Embed Size (px)
DESCRIPTION
Cocktail Watermarking for Digital Image Protection. IEEE Transactions on Multimedia, C. S. Lu, S. K. Huang, C, J. Sze, and Mark Liao Institute of Information Science Academia Sinica, Taiwan. Motivation. What kind of things that a thief won’t steal? The degree of difficulty is high? - PowerPoint PPT Presentation
Citation preview
Cocktail Watermarking for Cocktail Watermarking for Digital Image ProtectionDigital Image Protection
IEEE Transactions on Multimedia,IEEE Transactions on Multimedia,C. S. Lu, S. K. Huang, C, J. Sze, and Mark Liao C. S. Lu, S. K. Huang, C, J. Sze, and Mark Liao
Institute of Information ScienceInstitute of Information ScienceAcademia Sinica, TaiwanAcademia Sinica, Taiwan
MotivationMotivation
• What kind of things that a thief won’t steal?– The degree of difficulty is high?– Will get hurt in the action?– Intended objects will be destroyed once they
are out of the original place?
Cox’s MethodCox’s Method
• Add watermark– Step 1: FDCT (Forward Discrete Cosine Transform) and
select the largest n coefficients in magnitude.– Step 2: Generate n N(0, 1) noises.– Step 3: Embedding based on:– Step 4: IDCT (Inverse Discrete Cosine Transform)
• Result
)1( iii xvv
Cox’s Method (conti.)Cox’s Method (conti.)
• Extract watermark– Step 1: FDCT of the original image and image in
question.– Step 2: Select the largest coefficients in magnitude
from both images.– Step 3: Invert the embedding process.– Step 4: Similarity
• Result
***sim XXXX
Host and Watermarked Image bHost and Watermarked Image by Coxy Cox et al. et al. ((conti.conti.))
• Example 1: n = 2232
Host image
PSNR=34.87
Watermarked image
Host and Watermarked Image bHost and Watermarked Image by Coxy Cox et al. et al. ((conti.conti.))
• Example 2: n = 2232
Host image
PSNR=36.21
Watermarked image
Result by Cox Result by Cox et al. et al. ((conti.conti.))
• Attacks:
1. Scaling 10. Oil painting2. JPEG (10%) 11. Embossing3. JPEG (5%) 12. DeSpeckle4. Blurring 13. Pixelization5. Sharpening (75%) 14. Equalization6. Sharpening (85%) 15. Rotation ( 1)7. Dithering 16. Rotation ( 5)8. Stirmark (once) 17. Averaging9. Stirmark (5 times)
Result by Cox Result by Cox et al. et al. ((conti.conti.))
• Detector response w.r.t. different attacks:– Lena: maximum (n = 2232): 45.5
-505
1015202530
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
Attack
Det
ecto
r R
espo
nse
Result by Cox Result by Cox et al. et al. ((conti.conti.))
• Detector response w.r.t. different attacks:– Kids: maximum (n = 2232): 45.4
-5
0
5
10
15
20
25
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
Attack
Det
ecto
r R
espo
nse
傳統的方法傳統的方法 (I)(I)
• NEC Approach
• Largest 1000 AC coefficients
256
256
global DCT
(+1250, -1006, -989, …, +30)
傳統的方法傳統的方法 (II)(II)• Random Modulation: Modu(+,+),Modu(-,-),
Modu(+,-),Modu(-,+)
+1250 +0.5 (+,+)
Gaussian(0,1) magnitude
-1006 +0.2 (-,+)-989 -0.3 (-,-)+885 -0.2 (+,-)
+30 -0.1 (+,-)
攻擊的作用攻擊的作用• 通常攻擊 (attacks) 的作用
– 改變 coefficients 的 magnitude
• original watermarked image
coeff.1Attack #1 Attack #2
coeff.2
coeff.3coeff.4
coeff.1000
800 pairs matcheddetector response 0.8
150 pairs matcheddetector response 0.2
靠
運
氣
?
攻擊的分類攻擊的分類• Attacks that increase the magnitude of
most transform coefficient– Sharpening, histogram equalization, edge-
enhancing…
• Attacks that decrease the magnitude of most transform coefficient– Blurring, compression…
傳統的方法傳統的方法 (IV)(IV)
• 缺點– 人人可藏浮水印進入多媒體資料 , 但人人缺少
理論基礎來證明 robustness
雞尾酒式浮水印技術雞尾酒式浮水印技術 (I)(I)
• 緣起 : 民國 88 年 1 月底 (2000.10 digibits)
• 想法 : 可不可能放入多於一個浮水印 , 使其產生互補功能 , 藉以抵擋各種功能迥異的攻擊
• 實驗完成 : 民國 88 年 3 月 27 日• 作法 :
Negative modulation( 降低 magnitude)
Positive modulation( 增加 magnitude)
遇 + 加 -
遇 - 加 +
遇 + 加 +
遇 - 加 -
雞尾酒式浮水印技術雞尾酒式浮水印技術 (IV)(IV)
• W(i)= bipolar(Tm(x,y)-T(x,y))• We(i)=bipolar(Ta(x,y)-T(x,y))
=bipolar((Ta(x,y)-Tm(x,y))+
(Tm(x,y)-T(x,y)))
=bipolar(Beta1+Beta2)
• To obtain a higher detection, We(i) and W(i) should have the same sign.– Beta1 and Beta2 has the same sign
– The influence of Beta1<the influence of Beta2
Complementary modulation
JND
雞尾酒式浮水印技術雞尾酒式浮水印技術 (IV)(IV)
Complementary ModulationComplementary Modulation
• The proposed scheme embeds two watermarks, each of them playing complementing roles in resisting various kinds of attacks.
• Values of the two watermarks are drawn from the same watermark sequence. However, they are embedded using different modulation rules – Positive modulation – Negative modulation
雞尾酒式浮水印技術雞尾酒式浮水印技術 (II)(II)
• 例子 :
+1250 +0.5
-1006 -0.3-989 -0.3+885 +0.2
+30 +0.1
increasemagnitude
attackpositivemodulation
830 matched, 170 not matched -> detector response 0.66
雞尾酒式浮水印技術雞尾酒式浮水印技術 (III)(III)
• 例子 :
+1250 -0.3
-1006 +0.1-989 +0.2+885 -0.3
+30 -0.1
decreasemagnitude
attacknegativemodulation
220 matched, 780 not matched -> detector response -0.56
雞尾酒式浮水印技術雞尾酒式浮水印技術 (V)(V)
• 最厲害的攻擊 (50% - 50% 攻擊 )
• 1000 coefficients depends on ‘’images’’– ill-posed
剛好讓 50% coefficients 讓 50% coefficients
worst case: lowest detector response 0
Watermark EncodingWatermark Encoding
Watermark DecodingWatermark Decoding
實驗結果實驗結果
• 32 種不同攻擊後的結果• 互補效應的驗證
– 用可辨識的 pattern 為例• notebook 展示• Detector response vs. 漸差的影像品質• Detector response vs. 漸增的壓縮倍數• Combined attack• Probabilities of False positive and False negative
Categories of Attacks (I)Categories of Attacks (I)
• Waveform attacks -- to impair the embedded watermark by manipulations of the whole watermarked media– Linear filtering, non-linear filtering, waveform-based c
ompression (JPEG, EZW), addition of noise,…,etc
• Detection-disabling attacks-- to break the correlation and to make the recovery of the watermarking impossible– Shear, pixel permutations sub-sampling, and other ge
ometric distortions (Stir Mark, unZign)
Waveform attacks (I)Waveform attacks (I)• Blurring (27.79/35.64)
– high-frequency components are deleted
Waveform attacks (II)Waveform attacks (II)• Sharpening (24.56/35.64)
– high-frequency components are enhanced
Waveform attacks (III)Waveform attacks (III)• JPEG compression (19.38/35.64)
– quality factor 5%– severe blocky effects
Waveform attacks (IV)Waveform attacks (IV)• Embedding zero wavelet compression
(23.66/35.64)– compression ratio 64:1 (SPIHT)– all wavelet coefficients are reduced
Detection-disabling attacks (I)Detection-disabling attacks (I)• Jitter (13.36/35.64)
– with 4 pairs of columns deleted and duplicated
– raising asynchronous phenomena
Detection-disabling attacks (II)Detection-disabling attacks (II)• StirMark (17.73/35.64)
– all default parameters– non-linear operations– raising asynchronous phenomena
StirMark AttackStirMark Attack
Digimac, SysCoP, JK_PGS,EikonaMark, Signnum, etc. are successfully destroyed
Benchmark Tool: StirMarkBenchmark Tool: StirMark
Apply minor geometric distortion• Stretching, shearing, shifting and rotation• Simulate printing/scanning process• Use ‘sinc’ for reconstruction function
Detection-disabling attacks Detection-disabling attacks (III)(III)
• Rotation (14.28/35.64)– registration problem
Detection-disabling attacks Detection-disabling attacks (IV)(IV)
• Shear (13.73/35.64)– significant distortion
Categories of Attacks (II)Categories of Attacks (II)
• Interpretation attacks – to confuse by producing fake host media or fake watermark
deadlock problem
• Removal attacks – to analyze the watermarked data and discard only the watermark
collusion attacks, non-linear filter operations
Interpretation Attack (I)
+-
Alice Bob
original faked
watermarked image
original watermark faked watermark
Removal attacks (I)Removal attacks (I)
• Collusion attack (34.39/35.64)– 4 watermarked images hidden with 4
different watermarks are averaged
host image watermarked image blurring median filtering rescaling sharpening
histo. equalization dithering JPEG EZW StirMark StirMark+Rot180
StirMark (5) jitter (5) flip bright/contrast Gaussian noise texturier
(15X15) (11X11)
(5%) (64:1)
128X128
Attacked Watermarked Images
34.5 dB
host image watermarked image diff. clouds diffuse dust extrude
facet halftone mosaic motion blurring patchwork photocopy
pimch ripple shear smart blurring thresholding (96) twirl
Attacked Watermarked Images
128X128 34.5 dB
Detection Result of Noise-style Watermark for the Tiger Image
Result of Our Method (Result of Our Method (conticonti.).)
Negative
Positive
Dithering StirmarkSharpening 85%Sharpening 75%
Result of Our Method (Result of Our Method (conticonti.).)
Negative
Positive
5 Stirmark Oil Painting Embossing DeSpeckle
Result of Our Method (Result of Our Method (conticonti.).)
Negative
Positive
Pixelization Equalization Rotation Rotation1 5
Comparisons
Single-type Attack (Gaussian blurring)
with decreasing qualities
3x3
31x31
The tiger image 128x128 in size is watermarked
15x15
Single-type Attack (SPIHT)
with increasing compression ratios
The tiger image 128x128 in size is watermarked
512:1
4:1
Combined Attack
(Repeated Attack)
Attacks are composed of blurring (B) and histogram equalization (H)
B
BH
BHB
BHBH
TP1
0.15
0.2
0.6 0.65 0.7
Probability of False Negative
Probability of False Positive
0.5
1
1
T P1
0.15
0.2
0.5
8104
131062 .
0.61 0.6231001 .
250.
51091 .
21035 .
71031 .
31054 .
161041 .
81001 .
421001 .
281062 .
商業用途商業用途• 防篡改
– 照相機– 錄音機– 錄影機– 監視器
Cocktail watermarking with sensors
Image Authentication
4th level3rd level2nd level
original image watermarked image tampered image
Image Authentication
2nd level 3rd level
original image watermarked image tampered image
4th level
Image Authentication
original image watermarked image tampered image
2nd level 3rd level 4th level
Audio Authentication
Watermarkedaudio
Tamperedaudio
Results oftamper detection
