Affine-Resistant Watermarking

Multimedia Security

2

Part 1:• Digital Watermarking Robust to Geometric

Distortions

Part 2:• Digital Watermarking Robust to Rotation,

Scaling, and Translation

Digital Watermarking Robust to Geometric Distortions

A public watermarking scheme on the basis of Image Normalization

4

One of the most challenging problems for digital watermarking is the resilience of watermarking to geometric attacks.

Such attacks are easy to implement, but can make many of the existing watermarking ineffective.

Examples of geometric attacks include:Rotation, Scaling, Translation, Shearing( 修剪 ), random bending, and change of the aspect Ratio.

5

Geometric attacks are effective in that they can destroy the “Synchronization” in a watermarked bit stream, which is vital especially for spread spectrum based watermarking schemes.

Out of synchronization is problematic, especially in applications where the original image is not available for watermark extraction.

6

Literature Survey:

Ruanaidh and Pun [Signal Processing, vol.66, pp.33-317, 1998] C.Y.Lin et.al. [IEEE Trans. on Image Processing, pp.767-782, May 2001]

Invariant properties of Fourier-Mellin transform to deal with RST attacks. This approach was effective in theory but difficult to implement. [log-polar-Fourier transformations]

7

Pereira and Pun [IEEE Trans. On Image Processing, pp.11231129, Jan 2000]

An additional template, known as “pilot” signal in traditionalcommunication systems, besides the watermark wasembedded in the DFT domain of the image. This embeddedtemplate was used to estimate the affine geometric attacks inthe image. The image first corrected with the estimateddistortion, and the detection of the watermark was performedafterwards.

This approach requires the detection of both thesynchronization pattern and the watermark. A potential problem arises when a common template is used for differentwatermarked images, making it susceptible to collusion-typedetection of the template.

8

Bas, Chassery and Macq [IEEE Trans. On Image Processing, pp.1014-1028, Sept 2002]

- An image Content Adaptive Watermarking Scheme

In this approach, salient feature points extracted from the image were used to define a number of triangular regions. A 1-bit watermark was then embedded inside each triangle using an additive spread spectrum scheme. This approach requires robust detection of the salient points in the image in order to retrieve the watermark.

9

Alghoniemy and Tewfik [ ICME Multimedia Expo. 2000]

A watermarking scheme using “moment” based image normalization. In this approach, both watermark embedding and extraction were performed using a normalized Image having a standard size and orientation.

Thus, it is suitable for public watermarking where the original image is not available. This approach was used to embed 1-bit watermark.

10

Watermarking Based on Image Normalization

Key Idea:

Use a normalized image for both watermark

embedding and detection!

The normalized image is obtained from a geometric transformation procedure that is invariant to any affine distortion of the image. This will ensure the integrity of the watermark in the normalized image even when the image undergoes affine geometric attacks.

11Image Normalization-based Watermarking System

Image NormalizationWatermark Embedding

Restore to original size and position

Watermark Extraction

Image Normalization

Watermark Embedder

Original image

Geometric Attacks

Watermark extractorWatermark message

Private key

Watermark message

Private key

12

A. Image Moments and Affine Transforms

Let f(x,y) denote a digital image of size M x N.

Its geometric moments mpq and central moments μpq,p,q = 0,1,…., are defined, respectively, as

)3(,

)2(),()()(

)1(),(

00

01

00

10

1

0

1

0

1

0

1

0

m

my

m

mxwhere

yxfyyxxand

yxfyxm

M

x

N

y

qppq

M

x

N

y

qppq

13

An image g(x,y) is said to be an affine

transform of f(x,y) if there is a matrix

A = and vector d = such that

g(x,y) = f(xa,ya ) , where

= A ． - d

a11 a12

a21 a22

d1

d2

xa

ya

xy (4)

14

It is easy to see that RST are all special cases of affine transforms. Other example of affine transforms include:

(1) Shearing in the x direction

A = = Ax

(2) Shearing in the y direction

A = = Ay

(3) Scaling in both x and y directions

A = = Az

1 B

0 1

1 0

r 1

α 0

0 δ

15

Remark :

Any affine transform A can be decomposed as a composition of the aforementioned three transforms, i.e.,

A = As ． Ay ． Ax

provided that a11 ≠ 0 and det(A) ≠0

16

Lemma1: If g(x,y) is an affine transformed image of f(x,y) obtained with affine matrix

A = and d = 0, then the following identities hold :

Where m’pq, μ’

pq are the moments of g(x,y), and mpq, μpq are the moments of f(x,y).

a11 a12

a21 a22

)6('

)5('

0 0,22211211,

0 0,22211211,

p

i

q

jjiqpji

jqjipiqp

p

i

q

jjiqpji

jqjipiqp

aaaaj

q

i

p

maaaaj

q

i

pm

17

The general concept of image normalization using moments is well-known in pattern recognition problems. [IEEE Trans. On PAMI, (pp.366-376, Apr. 1996), (pp.431-440, May 1997), and (pp.466-476, May 1999)].

The idea is to extract image features that are invariant to affine transforms.

B. Image Normalization

18

The normalization procedure consists of the following steps for a given image f(x,y) :

(1) Center the image f(x,y); this is achieved by setting in (4) the matrixA = and Vector d = with

d1 = , d2 = This step aims to achieve translation invariance. Let f1(x,y) denote the resulting centered image.

1 0

0 1

d1

d2

m10

m00

m01

m00

19

(2) Apply a shearing transform to f1(x,y) in the x direction with matrix Ax = so that the resulting matrix, denoted by f2(x,y) =

Ax[f1(x,y)], achieves μ(2)30 = 0 where the

superscript is used to denote f2(x,y)

1 β0 1

20

(3) Apply a shearing transform to f2(x,y) in the y direction with matrix so that the resulting matrix, denoted by f3(x,y) =

Ay[f2(x,y)], achieves μ(3)11 = 0

1 0r 1

21

Scale f3(x,y) in both x and y directions with

As = so that the resulting image, denoted by

f4(x,y) = As[f3(x,y)], achieves

(a) a prescribed standard size

(b) μ(4)50 > 0 and μ(4)

05 > 0

The final image f4(x,y) is the normalized image, based on which subsequent watermark embedding or extraction is performed.

α 00 δ

22

The above normalization procedure can be also explained as follows:

Since a general affine transformation attacks can be decomposed as a composition of translation, shearing in both x and y directions, and scaling in both x and y directions. The four steps in the normalization procedure are designed to eliminate each of these distortion components.

23

Step(1) eliminates the translation of the affine attack by setting the center of the normalized image at the density center of the affine attacked image; steps(2) and (3) eliminate shearing in the x and y directions; step(4) eliminates scaling distortion by forcing the normalized image to a standard size.

It is important to note that each step in the normalized procedure is readily invertible. This will allow us to convert the normalized image back to its original size and orientation once the watermark is inserted.

24

Theorem 1 : An image f(x,y) and its affine transforms have the same normalized image

[IEEE Trans. on Image Processing, Dec. 2005, (Fig.2), page 2142]

25

1) Shearing matrix Ax =

From identity (6), we haveμ(2)

30 = μ(1)30 + 3βμ(1)

21 + 3β2μ(1)12 +β3μ(1)

03 (8)

Where μ(1)pq are the central moments of f1(x,y)

Setting μ(2)30 =0, we obtain

μ(1)30 + 3βμ(1)

21 + 3β2μ(1)12 +β3μ(1)

03 =0 (9)

The parameter β is then found from (9)

1 β0 1

C. Determination of the Transform Parameters

26

Note that (9) can have up to 3 roots in the

case that μ(1)03 ≠0 ( which is generally true for

most natural image). In particular we may have the following two scenarios :(1) One of the 3 roots is real and the other two are

complex(2) all 3 roots are real.

In the former case, We simply set β to be the real root; in the latter case, we pick β to be the median of the three roots.It can be proved that this choice of β ensures the uniqueness of the resulting normalized image.

27

Under some very unusual conditions, the number of roots of (9) may vary. For example, when all the moments involved in (9) are zeros, it will have infinite number of solutions. This can happen when the image is rotationally symmetric, such as a disk or a ring.

[IEEE Trans. on PAMI (pp.431-440, May 97) and (pp.466 – 476, May 99) gives more details on general normalization procedures.

28

(2) Shearing matrix Ay =

From identity (6), we have

μ(3)11 = γμ(2)

20 + μ(2)11 (10)

Setting μ(3)11 = 0, we obtain

γ = - μ(2)11 / μ(2)

20 (11)

Thus, the parameter γ has a unique solution.

1 0γ 1

29

(3) Scaling matrix As =

The magnitudes of scaling parameters α and δ are determined by resizing the image f3(x,y) to a prescribed standard size in both horizontal and vertical directions.

Their signs are determined so that both μ(4)50 and

μ(4)05 are positive.

α 0 0 δ

30

For watermark embedding, the normalization is applied w.r.t. the original image, which, for watermark extraction, it is applied w.r.t. the watermarked image.

Thus, it is important to design the watermark signal so that it has the minimal effect on the normalized image.

D. Effect of the Watermark

31

Let w(x,y) denote the watermark signal added to the original image f(x,y). Let m(w)

pg denote the moments of w(x,y). Then, from (7), one can see that it is desirable to have m(w)

10 = m(w)01 = 0, so that w(x,y) has no im

pact on the centering step of the normalization procedure.

32

In addition, from (8)-(11), it is desirable to have m(w)pg = 0

for p+q = 2 and 3, so that the watermark does not affect the rest of the normalization transformations.

It is assumed that w(x,y) and f(x,y) are statistically independent, so their second- and third-order central moments are additive.

As discussed in IEEE T-IP, Dec. 2005’ paper, the watermark w(x,y) is a CDMA signal generated from a zero-mean Gaussian or Uniform source that is added to the mid-frequency DCT coefficients of the image.

33

The normalization procedure described above consists of a sequence of elementary affine transforms (i.e., shearing and scaling operations). We point out that other transform procedures can also be constructed in a similar fashion to achieve affine-transform invariance in a normalized image. For example, one such procedure is the following:

A = (12)

which consists of (1) shearing in the x direction, (2) scaling in x and y directions, and (3) rotation by angle ψ. The parameter in the procedure described in (12) can be determined by enforcing a set of predefined moments for each step.

cosψ sinψ-sinψ cosψ

α 0 0 δ

1 β 0 1

E. Alternative Normalization Procedures

Digital Watermarking Robustto Rotation, Scaling, and Translation

A public Watermarking scheme on the basis of log-Polar-Fourier Transform

35

• Consider an image i(x, y) and a rotated, scaled, and translated version of the image, i’(x, y). Then we can write

i’(x, y) = i( σ(xcosα+ysinα)-x0, σ(-xsinα+ycosα)-y0 ) (1)

where the RST parameters are σ, α, (x0, y0)respectively.

• σ →scaling parameter• α →rotation parameter

• (x0, y0) →translation parameter

36

• The Fourier transform of i’(x, y) is I’(fx, fy), the magnitude of which is given by

|I’(fx, fy)| = | σ |-2 |I(σ-1(fxcosα+ fy sin α), σ-1 (-fx sin α + fy cosα))| (2)

Egn.(2) is independent of the translational parameters, (x0, y0).

This is the well know translation – invariant property of the Fourier Transform.

37

• Rewrite egn.(2) using log – polar coordinates, i.e.,

• fx = eρcosθ (3)

• fy = eρsinθ (4)

then we have

|I’(fx, fy)|

= | σ |-2 |I (σ-1 eρcos(θ-α), σ-1 eρsin(θ-α))| (5)

= | σ |-2 |I(e(ρ-log σ) cos(θ-α), e(ρ-log σ) sin(θ-α))| (6)

or

|I’(ρ, θ)| = | σ |-2 |I(ρ-log σ, θ-α)| (7)

38

• Egn.(7) demonstrates that the magnitude of the log-polar spectrum is scaled by | σ |-2, the image scaling results in a translational shift of log σ along the ρ axis, and that image rotation results in a cyclical shift of α along the θ axis.

39

• Now, define g(θ) to be a 1-D projection of |I(ρj,θ)| such that

g(θ) = ∑log (I(ρj,θ)|) (8)

• Due to the symmetry of the spectra of real images

|F(x, y)| = | F(-x, -y)| (9)

We only computer g(θ) for θ [0o, …, 180o)

ej

40

• It is found that it convenient to add the two halves of g(θ) together, obtaining

g1(θ) = g(θ’) + g(θ’+ 90o) (10)

where θ’ [0o, …, 90o) g1(θ) is invariant to both translation and scaling. Rotations result in a circular shift of the values of g1(θ). If θ is quantized to the nearest degree, then these are on

ly 90 discrete shifts, and one can handle this by exhaustive search.

41

A. Watermark Detection Process

– The watermark is expressed as a vector of length N.– An “extracted signal” is computed from the image, for

N values of θ evenly spaced between 0o and 90o.

– The extracted signal is then compared to the watermark using the correlation coefficient (which is independent of scaling of the signal amplitudes).

– If the correlation coefficient is above a detection threshold T, then the image is judged to obtain the watermark.

42

Detection Algorithm1) Compute a discrete log-polar Fourier Transform of th

e input images.This can be thought of as an array of K rows N columns, in which each row corresponds to a value of ρ, and each column corresponds to a value of θ.

2) Sum the logs of all the values in each column, and add the result of summing column j to the result of summing column j+N/2 (j = 0,…N/2 -1) to obtain an invariant descriptor V, in which

Vj = g1(θj)(11)

where θj is the angle that corresponds to column j in the discrete log-polar Fourier transform matrix.

43

3) Compute the correlation coefficient D, between v and the input watermark vector w, as

D = (12)

4) If D is greater than a threshold T, then indicate that the watermark is present. Otherwise, indicate that it is absent.

　　 w ． v

√(w ． w) (v ．v)

44

– If we view the embedder as a transmitter and the cover image as a communication channel, the complete knowledge of the “noise” caused by the original image amounts to side-information about the behavior of that channel.

– When the transmitter knows ahead of time what noise will be added to the signal (watermark), its optimal strategy is to subtract that noise from the signal before transmission.

– The noise then gets added back by the communication channel, and the receiver receives a perfect reconstruction of the intended signal.

B. Watermark Embedding Process

45

– In the case of watermarking, it is unacceptable for the embedder to subtract the original image from the watermark before embedding the watermark, because it would result in unacceptable fidelity loss.

– However, when the watermark is expressed as a signal in a lower-dimensional space, as is the case with the present system, the result would be better, since a wide variety of full-resolution images project into the same extracted (lower-dimensional) signal and the embedder may choose the one that most resembles the original.

46

– To make maximal use of the side-information at the embedder, which maintaining acceptable fidelity, the idea of a “mixing function”, f(v,w), was introduced. This takes an extracted signal v, and watermark vector w, as input, and the output is a signal s, which is perceptually similar to v, and has a high correlation with w.

– It is this mixed signal that the embedder transmits by modifying the image so that the extraction process in the detector will produce s.

47

Embedding Algorithm1) Apply the same signal-extraction process to the unw

atermarked image as will be applied by the detector, thus obtaining an extracted vector v. In our case, this means computing g1(θ).

2) Use the mixing function, s = f(v,w), to obtain a mixture v and the desired watermark, w. At present, the mixing function simply computes a weighted average of w and v, which is a highly sub-optimal approach.

3) Modify the original image so that, when the signal-extracted process is applied to it, the result will be s instead of v.This process can be implemented as follows:

48

a) Modify all the values in column j of the log-polar Fourier transform so that their logs sum to sj instead of vj. This can be done, for example, by adding (sj - vj)/k to each of the k values in column j. Care must be taken to preserve the symmetry of DFT coefficients.

b) Invert the log-polar resampling of the Fourier magnitudes, thus obtaining a modified, Cartesian Fourier transform.

c) The complex terms of the original Fourier transform are scaled to have the new magnitudes found in the modified Fourier transform.

d) The inverse Fourier transform is applied to obtain the watermark image.

Notice that, there is inherent, instability in inverting the log-polar resampling of the Fourier magnitude (step 3(b))