Polygonal mesh watermarking using Laplacian coordinates

Transcription

1 Eurographics Symposium on Geometry Processing 1 Olga Sorkine and Bruno Lévy (Guest Editors) Volume 9 (1), Number 5 Polygonal mesh watermarking using Laplacian coordinates Y. Yang and I. Ivrissimtzis School of Engineering and Computing Sciences, Durham University, UK Abstract We propose a watermarking algorithm for polygonal meshes based on the modification of the Laplacian coordinates. More specifically, we first compute the Laplacian coordinates (x, y, z) of the mesh vertices, then construct the histogram of the lengths of the (x,y,z) vectors, and finally, insert the watermark by altering the shape of that histogram. The watermark extraction is carried out blindly, with no reference to the host model. The proposed method is more robust than several existing high capacity watermarking algorithms. In particular, it is able to resist attacks such as translations, rotations, uniform scaling and vertex reordering, due to the invariance of the histogram of the Laplacian vector lengths under such transformations. Compared to the existing robust watermarking methods, our experiments show that the proposed method can better resist common mesh editing attacks, due to the good behaviour of the Laplacian coordinates under such operations. Categories and Subject Descriptors (according to ACM CCS): I.3.5 [Computer Graphics]: Computational Geometry and Object Modeling Curve, surface, solid and object representations 1. Introduction A digital watermark is a digital signal embedded into a digital medium, such as text, audio, image or video, to protect it from unauthorized use or alteration. Several important applications, such as proof of ownership, or copy control, require robust watermarks, that is, watermarks that are able to resist unintentional or malicious attacks to remove them. As the mesh geometry has much higher carrying capacity than the connectivity, a typical watermarking algorithm for 3D polygonal meshes embeds the watermark into the geometry, altering the positions of the vertices. Then, theoretical arguments or experiments are used to demonstrate the robustness of the algorithm against common attacks, such as geometric transformations, addition of noise and mesh smoothing. In contrast, in this paper we are primarily concerned with the robustness of the watermark against editing attacks that change the global shape of the mesh. We believe that, in many cases, the assumption of a mesh editing attack is more realistic than the assumption of a noise addition, or a smoothing attack. Indeed, even if the attacker can use smoothing or noise addition to remove the watermark without degrading the visual quality of the model, still they would probably want to alter the global shape of the model through mesh editing in order to, either disguise the appropriation of the model, or to create a model fit for their purpose. The algorithm we propose is based on Laplacian coordinates. In particular, the signal is embedded into the histogram of the lengths of the vectors (x,y,z), where (x,y,z) are the Laplacian coordinates. We notice that the lengths of the Laplacian coordinates, unlike the Laplacian coordinates themselves, are invariant under both translation and rotation. The use of histograms means that the method is also invariant under uniform scaling and vertex reordering. Finally, experiments show that the use of Laplacian coordinates makes the proposed method resillient against mesh editing attacks. The main contributions of the paper are: A new polygonal mesh watermarking algorithm based on Laplacian coordinates. A demonstration that the algorithm is robust against editing operations altering the global shape of the mesh. The rest of this paper is organized as follows. Section reviews the relevant literature. Section 3 presents the preliminaries and the basic ideas of the proposed watermarking scheme. Watermark embedding and extraction methods are described in detail in Section 4 and Section 5, respectively. Published by Blackwell Publishing, 96 Garsington Road, Oxford OX4 DQ, UK and 35 Main Street, Malden, MA 148, USA.

2 The experimental results are presented and discussed in Section 6 and finally, we briefly conclude in Section 7.. Related Work Given their immediate practical applications, watermarking algorithms have been developed for objects of various dimensions, including text documents [LT7], audios [BPN1], digital images [RP5] and video [NM8]. The research interest into the watermarking of 3D models is relatively newer; however, several watermarking [AM5, WH9], or closely related steganographic algorithms [CLYL9, SWK8] have already been proposed. Similarly to image watermarking, 3D mesh watermarking methods work either in the spatial domain [YY99] [LLLL5] [YIK3] [CPJ7] [Bor6], or in the frequency domain [OMT] [PHF99] [UCB4] [YPSZ1]. In one of the earliest approaches, Yeo et al. [YY99] verify 3D meshes with the use of a watermarking method which perturbs each vertex to ensure that two predefined hash functions have the same value on it. Verification is achieved by a comparison of the values computed by the two hash functions. One drawback of this method is the causality problem, caused by its heavy dependence on the order of traversal of the vertices. Lin et al. [LLLL5] address this issue using vertex-orderindependent hash functions. Yu et al. [YIK3] embed the watermark by altering the distance between the vertices and the center of the host 3D model. Cho et al. [CPJ7] propose an algorithm based on the modification of the mean value and variance of the distribution of vertex norms. Bors [Bor6] uses a neighborhood localized measure to find vertices that give small embedding distortion and then watermarks these vertices by local geometric perturbations. Another category of robust 3D mesh watermarking methods is based on frequency analysis. Using the mesh spectral analysis proposed by Karni et al. [KG], Ohbuchi et al. [OMT] modify the shape of the mesh to insert the watermark into the low frequencies. Praun et al. [PHF99] embed the watermark into the perceptually significant features of the 3D model, which are identified by Hoppe s multiresolution decomposition [Hop96]. The watermarking algorithms by Uccheddu et al. [UCB4] and Yin et al. [YPSZ1] use the multiresolution analysis in [LDW97] and [GSS99], respectively. A general survey of 3D mesh watermarking can be found in [WLDB8]. Steganographic methods also embed a digital signal into a carrier digital object. Their purpose is to hide information into a host in such a way that an eavesdropper cannot detect the existence of the hidden message [CMB 8]. They are closely related to watermarking, and similar techniques apply. However, due to the different domains of application, steganographic methods favor large embedding capacity, usually at the expense of robustness, while watermarking schemes are evaluated principally on their robustness. Chao et al. [CLYL9] propose a steganographic method based on small perturbations of the vertices of the 3D models. The method achieves high embedding capacity with low embedding distortion, but it is not able to withstand malicious attacks. Cayre et al. [CM3] propose a blind data hiding scheme which considers each triangle as a two-state (i.e., or 1) geometric object, depending on the position of the projection of a vertex onto its opposite edge. The theoretical capacity of this method is one bit per vertex. Motivated by this idea, Wang et al. [WC5] increases the embedding capacity and reduces the distortion by using a multi-level embedding procedure. Their work was extended in [CW7], achieving higher embedding capacity and lower visual degradation. The extended method takes into account the surface texture information (i.e., rough or smooth), making it an adaptive algorithm. As pointed out in [CLYL9], the previous 3D steganographic approaches are not robust and they can even be attacked by distortionless operations, such as translations or vertex reordering. In contrast, watermarking methods are generally robust against distortionless attacks, while some of them can resist mesh processing operations such as smoothing, or noise addition. However, they can not successfully resist mesh editing operations that change the global shape of the mesh. 3. The Watermarking Algorithm In this section we introduce the basic notation and terminology and then give an overview of the proposed algorithm. The details of the implementation of the watermark embedding and extraction will be discussed in the next two sections Preliminaries Let M be a polygonal mesh model with N vertices and let V and E denote the sets of vertices and edges of M, respectively. Let v i be the vertex indexed by i, its position described in Cartesian coordinates by [x i y i z i ] (written as a row vector). The 1-ring neighbor of the vertex v i is denoted by N (v i ) = v j (v i,v j ) E,1 i, j N }. (1) For each vertex v i, the vectors of the Laplacian coordinates L i = [x i y i z i] are the rows of the matrix x 1 y 1 z 1 x y z L = M. ().. x N y N z N where M is the Kirchhoff matrix [Bol98]) N (v i ) if i = j M i, j = 1 if v j N (i) 1 i, j N otherwise (3)

3 In d e x o f e a c h b in, B k (a) In d e x o f e a c h b in, B k Figure 1: Histograms of the lengths of the vectors of the Laplacian coordinates of the Rabbit model with (a) K = and (b) K = 5 bins. The use of a different discrete Laplacian, as for example the one used for mesh editing in [SCOL 4], would lead to a watermarking algorithm of comparable performance. The Cartesian coordinates of the vertices are obtained from the Laplacian coordinates by M 1 L. For numerical stability, as M may be not invertible, we update the M in Eq. 3 by M i, j ε if i = j M i, j = (4) M i, j otherwise 1 i, j N where ε > is a small real number. The proposed watermarking method embeds the watermark into the histogram of the lengths of the Laplacian coordinate vectors d i = L i = x i + y i + z i 1 i N (5) These lengths are then classified into K bins B k, according to B k = d i d min + δ(k 1) d i < d min + δk} (6) with 1 i N and 1 k K. The d min and d max are the minimum and maximum elements of d = d 1,d,,d N } and δ = dmax d min K is the size of the bin. We also assume that d max B K. The histogram of d is produced by counting the number of elements in each bin B k. Two examples for the Rabbit model for the values of K = and K = 5 are shown in Fig. 1. The figure indicates that many bins are empty. 3.. Overview of The Algorithm We assume that the watermark is a bitstring. Each bit (w j = 1 or +1) is inserted into a pair of bins (B k1,b k ) with k 1 k. However, in order to ensure exact watermark extraction, some pairs of bins will not be used. A pair of bins (B k1,b k ) is valid if it satisfies (b) (7) f (B k1,b k ) = B k1 B k = B k1 + B k n thr (8) with k 1 k and X denoting the number of elements of X. Here, n thr is an embedding threshold. A pair of bins that is not valid is called invalid. The proposed method does not utilize the bins B 1 and B K, and thus, (B k,b 1 ) and (B k,b K ) are always invalid. As it will become apparent later, this requirement ensures that the watermark can be extracted with no reference to the original model. Assuming that (B k1,b k ) is valid, we insert one watermark bit w j into this pair by, if necessary, moving some elements from B k1 into B k or vice-versa, such that ˆB k1 < ˆB k if w j = 1 (9) ˆB k1 ˆB k if w j = +1 where ˆB k1 and ˆB k are the k 1 -th and k -th bins after the watermarking operation. To move an element d i from one bin to another, we either enlarge or reduce its value so as to push it to the other bin. Notice that no element movement operation is applied when B k1 < B k and w j = 1, or B k1 B k and w j = +1. Finally, the watermark bit w j is extracted from the pair of bins ( ˆB k1, ˆB k ) 1 if ˆB w j = k1 < ˆB k (1) +1 if ˆB k1 ˆB k 4. Watermark Embedding In order to embed the watermark, we first alter the set of Laplacian lengths d, computing a new set ˆd ˆd = ˆ d 1, ˆ d,, ˆ d N } (11) carrying the watermark. Then, through a minimization process, a set of Laplacian vectors ˆL with lengths ˆd is realized, and eventually the corresponding Cartesian coordinates are computed The Computation of ˆd As the bins B 1 and B K are excluded from the embedding process, and as we need one pair of bins to embed one message bit, if K is odd we need to exclude one more bin from the embedding process (here we chose B K 1 ). Thus, the maximum index of a bin used for watermarking is K ˆK = + 1 (1) For any d i inside the bins B 1, B K or B K 1 (when K is odd), we have dˆ i = d i, that is, no changes are made. For the rest of the bins, in order to reduce the embedding distortion and hence improve the visual quality of the marked mesh, the watermark bits are inserted into pairs of adjacent bins (B k1,b k ) with k = k That gives a set of ( ˆK 1)/ candidate bin pairs (B,B 3 ),(B 4,B 5 ),...,(B ˆK 1,B ˆK ).

4 For any such pair, if f (B k,b k+1 ) < n thr, then the pair is invalid and we do not embed a watermark bit, that is, ˆ d i = d i. If f (B k,b k+1 ) n thr, then the pair is valid and the watermarking process depends on the relation between B k, B k+1 and the bit w j. Without loss of generality we assume that w j = +1, as the case w j = 1 is completely analogous. We separate two cases: Case 1: If B k B k+1, then no alteration of the Laplacian lengths is required, and thus, dˆ i = d i. Case : If B k < B k+1, then we have to transfer some elements from B k+1 to B k. We order the elements of B k+1 in ascending order d i1 d i d i Bk+1 (13) and update the first n elements in Eq. 13 by dˆ d if d i d i1,d i,...,d in } i = (14) d i if d i (B k+1 d i1,d i,...,d in }) B k where d = di B k d i B k if B k > (15) d min + δ(k 1) if B k = is the average value of elements in B k if B k is non-empty, or the average of the lower limits of B k and B k+1, if B k is empty. Notice that by transferring the smallest elements of B k+1 into B k, we keep the distortion of the mesh to a minimum. The number n of points transferred from B k+1 to B k is given by f (Bk,B B k+1 k+1 ) 1 f (Bk,B + k+1 ) 1 (16) n robust where the parameter n robust controls the tradeoff between robustness of the watermark and distortion of the mesh. If the number of points to be transferred, as computed by Eq. 16, exceeds the number of points in B k+1, then we just transfer all the contents of B k+1 into B k. 4.. Distortion Minimization and Watermarked Mesh Generation Next we compute a set of Laplacian coordinates ˆL realizing the computed set of lengths ˆd. This is an undetermined problem and we solve it by minimizing the distance between the Laplacian coordinates before and after watermarking. For computational efficiency we minimize that distance at each vertex separately, that is, we minimize ˆL i L i = ( ˆx i x i) + (ŷ i y i) + (ẑ i z i) (17) subject to ˆx i + ŷ i + ẑ i = dˆ i (18) In d e x fo r e a c h b in, B k (a) In d e x fo r e a c h b in, B k (c) In d e x fo r e a c h b in, B k (b) In d e x fo r e a c h b in, B k Figure : Histogram changes as a result of watermarking the Horse and Rabbit models with K = 3 bins. (a) non-watermarked histogram of Horse, (b) watermarked histogram of Horse, (c) non-watermarked histogram of Rabbit and (d) watermarked histogram of Rabbit. From Eq. 17 and Eq. 18, we observe that this minimization problem is equivalent to finding a point ( ˆx i,ŷ i,ẑ i) on a sphere S of radius dˆ i centered at the origin that is closest to the given point (x i,y i,z i). This means that ( ˆx i,ŷ i,ẑ i) is the projection of (x i,y i,z i) on S. As S is centered at the origin, the projection of (x i,y i,z i) on it is given by ˆx i = ŷ i = ẑ i = x i d ˆ i x i + y i + z i y id ˆ i x i + y i + z i z id ˆ i x i + y i + z i (d) (19) Finally, the Cartesian coordinates of the watermarked model ˆM are computed from its Laplacian coordinates by M 1 ˆL. Fig. shows the alteration of the histograms of the Horse and Rabbit models with K = 3 bins. A comparison between the non-watermarked and the watermarked histograms indicates that their global shapes are similar. 5. Watermark Extraction Given a watermarked polygonal mesh model ˆM in Cartesian coordinates, the watermark extraction is very simple and can

5 be carried out blindly, with no reference to the original mesh M. First, we obtain the 1-ring neighbors of each marked vertex ˆv i and construct the weighted Laplacian matrix M using Eq. 3 and Eq. 4. After calculating the watermarked Laplacian coordinates, we compute the lengths ˆd of the coordinate vectors. Then, we classify the elements in ˆd into K bins ˆB k,1 k K, using Eq. 6 and Eq. 7. Since the first and the last bins B 1 and B K have not been altered by the watermarking process, the minimum dˆ min and maximum dˆ max of ˆd (after watermarking) are equal to the minimum d min and maximum d max of d (before watermarking). That is, given the total number of bins K, the step size δ used in the watermark extraction process is the same as the step size used in the watermark embedding process. This is an efficient solution to the non-synchronization problem. However, dˆ min and maximum dˆ max may change significantly when the watermarked mesh ˆM has suffered from malicious attacks. If this is the case, we form the bins using only those dˆ i that satisfy d min dˆ i d max and Eq. 7. In the next step, we disregard the bins ˆB 1 and ˆB k (k > ˆK), which do not carry watermark, and form the pairs ( ˆB, ˆB 3 ),( ˆB 4, ˆB 5 ),, ( ˆB ˆK 1, ˆB ˆK ). From the embedding process, we know that only pairs (B k,b k+1 ) satisfying f (B k,b k+1 ) n thr have been used as watermark carriers. Based on the equation f (B k,b k+1 ) = f ( ˆB k, ˆB k+1 ) () which is a consequence of the embedding strategy that swaps vertices inside pairs of bins only, we can find the pairs that carry watermark by checking if f ( ˆB k, ˆB k+1 ) n thr (1) That means that we do not need the knowledge of the original mesh M to compute the pairs of bins that carry watermark. Finally, each embedded watermark bit w j is sequentially extracted from each pair ( ˆB k, ˆB k+1 ) by +1 if ˆB w j = k ˆB k+1 1 if ˆB k < ˆB k+1 6. Experimental Results The proposed method has been implemented on Matlab using Gabriel Peyré s code [Pey8]. The 3D mesh models used in the experiments, namely, the Bunny, Rabbit, Horse, Dragon, Elephant, Hand and Hank, are shown in Fig. 3. The watermark bits are produced randomly with uniform distribution, using the Matlab function randint. The parameter ε in Eq. 4 that ensures the invertibility of the Laplacian matrix M is fixed at ε =.1. In our Matlab implementation, Table 1: Parameter setting and experimental results. C is the embedding capacity of the model in bits. In each test, the number of actually changed bins is C. Model N K n thr n robust C Bunny Rabbit Horse Dragon Elephant Hand Hank which is not optimized for time efficiency, it takes few minutes (for instance, approximately one minute for the Bunny model) to watermark the test meshes on a PC running on an Intel Core Duo T657.1 GHz processor with GB memory. The parameters used in the experiment are reported in Tab. 1. Notice that the parameters n thr and K need to be passed to the watermark extraction algorithm. In a real installation framework, we can avoid the necessity of passing n thr and K to the extraction algorithm by always fixing n thr at a constant and using a K proportional to N, that is, K = N/N c, where N c is a constant. In most experiments, n thr = 46 and the parameter K was computed this way with N c = Evaluation of the Visual Degradation A first desirable characteristic of a watermarking method is the transparency of the watermark. That is, we expect the embedded watermarks to be imperceptible. Our first experiment evaluates the visual impact of the mesh alterations caused by watermarking. Fig. 4, Fig. 5 and Fig. 6 show the test models after watermarking. We found that it is fairly difficult to observe any undesirable artifacts on the watermarked models, even upon close inspection. In addition, the watermarked models shown in Fig. 4, Fig. 5 and Fig. 6 and the corresponding originals shown in Fig. 3 are visually indistinguishable. We conclude that the proposed watermarking method is capable of preserving the visual quality and the global shape of the cover mesh models. 6.. Evaluation of Robustness A watermarking method should be capable of surviving unintentional or malicious attacks, preventing the removal of the embedded watermark by an adversary. To evaluate the robustness of the proposed method, we apply the attack to the watermarked model and attempt to extract the watermark

6 (a) (b) (c) (d) (e) (f) (g) Figure 3: Original mesh models used in the experiments. (a) Bunny, (b) Rabbit, (c) Horse, (d) Dragon, (e) Elephant, (f) Hand, and (g) Hank. (a) (b) (c) (d) (e) Figure 4: Watermarked mesh models. (a) Bunny, (b) Rabbit, (c) Horse, (d) Dragon, and (e) Elephant. (a) (b) (c) Figure 5: Illustration of the watermarked Hand and its deformed versions. (a) watermarked Hand, (b) deformation of (a), and (c) deformation of (a). (a) (b) (c) Figure 7: Illustration of Cho et al. s [CPJ7] watermarked Hank and its deformed versions. (a) watermarked Hank, (b) deformation of (a), and (c) deformation of (a). (a) (b) (c) Figure 6: Illustration of the watermarked Hank and its deformed versions. (a) watermarked Hank, (b) deformation of (a), and (c) deformation of (a). from the attacked model. The standard measures of robustness are the normalized correlation (NC) and the correct detection rate (CDR), which are obtained by a comparison between the original watermark string and the extracted one. In this paper, two types of attacks were conducted: distortionfree geometric transformations and mesh editing operations. Note that we do not measure the robustness against some other common attacks, such as noise addition and cropping, as the visual alterations resulted from such operations are usually at an unacceptable level. As expected, the watermark is perfectly robust against vertex reordering and geometric transformations, including translation, rotation and uniform scaling. This is because the watermark carrier, that is, the histogram of the lengths of

7 Table : Evaluation of the robustness of the proposed algorithm against mesh editing operations. Model NC CDR Fig. 5 (b) Fig. 5 (c) the Laplacian coordinate vectors, is invariant under these operations, except uniform scaling. Although uniform scaling may deform the histogram, the watermark survives because both embedding and extraction are based on relationships between histogram bins that are invariant under uniform scaling. Regarding vicious attacks, we only consider mesh editing operations that are likely to be applied to the 3D models in practice. We carried out such operations using the popular Character Rigging tool of the well-known 3D editing software Blender.49 [ble]. Some instances of the mesh models undergoing deformation are shown in Fig. 5 and Fig. 6. In both examples, the shapes of the deformed models are meaningful and can still be used in practical applications. Tab. lists the robustness results under mesh editing for the two models. We notice that we obtain high values of NC and CDR, even for severely edited models. The reason is that even though the mesh editing operations modify the global shape of the models, the watermark carrier, i.e., the histogram of the lengths of the Laplacian coordinates vectors, is almost unchanged. We conclude that we are able to correctly extract most of the embedded watermark bits, and hence, the proposed watermarking method offers satisfactory resistance against editing attacks Embedding Capacity The data in the second and fourth columns of Tab. 1 imply that, for each of the test models, the embedding capacity does not attain its theoretical maximum (K )/, indicating that the proposed method cannot embed a watermark bit into every bin pair. This happens because many bins are empty, and because some bin pairs do not meet the embedding condition in Eq. 8, see also Fig. 1 and Fig.. Regarding the real embedding capacity of the method, the two crucial parameters are the number of bins K and the embedding threshold n thr. Fig. 8 (a) shows the embedding capacity for variable K and fixed n thr = 6. As expected, the embedding capacity increases monotonically with K, as a larger K means that more bin pairs are available for watermarking. Fig. 8 (b) shows the embedding capacity for variable n thr and fixed K = 1. As expected, the embedding capacity decreases monotonically with n thr, as a greater n thr means that more bin pairs become invalid Comparison and Discussion We compared the proposed method with existing watermarking and steganographic algorithms. The results of the evaluation are summarized in Tab. 3. We notice that steganographic methods have higher embedding capacity but weaker robustness compared to the watermarking ones. In fact, steganographic methods are quite sensitive to mesh alterations and even a slight processing could cause the complete removal of the embedded message. Consequently, they are not appropriate for applications such as digital content protection and authentication. By contrast, watermarking methods show higher levels of robustness, at the expense of their embedding capacity. We claim that the proposed method outperforms other schemes in terms of robustness under common shapechanging editing operations. The reason is that the watermark primitives used by previous schemes, for example, the vertex norms used by Cho et al. [CPJ7], are sensitive to changes of the global shape. In contrast, the histogram of the lengths of the Laplacian vectors is less sensitive to such operations. Tab. 4 summarizes the experimental comparison between the proposed method and Cho et al. s method [CPJ7], regarding robustness to mesh editing. We implemented Cho et al. s watermark algorithm that alters the distribution of vertex norms, defined as the distances between the vertices and the center of the mesh model. In the experiment, the same bit string was embedded to the Hank model using Cho et al. s and our method, respectively. For Cho et al. s algorithm, we set the watermark strength factor α =.4 and the bin number to 3, while for our algorithm we used the parameter values listed in Tab. 1. Then, using Blender, we deformed Cho s and ours watermarked models, trying to obtain edited models with the same appearance, see Fig. 6 and Fig. 7. Tab. 4 shows that our approach achieves higher NC and CDR values, and hence, it is more robust. The Ohbuchi et al. [OMT] method is weakly resistant against mesh editing attacks because the watermark is embedded in the low frequencies of the spectrum of the Laplacian. However, variants of their method using medium or high frequencies as watermark carriers could be more resistant to mesh editing attacks. Moreover, their method outperforms ours in that it is robust against a wider range of attacks, including mesh simplification and remeshing. On the other hand, their method is a non-blind scheme and requires the original mesh for watermark extraction. That makes it unsuitable for a range of practical applications where such information can not be provided to the extraction algorithm. 7. Conclusion We propose a watermarking algorithm for polygonal meshes based on the histogram of the lengths of Laplacian coordinate vectors. The watermark extraction is carried out

8 E m b e d d in g c a p a c ity (b its ) B u n n y R a b b it H o rs e D ra g o n E le p h a n t E m b e d d in g c a p a c ity (b its ) B u n n y R a b b it H o rs e D ra g o n E le p h a n t B in n u m b e r K (a) E m b e d d in g th re s h o ld n th r (b) Figure 8: Embedding capacity versus (a) number of bins K, with fixed embedding threshold n thr = 6 and (b) embedding threshold n thr, with fixed K = 1. In both cases, n robust = 5. Table 3: Comparison with previously proposed methods. Method Steganography Watermarking Cayre s Wang s Chao s Zafeirio s Cho s Ohbuchi s Ours Domain spatial spatial spatial spatial spatial frequency spatial Capacity v 3 v 3n layers v w w w w Extraction method blind blind blind blind blind non-blind blind Similarity transformation Vertex reordering Mesh editing Here, v and w represent the numbers of the mesh vertices and watermark bits, respectively; the symbols and indicate that the method can weakly survive and can survive attacks, respectively; n layers is an embedding parameter. The previous approaches used for comparison include those by Cayre et al. [CM3], Wang et al. [WC5], Chao et al. [CLYL9], Zafeiriou et al. [ZTP5], Cho et al. [CPJ7] and Ohbuchi et al. [OMT]. Table 4: Performance comparison between ours and Cho et al. s [CPJ7] methods. Model Method NC CDR Fig. 6 (b) Proposed Fig. 7 (b) Cho s Fig. 6 (c) Proposed Fig. 7 (c) Cho s.19.6 blindly without reference to the original model. The proposed method is robust against translation, rotation, uniform scaling and vertex reordering as a result of using primitives that are invariant under these operations to carry the watermark. Most importantly, the proposed method is robust under common mesh editing operations that change the global shape of the mesh. We believe that mesh editing is the logical choice of a malicious attacker aiming at the unauthorized use of copyrighted material, and thus, the research on watermarking methods that are robust against such attacks can have immediate practical implications. The main limitation of the proposed watermarking technique is its weak resistance against other attacks, such as mesh simplification, remeshing and topological changes. Such operations may change the Laplacian coordinates significantly, and consequently alter the watermark carrier, i.e., the histogram of the lengths of the Laplacian coordinate vectors, to the extent that the embedded watermark is destroyed. As a direction for future research, we propose watermarking methods based on local coordinates other than the Laplacian. Mean value coordinates and harmonic coordinates have also demonstrated good behavior under mesh editing operations and thus, they are good candidates as potential watermark carriers.

9 References [AM5] ALFACE P. R., MACQ B.: Blind watermarking of 3d meshes using robust feature points detection. In IEEE International Conference on Image Processing (5), vol. 1, pp [ble] 7 [Bol98] BOLLOBÁS B.: Modern graph theory. Springer Verlag, [Bor6] BORS A. G.: Watermarking mesh-based representations of 3-d objects using local moments. IEEE Transactions on Image Processing 15, 3 (6), [BPN1] BASSIA P., PITAS I., NIKOLAIDIS N.: Robust audio watermarking in the time domain. IEEE Transactions on multimedia 3, (1), [CLYL9] CHAO M.-W., LIN C.-H., YU C.-W., LEE T.-Y.: A high capacity 3d steganography algorithm. IEEE Transactions on Visualization and Computer Graphics 15, (9), , 8 [CM3] CAYRE F., MACQ B.: Data hiding on 3-d triangle meshes. IEEE Transactions on Signal Processing 51, 4 (3), , 8 [CMB 8] COX I. J., MILLER M. L., BLOOM J. A., FRIDRICH J., KALKER T.: Digital watermarking and steganography. Morgan Kaufmann, 8. [CPJ7] CHO J.-W., PROST R., JUNG H.-Y.: An oblivious watermarking for 3-d polygonal meshes using distribution of vertex norms. IEEE Transactions on Signal Processing 55, 1 (7), , 6, 7, 8 [CW7] CHENG Y.-M., WANG C.-M.: An adaptive steganographic algorithm for 3d polygonal meshes. The Visual Computer 3, 9 (7), [GSS99] GUSKOV I., SWELDENS W., SCHRÖDER P.: Multiresolution signal processing for meshes. In SIGGRAPH 99 (1999), ACM Press, pp [Hop96] HOPPE H.: Progressive mesh. In SIGGRAPH 96 (1996), vol. 96, pp [KG] KARNI Z., GOTSMAN C.: Spectral compression of mesh geometry. In SIGGRAPH (), ACM Press, pp [LDW97] LOUNSBERY M., DEROSE T. D., WARREN J.: Multiresolution analysis for surfaces of arbitrary topological type. ACM Trans. Graph. 16, 1 (1997), [LLLL5] LIN H.-Y., LIAO H.-Y., LU C.-S., LIN J.-C.: Fragile watermarking for authenticating 3-d polygonal meshes. IEEE Transactions on Multimedia 7, 6 (5), [LT7] LIU T.-Y., TSAI W.-H.: A new steganographic method for data hiding in microsoft word documents by a change tracking technique. IEEE Transactions on Information Forensics and Security, 1 (7), 4 3. [NM8] NOORKAMI M., MERSEREAU R. M.: Digital video watermarking in p-frames with controlled video bit-rate increase. IEEE Transactions on Information Forensics and Security 3, 3 (8), [OMT] OHBUCHI R., MUKAIYAMA A., TAKAHASHI S.: A frequency-domain approach to watermarking 3d shapes. Computer Graphics Forum 1, 3 (), , 7, 8 [Pey8] PEYRÉ G.: peyre/, 8. 5 [PHF99] PRAUN E., HOPPE H., FINKELSTEIN A.: Robust mesh watermarking. In SIGGRAPH 99 (1999), ACM Press, pp [RP5] ROBERT A., PICARD J.: On the use of masking models for image and audio watermarking. IEEE Transactions on Multimedia 7, 4 (5), [SCOL 4] SORKINE O., COHEN-OR D., LIPMAN Y., ALEXA M., RÖSSL C., SEIDEL H.-P.: Laplacian surface editing. In Symposium on Geometry Processing (4), EG Press, pp [SWK8] SALMAN M., WORRALL S., KONDOZ A.: An efficient steganographic algorithm for 3-d models. In International Conference on Signal Processing (8), pp [UCB4] UCCHEDDU F., CORSINI M., BARNI M.: Waveletbased blind watermarking of 3d models. In Workshop on multimedia and security (Magdeburg, Germany, 4), ACM Press, pp [WC5] WANG C.-M., CHENG Y.-M.: An efficient information hiding algorithm for polygon models. Computer Graphics Forum 4 (5), , 8 [WH9] WANG Y.-P., HU S.-M.: A new watermarking method for 3d models based on integral invariants. IEEE Transactions on Visualization and Computer Graphics 15, (9), [WLDB8] WANG K., LAVOUE G., DENIS F., BASKURT A.: A comprehensive survey on three-dimensional mesh watermarking. IEEE Transactions on Multimedia 1, 8 (8), [YIK3] YU Z., IP H. H. S., KWOK L. F.: A robust watermarking scheme for 3d triangular mesh models. Pattern Recognition 36, 11 (3), [YPSZ1] YIN K., PAN Z., SHI J., ZHANG D.: Robust mesh watermarking based on multiresolution processing. Computers & Graphics 5, 3 (1), [YY99] YEO B. L., YEUNG M. M.: Watermarking 3d objects for verification. Computer Graphics and Applications 19, 1 (1999), [ZTP5] ZAFEIRIOU S., TEFAS A., PITAS I.: Blind robust watermarking schemes for copyright protection of 3d mesh objects. IEEE Transactions on Visualization and Computer Graphics 11, 5 (5),