detection region with planar boundary


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Geometric interpretation of zlc()


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Now that we have a basic system …

… let’s consider a problem: What happens when we change the contrast of the image?

cwn = cw , where is some scalar value

zlc(cwn,w) zlc(cw,w)

If < 1, detection value might drop below threshold


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Solution: normalized correlation

Normalize correlation by magnitudes of vectors

Scaling has no effect on znc(c,w)

wc

wcwc

,ncz

wcwc

wcwc ,

, ncnc zz


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Geometric interpretation of znc()

znc(c,w) correlation is just cosine of angle between c and w

Comparing znc(c,w) against a threshold is equivalent to comparing angle against a threshold

Result: detection region with conical boundary


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Geometric interpretation of znc()

acos( znc(c,w) )

w

c


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Another problem

What happens if the image is spatially shifted a little?

Detection value will depend on autocorrelation function of watermark pattern.

White noise pattern has close to zero autocorrelation.

Watermark is unlikely to be detected.


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Possible solution

Watermark Fourier-magnitude instead of pixel values

Fourier-magnitudes are invariant to translation


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Possible solution

To embed Take FFT of image and compute magnitudes Add w to magnitudes Scale FFT coefficients of image to new magnitudes

and take inverse FFT

To detect Take FFT of image and compute magnitudes Compute normalized correlation between

magnitudes and w


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Watermark extraction

We can view the preceding system as comprising two basic parts A watermark extraction process that maps points in

media space to points in some marking space (Fourier-magnitude space, in this case)

A simple watermarking system that operates in marking space


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Reasons for watermark extraction

Increase robustness Project into distortion invariant space Invert distortions Reduce noise

Reduce computational cost

Increase security Key-based extraction


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

“Transform domain” watermarking

Many authors categorize watermarking systems by transforms included in their extraction processes, e.g. … “Spatial-domain watermarking” (no transform) “DCT-domain watermarking” “Wavelet-domain watermarking” Etc.

But …


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

“Transform domain” watermarking

… the transform alone says little about how the system works If T is a linear, energy-preserving transform, then

zlc( T(c),w ) = zlc( c,T-1(w) ) Thus a linear-correlation-based system in domain

T is the same as a spatial-domain system with a different watermark pattern

It is the nonlinearities in the extraction process that distinguish a system’s behavior


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Perceptual shaping

Basic idea: amplify watermark in areas where the cover work can mask noise

w

co

cw

Perceptualmodel


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Image before embedding


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Without perceptual shaping


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

With perceptual shaping


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Early approach: invert shaping in detector (shown here for informed detector)

Detection after perceptual shaping

c

co

wn

Perceptualmodel


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Detection after perceptual shaping

Not necessary to invert perceptual shaping Distortion of watermark pattern degrades detection

value for given watermark scaling value, , but … … possible to use larger value of because

pattern is better hidden


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Geometric view of perceptual shaping

Region ofacceptable

fidelity Shapedwatermark

vector

Original(unshaped)watermark

vector


Robustness IssuesThe robustness of a watermark is its ability to survive normal processing.

UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Watermarked image is corrupted by additive noise

Linear Correlation

Linear Correlation (matched filtering) is optimal when noise is AWGN.

Additive Noise

ncc wwn

nwcwcwz wwnlc ,


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Watermarked image is subjected to a change in contrast

Linear Correlation

For < 1, this scaling decreases the detection value.

How can we select a threshold?

Valumetric Scaling

wwn cc

wwnlc cwcwz ,


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Valumetric Scaling

wn

wn

c

c

Unit Sphere

w

w

Normalized Correlation

Independent of vector magnitude

Describes the cosine of the angle between the vectors

-1 znc +1


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Quantization

Transform

Quantization

EntropyCoding

uncompressedwork

compressedwork

Quantization noise cannot be modeled as additive white noise

There are current efforts to model quantization noise

Eggers and Girod

Appendix B.5

Canonical TransformCoder Basic Algorithms and Concepts

UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Synchronization

Geometric distortion in imagery translation, rotation, zoom, aspect

ratio, skew, perspective distortion, warp

Temporal distortion in audio time delay, time scaling

Video can suffer from both geometric and temporal misalignments

Noise due to synchronization errors is not well modeled as additive white noise.


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Synchronization Approaches

Exhaustive Search Detection applied at all possible

temporal/geometric distortions Negative impact on false positive probability Usually requires too much computation


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus


Synchronization Synchronization pattern is embedded along

with the payload-carrying pattern. Registration to synchronization pattern prior to

detection. Negative impact on fidelity and security


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus


Implicit Synchronization Watermark location in time or space is relative

to extracted features Example: audio reference pattern added

between salient points


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus


Invariance Design patterns that are invariant to

desynchronization Example: Use of Fourier magnitude in

watermark extraction process for shift invariance


Security IssuesThe security of a watermark is its ability to resist hostile attacks specifically designed to defeat the purpose of the watermark.

UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Robustness

Security against unauthorized removal requires robustness to any process that maintains fidelity Desynchronization Attacks Noise Removal Attacks


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Mosaic Attack

Image is broken into many small rectangular patches

Each patch is too small for reliable detection

Patches are displayed in a table such that patch edges are adjacent


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Collusion Attacks

Many different works, same watermark

Many different watermarks, same work

Simple example: averaging Average of many different works gives an estimate

of the watermark Average of many copies of the same work reduces

the strength of each watermark

212121

2

1

2

1

2

1

2wwcwcwc

ccooo

ww


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Copy Attack

Watermark is “copied” from one work to another

Unauthorized Embedding

Example: apply a watermark removal attack to obtain an estimate of the watermark, add to fake.


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Ambiguity Attack

Create the appearance that a watermark has been added to someone else’s work

Example: define fake watermark pattern and subtract from the distributed image. This is the fake “original.” Difference between distributed and Bob’s original

contains Bob’s watermark Difference between distributed and Alice’s original

contains Alice’s watermark


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pusAlice’s

original(real)

Bob’s“original”

(fake)

Alice’sdetector

Bob’sdetector


Bob isBob isowner!owner!

Distributedcopy

Alice

Bob

Ambiguity Attack


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Solution to ambiguity attack: Alice uses system that cannot be hacked May be possible to implement by making

watermark dependent on cryptographic hash of original work

Strictly-speaking, provides proof of ancestry, rather than proof of ownership

Ambiguity Attack


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Sensitivity Analysis

Technique for removing watermark when adversary has black box detector

Estimate the normal to the detection region surface boundary at some point

Assume that this normal indicates a short path out of the detection region


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Sensitivity Analysis

w

Detection region

watermarkedwork

work A

attackedwork

1 Find a work that lies on the detection boundary

2 Approximate the normal to the detection boundary

3 Scale and add the normal to the watermarked work


Conclusions


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Conclusions: Major stuff not covered

Message-coding for multi-bit watermarks

Non correlation-based watermarking “Constraint-based” watermarking (can usually

be recast as correlation-based) Quantization-based watermarking (will be

covered in part 3)

Authentication methods

ROC Curves


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus


Linear correlation (matched filtering) is optimal for detecting a signal in AWGN

Most processing is not well modeled as AWGN

Normalized correlation provides robustness to amplitude changes

Helpful to think of a work as a point in a high dimensional space


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus


Watermark extraction: project a work to another space for embedding and/or detection

Perceptual modeling can improve fidelity and allow for stronger embedding

Robustness to desynchronization is an difficult problem

Collusion attacks and sensitivity analysis are significant security challenges


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Outline



Part 3: Informed Watermarking

Part 3: Informed watermarking

UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Informed watermarking: Outline

Idea of informed watermarking

Informed shaping

Informed coding

Conclusions

Informed watermarking

Idea of informed watermarking

Informed watermarking is the practice of using information about the cover work during watermark coding and shaping.


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Blind coding & shaping

Blindcoding

Blindshaping(scaling)

WatermarkedWork

OriginalWork

Message

Watermark embedder


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Informed shaping

Blindcoding

Informedshaping

WatermarkedWork

OriginalWork

Message

Watermark embedder


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Informed coding & shaping

Informedcoding

Informedshaping

WatermarkedWork

OriginalWork

Message

Watermark embedder


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Central insight

Watermarking with informed embedder and blind detector = communication with side information at the transmitter Shannon’s model: transmitter has knowledge of

channel’s noise characteristics In watermarking, cover Work = (part of) noise Theoretical results for this type of channel should

apply to watermarking


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Consequences

Informed shaping alone Allows more precise control of fidelity/robustness

tradeoff

Informed coding + informed shaping Greatly increases payload for a given

fidelity/robustness performance Alternatively, improves fidelity/robustness

performance for a given payload


Informed shaping

The cover work can be used to inform perceptual shaping. It can also be used to adjust watermark pattern for maximal robustness.


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Basic approach

Design detector (we’ll use the linear-correlation detector from Part 2)

Treat detection algorithm and parameters as given

Design best embedder we can


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Embedding problem

The embedder is capable of producing any image

Objective: produce an image within the intersection of a region of acceptable fidelity and the detection region


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Embedding problem

w

Region ofacceptable

fidelity

Any point inthis area is asuccessfulembedding


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Embedding problem

Several possible approaches Maximize robustness for a given fidelity Maximize fidelity for a given robustness

Either approach requires Estimate of fidelity Estimate of robustness


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Simple embedding method

Assume MSE indicates fidelity (better estimates lead to perceptual shaping)

Assume robustness is monotonic function of linear correlation

Under these assumptions, blind embedding achieves maximum “robustness” for given “fidelity”

Alternatively …


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Simple embedding method

… we can minimize fidelity impact while embedding for a constant “robustness”


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Estimating robustness

Simple assumption: robustness is monotonic function of detection value True for linear correlation Not true for other detection measures

For normalized correlation, we have obtained good results by estimating amount of white noise that may be added before watermark is likely to be lost


Informed coding

Significantly larger data payloads can be embedded if the mapping between messages and watermark patterns is dependent on the cover work.


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Informed coding: Outline

Writing on dirty paper (problem studied by M. Costa)

Dirty-paper codes

Application of dirty-paper codes to watermarking

Experimental results

Conclusions


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Informed coding: Writing on dirty paper

M. Costa studied a “dirty-paper channel” Obtain a piece of paper with normally-distributed

dirt Write a message using limited ink Send message, acquiring more dirt along the way Recipient cannot distinguish dirt from ink How much information can we send?


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Informed coding: The dirty-paper channel

Transmitter Receiver

Firstnoise

m

Secondnoise

m’

s

n

x y

x limited by power constraint:

i

pi 2x


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Informed coding: Costa’s result

First noise has no effect on channel capacity


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Informed coding: Dirty-paper codes

Basic idea Dirty-paper code = code in which each

message is represented by several alternative code vectors

From the set of vectors that represent the desired message, choose the one, u, that is closest to the first noise, s

Transmit a function of u and s, for example x = u - s


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Coding for a simplified channel

Consider a simplified version of the dirty-paper channel First noise has only two possible values, s1 and s2

(i.e. there are only two possible patterns of dirt on the paper)

Remainder of channel is the same

If s1 is sufficiently different from s2, then Costa’s result is easy to obtain


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Coding for a simplified channel

DC E

A B

F G DC E

A B

F GThis group ofcode vectors

centered on s1

This group ofcode vectors

centered on s2


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Informed coding: Dirty-paper codes

For full dirty-paper channel:

Try to design a dirty-paper code in which, within the power-constraint around every possible s,

there is at least one code vector for each message.


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Coding for full dirty-paper channel

Code must ensure that, within the power-constraint around every possible s, there is at least one code vector for each message.

Capacity cannot be achieved transmitting x = u – s.

Costa transmits x = u – s, where is a carefully-chosen constant


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Application to watermarking

Costa’s proof does not translate directly to watermarking In watermarking, noise is not Gaussian Non-Gaussian noise necessitates non-spherical

detection regions (e.g. cones)

Lessons from Costa Use dirty-paper codes Use non-trivial informed embedding


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Practical dirty-paper codes

Costa’s code is generated randomly Requires exhaustive search during encoding and

decoding Practical for only very small data payloads

Lattice code is most-studied practical code Chen & Wornell (“Dither Index Modulation”,

“Quantization Index Modulation”) Eggers, Su, & Girod (“Scalar Costa Scheme”)


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Informed coding: Lattice codes

Each dimension in marking space encodes one symbol, usually one bit

Bit encoded by choosing between two quantization points

10 0 0 01 1


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Properties of lattice codes

Typically much higher capacity than correlation-based systems (> 1000 bits)

Not usually as robust as correlation-based systems Correlation-based systems have better

payload/robustness tradeoff when noise is high Lattice codes susceptible to changes in image

brightness or audio volume


Conclusions


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Conclusions: Stuff not covered

Informed-embedding for multi-bit watermarks

Syndrome coding

Application of informed-coding to correlation-based systems


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus


Informed shaping Embedder may choose any point in the detection

region for the desired message Best to base choice on an estimate of robustness

Informed coding Define several patterns for each message, and

embed the one that’s closest to the cover work In theory, capacity of watermarking might be

unaffected by distribution of cover works


UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Future directions

UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Future directions

Research Informed coding

Quantization index modulation Syndrome coding Trellis coding

Robustness Non-random processes

• Esp. geometric distortions

UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Future directions

Research Security

Collusion attacks Others …

UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Future directions

Commercial applications Transaction tracking

Movie screeners Digital cinema

Broadcast monitoring Metadata

Lyrics in MP3 files

UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Future directions

Commercial applications Authentication

Cameras Surveillance video Medical imagery

Enhancements to legacy systems 3D HDTV – Benoit Macq

UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Future directions

Commercial applications? Copy control Proof of ownership

UC

L A

dast

ral P

ark

Post

gra

duate

Cam

pus

Future directions

Commercial applications Must be based on a service or product

Not technology Similar to commercial applications of cryptography

principles of digital watermarking ingemar j. cox, matt l. miller, and jeffrey a bloom

Documents

applications watermarking

message definitions

common definitions

definition definitions

definitions imperceptibility

watermarking approaches

visible watermarking

multimedia watermarking