Further Attacks on Yeung-Mintzer Fragile Watermarking Scheme

Transcription

1 Header for SPIE use Further Attacks o Yeug-Mitzer Fragile Watermarkig Scheme Jiri Fridrich, Miroslav Golja, ad Nasir Memo a Departmet of Systems Sciece ad Idustrial Egieerig, SUNY Bighamto, Bighamto, NY b Departmet of Electrical Egieerig, SUNY Bighamto, Bighamto, NY c Departmet of Computer Sciece, Polytechic Uiversity, Brookly, NY ABSTRACT I this paper, we describe ew ad improved attacks o the autheticatio scheme previously proposed by Yeug ad Mitzer [1. Previous attacks assumed that the biary watermark logo iserted i a image for the purposes of autheticatio was kow. Here we remove that assumptio ad show how the scheme is still vulerable, eve if the biary logo is ot kow but the attacker has access to multiple images that have bee watermarked with the same secret key ad cotai the same (but ukow logo. We preset two attacks. The first attack ifers the secret watermark isertio fuctio ad the biary logo, give multiple images autheticated with the same key ad cotaiig the same logo. We show that a very good approximatio to the logo ad watermark isertio fuctio ca be costructed usig as few as two images. With color images, oe eeds may more images., evertheless the attack is still feasible. The secod attack we preset, which we call the `collage- attack is a variatio of the Hollima-Memo couterfeitig attack. The proposed variatio does ot require kowledge of the watermark logo ad produces couterfeits of superior quality by meas of a suitable ditherig process that we develop. 1. INTRODUCTION Yeug ad Mitzer [1 proposed the followig method for autheticatio of digital images. The process of image autheticatio starts with a secret key that is used to geerate a key depedet biary valued fuctio f, f: {, 1,, 255} {,1}, that maps itegers from to 255 to either 1 or. For color images, three such fuctios (or biary lookup tables), f R, f G, f B, oe for each color chael, are geerated. These biary fuctios are used to ecode a biary logo L. I order to embed a watermark, gray scale images are perturbed to satisfy the followig expressio For a RGB image, the three color chaels are perturbed to obtai L(i,j) = f g (g(i,j)) for each pixel (i,j). (1) L(i,j) = f R (R(i,j)) f G (G(i,j)) f B (B(i,j)) for each pixel (i,j). (2) I additio to this process, sice origial pixel values are modified durig watermark isertio, Yeug ad Mitzer use error diffusio to maitai proper average color over the image i ay local regio. Although the error diffusio step is crucial i suppressig ay aoyig artifacts that might be itroduced durig watermark isertio, it is ot of iterest i our discussio. This is because, for all practical purposes, the image that is obtaied after watermark isertio is treated as ``the'' origial image whose itegrity is to be verified by subsequet extractio of the embedded watermark logo ad checkig it for ay modificatios. Hece ay chages made while arrivig at this origial image are ot of iterest to a potetial attacker. Furthermore, i later versios of the techique, Yeug ad Mitzer also scramble the biary logo prior to embeddig. Agai this scramblig process is ot relevat to the type of attacks described here ad hece for the sake of brevity we chose to igore it. Oce a watermark is iserted, image autheticity is the easily verified by checkig the relatioship L(i,j) = f g (g(i,j)) for each pixel (i,j). Note that the autheticatio process requires kowledge of the biary lookup tables or the secret key used to geerate them.

2 There are some obvious advatages of this approach. First, the logo itself ca carry some useful visual iformatio about the image or its creator. It ca also represet a particular autheticatio device or software. Secod, by comparig the origial logo with the recovered oe, oe ca visually ispect the itegrity of the image ad readily idetify croppig. Third, the autheticatio watermark is embedded ot oly i the LSB s of the image but somewhat deeper (± 5 gray scales). This makes it somewhat more secure ad harder to remove. Fourth, the method is fast, simple, ad ameable to fast ad cheap hardware implemetatio. This makes it very appealig for still image autheticatio i digital cameras or for autheticatio of digital video. However, i order to use this autheticatio scheme i digital cameras, oe eeds to clarify the importat issue of key (ad logo) maagemet. To the best kowledge of the authors, this issue has ot bee properly addressed i the literature before. I Sectio 2, we demostrate that if the same logo ad key are reused for several images, oe could easily recostruct the logo as well as the biary lookup tables from a relatively small umber of images. Oe possibility how to make this attack more difficult to mout is to let the biary fuctios deped ot oly o the colors but also o the pixel positios i, j as suggested i [5. That this measure is ot eough is demostrated i Sectio i which we preset aother couterfeitig attack (the collage attack) ad optimize its performace. The collage attack was itroduced first by Hollima ad Memo i [2 as a special case of a substitutio or couterfeitig attack, which applied to a large class of block-based watermarkig techiques. However, Hollima ad Memo assumed the attacker kows the biary logo. Here we demostrate that the attack ca still be carried out eve if the logo is ot kow. Furthermore, we develop special ditherig techiques to improve the quality of the couterfeit that is costructed. We demostrate how the quality of couterfeit images (a aspect igored by Hollima ad Memo ca be sigificatly improved with the proposed ditherig process. Fially, i Sectio 4 we coclude the paper ad discuss simple modificatios that ca be made to the Yeug-Mitzer scheme to prevet the kid of attacks described here. 2. INFERRING THE SECRET BINARY FUNCTION AND THE WATERMARK LOGO Recetly, Memo, Shede ad Wog [5 showed that the ucertaity i the secret biary fuctios or lookup tables f R (), f G () ad f B () ca be sigificatly reduced give a sequece of watermarked images cotaiig the same logo, which was assumed to be kow. I this sectio we show that kowledge of the logo is ot ecessary. First we show that for gray scale images the look-up tables ca be mostly recostructed usig as few as two images. For the color case we eed may more images or the watermark image eeds to have sufficietly structure. Case 1: Gray scale images - If the same logo lookup tables are used for multiple images, both the logo ad the biary fuctios ca be almost completely recovered from as few as two grayscale images. Give two watermarked grayscale M N images U ad V with gray scales u ad v, watermarked with the same secret key K ad a biary logo B, oe ca write L(i,j) = f g (u(i,j)) = f g (v(i,j)) for every pixel (i,j). () This costitutes M N equatios for 256 ukows f g (), f g (1),, f g (255). Most of the equatios are redudat ad, depedig o the image, there may ot be a uique solutio f g. We ca start with the set {, 1,.., 255} divided ito 256 subsets, each subset havig exactly oe gray scale level. The, the first equatio, f g (u(1,1)) = f g (v(1,1)), tells us that the values of f g are the same for both u(1,1) ad v(1,1). Thus, we ca group together these two gray levels because the value of the biary fuctio f g is the same for both. Gradually, the 256 subsets will start to coalesce ito a smaller umber of larger subsets. At the ed, there will be two large subsets, oe correspodig to f g =, the other to f g = 1, ad several other sets for which the value of f g is udetermied. To test the plausibility of this idea, we have performed experimets with several grayscale images. Two test images have bee watermarked with the same biary logo ad the same biary fuctio f g. The system of equatios () was the solved to recover the biary fuctio f g. Three test images, 'Lea', 'Airfield', ad 'Bridge', are show i Figures 1. Usig the images 'Lea' ad 'Airfield', we were able to determie 24 values for f g. Combiig the watermarked images 'Airfield' ad 'Bridge' gave us 22 values for f g. This is a uacceptable leak of iformatio, which clearly idicates that the biary lookup table ad the logo should ot be reused for more tha oe image. With icreasig umber of available images, the umber of correctly recovered values of the biary fuctio f g quickly saturates at 256.

3 Figure 1 Test image 'Lea' Figure 2 Test image 'Airfield' Figure Test image 'Bridge' Case 2: Color images: I [5, Memo, Shede ad Wog showed that if the biary logo L is kow tha the ucertaity i the biary fuctios f R, f G, ad f B ca be sigificatly reduced. They cocluded that, i some cases, the biary look-up tables ca be reduced to as few as four possibilities, give a sigle image. However, as we show here, kowledge of the biary logo L is really ot ecessary. The biary fuctios f R, f G, ad f B ca still be mostly recostructed provided we have a sufficiet umber of images cotaiig the same logo ad watermarked usig the same key. That is, a similar attack as the gray scale case described above ca also be mouted for color images, although the umber of images eeded for recostructig the biary fuctios f R, f G, ad f B is much higher. This is because whereas i the grayscale image case we had 256 sets to begi with, i the color case we have as may as 2 24 for 24 bit images. Assumig a 24 bit color image for the sake of discussio, we start with the colors (,, ) partitioed ito 2 24 sets, with each color beig i a separate set. The, give a sequece of images X 1,, X k let X i,j deote the set of pixels i the sequece at locatio (i,j). If the same logo is embedded i each image i the sequece X 1,, X k the all the pixels i the set X i,j map to the same value L(i,j), which ca be either or 1. Now if two such sets say X i,j ad X k,l have a o-empty itersectio, the clearly all pixels i these two sets agai map to the same value ad hece ca be grouped together. We cotiue i this maer groupig together sets that have a o-empty itersectio ad stop whe we have all pixels partitioed ito exactly two sets. I practice we do ot expect to get exactly two sets but if f most of the pixels fall ito two sets the we have sigificat iformatio about the biary lookup tables. That is, we kow the value of f R ( ) f G ( ) f B ( ) for a large majority of RGB triples. Note that this would be sufficiet to make modificatios to a image ad still have it autheticate. However we still do ot kow the idividual fuctios f R, f G, ad f B. These ca be deduced by usig the techiques give i [5 or by directly solvig a system of M N liear equatios i mod 2 arithmetic. No formal aalysis of this issue has bee performed as yet. The authors believe that the fact that the watermarkig techique has certai serious security weakesses for gray-scale images is a sufficiet argumet for modificatio Note that replacig the liear expressio (2) with a more complicated expressio ivolvig quadratic or other o-liearity s with the hope to make the umerical solutio of the system of equatios impractical, is ot likely to brig a sigificat improvemet. This is because the umber of equatios exceeds the umber of ukows by a large margi ad the values of the oliear terms ca simply be added as aother set of ukows. I Sectio 4, we propose better coutermeasures agaist this attack.. THE COLLAGE ATTACK The secod problem described i this paper is actually commo to all watermarkig schemes i which the watermark is embedded locally ad does ot deped o the image idex. This attack will apply to eve more geeral schemes i which the biary fuctio depeds ot oly o the gray level (color) but also o the pixel positio i, j i the image. We call the attack the collage attack. The collage-attack is a variatio of the Hollima-Memo couterfeitig attack o blockwise idepedet watermarkig techiques [2. However, i their attack of the Yeug-Mitzer techique, Hollima ad Memo had assumed the watermark logo is available to the attacker. However, we show here that the attack is possible eve whe the biary logo is ot kow. I this case the attacker just eeds a larger umber of images watermarked with the same key ad logo. Furthermore, Hollima ad Memo did ot cosider the quality of the recostructed image i their attack. Here we show that

4 uless care is take the couterfeit image could be of poor quality. We the give techiques for producig high quality couterfeit images. The basic idea behid the collage attack is to create a ew image from multiple autheticated images by combiig portios of differet images while preservig their relative spatial locatio withi the image. More geerally, give multiple M N images I 1, I 2,, I autheticated with the same logo ad biary fuctios, we ca costruct a ew image (a collage) J by selectig pixels from all images, while preservig the relative locatio of the pixels i the images: J(i,j) = I k (i,j) for some k {1,, } ad all (i,j). The ew image J will be authetic if its autheticity is checked with the same logo ad biary fuctios used for autheticatig images I 1,, I. Give a large umber of images I 1, I 2,, I with RGB colors (R k (i,j), G k (i,j), B k (i,j)), k = 1,,, a pirate ca take a arbitrary image I with RGB colors (R(i,j), G(i,j), B(i,j)), ad create a approximatio to I by selectig the closest colors from all images for every pixel (R, G, B) = (R k, G k, B k ) with k = mi arg k { (R R k ) 2 + (G G k ) 2 + (B B k ) 2 }, (4) where the last expressio eeds to be evaluated for every pixel (i,j). I the ext sub-sectio we calculate the expected value of the differece I J (i square orm) depeds o the umber of images i the database,, based o some simple assumptios about the images. We the itroduce a modified ditherig algorithm to further improve the visual quality of the forgery J. The sectio is closed with several examples of forgeries geerated from a database cotaiig = 2, 8, ad images. Calculatio of Expected Distortio i Couterfeit: We model the statistical distributio of colors i the images simply as a uiform distributio of colors i the color cube. I what follows, we also assume that the space of all possible RGB colors is scaled to a uit cube C ad that the color values are triples of real umbers. Let D be the distace betwee two radomly chose colors i the color cube C. The fuctio F(x) = P(D < x) is a o-decreasig probability distributio fuctio with F() =, F(a) = 1 (a = for Euclidea metric i the color cube ad a = 1 for the maximal metric). We further deote F (x) = P(D x). The expected value E(D) of the distace betwee two radomly chose colors i C is a a E( D) = x. F' ( x) dx = F ( x) dx. We approximate the average error due to quatizatio i Eq. (4) as the expected value of the distace betwee a radomly chose color ad the earest color out of other radomly chose colors a E( D, = F ( x) dx. The probability F (x) = P(D x) = V ( B( z, x) C) dz = 1 4/ π x + O(x 4 ), where V( ) deotes the volume ad B(z, x) is a z C ball with ceter i z ad radius x. To fid out about asymptotic behavior of this itegral for large, it will become clear that it is sufficiet to calculate the cubic term oly. Now we eed to fid the asymptotic expressio for E(D, for large : a a 4 4 E( D, = F ( x) dx (1 π x + O( x )) dx. The asymptotic behavior of this itegral for large ca be obtaied usig the well-kow Laplace techique [4, pp E ( D, Γ( )( ) = Γ( ) =.554 4π 6 π Fially, the average mea square error betwee the origial image I ad its forgery J obtaied froma database of images is.

5 1 I J = 2 1 [ I( i, j) J ( i, j).7. MN i, j 2 Improvig Couterfeit Quality by Error Diffusio: It is possible to improve the visual appearace of the forgery by diffusig the quatizatio error usig a mechaism similar to error diffusio. However, the stadard error diffusio does ot work well i this case because the palette is differet for every pixel ad the palette color distributio does ot fill out the color cube uiformly. The resultig effect is that error diffusio mechaism causes a "spillage" of colors whe the diffusio comes to a boudary betwee two colors. This leads to poor forgeries that actually look worse tha the simple approximatio based o Eq. (4). To fix this problem, we employ a decay factor that suppresses the error ad avoids the above-metioed spillage of colors. The ew color c i ' at pixel i ca be expressed usig the origial color c i as c' i = c i decay error i error i = closest_color i 1 c' i 1. We ote that decay=1 i the classical error diffusio techique. The purpose of the decay factor is to prevet the error from growig due to a lack of colors at a give pixel. The error grows especially fast i regios cotaiig a uiform color c while the available colors from the image database are all far from that color c. This happes whe the color c is located close to a face, a edge or the vertex of the color cube. Let us look at the case of the vertex first. Let D v be the distace of a radomly chose color from a vertex. We have P(D v x) = (1 4/π x /8), for x 1. The expressio for the probability becomes more complicated for x > 1 but, fortuately, it is eough to otice that max(p(d v x)) = m < 1 for 1< x to obtai Therefore 1 4 E ( Dv, = [1 ( x π ) dx + O( m ) / 2 4 E( D, ) [1 ( x ) 2 [1 v π dx = t dt = 2E( D, 2 π. The expected values for a edge ad face colors ca be calculated similarly: / 4 4 E( D, ) [1 4 [1 e π x dx = πt dt = 4 E( D,, / 2 4 E( D, ) [1 2 [1 f π x dx = πt dt = 2 E( D,. 2 The accumulated error after processig K pixels i a row becomes Because E(error i+k ) E(D v,, we have error i+k decay ( error i+k 1 + decay ( error i+k decay error i )) < < decay error i+k 1 + decay 2 error i+k 2 + E(error i+k ) decay/(1 decay) E(D v, for all K.

6 Origial image Origial image Forgery without diffusio (2 database images) Forgery without diffusio (2 database images) Forgery with diffusio (2 database images) Forgery with diffusio (2 database images) Figure 4 Examples of two images ad forgeries obtaied usig the simple approach based o Eq. 4 (without error diffusio ad with the diffusio ad the optimal decay factor (with diffusio. Oly 2 database images were used i this Figure.

7 This error should ot grow above certai maximal value durig our ditherig process. I particular, we do ot wat to obtai a color outside the color cube. Thus, we require that the error be smaller tha oe half of the diameter of the cluster of available colors [ 2 E(D v, /2. This gives us a upper boud for decay: decay/(1 decay) E(D v, [ 2 E(D v, /2, or decay 1 2/ E(D v,. O the other had, the decay should ot be too small otherwise o error would be diffused to eighborig pixels. Cosequetly, we choose the decay value equal to the upper boud 4β decay = 1 2/ E(D v, = 1, where β = Γ( ) π Our umerical experimets with differet images ad decay factors ideed cofirmed that this value of decay gives us the most pleasig results (see Figure 4, 5, ad 6). We have performed a series of experimets o a database cosistig of color images with 5 25 pixels. As these figures show, the improvemet obtaied by the proposed diffusio process is ideed sigificat, especially whe fewer images are available for costructig a forgery. Forgery without diffusio (8 database images) Forgery without diffusio (8 database images) Forgery with diffusio (8 database images) Forgery without diffusio (8 database images) Figure 5 Examples of two images ad forgeries obtaied usig the simple approach based o Eq. 4 (without error iffusio ad with the diffusio ad the optimal decay factor (with diffusio. Total of 8 database images were used i this Figure.

8 Origial image Forgery with diffusio ( database images) Origial image Forgery with diffusio ( database images) Origial image Forgery with diffusio ( database images) Figure 6 Examples of images ad their forgeries obtaied usig a database of images ad error diffusio with a decay factor.

9 4. CONCLUSION AND COUNTERMEASURES There are several possibilities how to prevet the attacks described i Sectios 2 ad. I [5 Memo, Shede ad Wog suggest makig the watermark extractio fuctio depedet o the positio of the pixel This ca be doe, for example by addig two more look-up tables f I ad f J that take the row idex i ad colum idex j ad also output a zero or a oe value which are the XOR'ed with the values produced by the f R, f G ad f B look-up tables to yield the watermark bit. I other words, we have L{i,j} = f R (R(i,j)) f G {G(i,j)) f B (B(i,j)) f I (i) f J (j). Although the above strategy makes the attacks outlied i sectio 2 ieffective, it is ot eough to prevet the collage attacks preseted i sectio. It appears that the simplest solutio would be to make the watermark deped o a image idex. This would solve the collage attack completely, ad sice the biary fuctios f ad the logo L ca also be made idex-depedet, we could ot apply the first attack either. However, ow we eed the idex i order to autheticate the image. A exhaustive search may ot be a plausible approach because of a potetially large umber of autheticated images (video-frames, for example). A better idea would be to embed the idex i the image usig a key uiquely associated with a particular digital camera or a movie. The idex caot be embedded i the whole image because tamperig with a portio of the image would result i a coclusio that the whole image has bee tampered with. Thus, the idex eeds to be embedded multiple times i small blocks. The idex, however, should be embedded i a robust maer so that the correct idex is extracted eve from slightly modified blocks. However, robust embeddig leads to larger distortio cotributig to the distortio due to the fragile watermark. Obviously, the robust watermark must be embedded as the first watermark. To achieve at least moderate robustess of the idex watermark, we may have to icrease the block size to at least pixels. Assumig the idex ca be captured usig 2 bits, we are takig a potetially large risk that tamperig with a very spatially localized block feature will cause a erroeous idex extractio. Icreasig the block size will egatively ifluece the ability of the autheticatio scheme to localize chages. Hece we propose a differet approach to thwart the attacks described i Sectios 2 ad. We observe that makig the biary fuctio f deped o more tha oe pixel ca thwart the first attack. For example, assumig we are scaig the picture by rows, we ca iclude a fixed radom collectio of eighbors from the portio of the image that has already bee modified. The lookup tables ca be replaced with a mappig derived from a secure block ecryptio algorithm to prevet attacks based o calculatig the lookup tables. The attack described i Sectio 2 will ot be successful for this scheme because of a large umber of possible combiatios of values of the biary fuctio f. It is also ot kow which pixels cotribute to the curret pixel. O top of this, the secure block ecryptio algorithm provides additioal feature of security makig the first attack impractical. To eable detectio of collages, we eed to embed the image idex ito the image. We suggest to embed this idex ito every small, 2 2 block ito radomly chose pixels (the selectio of pixels is the same for every block). The embeddig of the idex ca be itegrated ito the autheticatio scaig process described i the above paragraph simply by makig a additioal request wheever we are at a pixel that will carry iformatio about the idex. We request that ot oly f(p) = Logo(p) but also g(p) = idex bit for some fuctio g. I the autheticatio step, we first apply the detectio fuctio for the fragile watermark ad by lookig at the logo, we ca idetify portios of the image that have bee tampered with. We ca also determie if the image has bee cropped ad idetify boudaries of collaged portios from multiple images. To fid out if the collaged portios came from differet images, the image idices are recovered from each 2 2 block.

10 ACKNOWLEGEMENTS The work o this paper was partially supported by Air Force Research Laboratory, Air Force Material Commad, USAF, uder the grats umber F62-98-C-176 ad F62-98-C-9. The U.S. Govermet is authorized to reproduce ad distribute reprits for Govermetal purposes otwithstadig ay copyright otatio there o. The views ad coclusios cotaied herei are those of the authors ad should ot be iterpreted as ecessarily represetig the official policies, either expressed or implied, of Air Force Research Laboratory, or the U. S. Govermet. REFERENCES [1 M. Yeug, ad F. Mitzer. "A Ivisible Watermarkig Techique for Image Verificatio", Proc. ICIP'97, Sata Barbara, Califoria, [2 M. Hollima ad N. Memo. Couterfeitig attacks for block-wise idepedet watermarkig techiques. To.appear i IEEE Trasactios o Image Processig, March 2. [ M. Hollima, N. Memo, ad M. M. Yeug, "O the Need for Image Depedet Keys for Watermarkig", Proc. Cotet Security ad Data Hidig i Digital Media, Newark, NJ, May 14, [4 A. Erdélyi, Asymptotic Expasios, Dover Publicatios, Ic., New York, 1956, pp. 6. [5 N. Memo, S. Shede ad P. Wog. O the security of the Yeug-Mitzer Autheticatio Watermark. Proceedigs of the IS & T PICS Symposium, Savaah, Georgia, March 1999.