Affine-Resistant Watermarking

1. Affine-Resistant Watermarking Multimedia Security

2. Part 1: • Digital Watermarking Robust to Geometric Distortions Part 2: • Digital Watermarking Robust to Rotation, Scaling, and Translation

3. Digital Watermarking Robust to Geometric Distortions A public watermarking scheme on the basis of Image Normalization

4. One of the most challenging problems for digital watermarking is the resilience of watermarking to geometric attacks. Such attacks are easy to implement, but can make many of the existing watermarking ineffective. Examples of geometric attacks include:Rotation, Scaling, Translation, Shearing(修剪), random bending, and change of the aspect Ratio.

5. Geometric attacks are effective in that they can destroy the “Synchronization” in a watermarked bit stream, which is vital especially for spread spectrum based watermarking schemes. Out of synchronization is problematic, especially in applications where the original image is not available for watermark extraction.

6. Literature Survey: Ruanaidh and Pun [Signal Processing, vol.66, pp.33-317, 1998] C.Y.Lin et.al. [IEEE Trans. on Image Processing, pp.767-782, May 2001] Invariant properties of Fourier-Mellin transform to deal with RST attacks. This approach was effective in theory but difficult to implement. [log-polar-Fourier transformations]

7. Pereira and Pun [IEEE Trans. On Image Processing, pp.1123 1129, Jan 2000] An additional template, known as “pilot” signal in traditional communication systems, besides the watermark was embedded in the DFT domain of the image. This embedded template was used to estimate the affine geometric attacks in the image. The image first corrected with the estimated distortion, and the detection of the watermark was performed afterwards. This approach requires the detection of both the synchronization pattern and the watermark. A potential problem arises when a common template is used for different watermarked images, making it susceptible to collusion-type detection of the template.

8. Bas, Chassery and Macq [IEEE Trans. On Image Processing, pp.1014-1028, Sept 2002] - An image Content Adaptive Watermarking Scheme In this approach, salient feature points extracted from the image were used to define a number of triangular regions. A 1-bit watermark was then embedded inside each triangle using an additive spread spectrum scheme. This approach requires robust detection of the salient points in the image in order to retrieve the watermark.

9. Alghoniemy and Tewfik [ ICME Multimedia Expo. 2000] A watermarking scheme using “moment” based image normalization. In this approach, both watermark embedding and extraction were performed using a normalized Image having a standard size and orientation. Thus, it is suitable for public watermarking where the original image is not available. This approach was used to embed 1-bit watermark.

10. Watermarking Based on Image Normalization Key Idea: Use a normalized image for both watermark embedding and detection! The normalized image is obtained from a geometric transformation procedure that is invariant to any affine distortion of the image. This will ensure the integrity of the watermark in the normalized image even when the image undergoes affine geometric attacks.

11. Watermark message Private key Image Normalization-based Watermarking System Watermark Embedder Restore to original size and position Original image Watermark Embedding Image Normalization Watermark extractor Watermark message Watermark Extraction Image Normalization Geometric Attacks Private key

12. A. Image Moments and Affine Transforms Let f(x,y) denote a digital image of size M x N. Its geometric moments mpq and central moments μpq, p,q = 0,1,…., are defined, respectively, as

13. An image g(x,y) is said to be an affine transform of f(x,y) if there is a matrix A = and vector d = such that g(x,y) = f(xa,ya ) , where = A． - d a11 a12 a21 a22 d1 d2 xa ya x y (4)

14. It is easy to see that RST are all special cases of affine transforms. Other example of affine transforms include: • Shearing in the x direction A = = Ax (2) Shearing in the y direction A = = Ay (3) Scaling in both x and y directions A = = Az • B • 0 1 • 0 • r 1 α 0 0 δ

15. Remark : Any affine transform A can be decomposed as a composition of the aforementioned three transforms, i.e., A = As．Ay ．Ax provided that a11 ≠ 0 and det(A) ≠0

16. a11 a12 a21 a22 Lemma1: If g(x,y) is an affine transformed image of f(x,y) obtained with affine matrix A = and d = 0, then the following identities hold : Where m’pq, μ’pq are the moments of g(x,y), and mpq, μpq are the moments of f(x,y).

17. B. Image Normalization The general concept of image normalization using moments is well-known in pattern recognition problems. [IEEE Trans. On PAMI, (pp.366-376, Apr. 1996), (pp.431-440, May 1997), and (pp.466-476, May 1999)]. The idea is to extract image features that are invariant to affine transforms.

18. d1 • 0 d2 0 1 m10 m01 m00 m00 The normalization procedure consists of the following steps for a given image f(x,y) : • Center the image f(x,y); this is achieved by setting in (4) the matrix A = and Vector d = with d1 = , d2 = This step aims to achieve translation invariance. Let f1(x,y) denote the resulting centered image.

19. (2) Apply a shearing transform to f1(x,y) in the x direction with matrix Ax = so that the resulting matrix, denoted by f2(x,y) = Ax[f1(x,y)], achieves μ(2)30 = 0 where the superscript is used to denote f2(x,y) • β 0 1

20. (3) Apply a shearing transform to f2(x,y) in the y direction with matrix so that the resulting matrix, denoted by f3(x,y) = Ay[f2(x,y)], achieves μ(3)11 = 0 • 0 r 1

21. Scale f3(x,y) in both x and y directions with As = so that the resulting image, denoted by f4(x,y) = As[f3(x,y)], achieves (a) a prescribed standard size (b) μ(4)50 > 0 and μ(4)05 > 0 The final image f4(x,y) is the normalized image, based on which subsequent watermark embedding or extraction is performed. α 0 0 δ

22. The above normalization procedure can be also explained as follows: Since a general affine transformation attacks can be decomposed as a composition of translation, shearing in both x and y directions, and scaling in both x and y directions. The four steps in the normalization procedure are designed to eliminate each of these distortion components.

23. Step(1) eliminates the translation of the affine attack by setting the center of the normalized image at the density center of the affine attacked image; steps(2) and (3) eliminate shearing in the x and y directions; step(4) eliminates scaling distortion by forcing the normalized image to a standard size. It is important to note that each step in the normalized procedure is readily invertible. This will allow us to convert the normalized image back to its original size and orientation once the watermark is inserted.

24. Theorem 1 : An image f(x,y) and its affine transforms have the same normalized image [IEEE Trans. on Image Processing, Dec. 2005, (Fig.2), page 2142]

25. C. Determination of the Transform Parameters • Shearing matrix Ax = From identity (6), we have μ(2)30 = μ(1)30 + 3βμ(1)21 + 3β2μ(1)12 +β3μ(1)03 (8) Where μ(1)pq are the central moments of f1(x,y) Setting μ(2)30 =0, we obtain μ(1)30 + 3βμ(1)21 + 3β2μ(1)12 +β3μ(1)03 =0 (9) The parameter β is then found from (9) • β • 0 1

26. Note that (9) can have up to 3 roots in the case that μ(1)03 ≠0 ( which is generally true for most natural image). In particular we may have the following two scenarios : • One of the 3 roots is real and the other two are complex • all 3 roots are real. In the former case, We simply set β to be the real root; in the latter case, we pick β to be the median of the three roots. It can be proved that this choice of β ensures the uniqueness of the resulting normalized image.

27. Under some very unusual conditions, the number of roots of (9) may vary. For example, when all the moments involved in (9) are zeros, it will have infinite number of solutions. This can happen when the image is rotationally symmetric, such as a disk or a ring. [IEEE Trans. on PAMI (pp.431-440, May 97) and (pp.466 – 476, May 99) gives more details on general normalization procedures.

28. 0 • γ 1 (2) Shearing matrix Ay = From identity (6), we have μ(3)11 = γμ(2)20 + μ(2)11 (10) Setting μ(3)11 = 0, we obtain γ = - μ(2)11 / μ(2)20 (11) Thus, the parameter γ has a unique solution.

29. (3) Scaling matrix As = The magnitudes of scaling parameters α and δ are determined by resizing the image f3(x,y) to a prescribed standard size in both horizontal and vertical directions. Their signs are determined so that both μ(4)50 and μ(4)05 are positive. α 0 0δ

30. D. Effect of the Watermark For watermark embedding, the normalization is applied w.r.t. the original image, which, for watermark extraction, it is applied w.r.t. the watermarked image. Thus, it is important to design the watermark signal so that it has the minimal effect on the normalized image.

31. Let w(x,y) denote the watermark signal added to the original image f(x,y). Let m(w)pg denote the moments of w(x,y). Then, from (7), one can see that it is desirable to have m(w)10 = m(w)01 = 0, so that w(x,y) has no impact on the centering step of the normalization procedure.

32. In addition, from (8)-(11), it is desirable to have m(w)pg = 0 for p+q = 2 and 3, so that the watermark does not affect the rest of the normalization transformations. It is assumed that w(x,y) and f(x,y) are statistically independent, so their second- and third-order central moments are additive. As discussed in IEEE T-IP, Dec. 2005’ paper, the watermark w(x,y) is a CDMA signal generated from a zero-mean Gaussian or Uniform source that is added to the mid-frequency DCT coefficients of the image.

33. cosψ sinψ -sinψ cosψ α 0 0δ 1 β 01 E. Alternative Normalization Procedures The normalization procedure described above consists of a sequence of elementary affine transforms (i.e., shearing and scaling operations). We point out that other transform procedures can also be constructed in a similar fashion to achieve affine-transform invariance in a normalized image. For example, one such procedure is the following: A = (12) which consists of (1) shearing in the x direction, (2) scaling in x and y directions, and (3) rotation by angle ψ. The parameter in the procedure described in (12) can be determined by enforcing a set of predefined moments for each step.

34. Digital Watermarking Robustto Rotation, Scaling, and Translation A public Watermarking scheme on the basis of log-Polar-Fourier Transform

35. Consider an image i(x, y) and a rotated, scaled, and translated version of the image, i’(x, y). Then we can writei’(x, y) = i( σ(xcosα+ysinα)-x0, σ(-xsinα+ycosα)-y0 ) (1)where the RST parameters are σ, α, (x0,y0)respectively. • σ →scaling parameter • α→rotation parameter • (x0,y0) →translation parameter

36. The Fourier transform of i’(x, y) is I’(fx, fy), the magnitude of which is given by|I’(fx, fy)| = | σ |-2 |I(σ-1(fxcosα+ fy sin α), σ-1 (-fx sin α + fy cosα))| (2) Egn.(2) is independent of the translational parameters, (x0,y0). This is the well know translation – invariant property of the Fourier Transform.

37. Rewrite egn.(2) using log – polar coordinates, i.e., • fx =eρcosθ (3) • fy =eρsinθ (4) then we have |I’(fx, fy)| =| σ |-2 |I (σ-1 eρcos(θ-α), σ-1 eρsin(θ-α))| (5) =| σ |-2 |I(e(ρ-log σ) cos(θ-α), e(ρ-log σ) sin(θ-α))| (6) or |I’(ρ, θ)| = | σ |-2 |I(ρ-log σ, θ-α)| (7)

38. Egn.(7) demonstrates that the magnitude of the log-polar spectrum is scaled by | σ |-2, the image scaling results in a translational shift of log σ along the ρ axis, and that image rotation results in a cyclical shift of α along the θ axis.

39. Now, define g(θ) to be a 1-D projection of |I(ρj,θ)| such that g(θ) = ∑log (I(ρj,θ)|) (8) • Due to the symmetry of the spectra of real images |F(x, y)| = | F(-x, -y)| (9) • We only computer g(θ) for θ [0o,…,180o) ej

40. It is found that it convenient to add the two halves of g(θ) together, obtaining g1(θ) = g(θ’) + g(θ’+ 90o) (10) where θ’ [0o,…,90o) • g1(θ) is invariant to both translation and scaling. • Rotations result in a circular shift of the values of g1(θ). • If θis quantized to the nearest degree, then these are only 90 discrete shifts, and one can handle this by exhaustive search.

41. The watermark is expressed as a vector of length N. An “extracted signal” is computed from the image, for N values of θ evenly spaced between 0o and 90o. The extracted signal is then compared to the watermark using the correlation coefficient (which is independent of scaling of the signal amplitudes). If the correlation coefficient is above a detection threshold T, then the image is judged to obtain the watermark. A. Watermark Detection Process

42. Detection Algorithm • Compute a discrete log-polar Fourier Transform of the input images.This can be thought of as an array of K rows N columns, in which each row corresponds to a value of ρ, and each column corresponds to a value of θ. • Sum the logs of all the values in each column, and add the result of summing column j to the result of summing column j+N/2 (j = 0,…N/2 -1) to obtain an invariant descriptor V, in which Vj = g1(θj) (11) where θj is the angle that corresponds to column j in the discrete log-polar Fourier transform matrix.

43. Compute the correlation coefficient D, between v and the input watermark vector w, as D = (12) • If D is greater than a threshold T, then indicate that the watermark is present. Otherwise, indicate that it is absent. w．v √(w．w) (v．v)

44. B. Watermark Embedding Process • If we view the embedder as a transmitter and the cover image as a communication channel, the complete knowledge of the “noise” caused by the original image amounts to side-information about the behavior of that channel. • When the transmitter knows ahead of time what noise will be added to the signal (watermark), its optimal strategy is to subtract that noise from the signal before transmission. • The noise then gets added back by the communication channel, and the receiver receives a perfect reconstruction of the intended signal.

45. In the case of watermarking, it is unacceptable for the embedder to subtract the original image from the watermark before embedding the watermark, because it would result in unacceptable fidelity loss. • However, when the watermark is expressed as a signal in a lower-dimensional space, as is the case with the present system, the result would be better, since a wide variety of full-resolution images project into the same extracted (lower-dimensional) signal and the embedder may choose the one that most resembles the original.

46. To make maximal use of the side-information at the embedder, which maintaining acceptable fidelity, the idea of a “mixing function”, f(v,w), was introduced. This takes an extracted signal v, and watermark vector w, as input, and the output is a signal s, which is perceptually similar to v, and has a high correlation with w. • It is this mixed signal that the embedder transmits by modifying the image so that the extraction process in the detector will produce s.

47. Embedding Algorithm • Apply the same signal-extraction process to the unwatermarked image as will be applied by the detector, thus obtaining an extracted vector v. In our case, this means computing g1(θ). • Use the mixing function, s = f(v,w), to obtain a mixture v and the desired watermark, w. At present, the mixing function simply computes a weighted average of w and v, which is a highly sub-optimal approach. • Modify the original image so that, when the signal-extracted process is applied to it, the result will be s instead of v.This process can be implemented as follows:

48. Modify all the values in column j of the log-polar Fourier transform so that their logs sum to sj instead of vj. This can be done, for example, by adding (sj - vj)/k to each of the k values in column j. Care must be taken to preserve the symmetry of DFT coefficients. • Invert the log-polar resampling of the Fourier magnitudes, thus obtaining a modified, Cartesian Fourier transform. • The complex terms of the original Fourier transform are scaled to have the new magnitudes found in the modified Fourier transform. • The inverse Fourier transform is applied to obtain the watermark image. Notice that, there is inherent, instability in inverting the log-polar resampling of the Fourier magnitude (step 3(b))