SECOND GENERATION IMAGE WATERMARKING IN THE WAVELET DOMAIN

SECOND GENERATION IMAGE WATERMARKING IN THE WAVELET DOMAIN Thesis submitted for the degree of Doctor of Philosophy to the School of Sciences in the University of Buckingham 29 March 2005 By Martin Dietze Department of Information Systems

Contents Abstract Declaration Acknowledgements List of Acronyms x xii xiii xv 1 Introduction 1 1.1 Digital Watermarking......................... 2 1.2 Types of Watermarks......................... 2 1.3 Robustness of Copyright Watermarking............... 4 1.4 Objectives of this Work........................ 5 1.5 Contributions of this Work...................... 6 1.6 The Structure of this Thesis..................... 7 2 Background and Survey of Existing Techniques 8 2.1 Digital Image Watermarking..................... 8 2.1.1 Steganography: The Art of Hiding Information...... 8 2.1.2 Requirements for Robust Watermarking Systems..... 10 2.1.3 Categories of Watermarking Systems............ 11 2.1.3.1 The Embedding Domain.............. 11 2.1.3.2 Blind and Public Watermarking.......... 12 2.1.3.3 Image Adaptive Watermarking.......... 12 ii

2.1.3.4 Second Generation Watermarking......... 13 2.1.4 Attacks on Robust Watermarking Systems......... 13 2.1.4.1 Image Processing Attacks............. 14 2.1.4.2 Protocol Attacks.................. 16 2.1.5 The Human Visual System.................. 18 2.2 The Wavelet Transform........................ 19 2.2.1 What is a Wavelet Transform?................ 20 2.2.1.1 Wavelets....................... 20 2.2.2 Multiresolution Analsysis................... 21 2.2.2.1 Orthogonality.................... 24 2.2.2.2 Wavelet Properties................. 25 2.2.3 Two-dimensional Wavelet Decompositions......... 25 2.2.3.1 The Pyramid Decomposition........... 25 2.2.3.2 The Standard Decomposition........... 26 2.2.3.3 The Packet Decomposition............. 27 2.2.4 Applications for Wavelets in Imaging............ 27 2.2.4.1 Image Compression................. 28 2.2.4.2 Image Querying................... 29 2.2.4.3 Image Watermarking................ 30 2.2.5 The Use of Wavelets in this Research............ 30 2.3 Existing Robust Digital Watermarking Techniques......... 31 2.3.1 Schemes Operating in the Spatial Domain......... 31 2.3.1.1 The Patchwork Embedding............ 31 2.3.1.2 The SCS Embedding................ 32 2.3.1.3 Dual Channel Watermarking for Colour Images. 32 2.3.2 Schemes Operating in the DCT Domain.......... 33 2.3.2.1 Spread Spectrum Watermarking in the DCT Domain......................... 33 2.3.2.2 Towards Second Generation Watermarking Schemes 34 iii

2.3.3 Schemes Operating in the DWT Domain.......... 34 2.3.3.1 Embedding Multiresolution Watermark Images. 34 2.3.3.2 Two Schemes Using Zerotrees for Classification. 35 2.3.3.3 A Watermark in Significant DWT Coefficients.. 35 2.3.3.4 Image-adaptive Watermarking using Visual Models 36 2.3.3.5 Digital Image Watermarking using Secret Filters 37 3 The Tradeoff Between Image Quality and Watermark Robustness 38 3.1 The Choice of Filter and Embedding................ 38 3.1.1 Experimental Setup...................... 39 3.1.1.1 The Watermarking System............ 39 3.1.1.2 Watermark and Images.............. 41 3.1.1.3 The Watermarking Settings............ 41 3.1.1.4 The L q d Watermark Quality Measurement.... 42 3.1.1.5 The Test Procedure................ 45 3.1.2 Results and Discussion.................... 46 3.1.2.1 Image Degradation................. 46 3.1.2.2 Watermark Quality................. 54 3.1.2.3 Overall Results................... 61 3.2 An Alternative Attack........................ 63 3.2.1 The Attack.......................... 64 3.2.2 Experimental Setup...................... 65 3.2.3 Results and Discussion.................... 66 3.2.3.1 Image Quality................... 66 3.2.3.2 Watermark Robustness............... 66 3.2.3.3 Overall....................... 69 3.3 Conclusion............................... 70 iv

4 Geometric Attacks and the Dual Channel Approach 71 4.1 Second Generation Watermarking.................. 71 4.2 The Dual Channel Approach in the Wavelet Domain....... 73 4.2.1 The Original Idea....................... 73 4.2.2 The DWT-Dual-Channel Algorithm............. 74 4.2.3 The Quality Problem..................... 75 4.2.3.1 A Naive Approach................. 75 4.2.3.2 Three instead of Two Channels.......... 76 4.2.3.3 The Choice of Factors............... 76 4.2.4 An Implementation...................... 77 4.2.4.1 The Feature Detection............... 77 4.2.4.2 The DWT-PatchworkRegion Embedding..... 78 4.2.5 Experimental Setup...................... 79 4.2.5.1 Parameters..................... 79 4.2.5.2 Dual Channel Basic Setup............. 80 4.2.5.3 Dual Channel Fine-tuning............. 81 4.2.6 Experimental Results..................... 82 4.2.6.1 Robustness against JPEG Compression...... 82 4.2.6.2 Robustness against StirMark........... 83 4.2.6.3 The Feature Detection s Performance....... 85 4.2.6.4 The Embedding Techniques Performance.... 86 4.3 Discussion............................... 86 4.3.0.5 Channel Independence............... 86 4.3.0.6 Overall Performance................ 87 4.3.1 Conclusion........................... 88 5 A New Approach to Second Generation Watermarking 89 5.1 Training-based Feature Recognition................. 89 5.1.1 Marking an Image...................... 91 v

5.1.2 Reading a Watermark.................... 91 5.1.3 Classification of the new Approach............. 91 5.2 An Implementation.......................... 92 5.2.1 The WISARD Image Recognition Concept......... 93 5.3 Experimental Setup.......................... 95 5.4 Experimental Results......................... 96 5.4.1 Feature Recognition Performance.............. 96 5.4.2 Overall Performance..................... 99 5.4.3 Large Watermarks...................... 99 5.5 Discussion............................... 101 6 Conclusions and Further Work 103 Bibliography 106 Concept Index 111 A The Test Images 115 B Full Ranking Tables 117 B.1 Feature Recognition Rankings.................... 117 B.2 Training-based Robustness Rankings................ 124 vi

List of Tables 3.1 The 11 wavelet filters used in the experiments........... 41 3.2 Overall filter ranking, image degradation, DWT-Multiplicative.. 49 3.3 Overall filter ranking, image degradation, DWT-SCS....... 51 3.4 Overall average filter ranking, watermark, JPEG.......... 58 3.5 Overall average filter ranking, watermark, DWT.......... 59 3.6 Image degradation after noise reduction............... 67 3.7 Overall filter ranking, noise-reduction attack............ 67 3.8 Overall filter ranking, noise-reduction Antonini........... 68 3.9 Overall filter ranking, noise-reduction Daub4............ 68 5.1 The feature recognition performance using obvious embedding.. 97 5.2 The feature recognition performance using obvious embedding.. 100 vii

List of Figures 1.1 Principle Image Watermarking Framework............. 3 2.1 Plots of the Haar and Mexican Hat wavelets............ 22 2.2 Decomposition of a one-dimensional signal............. 23 2.3 Plots of the Daub4 scaling function and wavelet.......... 24 2.4 A Pyramid decomposition, applied one and then two steps..... 26 2.5 A Standard decomposition, applied two and then three steps.... 27 2.6 Two different possible stages of packet decomposition........ 28 3.1 The watermark before and after attacks............... 41 3.2 Histograms of lena512, subbands 1 and 1-2............. 43 3.3 Distribution of marked coefficients over subbands (Haar filter).. 47 3.4 Images christina57 and freske1 decomposed to two subbands... 48 3.5 Filter performance DWT-Multiplicative,subband depth, intensity 49 3.6 Filter performance DWT-Multiplicative, subband depth...... 50 3.7 Filter performance DWT-SCS, subband depth, intensity..... 51 3.8 Filter performance DWT-SCS, subband depth........... 52 3.9 Filter performance, subband depth................. 53 3.10 Image degradation resulting from marking............. 54 3.11 Performance DWT-Multiplicative, subband depth, JPEG quality. 55 3.12 Villa3 performance DWT-Multiplicative, JPEG factor....... 55 3.13 Antonini performance DWT-SCS, intensity............. 57 3.14 Daub6 performance DWT-SCS, intensity.............. 61 viii

3.15 Adaptive DWT-Multiplicative embedding.............. 62 3.16 Quad-tree structures resulting from the Pyramid decomposition. 64 4.1 Second Generation Image Watermarking Framework........ 72 4.2 The watermark images........................ 80 4.3 The StirMark attacked lena512 and the reconstructed image... 84 5.1 A new framework for Second Generation Image Watermarking.. 90 A.1 From left to right: barbara, boat................. 115 A.2 From left to right: goldhill, lena................. 115 A.3 From left to right: mandrill, peppers............... 116 A.4 From left to right: christina, freske1............... 116 A.5 From left to right: zelda, freske2................. 116 ix

Abstract Robust image watermarking aims to embed invisible information, typically for copyright protection applications, in images in a way that the watermark is robust against various image processing attacks. Such attacks can be divided into signal processing and geometric attacks leading to different requirements for achieving robustness against them. This thesis investigates approaches to robust image watermarking focusing on the type of watermarking techniques termed as second generation watermarking. This class of watermarking schemes increase robustness against geometric attacks by including the use of the image s perceptual features into the marking/detection process. Additional focus is put on the wavelet transform and its properties relevant for applications in robust image watermarking. Based on a comparative study of 11 wavelet filters and 2 embedding techniques on their suitability to achieve robustness against 3 signal processing attacks at acceptable image quality, factors for the optimal choice of filter and embedding technique for DWT-based robust watermarking are presented. Though the different filters performance largely depends on the kind of attack (which is usually beyond the watermarker s control) and the embedding technique, there is in fact one filter with good all-round capability with respect to the two usually contradicting requirements of maintaining good image quality and achieving robustness against attacks. This is particularly significant because this filter is relatively little known among watermarkers and has thus hardly if at all yet been used in watermarking applications. Within the course of this study, a new method to compare the original and the read watermark (both binary images) was developed. This method uses the wavelet domain s multiresolution property and mimics the way a human would decide about a watermark s quality. x

A novel wavelet-based method of applying the so-called dual channel concept for second generation watermarking schemes is presented. The dual channel concept is a measure to avoid interference of the watermark with the feature detection performed before detection. While the original dual channel concept was restricted to use on colour images in the spatial domain, representing images in a multi resolution Pyramid wavelet decomposition as channels is proposed, thus allowing to use this technique for any kind of image. Experimental results show that this application leads to robustness improvements in many cases; it can even be used to optimise existing watermarking schemes operating on a Pyramid decomposition of the image in the DWT domain. A new approach to second generation watermarking is presented. Instead of performing the same feature detection before embedding and reading the mark, we propose to use a training-based feature recognition method. This has the advantage of avoiding the capacity-limiting split of the image in logical channels, and using the watermark as part of the feature used for later detection instead of considering it as interference. The result is a watermarking scheme with improved robustness due to more reliable location of embedding positions in the marked image. Experiments show that this technique already achieves remarkable robustness against sophisticated combinations of image processing attacks. The experience from this research suggests that full robustness against the commonly used watermarking benchmarks that still defeat most of today s watermarking schemes is feasible. xi

Declaration The work presented in this thesis embodies my own research work. Where appropriate I have made acknoledgements to the work of others. No portion of the work referred to in this thesis has been submitted in support of an application for another degree or qualification of this or any other university or other institution of learning. xii

Acknowledgements A lot of people directly and indirectly contributed to this research work. The project started with being accepted for a DPhil project, so the first person I would like to mention is Dr Judith Jeffcoate of the University of Buckingham who met me to discuss a possible Ms project and found herself confronted with the fact that I had wanted to do a PhD instead. Her positive reaction was the reason for me coming to Buckingham where I met my supervisor, Dr Sabah Jassim, who is the person I have to thank most of all. His patience with me was endless, and so was his scientific curiosity which kept inspiring me and other people in the research group. I would also like to thank all the other people working and doing research in the Information Systems department at the University of Buckingham, in particular Prof. Chris Adams, Naseer Aljawad, Hongbo Du, Harin Sellahewa and Johan Ehlers who could often contribute inspirational ideas in our discussions and Julie Leach who was always there having an open ear for anything. In the first phase of the project and then again just before its final year I worked at the University of Applied Sciences in Wedel, Germany. Of all the people who work there and make it a wonderful place to work and study I need to thank Prof. Dr. Uwe Schmidt for just being there and being such a good (and supportive) friend, Prof. Dr. Andreas Kolb for his continued encouragement and advice, and Prof. Dr. Christian Bohn for hinting me at the idea of neural networks. Most of all, I would like to thank my family starting with my wonderful wife, Oksana, who often had a difficult time with me while I was working on this but who also was an inspiration by just being with me and showing me that life has many other things to offer than just research. My parents saw me taking a long time to first finish my degree and then start another one. They did more for me than I could ever thank them for, and I wish that I can pass on some of this to xiii

my children one day. Finally, I do not want to forget to thank the numerous people involved in developing open source software I had the pleasure to use in the course of the research project presented in this thesis. I believe that without the (free) availability of software like the Linux operating system, the gcc compiler suite, the Gimp, ImageMagick, Gnuplot and XFig graphics packages, the xemacs and vi editors and the L A TEXtypesetting package and many more, the work on this project would have been much more difficult and less fun! xiv

List of Acronyms CWT DCT DFT DWT HVS ISO JND JPEG MSE PCA PRNG PSNR Continuous Wavelet Transform Discrete Cosine Transform Discrete Fourier Transform Discrete Wavelet Transform Human Visual System International Standardisation Organisation Just-Noticeable Difference Joint Photographic Experts Group Mean Square Error Principal Component Analysis Pseudo Random Number Generator Peak Signal to Noise Ratio xv

Chapter 1 Introduction Computers and the Internet have long made their way into private living rooms, and activities of daily life, like writing letters, shopping, listening to music and watching movies now involve computing technology. The way computers deal with data digitised representation introduces new opportunities but also new problems: finding a reasonable compromise between user-friendliness and security is often difficult, goods like multimedia objects are technically a bunch of bits and bytes that can easily be perfectly copied and even redistributed, digital images can easily be manipulated making them unsuitable as proofs in criminal cases etc. There are various concepts aiming to solve some of these problems including legal protection, technical standards, digital rights management and copyright protection. For multimedia objects, like images, videos and sound files, two of the above problems apply in particular: the question of an object s authenticity, i.e. originality, and protection of copyright against pirating, or false ownership claims. Digital watermarking plays an increasingly important role for proving authenticity and copyright protection. Most multimedia file formats do not introduce any restriction on copying or manipulating multimedia objects; and while the Internet is an ideal medium for selling digital goods it also makes redistribution of pirated files very easy. Digital watermarking can be used to insert invisible data into an object helping to track down pirate copies and to prove rightful ownership in a dispute. In principle, watermarking technologies can be applied to any kind of multimedia object, however to achieve the best possible results schemes are normally optimised on a particular medium. 1

2 CHAPTER 1. INTRODUCTION 1.1 Digital Watermarking The term watermark has been known long before the age of computing: watermarks were found on bank notes to make falsification difficult or on writing paper to add an individual taste or corporate identity. On computers, such applications are possible, too: in 1994, the German software company StarDivision distributed free copies of their word processor StarWriter to visitors on the Hanover CeBit fair; the copies were fully functional, only that when printing documents from within the application, a watermark would be printed as the background of the document s pages. Other common applications for watermarks on computers include proof of rightful ownership and authentication for multimedia objects like images. Since multimedia objects are digital representations of analogue data (like sound, photos, movies) they tolerate some amount of manipulation as long as some rules are obeyed 1. If some pixels intensities in an image are changed subtly, the human eye is unlikely to notice this, yet these changes can carry information visible to the respective detection software. Figure 1.1 shows a digital image watermarking system s principle setup. In many cases there is an additional data item necessary for embedding or detection, like a secret key. Also, the kind of detection result obviously depends on the watermarking system s purpose and design in some cases the presence of a known watermark pattern is detected, in others a message of some kind (text, or even multimedia contents like images, audio etc.) is read. 1.2 Types of Watermarks Watermarking can serve various purposes, hence there are a number of different types of watermarks. In the literature (e.g. in [WPD99]), we find two main applications for digital image watermarking: Content authentication The watermark is used to prove authenticity, i.e. ensure that the image has not been manipulated in any way. This is useful whenever the originality of an image is important, like the protection of historical 1 In contrast, just changing random bytes of an executable program is likely to make it unusable.

1.2. TYPES OF WATERMARKS 3 Watermark Embedding Cover Image Embedding Algorithm Watermark Marked Image Watermark Detection Detection Algorithm Detection result: Watermark Probability Yes/No Marked Image Figure 1.1: Principle Image Watermarking Framework images and evidence before courts. Proof of rightful ownership The watermark is used to support claims on rightful ownership of an image. It can also help to detect unauthorised copies and by embedding serial numbers to track down the licensee from who a pirate copy originated. Consequently, two different types of digital image watermarks are needed: Fragile watermarks The watermark is destroyed by any manipulations of the image. Therefore originalness of the image is established if the watermark can still be read/detected. The watermark can be seen as a seal protecting the object s content, but unlike in the real world it does not restrict from read-only access. Robust watermarks The watermark survives a reasonable amount of image manipulation. The term reasonable means that the image quality after such

4 CHAPTER 1. INTRODUCTION manipulation should be high enough to maintain the image s value to users. Robust watermarks used for tracking down pirate copies are usually embedded per customer or group of customers; such marks are often referred to as fingerprints in the literature. Technically, this second category is the greater challenge since due to the nature of multimedia objects it is much easier to apply significant yet imperceptible changes than the other way round. Both kinds of watermarks must at the same time operate without causing perceptible distortion in the object; the actual thresholds of what is acceptable depend to a large extent on the application. Besides these two main types of digital image watermarks there can also be mixes of the above, e.g. fragile watermarks tolerating JPEG compression, or watermarks providing information about the kind of image manipulation after an attack. In general, watermarks can be either visible or invisible. Visible watermarks, also known as masks are often used to mark demonstration images to avoid commercial exploitation; also public libraries sometimes add visible watermarks to copies made from books, papers etc. However their relevance for fragile or robust watermarking is usually rather low most applications deal with original images that need to be of high quality. Therefore most such applications apply invisible watermarks. 1.3 Robustness of Copyright Watermarking The most common application of robust image watermarking is the protection of intellectual property. It is in the interest of the watermarker that the watermark survives all image processing operations that do not make the image commercially useless and that the watermark is considered as an appropriate proof by a court. An attacker will of course aim to find way to render watermarks (if there are any) unreadable and/or dispute the claims based on the watermark legally. Existing research has named a number of prerequisites for robust digital watermarks to make them suitable to help proving rightful ownership before court ([CMYY96, ZL97], see also section 2.1.4.2 for a brief summary), and it is generally believed that the necessary features outlined there can protect watermarking

1.4. OBJECTIVES OF THIS WORK 5 schemes against successful disputes over successfully detected watermarks. However robustness against image processing attacks is far more difficult to achieve. Already in 1998, Petitcolas et al. in [PAK98a] introduced the so-called Stir- Mark benchmark for copyright marking schemes on images which consisted of a combination of different image manipulation operations and was so powerful that the vast majority of schemes known at that time was unable to withstand it. The authors claimed that watermarking systems not robust against this benchmark should be considered unacceptably easy to break. There have been different approaches to make copyright marking systems more robust against such attacks. These concepts include transforming the object into some transform domain before embedding the mark. There are also many different ways to embed or detect a mark, strategies to choose image locations for embedding or reading it, even various ideas of what a watermark should consist of or how it should be organised before embedding it into an image. However, though StirMark is well-known and freely available, only few watermarking schemes proposed since then have claimed robustness against it which is a good indication that the current state of the art in image copyright marking is still far from having reached an acceptable level of robustness against attacks. To make things even worse, the robustness requirement often contradicts the requirement of maintaining an acceptable image quality after marking, so that often some watermark robustness has to be sacrificed to achieve a reasonable compromise between both these requirements. 1.4 Objectives of this Work This thesis is concerned with robust watermarking of digital images. The main objectives are: achieve or at least come close to robustness against the Stir- Mark watermarking benchmark while maintaining acceptable image quality. Existing research on robust image watermarking and image compression suggests that the Discrete wavelet transform (DWT) can provide a domain for embedding and reading watermarks with good properties for both, robust and invisible embedding and dealing with perceptual image features which is important for choosing and/or finding marking locations. A particular focus is thus put on investigating and exploiting the DWT s properties for robust image watermarking.

6 CHAPTER 1. INTRODUCTION 1.5 Contributions of this Work In the course of the research project presented in this thesis various aspects involved in robust image watermarking were investigated: Different wavelet filters were compared to establish their suitability for marking under consideration of image quality and robustness against a simple attack based on lossy compression. This included implementing two different embedding techniques. Since the various wavelet filters have different properties affecting both image quality and robustness, the optimal choice of filter can help optimising DWT-based watermarking schemes. The results from this research were published in [DJ02] and [DJ03]. A method to compare the detected watermark to the original (both binary images) was developed and implemented. It is based on the DWT s multiresolutional property and mimics the way a human looking at the watermark would decide about the watermark s quality. This method was introduced in [DJ02]. A novel concept that extends the dual channel concept introduced by Ker in [Ker01] on grey-scale images to the Wavelet domain for second generation watermarking was developed and implemented. Feature detection is used by second generation watermarking schemes to choose image locations for embedding and find marked locations for reading a mark. The dual channel concept helps to minimise side effects caused by the watermark on the feature detection before reading the mark. A new approach to second generation watermarking based on training and feature recognition with better robustness against attacks and more capacity than the DWT-based dual channel marking scheme was introduced, and a prototype application was developed and implemented. This approach uses the mark for better feature detection rather than considering it as a problem. The result is better robustness against geometric attacks on the watermark.

1.6. THE STRUCTURE OF THIS THESIS 7 1.6 The Structure of this Thesis In chapter 2, we review fundamental knowledge about image watermarking and the wavelet transform. We present the terminology, commonly used categorisation and basic techniques of both watermarking and attacks on watermarking schemes. We give a brief summary of the idea behind the wavelet transform, multiresolutional analysis, two-dimensional decomposition schemes and applications. We also survey existing research on robust image watermarking which was relevant to the research presented in this thesis. In chapter 3, we present the results of experiments aiming to compare different wavelet filters properties for watermarking while using two alternative embedding techniques. In these experiments we focus on attacks that do not include geometric operations. In chapter 4, we discuss how geometric attacks require a different approach to robust image watermarking, i.e. the image s perceptual features need to be included in the scheme. We present experimental results obtained with a new watermarking scheme aiming at more robustness against this kind of attacks. In chapter 5, we present a new approach to watermarking which includes the image s perceptual features, based on the conclusions drawn from the experimental results in chapter 4. We present an example implementation of this new concept and experimental results. In chapter 6, we present our conclusions from the results presented in this thesis and discuss possible courses of future research. The appendices 1 and 2 contain the test images and some selected tables of experimental results.

Chapter 2 Background and Survey of Existing Techniques In this thesis we present our research on digital image watermarking which aims to embed information into digital images. The purpose and the techniques used for this can differ. The first section provides an introduction to history, requirements, categorisation and terminology of digital image watermarking. The second section gives an overview on the wavelet transform which played an important role in the research presented in this thesis. 2.1 Digital Image Watermarking In this section, we summarise relevant knowledge and terminology related to digital image watermarking. Techniques, terms or attacks particularly relevant for the research presented in this thesis are highlighted. 2.1.1 Steganography: The Art of Hiding Information Invisible watermarking is a kind of data hiding, also known as steganography. The name steganography originates from the Greek word steganos which roughly translates to concealed writing. Applications and techniques of steganography can be traced back into antiquity; in [PAK99] and [AP98], a number of examples on 8

2.1. DIGITAL IMAGE WATERMARKING 9 classic steganography including the use of invisible ink or the use of acrostic 1 in text are given. In contrast to cryptography 2, where the existence of secret encrypted data is usually obvious or at least likely, steganography aims to hide the existence of such data completely. In history all cryptographic systems were broken at some time, either by cryptanalysis or by treachery; Petitcolas et al. state that in many operational contexts until today steganographic techniques have been preferred even if cryptography was available [PAK99]. Throughout this thesis, we adopt the following conventional terminology on steganography [PAK99]: A secret message is embedded into the cover-text, cover-image or some other kind of stego-object. For reading the message, a secret stego-key is necessary. The most commonly used model for steganographic communication was provided by Simmons et al. in [Sim84]. Two prisoners, Alice and Bob want to prepare an escape plan. Warden Willie can read all their communication and even punish them if he finds anything suspicious (like obviously encrypted messages). Thus Alice and Bob need to conceal the existence of anything secret in the messages they exchange. The question arising from this scenario is whether a channel for exchanging hidden information undetectable by Willie can be found. In the simplest of cases, Willie is assumed to be a passive warden. This means that the stego-technique is broken once he finds out about the secret communication. In modern applications, like digital image watermarking, this can no longer be expected [AP98] Willie will most likely be an active warden. This means that he not only searches for hidden communication but can also modify the cover-text s content. The active warden creates the typical scenario a robust digital image watermarking scheme has to deal with. It makes steganography more difficult, but not impossible, and it needs to be considered in the design of watermarking or other steganographic systems. In particular the obvious concept of hiding information in the cover-text s most insignificant components is likely to fail here, since the warden can do basically the same by adding random noise to those very components thus rendering the secret message unreadable. Craver et al. thus point 1 An acrostic is a poem or some other text written in an alphabetic script, in which the first letter of each verse, paragraph, or some other recurring feature in the text spells out another message (definition from [Wik04]). 2 (from Greek kryptós, hidden, and gráphein, to write ) is, traditionally, the study of ways to convert information from its normal, comprehensible form into an incomprehensible format, rendering it unreadable without secret knowledge the art of encryption (definition from [Wik04]).

10CHAPTER 2. BACKGROUND AND SURVEY OF EXISTING TECHNIQUES out in [Cra98] that if there is an active warden, the secret message must be embedded in the cover-text s perceptually significant information that the warden cannot change randomly without obviously altering the cover-text s contents. An example of this technique given by Craver is to embed hidden information in explicit state of affairs or description of characters in a novel. This can be at least partly applied to digital image watermarking systems, as we show in section 2.3. It needs to be mentioned that large parts of the above sources also deal with the question of public key steganography. This stands in analogy to public key cryptography [FAQ04] in that a publicly accessible key is used for creating the stego-object. This enables sender and receiver of a stego-message to communicate without sharing a secret; for the sender only the receiver s public key is necessary, and the receiver needs a secret key to access the hidden information. This can lead to increased security because the risk introduced by a shared secret is eliminated. Looking at the model of the prisoner s problem, this would mean that Alice and Bob were not able to exchange secret keys before they were imprisoned, but Bob has a public key known to Alice, so that she can embed information only Bob can read. The question arising from this scenario is how the two can now establish a secret channel for communication that cannot be destroyed by an active warden. In general, for a steganographic system to be secure the same principle applies as for cryptography: The method of embedding must be assumed to be known by the opponent, so the security must lie in the choice of key [PAK99, Ker83]. However in contrast to public key cryptography, there are more constraints on public key steganography [AP98]. 2.1.2 Requirements for Robust Watermarking Systems The requirements for watermarking systems depend on their actual application. In the research project presented in this thesis we were mainly concerned with robust digital image watermarking, and we have concentrated on the requirements relevant for proving rightful ownership and/or tracking down pirate copies according to [PAK99]: The mark should not degrade the quality of the image in any perceptible way, i.e. to humans the image after marking should look indistinguishable from before marking.

2.1. DIGITAL IMAGE WATERMARKING 11 The mark s detection should depend on a secret. Multiple marks should not have an effect on each other, i.e. merging images bearing different marks should result in an image with more than one mark instead of an image with a new mark. The mark should survive attacks aiming to render the mark unreadable. The particular attacks commonly used to do this are presented in section 2.1.4. As we will see later, a mark can hardly be optimised to satisfy all of these requirements at the same time; designing good watermarking techniques usually requires mastery in the art of compromise. 2.1.3 Categories of Watermarking Systems For digital image watermarking, in particular robust marking techniques, the classic steganography scenario applies to a large extent, however there is one exception: sender and receiver of the secret message are usually the same. Therefore the question how a key can be securely transmitted may not be of interest. Depending on a watermark s application there is even a new question a technique may have to deal with: is the watermark detection result qualified for proving rightful ownership or the cover-image s authenticity? Some research on digital image watermarking is dedicated to this particular question; relevant work on these issues is reviewed later in this section. In the rest of this subsection we now describe some commonly used classifications of watermarking systems according to different technical criteria: 2.1.3.1 The Embedding Domain The first distinction of importance is whether a watermarking scheme operates in the spatial or some transform domain [WPD99]. Traditional digital image watermarking schemes embed marks in image pixels directly (e.g. by manipulating the pixels least significant bits because this resulted in little or no visible artifacts in the image). It however turned out that such techniques could easily be broken by simple filtering or quantisation techniques [PAK98b]; often simple JPEG compression at high a quality setting would render the watermark unreadable. To

12CHAPTER 2. BACKGROUND AND SURVEY OF EXISTING TECHNIQUES overcome this problem, schemes operating in a transform domain were proposed. Such schemes first decompose the image using some transform like e.g. the discrete cosine transform (DCT) or discrete wavelet transform (DWT), embed the mark into transform coefficients and then apply the reconstruction operation to obtain the marked image. Such schemes are considered by many to have better properties than those operating in the spatial domain. There has been significant research on watermarks using either of the above embedding domains as we show in section 2.3. 2.1.3.2 Blind and Public Watermarking Secondly there is the important question of whether or not the original unmarked image may be used for watermark detection. If the original image is present, it becomes much easier to undo certain attacks to the marked image, and the detection result will most likely be more reliable. Such watermarking schemes are called non-blind or public watermarking, while schemes that do not use the original image are referred to as blind [PAK99]. Despite of its obvious technical benefits, non-blind watermarking introduces problems when it comes to proving rightful ownership. Zeng et al. point out in [ZL99, ZL97] that if the original image is used for watermark detection, the claim resulting from the detection results is actually based on the relationship of two images to each other: the original and the marked image. This can be exploited by counterfeit attacks aiming to invalidate the claim of ownership (see section 2.1.4 for a more thorough investigation of this issue). In general, blind watermarking is considered a necessary requirement for being able to prove rightful ownership. 2.1.3.3 Image Adaptive Watermarking Another aspect in the design of watermarking techniques is the fine-tuning of image degradation introduced by the watermark. Technically, every watermark degrades the cover-image, but the human eye is insensitive enough not to notice relatively minor image degradation for a fair amount of payload 3. Depending on the watermarking application the marking scheme needs to consider how much 3 This is exploited not only by watermarking techniques, like lossy image compression common in the Internet, e.g. JPEG.

2.1. DIGITAL IMAGE WATERMARKING 13 and what kind of degradation is acceptable. In robust watermarking, the requirement of little image degradation often stands in obvious conflict with the requirement of robustness against image processing attacks [Die02]. Therefore image adaptive watermarking uses the cover-image s properties around the embedding locations to determine the maximal intensity that can be used for embedding [WPD99]. There has been intensive research in this field including using models of the human visual system (HVS). The complexity of image adaptive watermarking techniques depends a lot on an image s embedding domain; creating and using visual models requires a lot of filtering and processing in the spatial domain, suffers from the partial loss of spatial support in the DCT or DFT (discrete Fourier transform) domains but is actually supported by the DWT (see section 2.2). 2.1.3.4 Second Generation Watermarking Finally, there are different ways in which watermarking schemes choose the embedding locations at marking and aim to find them back when detecting the mark. Some schemes simply mark all pixels (or coefficients), some choose and memorise particular coordinates. A relatively new class of techniques is called second generation watermarking. Such schemes use the image s features rather than fixed coordinates because geometric attacks are likely to move pixels about in the image. Consequently this involves the application of feature detection techniques for both, determining features (according to whatever definition) for marking and later finding them back for detection. The research project presented in this thesis aims to find ways to improve robust and blind second generation watermarking schemes operating in the DWT domain, while maintaining image quality. 2.1.4 Attacks on Robust Watermarking Systems The aim of attacking a robust watermarking system is usually to prevent the watermark embedder (usually owner or copyright holder) from using the watermark to support his claims. This can be accomplished in two ways: either by rendering the watermark unreadable or by successfully disputing the claim based on the

14CHAPTER 2. BACKGROUND AND SURVEY OF EXISTING TECHNIQUES watermark detection result. We denote these categories as image processing attacks and protocol attacks in the above order, even though there are other ways to make a watermark undetectable than through classic image processing. 2.1.4.1 Image Processing Attacks The class of attacks aiming to render watermarks unreadable are often divided into sub-categories: robustness attacks aim to diminish or remove the presence of a watermark, while presentation attacks modify the image s content in a way that the watermark is no longer detectable [PAK99]. Robustness attacks can again be divided into signal processing attacks that operate on the data as a stream, e.g. by simple filtering operations, and geometric attacks that move things about in the image. In general, image processing attacks have to fulfil two rather conflicting requirements: the image quality must not suffer, and the attack must make it impossible for the watermark embedder to successfully detect the mark. The second point leads to the conclusion that the attack does not actually have to remove the mark, i.e. the attacker does not necessarily know where in the image the mark is hidden, as long as the manipulations to the image render the mark unreadable. In [PAK98b], Petitcolas et al. give an overview of the most common image processing attacks that we briefly summarise here: The Jitter Attack is widely known as an attack on audio watermarks. The signal is split into equally sized chunks. Then single frames are randomly deleted from or duplicated within each chunk before assembling them together again. This attack is very efficient against watermarking schemes operating in frequency domains like DCT or DFT. The Mosaic Attack is the best-known kind of presentation attack. The image is cut into a set of smaller sub-images that are presented on a web page in a way that they appear to the user as one large image. This is made possible by web browsers feature of rendering such a mosaic in the same way as one large image. The mosaic attack was designed to defeat automated webcrawler based systems for piracy detection; since such robots would never get the whole watermarked image, the watermark detectors will in many

2.1. DIGITAL IMAGE WATERMARKING 15 cases fail to detect the watermark, though the image itself has not been modified in any way. Filtering Attacks are a rather broad category including filters known from image processing, like high-, low-pass, median filters and blurring. Their effects on watermarking systems differ, and they can be applied by combining different filters and using different intensity parameters. Different Mark Removal Attacks go a slightly different way than ordinary image processing attacks; they try to guess the watermark by using image statistics and then produce an image that does not contain the watermark. The techniques used for this approach differ. This usually works well with images that provide few features suitable for hiding a watermark, like cartoons that have only a few number of distinct colours. Such techniques also suffer from problems in finding the right settings, see [PAK98b] for more details. Photocopying and Scanning has many effects on the image, like added noise and slight colour changes. The Collusion Attack consists of merging together several differently marked images (assuming that they were all marked using the same technique) which confuses some watermark detection algorithms. The StirMark Attack is a combination of different kinds of image processing attacks. It was developed by Fabien A. P. Petitcolas et al. as a benchmark to test the robustness of watermarking schemes and presented in [PAK98b]. The combination of the following signal processing attacks are performed by StirMark : JPEG Lossy Compression modifies the image by quantising its frequency components. This is effective against watermarks applied with too little intensity or information embedded in perceptually insignificant components of the image. Pseudo Random Noise has a somewhat similar effect on the watermark like JPEG compression, but it is not limited to use in the frequency domain; also the noise can be spread wider over the image s frequency bands. This attack is particularly effective against marks that share the pseudo random noise s properties.

16CHAPTER 2. BACKGROUND AND SURVEY OF EXISTING TECHNIQUES Resampling, in this case using a bilinear Nyquist interpolation, combined with a small smoothly distributed error, leads to the typical non-linear analog/digital converter errors resulting from scanning an image. Frequency Displacement at high frequencies has an effect on watermarks embedded in the image s high frequency components. StirMark also includes geometric attacks: Resizing and Cropping first scales up the image size and then crops it back to its original size. It leads to both a slight shift of features and a change of values to almost all image pixels or coefficients. This has a devastating effect on many watermarking schemes that embed their watermark bits in single pixels or coefficients at chosen locations in the image. Rotation and Shifting is applied to the whole and regions of the image. Slight rotation changes the features in the images that may be used for finding previously marked locations, also shift of marked locations. Bending can optionally be applied to the whole image with the the maximum deviation of pixels in the image s center. The effect on a watermark is slightly similar to the one from rotation and shifting. Shearing produces a relative horizontal or vertical displacement of image features ( diagonalization ). The effect on a watermark is slightly similar to the one from rotation and shifting. After the above attacks, StirMark applies a JPEG compression at medium quality to the image. This thesis is particularly concerned with a watermarking system s robustness against image processing attacks like the ones listed above. 2.1.4.2 Protocol Attacks This class of attacks also referred to as Interpretation attacks aims to exploit weaknesses in the protocol involved in resolving rightful ownership with the help of a robust digital image watermarking system and/or the watermarking system itself. It is often irrelevant whether a watermark previously embedded by

2.1. DIGITAL IMAGE WATERMARKING 17 an image s owner can be read if the attacker can make a plausible case that the watermark is inadequate for proving what the embedder wants to prove. There are a number of typical scenarios which we consider as particularly relevant to our research since they exploit watermarking systems weaknesses: Counterfeit Original according to Craver et al. [CMYY96] operates as follows: 1. The attacker has an image Î which was marked with signature S by the rightful owner using a non-blind (see section 2.1.3) watermarking scheme. 2. The attacker now subtracts his own watermark S using the same marking technique and obtains a counterfeit original image Î. 3. When the rightful owner presents the real original image I to extract the watermark, he will probably still be able to read the watermark from Î. 4. However since the relationship between Î and Î carries over to I, the attacker will be able to extract his watermark S from I using Î as the original and thus claim that I is in fact a watermarked version of Î to which the rightful owner simply added his own watermark. This counterfeit scenario exploits two weaknesses found in some watermarking schemes: 1. The extraction process is non-blind, i.e. the extraction (and thus the claim of rightful ownership) depends on the relationship between the marked image Î and original image I. 2. The watermarking process is invertible. The invertability property is discussed in detail in [CMYY96]: If a watermarking scheme is invertible, a computionally feasible inverse encoder can be found that produces a counterfeit original image Î perceptually close to the original from an image Î and a watermark S, so that the original watermark encoder produces Î from S and Î. Claimed Counterfeit Original according to Zeng et al. [ZL97] operates as follows: 1. Given the same scenario as above, the attacker does not even produce a counterfeit original Î, but claims that the real original image I

18CHAPTER 2. BACKGROUND AND SURVEY OF EXISTING TECHNIQUES presented by the rightful owner is in fact a counterfeit original created from Î. 2. In this case the attacker cannot claim rightful ownership, but still successfully dispute the real owner s claims. 3. This dispute of rightful ownership holds even if the original image was registered. In both cases it is obvious that if a watermarking scheme is not invertible it is vulnerable against the above counterfeit attacks. According to Zeng et al. in [ZL97], true non-invertability is very difficult to achieve, so that the real problem lies in the watermark detection process. The detection should therefore not depend on a second (original) image of which the authenticity may be questionable: a watermarking system needs to be blind. In addition, Zeng et al. propose in [ZL99] to generate the watermark sequence using a certified one-way deterministic function from either a registered owner-id or a meaningful signature to support the owner s claims on rightful ownership from successfully extracting the watermark from a marked image. Several other sources, like [HRP + 98] also propose to use registration authorities for images, watermarks and additional data, like the watermarking technique and cryptographic keys used. However such frameworks can only provide limited protection since there does not seem to be anything preventing an attacker from registering a counterfeit original. Here we do not directly focus on protocol attacks like the ones listed above, yet we are aware that in the design of robust digital image watermarking systems such attacks need to be considered. 2.1.5 The Human Visual System Understanding the way the human visual system (HVS) works is important to applications dealing with images, like image coding/compression and has lead to numerous research projects on modelling it. Since one crucial requirement for a watermark system is to cause no perceptual degradation to the image (see section 2.1.2), some watermarking schemes use such perceptual models aiming to define a just-noticeable difference (JND) threshold for the optimal choice of marking intensity. The JND depends most of all on the image properties around

2.2. THE WAVELET TRANSFORM 19 the marking locations which according to [WPD99, Mee01] can be categorised as follows: Frequency sensitivity describes the human eye s sensitivity to sine wave gratings at various frequencies. The human eye is usually less sensitive to high frequencies which means that high frequency noise will be less likely to be seen. Most of the early work on perceptually based image coding has exploited this. Luminance sensitivity measures the effect of noise on a constant background. It usually depends on the luminance of both the noise and the background, and it is a non-linear function for the human visual system. Contrast masking refers to the reduction in the visibility of one image component by the presence of another. This effect is strongest if both components share frequency, orientation and location [Wat93]. Technically, perceptual models for watermarking also depend on the embedding domain. Podilchuk et al. compared their use with two watermarking schemes, one operating in the DCT and one in the DWT domain in [PZ98] and found that determining the JND thresholds for marking was much easier in the DWT domain due to its superior spatial support (see section 2.3 for a more detailed summary of their results). They also point out that some typical limit known from compression like the 8x8 quantisation matrix used in JPEG compression does not necessarily apply to watermarking thus making the use of perceptual models more efficient. The work reported in this thesis does not include the use of such perceptual models, since its primary concern is robustness against sophisticated image processing attacks. We believe that once this robustness is achieved with reasonably little image degradation, the next logical step will be to fine-tune the watermarking scheme s perceptual properties. 2.2 The Wavelet Transform The wavelet transform has been extensively studied and discussed in dedicated research (like [Mal89]) or educational publications (e.g. [SDS96]). Here we give

20CHAPTER 2. BACKGROUND AND SURVEY OF EXISTING TECHNIQUES a brief summary of the wavelet transform s aspects relevant for applications in watermarking. 2.2.1 What is a Wavelet Transform? According to Rehmi Post in [Pos95], a wavelet transform is a tool for carving up functions, operators, or data into components of different frequency, allowing one to study each component separately. In more practical terms this means that a wavelet transform decomposes a signal into windows of different resolutions. For doing so, a wavelet transform applies a wavelet on the (one-dimensional) data of interest resulting in a multiresolution signal 4 representation. This is done by separating the signal and details at a frequency determined by the wavelet and then keep repeating this on the low frequency output of this operation until some condition is met (e.g. the signal has become too small to be split again). Like other linear transforms on he space of real/complex valued functions, the wavelet transform is a change of basis. This is similar to e.g. the Fourier series, only that instead of using the base functions sine and cosine functions wavelets are used. The signal to decompose can be continuous (e.g. functions) or discrete (e.g. images), and thus we distinguish between the continuous wavelet transform (CWT ) and the discrete wavelet transform (DWT ). 2.2.1.1 Wavelets The term wavelet denotes the function used to approximate the signal by scaled and dilated superposition. It is therefore responsible for the way in which the signal is decomposed. There are numerous definitions of what wavelets are ranging from the mathematical fundaments to application considerations. In [Swe96], Wim Sweldens argues that because of the fast growing nature of the wavelet field it is almost impossible to rigorously define a wavelet and thus gives the following slightly fuzzy definition: A wavelet is denoted as ψ λ (x) with ψ being a function from some space of functions F, x belonging to some spatial domain X and λ to some index domain Λ. Now Ψ = {ψ λ λ Λ} is called a wavelet basis if it has the following three properties: 4 For simplicity, we will from now on use the term signal for whatever is transformed.

2.2. THE WAVELET TRANSFORM 21 Wavelets are building blocks for general functions. A signal f must be expressible by an infinite series λ c λ ψ λ, where the coefficient sequence c λ C with C = {c λ λ Λ} 5 must exist, be computable from ψ λ and f, C must be characterised by by an appropriate norm, so that whether or not a coefficient sequence c belongs to C can be determined without having to synthesise f. Wavelets have space-frequency localisation. Most of the wavelet s energy is concentrated in a finite interval and ideally exactly zero outside it; also its Fourier transform is localised. This is responsible for the wavelet s well-known multiresolution property: a given location in the signal is represented by coefficient values at different resolution levels in the wavelet domain; conversely several coefficients can represent the same spatial frequency but different parts of the picture. As a consequence, wavelet transforms allow us to extract and examine different resolutions (and thus: detail levels) of the signal 6. Wavelets have fast transform-algorithms. The computation of the coefficients c λ must be achievable by an algorithm with typically linear or linear-logarithmic complexity. This is often done by multiresolution analysis by approximating the signal f at different resolution levels which yields the coefficients as the additional detail distinguishing the coarser from the finer approximation. Typically wavelets are functions looking like small waves, i.e. the signal looks like a wave inside a given interval but is by definition zero outside it. Figure 2.1 shows the plots of two well-known wavelet functions, the Haar and Mexican Hat. 2.2.2 Multiresolution Analsysis A wavelet transform is typically computed using multiresolution analysis which we briefly describe here, for more details see [WA94, SDS96]. 5 In [Swe96] this is written as c = {c λ λ Λ}. We prefer a different notation, since this equation really defines the space C rather than single coefficients. 6 Wording inspired by [Str99].

22CHAPTER 2. BACKGROUND AND SURVEY OF EXISTING TECHNIQUES Figure 2.1: Plots of the Haar and Mexican Hat wavelets The basic idea behind multiresolution analysis is to represent a signal f in a vector space V n which is the end point to a sequence of nested vector spaces V i with i n using scaled and dilated versions of the basis functions φ i : V 0 V 1 V 2... V n (2.1) If f contains discrete values and its length is finite (e.g. the signal is an image), n will be a positive integer, however multiresolution analysis can be applied on continuous signals as well, in that case n will approach infinity. The nested spaces are related by a scaling law, so that the lower the index is the lower the resolution level (and, consequently, the smaller the subspace) is at which the whole signal is represented. This allows to approximate the signal f by its projection P k onto V k with k n and the expansion coefficients c k,h using scaled and dilated versions of V k s basis function φ k : P k f = c k,h φ k,h (x) (2.2) h= This yields the signal at resolution level k, and of course P k f will approach f with k n. The basis functions φ i used in V i are called scaling functions. To construct any V k from V k 1, another set of vector spaces, W i, on scaled and dilated versions of the basis functions ψ i is used ( denoting a direct sum), so that: V k = V k 1 W k 1 and V k 1 W k 1 (2.3) Thus, W k 1 is the orthogonal complement of V k 1 in V k, i.e. W k 1 is the

2.2. THE WAVELET TRANSFORM 23 space of all functions in V k that are orthogonal to all functions in V k 1 under a chosen inner product which is defined for all elements of V n. It follows that W i are orthogonal, too. Consequently, any of the V i can be expressed by V i m and a series of W i j with m, j n: V k = W k 1 W k 2 W k 3... W k m V k m (2.4) The basis functions ψ i used in W i are called wavelet functions. With the projection Q k of f onto W k and equations 2.3, 2.4, P n f can be rewritten as the direct sum of V n m and the W n j with d k,h being the Q k s expansion coefficients: P n f = Q n 1 f Q n 2 f... Q n m f P n m f (2.5) = h= d n 1,h ψ n 1,h (x) h= d n 2,h ψ n 2,h (x) (2.6)... h= d n m,h ψ n m,h (x) h= c n m,h φ n m,h (x) (2.7) This is the framework typically used by algorithms implementing wavelet transforms. Each transform step decomposes the signal into the expansion coefficients c k,h (often also denoted as low-pass coefficients or average coefficients even though with most cases these coefficients do not represent the average of anything) and d k,h (also known as high-pass coefficients or detail coefficients). Thus, the wavelet transform splits a one-dimensional signal into one part holding an approximation at a resolution resulting from the chosen decomposition depth and several subbands with the details missing to gain the next higher resolution step. Figure 2.2 shows a signal consisting of a finite number of discrete value decomposed by three steps. Average 0000 1111 0000 1111 111111110000000000000000 1111111111111111 111111110000000000000000 1111111111111111 111111110000000000000000 1111111111111111 111111110000000000000000 1111111111111111 Subband 3 Subband 2 Subband 1 Figure 2.2: Decomposition of a one-dimensional signal In practical DWT implementations, the repeated separation of frequencies is achieved by multiplying the signal s values (or samples) by a vector of coefficients specific to the wavelet. These sets of filter banks (one for calculating the average

24CHAPTER 2. BACKGROUND AND SURVEY OF EXISTING TECHNIQUES and one for the detail coefficients) are derived from the wavelet and scaling functions. Figure 2.3 shows plots of the wavelet and scaling functions belonging to Daub4 wavelet family that was presented by Daubechies in [Dau88]. Figure 2.3: Plots of the Daub4 scaling function and wavelet 2.2.2.1 Orthogonality According to the concepts of Multiresolution Analysis outlined in the previous section, the W i 1 are defined as the orthogonal complement of V i 1 in V i from which follows that the multiresolution analysis is orthogonal, too. Thus the wavelet and scaling functions need to be orthogonal, so that the following (as found in [SDS96]) holds 7 : < φ j k φj l > = δ k,l < ψ j k ψj l > = δ k,l < φ j k ψj l > = 0 for all j, k, l (2.8) However the requirement of orthogonality results in significant constraints on the construction of wavelets, so that for some applications it is sacrificed in favour of other properties (see the next section). A well-known family of such wavelets are biorthogonal wavelets. In [JS94], Jawerth et al. characterise them as wavelets that use a dual scaling function φ and a dual wavelet function ψ to generate a dual multiresolution analysis with subspaces Ṽi and W i, so that: Ṽ i W i, V i W i, and W i W k for i k (2.9) These biorthogonal wavelets define a dual multiresolution analysis which can 7 The notation < a b > stands for a chosen inner product between a and b, the δ k,l denotes a Kronecker delta function which is defined to be 1 for k = l and 0 otherwise.

2.2. THE WAVELET TRANSFORM 25 be used for wavelet transforms. Biorthogonal wavelets are very popular in image processing applications, like image compression for which some well-known ones were particularly designed, like the 9/7 8 Antonini filter from [ABMD92] and the filters introduced by Villasenor in [VBL95]. 2.2.2.2 Wavelet Properties Depending on the target application, a wavelet is characterised by a number of properties. Some of these considered relevant for image processing applications are: Compact support means that a wavelet s values are zero outside a bounded interval. Wavelets with compact support are usually said to have good time or space localisation properties. Smoothness is responsible for good approximation at coarser detail levels; the lack of it usually leads to blocky and/or edgy artefacts. Filter length determines over how many wavelet coefficients a single signal value is distributed in the transform domain. This is of interest for applications like image compression or watermarking where the signal is manipulated in the transform domain. 2.2.3 Two-dimensional Wavelet Decompositions The wavelet transform is a one-dimensional operation. To apply it on a twodimensional signal like an image the transform operation (and inverse transform respectively) needs to be applied to rows and columns of the signal in a particular way. In image processing, there are several image decomposition schemes commonly used. 2.2.3.1 The Pyramid Decomposition The pyramid decomposition is by far the most popular scheme for image processing applications. The method was described by Mallat et al. in [Mal89], and 8 Unlike orthogonal wavelets, biorthogonal wavelets may use filters of different lengths for analysis and synthesis. These filter lengths are notated as n/m with n as the number of analysis and m the number of synthesis filter coefficients.

26CHAPTER 2. BACKGROUND AND SURVEY OF EXISTING TECHNIQUES its main philosophy is to repeatedly apply the wavelet transform on all rows and all columns of first the whole signal and then its low-pass representation. Figure 2.4 shows how only the low-pass part of the image is further decomposed after the first decomposition step. The decomposition steps can be repeated until the low-pass signal is condensed in only one wavelet coefficient. Figure 2.4: A Pyramid decomposition, applied one and then two steps. To navigate more easily through the decomposed image, we stick to the following commonly used naming conventions. The low-pass area of the image (shown in the upper left of the images in figure 2.4) is called LL (for low-pass representation in horizontal and vertical direction), and sometimes, if the decomposition level is of particular interest, LL n with n denoting the decomposition level at which the decomposition has stopped. The detail subbands are named accordingly (with the decomposition level index if applicable) with H and L standing for high- and low-pass filtering applied horizontally and vertically in three permutations: HL, HH, LH (clockwise, starting from the upper right area). The pyramid decomposition is of particular interest for digital image watermarking since the detail subbands show the details extracted from the whole image, so that applying marking techniques or developing perceptual models is very straightforward. 2.2.3.2 The Standard Decomposition The standard decomposition is similar to the pyramid in the first decomposition step, but in the following iterations the transform is applied to the whole row or

2.2. THE WAVELET TRANSFORM 27 column instead of only its low-pass part. Figure 2.5 shows how at decomposition steps greater than one the detail subbands are further decomposed. Figure 2.5: A Standard decomposition, applied two and then three steps. The standard decomposition is computationally more expensive than the pyramid because of the additional computations necessary to decompose the detail signal. 2.2.3.3 The Packet Decomposition The packet decomposition is an adaptive method that applies the transform on the image producing four components like the first decomposition step of the pyramid decomposition and then repeatedly and selectively applied to the four sub-image areas until a particular criterion is met. Figure 2.6 illustrates that this can result in an image with a very irregular decomposition geometry, however the chosen property is likely to be highly uniformly distributed. The packet transform has applications in image compression but only very seldomly in watermarking (like e.g. described in [VM00]). 2.2.4 Applications for Wavelets in Imaging Wavelets are a popular tool for different tasks in imaging. We here present some examples out of the large number of actual applications. We here briefly introduce some of those that had an actual impact on the research project presented in this thesis.

28CHAPTER 2. BACKGROUND AND SURVEY OF EXISTING TECHNIQUES Figure 2.6: Two different possible stages of packet decomposition. 2.2.4.1 Image Compression Image compression is probably the most popular application for wavelets in imaging. The reasons for this are straightforward: By far the most detail coefficients have a value very close to zero. This makes entropy coding in the the DWT domain efficient. The image quality after lossy compression depends on the significant coefficients (i.e. coefficients with high absolute values) much more than on the insignificant ones. Thus, insignificant coefficients can be quantised at higher quantisation steps resulting in excellent compression ratio/image quality tradeoffs. The spatial relationship between corresponding coefficients in different resolution levels can be exploited to guess values in lower subbands. Shapiro s embedded image coding using zerotrees presented in [Sha93] does this by building up trees from higher to lower subbands in pyramid decomposed images. Perceptual models are simpler in the DWT domain than in e.g. the DCT domain, allowing easier optimisation of lossy compression (see section 2.1.5). There has been extensive research on image compression in the DWT domain, including:

2.2. THE WAVELET TRANSFORM 29 New compression techniques including the already mentioned algorithm by Shapiro [Sha93]. Others, like Strømme in [Str99] or Ma in [Ma02] propose using hybrid decompositions to optimise the compression ratio / image quality tradeoff. New wavelets were proposed by a number of people, like Antonini in [ABMD92] and Villasenor in [VBL95]. These wavelets often have superior properties for the quantisation typical for lossy compression. This of course makes them interesting for other applications, like watermarking, too. Finally, it should be mentioned that due to the wavelet transform s good properties for image compression, the latest version of the JPEG image compression standard, JPEG2000 [Gro04], now uses a DWT-based approach. 2.2.4.2 Image Querying The wavelet transform s multiresolution property can be exploited to implement very simple and elegant image comparison algorithms. In [JFS95], Jacobs et al. propose a fast image querying algorithm that operates by transforming images from an image database into the DWT domain, quantising their wavelet coefficients to either ±1 or 0 depending on their significance. The nonzero detail coefficients and the single average coefficient were stored in another database and then used to match the images from the database against rough drawings. The result was a list of images that matched best according to the wavelet coefficients stored in the database. This method exploits the fact that the significant coefficients are much more important than the insignificant ones and that the coarser subbands usually contain more coefficients with higher absolute values than the finer ones. The method is time and space efficient because only relatively little information needs to be stored and compared. Ongoing research at the University of Buckingham as part of the SecurePhone project [Sec04] shows that an image s coarse LL component and detail subbands can be used to implement a face verification application with properties not worse than if using principal component analysis (PCA) instead.

30CHAPTER 2. BACKGROUND AND SURVEY OF EXISTING TECHNIQUES 2.2.4.3 Image Watermarking A lot of watermarking techniques were proposed that used the DWT in some way. By far most of them first apply a wavelet transform on images to then embed the watermark information into the wavelet coefficients. We summarise existing, not only DWT-based, techniques in section 2.3.3. In general, the DWT domain shares most of the DCT domain s advantages: the mark is usually more robust and good image quality after marking. However marking in the DCT domain has one significant disadvantage: spatial support is missing and can only be partly established if the DCT is applied in reasonably small blocks. The DWT domain provides good spatial support without such measures; at each resolution level the wavelet coefficients represent properties in their respective image locations. Also, the DWT s multiresolution property allows to select the scale on which modifications take place, i.e. embedding in a coarser subband will correspond to modifying low-frequency components while embedding in finer subbands will have an effect on the image s high frequency bands. This leads to better control for a good compromise between embedding intensity and image quality. Finally, the DWT itself can be utilised for establishing visual models for image-adaptive watermarking leading to far simpler but still efficient algorithms (see section 2.1.3.3). 2.2.5 The Use of Wavelets in this Research The DWT domain s desirable properties described in the last section make it a generally good choice for an embedding domain. While there are different possible ways of applying the wavelet transform for embedding, our approach to using the DWT domain for image watermarking mostly follows the traditional philosophy. We consider the pyramid decomposition most suitable for our purpose: the whole image s detail coefficients at different resolution levels are available in the respective subbands HL, HH and LH components. In the subbands finding thresholds to classify coefficients according to their significance is straightforward, and features directly correspond to features in the spatial domain. In our DWTapplication of the dual channel watermarking concept we present in section 4.2 we directly exploit the DWT s multiresolution property obtained from the pyramid decomposition.

2.3. EXISTING ROBUST DIGITAL WATERMARKING TECHNIQUES 31 2.3 Existing Robust Digital Watermarking Techniques In section 2.1.3, we presented a number of different criteria for classification of watermarking systems. In this section we use the criterion of the embedding domain to categorise third party research which was found relevant to the research project presented in this thesis. 2.3.1 Schemes Operating in the Spatial Domain 2.3.1.1 The Patchwork Embedding In [BGML96], Bender et al. present different embedding techniques for data into images of which the blind Patchwork Embedding is frequently referred to in publications on robust digital image watermarking. The Patchwork embedding method modifies the least significant bits of pseudo randomly chosen tuples of pixels in the image by slightly increasing the intensity in one and decreasing the intensity in the other location. The watermark detection is based on image statistics. It is assumed that the image uses 256 distinct colours (e.g. one of the colour components in a colour image), all brightness levels are equally likely and all samples are independent of all others. Hence the mean value of the brightness difference S between two randomly chosen points a and b is without manipulation expected to be 0 if enough samples are taken: n S n = a i b i 0 (2.10) i=0 The Patchwork embedding manipulates this statistic by increasing the values of all a i and decreasing all b i. The detector now only needs to know the locations of the manipulated tuples and then compute S n. If S n has a value far beyond the standard deviation the watermark has been successfully detected. The authors claim the Patchwork embedding shows reasonably high resistance to most non-geometric image modifications. With the knowledge of today s attacks its robustness is rather low: it suffers from the same problems as most modifications of the images least significant bits: it can be removed by quantisation (like with JPEG compression) or blurring. However the idea behind

32CHAPTER 2. BACKGROUND AND SURVEY OF EXISTING TECHNIQUES detection is simple and reliable, and others (like Ker in [Ker01]) have used it as a basis for new embedding algorithms. 2.3.1.2 The SCS Embedding In [ESG00] and [ESG01], Eggers et al. present a new blind embedding method based on dither modulation ([CW98]). Earlier work by Costa [Cos83] suggests that for additive white Gaussian noise attacks, a blind watermarking can perform as well as as a non-blind one which involves the use of a large random codebook. Since deriving, storing and searching such a codebook is impractical, the authors propose to use a structured codebook of dithered uniform quantisers for their SCS (Scalar Costa Scheme) embedding technique. For applications in robust digital watermarking, the authors propose some variations to the SCS embedding, like repetition coding (adding redundancy), Spread-Transform (ST-SCS, derived from work by Chen et al. [CW99]) and channel coding (like turbo codes). We implemented the SCS embedding for embedding in the DWT domain where it showed very good robustness against JPEG compression at little or no image degradation. 2.3.1.3 Dual Channel Watermarking for Colour Images In [Ker01], Ker presents a second generation watermarking scheme (see [KBE99]) for colour images operating in the spatial domain with the focus on the Stir- Mark [PAK98a] attack. Geometric attacks on watermarks consist of what the author calls warpings of different kinds. This means that the main modification to the image is moving around coefficients rather than really modifying them. Therefore the major problem with watermarking is finding the locations of the watermark coefficients in a geometrically transformed image. Second generation watermarking schemes use the image s perceptually significant features for determining locations for embedding/detecting. However the marking process itself can lead to problems since it leads to changes of these relevant features. The author solves this problem by proposing to define two of the image s rgb components as channels, one as the actual embedding and the other as synchronisation channel. The feature detection is performed only on the synchronisation channel.

2.3. EXISTING ROBUST DIGITAL WATERMARKING TECHNIQUES 33 Then the locations resulting from it are used to embed/detect the mark in the marking channel. According to the author the implementation is already robust against Stir- Mark at standard settings but has problems with rotation and missing scale invariance of which the first is not considered a real problem if the patterns matched against are made rotationally symmetric. 2.3.2 Schemes Operating in the DCT Domain 2.3.2.1 Spread Spectrum Watermarking in the DCT Domain In [CKLS97], Cox et al. present their non-blind spread spectrum watermarking scheme operating in a block-dct domain. The authors point out that despite the risk of potential fidelity distortions the watermark needs to be embedded in an image s perceptually relevant components in order to be robust against image processing attacks. The proposed watermarking scheme therefore aims to embed the watermark into the image s perceptually significant frequency components without introducing visible distortions to achieve robustness against simple image processing and geometrical image manipulation. To determine the optimal locations for the watermark, a perceptual mask on a DCT is used to highlight locations with good properties for robustness and image quality which normally results in picking low frequency coefficients. This approach is inspired by the concept of spread spectrum communications, in which a narrow-band signal is transmitted over a much larger bandwidth, so that the energy added to any single frequency is imperceptible. For marking a Gaussian sequence of real numbers is embedded into the most significant coefficients found in the image s 8x8-DCT blocks (the use of blocks gives the scheme some spatial control). Without necessarily introducing distortion to the cover image, the Spread Spectrum watermarking scheme showed robustness against down- and then upscaling the image, JPEG compression down to 5% quality, dithering, clipping, photocopying and scanning, successive watermarking and collusion attacks. This concept was an inspiration to many watermarking schemes operating in different transform domains like DCT or DWT. Although it is non-blind, schemes

34CHAPTER 2. BACKGROUND AND SURVEY OF EXISTING TECHNIQUES with similar properties can be derived by using a blind embedding technique, like SCS (see above). 2.3.2.2 Towards Second Generation Watermarking Schemes In [KBE99] M. Kutter et.al. define requirements for future watermarking and also present an own blind scheme. While first generation watermarking schemes do not explicitly make use of perceptually significant schemes in the data, the requirements for second generation schemes further by involving perceptually significant features. To be suitable for watermarking features should be invariant to noise, covariant to geometric transformations and have an own location. Since attacks are not likely to modify such features they are good candidates for watermarking. The example technique presented uses a 2D Mexican Hat wavelet filter to find features. The wavelet chosen has the advantage of being rotation symmetric, so that features found will inherit this property. This is needed for robustness against rotation attacks. The watermark embedding process is a spread spectrum modulation weighted based on the image content. Only the blue component of a colour image is marked. The watermark locations are determined using Voronoi diagrams partitioning the space between the feature points into segments. The watermark is always put into the center of each segment. The authors do not present any experimental results, but the concept has been an inspiration for a number of research projects, like [Ker01] and this one. 2.3.3 Schemes Operating in the DWT Domain 2.3.3.1 Embedding Multiresolution Watermark Images In by [ZLL99] Wenjun Zeng et.al. concentrate on resolving rightful ownership using watermarks presenting a blind watermarking system for embedding binary images. The fundamental problem with watermarks detected by an automatic device is the threshold to be defined. A detector peak indicates a high probability for the presence of the watermark, but whether or not this is appropriate as a proof of rightful ownership does not seem very clear. As pointed out in [ZL99] the

2.3. EXISTING ROBUST DIGITAL WATERMARKING TECHNIQUES 35 message encoded in the watermark must be meaningful to build up a strong relation between image owner and the image. So the ideal watermark carries a meaningful message and is obvious enough to prove the above relationship. Especially after serious damage through image processing attacks the detector peak may not meet this requirement. Thus the authors propose to insert a binary image as a watermark, so that the human eye is the detector here. The image can carry a logo or a text message, that should be as simple as possible, so that even a seriously degraded image can still be read by a human. Furthermore, the resolution of the watermark image can be chosen at the time of reading, to obtain a smooth, low-detail version if the quality is not good enough for the full-scale image anymore. Lost bits can sometimes be approximated, since they are likely to have the same values as their neighbours in homogeneous regions. After creation the signature S 1 is into smaller segments which are modulated by either +1 or 1. The segments size is of importance, as we face a tradeoff between robustness and the number of bits chosen, here 8x8 blocks are used. The author report on two implementations, one embedding in the block-dct and the other in a multiresolution wavelet domain of which the wavelet-based scheme is said to be simpler and more robust. 2.3.3.2 Two Schemes Using Zerotrees for Classification In [IMYK98], Hisashi Inoue et.al. present two blind wavelet-based techniques, one using significant and one using insignificant wavelet coefficients for embedding. Both techniques make use of the zerotree algorithm [Sha93] for classifying the wavelet coefficients in terms of significance (see section 2.2.4.1) and embedding information. The first technique chooses insignificant branches, the other second one embeds in the significant branches. The authors claim that using only the coarser scales for embedding reduces the artifacts resulting from marking, since the finer scale will neutralise them. However no extensive demonstration of the scheme s robustness is given. 2.3.3.3 A Watermark in Significant DWT Coefficients In [DRA98], Rakesh Dugad et.al. present a blind watermarking schemes concentrating on the movement of marked coefficients in the wavelet-transformed image

36CHAPTER 2. BACKGROUND AND SURVEY OF EXISTING TECHNIQUES geometric attacks. First the image is transformed using a Daubechies 8-tap filter. Then all coefficients from the detail components that are above a given threshold T 1 are taken and marked. The marked coefficients are located by their significance; the order of the coefficients is not important since it could change due to image manipulation. The choice of significant coefficients provides good imperceptibility. For detection a second threshold T 2 > T 1 is chosen to avoid picking coefficients without watermark. The result then gets correlated with the original watermark; the detector s decision then depends on a threshold S = Vi (V i the corrupted coefficients). The examples provided by the authors show a very clear detector response. However only results after JPEG compression are presented, and the scheme s robustness against more sophisticated attacks like StirMark can be doubted. a 2M 2.3.3.4 Image-adaptive Watermarking using Visual Models In [PZ98], Christine I. Podilchuk and Wenjun Zeng present both, a DCT- and wavelet-based watermarking scheme making use of visual models. The original image is needed for detection, but according to the authors the scheme can with little effort be changed to blind watermarking, too. The techniques used for image-adaptive watermarking are based on research on visual models for image compression perceptual coders based on the JND paradigm are ideal for watermarking, but the authors point out that the approach for watermarking is much more flexible than for compression. The two schemes use a number of different, image-dependent JND-thresholds below which the watermarked coefficients need to remain for an invisible mark. For the DCT-based watermarking scheme individual JND thresholds for 8x8 DCT blocks. The perceptual models used here are Watson s [Wat93] and Safranek- Johnston s [SJ90] that both base on the same image independent component utilising frequency sensitivity. The DWT-based watermarking scheme benefits from the superior spatial support of the wavelet transform. The frequency sensitivity thresholds are determined for hierarchical four-level decomposition. The watermark weight factor is determined for each frequency band based on typical viewing conditions. The

2.3. EXISTING ROBUST DIGITAL WATERMARKING TECHNIQUES 37 authors report the DWT-based scheme to be much simpler and also more robust than the DCT-based one. The authors point out that a scheme using the original image for watermark detection is not suitable for copyright assertion, but may well be used for fingerprints, such as serial numbers. The wavelet transform is clearly superior to the DCT as it allows easier construction of local JND thresholds due to its better spatial support. It thus performs better although being much simpler. 2.3.3.5 Digital Image Watermarking using Secret Filters In his MSc thesis [Mee01], Peter Meerwald reviews a number of existing watermarking schemes and proposes a blind wavelet-based technique based on customised wavelet filters. His survey on existing techniques is excellent, and we do not attempt to summarise it here. His main conclusion is that wavelet-based watermarking techniques are usually quite robust and have good perceptual properties. In order to achieve the best combination of robustness and invisibility, the number of coefficients that come in question for embedding is rather limited. This of course would make attacks rather easy, since an attacker could easily guess where the watermark is hidden in an image. Meerwald now proposes not to use well-known wavelet filters with good properties but rather create own, secret wavelet filters used to transform the images before embedding. For the construction a template and a second part depending on a secret key would be used.

Chapter 3 The Tradeoff Between Image Quality and Watermark Robustness Robust watermarking needs to achieve robustness against image processing attacks, typically a combination of signal processing and geometric attacks (see section 2.1.4). While geometric attacks try to confuse the watermark detector by moving things around in the image so that coefficients 1 other than the previously marked ones are read, signal processing attacks target the watermark itself by manipulating the coefficients values. This leads to the consequence that in order to withstand signal processing attacks, the watermark embedding needs to be robust, so that even after manipulations to the coefficients the embedded values can still be read correctly. Unfortunately the robustness requirement usually contradicts the requirement of the mark not degrading the image in any perceptible way (see section 2.1.2). 3.1 The Choice of Filter and Embedding In DWT-based watermarking schemes, the above tradeoff is influenced not only by the embedding technique but also the choice of wavelet filter used for the decomposition before embedding and reading the watermark. In this section we 1 For simplicity, we from now on use the term coefficients for coefficients in any transform and even pixels in the spatial domain. 38

3.1. THE CHOICE OF FILTER AND EMBEDDING 39 present results of research conducted to find out more about the combination of filter and embedding technique and how they influence each other. 3.1.1 Experimental Setup 3.1.1.1 The Watermarking System For our experiment we implemented a simplistic watermarking scheme that shares typical DWT-based watermarking schemes features, like the decomposing the image into the DWT domain before embedding and reading the watermark, the choice of significant wavelet coefficients for embedding and embedding of information in single coefficients. We chose the Pyramid decomposition for the wavelet transform for the reasons given in section 2.2.3 2. The scheme embeds a watermark of the size n in the n coefficients with the highest absolute values found in the subbands previously chosen for marking. If the embedded watermark leads to values greater than 255 or less than 0 in the reconstructed image, they will be truncated to fit into the [0, 255] interval. For simplicity, a record of the the marked coefficients positions is kept and used this information when extracting the mark. For embedding a mark value m i in an image coefficient x i with a given intensity, we compared two alternative algorithms. The first of these was the non-blind Multiplicative embedding used by Cox et al. in [CKLS97] (see section 2.3.2.1). In this technique, embedding of single values m i into a DCT coefficient x i follows this scheme: s i = x i (1 + αm i ) (3.1) The embedding intensity is controlled by the α parameter. Being a multiplicative algorithm, this method will keep the modification/value ratio constant. For extracting a single value m i from a (possibly manipulated) DCT coefficient s i, the original original coefficient value x i is needed: m i = s i x i αx i (3.2) 2 The Standard decomposition was found to produce largely similar results in a smaller number of experiments with randomly picked settings.

40CHAPTER 3. THE TRADEOFF BETWEEN IMAGE QUALITY AND WATERMARK ROBUSTNE The second algorithm was the blind SCS embedding by Eggers et al. from [ESG01] (see section 2.3.1.2). The SCS embedding encodes the watermark as a sequence of letters d i D = {0, 1,..., D 1} that get embedded each in one host sample x i. The technique embeds information into pixels by setting their values near the output of a linear quantiser Q with the step-width. The result also depends on a key k which is a pseudo-random sequence with k i (0, 1]. Embedding a codeword d i into an image pixel x i to obtain the marked pixel s i operates as follows: u i = x i ( d i 2 + k i) (3.3) s i = x i + α (Q {u i } u i ) (3.4) The embedding intensity is controlled mainly by the parameter while α is needed to fine-tune the system for optimal detection results. Since we are embedding binary sequences, the codeword m i is taken from the alphabet D = {0, 1}. The key to extracting the watermark codeword m i from the (probably manipulated) pixel s i is the pseudo-random sequence k and the step-width : v i = s i k i (3.5) m i = Q {v i } v i (3.6) This algorithm results in a limited range of absolute changes for a given combination of and α. Both embedding methods were used by us mostly but not completely in the way they had been originally proposed; we applied them on wavelet coefficients instead of DCT coefficients and image pixels respectively. We thus prepend DWT to both embedding techniques, and will refer to them as DWT-Multiplicative and DWT-SCS hereafter when they are applied on DWT coefficients. The watermarking system allows any combination of the two embedding techniques and 11 wavelet filters (the filter coefficients taken from Davis Wavelet Coding Kit [Dav97]) displayed in table 3.1.

3.1. THE CHOICE OF FILTER AND EMBEDDING 41 Name Orthogonality Length Haar Orthogonal 2 Daub4 Orthogonal 4 Daub6 Orthogonal 6 Daub8 Orthogonal 8 Antonini Biorthogonal 9/7 Odegard Biorthogonal 9/7 Villa2 Biorthogonal 13/11 Villa3 Biorthogonal 6/10 Villa4 Biorthogonal 5/3 Villa5 Biorthogonal 2/6 Villa6 Biorthogonal 9/3 Table 3.1: The 11 wavelet filters used in the experiments 3.1.1.2 Watermark and Images Inspired by [ZLL99], we chose a binary image of 64x64 pixels size as watermark, so that a meaningful message could be embedded into the image and both, the human eye and an automatic detection device can be used to compare the detected with the original watermark and decide on the presence and quality of the detected watermark. Because we configured our marking scheme to mark coefficients sorted by their absolute values, it is easy to see which of them suffered worst from an attack, as seen in Figure 3.1. Figure 3.1: The watermark before and after attacks 3.1.1.3 The Watermarking Settings The intensity settings to the two embedding techniques were the following: DWT-Multiplicative embedding: The value of α ranged from 0.2 to 0.8 using steps of 0.05

42CHAPTER 3. THE TRADEOFF BETWEEN IMAGE QUALITY AND WATERMARK ROBUSTNE DWT-SCS embedding: The value of ranged from 20 to 120 using steps of 10, α was set to 1.0 for 20 40, 1.1 for 50 90, and 1.2 for 100 120 The two embedding schemes relevant intensity settings are hardly comparable. To make the results at least somehow comparable we thus chose the image degradation resulting from the marking as a common factor. For each intensity α used for the DWT-Multiplicative embedding we experimentally determined a combination /α for the DWT-SCS one that produced approximately the same image degradation and was optimal with respect to the tradeoff between image quality and watermark robustness. As a result, we marked images using subband depths 3 of 1, 2 and 3 (we did not use a subband depth of 4 here as the results from the DWT-Multiplicative embedding indicated that it would not be of practical interest), each with 13 different intensity settings. In fact, due to the different ways these settings result in changes to the DWT coefficients, we needed to increase the intensity for higher subband depths. 3.1.1.4 The L q d Watermark Quality Measurement Because we embedded a binary image as watermark, we needed a method to automatically measure the quality of the detected watermark by how much of it could still be recognised by the human eye. Due to its multiresolution property, the wavelet transform was found very helpful for this task. The fast image querying algorithm described by Jacobs et al. in [JFS95] (see section 2.2.4.2) was an excellent starting point for developing such a method. Jacobs et al. defined a pseudo-norm, the L q distance, that uses truncated quantised versions images most significant detail coefficients and the overall average coefficient to roughly measure the difference between two images. In this context a distinction is made between images from an image data base and a query image which is matched against the images in the data base. The relevance of differences or similarities between corresponding coefficients depends on their position in the decomposed image; the coarser the subband the more relevant they are. This is reflected by a weight table obtained from experiments by Jacobs et al. and depending on the kind of query image (drawn 3 The term subband depth means that starting from the first, all subbands up to the chosen depth are available for marking.

3.1. THE CHOICE OF FILTER AND EMBEDDING 43 Coefficient Values Histogram of Image Lena512, subband 1, decomposed using Villa3 Coefficient Values Histogram of Image Lena512, subbands 1 and 2, decomposed using Villa3 35000 Detail coefficients in subband 1 35000 Detail coefficients in subbands 1, 2 30000 30000 25000 25000 [Occurrences] 20000 15000 [Occurrences] 20000 15000 10000 10000 5000 5000 0-300 -200-100 0 100 200 300 0-300 -200-100 0 100 200 300 [Coefficient Values] [Coefficient Values] Figure 3.2: Histograms of lena512, subbands 1 and 1-2 or photocopy) and the colour channel. Figure 3.2 shows the histogram of the wavelet coefficients in subbands 1 and 1 + 2 together. Though similar in shape, the coefficients spread much wider if the second subband is included; this indicates that the majority of significant coefficient is in the coarser subband 2, and also that this subband contains more significant coefficients than the finer subband 1. The L q distance between the query image and some other image is computed as follows: 1. Both images (both of size x columns and y rows) are fully decomposed using a Haar filter and a Standard decomposition. 2. The overall average coefficients are stored. 3. The coordinates of the m largest coefficients are stored together with their signs. The value of m is a parameter that can be set. 4. Compute the difference between the two images overall averages; multiply the result with a weight from the weight table. 5. For all previously stored nonzero locations of the query image, if the image compared to has the same value at that location, a number taken from the weight table is subtracted from the weighted difference between the overall averages computed in the previous step. In the above example we simplified the algorithm by assuming that both images are grey-scale images, for colour images the scores are calculated for all

44CHAPTER 3. THE TRADEOFF BETWEEN IMAGE QUALITY AND WATERMARK ROBUSTNE colour channels using the respective weight tables and then added. The lower the L q distance s value is (it can even be negative) the more the two images are perceptually close to each other. The authors propose two weight tables of value triplets for the YIQ colour representation (which they found optimal after experimenting with different colour spaces) one for scanned and one for drawn pictures. Each weight table has six entries, one (index 0) for the differences between the overall averages five more (indices 1 to 5) for for detail coefficients. The weight tables values are picked by indices returned by the bin(i, j) function: bin(i, j) := min(max( log 2 i, log 2 j ), 5) (3.7) Over all tables the values range from from 4.04 to 34.37 (averages) and 0.0.07 to 1.26 (details). Their values usually (but not always) decrease with increasing table indices. Consequently, positions in the image nearer to the overall average (thus having lower (i, j) coordinate values) have a higher weight in the resulting score. From this pseudo-norm we derived our own measurement for comparing degraded watermarks with the original. Its computation differs from the L q in some ways: The number of coefficients the images are truncated to is determined by the percentage p. The difference between the overall averages is completely discarded. This is due to the fact that for the small binary images the overall average energies differences can be purely coincidental. Instead of subtracting weights for coefficient pairs with identical values we add weights for each difference found. This leads to always positive scores (since we do not use the averages, the score would otherwise be negative). We compute the score twice, going over all nonzero coefficients of the first and then for the second image. The final result is the lower of these two scores multiplied by 10000 x y p. This is necessary for making the score imageindependent, so that we can compare scores.

3.1. THE CHOICE OF FILTER AND EMBEDDING 45 L q d Because this measurement only uses the wavelet detail coefficients we call it whereby the d in the name stands for details. When operating on on greyscale or binary images we use the weight table for the Y channel for scanned images. The L q d scores for the two degraded images in Figure 3.1 are 8.13 for the less and 27.59 for the more degraded watermark image. Noise inserted into the watermark through attacks has high frequency characteristics as long as the watermark is still readable. We can thus safely expect to have a high percentage of identical significant coefficients in the coarser scales. This comes close to the way a human would try to read the watermark making the L q d metric ideal for our purpose. We manually fine-tuned the detection device for our particular watermark and obtained threshold categories for the watermark quality as clearly (< 21), still (< 25), partly (< 31) or only in traces (< 34) detectable. 3.1.1.5 The Test Procedure We conducted our experiments on 8 test grey-scale images, each of 512x512 pixels size. Most of these images are well-known in the watermarking community and in the public domain. They are the first 8 images listed in Appendix A. The same test procedure was performed on each image, and the results were averaged per image and overall. First, an image was marked and the mean square error (MSE) was used to determine the degradation to the image through marking. Then the watermark was detected and scored using the L q d measurement, this step would usually result in a nearly 100%. Finally the watermark was attacked, detected and scored again to see how much the watermark had suffered from the attack. We performed this sequence for all combinations of watermark and attack settings. The main attack was JPEG compression with 7 quality factors (100, 95, 90, 85, 80, 70 and 60) for which we used the cjpeg and djpeg utilities from the JPEGlib package. To see whether and how much the kind of lossy compression has an influence on the detection results and the quality of wavelet filter, we performed a smaller number of experiments using a DWT-based lossy compression with 4 different compression ratios (1:8, 1:10, 1:12 and 1:14) using Geoff Davis encode and decode command line tools from [Dav97]. The MSEs for image degradation and L q d s for watermark detection quality

46CHAPTER 3. THE TRADEOFF BETWEEN IMAGE QUALITY AND WATERMARK ROBUSTNE were then used to calculate various statistics, such as watermark quality depending on the watermark intensity, the compression ratio etc. The resulting overall statistics were simple averages computed by adding up the scores and dividing the result by their number. Since the progression of the scores is not linear, this method can lead to high scores influencing the computed average more than low scores. We nevertheless decided not to normalise the results since our results showed that neither marking intensity nor attack compression ratio had a significant impact on the actual rankings, and there was no normalisation factor common to both the DWT-Multiplicative and the DWT- SCS embedding method. Thus normalisation would not have lead to significantly different rankings but the undesired effect of making the results obtained with the two embedding techniques incomparable. 3.1.2 Results and Discussion We generated a number of rankings to determine the influence of the following parameters on the detection results and image quality: choice of filter, watermark intensity, (lossy) compression ratio, the chosen subband depth for marking, and the image itself. We particularly examined the different filters performance in combination with the other 4 of the above parameters of which in real-life watermarking some are within and some beyond the watermarker s control. Our results showed that only some of these parameters actually have a significant impact on the ranking of filters. The most significant correspondence between particular parameters and the filters ranking was found with the subband depth for marking and the kind of attack JPEG or DWT, while the embedding intensity and the compression ratio used for the attack made only little difference. This observation is of significant interest to all Wavelet-based watermarking schemes. 3.1.2.1 Image Degradation The subband depth of marking turned out to have the most significant effect on the image degradation resulting from marking, thus finding an optimal setting for this parameter is crucial: embedding in the finer subbands leads to good image quality but also less robust watermarks (see section 3.1.2.2). On the other hand, increasing the subband depth, so that coarser subbands can be marked too,

3.1. THE CHOICE OF FILTER AND EMBEDDING 47 usually leads to a more robust watermark, but it can easily lead to visible artifacts even at low embedding intensities on highly textured images depending on the embedding method. Since the first subband has relatively low energy, our choice of the most significant coefficients for marking leads to most of the watermark being accommodated by the coarser subbands. In our environment, at a subband depth of 2, less than half of the watermark would typically be embedded in the first subband, even though it is twice as large as the second one. This effect increases with higher subband depths. Watermark distribution at subband depth 2 Watermark distribution at subband depth 3 4000 3500 3000 image barbara image boat image christina57 image freske1 image goldhill image lena512 image mandrill image peppers 4000 3500 3000 image barbara image boat image christina57 image freske1 image goldhill image lena512 image mandrill image peppers 2500 2500 [values] 2000 [values] 2000 1500 1500 1000 1000 500 500 0 1 2 0 1 2 3 [stage] [stage] Figure 3.3: Distribution of marked coefficients over subbands (Haar filter) Figure 3.3 shows how the coefficients are distributed over the subbands at subband depths of 2 and 3 if a Haar filter was used before embedding. The example of image christina57 shows that there can be exceptions from the rule; as shown in Figure 3.4, this image has relatively little energy in the second subband compared to the first one. The other extreme in this example is the image freske1 where there is extremely little energy in subband 1. Since every coefficient in subband s corresponds to four coefficients in the next finer scale s 1, marking in coarser subbands leads to larger regions affected by changes. Consequently, the image quality dramatically decreases the more subbands we allow for marking. This effect is the same for all filter banks we tested. However the choice of filter was found to have a significant impact on the image quality. Changes to single wavelet coefficients introduced by marking them has an effect on a number of pixels in the reconstructed image. A good filter with respect to image quality will tolerate such changes, so that visible artifacts in the reconstructed image are minimised. Filters with this property are useful not only for watermarking, they are particularly appreciated for applications in lossy

48CHAPTER 3. THE TRADEOFF BETWEEN IMAGE QUALITY AND WATERMARK ROBUSTNE Figure 3.4: Images christina57 and freske1 decomposed to two subbands compression. Like watermarking, lossy compression introduces small changes to coefficients, usually by quantising them. However there is a difference in the choice of coefficients that are subject to those changes lossy compression will most likely affect more uniformly distributed coefficients and apply rather small changes while watermarking can apply more significant changes to a typically smaller number of coefficients. As discussed in section 2.2.4.1, there are a number of wavelet filters particularly designed for lossy compression, and we expected such filters to be potentially good choices for embedding where image quality is important. The results shown below showed that this assumption was correct. DWT-Multiplicative Embedding With the DWT-Multiplicative embedding, the rankings were found not to depend significantly on the subband depth of marking. This is illustrated by Figure 3.5 which shows the filters performance on lena512 graphically. The actual overall averages rank filters designed for image compression highest, like some of the Villa filters from [VBL95]) or commonly used for compression (like Antonini from [ABMD92] all of which are long, biorthogonal filters. The orthogonal filters Haar, Daub4, Daub6 and Daub8 were found on the bottom of the rankings. Of the filters with good properties some perform better at low (e.g. Villa4, Villa6 ) and some at high (Antonini, Villa5 ) subband depths, but there

3.1. THE CHOICE OF FILTER AND EMBEDDING 49 Degradation against subband depth measured in MSE Degradation against intensities measured in MSE 70 60 50 Antonini Brislawn Daub4 Daub6 Daub8 Haar Odegard Villa1 Villa2 Villa3 Villa4 Villa5 Villa6 60 50 Antonini Brislawn Daub4 Daub6 Daub8 Haar Odegard Villa1 Villa2 Villa3 Villa4 Villa5 Villa6 40 40 [MSE] [MSE] 30 30 20 20 10 10 0 1 2 3 4 Subband Depth 0 20 30 40 50 60 70 80 Intensities Figure 3.5: Filter performance for lena512 with DWT-Multiplicative embedding depending on subband depth and embedding intensity is also an excellent all-rounder (Villa3 ). The relative difference between the best and worst filter s average score is larger at subband depth 1 (39.4%) and smaller at higher subband depths (31.0% and 28.3%). 1 subband Villa4 5.326 Villa6 5.464 Villa3 5.534 Antonini 5.573 Odegard 5.715 Villa2 5.867 Villa5 6.039 Daub4 6.381 Daub6 6.501 Daub8 6.549 Haar 7.427 2 subbands Villa4 12.919 Villa3 13.118 Antonini 13.313 Villa6 13.340 Villa5 13.724 Odegard 13.739 Villa2 14.020 Daub8 14.913 Daub4 15.157 Daub6 15.413 Haar 16.919 3 subbands Villa3 26.494 Antonini 27.358 Villa5 27.468 Villa4 27.543 Odegard 27.937 Villa6 27.976 Villa2 28.508 Daub8 30.077 Daub4 30.880 Daub6 31.467 Haar 33.997 Table 3.2: Overall average filter ranking for image degradation after DWT- Multiplicative embedding [MSE] The rankings in Table 3.2 were relatively consistent over the different images,

50CHAPTER 3. THE TRADEOFF BETWEEN IMAGE QUALITY AND WATERMARK ROBUSTNE however as shown in Figure 3.6 there can be exception under particular circumstances. The short filters, like Haar, perform better than the long ones with barbara at subband depth 1, which is a result of the image being highly textured: short filters distribute noise over less pixels in the reconstructed image, so that for subbands with fine textures this features outweighs disadvantages like lack of smoothness. Degradation against subband depth measured in MSE Degradation against subband depth measured in MSE 40 35 30 Antonini Brislawn Daub4 Daub6 Daub8 Haar Odegard Villa1 Villa2 Villa3 Villa4 Villa5 Villa6 80 70 60 Antonini Brislawn Daub4 Daub6 Daub8 Haar Odegard Villa1 Villa2 Villa3 Villa4 Villa5 Villa6 25 50 [MSE] 20 [MSE] 40 15 30 10 5 20 0 1 2 3 4 Subband Depth 10 1 2 3 4 Subband Depth Figure 3.6: Filter performance for christina57 and barbara with DWT- Multiplicative embedding depending on subband depth DWT-SCS Embedding The DWT-SCS embedding lead to different rankings which are summarised in Table 3.3. First of all, there is a group of three filters that lead the rankings at subband depths of 2 and 3: Villa6, Villa4 and Villa3 ; interestingly this group is at the bottom for a subband depth of 1. At subband depth 1 the shorter filters, Haar and Daub4 are on top which indicates that for marking in the finest subband short filters can be an interesting choice. The four orthogonal filters are ranked close to each other in all degradation rankings and exhibit much better properties than with the DWT-Multiplicative embedding. However the results at subband depth 1 need to be looked at with special care, since the difference between the best and the worst filter is very small here (10.8%). For the coarser subbands the spread the spread between the top and bottom ranked filters increases (60.0% and 113.6%) which was not the case with

3.1. THE CHOICE OF FILTER AND EMBEDDING 51 the DWT-Multiplicative embedding. 1 subband Daub4 13.939 Haar 13.947 Villa2 14.071 Daub6 14.084 Odegard 14.144 Daub8 14.157 Antonini 14.496 Villa5 14.564 Villa3 14.883 Villa6 15.307 Villa4 15.445 2 subbands Villa6 10.152 Villa4 10.573 Villa3 11.096 Haar 14.019 Daub4 14.047 Daub8 14.058 Daub6 14.082 Antonini 14.148 Villa5 15.044 Odegard 15.526 Villa2 16.243 3 subbands Villa6 8.495 Villa4 8.919 Villa3 9.341 Haar 13.809 Daub4 13.842 Daub6 13.881 Daub8 13.883 Antonini 14.551 Villa5 15.442 Odegard 17.068 Villa2 18.145 Table 3.3: Overall average filter ranking for image degradation after DWT-SCS embedding [MSE] Degradation against subband depth measured in MSE Degradation against Deltas measured in MSE 20 18 Antonini Daub4 Daub6 Daub8 Haar Odegard Villa2 Villa3 Villa4 Villa5 Villa6 45 40 35 Antonini Daub4 Daub6 Daub8 Haar Odegard Villa2 Villa3 Villa4 Villa5 Villa6 16 30 25 [MSE] 14 [MSE] 20 12 15 10 10 5 8 1 2 3 Subband Depth 0 20 40 60 80 100 120 140 Deltas Figure 3.7: Filter performance for lena512 with DWT-SCS embedding depending on subband depth and embedding intensity Interestingly increasing the subband depth of marking, does not lead to increased image distortion with all filters. This stands in contrast to the DWT- Multiplicative embedding, but is logical because of the the uniform quantisation

52CHAPTER 3. THE TRADEOFF BETWEEN IMAGE QUALITY AND WATERMARK ROBUSTNE used in the DWT-SCS embedding which leads to higher relative changes to coefficients with lower absolute values. Since the proportion of coefficients with high absolute values rises with the subband depth of marking, a higher subband depth leads to more subtle changes to the marked coefficients values. Actually only with Villa5, Odegard and Villa2, which are also found at the bottom of the rankings at higher subband depths, the image degradation increases with the subband depth of marking. On the other hand the one-to-four relationship between corresponding coefficients in different subbands (see section 3.1.2.1) leads to changing coefficients in coarser subbands causing potentially more image degradation. The results from using the DWT-SCS embedding method show that the balance between these two factors depends a lot on the filter used for embedding, regardless of the intensity settings. This can be seen in figure 3.7. Degradation against Deltas measured in MSE Degradation against Deltas measured in MSE 40 35 30 Antonini Daub4 Daub6 Daub8 Haar Odegard Villa2 Villa3 Villa4 Villa5 Villa6 45 40 35 Antonini Daub4 Daub6 Daub8 Haar Odegard Villa2 Villa3 Villa4 Villa5 Villa6 30 25 25 [MSE] 20 [MSE] 20 15 15 10 10 5 5 0 20 40 60 80 100 120 140 Deltas 0 20 40 60 80 100 120 140 Deltas Figure 3.8: Filter performance for christina57 and barbara with DWT-SCS embedding depending on subband depth We configured our system in a way that the average degradation at the different subband depths with the DWT-SCS embedding would be approximately similar to the average degradation with the DWT-Multiplicative embedding. Due to the above effect this lead to increased marking intensities for higher subband depths. This explains the rather drastic increase of the spread between the best and worst ranked filter at higher subband depths which we reported above.

3.1. THE CHOICE OF FILTER AND EMBEDDING 53 Overall Degradation Results The results obtained with both embedding algorithms are relatively consistent at subband depths of 2 and 3 and differ slightly from the ones at subband depth 1; however these results are so close to each other with the DWT-SCS embedding that this difference should not be overestimated. For subband depths of 2 and 3, Villa3 and to a less extent Villa4 are good choices regardless of the embedding technique, Villa2 is consistently low ranked. The popular orthogonal filters (Haar, Daub4..8 ) seem recommendable only for the DWT-SCS, and Antonini only for the DWT-Multiplicative embedding algorithm respectively. With both embedding techniques, the marking intensity was found to have little effect on the rankings. The marked image is always important, but again the generally good choices still have good properties. Subband depth 2, measured in MSE Subband depth 2, measured in MSE 30 25 20 Antonini Brislawn Daub4 Daub6 Daub8 Haar Odegard Villa1 Villa2 Villa3 Villa4 Villa5 45 40 35 30 Antonini Daub4 Daub6 Daub8 Haar Odegard Villa2 Villa3 Villa4 Villa5 Villa6 Villa6 25 [MSE] 15 [MSE] 20 10 15 10 5 5 0 20 30 40 50 60 70 80 [Intensity] 0 20 40 60 80 100 120 140 [Delta] Subband depth 3, measured in MSE Subband depth 3, measured in MSE 70 60 50 40 Antonini Brislawn Daub4 Daub6 Daub8 Haar Odegard Villa1 Villa2 Villa3 Villa4 Villa5 Villa6 60 50 40 Antonini Daub4 Daub6 Daub8 Haar Odegard Villa2 Villa3 Villa4 Villa5 Villa6 [MSE] [MSE] 30 30 20 20 10 10 0 20 30 40 50 60 70 80 0 20 40 60 80 100 120 140 [Intensity] [Delta] Figure 3.9: Filter performance for lena512 with DWT-Multiplicative (left) and DWT-SCS (right) embedding depending on subband depth Figure 3.9 shows the degradation of lena512 at subband depths 2 and 3 depending on the embedding intensity. The effect of the watermark can be seen in Figure 3.10 on lena s left eye magnified from the original image, the image marked using DWT-SCS ( was 80.0, α 1.2, and MSE 0.58) and from the image marked

54CHAPTER 3. THE TRADEOFF BETWEEN IMAGE QUALITY AND WATERMARK ROBUSTNE using the DWT-Multiplicative embedding (α 0.5 and MSE 31.5), both images marked at subband depth 2 and using a Daub4 filter. This demonstrates both how image degradation can be visible at too high an embedding intensity and how moderate the image degradation introduced by the DWT-SCS embedding is even at high intensity. Figure 3.10: Magnified image degradation on the original image (left) caused by DWT-SCS (middle) and DWT-Multiplicative embedding (right) at subband depth 2 using a Daub4 filter 3.1.2.2 Watermark Quality We found our two two embedding techniques to differ a lot with respect to the watermarking software s performance; however the resulting rankings were relatively similar. Having used two different lossy compression techniques to attack the watermark, we the rankings of filters turned out to differ significantly depending on the kind of attack while with a particular attack the two embedding techniques lead to rather similar rankings. We will thus first report our observations on our two embedding techniques with respect to the watermark quality and then present the rankings depending on the kind of attack which was used. DWT-Multiplicative Embedding Consistent to the results on image degradation the spread between the top and bottom ranked filters is lower with the JPEG attack: 27.0%, 21.5% and 15.9% (JPEG attack, subband depths 1..3), whereas after DWT compression the differences are significantly higher: 57.4%, 116.6% and 96.2% (DWT-compression attack, subband depths 1..3). The robustness of the watermark was found to depend on the subband depth

3.1. THE CHOICE OF FILTER AND EMBEDDING 55 Filter Haar at subband depth 1 Filter Villa4 at subband depth 1 Watermark Degradation [Lq_d] 50 45 40 traces: < 34 partly: < 31 still: < 25 clearly: < 21 15 Intensity 20% Intensity 25% Intensity 30% Intensity 35% Intensity 40% Intensity 45% Intensity 50% Intensity 55% Intensity 60% Intensity 65% Intensity 70% Intensity 75% Intensity 80% Watermark Degradation [Lq_d] 50 45 40 traces: < 34 partly: < 31 still: < 25 clearly: < 21 15 Intensity 20% Intensity 25% Intensity 30% Intensity 35% Intensity 40% Intensity 45% Intensity 50% Intensity 55% Intensity 60% Intensity 65% Intensity 70% Intensity 75% Intensity 80% 10 10 5 5 0 100 95 90 85 80 75 70 65 60 0 100 95 90 85 80 75 70 65 60 JPG Quality factor [%] JPG Quality factor [%] Figure 3.11: Two filters performance for lena512 with DWT-Multiplicative embedding depending on subband depth and JPEG quality factor more than on the marking intensity: a watermark inserted in the first subband needs intensities of more than 30 percent to survive JPEG compression with quality factors less than 95 percent. Figure 3.11 shows the difference between the highest ranked filter (Haar) and the lowed ranked (Villa4 ) at subband depth 1 on the lena512 image. However, increasing the subband depth to 2 dramatically improves the detection results. Even with low embedding intensity of 20 percent the mark is still clearly detectable at JPEG quality factors of 85 percent or greater. Marking the first three subbands or even more makes the watermark virtually invulnerable to lossy compression. This can be seen in Figure 3.12 where we use a filter with good overall properties at different intensities and JPEG quality factors. Filter Villa3 at subband depth 2 Filter Villa3 at subband depth 3 Watermark Degradation [Lq_d] 50 45 40 traces: < 34 partly: < 31 still: < 25 clearly: < 21 15 Intensity 20% Intensity 25% Intensity 30% Intensity 35% Intensity 40% Intensity 45% Intensity 50% Intensity 55% Intensity 60% Intensity 65% Intensity 70% Intensity 75% Intensity 80% Watermark Degradation [Lq_d] 50 45 40 traces: < 34 partly: < 31 still: < 25 clearly: < 21 15 Intensity 20% Intensity 25% Intensity 30% Intensity 35% Intensity 40% Intensity 45% Intensity 50% Intensity 55% Intensity 60% Intensity 65% Intensity 70% Intensity 75% Intensity 80% 10 10 5 5 0 100 95 90 85 80 75 70 65 60 0 100 95 90 85 80 75 70 65 60 JPG Quality factor [%] JPG Quality factor [%] Figure 3.12: Villa3 performance at subband depth 2 and 3 for lena512 with DWT-Multiplicative embedding depending on JPEG quality factor

56CHAPTER 3. THE TRADEOFF BETWEEN IMAGE QUALITY AND WATERMARK ROBUSTNE The drastic increase of robustness at subband depths greater than 1 can be explained by the DWT-Multiplicative embedding method, s i = x i (1 + αm i ). We know from section 3.1.1.4 that the coarser subband typically contain much more energy than the finer ones. As the amount added to or subtracted from a particular coefficient depends on its value, large coefficients lead to higher absolute changes. If a uniform quantiser is used in the compression attack, a high quantisation step width would be necessary to destroy the watermark, thus resulting in more image degradation. Even nonuniform quantisers would have to operate in the same DWT-domain as the one chosen for embedding the mark to attack a mark embedded in the most significant coefficients more efficiently. However, increasing the subband depth of marking usually takes its toll on image quality, so that a good compromise must be found for the marking settings. DWT-SCS Embedding Though being blind, the DWT-SCS embedding usually leads better results than those obtained with the non-blind DWT-Multiplicative method. This is the case throughout if the watermark is attacked by JPEG compression and applies for the better ranked filters under the DWT-compression attack. The spread between the top and bottom ranked filters is almost always (exception: JPEG attack, subband depth 1) higher than with the DWT-Multiplicative embedding: 16.1%, 71.7% and 113.1% (JPEG attack, subband depths 1..3), and after DWT compression the differences are even higher 70.7%, 202.6% and 262.7% (DWT-compression attack, subband depths 1..3). The dramatic increase at subband depths greater than one can be explained by the higher intensity settings (see section 3.1.2.1), but the already large spread at subband depth 1 indicates that the choice of filter can make a lot of difference for the DWT-SCS embedding. In contrast to the observations made with the DWT-Multiplicative embedding technique, an increased subband depth of marking now does not automatically lead to a more robust watermark if the same intensity settings are used. However at subband depths greater than 1, the marking intensity can be significantly increased before the image degradation is reached which an increased subband depth and no change to the intensity settings with the DWT-Multiplicative embedding would have caused. To explain this behaviour, we can use the same considerations as for the image degradation (see section 3.1.2.1). The uniform quantization used for embedding will most likely result in smaller relative changes

3.1. THE CHOICE OF FILTER AND EMBEDDING 57 to coefficients with larger than to those with lower absolute values. Thus for the typically more significant coefficients at higher subband depths, a higher can be chosen leading to increased robustness and an only modestly higher level of image degradation. An example of how the image degradation caused by DWT- Multiplicative and DWT-SCS embedding compare at different intensity settings, can be seen in Figure 3.9 in section 3.1.2.1. Filter Antonini at subband depth 1 Filter Antonini at subband depth 2 50 45 40 JPG 85% JPG 80% JPG 70% JPG 60% DWT 1:8 DWT 1:10 DWT 1:12 DWT 1:14 50 45 40 JPG 85% JPG 80% JPG 70% JPG 60% DWT 1:8 DWT 1:10 DWT 1:12 DWT 1:14 Watermark Degradation [Lq_d] traces: < 34 partly: < 31 still: < 25 clearly: < 21 15 Watermark Degradation [Lq_d] traces: < 34 partly: < 31 still: < 25 clearly: < 21 15 10 10 5 5 0 20 40 60 80 100 120 140 Watermark Delta 0 20 40 60 80 100 120 140 Watermark Delta Figure 3.13: Antonini performance at subband depth 1 and 2 for christina57 with DWT-SCS embedding depending on intensity settings. Figure 3.13 shows how the watermark robustness against JPEG and DWTbased compression attacks at different intensities differs at subband depths 1 and 2 (filter Antonini and image christina57 ). These graphs suggest that fore the DWT-SCS embedding there is a particular minimum embedding intensity needed before the robustness against it increases at subband depth 2. JPEG Compression Rankings Regardless of the embedding method the group of orthogonal filters (Haar, Daub4, Daub6 and Daub8 ) show the best robustness against JPEG compression. In the image quality rankings, the same group is ranked in the midfield with some distance to the top group when using DWT-SCS, and even at the bottom when using the DWT-Multiplicative embedding, hence these filters are good choices if the watermark robustness is more important than minimising the image degradation. Interestingly, we find one of the the biorthogonal filters consistently ranked in the top group: Villa3 produces good overall results and is even among the top two in the rankings for the embedding subband depths 2 and 3 with the DWT-Multiplicative embedding. This result is remarkable because this filter bank had already shown very

58CHAPTER 3. THE TRADEOFF BETWEEN IMAGE QUALITY AND WATERMARK ROBUSTNE DWT-Multiplicative Embedding: 1 subband Haar 16.453 Daub4 17.704 Daub6 17.725 Daub8 17.894 Villa5 18.562 Villa2 19.169 Odegard 19.703 Antonini 19.727 Villa3 19.778 Villa6 20.621 Villa4 20.895 DWT-SCS Embedding: 1 subband Haar 6.035 Daub6 6.114 Villa3 6.160 Daub8 6.232 Daub4 6.324 Villa5 6.471 Villa2 6.847 Villa6 6.891 Antonini 6.939 Odegard 6.949 Villa4 7.005 2 subbands Daub8 10.259 Villa3 10.533 Daub6 10.678 Haar 10.807 Daub4 11.016 Odegard 11.529 Villa6 11.660 Villa5 11.969 Antonini 12.268 Villa2 12.327 Villa4 12.467 2 subbands Daub8 3.018 Daub4 3.115 Daub6 3.146 Villa3 3.167 Haar 3.430 Odegard 3.512 Villa2 3.605 Villa5 3.669 Antonini 3.833 Villa6 4.403 Villa4 5.183 3 subbands Villa3 8.715 Daub4 9.057 Daub6 9.059 Daub8 9.133 Haar 9.260 Villa6 9.337 Antonini 9.415 Villa5 9.788 Villa2 9.911 Villa4 9.933 Odegard 10.098 3 subbands Daub8 1.796 Daub4 1.933 Daub6 1.935 Villa3 2.123 Haar 2.267 Villa5 2.397 Odegard 2.408 Villa2 2.440 Antonini 2.545 Villa6 2.883 Villa4 3.827 Table 3.4: Overall average filter ranking for watermark degradation after JPEG compression attack [L q d ] good properties with respect to image quality. In our experiments no other filter had a comparable all-round capability. In the bottom group of the tables we consistently find Villa4 that had been in the top group of all image degradation rankings. The rest of the filter banks in the lower half of the tables differs depending on the subbands depth of marking. The rankings for robustness against the JPEG compression attack were rather consistent throughout, i.e. differences resulting from different marking intensities

3.1. THE CHOICE OF FILTER AND EMBEDDING 59 or marking different images were small enough to suggest that the average values displayed in Table 3.4 can safely be relied upon. DWT-Multiplicative Embedding: 1 subband Antonini 19.269 Odegard 19.698 Villa2 19.750 Villa4 21.041 Villa6 21.275 Haar 24.483 Villa5 26.803 Villa3 27.648 Daub8 27.934 Daub4 29.471 Daub6 30.346 DWT-SCS Embedding: 1 subband Villa4 7.298 Villa6 7.424 Antonini 7.450 Odegard 7.905 Villa2 7.915 Villa5 9.067 Villa3 9.221 Haar 9.612 Daub8 10.695 Daub6 12.268 Daub4 12.455 2 subbands Odegard 11.645 Antonini 12.012 Villa6 12.263 Villa2 12.385 Villa4 12.666 Daub8 20.992 Haar 21.019 Villa5 22.862 Villa3 24.663 Daub6 25.014 Daub4 25.223 2 subbands Odegard 4.658 Antonini 4.847 Villa2 4.873 Villa6 7.180 Villa4 7.557 Haar 10.560 Daub8 10.862 Villa5 10.880 Daub4 13.588 Daub6 14.030 Villa3 14.094 3 subbands Villa2 10.053 Antonini 10.170 Villa6 10.288 Odegard 10.340 Villa4 11.733 Daub8 15.469 Haar 17.135 Daub6 18.107 Villa5 18.728 Villa3 19.364 Daub4 19.733 3 subbands Odegard 4.002 Villa2 4.032 Antonini 4.076 Villa6 7.184 Daub8 7.996 Villa4 8.271 Villa5 10.003 Haar 10.007 Daub6 10.496 Daub4 11.792 Villa3 14.516 Table 3.5: Overall average filter ranking for watermark degradation after DWTbased compression attack [L q d ] DWT-based Compression Rankings We included DWT-based compression as an attack in our experiments at only four different quality factors using an Antonini filter for decomposition. The main purpose of this second attack was to find out how a different kind of compression would influence the results. Indeed

60CHAPTER 3. THE TRADEOFF BETWEEN IMAGE QUALITY AND WATERMARK ROBUSTNE the rankings looked quite different from those obtained with the JPEG attack: instead of orthogonal filters, long biorthogonal ones exhibited the best results. This is an interesting observation since the filters found to have the best properties were those rather similar to the filter used for the lossy compression (Antonini, length 9/7). This prompted us to try other filters for compression attacks. Using Daub4 instead for a small number of tests lead to good results with especially the Daub4 filter at subband depth 1 and the attack conducted with a high compression ratio. However when using a lower compression ratio for the attack, again long, biorthogonal filters performed better. Marking more than only the first subband again changed the rankings significantly with Daub8 still performing much better than with the compression setup using the Antonini filter. We also obtained a few samples using Villa4 the biorthogonal filter with almost the same length as Daub4 for the compression attack. Here most of the time long, biorthogonal filters lead the field again while the orthogonal filters performance was quite diverse with no obvious regularity to be seen. These observations were consistent with both DWT-Multiplicative and DWT-SCS embedding. The rankings for robustness against the DWT-based compression compression attack were not as consistent as seen with robustness against JPEG compression. Our experimental results suggest that for subband depths greater than 1 the choice of filter bank is of greater importance. Figure 3.14 illustrates this by displaying graphs like Figure 3.13, only the bottom-ranked Daub6 filter is used instead of top-ranked Antonini. At subband depth 2 the watermark is less robust against the DWT-based compression than against the JPEG compression. This effect was observed only with the lowest-ranked filters and is consistent with both, DWT-Multiplicative and DWT-SCS embedding, its strength depends on the image to mark. The experiments with DWT-based compression attacks illustrate that the kind of compression used for the attack has an impact on the optimal choice of filter banks. In general, long, biorthogonal filters give the best results, but the actual rankings change with the choice of filter for compression and with other parameters, so that no simple recommendation can be made here. The design of a filter bank that shows good robustness regardless of the kind of DWT-based compression could be the starting point for interesting followup research.

3.1. THE CHOICE OF FILTER AND EMBEDDING 61 Filter Daub6 at subband depth 1 Filter Daub6 at subband depth 2 50 45 40 JPG 85% JPG 80% JPG 70% JPG 60% DWT 1:8 DWT 1:10 DWT 1:12 DWT 1:14 50 45 40 JPG 85% JPG 80% JPG 70% JPG 60% DWT 1:8 DWT 1:10 DWT 1:12 DWT 1:14 Watermark Degradation [Lq_d] traces: < 34 partly: < 31 still: < 25 clearly: < 21 15 Watermark Degradation [Lq_d] traces: < 34 partly: < 31 still: < 25 clearly: < 21 15 10 10 5 5 0 20 40 60 80 100 120 140 Watermark Delta 0 20 40 60 80 100 120 140 Watermark Delta Figure 3.14: Daub6 performance at subband depth 1 and 2 for christina57 with DWT-SCS embedding depending on intensity settings. Overall Detection Results We found both embedding algorithms leading to rather similar filter rankings. The factors most influential on these rankings were the subband depth of marking and the kind of attack. Unfortunately the two kinds of compression attacks suggest using different filters, so that no one optimal filter could be determined. However even the filters exhibiting the worst performance with the DWT-SCS embedding were hardly worse than the filters found optimal for the DWT-Multiplicative technique, so that a compromise will most likely be good enough in practical applications. 3.1.2.3 Overall Results As seen above, the requirements of imperceptability and robustness usually contradict. For the best possible robustness at a given level of image degradation, additional fine tuning is necessary. Due to the differences between the two embedding techniques we used for our experiments, fine-tuning measures to get the best out of them need to be looked at separately. DWT-Multiplicative Embedding Optimisation Our experiments showed that sufficient robustness is only achieved at subband depths greater than one, but with the setup we used for our experiments this usually leads to image degradation beyond acceptable limits. On the other hand, the watermark robustness gained by allowing coarser subbands for marking was found to quickly reach a state of saturation with increased marking intensity. We can thus afford to sacrifice some

62CHAPTER 3. THE TRADEOFF BETWEEN IMAGE QUALITY AND WATERMARK ROBUSTNE of this additional robustness to improve the image quality by introducing a factor to scale down the intensity of the watermark in subbands greater than one (this was proposed in [KM99]) for a better tradeoff between image quality and watermark robustness. With an intensity reduction of 50% for the second and another 50% for the third subband we found this measure to actually produce a better compromise between image quality and watermark robustness as demonstrated by Figure 3.15. Though the robustness does not match the one demonstrated in Figure 3.12, the watermark can now withstand lower JPEG qualities than before. 4.5 4 3.5 Degradation against subband depth measured in MSE Antonini Brislawn Daub4 Daub6 Daub8 Haar Odegard Villa1 Villa2 Villa3 Villa4 Villa5 Villa6 Filter Villa3 at subband depth 2 [MSE] 3 2.5 2 Watermark Degradation [Lq_d] 50 45 40 traces: < 34 partly: < 31 still: < 25 clearly: < 21 15 Intensity 20% Intensity 25% Intensity 30% Intensity 35% Intensity 40% Intensity 45% Intensity 50% Intensity 55% Intensity 60% Intensity 65% Intensity 70% Intensity 75% Intensity 80% 1.5 10 5 1 1 2 3 4 0 100 95 90 85 80 75 70 65 60 Subband Depth JPG Quality factor [%] Figure 3.15: Image degradation and detection quality for lena512 with adaptive DWT-Multiplicative embedding DWT-SCS Embedding Optimisation There is no measure to improve the DWT-SCS embedding s performance as simple as the one for the DWT-Multiplicative technique. Because the relative change to coefficients tends to be smaller in coarser than in finer subbands, we tried up-scaling the parameter for subbands greater than one, but this resulted in only minor robustness improvements while image degradation increased. We conclusively recommend to set a threshold as a limit for either the image degradation or the watermark s robustness and then use an iterative method to find the resulting in the best robustness at an acceptable level of image degradation or the lowest image degradation at an acceptable level of watermark robustness respectively.

3.2. AN ALTERNATIVE ATTACK 63 Conclusion In our experiments, the DWT-SCS embedding outperformed the DWT-Multiplicative technique in both, the image degradation and watermark robustness rankings. At similar levels of image degradation, the DWT-Multiplicative embedding showed better properties only at subband depth 1 and low compression quality, in all other cases the DWT-SCS yielded better results. For both requirements a filter s performance was found to depend most of all on the subband depth used for marking. The embedding algorithm used in the watermarking process has significant impact on the watermarking scheme s performance and to a less extent on the optimal choice of filter bank. The filter rankings for the two attacks, the JPEG and DWT-based compression, differ significantly. Unfortunately the kind of attack is beyond one s control in real-life watermarking, however the good results achieved with the DWT-SCS embedding suggest that even a filter not optimal for a particular attack is likely to still lead to satisfactory overall results. To achieve good robustness to attacks, marking more than the first subband is desirable, but it easily leads to artifacts. Depending on the embedding algorithm adaptive marking with changing intensity settings depending of the marked coefficients subbands can help in achieving better overall results. We cannot recommend one optimal filter, however there are some with remarkable qualities: at subband depths greater than one, Villa3 was found to lead to good robustness at low image degradation regardless of the embedding technique used. 3.2 An Alternative Attack In the experiments presented in the previous section we had used two different attacks for our experiments: JPEG and DWT-based compression. Both of these attacks are based on the same principle: decomposition, quantization, entropycoding. The actual attack in this process is the quantization in which, according to a quality criterion, some of the information considered as least perceptibly relevant is discarded. The most obvious way a watermarking scheme can defeat such an attack is by increasing the marking intensity, so that the marked coefficients survive the quantization. However this approach has its drawbacks not only because it is likely to cause visible distortions to the image, it can also

64CHAPTER 3. THE TRADEOFF BETWEEN IMAGE QUALITY AND WATERMARK ROBUSTNE be too obvious, so that it is relatively easy for an attacker to guess the marked coefficients whereabouts and then selectively attack them. In this section we present results of experiments we conducted on the two embedding methods presented in section 3.1.1 to compare their robustness against an attack that modifies significant wavelet coefficients. 3.2.1 The Attack The attack uses a simple, wavelet-based noise reduction algorithm. This algorithm uses the same assumptions as Shapiro in [Sha93]: a coefficient in a subband k 1 of a Pyramid-decomposed natural image usually has less energy than the coefficient at the corresponding spatial location in the coarser subband k. For compression, this was used to construct the so-called zerotrees that would be encoded using a single symbol. A zerotree is a quad-tree of coefficients like shown in Figure 3.16, in which all coefficients have smaller or equal values than the tree root and the root s value is smaller than a given threshold. Figure 3.16: Quad-tree structures resulting from the Pyramid decomposition For our noise-reduction attack, we do not look for zerotrees, but for trees that should be zerotrees, thus enforcing the rule that all descendants of an insignificant tree root are insignificant, too. To accomplish this, we first transform the image into the DWT domain using a Pyramid decomposition and a given decomposition depth n. Then, we build and scan the quad-trees for all insignificant coefficients in the coarsest subband. If at any level below the root coefficients are found to be significant, we correct their values as described below. Then for the rest of

3.2. AN ALTERNATIVE ATTACK 65 the next finer subband the same procedure is applied, i.e. quad-trees are created and processed for all remaining insignificant coefficients found in that subband. This is repeated until the finest subband has been reached. The thresholds are calculated for each subband k from the average x k and standard deviation σ k of its coefficient values x k,i : T k = α x k σ k (3.8) The parameter α can be used to fine-tune the noise-reduction. A lower value leads to more coefficients being processed and thus more image degradation. The correction of values considered as noise tries to guess a good coefficient value according to its neighbourhood. If the coefficient is located in a HL region, the positions immediately above and below are considered as its neighbourhood, accordingly the left and right neighbours are used for locations in a AH region and the diagonal neighbours for a AH region. The new value x k then is the square root of the neighbourhood s n squares (x 2 i ) average (including the coefficient to be corrected itself) multiplied by 1 if x k had a negative value: x k = i<n i=0 x 2 i n (3.9) In addition to thresholding single values, we implemented two variants on the way coefficients are classified as noise: a coefficient is considered as noise if it is significant but in its neighbourhood there are overall less significant than insignificant coefficients. In the first variant (a) the neighbourhood depends on the coefficient s region in the same way as for the coefficient correction above; in the second variant (b) simply the 3x3 region around the coefficient is used. These two variants reduce the image reduction leading to a better compromise for noise reduction, however the effect on the watermark is reduced, too. 3.2.2 Experimental Setup In our experiments we used 4 different settings to the noise reduction which were permutations of these parameter variations: α set to 0.6 and 1.0, an Antonini and a Daub4 filter. In all cases, the algorithm processed subband 3 down to 1, classifying coefficients in the original way rather than using variants (a, b) which

66CHAPTER 3. THE TRADEOFF BETWEEN IMAGE QUALITY AND WATERMARK ROBUSTNE had been found to have hardly any effect on the watermark. For the watermarking software, we used the DWT-Multiplicative embedding at three intensities controlled by α (0.5, 0.7, 0.9) and the DWT-SCS embedding at two intensities (α = 1.1, = 50, α = 1.2, = 80). Like suggested in section 3.1.2.3, we scaled down the intensity for the DWT-Multiplicative embedding by 0.5 for coarser subbands to achieve a better compromise between image quality and watermark robustness. All the above settings were combined with the 11 filters listed in section 3.1.1. The remaining settings were common to all configurations: the subband depth of embedding was 2, the n most significant coefficients were marked, and the marking locations were memorised and later used for mark detection. 3.2.3 Results and Discussion Our primary interests were the filter rankings in watermark robustness (whether or not they would differ significantly from the ones obtained with JPEG and DWT-based compression attacks) and which of the two embedding techniques was most vulnerable against this particular attack. 3.2.3.1 Image Quality The image degradation from marking was already known from the previous set of experiments, so that we did not have to produce any rankings again. Table 3.6 shows that the image degradation caused by the attack sometimes differs extremely: since the noise reduction has a smoothing effect, it causes intolerable blurry effects on some, in particular textured, images, like e.g. barbara. However we still included such results in our evaluation in order to find out whether or not the effect on the watermark was similarly extreme. 3.2.3.2 Watermark Robustness Like in the previous series of experiments, the DWT-SCS showed more robustness, even though we had optimised the DWT-Multiplicative embedding using intensity adaptation as described above. And again, like in the experiments with JPEG and

3.2. AN ALTERNATIVE ATTACK 67 DWT-Multiplicative Embedding Image avg. [M SE] σ lena512 9.472 0.100 barbara 22.253 8.130 boat 8.825 1.363 christina57 12.744 4.902 freske1 36.267 0.637 goldhill 3.491 0.275 mandrill 23.791 9.373 peppers 18.945 10.081 zelda 2.734 0.621 SCS Embedding Image avg. [M SE] σ lena512 23.559 5.516 barbara 32.267 4.224 boat 5.948 2.207 christina57 28.849 0.874 freske1 30.411 2.002 goldhill 6.542 2.885 mandrill 29.060 0.524 peppers 30.330 4.525 zelda 7.747 4.260 Table 3.6: Image degradation on different images, watermark embedded using Daub4, noise reduction using Antonini and α = 0.6 [MSE] DWT-based lossy compression as an attack, the rankings obtained with the DWT- Multiplicative and the DWT-SCS embedding exhibited only minor differences as illustrated by Table 3.7. DWT-Multiplicative Embedding Filter avg. [L q d ] σ Haar 5.852 6.633 Villa5 26.316 8.551 Daub8 26.774 8.578 Daub4 27.650 9.951 Villa3 27.780 7.656 Daub6 28.197 7.909 Villa4 28.660 7.677 Villa6 28.885 7.883 Villa2 29.238 7.502 Odegard 29.465 7.172 Antonini 30.102 7.636 Brislawn 30.102 7.636 SCS Embedding Filter avg. [L q d ] σ Haar 16.247 12.051 Odegard 19.021 11.001 Daub8 19.546 11.142 Villa5 19.756 10.867 Antonini 20.066 10.522 Brislawn 20.066 10.522 Villa2 20.073 10.990 Daub6 20.219 10.839 Daub4 20.669 11.632 Villa4 21.726 10.226 Villa3 21.880 10.034 Villa6 22.772 10.256 Table 3.7: Overall average filter ranking for watermark degradation after DWTbased noise-reduction attack [L q d ] The most significant result from this experiment is the observation that the watermark is most vulnerable against the (DWT-based) noise reduction if the attack operates in the same wavelet domain (i.e. decomposition performed by

68CHAPTER 3. THE TRADEOFF BETWEEN IMAGE QUALITY AND WATERMARK ROBUSTNE using the same filter) as the watermarking. Consequently, in all rankings, the filters used in the attack were found at the bottom of the tables which can be seen in Tables 3.8 and 3.9. Multiplicative Embedding Filter avg. [L q d ] σ Haar 6.419 7.871 Daub4 21.931 10.803 Villa5 22.613 9.478 Villa3 24.969 8.761 Daub6 25.624 9.114 Daub8 27.101 8.289 Villa4 31.925 3.187 Villa2 32.246 3.690 Odegard 32.757 3.287 Villa6 32.894 3.183 Antonini 33.542 3.798 Brislawn 33.542 3.798 SCS Embedding Filter avg. [L q d ] σ Haar 11.125 10.901 Daub4 14.410 10.813 Daub6 17.369 10.123 Villa5 17.407 10.843 Villa3 19.731 10.372 Daub8 19.855 11.013 Odegard 23.070 9.167 Antonini 24.330 8.321 Brislawn 24.330 8.321 Villa2 24.424 9.119 Villa4 26.226 7.647 Villa6 27.011 7.828 Table 3.8: Overall average filter ranking for watermark degradation after DWTbased noise-reduction attack using an Antonini decomposition [L q d ] Multiplicative Embedding Filter avg. [L q d ] σ Haar 5.284 5.112 Villa6 24.875 9.085 Villa4 25.394 9.330 Odegard 26.173 8.421 Villa2 26.231 9.027 Daub8 26.446 8.916 Antonini 26.663 8.896 Brislawn 26.663 8.896 Villa5 30.019 5.456 Villa3 30.591 5.041 Daub6 30.770 5.444 Daub4 33.368 4.068 SCS Embedding Filter avg. [L q d ] σ Odegard 14.973 11.291 Villa2 15.723 11.076 Antonini 15.802 10.851 Brislawn 15.802 10.851 Villa4 17.226 10.573 Villa6 18.533 10.722 Daub8 19.237 11.402 Haar 21.370 11.024 Villa5 22.105 10.504 Daub6 23.068 10.901 Villa3 24.028 9.321 Daub4 26.928 8.764 Table 3.9: Overall average filter ranking for watermark degradation after DWTbased noise-reduction attack using a Daub4 decomposition [L q d ]

3.2. AN ALTERNATIVE ATTACK 69 Also, the Haar filter showed the best robustness against this attack throughout. Since using the same filter as for embedding for the attack seems to make the attack most efficient, we ran the set of experiments with the Haar filter for the decomposition in the attack. This however resulted in both, severe degradation to the watermark and the image, regardless of the filter used for embedding, so that as a result we cannot consider this a realistic configuration for an attack on a watermarking system. In general, the watermark was still readable after the attack, and the watermark was not found to be significantly more or less robust at higher or lower embedding intensity. Obviously our choice of the most significant coefficients lead to some robustness against the noise reduction: because a large number of significant coefficients in a finer subband k 1 descend from an equally or more significant coefficient in the coarser subband k; Shapiro uses this assumption for his compression algorithm in [Sha93], and our histogram in section 3.1.1.4, Figure 3.2, suggests the same conclusion. The noise reduction is designed to correct only significant coefficients in insignificant trees. In our case the proportion of significant coefficients in significant trees among the marked coefficients was still large enough for a good number of watermark bits to survive the attack. Of course, a real attacker could play around with the noise reduction settings until a good image quality is accomplished, however the effect on the watermark would still be difficult to predict. 3.2.3.3 Overall We found that the α parameter to the noise reduction did not result in a significant difference for both the image quality and watermark robustness. The statistics displayed in the tables on the previous pages show that the results are in general very diverse (the standard deviations are generally very high) which shows that the image has a significant influence on the attack s result. In most scenarios, the watermark was still readable after the attack while the image quality had often already gone below the acceptable limit. The results show that both the DWT-Multiplicative and the DWT-SCS embedding are vulnerable against denoising, however such an attack does not destroy the watermark easily; a lot of the marked coefficients, though with increased energy after marking, cannot be singled out as noise in a simple way because with

70CHAPTER 3. THE TRADEOFF BETWEEN IMAGE QUALITY AND WATERMARK ROBUSTNE and without the watermark they represent perceptually significant details in the image, they are often part of a group of significant coefficients in the same or of a tree of significant coefficients over different resolution levels which qualifies them as not easily discardable. 3.3 Conclusion Our experiments on the DWT-Multiplicative and DWT-SCS embedding using different wavelet filters showed that in particular the DWT-SCS technique at an acceptable level of image degradation shows good robustness against signal processing attacks such as lossy compression and simple noise reduction. In most cases, the orthogonal filters, like Haar, Daub4,6,8 were found to have good properties for the watermark robustness while long, orthogonal filters are the better choice if image quality is more important. The Villa3 filter can be singled out as an excellent all-rounder, which has since then proved its value to us when we used it for other experiments. DWT-based attacks, like the noise reduction and the DWT-based lossy compression lead to a higher degree of dependency on the choice of filter for embedding, however since the choice of filter for an attack is beyond one s control in real-life watermarking we cannot recommend filters other than those with generally good properties.

Chapter 4 Geometric Attacks and the Dual Channel Approach Having taken a closer look at signal processing attacks in the last chapter, we now need to investigate the effect of geometric attacks more closely. Such attacks move things around, which in some cases may not have any effect at all on coefficents values. This change of location can either from or a combination of transforms, such as shifting, rotating, resizing, bending and shearing. Geometric attacks defeat watermarking schemes that locate marked coefficients simply by their coordinates, like the one we had used for our experiments on signal processing attacks, leading to a new approach to selecting and locating coefficients in an image. 4.1 Second Generation Watermarking In 1999, Kutter et al. introduced a new class of watermarking schemes in [KBE99] which they called second generation watermarking (see also section 2.3.2.2). The authors main statement essentially is that the image s perceptual features should be involved in the watermarking process. Good features in this sense are those surviving geometric and signal processing attacks, such as edges, corners and textured areas, and they can then be used to help to select locations for marking or previously marked locations. Given a good definition of what a feature is, together with a precise feature detection algorithm, this can help making a watermarking scheme robust against geometric attacks. Figure 4.1 shows the principal 71

72CHAPTER 4. GEOMETRIC ATTACKS AND THE DUAL CHANNEL APPROACH framework of a second generation watermarking scheme; in practical implementations the feature detection will most likely be configured by some secret, so that without knowing the secret the selected locations cannot be determined, even if the algorithm is known. Watermark Embedding Cover Image Feature Detection Algorithm Embedding Algorithm Watermark Marked Image Watermark Detection Marked Image Detection Algorithm Detection result: Watermark Probability Yes/No Feature Detection Algorithm Figure 4.1: Second Generation Image Watermarking Framework The idea of including perceptual features in the selection/location process is not completely new though. Cox et al. already proposed in [CKLS97] to embed watermarks in the image s perceptually significant frequency components which lead to marking the most significant DCT-coefficients in 8x8 transform blocks. Since the 8x8 block-dct used in this scheme provides some spatial control, single

4.2. THE DUAL CHANNEL APPROACH IN THE WAVELET DOMAIN 73 coefficients within such blocks directly correspond to the image s perceptual features. In DWT-based watermarking, the image s significant coefficients directly represent high frequency properties at their respective locations in the image. Many schemes, like e.g. the one proposed by Dugad et al. in [DRA98] (see section 2.3.3.3) operating in the DWT domain select the image s most significant coefficients for marking meaning that the image s features indeed have some influence on the choice of marking locations. However, first generation watermarking schemes usually suffer from poor selection algorithms and are thus vulnerable against geometric attacks. In the course of the research project presented in this thesis we found that using a feature detection technique for locating marked coefficients together with a good embedding technique can already lead to robustness against most of the attacks performed by StirMark. 4.2 The Dual Channel Approach in the Wavelet Domain Our first approach to second generation watermarking was to apply some of Ker s ideas from [Ker01] on grey-scale images in the DWT domain. The result was a blind, second generation watermarking scheme that like the scheme presented by Ker addresses the problem of embedding deteriorating image features and thus leading to less reliable feature detection results even before attacks. The scheme is not restricted to colour images which is achieved by exploiting the wavelet transform s multiresolution property. 4.2.1 The Original Idea As described in section 2.3.1.3, Ker uses two of a colour image s colour components as channels: one for marking and one for selection ( synchronization, i.e. determining the watermark s bits locations by feature detection). Assuming that a geometric attack will usually perform the same warpings on all of an image s colours, this avoids any effect of the marking process on the data used for the feature detection, thus additional watermark robustness is added. The experimental results presented by Ker indicate surprising robustness: the watermark

74CHAPTER 4. GEOMETRIC ATTACKS AND THE DUAL CHANNEL APPROACH withstands a StirMark attack with default parameters and JPEG compression with quality factors down to 35%. 4.2.2 The DWT-Dual-Channel Algorithm Our DWT-application of this approach is based on the multiresolution property exhibited by the Pyramid image decomposition: all areas LL, HL, HH, LH in any subband provide representations of the whole image at different resolution levels that can be used as channels for selection and marking in a dual-channel watermarking scheme. Besides using areas in the same subband, like HL k and LH k as selection and marking channel, pairs can be chosen even across subbands, like HL k 1 and LH k, or even include the average LL k. The rest closely follows the original idea: select coefficients for marking in the Selection Channel, map their coordinates to their respective locations in the Marking Channel and insert/read the watermark there. The coordinate mapping depends on the way the channel pair is chosen. As long as both channels are in the same subband, their scale and size are identical. If the two channels belong to different subbands, the mapping needs to consider their different scales and sizes. For both cases, mapping is implemented as follows: ( ) sx,m (x s o x,s ) x m = round + o x,m s x,s (4.1) Equation 4.1 describes how the horizontal component of a coordinate x s in the selection channel is mapped to the according location x m in the marking channel. For this, 4 additional values need to be known: The size of the selection channel s area s x,s, the size of the marking channel s area s x,m, and their respective offsets from the left image boundary o x,s and o x,m. The algorithm for mapping y s to y m is of course similar. Computing the area sizes and offsets depends on the kind of decomposition. As we are using the Pyramid, this is pretty straightforward: o x,s,a = s x,i 2 s : a = HL s x,i 2 s : a = HH 0 : a = LH and o y,s,a = 0 : a = HL s y,i 2 s : a = HH s y,i 2 s : a = HL (4.2)

4.2. THE DUAL CHANNEL APPROACH IN THE WAVELET DOMAIN 75 Equation 4.2 shows how the horizontal and vertical area offsets o x,s,a and o y,s,a can be calculated from the horizontal and vertical area sizes s x,i and s y,i, 2 s 2 s the subband s and the area identifier a. 4.2.3 The Quality Problem The dual-channel concept introduces a new problem to watermarking schemes (e.g. [DRA98, WSK98, KKK + 02]) trying to embed the mark into the image s most significant coefficients to increase robustness against signal processing attacks and often also less image degradation. Introducing the dual channel concept for DWT-based watermarking schemes however makes the choice of the most significant coefficients for marking problematic. Though the different channels in a decomposed image show the same image, the significance of corresponding coefficients in the selection and marking channel will differ, because the image will be represented either in different scales or by details obtained from different permutations of horizontal and vertical filtering. As a consequence, the watermarking scheme may achieve improved feature detection reliability, but this at the cost of robustness against signal processing attacks and image quality. Selecting the most significant coefficients in the marking channel, is not straight-forward, additional measures are necessary. 4.2.3.1 A Naive Approach A naive approach to this problem is to remove all locations corresponding to insignificant coefficients in the marking channel from the selection channel. This can be done by defining a threshold for the absolute values below which no coefficient would be allowed for marking. Such a threshold will typically result in an image dependent factor for narrowing a channel, e.g. nk with watermark size n and a freely chosen factor k >= 1. This would lead to marking only coefficients with sufficient quality (i.e. significance). However using a single factor k introduces new problems to the feature detection: quantisation while applying the inverse transform after marking and attacks are likely to change the order of the most significant coefficients in the marking channel. In fact, even without attack the above pre-selection procedure will produce different sets of locations for the feature detection. As a consequence, the feature detection is doomed to fail for a number of watermark bits because the corresponding locations are no longer in

76CHAPTER 4. GEOMETRIC ATTACKS AND THE DUAL CHANNEL APPROACH the selection channel. Our experiments showed that this naive approach makes the watermarking scheme almost unusable. 4.2.3.2 Three instead of Two Channels The above problem can be solved by using three different factors instead of one, two for writing (k w1,2 ) and one for reading the watermark (k r ), the three together satisfying k w2 > k r > k w1. The method works as follows: Before writing, run the feature detection on a larger channel C w2 with the size depending on k w2, but accept only those locations for marking that can also be found in a smaller channel C w1 determined by k w1 and satisfying C w1 C w2. Before reading, run the feature detection on a medium size channel C r determined by k r. We should have C w1 C r C w2 to avoid the loss of locations and the feature detection delivering false hits resulting from new, previously unchecked locations. The shrinking of the selection channel is not trivial. It depends on the significance ranking of the coefficients found in the marking channel. Before writing, a practical implementation will typically first shrink the selection channel to size nk w2 by removing all locations corresponding to insignificant coefficients in the marking channel and copy it to obtain C w2, then repeat the procedure using k w1 to create C w1. Before reading, of course, only k r is needed. If the selection and marking channels are in different subbands, their s s : s m size relationship needs to be considered; in this case a larger number of locations from the larger channel may correspond to only one location in the other. 4.2.3.3 The Choice of Factors The optimal choice of the different ks should be determined experimentally. The safest choice for k w2 is the selection channel s original size divided by n, but in most cases lower values are acceptable to speed up the feature detection process. The lower k w1 is chosen the better the watermark s robustness gets; on the other hand the number of potential embedding locations is reduced so that the watermark location will be more obvious. Finding the optimal k r is the most important parameter for the feature detection reliability and probably the most challenging task. In our implementation, we dump the channels C w1 and C r before and after feature detection into log files. During fine-tuning the parameters, we embed the mark, read it from the marked image, then attack the image and finally read the

4.2. THE DUAL CHANNEL APPROACH IN THE WAVELET DOMAIN 77 mark again. We can then use the channel dumps to determine whether C w1 C r is satisfied. For this to work the attack must not move things about in the image, thus simple filtering and/or quantisation (e.g. JPEG compression) make sense here. 4.2.4 An Implementation In our implementation we combined the watermarking scheme described in section 3.1.1.1 with the new functionality described above. We also added to it Ker s feature detection algorithm (we call it MatrixCorrelation) and embedding technique (DWT-PatchworkRegion) from [Ker01] as described below. For debugging, besides the already mentioned ability of dumping channels into files before and after marking plus an Obvious embedding technique that allows checking the feature detection results were added. The Obvious embedding embeds a large positive value for a 1 and a large negative value for a 0; at detection all positive values will be interpreted as 1 and all negative values as 0. Because we embed in the DWT domain and the watermark is a binary image we implemented Ker s feature detection and embedding technique slightly differently as summarised below. 4.2.4.1 The Feature Detection We use Ker s feature detection (we call it MatrixCorrelation) which is based on correlation image regions with rectangular patterns consisting of n b blocks of size s b. Each block is initialised by one pseudo random number, so that every pattern contains n 2 b random numbers in the end. For feature detection, n patterns are generated (one for each marking location) and shifted over the image until the correlation C(x, y) between the pattern P j,k and the underlying image coefficients I x,y is maximal: C(x, y) = j<nb s b k<nb s b j=0 j<nb s b k<nb s b j=0 k=0 Ix+j,y+k 2 k=0 P j,k I x+j,y+k (4.3) To obtain n watermark bit locations, matrices are generated and correlated against all locations in the selection channel until n unique correlation maxima

78CHAPTER 4. GEOMETRIC ATTACKS AND THE DUAL CHANNEL APPROACH are found. Clashes are resolved by discarding the matrix yielding the lower correlation. All matrices depend on a PRNG. If the seed to the PRNG is known, the same sequence of matrices can be reconstructed. This is used for speeding up detection by storing the PRNG seed and numbers of unsuccessful calls to the random() function in the secret key; this allows to avoid generating and correlating against matrices which did not lead to accepted features at marking. Optionally the coefficients in the selection channel can be quantised before being presented to the feature detector to make the feature detection less sensitive against noise. During correlation the matrices are shifted over the selection channel which may lead to having to operate beyond image or channel boundaries. We deal with such situations in the following way: we allow operation beyond channel boundaries as long as the location is still within the image. If not, the coordinates are simply mapped back into the image by a mirror or periodic extension. 4.2.4.2 The DWT-PatchworkRegion Embedding Ker s original embedding technique was inspired by the Patchwork embedding [BGML96] (see 2.3.1.1), but differed in that instead altering single pixels, square regions for each watermark bit are modified. The mark is a DCT-like permutation p(g, h) which is added to the image pixels w jk in the previously chosen square region, each of size 2ν: n s jk = w jk + α m t χ(x i j, y i k)p(x i j, y i k) (4.4) i=1 This is performed n times for all image locations (j, k). p(g, h) is defined as: The permutation and the characteristic function χ(h, k) as: p(g, h) = cos( gπ ν ) cos(hπ ν ) (4.5) 1 : ν h ν and ν k ν χ(h, k) = 0 : otherwise. (4.6) The embedding intensity α and the region s half size ν are the parameters for the watermark responsible for the robustness/visibility tradeoff. Note that the

4.2. THE DUAL CHANNEL APPROACH IN THE WAVELET DOMAIN 79 watermark must contain as many ones as zeros for successful detection. Detection follows the Patchwork approach, the probability of a particular watermark s existence in the image is calculated over all the m image s columns and n rows. First, for each previously identified watermark bit location, a xi y i is computed: a xi y i = m 1 n 1 j=0 k=0 s jkχ(x i j, y i k)p(x i j, y i k) (4.7) Then, average and square variance are used to determine the overall detection result d on the image: ā = Ni=1 a xi y i N, σ 2 a = Ni=1 (a xi y i ā) 2 N 1 and d = Ni=1 m i a xi y i Nσ 2 a (4.8) Because we read a watermark without knowing it in advance, we use a simplified detection formula. In Ker s overall detector the result d is maximal, if wherever the a xi y i for all previously identified watermark bit locations are negative, the corresponding mark bits m i are zero. Thus, if the mark bits m i are not yet known, they can be calculated from the a xi y i and the square variance σa 2 over all a xi y i : a 1 : xi y i > 0 m s i = 2 a 0 : otherwise. (4.9) Of course, our modification discards some quite significant information since it can only make yes-no decisions for all watermark bits which eventually results in a less robust watermark. 4.2.5 Experimental Setup 4.2.5.1 Parameters The following parameters are the result of some initial experiments and were found to perform well. We found that the optimal set of parameters depends a lot on the marked image and the kind of attack, we thus did not attempt to determine an overall optimal set of parameters and tried to limit the number of

80CHAPTER 4. GEOMETRIC ATTACKS AND THE DUAL CHANNEL APPROACH different configurations instead. The fixed settings were the MatrixCorrelation feature detection with a quantisation step of 3, the number of blocks n b = 3 and the block size s b = 32 for large and s b = 16 for small channels. We compared two embedding techniques, DWT-SCS and DWT-PatchworkRegion 1 with varying parameters. As shown in our experiments on signal processing attacks, a good choice of Wavelet filter can improve the performance of a DWT-based watermarking scheme. However our main interest in this series of experiments was to investigate the effect of the dual channel option, so that we decided to choose one filter and only occasionally vary it for more or less random probes. The filter we chose was Villa3 which had been found to exhibit good behaviour with respect to image quality and watermark robustness in combination with the DWT-SCS and spread spectrum embedding. During initial experiments we found out that the watermark we had previously used was too large and resulted in poor detection result. We thus reduced the watermark size to 36 bit payload (Figure 4.2). We embedded our watermarks in the 10 images found in Appendix A. Figure 4.2: The watermark images Attacks were simulated using JPEG compression (cjpeg and jpeg), Stir- Mark version 3.1 and a resizing tool using ImageMagick. Finally, the detection results were measured by comparing the detected binary image to the original watermark and then counting the number of incorrectly detected bits. This was necessary since the small watermark size does not really allow to use the human eye or the L q d pseudo-norm as a metric to quantify detected watermarks quality. 4.2.5.2 Dual Channel Basic Setup For the basic setup of the dual channel marking system we tried out several sets of channel settings, like picking selection and marking channels in the same or in different subbands, whether or not include the LL etc. The optimal choice was not surprisingly found to depend on the embedding technique, so that we will 1 We did not use the DWT-multiplicative embedding anymore since it is non-blind, and the DWT-SCS had usually performed better in our previous experiments.

4.2. THE DUAL CHANNEL APPROACH IN THE WAVELET DOMAIN 81 report experimental results obtained using various of these settings. In all cases however it was found advisable to use the LL part of the image for the selection channel. Since the feature detection works best when presented a channel with clear and rich features this seems quite logical. DWT-SCS embedding works best if the watermark is embedded in the LH or HL area of subband 2 or 3. Typical settings would thus be LL/HL or LL/LH in one of the two subbands. The DWT-PatchworkRegion embedding is less sensitive to noise but needs large marking channels to avoid overlapping watermarks that lead to visible distortion and bad detection results. The coarser subbands can still be used for marking if the marking intensity is kept low and the parameter controlling the size of the square region ν is set to smaller values. Embedding in finer subbands allows higher marking intensity and larger νs without visible image degradation. We thus prefer LL/HL or LL/LH in the first subband. 4.2.5.3 Dual Channel Fine-tuning To determine good choices for the three channel size parameters k w1, k w2 k r we need to check whether the C w1 C r condition is satisfied. We thus disable the feature detection for reading the watermark and use recorded marking locations instead for the fine-tuning process. As already mentioned, the channels C w1 and C r are dumped into text files before and after being processed and modified by the feature detection. Then some Unix shell scripts are used to check whether previously marked locations have disappeared from the reading channel. This check is performed without attacks first to determine an initial set of options; then launching of some signal processing attacks can be inserted, so that the k parameters can be adapted to sufficient robustness. The fine-tuning of the three channel size factors is independent of the kind of feature detection, we thus use a method faster than the MatrixCorrelation like the maximum selection strategy which is otherwise no serious choice for second generation watermarking for this process. The starting point is then one out of the 3 parameters; in most cases this is either k w2 for speed or k w1 for secrecy reasons. We then pick start values for the two remaining factors. From our experiments we obtained a rule of thumb according to which a factor in the [1.4...2.0] range for k r /k w1 is usually not far from a good choice. The remaining parameter k w2 should be large for maximum reliability, we thus

82CHAPTER 4. GEOMETRIC ATTACKS AND THE DUAL CHANNEL APPROACH recommend setting k w2 /k r greater than 2. Having set start values, we now run a sequence consisting of embedding, reading, attacking and reading, using a shell script for checking the channels to get the numbers of locations in the selection channel before marking no longer in the selection channel before reading and before reading after the attack. If both numbers are zero we can leave the settings as they are or try to optimise the factors according to whatever requirements we have. This procedure only makes sense for attacks that unlike geometric attacks do not move features around in the image. We used JPEG compression of different quality factors. 4.2.6 Experimental Results Our scheme does not reach the robustness reported in [Ker01]. However the dual channel option was found to lead to a significant improvement of watermark robustness in some configurations. 4.2.6.1 Robustness against JPEG Compression The JPEG attack was included in the experiments to find out how sensitive the feature detection is against signal processing attacks and compare the two embedding techniques robustness. The scheme s robustness against JPEG compression is generally good. The DWT-SCS embedding does not even make the dual-channel option necessary, the watermark easily survives JPEG compression at a quality setting of 50%. The DWT-PatchworkRegion embedding however tends to confuse the feature detection even without any attack, so that the dualchannel option is necessary in any case. Before enabling the dual-channel option, up to 30% of the mark s bits were falsely detected without and more than 50% after JPEG compression at the above settings (embedding in subband 1). After activating the dual channel option (selection in LL 1, embedding in HL 1 ) the results with DWT-PatchworkRegion embedding improve to 5% of the mark s bits falsely detected before and 16.6% after attack. Varying the channel settings (e.g. setting the selection channel to LL 3 and the marking channel to HL 3 ) revealed that the adapting of the size parameters for the embedding and feature detection to the channel size is important: large values of s b, n b and ν lead to worse results in smaller channels.

4.2. THE DUAL CHANNEL APPROACH IN THE WAVELET DOMAIN 83 4.2.6.2 Robustness against StirMark Our watermarking scheme was found not to withstand StirMark 3.1 with standard settings. We thus needed to investigate further, against which of the attacks performed by StirMark our scheme is most vulnerable. The first step in this was to disable as many of the optional attacks as possible to see whether this lead to a robustness improvement. For StirMark 3.1 this included disabling the bending, moving of corners inward or outward and JPEG compression. With these settings to the attack the detection results improved slightly with both, the DWT-SCS and DWT-PatchworkRegion embedding techniques in that at some configurations there was a good probability of being able to read more than 60% of the watermark after attack. We experimentally obtained configurations for both embedding techniques which produced higher numbers of good results than the others 2 : DWT-SCS embedding: Villa3 filter, selection in LL 3, marking in HL 3, k w2 = 3.0, 10.0 k r = 1.5, k 10 w1 = 1, α = 1.1, δ = 45.0, s 10 b = 16, n b = 3, quantisation step width before feature detection 3 Mean number of incorrectly detected bits: 46.79%, σ : 3.190 (45 samples) DWT-PatchworkRegion embedding: Haar filter, selection in LL 1, marking in HL 1, k w2 = k r = k w1 = 1, α = 14.0, ν = 12, s b = 32, n b = 3, quantisation step width before feature detection 3 Mean number of incorrectly detected bits: 45.6%, σ : 2.842 (36 samples) However the detection quality was far from acceptable even with the gentle StirMark settings; hence we continued by isolating one of the attacks from the StirMark cocktail: even at the settings described above, StirMark still performs resizing and cropping which is the only geometric attack in that configuration. In fact, this particular geometric attack also shares some properties of signal processing attacks, since the interpolation used in the resizing process also leads to changed coefficient values besides moving them about. We thus wrote a simple shell script that uses ImageMagick s convert CLI program to simulate this attack and found that this attack had a devastating effect: it usually caused 2 The k r,w values were used to multiply the original channel sizes by, thus making them smaller.

84CHAPTER 4. GEOMETRIC ATTACKS AND THE DUAL CHANNEL APPROACH more than 75% of the overall incorrectly detected bits. Interestingly the DWT- PatchworkRegion embedding was found to cope much better with the rescaling attack than the DWT-SCS. Since the results from these experiments are close to those obtained with the gentle StirMark attack, we assumed that the rescaling performed by StirMark hits a particularly weak point of our scheme. To investigate this attack s influence on the StirMark s overall effect on the watermark, we ran another series of experiments in which we tried to manually and this particular attack after running StirMark on the marked images. This was done using the Gimp image processing software: We compared the previously attacked image with the original and scaled it down until the displayed features would approximately match the ones in the original image. Finally, the (smaller) reconstructed image was pasted into the original marked image to avoid boundary problems and also check how good our correction was. Figure 4.3 shows the attacked and the reconstructed image: the size difference can be seen at the image boundaries, in particular the upper and lower left corners. Figure 4.3: The StirMark attacked lena512 and the reconstructed image It turned out that after undoing the rescaling as described above the detection results improved significantly and we could achieve confident detection results (more than 70% of the watermark correctly detected) in all cases. The second interesting observation had been the fact that the DWT-SCS embedding performed worse than the DWT-PatchworkRegion technique. We

4.2. THE DUAL CHANNEL APPROACH IN THE WAVELET DOMAIN 85 thus needed to take a closer look at the feature detection. This was done by first marking images using the Obvious embedding and then comparing the locations of marked coefficients found in the attacked and then again decomposed images to the coordinates written to the channel logs after feature detection on the attacked images. This revealed that the MatrixCorrelation does not deliver 100% correct results; sometimes the returned positions miss the marked locations by small amounts. This effect had already been reported by Kutter et al. in [KBE99]. Since the DWT-PatchworkRegion embedding uses a whole region instead of only one coefficient for reading and writing marks it is of course less vulnerable against this lack of feature detection precision. 4.2.6.3 The Feature Detection s Performance Given the (random) way the matching patterns are produced, the MatrixCorrelation feature detection was expected to produce best results in detail-rich images. This is backed by our experimental results; the detection results are best if we run the feature detection on the decomposed image s LL area in some decomposition level m instead of in the detail areas where most coefficient values are close to zero. This leads to the conclusion that this feature detection will perform better in a watermarking scheme operating in the spatial instead of the DWT domain. As already mentioned in section 4.2.6.1, the matching patterns should be chosen as large as the selection channel allows. Using too small matching patterns usually leads to poorer detection results as soon as attacks more sophisticated than JPEG compression are used. The obvious drawbacks of choosing large matching patterns are the enormous time needed to calculate the feature list during marking and extracting and capacity problems with smaller selection channels. The MatrixCorrelation feature detection clearly benefits from the dual channel option if the watermarking scheme uses the DWT-PatchworkRegion embedding; with the DWT-SCS technique this is not always the case. Its performance was not found to deliver results of 100% precision; often marked locations are missed by a small amount. This is a problem known from [KBE99], however in combination with our kind of watermark and the DWT-SCS embedding this makes the watermarking scheme vulnerable against StirMark s resizing and cropping attack.

86CHAPTER 4. GEOMETRIC ATTACKS AND THE DUAL CHANNEL APPROACH 4.2.6.4 The Embedding Techniques Performance The DWT-SCS exhibited good properties against the signal processing attacks we tested it with but showed weaknesses with the StirMark attack. As discussed in section 4.2.6.2, the main reason for this is the feature detection s lack of precision. Also the embedding intensity must be chosen neither too low nor too high since the mark would then be vulnerable against StirMark s Gaussian noise, lossy compression and smoothing filter. Regardless of the attack, we found the DWT-SCS embedding to benefit significantly from the pre-selection measure with the three thresholds described in section 4.2.3 which is not surprising since this allows embedding at higher intensities. The embedding algorithm used by Ker has an entirely different philosophy. Like the feature detection, this embedding scheme was designed for the spatial domain and works best if there is plenty of space in the image to mark. Since this leads to capacity problems with the potentially small marking channel in our dual channel scheme we chose a small watermark of only 36 bits payload for embedding and expected the technique to perform better the larger the marking channel was. This proved true, the embedding worked best if an area in the first subband was chosen for marking even though we know from experience that it would be subject to more noise than the coarser subbands. Marking in coarser subbands produced good robustness but unacceptably low image quality. The DWT-PatchworkRegion embedding depends on the marked coefficients significance to a less extent, especially since our measure cannot assert that a majority or even all of the marked coefficients are significant; thus our three-threshold preselection measure does not lead to a significant difference. It also benefits from the dual channel option more than DWT-SCS because more than one value in a region are marked which is likely to confuse the feature detection. 4.3 Discussion 4.3.0.5 Channel Independence We found that the channels in our DWT-Dual-Channel watermarking system are not completely independent. This seems surprising at first glance, since theoretically the image reconstructed after marking should produce at least the same

4.3. DISCUSSION 87 DWT representation for detection as left by the watermarking system s embedding stage. Therefore modifications made to a number coefficients in a particular subband/area should not affect any other locations in the decomposed image. However even without having attacked our marked images, the feature detection was found to produce wrong positions leading to detection results of less than 100%. The reason for this is the fact that embedding in the DWT domain by changing some coefficients often leads to reconstructed images with not all pixel values fitting into the [0...255] range. When writing to an ordinary image format, these values will be set to 0 and 255 respectively which is a change far more significant than the quantisation from floating point to integer numbers alone. Thus, after decomposing such marked images for reading the watermark does in fact not reproduce the previous DWT representation. Furthermore, there will be differences not only in the marking channel, but throughout the whole decomposed image. We could verify this explanation by saving our marked images in a floating-point-based image format [Die01], so that no information was lost when writing and reading the marked file. The detection results were perfect now. This shows that the DWT dual channel technique can provide only almost independent channel pairs for watermarking. 4.3.0.6 Overall Performance With our experimental setup we did not achieve the same robustness against the StirMark attack as claimed by Ker. There are various reasons for this, starting with the fact that Ker s feature detection and embedding algorithms were designed for use in the spatial rather than the DWT domain as discussed above. Next, the feature detection has problems with the rescaling performed by the StirMark attack. Also the dual channel option does not actually provide 100% independent channels (see section 4.3.0.5). And finally, as far as the DWT- PatchworkRegion embedding is concerned, our DWT-based application is weaker than Ker s application apart from the the differences between the spatial and the DWT domain: while Ker s detector is based on calculating the probability whether a particular watermark is in the image or not, our detector reads embedded bits and puts them together to form a message. This means that for every bit, the probability value provided by the DWT-PatchworkRegion detector is discarded and a yes-or-no decision is made instead which of course leads to a loss in confidence for the detection result.

88CHAPTER 4. GEOMETRIC ATTACKS AND THE DUAL CHANNEL APPROACH 4.3.1 Conclusion We implemented a second generation watermarking scheme operating in the DWT domain applying the dual channel concept for colour images to grey-scale images. The technique does not yet achieve robustness against the StirMark attack. Besides that, the scheme s capacity for watermarks is rather modest, because dividing the image s DWT representation into channels limits the space for marking. As the scheme s main weakness we identified the lack of robustness against the resizing and cropping performed by StirMark as the feature detection s precision drops below 100% at a considerable number of locations after this attack. The resizing and cropping attack is not purely geometric, coefficients values are also changed by the interpolation performed during resizing, however the two embedding techniques robustness against this effect could not be established due to the lack of a sufficiently reliable feature detection. Thus, next generations of of our watermarking schemes need to improve the feature detection s performance more than anything else.

Chapter 5 A New Approach to Second Generation Watermarking Embedding techniques based on manipulating single coefficients per bit of embedded information (like e.g. the DWT-SCS) require the exact locations of previously marked coefficients, however our results in chapter 4 suggest that this is not easy to accomplish, in particular after combinations of geometric and signal processing attacks like StirMark. Hence, investigations on how to further optimise the feature detection are the logical next step. In this chapter we present a new approach to second generation watermarking which we believe can be the starting point to a generation of both simpler and more robust methods for locating previously marked coefficients. 5.1 Training-based Feature Recognition Existing second generation watermarking schemes usually use the same approach to select coefficients for marking and for detection. This is expected to yield good features that hopefully survive possible attacks and can then be found again when marking. But is the identification of good features really needed for watermark detection? And does not selecting coefficients and locating features usually require different techniques? Our DWT implementation of the dual channel concept suffered from insufficient precision of the feature detection. While the feature detection we had used could certainly be improved in many ways, we were also faced with modest capacity and less than full channel independence of our 89

90CHAPTER 5. A NEW APPROACH TO SECOND GENERATION WATERMARKING dual channel implementation. Furthermore, for the DWT-SCS embedding significant coefficients should be chosen, but good features in the selection channel returned by the feature detection do not necessarily correspond to significant coefficients in the marking channel. Instead of simply looking for a better algorithm for the feature detection, one could change the approach to determining image coordinates for marking and detection by applying different methods for selecting locations for marking and detecting features. This could potentially also solve the problems of limited capacity and the selection of coefficients with too little energy. We thus propose a new framework including a training-based feature recognition algorithm as displayed in Figure 5.1. Watermark Embedding Cover Image Location Selection Algorithm Embedding Algorithm Training Algorithm Watermark Marked Image Key Watermark Detection Marked Image Detection Algorithm Detection result: Watermark Probability Yes/No Key Feature Recognition Algorithm Figure 5.1: A new framework for Second Generation Image Watermarking

5.1. TRAINING-BASED FEATURE RECOGNITION 91 5.1.1 Marking an Image Before marking, coefficients are selected according to heuristics on the quality of image features surrounding them and their suitability depending on the chosen embedding algorithm. The watermark is then embedded in the chosen locations. Then a training on the embedding locations in the marked image is performed. During this process, a secret key gets generated from the training data and the input parameters to the watermarking scheme. This key is later needed for extracting the watermark. The marking process is an optimisation in comparison to dual channel marking in several ways: since training is performed on the marked image, the mark cannot interfere when later reading the watermark, also significantly larger parts of the image are available for marking than in the the DWT-dual-channel scheme since a division into channels is no longer necessary, leading to potentially larger capacity for watermarks. 5.1.2 Reading a Watermark For reading the watermark, the training data from the secret key obtained after marking is needed. It is fed into a feature recognition algorithm which attempts to recover the original marking locations from the received image. The watermark bits are then read at the resulting locations. The beauty of this approach lies in its simplicity: the unnecessary classification of image features is skipped, and since the feature recognition is optimised for particular locations, the probability of returning completely wrong locations is much lower than with feature detections that return scores on locations according to some predefined concepts of features. 5.1.3 Classification of the new Approach According to the definitions from section 2.1.3, the training-based approach belongs into the class of second generation watermarking schemes, because the image s perceptual features are involved in the watermarking process. Schemes following this approach can be either blind or non-blind, operate in the spatial or some transform domain, the selection algorithm can even be designed to include visual models for image-adaptive watermarking. However in its basic form, the training-based approach can be what Craver

92CHAPTER 5. A NEW APPROACH TO SECOND GENERATION WATERMARKING et al. call invertible in [CMYY96] (see also section 2.1.4), because the choice of locations for marking is not limited in any way. To produce a counterfeit original as described by Craver, an attacker would only have to look for a sequence of locations in the image Î which would result in a plausible watermark message if the chosen watermark detection algorithm were to read the watermark bits from those locations. If the chosen embedding algorithm allows this, the attacker would then modify the image in a way that marking these locations produces Î and obtain the counterfeit original Î. Since the selection algorithm is not defined by the framework, the last step would be to choose a selection algorithm that returns the very locations picked and processed in the previous two steps. To make the counterfeit original protocol attack impossible, the selection algorithm needs to be made non-invertible. This can be accomplished by involving a non-invertible (i.e. cryptographic) hash, either as a pre- or a post-selection step. This does not have any effect on the watermark s robustness against image processing attacks, because the feature recognition is always performed on all possible locations in the image. We consider it necessary for practical implementations to include this measure, however we will not discuss it any further here, as this would be outside the scope of our investigation into the watermark s robustness against sophisticated image processing attacks. The secret key needed for storing the training data for later extraction of the watermark is a technical and not a legal necessity for the scheme and should be kept secret. This reason for this is that attackers could otherwise use a trial and error method to render the watermark unreadable. A registration of this key at a registration centre (provided there is such an infrastructure available) might be beneficial in legal disputes, however it is beyond the scope of this research to make such claims. 5.2 An Implementation We implemented the training-based watermarking approach as an extension to the watermarking scheme described in section 4.2.4, so that all embedding algorithms, debugging features and configuration options are still available. Embedding and detection takes place in the DWT domain, and we allow any combination of subbands or even areas (HL, LH, etc.) within subbands for marking.

5.2. AN IMPLEMENTATION 93 5.2.1 The WISARD Image Recognition Concept In principle, any training-based image recognition algorithm can be used for training-based watermarking. The most popular family of such algorithms are neural network simulators, but there is also a group of concepts sharing some of NN properties but more optimised on particular tasks. One of these is the WIS- ARD architecture, presented by Aleksander et al. in [AWP84], which is optimised on recognising binary images. Richard Bowles gave a practical description and example implementation of the WISARD concept for recognising binary images in [Bow03] that we here briefly summarise. The heart of the WISARD architecture is the discriminator element which is a 16-bit object with random access. Each bit in a discriminator can be accessed by a four-bit address (2 4 = 16). This structure can now be associated with a binary image by randomly combining four image pixels to initialise such a four-bit address, thus addressing a bit in the discriminator. It follows that one discriminator can be linked to 4 image pixels; for recognition of larger images, an array of discriminators can be used. At setup, the random mapping (without repetition) of image locations to address bits is created, so that up to every image pixel x h is now associated with one address bit a i,k for discriminator d i 1. Also all discriminator bits are initialised to zero. A discriminator (or a sequence of discriminators) can be trained on one or more images, more (usually slightly different) images will lead to a more tolerant recognition result. For each image, training involves only one step: the image s pixel values (either 0 or 1) set addresses in the discriminators they had been connected to at setup and set the addressed discriminator bits to one. After having performed this step for all training images, the discriminators state can be saved as training data. Image recognition uses a setup similar to training, i.e. the same (pseudo-) random pixel-to-address wiring needs to be performed at initialisation. Then the discriminators are set to the same state as after training by loading the previously stored training data. Then an image can be presented to the discriminator-array, and a score is calculated by checking whether the addresses triggered by the new image resolve to non-zero discriminator bits. This also explains why the 1 The PRNG seed used to produce this sequence needs to be the same for training and recognition and will thus be part of the secret key after marking.

94CHAPTER 5. A NEW APPROACH TO SECOND GENERATION WATERMARKING algorithm reacts more tolerantly the more training images it had been presented: this increases the number of non-zero bits in the discriminator-array and thus the chance to encounter a non-zero bit at an address generated by a new image s pixel values. The advantages of this scheme are instant training, simplicity, speed and, in our case of DWT-based watermarking, it operates on binary images. Why this last point is an advantages can be explained by the properties of a decomposed image s detail subbands: most coefficients are zero or close to zero, significant values are found mainly in the regions of perceptual features, like edges, textures, etc. With a suitable quantisation threshold, such regions around features can be reduced to binary images hopefully unique and clear enough to allow precise feature recognition. In our implementation, the discriminators are configurable by a parameter B for the rectangular feature regions side length. Secondly, the zero-one quantisation is controlled by another, usually larger size specification A: the rectangular AxA-sized region inside which the coefficients average value x and the standard deviation σ x is calculated. The zero-one quantisation on the BxB-sized feature region F then uses these x and σ x to determine a threshold for calculating the region s values f i from their corresponding coefficients x i : 0 : x i x < ασ x f i = 1 : otherwise. (5.1) The parameter α is used to control the number of non-zero f i in the result. This method is based on the understanding that for recognising features from an area in a DWT detail subband the coefficients the coefficients with values outside the average plus/minus the standard deviation are most relevant 2. In detail regions of a wavelet-decomposed image, x is typically close to zero, and the coefficients relevant for recognising features are thus the ones with high energy. Because x and σ x are calculated for each region surrounding a marked position individually, the zero-one quantisation adapts to the image s local properties. The choice of coefficient locations for marking depends on the subbands and/or areas we allow and on the selection strategy. The simplest one of these is to just select the most significant coefficients found in the marking regions. In principle, 2 This was established for face detection and feature extraction in telemedicine applications by Aljawad et al. [Alj04].

5.3. EXPERIMENTAL SETUP 95 any of the selection strategies (like even the MatrixCorrelation algorithm from section 4.2.4) could be used. We do not check for marking locations very close to each other, but the program generates a warning if identical training data is produced. 5.3 Experimental Setup The experimental setup was widely similar to the one used on the dual-channel watermarking as described in section 4.2.5. The first step was to find the best configuration to the Discrim feature recognition and evaluate its performance. For this, we used the Obvious embedding and ran the scheme with other parameters that were expected to lead to good results, like third subband for embedding, simulating an attack by StirMark with the gentle settings described in section 4.2.6.2. The Obvious embedding was found to usually survive the StirMark attack, so falsely detected watermark bits could be expected to result from wrong positions returned by the feature recognition. The test procedure was repeated on all 10 test images (see Appendix A) and the 5 watermarks shown in Figure 4.2 in section 4.2.5 also using different parameters to the Discrim feature recognition, like B, A and α. The results from this experiments helped to find some configuration settings often leading to good results which were then applied with a real embedding technique, DWT-SCS. We used a relatively high embedding intensity which nevertheless still provides a good compromise for watermark robustness and image quality in the third subband: = 80 and α = 1.1. Apart from this, we kept all settings from the experiment for testing the feature recognition. As watermark we first used the small images (36 bits) from figure 4.2 in section 4.2.5 for speed reasons, we then tested the results on larger watermarks. For the small watermarks we scored the detection results by counting the number of falsely detected bits. Throughout the experiments we allowed marking only in the third subband.

96CHAPTER 5. A NEW APPROACH TO SECOND GENERATION WATERMARKING 5.4 Experimental Results 5.4.1 Feature Recognition Performance There are 5 factors of possible influence on the feature recognition s performance: the image, the wavelet filter, the feature region size B, the size A of the statistics region in which x and σ x are calculated per location and the quantisation scaling factor α. Due to the number of possible permutations, we did not attempt to find the one optimal setting to the feature recognition but started with a seemingly reasonable subset of possible settings to each parameter: 3 Feature region sizes: B = 16, B = 18, B = 20 3 Statistics regions sizes: A = B, A = B + 4, A = B + 8 6 Quantisation scaling factors: α = 0.1, α = 0.4, α = 0.7, α = 1.0, α = 1.3, α = 1.6 The choice of filters include both, orthogonal and biorthogonal filters and also different filter lengths. In previous experiments (see section 3) all of them had been found to perform well with the DWT-SCS embedding which like the Obvious scheme embeds single bits in single coefficients. The chosen values for B had been determined by a small number of initial experiments which had shown that smaller values generally lead to poor results while larger values make the feature recognition too computationally expensive while not always improving anything. With the above settings we obtained a ranking of configurations and average performances over the 10 images and 5 watermarks of which we display the better results with error rates less than 40% in table 5.1. Appendix 2 contains the top third of all results together with the corresponding configurations. These tables are organised in the following way: the two leftmost columns contain the average absolute and relative error rates (i.e. the number of falsely detected watermark bits) which are the sorting criteria for the tables. The absolute errors σs indicate the spread of results from the 50 samples per average result, and the four remaining columns contain the configuration used to obtain these average results. Thus, the tables show both, the best feature detection performances and the configuration with which these were achieved.

5.4. EXPERIMENTAL RESULTS 97 Abs. errors Rel. errors Abs. errors σ Filter B A α 13.400 37.222% 4.997 Haar 16 16 0.7 13.400 37.222% 5.710 Haar 16 16 0.1 13.440 37.333% 4.338 Villa6 18 22 1.0 13.480 37.444% 7.100 Villa1 16 16 0.4 13.560 37.666% 6.211 Villa3 18 22 1.6 13.560 37.666% 6.237 Villa3 16 20 1.0 13.600 37.777% 6.886 Brislawn 18 26 0.7 13.620 37.833% 5.858 Villa6 16 24 1.3 13.660 37.944% 5.423 Villa6 18 18 1.3 13.720 38.111% 5.831 Villa4 16 20 1.0 13.720 38.111% 6.207 Villa4 18 18 1.3 13.740 38.166% 6.265 Antonini 20 20 0.1 13.780 38.277% 5.104 Haar 18 22 0.7 13.780 38.277% 6.667 Brislawn 16 20 0.7 13.800 38.333% 5.492 Haar 16 20 0.1 13.880 38.555% 6.002 Villa4 16 20 0.4 13.920 38.666% 5.937 Villa6 20 24 0.7 13.940 38.722% 7.257 Antonini 20 28 1.3 13.960 38.777% 4.439 Haar 16 24 1.6 13.960 38.777% 5.598 Haar 16 20 1.6 13.980 38.833% 5.615 Villa4 20 24 1.0 14.000 38.888% 6.020 Villa6 16 24 0.4 14.020 38.944% 5.633 Haar 18 18 1.3 14.060 39.055% 6.001 Villa5 20 24 1.6 14.080 39.111% 5.702 Haar 20 24 0.4 14.120 39.222% 6.103 Villa4 16 16 0.7 14.160 39.333% 5.704 Daub4 20 24 1.0 14.180 39.388% 6.460 Villa3 18 22 1.3 14.200 39.444% 5.341 Haar 20 20 0.1 14.200 39.444% 6.013 Haar 16 24 0.7 14.220 39.500% 5.084 Haar 18 18 0.1 14.260 39.611% 5.717 Villa2 16 24 0.4 14.260 39.611% 5.885 Villa4 16 16 1.0 14.280 39.666% 5.054 Villa1 16 24 0.1 14.280 39.666% 5.383 Antonini 18 18 1.6 14.280 39.666% 6.074 Haar 16 16 1.3 14.300 39.722% 5.500 Villa4 16 20 1.3 14.340 39.833% 6.400 Villa5 20 20 1.3 14.360 39.888% 6.166 Villa5 20 28 0.4 14.360 39.888% 7.064 Antonini 18 26 1.3 Table 5.1: The feature recognition performance using obvious embedding

98CHAPTER 5. A NEW APPROACH TO SECOND GENERATION WATERMARKING The experimental results indicate that there are some filters leading to better results with different combinations of B, A and α; unfortunately there does not seem to be a clear relationship indicating that a particular set of parameters is better than others in general or in combination with a particular filter. Having examined the top and the bottom thirds of the complete ranking, we could establish that the following filters had the best properties: Filter # in top third # in bottom third Haar 39 5 Villa6 31 8 Villa4 28 10 Daub4 26 12 Villa3 20 3 Villa5 19 17 Antonini 18 18 Brislawn 17 22 Villa1 9 25 Villa2 8 28 Odegard 7 34 Daub6 5 33 Daub8 5 27 This ranking is derived from the number of times a filter was used in a configuration leading to a place in the top third of the performance ranking. This can be seen in the second column. In the third column the number of occurrences in the bottom third of the performance ranking is displayed; it shows that the best filters are only very rarely found in that bottom region. Our previous experiments (see section 3.1) had revealed that different embedding techniques lead to different optimal choices of wavelet filters. This effect is even increased in the training-based watermarking: the watermark s quality depends on both the embedding scheme s robustness and the feature recognition performance. Since the training is performed after marking, the mark becomes part of the image s perceptual features used for locating watermark bits. Thus, different combinations of filter/embedding have the potential to lead to different feature recognition results.

5.4. EXPERIMENTAL RESULTS 99 5.4.2 Overall Performance In a second experiment we picked kept most settings from the previous experiment but used the DWT-SCS instead of the Obvious embedding. Consequently, not only the watermark robustness but also the image quality needed to be considered now. Unlike the Obvious embedding, the DWT-SCS was expected to be vulnerable against the StirMark attack to a certain extent, so that the results were expected to exhibit slightly higher average error rates and different optimal choices of Discrim settings and filters. Since the used embedding intensity was the same throughout the experiments, the image degradation by marking remained mostly on the same level throughout all combinations of cover image and watermark. Due to the small watermark size, the degradation was very low, MSEs ranged from 0.06 to 0.12. The watermark robustness of course differed much more depending on the marking settings. Unlike with the Obvious embedding, there are no filters standing out in performance. Like before, Haar still performs well but not better than others, like Odegard and Villa2. No filter was found to lead to significantly worse results than others which leads to the conclusion that the choice of filter does not play a very important role with the DWT-SCS embedding. The watermark robustness of the DWT-SCS looks relatively poor. The best results achieved are above 45.8% which indicates that either the embedding is not robust enough or has a negative effect on the feature recognition. Samples taken at higher intensities ( = 100 and α = 1.2) did not lead to an improvement. 5.4.3 Large Watermarks We also tested our watermarking system on watermarks larger than 6x6 pixels which could carry meaningful messages. These experiments quickly revealed that with the given selection policy most images exhibit only a limited number of unique features which can be exploited for the feature recognition. When training the discriminator, a set of training data is generated. Only if this training data is unique for each trained image position, a reliable feature recognition is possible. When increasing the watermark size in our experiments we found that embedding in the 3rd subband always resulted in several duplicates in training data sets leading to poor detection performance. This indicates that for larger watermarks

100CHAPTER 5. A NEW APPROACH TO SECOND GENERATION WATERMARKING Abs. errors Rel. errors Abs. errors σ Filter B A α 16.520 45.888% 3.221 Daub4 18 18 0.7 16.520 45.888% 3.860 Daub4 18 26 0.7 16.540 45.944% 3.118 Daub4 20 24 0.1 16.680 46.333% 3.241 Villa5 20 24 1.0 16.700 46.388% 3.085 Daub4 16 16 1.6 16.740 46.500% 3.212 Daub4 16 16 0.1 16.760 46.555% 2.773 Villa3 16 16 1.0 16.760 46.555% 2.868 Daub4 18 22 0.4 16.780 46.611% 4.026 Daub4 20 20 0.7 16.780 46.611% 4.267 Daub4 16 20 1.3 16.820 46.722% 3.081 Villa5 16 20 1.0 16.840 46.777% 2.902 Villa5 20 28 1.6 16.860 46.833% 2.740 Villa5 20 20 1.6 16.880 46.888% 2.875 Haar 18 18 0.7 16.880 46.888% 3.034 Villa4 18 26 1.6 16.880 46.888% 3.341 Haar 18 22 1.3 16.900 46.944% 2.977 Villa3 18 18 1.6 16.940 47.055% 3.012 Haar 18 26 1.3 16.940 47.055% 3.309 Daub4 16 24 1.0 16.960 47.111% 2.769 Villa5 18 26 0.4 16.960 47.111% 2.996 Villa5 16 20 0.1 16.960 47.111% 3.392 Villa4 18 18 0.1 16.960 47.111% 3.451 Villa4 16 16 0.1 16.980 47.166% 3.067 Villa5 20 20 0.7 16.980 47.166% 3.914 Daub4 20 20 0.4 17.000 47.222% 2.680 Daub4 16 24 1.3 17.000 47.222% 2.864 Haar 16 24 0.4 17.000 47.222% 3.181 Daub4 20 20 1.3 17.020 47.277% 2.272 Haar 16 24 0.7 17.020 47.277% 2.831 Haar 18 18 0.4 17.020 47.277% 3.046 Villa5 20 28 0.7 17.020 47.277% 3.395 Villa5 16 24 1.6 17.040 47.333% 2.709 Haar 16 16 1.0 17.040 47.333% 2.709 Villa5 20 20 0.1 17.040 47.333% 2.709 Haar 16 16 1.0 17.040 47.333% 2.709 Villa5 20 20 0.1 17.040 47.333% 2.968 Villa5 20 24 0.1 17.040 47.333% 3.135 Villa3 20 28 1.6 17.060 47.388% 2.558 Villa6 20 20 1.3 Table 5.2: The feature recognition performance using obvious embedding

5.5. DISCUSSION 101 improved methods of location selection and feature recognition will be necessary. 5.5 Discussion In comparison to the dual-channel watermarking scheme from section 4.2, the approach based on feature-recognition is far simpler (i.e. less fine-tuning parameters of critical importance) but nevertheless shows better resistance against the Stir- Mark benchmark. It can potentially circumvent the capacity problem resulting from the dual-channel watermarking s splitting of the decomposed image s DWT subbands/areas into selection and marking channel. Robustness against the Stir- Mark benchmark depends on the parameters to the marking scheme. While the experimental results do not indicate an optimal combination of the B, A and α parameters, there is a group of wavelet filters that clearly outperforms the others. For the feature detection, the optimal filter is Haar which can be explained by the fact that it produces the clearest features and the largest number of significant coefficients in the detail areas of the decomposed image. Other good choices include filters known to perform well with the DWT-SCS embedding for watermark robustness and image quality as reported in section 3.1.2, like Villa6, Daub4 and Villa3. With the DWT-SCS embedding the performance goes down as it had to be expected since the embedding is now supposed to be invisible and less brutal than the Obvious embedding. There are a fairly large number of configurations leading to less than 48% errors, however there is no known configuration that will always lead to good robustness. The scheme has more capacity than the DWT- Dual-Channel marking, yet this is not enough to accommodate watermarks large enough to carry meaningful messages in the third subband. We consider the above results significant and encouraging. The feature recognition used in our implementation is rather simplistic, so is the heuristic used for selecting coefficients for marking. This leads to possible optimisations which are subject of future research. We think of training the discriminator not only on the original feature but also slightly rotated versions of it to simulate some of the effects of possible geometric attacks. This is however not trivial since this would mean making the feature recognition more tolerant which could possibly lead to a loss in precision. Another approach could be to use training-based

102CHAPTER 5. A NEW APPROACH TO SECOND GENERATION WATERMARKING feature recognition algorithms more sophisticated than the WISARD approach. Also Ker s results in [Ker01] show that a watermark embedding bits in patches of coefficients rather than single coefficients can help overcoming the problem of insufficient precision in the feature recognition. The DWT-PatchworkRegion embedding proved to produce too many problems in the DWT domain (visible artifacts, loss of robustness due to having had to change the detection algorithm, see section 4.2.4.2), thus a new embedding technique should be developed.

Chapter 6 Conclusions and Further Work Robustness against the StirMark benchmark [PAK98a] is still not achieved by most of today s robust watermarking schemes. Because of the variety of attacks combined by StirMark, trying to invent counter measures against every single one does not make sense: the resulting watermarking scheme would get very complex, and the way a watermark will be attacked is usually not known when embedding the mark. Trying to reconstruct an image after geometric attacks falls into the same category, in particular because in blind watermarking there is no access to the original image, and as established by Craver et al. in [CMYY96] and Zeng et al. in [ZL97], only blind watermarking can provide sufficient robustness against protocol attacks. The approach thus adopted in the research project presented in this thesis was to investigate attacks according to two categories: signal processing and geometric. We investigated measures to achieve robustness against these two kinds of attacks. To cope with signal processing attacks, the choice of wavelet filter and embedding method is of particular importance. We established that the choice of filter depends most on the kind of attack and the embedding method. Two embedding methods were tested against the lossy compression attacks, both adaptations of existing embedding techniques for embedding and detecting in the DWT domain: DWT-Multiplicative, based on Cox s spread spectrum embedding from [CKLS97], and DWT-SCS, based on Eggers Scalar Costa Scheme from [ESG01]. The optimal choice of filter turned out to depend on the embedding technique to a minor extent. The requirements of robustness against attacks and maintaining good image 103

104 CHAPTER 6. CONCLUSIONS AND FURTHER WORK quality were found to contradict, and consequently there were usually different filters found to be optimal choices for either of these two requirements. In particular, the watermark robustness rankings differed depending on the kind of lossy compression, either JPEG or a simple DWT-based scheme. However there was one filter found to have good overall properties: Villa3 usually leads to good robustness at low image degradation regardless of the embedding technique and with most of the two compression attacks we tested in our experiments. A noise reduction attack operating in the DWT domain and targeting watermarks embedded with higher intensities was found to do only little damage. Sophisticated attacks like StirMark perform not only signal processing, but also geometric transforms to render watermarks unreadable. This leads to a particular focus on the way marked coefficients in the image are located for watermark detection. The class of second generation watermarking schemes are characterised by the fact that they include the image s perceptual features in the marking and detection process [KBE99]. Instead of remembering marking locations by their coordinates, such schemes remember the image features surrounding them, so that even after geometric transforms the mark can be read. However marking adds noise to the image which could cause the feature detection before detection problems. Ker proposed dividing the image into a selection and a marking channel using colour images colour components as channels in [Ker01]. We extended this idea for our DWT dual channel marking, using the image s representations in a Pyramid decomposition as channels instead, thus making this concept usable for any kind of image. The result was a watermarking scheme with improved robustness, but the robustness claimed by Ker could not be achieved. Experimental results indicate that after StirMark s signal processing the feature detection described by Ker tends to return coordinates missing the exact location by one or two pixels after attacks when applied in the DWT domain. This has significant implications on the embedding scheme to be used in such a scheme: The DWT-SCS embedding which had exhibited good results in previous experiments needs exact marking locations because information is embedded in single coefficients. If a coefficient is missed even by only one coefficient position, the information is lost. Ker s scheme used an embedding which marks a rectangular region around the position returned by the feature detection making the scheme less vulnerable against the feature detection s lack of precision, however

105 it was found to produce visible artifacts when applied in the DWT domain. Another problem identified with the DWT dual channel marking was a tendency to lack capacity for large marks, because the space available in the image s chosen subbands had to be divided into selection and marking channel thus reducing the size of the markable area in the image. As a solution to these problems we presented a new approach to second generation watermarking: instead of performing the same feature detection before embedding and marking, we proposed a framework for second generation watermarking based on training-based feature recognition methods. The advantage of such an approach is that for embedding and detection two different algorithms are used allowing to optimise them better for their tasks: finding the best locations for marking and locating previously chosen marked coefficients. Since the training-based approach is fairly general, it is not restricted to DWT-based watermarking schemes; it can be adopted for embedding in any domain. We presented an example implementation which used the WISARD recognition method for binary images presented by Aleksander et al. in [AWP84]. Experimental results showed improved robustness against the StirMark attack. The feature recognition was found to reach an average watermark bit detection error rate of little more than 37% after a StirMark attack at modest settings. Using DWT-SCS embedding in the same test bed, average watermark bit detection error rates down to 45.9% could be achieved, which is a modest improvement over the results obtained with the DWT dual channel marking which were above 46.8%. Our training-based approach to second generation watermarking can be further optimised, like by training the recognition algorithm on not only the original embedding locations but also slightly modified, e.g. rotated, versions simulating possible geometric attacks. Also one could think of more sophisticated feature recognition algorithms and selection criteria than the one used in our implementation. Finally, a new embedding technique based on marking regions of coefficients per watermark bit, like the DWT-PatchworkRegion, could help overcoming problems resulting from insufficient feature recognition robustness. The development of advanced training-based second generation watermarking schemes will be subject of future research.

Bibliography [ABMD92] Marc Antonini, Michel Barlaud, Pierre Mathieu, and Ingrid Daubechies. Image coding using wavelet transform. IEEE Trans. on Image Processing, pages 205 220, 1992. [Alj04] Naseer Aljawad. Wavelet based Face Detection and Feature Extraction Analysis of Video Images (in preparation). PhD thesis, University of Buckingham, 2004. [AP98] Ross J. Anderson and Fabien A.F. Peticolas. On the limits of steganography. IEEE Journal of Selected Areas in Communications, pages 474 481, 1998. [AWP84] Igor Aleksander, W.V.Thomas, and P.A.Bowden. Wisard: a radical step forward in image recognition. Sensor Review, 4:120 124, 1984. [BGML96] Walter Bender, Daniel Grul, Norishige Morimoto, and Anthony Lu. Techniques for data hiding. IBM Systems Journal, 35:313 336, 1996. [Bow03] Richard Bowles. An idiot s guide to neural networks. http://richardbowles.tripod.com/neural/wisard/wisard.htm (accessed 2004), 2003. [CKLS97] Ingemar J. Cox, Joe Kilian, Tom Leighton, and Talal Shamoon. Secure spread spectrum watermarking for multimedia. IEEE Transactions on Image Processing, 6(12):1673 1687, 1997. [CMYY96] Scott Craver, Nasir Memon, Boon-Lock Yeo, and Minerva Yeung. Can invisible watermarks resolve rightful ownerships? IBM Cyber Journal, pages 310 321, 1996. 106

BIBLIOGRAPHY 107 [Cos83] Max Costa. Writing on dirty paper. IEEE Transactions on Information Theory, 29, no. 3:439 441, 1983. [Cra98] Scott Craver. On public-key steganography in the presence of an active warden. Lecture Notes in Computer Science, 1525:355 368, 1998. [CW98] Brian Chen and Gregory W. Wornell. Digital watermarking and information embedding using dither modulation. In Proceedings IEEE Workshop on Multimedia Signal Processing, pages 273 278, 1998. [CW99] Brian Chen and Gregory W. Wornell. Achievable performance of digital watermarking systems. In IEEE Int. Conf. on Multimedia Computing & Systems, volume 1, pages 13 18, 1999. [Dau88] Ingrid Daubechies. Orthonormal bases of compactly supported wavelets. Communications on Pure and Applied Mathematics, 41:909 996, 1988. [Dav97] Geoff Davis. Wavelet image compression construction kit. http://www.geoffdavis.net/dartmouth/wavelet/wavelet.html (accessed 2004), 1997. [Die01] Martin Dietze. A portable floating point image format. http:// herbert.the-little-red-haired-girl.org/en/pfi/index.html (accessed 2004), 2001. [Die02] Martin Dietze. A wavelet class library. http://herbert. the-little-red-haired-girl.org/en/wavelet/index.html (accessed 2004), 2002. [DJ02] Martin Dietze and Sabah Jassim. The choice of filter banks for wavelet-based robust digital watermarking. In Proceedings ACM Multimedia 2002 Workshop on Multimedia and Security, ACM ISBN 1-58113-639-0, pages 37 41, 2002. [DJ03] Martin Dietze and Sabah Jassim. Filters ranking for dwt-domain robust digital watermarking, 2003. EURASIP Journal for Applied Signal Processing special issue on Multimedia Security and Rights Management.

108 BIBLIOGRAPHY [DRA98] Rakesh Dugad, Krishna Ratakonda, and Narendra Ahuja. A new wavelet based scheme for watermarking images. University of Illinois at Urbana-Champaign, 1998. [ESG00] [ESG01] [FAQ04] Joachim J. Eggers, Jonathan K. Su, and Bern Girod. A blind watermarking scheme based on structured codebooks. In Proceedings IEE Colloquium: Secure Images and Image Authentication, London, page 4/14/6, 2000. Joachim J. Eggers, Jonathan K. Su, and Bern Girod. Performance of a practical blind watermarking scheme. In Proceedings SPIE Security and Watermarking of Multimedia Contents III, volume 4314, 2001. Cryptography FAQ. 06/10: Public key cryptography. http://www. faqs.org/faqs/cryptography-faq/part06/ (accessed 2004), 2004. [Gro04] The JPEG Group. Jpeg 2000. http://www.jpeg.org/jpeg2000/ index.html (accessed 2004), 2004. [HRP + 98] [IMYK98] [JFS95] Alexander Herrigel, Joseph O Ruanaidh, Holger Petersen, Shelby Pereira, and Thierry Pun. Secure copyright protection techniques for digital images. Lecture Notes in Computer Science, 1525:169 190, 1998. Hisashi Inoue, Akio Miyazaki, Akihiro Yamamoto, and Takashi Katsura. A digital watermark based on the wavelet transform and its robustness on image compression. In Proceedings IEEE Int. Conf. on Image Processing, volume II, pages 391 395, 1998. Charles E. Jacobs, Adam Finkelstein, and David H. Salesin. Fast multiresolution image querying. Computer Graphics, 29:277 286, 1995. [JS94] Björn Jawerth and Wim Sweldens. An overview of wavelet based multiresolution analyses. SIAM Review, 36(3):377 412, 1994. [KBE99] Martin Kutter, Sushil K. Bhattacharjee, and Trouradj Ebrahimi. Towards second generation watermarking schemes. In 6th International Conference on Image Processing (ICIP 99), Kobe, Japan, volume 1, pages 320 323, 1999.

BIBLIOGRAPHY 109 [Ker83] Auguste Kerckhoffs. La cryptographie militaire. Republication online: http://www.petitcolas.net/fabien/kerckhoffs/ la_cryptographie_militaire_i.htm (accessed 2004), 1883. [Ker01] Andrew D. Ker. An idea for a blind watermarking scheme resistant to stirmark. Programming Research Group Technical Report RR-01-14, 2001. [KKK + 02] Bong-Seok Kim, Kee-Koo Kwon, Seong-Geun Kwon, Kyung-Nam Park, Kyu-Ik Song, and Kuhn-Il Lee. A robust wavelet-based digital watermarking using statistical characteristic of image and human visual system. In Proceedings of the International Technical Conference on Circuits/Systems (ITC-CSCC), Vol 2, pages 1019 10022, 2002. [KM99] [Ma02] [Mal89] [Mee01] [PAK98a] [PAK98b] [PAK99] Jong Ryul Kim and Young Shik Moon. A robust wavelet-based digital watermarking using level-adaptive thresholding. In Proceedings of the IEEE International Conference on Image Processing, 1999. Jinming Ma. Wavelet Based Images/Video Compression Techniques for Telemedicine Application. PhD thesis, University of Buckingham, 2002. Stephane G. Mallat. A theory for multiresolution signal decomposition: The wavelet representation. IEEE Transactions on Pattern Analysis and Machine Intelligence, 11(7):674 693, 1989. Peter Meerwald. Digital image watermarking in the wavelet transform domain. Master s thesis, University of Salzburg, 2001. MSc Thesis. Fabien A.P. Petitcolas, Ross J. Anderson, and Markus G. Kuhn. Attacks on copyright marking systems, 1998. Introduces the StirMark benchmark software. Fabien A.P. Petitcolas, Ross J. Anderson, and Markus G. Kuhn. Attacks on copyright marking systems. In Information Hiding, pages 218 238, 1998. Fabien A.P. Peticolas, Ross J. Anderson, and Markus G. Kuhn. Information hiding a survey. Proceedings of the IEEE special issue on protection of multimedia content, 87(7):1062 1078, 1999.

110 BIBLIOGRAPHY [Pos95] [PZ98] [SDS96] [Sec04] Rehmi Post. A gentle introduction to wavelets. University of Massachusetts, online http://web.media.mit.edu/~rehmi/wavelet/ wavelet.html (accessed 2004), 1995. Christine I. Podilchuk and Wenjun Zeng. Image-adaptive watermarking using visual models. IEEE Journal on selected areas in communications, pages 525 538, 1998. Eric J. Stollnitz, Tony D. Derose, and David H. Salesin. Wavelets for Computer Graphics. Morgan Kaufmann, 1996. SecurePhone. Securephone home page. http://www.secure-phone. info (accessed 2004), 2004. [Sha93] Jerome M. Shapiro. Embedded image coding using zerotrees of wavelet coefficients. IEEE Trans. on Signal Processing, pages 3445 3462, 1993. [Sim84] Gustavus J. Simmons. The prisoner s problem and the subliminal channel. Advances in Cryptology CRYPTO 83, pages 51 67, 1984. [SJ90] Robert J. Safranek and James D. Johnston. A perceptually tuned sub-band image coder with image-dependent quantization and postquantization data compression. In Proceedings SPIE Conf. Human Visual, volume 1249, pages 284 293, 1990. [Str99] Øyvind Strømme. On the Applicability of Wavelet Transforms to Image and Video Compression. PhD thesis, University of Strathclyde, 1999. [Swe96] Wim Sweldens. Wavelets: What next? Proceedings of the IEEE, 84(4):680 685, 1996. [VBL95] [VM00] John D. Villasenor, Benjamin Belzer, and Judy Liao. Wavelet filter evaluation for image compression. IEEE Trans. on Image Processing, pages 1053 1060, 1995. Jacques Lévy Véhel and Anne Manoury. Wavelet packet based digital watermarking. In Proceedings International Conference on Pattern Recognition, Barcelona, Spain, pages 413 416, 2000.

BIBLIOGRAPHY 111 [WA94] [Wat93] John R. Williams and Kevin Amaratunga. Introduction to wavelets in engineering. International Journal for Numerical Methods in Engineering, 37:2365 2388, 1994. Andrew B. Watson. DCT quantization matrices visually optimized for individual images. In Proceedings SPIE Conf. Human Vision, pages 100 104, 1993. [Wik04] Wikipedia. Wikipedia, the free encyclopedia. http://www. wikipedia.org (accessed 2004), 2004. [WPD99] [WSK98] [ZL97] [ZL99] [ZLL99] Raymond B. Wolfgang, Christine I. Podilchuk, and Edward J. Delp. Perceptual watermarks for digital images and video. Proceedings of the IEEE, pages 1108 1126, 1999. Houng-Jyh Wang, Po-Chyi Su, and C.-C. Jay Kuo. Wavelet-based digital image watermarking. Optics Express 3, pages 491 496, 1998. Wenjun Zeng and Bede Liu. On resolving rightful ownerships of digital images by invisible watermarks. In IEEE International Conference on Image Processing, pages 414 418, 1997. Wenjun Zeng and Bede Liu. A statistical watermark detection technique without using original images for resolving rightful ownerships of digital images. IEEE Trans. Image Processing, pages 1534 1548, 1999. Wenjun Zeng, Bede Liu, and Shawmin Lei. Extraction of multiresolution watermark images for resolving rightful ownership. In S&T/SPIE Symposium on Electronic Imaging: Science & Technology, pages 404 414, 1999.

Index Active warden, 9 Antonini filter, 25 Attack bending, 16 claimed counterfeit original, 17 collusion, 15 counterfeit original, 17 filtering, 14 frequency displacement, 16 jitter, 14 lossy compression, 15 mark removal, 15 mosaic, 14 photocopying and scanning, 15 pseudo random noise, 15 resampling, 15 resizing and cropping, 16 rotation and shifting, 16 shearing, 16 Attacks geometric, 14 image processing, 13 interpretation, 16 presentation, 14 protocol, 13 robustness, 14 signal processing, 14 Average coefficients, 23 Basis functions, 22 Bending attack, 16 Biorthogonal wavelets, 24 Blind watermarking, 12 Claimed counterfeit original attack, 17 Coefficient detail, 23 Coefficients average, 23 high-pass, 23 low-pass, 23 Collusion attack, 15 Compact support, 25 Continuous wavelet transform, 20 Contrast masking, 19 Counterfeit original attack, 17 Cover-image, 9 Cover-text, 9 Cryptography, 9 CWT, 20 Data hiding, 8 Detail coefficients, 23 Digital image watermarking, 8 Direct sum, 22 Discrete cosine transform, 12 Discrete Fourier transform, 13 Discrete wavelet transform, 12, 20 Discrete wavelet transform, 5 Discriminator element, 93 112

INDEX 113 Domain spatial, 11 transform, 11 Dual channel watermarking, 73 DWT, 20 Embedding Patchwork, 31 SCS, 32 spread spectrum, 33 Feature detection, 71 Feature recognition, 91 Filter banks, 23 Filtering attacks, 14 Filter length, 25 Fingerprints, 4 Fragile watermarks, 3 Frequency displacement attack, 16 Frequency sensitivity, 18 Geometric attacks, 14 High-pass coefficients, 23 Human visual system, 18 HVS, 18 Image adaptive watermarking, 13 Image decomposition schemes, 25 Image processing attacks, 13 Interpretation attacks, 16 Invertible watermarking schemes, 17, 92 Invisible watermarks, 4 Jitter attack, 14 JND, 18 Just-noticeable difference, 18 Kronecker delta, 24 LL, 26 Lossy compression attack, 15 Low-pass coefficients, 23 Luminance sensitivity, 19 Mark removal attack, 15 Masks, 4 Mosaic attack, 14 Multiresolution, 20 Multiresolution analysis, 21 Multiresolution property, 21 Non-blind watermarking, 12 Orthogonal complement, 22 Packet decomposition, 27 Passive warden, 9 Patchwork Embedding, 31 Perceptual models, 18 Photocopying and scanning attack, 15 Presentation attacks, 14 Projection, 22 Protocol attacks, 13 Pseudo random noise attack, 15 Public key cryptography, 10 Public key steganography, 10 Public watermarking, 12 Pyramid decomposition, 25 Resampling attack, 15 Resizing and cropping attack, 16 Resolution level, 22 Robustness attacks, 14 Robust watermarks, 3 Rotation and shifting attack, 16 Scaling functions, 22

114 INDEX Second generation watermarking, 13, 71 SecurePhone, 29 Shearing attack, 16 Signal processing attacks, 14 Smoothness, 25 Spatial domain, 11 Standard decomposition, 26 Steganography, 8 Stego-key, 9 Stego-object, 9 StirMark, 5 Subbands, 23 haar, 21 mexican hat, 21 Wavelets biorthogonal, 24 Wavelets basis, 20 Wavelet transform continuous, 20 discrete, 20 WISARD, 93 Zerotree, 28, 64 Training, 91 Transform domain, 11 Visible watermarks, 4 Warden active, 9 passive, 9 Watermarking blind, 12 dual channel, 73 image adaptive, 13 invertible, 17, 92 non-blind, 12 public, 12 second generation, 13 Watermarks fragile, 3 invisible, 4 robust, 3 visible, 4 Wavelet, 20 filter banks, 23 function, 23

Appendix A The Test Images Figure A.1: From left to right: barbara, boat Figure A.2: From left to right: goldhill, lena 115

116 APPENDIX A. THE TEST IMAGES Figure A.3: From left to right: mandrill, peppers Figure A.4: From left to right: christina, freske1 Figure A.5: From left to right: zelda, freske2