Multibit Digital Watermarking Robust against Local Nonlinear Geometrical Distortions Sviatoslav Voloshynovskiy Frédéric Deguillaume, and Thierry Pun CUI - University of Geneva 24, rue du Général Dufour 1211 Geneva 4 Switzerland http://watermark.unige.ch
Outline 1. Introduction 2. Watermarking as Communication with Side Information 3. Adaptive diversity watermarking 4. Affine transforms 5. Non-linear geometrical distortions 6. Results 7. Conclusions
1. Introduction Watermarking (WM) should mainly resist: geometrical attacks (desynchronization( desynchronization), e.g.: cropping, translation, rotation, rescaling, proportion change, row/column removal, general affine transforms, random local distortions signal processing attacks: non-linear and adaptive filtering, lossy compression (JPEG, JPEG2K), (re)quantization, multiple watermarks, noise addition Open questions for many existing WM technologies: random bending attack (RBA) projective transforms warping 3
2. Watermarking as Communication with Side Information (SI) Key p(y x,s) Message b Watermark Encoder s Attacking Channel Watermark Decoder s bˆ A State generator B Cover image x 4
2. Watermarking as Communication with SI SI is available at both encoder and decoder. Key Pilot Generator Pilot Generator Message b x Encoder c Image channel state estimation Watermark Embedder y Attacks y Watermark Extractor ŵ Geometrical distortion Estimator Recovery of synchronization Fading Estimator Decoder bˆ 5
2. Watermarking as Communication with SI These algorithms can operate under a wide class of uncertainties with respect to the channel state. The encoder is matched with the cover data and the decoder is adapted to the attacking channel variations assuming fading, non-gaussian attacks and geometrical transforms utilizing advantages of diversity watermarking. 6
3. Adaptive diversity watermarking Matched filter c i F 1 ( i) β 1 ( i) r(i) Decoder bˆ Pilot F J (i) β J (i) Pilot based channel state estimation Generalized channel: c = Fc + β Fading non-gaussian noise 7
3. Adaptive diversity watermarking Decoder for Fading and non Gaussian noise: was presented in [SPIE2001] Main goal of this paper: to consider the synchronization aspects of the adaptive decoder: global affine transforms random bending attack (RBA) projective transforms warping 8
4. Affine transforms An affine transform maps a point (x,y) T to (x,y ) T : x = y x A + d y a b and dx A = d = c d d y d = translation part, parameters: d x, d x A = linear part, parameters: a, b, c, d d is easily estimated, e.g. based on cross-correlation with a reference pattern with: 9
4. Affine transforms Original image: Affine transformed: 10
4.1. A self-reference watermark Message b Encoder c Encryption Allocation in the block Addition of reference WM, or pilot K Watermark 2 Tiling Upsampling Flipping For more details, see [EUSIPCO2000] 11
4.2. Estimation of affine transform parameters based on magnitude spectrum Magnitude spectrum peaks (after perceptual embedding) : Periodical WM : without compression with JPEG, QF=50%! Rotated periodical WM : - Fourier magnitude spectrum of WM => regular grid of peaks - The affine transform parameters can be estimated from this grid 12
4.2. Estimation of affine transform parameters The set of peaks is generally noisy: Â ˆ min x' x A = arg ρ A + µ Ω( A) A Φ y' y = estimate of the affine transform within the set of possible transforms ρ = cost function (quadratic norm for Gaussian model of misalignments, l 1 norm for Laplacian model) µ Ω(A) A Φ = regularization parameter a, b, c, d A = constraints on the coefficients in 13
4.2. Estimation of affine transform parameters Magnitude spectrum peaks Fitted affine parameters More details will be presented in [SPIE2002] 14
5. Nonlinear geometrical distortions Not all transforms are affine transforms: projective transforms random bending attack (RBA) warping Factors that complicate the WM extraction: perceptual masking function: reduce the WM energy in flat areas damaged areas: information is easily destroyed in flat areas by lossy compression or denoising splitting in non-synchronized parts, insertion in another image: collage attack => modeled as deep fade or erasure channels 15
5.1. Projective transforms, RBA, and warping Original image: Projected: RBA: Warped: 16
5.2. Collage attack Original image: Splitted: 17
5.3. Recovering from local distortions Main idea: The WM can be approximated by a set of local affine transforms as: w p ( x, y) w A m, n K x 1K y 1 m= 0 n= 0 w( A 1 T T m, n ( x, y) ( mt, nt) ) K K where: is the original WM block, repeated x y times with a period (block size) of T T, resulting in the periodical and distorted WM. w This approximation is valid due to the limited amount of local distortions introduced by RBA to preserve the image quality p 18
5.3. Recovering from local distortions First approach: local self-reference in local areas, take at least 4 WM blocks into account compute magnitude spectrum locally, and then estimate local transform A m, n (with constrains) locally symmetric WM => zero-phase condition Fragment of RBA distorted WM Magnitude spectrum Fitted parameters compensate Compensated fragment or ACF 19
5.3. Recovering from local distortions Second approach: local template matching local area ~ 1 block based on the known reference WM perform local (and constrained) template matching to determine A m, n Fragment of RBA distorted WM pilot matching compensate Compensated fragment 20
5.4. Local geometrical compensation advantages Based on local self-reference: self-reference => no need for explicit template matching area of several blocks => more WM energy available for local fitting and decoding, than in the template case small number of peaks => fast estimation of the local linear transform Based on local template matching: area of only one block => better chance to correctly approximate the local transform by an affine transform Adaptive diversity decoding: combine blocks based on the reliability of the reference WM or pilot 21
5.5. Application to video watermarking Motion-compensated video (eg( eg.. MPEG-1/2) I-frames: JPEG encoded frames P/B-frames: block-wise motion compensated frames, relatively to I/P-frames I-frames Video frames P/B-frame P-frames B-frames local displacements of WM ~ RBA + collage attack 22
6. Results Stirmark 3.1 score Signal enhancement 1,00 Compression (JPEG/GIF) 0,99 Scaling 1,00 Cropping 0,99 Shearing 1,00 Rotation (auto-crop, auto-scale) 0,99 Column & line removal 1,00 Flip 1,00 Random geometric distortions 1,00 Total score 0,996 23
7.. Conclusions The method is robust against non-linear geometric distortions: RBA, projective transforms, warping,... collage, partial erasure, In general, the method does not require a strictly periodical WM The The method can operate simultaneously on both hierarchical levels of global and local geometrical transforms The best known Stirmark 3.1 score = 99.6%! 24
References [SPIE2001] S. Voloshynovskiy, F. Deguillaume, S. Pereira and T. Pun, Optimal adaptive diversity watermarking with state channel estimation, Proceedings of SPIE: Security and Watermarking of Multimedia Content III, vol. 4314, San Jose, CA, USA, 22-25 January 2001 [EUSIPCO2000] S.Voloshynovskiy, F. Deguillaume and T. Pun, Content adaptive watermarking based on a stochastic multiresolution image modeling, EUSIPCO2000, X European Signal Processing Conference, Tampere, Finland, September 2000 [SPIE2002] F. Deguillaume, S. Voloshynovskiy and T. Pun Method for the estimation and recovering from general affine transforms in digital watermarking applications, Proceedings of SPIE: Security and Watermarking of Multimedia Contents IV, paper 4675-34, San Jose, CA, USA, 20-25 January 2002 (accepted) 25