Blind watermarking of 3D shapes using localized constraints

Transcription

1 Blind watermarking of 3D shapes using localized constraints Adrian G. Bors Dept. of Computer Science, University of York, York YO DD, U.K. Abstract This paper develops a digital watermarking methodology for 3-D graphical objects defined by polygonal meshes. In watermarking or fingerprinting the aim is to embed a code in a given media without producing identifiable changes to it. One should be able to retrieve the embedded information even after the shape had suffered various modifications. Two blind watermarking techniques applying perturbations onto the local geometry for selected vertices are described in this paper. The proposed methods produce localized changes of vertex locations that do not alter the mesh topology. A study of the effects caused by vertex location modification is provided for a general class of surfaces. The robustness of the proposed algorithms is tested at noise perturbation and object cropping. 1 Introduction Digital watermarking and fingerprinting are techniques for embedding and retrieving information into various types of digital media data. In watermarking terminology the original object is called cover media while the watermarked object is called stego media. Most of the research in watermarking has concentrated on cover media such as audio data, still images (bitmaps), text, or video [1, 2, 3]. This paper addresses the problem of inserting binary codes in 3D shapes represented by polygonal meshes. 3-D shape watermarking implies an entirely new set of requirements when compared to watermarking other digital media types. Such requirements include the nonperceptibility of changes brought to the watermarked model and the ability to detect the stored information even after the object has suffered various transformations. Potential transformations in 3-D meshes can be classified into geometrical and topological. Examples of geometrical transformations are: rotation, scaling, or other affine transformations. Topological transformations consists of changing vertex order in the object description file, polygon simplification, mesh altering or cropping parts of the object. Smoothing and noise corruption algorithms can be mentioned from the category of intentional attacks. Noise corruption in 3D models amounts to a succession of small perturbations in the vertex location and can model a variety of potential attacks. Authentication of 3-D graphical objects by means of fragile watermarking has been considered in [4, ]. Results provided by a copyright protection watermarking algorithm employing modifications in histograms of surface normals were reported by Benedens in [6]. Ohbuchi et. al discussed three methods for watermarking 3-D polygonal models [7]. Most of the 3-D object watermarking algorithms aim either to ensure invariance to geometrical transformations or to preserve the object topology [13]. Invariance to geometrical transformations can be realized by using ratios of various 2-D or 3-D measures [7, 8, 9]. Watermarking of 3-D polygonal meshes in spectral domain has been shown to be robust under various attacks []. Kanai et al. developed a watermarking technique using a wavelet decomposition for polygons [11]. Praun et al. used multiresolution filters, employing a set of interpolating basis functions in [12]. Benedens and Busch introduced three different algorithms, each designed for a specific application, [13]. A public watermarking system requires only the knowledge of the watermark and that of the stego object in the detection stage. However, most of the approaches developed for watermarking graphical objects need the knowledge of the cover media in the detection stage as well [6,, 12], or they require significant preprocessing efforts in the detection stage [9, 11, 13]. This paper extends the blind 3-D watermarking methodology that has been proposed in [14]. The watermarking algorithm consists of two steps. In the first step an array of vertices and their neighborhoods are selected from the cover object. The selected vertices are ordered according to a criterion. Two different localized approaches, that produce controlled geometrical perturbations, are considered for embedding: using parallel planes and bounding ellipsoids. The paper is organized as follows. The procedure for selecting the watermark locations is described in Section 2. The analysis of the effect of perturbations in meshes is provided in Section 3, while the watermark embedding and detection algorithm is detailed in Section 4. Experimental re- Proceedings of the 2nd Intl Symp 3D Data Processing, Visualization, and Transmission (3DPVT 4) /4 $. 4 IEEE

2 sults are provided in Section, and the conclusions of this study are drawn in Section 6. 2 Vertex selection The aim of this work is to embed information in a given 3-D object represented by polygonal meshes. Color, shading, texture or other attributes may be easily changed or removed. The most suitable attribute for watermarking graphical objects is represented by vertex coordinates [13, 14]. On the other hand various attributes can be used to mask the changes produced to the object geometry. The shape watermarking approach adopted in this paper consists of imperceptibly changing the location of certain vertices in such a way that they eventually embed a code. The proposed approach embeds one bit per vertex without altering the topology of the mesh. As in the image watermarking approach from [2], the 3-D watermarking algorithm consists of two distinct steps: identifying the most suitable vertices to carry watermarking information and the embedding operation itself. A vertex is denoted by V i O and its coordinates are defined by the vector V i. Let us consider the neighborhood of a vertex as all the vertices from the same object that are connected to it: N (V i ) = {V j V j V i >, j = 1,..., N i } (1) where V j V i denotes the cardinal set between two neighboring vertices V i and V j, while N i denotes the total number of vertices from N (V i ). A vertex and its neighborhood are considered as part of a vertex array denoted as B = {V i, N (V i )}, a subset of the polygonal mesh defining the object, B O, where O is the 3-D graphical object. The most appropriate vertices for watermarking are those from areas of high variation in the 3-D object. Such regions are the equivalent of image areas with textures or with great amount of detail that are deemed appropriate for image watermarking [1, 2]. Let us consider the first two moments description for a neighborhood. The second order moment represents geometrically an ellipsoid which roughly models the geometry of the V i s neighborhood. The centre of the ellipsoid is given by the average of the vertex locations : V µ i = j N (V i ) V j (2) N i where N i is the number of vertices in the neighborhood N (V i ). Due to their property of invariance to translation and rotation, first and second order moments have been used in image watermarking [3] and for modelling 3-D objects []. The shape of the ellipsoid can be calculated as the second order moment (variance) of the set of locations in the given neighborhood : V S i = (V j N(V i) j µ i )(V j µ i ) T (3) N i The ellipsoid which locally describes the vertices in the neighborhood N (V i ) is modelled by : (x µ i ) T S 1 i (x µ i ) = K (4) where x is a vector located onto the ellipsoid described by (µ i, S i ), and characterising N (V i ), and K describes the extension of the ellipsoid. Certain neighborhoods, when all the vertices in the neighborhood are located on the same plane, provide a singular covariance matrix S i. Let us consider D(V i ), the squared distance from a vertex to its neighborhood N (V i ): D(V i ) = V j V i 2 () V j N (V i ) The polygonal surface of a certain neighborhood can be considered as a measure of the local shape variation. The area of all the polygons (considered here as triangles), connected to a certain vertex, is calculated as: A(V i ) = 1 2 V j N (V V i) iv j V i V (j+1)modn i sin( V i V j, V i V (j+1)modn i ) (6) where the vertices in the neighborhood are considered ordered, and where mod denotes operation modulo. The threshold for selecting a certain vertex as a bit-holder for watermarking is calculated with respect to the local surface: T (V i ) = k A(V i ) (7) where k is a small constant. The underlying assumption, studied in Section 3, is that we can produce unobservable modifications in areas consisting of small polygons, while any location modification of vertices adjacent to large polygons may become visible. The vertex selection procedure is introduced in the following. Distances D(V i ), for every vertex V i O to its neighborhood, are evaluated according to (). A head chain vertex, having the smallest D(V i ), is selected. The set B is made up by choosing sets of vertices and their neighborhoods, with the condition that a newly selected vertex V j is not part of any previously selected vertex neighborhood and does not produce a significant distortion: {V j B N (V j ) B D( ˆV j ) < T (V j )} (8) where j = 1,..., M, M is the total number of vertices that fulfill the above mentioned conditions and ˆV j is the watermarked vertex. The selected bit holding vertices are ordered according to their increasing Euclidean distance to the head chain vertex. The selection and ordering of vertices in B is obviously invariant to translation, rotation and uniform scaling of the model. In order to increase the robustness to 3-D object cropping, the given code is embedded repeatedly into various regions of the mesh. Consequently, the array B is split into localized subsets. A code of B bits will be redundantly embedded using localized sub-arrays of B. The array of bitholder vertices B is split into groups of B sets {V i, N (V i )}, Proceedings of the 2nd Intl Symp 3D Data Processing, Visualization, and Transmission (3DPVT 4) /4 $. 4 IEEE

3 each group located in the same geometrical proximity. The watermark is repeatedly embedded in the object a number of times equal to M/B. The bit-holder selection procedure will resist any change of the vertex order in the polygonal mesh description file. Shape perturbation to noise is assessed in the following Section. 3 The effect of vertex displacement in meshes A large variety of surfaces and 3-D objects can be modelled by using Gaussian mixtures []. In order to study the perturbation effects on a mesh let us consider a family of surfaces modelled as: R R F (x) = λ i=1 [ exp (x c i) T ] (x c i ) S 2 where λ is a constant representing the contribution of each Gaussian function and the normalization, c is the Gaussian function center, S is the scale parameter and x is the vertex vector, chosen equally spaced on a plane in the following range: x = {1,..., R /R } {1,..., R /R }. An equal number of Gaussian components is considered along each axis, respectively R, while their centers are equally spaced. Vertices x p are selected for watermarking by subsampling with two along each axis while the neighborhood size is N i = 8 for all selected vertices. Many different surfaces are considered for S = [4, 16] and R = {2,..., 2}. Distances D(V i ) are calculated from each selected vertex to its 8-vertex neighborhood for selected vertices using (8). The average distance D(x p ) for all selected vertices to their neighborhoods, for a mesh surface obtained for a certain S and R is shown in Figure 1. In Figure 2 an approximation of the average surface A(V i ) is displayed. One can observe the similarity of the two plots from Figures 1 and 2. The average surface connected to a selected vertex is larger for a small scale parameter. Surface perturbations are produced onto the surface modelled by F (x) from (9), along z direction, in selected vertices. The perturbation induced in the surface is represented as a fraction from the distances to the local neighborhood, (): (9) F (ˆx p ) = F (x p ) + ηd(x p )) () where ˆx p is the perturbed vertex, η (, 1) is the perturbation ratio. In Figure 3 is represented the surface modelled by R = 3 Gaussian components, with S = 23. In Figure 4 the surface from Figure 3 is shown after being changed by (), when considering η =.2. In order to assess the distortions produced in the shape, a large set of surfaces is considered, by varying S and R. The distortion in the distance from each watermarked vertex to its neighborhood is calculated using: E = 1 M D(ˆx p ) D(x p ) (11) M p= Scale No. of components on x and y Figure 1. Evaluation of the average D(V i ) for various surfaces modelled by S and R Scale No. of components on x and y Figure 2. Evaluation of the local surface average for various surfaces modelled by S and R. where D(ˆx p ) is the distance from the perturbed site to its neighborhood, and M is the total number of perturbed vertices. The plots for R = 3, and R = components, when assuming various values for S, are represented in Figures and 6, respectively. From these plots we can observe that distortions are higher for a smaller S and for a larger number of components R, while they are linearly predictable for surfaces that tend to be smooth. 4 Embedding and retrieving the watermark The watermark is embedded in an array of B vertices and their neighborhoods, modelled as ellipsoids (4). Two regions are considered in the space defined by the set {V i, N (V i )}, one for embedding a bit of, and the other for embedding a bit of 1. The watermarking code is represented by a unique sequence of bits generated according to a key. The information is embedded in the graphical object structure by performing a succession of localized perturbations in the location of chosen bit-holding vertices V i B. 2 2 Proceedings of the 2nd Intl Symp 3D Data Processing, Visualization, and Transmission (3DPVT 4) /4 $. 4 IEEE

4 4 S= S= S=6 S= F Surface Distortion 3 2 S=11 S= Y 3 X S> Applied Perturbation Figure 3. Original surface modelled by a mixture of Gaussians R = 3, S = 23. Figure. Distortions produced in the mesh surface when R = 3 components. 4 S= S= F Surface Distortion 3 2 S= S> Y 4 X Applied Perturbation Figure 4. Watermarked surface for η =.2. Two different embedding approaches developed from the methodology proposed in [14] are described in the following. The first approach defines two parallel planes for a stego vertex V i, using the geometry of its neighborhood N (V i ). In the first step, the normal N j at each vertex from the neighborhood, V j N (V i ), is calculated. The surface normal N i at the vertex V i is taken as the average of surface normal directions corresponding to all its adjacent polygons. The orientation of the two bounding planes is denoted by Q(V i ) and is given by averaging the orientations of all surface normals from that neighborhood : V Q(Vi ) = j N (V i ) Nj (12) N i where N i is the number of vertices in the neighborhood N (V i ). The two planes are located at equal distance from the neighborhood s centre µ i, on both sides, calculated in the direction of the average neighborhood s normal, Q(V i ). This distance from the planes to the neighborhood s centre is derived as the variance of distances in the local neighbor- Figure 6. Distortions produced in the mesh surface when R = components. hood, projected along the direction Q(V i ) : V Ψ(V i ) = j N (V i ) [(V j µ i ) Q(V i )] 2 (13) N i where denotes the scalar product. In the case when embedding a 1 bit, the vertex V i is projected along the direction of Q(V i ), inside the volume defined by the parallel planes such that : ( ˆV i µ i ) Q(V i ) < Ψ(V i ) ɛ (14) where ˆV i is the new location of the watermarked vertex and ɛ is a small distance. When embedding a bit, the vertex is projected outside the volume defined by the parallel planes: ( ˆV i µ i ) Q(V i ) > Ψ(V i ) + ɛ () The projection defined by (14) or () ensures a minimal local distortion in the graphical object. The updating rule for embedding a bit of 1 is given by: ˆV i V i = [(V i µ ) Q(Vi ) i Q(V i ) Ψ(V i )+ɛ] Q(V i ) (16) Proceedings of the 2nd Intl Symp 3D Data Processing, Visualization, and Transmission (3DPVT 4) /4 $. 4 IEEE

5 Embed µ 1 µ 3 µ 2 Embed 1 Embed (a) Initial mesh. (b) Embedding the code. Figure 7. Embedding information in polygonal meshes using bounding ellipsoids. while for embedding a bit of is similar but with opposite direction of modification. It can be observed that the robustness of the watermark is improved by choosing a larger ɛ. On the other hand, a larger ɛ may lead to visible artifacts in the 3-D object. The second embedding approach consists of defining bounding ellipsoids for each chosen stego vertex, V i B. When embedding a 1 bit, the vertex V i is projected along the shortest path inside the bounding ellipsoid: ( ˆV i µ i ) T S 1 i ( ˆV i µ i ) < K ɛ (17) A bit is embedded by moving the vertex V i just outside its corresponding bounding ellipsoid, by fulfilling: ( ˆV i µ i ) T S 1 i ( ˆV i µ i ) > K + ɛ (18) where ɛ is a small distance. In the case that the relationships (17) and (18) are already fulfilled by the neighborhoods N (V i ), according to their corresponding bits, no action will be taken. Otherwise, the vertices V i will be moved into ˆV i according to their neighborhood geometry and the information to be embedded. In the following, the updating equations are provided for the bounding ellipsoids algorithm. The direction for changing the location of the updated vertex ˆV i is parallel with the normal to the bounding ellipsoid Γ. The normal to the bounding ellipsoid at a location x is obtained after differentiating equation (4): Γ (x) = 2(x µi ) T S 1 i (19) The updating equation for the vertex location when embedding a bit of 1 is given by: Γ (Vi ) ˆV i = V i Γ (V i [(V i µ i ) T S 1 i (V i µ i ) K + ɛ] () while for a bit has an opposite updating direction. No change is performed if the vertex is already located according to the relationships (17) or (18). The embedding of a code using bounding ellipsoids is shown in Figure 7. When embedding digital information, the local mesh topology does not change for either of the two 3-D graphics watermarking algorithms. The change in the vertex location may affect the ordering of vertices in the selected vertex arrays. The effect of vertex perturbation on the ordering of vertices is predictable according to the study provided in Section 3. In this case the location of vertices in the neighborhoods of selected vertices should be modified in order to maintain the local ordering of the array B. The algorithm checks all the vertices, ensuring that the set ordering has not been affected by the embedding process. The watermark detection stage aims to recover the information that has been stored in the shape. Firstly, the set of marked vertices and their neighborhoods is selected in the same way as explained in Section 2. In the case of parallel planes algorithm, for the chosen vertices and their neighborhoods, the relationship (14) is verified for detecting a 1 bit and () for a bit. On the other hand, when embedding using ellipsoidal bounding volumes, equations (17) and (18) are considered for detecting a 1 bit and a bit, respectively. Thus a sequence of bits is retrieved from the shape. Eventually, a XOR operation is evaluated between the resulting set of bits and the watermark code. This shows the number of bit errors. A decision is taken based on an acceptable minimal bit error. In order to improve the robustness to errors in the detected bit-sequence from the given watermarked shape, error correction codes can be used. Such error correction codes are widely used in communication systems [16]. An example of error correction code is the Hamming code which checks for the parity of bits. Such a watermark retrieval approach can be adopted for stenography applications. In a statistic detection approach a distribution of all the distances from the B bit-holding vertex locations to their neighborhood representations is formed. The resulting distribution produces two Gaussian densities, offset with ɛ or ɛ, for embedding a 1 bit or a bit, respectively. The likelihood of the presence of a certain code can be statistically estimated from these distributions [1]. Two types of errors may occur: false rejection error when the embedded watermark is not detected, and false detection error, when a watermark is detected without ever being embedded in the given 3-D shape. Experimental results The watermarking algorithms described in this paper can be applied to a large variety of graphical objects modelled by polygonal meshes. In the following the results when applying the proposed watermarking algorithms onto a set of graphical shapes that represent both animation characters and industrial objects are provided. The selected objects have a relatively low number of vertices and polygons and are all in the 3DS (3D studio) format. Table 1 provides the characteristics for five 3-D objects. A watermark code of 32 Proceedings of the 2nd Intl Symp 3D Data Processing, Visualization, and Transmission (3DPVT 4) /4 $. 4 IEEE

6 bits is generated using cyclic redundancy error checks of a particular bit-string. The 32 bit code is split into 8 arrays, of 4 bits each. Cyclic redundancy checks have the property of mapping evenly across the space of possible values. The information to be embedded is seven bits long, where four bits represent the watermark code and the rest are used as error correction bits. A total of eight different sequences are needed in order to embed the entire watermark code. It is trivial to show that this watermarking technique is unaffected by rotation, translation and scaling of the graphical objects. Experiments have found no false alarm detection probabilities in the given set of objects, when considering a large number of different codes. Graphical No. of No. of No. polygons Model Vertices Polygons connected to a vertex Dog Extractor Fan Guillotine Screwdriver Sink to the case when using parallel planes. The results for the following objects are displayed: dog shown in Figure 8a, sink in Figure 9a, screwdriver in Figure a, and fan in Figure 11a. In Figures 8b, 9b, b, and 11b the same objects are shown after being watermarked using bounding ellipsoids, while in Figures 8c, 9c, c, and 11c are displayed after being watermarked using parallel planes. All the graphical objects are shown under the same visibility conditions, using simple illumination models and flat shading. The distortions caused by the parallel planes algorithm have higher visibility than the distortions caused by the bounding ellipsoids algorithm. Such distortions are more evident in the planar structure of the dog model and on the bottom of the sink, when watermarked by using parallel planes. When applying textures, colors and more realistic illumination models, the visibility of distortions caused by watermarking decreases. Table 1. Graphical objects considered in the experiments and their characteristics. Graphical Cover vertices Cover vertices Model bounding parallel ellipsoids planes Dog 28.% 17.3% Extractor Fan 18.% 13.% Guillotine 16.6% 11.3% Screwdriver 13.% 9.8% Sink 14.% 9.8% Table 2. Percentage of selected vertices for watermark embedding. (a) (b) (c) Figure 8. Graphical object representing a dog: (a) original; (b) watermarked using bounding ellipsoids; (c) watermarked using parallel planes. Experimentally, it was found that a watermark can be safely considered as embedded in a 3-D graphical object if 7 % of the code bits from at least half of all the arrays, forming the watermark code, can be recovered from the object structure. In the experimental results presented in this paper, both algorithms, using bounding ellipsoids and parallel planes, are applied to a set of five graphical objects. Table 2 displays the amount of stego vertices (i.e. vertices that can be used for embedding information) as a percentage of all individual 3-D object vertices. From Table 2 it can be observed that more bit holder vertices can be found when using the bounding ellipsoids approach than by using parallel planes. The reason for this is that mesh distortions are smaller when using bounding ellipsoids when compared In the following the proposed 3-D watermarking scheme is tested at two attacks. The first attack is topological and consists of cropping specific regions of the 3-D object. The dog object is considered and the region representing the head is separated from that of the body. The new shapes representing the head and the body of the dog are shown in Figures 13a and 13b. The watermark was fully recovered from the dog-head shape while it was % recovered from the dog-body shape. In another attack, random perturbations are applied to all five 3-D watermarked graphical objects, generating a total of shapes distorted with various levels of noise. The perturbations are modelled according to Gaussian noise V i V i N(, σ 2 ), where V i represents the location of a distorted vertex by noise. The Proceedings of the 2nd Intl Symp 3D Data Processing, Visualization, and Transmission (3DPVT 4) /4 $. 4 IEEE

7 (a) original b) watermarked using (c) watermarked using bounding ellipsoids parallel planes Figure 9. Graphical object representing a sink. (a) original b) watermarked using (c) watermarked using bounding ellipsoids parallel planes Figure. Graphical object representing a screwdriver. following measure is used: E(σ) = 1 L L i=1 σ 2 D(V i ) (21) where D(V i ) is provided in () and L represents the number of vertices in the 3-D object. The plots from Figures 12 and 14 show the watermark detection results when using bounding ellipsoids and parallel planes. Error bars showing the absolute deviation from the local average, for a certain normalized displacement E(σ) are shown for various levels of perturbations. All these experimental results show the 3-D watermark resilience and robustness. The proposed algorithms do not require the cover objects in the detection stage. For both algorithms better results have been obtained with artistic graphical objects than with objects representing industrial objects. Industrial graphical objects have fewer and larger surfaces, as it can be observed from their properties in Table 1, contain lower surface variability and implicitly fewer vertex sites suitable for watermarking, Table 2. The bounding ellipsoid watermarking approach produces less visible modifications and has a higher robustness to attacks. 6 Conclusions This paper expands a digital watermarking methodology for 3-D shapes and graphical objects represented by polygonal meshes. The proposed watermarking algorithms have two stages. In the first processing stage a set of vertices and their neighborhoods are selected and ordered according to a minimal distortion visibility threshold. The embedding (a) (b) (c) Figure 11. Graphical object representing a fan: a) original; (b) watermarked using bounding ellipsoids; (c) watermarked using parallel planes. consists of localized geometrical changes of selected vertex locations. Two different techniques are considered: using bounding ellipsoids and parallel planes. The proposed watermarking algorithms do not require the original object in the detection stage, are completely automatic and can be applied to a large variety of applications requiring 3-D model fingerprinting and for stenography. References [1] I. Cox, M. Miller, and J. Bloom, Digital watermarking. Morgan Kaufmann, 1. [2] A.G. Bors, I. Pitas, Image watermarking using bock site selection and DCT domain constraints, Optics Express, vol. 3, no. 12, pp , [3] A. Nikolaidis, I. Pitas, Region-Based Image Watermarking, IEEE Trans. on Image Processing, vol., no. 11, pp , 1. Proceedings of the 2nd Intl Symp 3D Data Processing, Visualization, and Transmission (3DPVT 4) /4 $. 4 IEEE

8 Detection probability (%) 6 4 Detection probability (%) Normalized displacement Figure 12. Bounding ellipsoids watermark robustness to Gaussian noise Normalized displacement Figure 14. Parallel planes watermark robustness to Gaussian noise. [9] F. Cayre, B. Macq, Data hiding on 3-D triangle meshes, IEEE Trans. on Signal Processing, vol. 1, no. 4, pp , 3. [] R. Ohbuchi, S. Takahashi, T. Miyazawa, and A. Mukaiyama. Watermarking 3D polygonal meshes in the mesh spectral domain, Proc. of Graphics Interface, Ottawa, Canada, 1, pp (a) Head of the dog (b) Body of the dog Figure 13. Cropping of a watermarked dog model. [4] C. Fornaro and A. Sanna, Private key watermarking for authentication of CSG models, Computer-Aided Design, vol. 32, no. 12, pp ,. [] B.-L. Yeo and M.M. Yeung, Watermarking 3D objects for verification, IEEE Computer Graphics and Applications, vol. 19, no. 1, pp. 36 4, [6] O. Benedens, Geometry based watermarking of 3D models, IEEE Computer Graphics and Applications, vol. 19, no. 1, pp. 46-, [7] R. Ohbuchi, H. Masuda, and M. Aono, Watermarking three polygonal models through geometric and topological modifications, IEEE Jour. on Selected Areas in Communication, vol. 16, no. 4, pp. 1-6, [8] M.G. Wagner, Robust watermarking of polygonal meshes, Proc. Geometric Modelling and Processing, Hong Kong,, pp [11] S. Kanai, H. Date, and T. Kishinami, Digital watermarking for 3D polygons using multiresolution wavelet decomposition, Proc. of International Workshop on Geometric Modeling: Fundamentals and Applications, Tokyo, Japan, 1998, pages [12] E. Praun, H. Hoppe, A. Finkelstein, Robust mesh watermarking, Proc. International Conference on Computer Graphics and Interactive Techniques (SIG- GRAPH), Los Angeles, CA, (Computer Graphics), vol. 6, no. 4, 1999, pp [13] O. Benedens, C. Busch, Towards blind detection of robust watermarks in polygonal models, Proc. EU- ROGRAPHICS, Interlaken, Switzerland, (Computer Graphics Forum), vol. 19, no. 3,, pp. C199- C8. [14] T. Harte, A.G. Bors, Watermarking 3D Models, Proc. IEEE International Conference on Image Processing, Rochester, NY, 2, vol. III, pp [] A.G. Bors, I. Pitas, Object classification in 3-D images using alpha-trimmed mean radial basis function network, IEEE Trans. on Image Processing, vol. 8, no. 12, pp , [16] J. Baylis, Error-correcting codes. Chapman-Hall, London, Proceedings of the 2nd Intl Symp 3D Data Processing, Visualization, and Transmission (3DPVT 4) /4 $. 4 IEEE