A ROBUST 3D WATERMARKING BASED ON FEATURE REGIONS

Transcription

1 A ROBUST 3D WATERMARKING BASED ON FEATURE REGIONS Saoussen Ben Jabra and Ezzeddine Zagrouba Institut Supérieur d informatique, Abou Raihane Bayrouni, 2080 l Ariana, Tunisia. Saoussen.bj@laposte.net, ezzeddine.zagrouba@fsm.rnu.tn ABSTRACT In this paper, a robust 3D mesh watermarking algorithm based on feature regions is proposed. In this algorithm, three classes of watermarking are combined. First, we segment the original image to many different regions. These regions will be classified to three classes: concave, convex and plane regions. For every type of regions we will choose a feature region which maximizes the curvature criteria. Finally, every feature region will be marked with the adequate algorithm based on its type. The experimentations show that our watermarking is robust against numerous attacks including RST transformations, additive random noise, cropping, simplification and remeshing. In plus, it gives a good invisibility and a blind extraction.. Index Terms 3D mesh, watermarking, feature regions, robustness, invisibility 1. INTRODUCTION With the development of internet, some information, such as text, image, sound, video and 3D model, is exchanged and transferred conveniently on internet. In this environment, an important issue is the copyright protection of these digital data and prevents unauthorized duplication of them. Digital watermarking technique is one of effective methods of protection copyright and information security. In fact, Digital watermarking, derived of the steganography, has been considered as a good technique to resolve the problem of copyright. It consists of inserting (generally under invisible shape) a signature into an image, then to try to get it back after any possible attacks on the image. It can be blind or not depending on whether the original image is needed at extraction or not. Usually, the signature must be robust it means that it must resist against the malicious attacks; this type of watermarking is designed to copyright protection applications. The watermarking can also be fragile for authentification applications. Robustness is often measured in terms of the number of watermarking attacks categories the watermark is able to resist. Most common categories of attacks are RST transformations (rotation, translation, scaling), geometrical attacks (noise addition, surface smoothing), resampling attacks (connectivity modifications such as simplification, subdivision, remeshing) and cropping. The remaining sections of this paper are organized as follows. A brief review of the 3D watermarking schemes is given in section 2. The proposed watermarking embedding scheme is described in section 3 and the experimental results are provided in section 4. Finally, section 5 summaries the proposed work and present the future work. 2. 3D WATERMARKING OVERVIEW 3D images are mostly represented by polygonal meshes. Basically, a mesh is a collection of polygonal facets. It possesses three different combinatorial elements: vertices, edges and facets. It can also be completely described by two kinds of information: the geometry information defines essentially the coordinates of all its vertices, while the connectivity (topology) information describes the adjacency relations between the different elements. Although there are many other 3D representations (such parametric surface, implicit surface and voxels), 3D mesh has been the most popular used representation of 3D objects thanks to its simplicity and usability. Compared to other audiovisual multimedia such as image, audio and video, 3D watermarking is relatively new and is not yet a mature technology. This situation is caused by the complexity of the meshes and the possible manipulations which can attack the watermarked meshes. Existing techniques concerning 3D meshes can be classified in two main categories, depending whether the watermark is embedded in the spatial domain or in the spectral domain. The spatial methods can modify geometry (point positions) or topology (connectivity). Harte et al. [1] have proposed a blind watermarking scheme to embed a watermark in the point positions. One bit is assigned to each point: 1 if the point is outside a bounding volume defined by its point neighborhood and 0 otherwise. This bounding volume may be either defined by a set of bounding planes or by a bounding ellipsoid. The Vertex Flood Algorithm (VFA) [2] embeds information in point positions. Designed for public watermarking, its high capacity is its main feature. Given a point p in the mesh, all points are clustered in subsets (Sk) accordingly with their distance to p. This point is the barycenter of a reference triangle R whose edges are the

2 closest to a predefined edge length ratio. Each non-empty subset is subdivided in m + 2 intervals in order to encode m bits. The distance of each point in a subset is modified so that it is placed on the middle of one of the m+2 intervals. Decoding does not need the original mesh and is simply achieved by reading point positions in the subintervals of each subset. Geometric algorithms can resist to geometrical attacks (translation, rotation, zooming and a combination of them). For extraction, geometric watermarking mostly can be blind. There exist very few watermarking methods using the mesh topology. Among this class of watermarking schemes, Ohbuchi et al. [3] have proposed four different watermarking algorithms. These schemes are Triangle Similarity Quadruple (TSQ), Tetrahedral Volume Ratio (TVR), Triangle Strip Peeling Sequence (TSPS) and Macro Density Pattern (MDP). TSQ modifies ratios between triangle edge lengths or triangle height and basis lengths. The invariant used by TVR is the ratio between an initial tetrahedron volume and the volume of tetrahedron given by an edge and its two incident triangles. These ratios are slightly modified to embed the watermark. The third scheme, TSPS, encodes data in triangle strips given the orientation of the triangles. Finally, Ohbuchi's MDP is a visual watermarking method which embeds the signature by changing the local density of points. The Triangle Flood Algorithm (TFA) is another connectivity-driven watermarking scheme developed by Oliver Benedens [4]. This scheme uses connectivity and geometric information to generate a unique traversal of all the mesh triangles. Point positions are modified to embed the watermark by altering the height of the triangles and also to enable the regeneration of the traversal. Topologic algorithms can resist to topologic attacks (simplification and remeshing). For extraction, topologic watermarking mostly can be blind. The spectral schemes methods embed information in a mesh transform domain. These transforms can be the mesh spectral decomposition, the wavelet transform or the spherical wavelet transform. The first scheme based on spectral decomposition has been proposed by Ohbuchi et al. in 2002 [5]. The signature was added to the low pseudo-frequency coefficients to obtain a good invisibility. Kanai et al. [6] have proposed the first scheme embedding in the wavelet transform domain. The watermark bits are embedded by modifying the least significant bits of the wavelet coefficients modulus. In order to minimize the visual impact of the watermark embedding, a selection of wavelet coefficients based on geometric thresholds is proposed. Watermark extraction is performed through the comparison of wavelet coefficients of the original and watermarked versions of the model. Extending this scheme, a blind watermarking algorithm has been presented more recently [6] that can ignore the original mesh information on the detector side. Spectral watermarking can resist to the cropping and filtering. The watermarking can use other proprieties of the 3D mesh like texture, 3D silhouettes... [7] separate the texture from the original 3D mesh and uses a 2D watermarking to insert the signature in the texture. This scheme is robust against the 2D attacks. Bennour et al. [8] propose a very different approach. They embed the watermark in 3D silhouettes of the mesh and retrieve it in 2D rendered views of the model. Therefore, no 3D data is necessary at the decoding side. Watermarking can also modify NURBS surfaces used in aided design conception for industry. A NURBS surface is composed by a set of control points denoted by P, a vector of weights denoted by w, and a knot vector denoted by U. The greater a weight component, the closer the NURBS surface to the corresponding control point. The U vector determines the influence area for a control point. The principle in [9] is to change the weight and the knot vectors so as to preserve the overall geometry. Such an algorithm is required mainly when marking CAD models, where the smallest alteration of the geometry would lead to errors in production. In [10], they consider that the NURBS may afford a natural extension from 2D to 3D data: they advanced a method where the mark is not embedded directly into the 3D model but into some virtual images derived from the 3D model. These algorithms can resist to 2D attacks and they are not blind. 3. PROPOSED APPROACH Based on the comparative study of the existing watermarking methods we observed that every class presents his own advantages and inconveniences. Besides, it is very difficult to find a method that verifies a good compromise between good invisibility of the marked image, robustness to the maximum attacks and blind detection. The idea that we conceived consists to profit from the advantages of three classes by combining them in one scheme. The three classes are topologic, geometric and spectral class. This choice allow us to obtain a robustness against geometric attacks due to the use of the geometric class, a robustness against remeshing and simplification thanks to the topologic class and a robustness against cropping and filtering by using the spectral class. In addition, these three classes have a blind detection. To combine these schemes, we applied an unrefined segmentation on the original image to obtain many different regions. These last ones will be classified to three classes: convex, concave and plane regions based on their curvature values. Then we select a feature region from every class to represent it. This feature region must maximize the curvature criterion for every class. Finally, every feature region will be marked using the adequate

3 scheme. The choice of the algorithm for every region will be based on the comparative study and experimental tests. The general algorithm of insertion decomposes into many stages: segmentation, region classification, feature region extraction and regions marking. The general algorithm of insertion is presented in fig 1. Convex regions Most Convex region Original image Segmentation Regions classification Concave regions Feature region extraction Most Concave region Plane regions Most plane region 3.1. Step 1: 3D Segmentation The first step in our approach is to decompose the original image into many regions. For obtain this decomposition, we applied a 3D segmentation algorithm. In fact, 3D Segmentation consists to transform an original 3D mesh into connected subsets of mesh called regions. There exist many 3D segmentation algorithms but we have implemented an algorithm which have the same principle of the segmentation proposed by L.Guillaume[11] because it decomposes the object into almost constant curvature triangle regions with precise edge boundaries. This will help us in the second step because our classification will be based on curvature measure. The general idea of this segmentation algorithm is composed of several steps. Firstly, discrete curvature is calculated for each vertex according to the work of Meyer et al [12]. Then vertices are classified into clusters according to their principal curvatures values. A region growing algorithm is then processed assembling triangles into connected labelled regions according to the vertex clusters. Holes between regions are filled taking into account boundary criteria. Finally a region adjacency graph is processed and reduced in order to merge similar regions according to several criteria (curvature similarity, size, common perimeter) Step 2: Regions classification The classification of the different regions given by the segmentation is achieved by using two measures: Gaussian and mean curvatures. In fact, these two measures permit to classify the regions in three classes: convex regions having positive mean curvature and positive Gaussian curvature, concave regions having a negative mean curvature and positive Gaussian curvature and plane regions having Gaussian curvature almost equal to zero. Estimating the mean curvature on a triangulated surface can be done by using the following formula: Topologic scheme Geometric scheme Spectral scheme Where angles αj and βj are two angles opposite to the edge e(i, j), A is the Voronoi surface in the point X and N(i) is the neighbourhood of the point X. The Gaussian curvature can be calculated using the following formula: Marked image Fig. 1. General architecture Where n is the number of triangles where i is a component. For every region we calculated the mean and the Gaussian curvature for every vertex. After the mean and Gaussian curvature of the region consist of the mean of the vertices curvatures.

4 3.3. Step 3: Feature region extraction In this step, we will order every class of regions and we will select one region from each class to represent it and to be marked with the adequate algorithm. This selected region will be chosen because it maximizes the curvature criterion for every class. This region will be the feature region. In fact, from the class of convex regions we will select the most convex region. This region must have the maximum of mean curvature with a positive Gaussian curvature. From the concave class the most concave region is the region which has the minimum of median curvature with a positive Gaussian curvature. For plane class the chosen region must have the most Gaussian curvature near to zero. After this step, we obtain three regions which represent the feature regions for our watermarking. In table 1, we present the curvature values to select a feature region from every class. TABLE I FEATURE EXTRACTION FOR EVERY CLASS Region type Feature region Convex max(km) &Km >0 & Kg >0 Concave max( Km ) &Km <0 & Kg >0 Plane Kg nearest to Step 4: Region watermarking Our main goal is to obtain a scheme of watermarking robust against the maximum of attacks, blind and invisible. To get the maximum of robustness, the idea consists to profit from the advantages of many classes of watermarking. So, we choose to use three schemes in one algorithm. These three schemes are: geometric, topologic and spectral scheme. These three schemes are chosen because the first permit to get robustness against geometric attacks, the second permit to the signature to be robust against remeshing and simplification and the last scheme allow obtaining robustness against filtering and compression. In more, the repetition of the signature in three regions helps us to detect the signature after a cropping of the marked image because if one marked region was destroyed by the cropping we can find the signature in the two others marked regions. In the other hand, the use of these three schemes allows to obtain a blind extraction because these algorithms don t need the original image at the time of the detection. In the comparative study, we observed that spectral watermarking give the maximum of invisibility when the insertion is done in low frequencies which correspond to the plane regions so we choose to mark the feature region for the plane class with spectral watermarking. For the two others classes of regions, we choose to mark concave feature region with geometric watermarking and convex feature region with topologic watermarking. This choice is based on experimental study. In fact, we have tested the two propositions and we have obtained the better visibility where we apply geometric algorithm on the concave region and topologic algorithm on the convex region Signature detection The detection of the signature decomposes in many stages where the three first stages are similar to those in insertion. In fact, the tested image will be segmented with the same algorithm used in insertion. After, mean and gaussian curvature of the obtained regions will be calculated to classify the regions to three classes: convex, concave and plane. After classification, the two feature regions for every class will be detected using the same criteria like insertion. In the fourth step, the adequate algorithm of detection will be applied on every feature region. So a geometric detector will be applying to concave feature region, a topologic detector will be applying to convex feature region and spectral detector to the plane feature region. Every detector will give 1 if the signature will be found in the region else it gives 1. If the three detectors give 0 so we decide that the image is not marked else if one of these three detectors give 1 we decide that the tested image is marked. These detectors are all blind they don t need the original image to detect the signature so our detector is blind. 4. EXPERIMENTAL RESULTS To evaluate our approach we applied it on a database of test images used usually in 3D applications. In plus, these images have different proprieties of number of points, number of regions and triangles and they have different proprieties of curvature. We will present here only four examples of this database: Cow, Fandisk, Porsche and rhino. Table 2 presents the different proprieties of these examples. TABLE II TEST IMAGES Images Vertices Triangles Regions Cow Teapot Fandisk Porsche Fig 2 presents the segmentation and the watermarking results for these four examples.

5 Teapot Fandisk We can observe that original and marked images are identical so the invisibility of our approach is good. In order to improve this result we have compared the invisibility of our approach with other approaches using only one of 3D watermarking class. For this, we have evaluated the mean square error (MSE) between the vertices composing the original and watermarked object, respectively. MSE can be written as: Porsche a- Original images Cow Where M is the total number of the mesh vertices and v i, v i are the vertices coordinates of the original mesh and watermarked mesh. We present in Fig 3 the MSE values for our approach and for geometric, topologic and spectral watermarking. b- Segmented images Fig. 3. Invisibility evaluation c- Marked images Fig. 2. Segmentation and watermarking results The MSE values for our watermarking are lower than the MSE values for the others algorithms. This is natural because our algorithm embed the mark only on four feature regions so it don t many damage the visual quality of the marked image. The most important criterion that must verify a watermarking algorithm is robustness against attacks. So a good watermarking must detect the presence of the mark in the image after many manipulations. To verify this criterion for our approach we have applied many attacks on the marked image. These attacks are the most used in 3D watermarking tests. After, we have applied our detector on this attacked image. In case of the success of the detection, the detector output must be 1 else 0. First, we have evaluated our watermarking algorithm against RST attacks (translation, scaling and rotation). We noticed the success of the retrieval of the signature after these three attacks. After, we have studied additive random noise on the vertices coordinates and Laplacian

6 smoothing of the mesh. We applied these two attacks with different parameters. Considering noise addition, we have focused on the noise power as the attack parameter. The parameter for smoothing is the number of iterations of the smoothing algorithm. For the four tested images the robustness against these two attacks is achieved if the noise power is <0.45 and the number of smoothing iterations is <20. Finally we cropped the 3D mesh by cutting 15% of vertices and we changed the meshing and we removed 1/8 of vertices. We observed that our algorithm is also able to detect the presence of signature after these three manipulations. Table 3 present a comparison between the robustness of our approach and the three other classes. TABLE III ROBUSTNESS COMPARISON Attacks Geometric Topologic Spectral Our approach RST YES NO NO YES Cropping NO NO YES YES Simplification NO YES NO YES Remeshing NO YES NO YES Noise NO NO YES YES In plus, our watermarking is blind. In fact, it doesn t need the original mesh during detection step. 5. CONCLUSIONS In this paper, we have presented a new approach of 3D image watermarking which combines three classes of insertion. This combination allows benefiting from the multiple advantages of each class. This is realized by segmenting the 3D image in unrefined regions having different values of curvature. These last ones will be classified to three classes: convex, concave and plane regions. Then we select from every class the feature region which maximizes the curvature value. Finally we mark these three feature regions with the adequate watermarking. We have presented first, existing methods using the two possible domains of insertion: spatial (geometric and topologic), spectral and the other types of watermarking. Then, we have presented the different steps of our method. A quantitative evaluation in terms of MSE was used to measure the quality of the marked image. The robustness of our new method was verified after application of various types of attacks such as RST transformations (rotation, scaling and translation), smoothing, random noise added to vertex coordinates, cropping vertices, simplification and remeshing. This is obtained through to the capacity of our detector to find signature from marked and attacked image. In perspective, this work can be completed by other studies which can improve it. Indeed, we can find new invariant parameters to the segmentation algorithm. These regions allow us to improve the robustness of the scheme. 6. REFERENCES [1] T. Harte and A. Bors, Watermarking 3d models, In Proc. of International Conference on Image Processing (ICIP), Rochester, NY, USA, volume 3, pp , Sep [2] O. Benedens. Two high capacity methods for embedding public watermarks into 3d polygonal models. In Proc. of the Multimedia and Security Workshop at ACM Multimedia 99, Orlando, FL, pp [3] R. Ohbuchi, H. Masuda, and M. Aono, Watermarking three dimensional polygonal models through geometric and topological modifications, In IEEE JSAC, pp , May [4] O. Benedens. Geometry-based watermarking of 3d models, IEEE Computer Graphics and Applications, pp January [5] R. Ohbuchi, S. Takahashi, T. Miyazawa, and A. ukayiama, Watermarking 3d polygonal meshes in the mesh spectral domain. In Proceedings of Graphics Interface, pp Jun [6] S. Kanai, H. Date, and T. Kishinami, Digital watermarking for 3d polygons using multiresolution wavelet decomposition, In Proc. Sixth IFIP WG 5.2 GEO-6, Tokyo, Japan, pp , December [7] E. Garcia and J.-L. Dugelay. Texture-based watermarking of 3d video objects. IEEE Trans. Circuits Syst. Video Techn., 13(8), pp ,2003. [8] J. Bennour and J.-L. Dugelay. Protection of 3d object through silhouette watermarking. In ICASSP 2006, 31st International Conference on Acoustics, Speech, and Signal Processing, Toulouse, France, May 14-19, [9] R. Ohbuci, H. Masuda, and M. Aono, A shap-preserving data embedding algorithm for NURBS curves and surface, in Proc. of the Computer Graphics Intl., pp , [10] J.J. Lee, N.I. Cho, and J.W. Kim, Watermarking for 3D NURBS graphic data, in Proc. of the IEEE Workshop on Multimedia Signal Processing, pp , [11] L. Guillaume, D. Florent, and B. Atilla, Constant curvature region decomposition of 3d meshes by a mixed approach vertex-triangle, Journal of WSCG, no.1-3, Vol.12, [12] Meyer, M., Desbrun, M., Schröder, P. et al, Discrete Differential-Geometry operators for Triangulated 2-Manifolds. International Workshop on Visualization and Mathematics, Berlin, Germany, 2002.