Cocktail Watermarking for Digital Image Protection

Cocktail Watermarking for Cocktail Watermarking for Digital Image ProtectionDigital Image Protection

IEEE Transactions on Multimedia,IEEE Transactions on Multimedia,C. S. Lu, S. K. Huang, C, J. Sze, and Mark Liao C. S. Lu, S. K. Huang, C, J. Sze, and Mark Liao

Institute of Information ScienceInstitute of Information ScienceAcademia Sinica, TaiwanAcademia Sinica, Taiwan

MotivationMotivation

• What kind of things that a thief won’t steal?– The degree of difficulty is high?– Will get hurt in the action?– Intended objects will be destroyed once they

are out of the original place?

Cox’s MethodCox’s Method

• Add watermark– Step 1: FDCT (Forward Discrete Cosine Transform) and

select the largest n coefficients in magnitude.– Step 2: Generate n N(0, 1) noises.– Step 3: Embedding based on:– Step 4: IDCT (Inverse Discrete Cosine Transform)

• Result

)1( iii xvv

Cox’s Method (conti.)Cox’s Method (conti.)

• Extract watermark– Step 1: FDCT of the original image and image in

question.– Step 2: Select the largest coefficients in magnitude

from both images.– Step 3: Invert the embedding process.– Step 4: Similarity

• Result

***sim XXXX

Host and Watermarked Image bHost and Watermarked Image by Coxy Cox et al. et al. ((conti.conti.))

• Example 1: n = 2232

Host image

PSNR=34.87

Watermarked image

Host and Watermarked Image bHost and Watermarked Image by Coxy Cox et al. et al. ((conti.conti.))

• Example 2: n = 2232

Host image

PSNR=36.21

Watermarked image

Result by Cox Result by Cox et al. et al. ((conti.conti.))

• Attacks:

1. Scaling 10. Oil painting2. JPEG (10%) 11. Embossing3. JPEG (5%) 12. DeSpeckle4. Blurring 13. Pixelization5. Sharpening (75%) 14. Equalization6. Sharpening (85%) 15. Rotation ( 1)7. Dithering 16. Rotation ( 5)8. Stirmark (once) 17. Averaging9. Stirmark (5 times)

Result by Cox Result by Cox et al. et al. ((conti.conti.))

• Detector response w.r.t. different attacks:– Lena: maximum (n = 2232): 45.5

-505

1015202530

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

Attack

Det

ecto

r R

espo

nse

Result by Cox Result by Cox et al. et al. ((conti.conti.))

• Detector response w.r.t. different attacks:– Kids: maximum (n = 2232): 45.4

-5

0

5

10

15

20

25

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

Attack

Det

ecto

r R

espo

nse

傳統的方法傳統的方法 (I)(I)

• NEC Approach

• Largest 1000 AC coefficients

256

256

global DCT

(+1250, -1006, -989, …, +30)

傳統的方法傳統的方法 (II)(II)• Random Modulation: Modu(+,+),Modu(-,-),

Modu(+,-),Modu(-,+)

+1250 +0.5 (+,+)

Gaussian(0,1) magnitude

-1006 +0.2 (-,+)-989 -0.3 (-,-)+885 -0.2 (+,-)

+30 -0.1 (+,-)

攻擊的作用攻擊的作用• 通常攻擊 (attacks) 的作用

– 改變 coefficients 的 magnitude

• original watermarked image

coeff.1Attack #1 Attack #2

coeff.2

coeff.3coeff.4

coeff.1000

800 pairs matcheddetector response 0.8

150 pairs matcheddetector response 0.2

靠

運

氣

?

攻擊的分類攻擊的分類• Attacks that increase the magnitude of

most transform coefficient– Sharpening, histogram equalization, edge-

enhancing…

• Attacks that decrease the magnitude of most transform coefficient– Blurring, compression…

傳統的方法傳統的方法 (IV)(IV)

• 缺點– 人人可藏浮水印進入多媒體資料 , 但人人缺少

理論基礎來證明 robustness

雞尾酒式浮水印技術雞尾酒式浮水印技術 (I)(I)

• 緣起 : 民國 88 年 1 月底 (2000.10 digibits)

• 想法 : 可不可能放入多於一個浮水印 , 使其產生互補功能 , 藉以抵擋各種功能迥異的攻擊

• 實驗完成 : 民國 88 年 3 月 27 日• 作法 :

Negative modulation( 降低 magnitude)

Positive modulation( 增加 magnitude)

遇 + 加 -

遇 - 加 +

遇 + 加 +

遇 - 加 -

雞尾酒式浮水印技術雞尾酒式浮水印技術 (IV)(IV)

• W(i)= bipolar(Tm(x,y)-T(x,y))• We(i)=bipolar(Ta(x,y)-T(x,y))

=bipolar((Ta(x,y)-Tm(x,y))+

(Tm(x,y)-T(x,y)))

=bipolar(Beta1+Beta2)

• To obtain a higher detection, We(i) and W(i) should have the same sign.– Beta1 and Beta2 has the same sign

– The influence of Beta1<the influence of Beta2

Complementary modulation

JND

雞尾酒式浮水印技術雞尾酒式浮水印技術 (IV)(IV)

Complementary ModulationComplementary Modulation

• The proposed scheme embeds two watermarks, each of them playing complementing roles in resisting various kinds of attacks.

• Values of the two watermarks are drawn from the same watermark sequence. However, they are embedded using different modulation rules – Positive modulation – Negative modulation

雞尾酒式浮水印技術雞尾酒式浮水印技術 (II)(II)

• 例子 :

+1250 +0.5

-1006 -0.3-989 -0.3+885 +0.2

+30 +0.1

increasemagnitude

attackpositivemodulation

830 matched, 170 not matched -> detector response 0.66

雞尾酒式浮水印技術雞尾酒式浮水印技術 (III)(III)

• 例子 :

+1250 -0.3

-1006 +0.1-989 +0.2+885 -0.3

+30 -0.1

decreasemagnitude

attacknegativemodulation

220 matched, 780 not matched -> detector response -0.56

雞尾酒式浮水印技術雞尾酒式浮水印技術 (V)(V)

• 最厲害的攻擊 (50% - 50% 攻擊 )

• 1000 coefficients depends on ‘’images’’– ill-posed

剛好讓 50% coefficients 讓 50% coefficients

worst case: lowest detector response 0

Watermark EncodingWatermark Encoding

Watermark DecodingWatermark Decoding

實驗結果實驗結果

• 32 種不同攻擊後的結果• 互補效應的驗證

– 用可辨識的 pattern 為例• notebook 展示• Detector response vs. 漸差的影像品質• Detector response vs. 漸增的壓縮倍數• Combined attack• Probabilities of False positive and False negative

Categories of Attacks (I)Categories of Attacks (I)

• Waveform attacks -- to impair the embedded watermark by manipulations of the whole watermarked media– Linear filtering, non-linear filtering, waveform-based c

ompression (JPEG, EZW), addition of noise,…,etc

• Detection-disabling attacks-- to break the correlation and to make the recovery of the watermarking impossible– Shear, pixel permutations sub-sampling, and other ge

ometric distortions (Stir Mark, unZign)

Waveform attacks (I)Waveform attacks (I)• Blurring (27.79/35.64)

– high-frequency components are deleted

Waveform attacks (II)Waveform attacks (II)• Sharpening (24.56/35.64)

– high-frequency components are enhanced

Waveform attacks (III)Waveform attacks (III)• JPEG compression (19.38/35.64)

– quality factor 5%– severe blocky effects

Waveform attacks (IV)Waveform attacks (IV)• Embedding zero wavelet compression

(23.66/35.64)– compression ratio 64:1 (SPIHT)– all wavelet coefficients are reduced

Detection-disabling attacks (I)Detection-disabling attacks (I)• Jitter (13.36/35.64)

– with 4 pairs of columns deleted and duplicated

– raising asynchronous phenomena

Detection-disabling attacks (II)Detection-disabling attacks (II)• StirMark (17.73/35.64)

– all default parameters– non-linear operations– raising asynchronous phenomena

StirMark AttackStirMark Attack

Digimac, SysCoP, JK_PGS,EikonaMark, Signnum, etc. are successfully destroyed

Benchmark Tool: StirMarkBenchmark Tool: StirMark

Apply minor geometric distortion• Stretching, shearing, shifting and rotation• Simulate printing/scanning process• Use ‘sinc’ for reconstruction function

Detection-disabling attacks Detection-disabling attacks (III)(III)

• Rotation (14.28/35.64)– registration problem

Detection-disabling attacks Detection-disabling attacks (IV)(IV)

• Shear (13.73/35.64)– significant distortion

Categories of Attacks (II)Categories of Attacks (II)

• Interpretation attacks – to confuse by producing fake host media or fake watermark

deadlock problem

• Removal attacks – to analyze the watermarked data and discard only the watermark

collusion attacks, non-linear filter operations

Interpretation Attack (I)

+-

Alice Bob

original faked

watermarked image

original watermark faked watermark

Removal attacks (I)Removal attacks (I)

• Collusion attack (34.39/35.64)– 4 watermarked images hidden with 4

different watermarks are averaged

host image watermarked image blurring median filtering rescaling sharpening

histo. equalization dithering JPEG EZW StirMark StirMark+Rot180

StirMark (5) jitter (5) flip bright/contrast Gaussian noise texturier

(15X15) (11X11)

(5%) (64:1)

128X128

Attacked Watermarked Images

34.5 dB

host image watermarked image diff. clouds diffuse dust extrude

facet halftone mosaic motion blurring patchwork photocopy

pimch ripple shear smart blurring thresholding (96) twirl

Attacked Watermarked Images

128X128 34.5 dB

Detection Result of Noise-style Watermark for the Tiger Image

Result of Our Method (Result of Our Method (conticonti.).)

Negative

Positive

Dithering StirmarkSharpening 85%Sharpening 75%

Result of Our Method (Result of Our Method (conticonti.).)

Negative

Positive

5 Stirmark Oil Painting Embossing DeSpeckle

Result of Our Method (Result of Our Method (conticonti.).)

Negative

Positive

Pixelization Equalization Rotation Rotation1 5

Comparisons

Single-type Attack (Gaussian blurring)

with decreasing qualities

3x3

31x31

The tiger image 128x128 in size is watermarked

15x15

Single-type Attack (SPIHT)

with increasing compression ratios

The tiger image 128x128 in size is watermarked

512:1

4:1

Combined Attack

(Repeated Attack)

Attacks are composed of blurring (B) and histogram equalization (H)

B

BH

BHB

BHBH

TP1

0.15

0.2

0.6 0.65 0.7

Probability of False Negative

Probability of False Positive

0.5

1

1

T P1

0.15

0.2

0.5

8104

131062 .

0.61 0.6231001 .

250.

51091 .

21035 .

71031 .

31054 .

161041 .

81001 .

421001 .

281062 .

商業用途商業用途• 防篡改

– 照相機– 錄音機– 錄影機– 監視器

Cocktail watermarking with sensors

Image Authentication

4th level3rd level2nd level

original image watermarked image tampered image

Image Authentication

2nd level 3rd level

original image watermarked image tampered image

4th level

Image Authentication

original image watermarked image tampered image

2nd level 3rd level 4th level

Audio Authentication

Watermarkedaudio

Tamperedaudio

Results oftamper detection