Project Number: IST-1999-11422

Project Number: IST- 1999 - 10987 Project Title: CERTIMARK Deliverable Type: Deliverable Number: D 5.2 Contractual Date of Delivery: Actual Date of Delivery: Title of Deliverable: Robustness and countermeasures Work-Package contributing to the Deliverable: WP5 Nature of the Deliverable: RE Author(s): UNIGE, UVIGO, AUTH, UCL, PHILIPS Abstract: This document advocates the number of countermeasures against different classes of attacks considered according to the main operational scenarios introduced in the deliverable D4.1. The main emphasis is focused on the countermeasures essential for robust watermarking that is the core technology in the above applications. This document summarizes the state-of-art countermeasures against watermark removal, desynchronisation, protocol and estimation-based attacks. The considered countermeasures will be used in the corresponding ongoing research on the European watermarking algorithm. Keyword List: Watermark robustness, countermeasures against attacks, encoding, perceptual masking, synchronisation, watermark detection, watermark decoding. *Type: PU-public, LI-limited, RP-restricted **Nature: PR-Prototype, RE-Report, SP-Specification, TO-Tool, OT-Other

D52: Robustness and countermeasures

CMK_D52 28/01/02, 2 / 35

TABLE OF CONTENTS 1 INTRODUCTION ...................................................................................................... 3

2 ROBUSTNESS: Requirements and Attacks ............................................................ 5

3 Countermeasures........................................................................................................ 7 3.1. Generic countermeasures against watermark removal attacks ............................... 7

3.1.1 Optimal encoding/decoding .................................................................................................... 7 3.1.2 Perceptual masking ............................................................................................................... 10 3.1.3 Watermark embedding and energy allocation....................................................................... 16

3.2. Countermeasures against desynchronization attacks ............................................. 19 3.2.1 Global affine transforms ....................................................................................................... 20 3.2.2 Local random geometrical distortions................................................................................... 25 3.2.3 Projective transforms ............................................................................................................ 27

3.3. Countermeasures against protocol attacks .............................................................. 28 4 CONCLUSION......................................................................................................... 29

5 BIBLIOGRAPHY..................................................................................................... 29


CMK_D52 28/01/02, 3 / 35

1 INTRODUCTION This document contains the review of the general countermeasures against different classes of attacks developed within Certimark project as well as reported by other researchers. One should immediately note [24]that the number of existing methods and reported data hiding solutions are extremely large. Moreover, since many methods were proposed for different applications, for coordinate and transform domains using different mathematical apparatus by people with different background, it is quite difficult to represent all these achievements in this review. Therefore, for the sake of generality we will use the most general and already commonly accepted formulation of digital watermarking in the scope of communication theory pointing on the possible differences when there are any. According to this formulation (Figure 1), a message b is to be embedded in the cover data x . The message contains information about the owner, index, pointer, time, date, place, authentication code, or even other multimedia such as image, audio/speech or small video. We will concentrate our further consideration on the watermarking of still images and partially on video. To convert the message into a form efficient for communication, it is encoded using either error correction codes (ECC) or modulated using binary antipodal signaling [1] or more generally M-ary modulation [2]. With respect to ECC, mostly Bose Chaudhuri (BCH) or convolutional codes are used [3]. Recent publications [4][5][6][7][8] report successful results using novel Turbo codes and low-density parity-check (LDPC) codes in the DCT and wavelet domains. In the general case, the type of ECC and the set of basis functions for M-ary modulation can be key-dependent. The above conversion is performed in the encoder that produces the codewords c which are mapped from {0,1} to {-1,1} using binary phase shift keying (BPSK). A watermark w is created by some key-dependent function ( )KeyM ,,,pcw ε= that ensures the necessary spatial allocation of the watermark based on a key-dependent projection function p , and according to human visual system (HVS) features as expressed by a perceptual mask M in order to improve the watermark. The resulting watermark is a linear combination of a set of L orthogonal funstions

( ){ } { }1,...,0,, −= Linmpi

( ) ( ) ( )∑−

=

=1

0

,,,L

iii nmMnmpcnmw

where ( ){ }nmpi , satisfy ijiji ppp δ2, = .

Let { }10 ,..., −= LSSS be the sets of points where the pulses { }ip take nonzero values: ( ) ( ){ } { }1,...,0,0,, −=≠≡ LinmpnmS ii .

In the most cases, it is assumes non-overlaping pulses, i.e., jiforSS ji ≠∀∩ , .This assumption guaranties that the pulses will always be orthogonal:

( ) ( ) ( ) ∈

=.,0,,,

,otherwise

Snmifnmsnmp i

i


CMK_D52 28/01/02, 4 / 35

Cover data

where ( )nms , is a key dependent zero-mean uncorrelated pseudorandom sequence with unit variance at each pixel. ( )nms , is i.i.d. to provide maximum uncertainty (entropy). The projection function performs a ''spreading'' of the data over the image area. It can be also considered as a diversity communication problem with parallel channels. Moreover, the projection function can have a particular spatial structure with given correlation properties that can be used for the recovery of affine geometrical transforms, as it will be considered in section 3.2.1.

Figure 1. Digital watermarking as communication problem. A recent development is to model digital watermarking as communication with side information (Figure 2) [9][10][11][12][13]. Since the cover or host data is available at the watermark encoder, it can be efficiently used to suppress the interference with the host signal. Oppositely, the decoder designed to operate in the environment of channel uncertainty can perform the estimation of the channel state and in such a way suppress the interference with the host data [14] [15].

Figure 2. Digital watermarking as communications with side information.

Message Watermark Encoder

x

State generator

p(y¦x,s)

Key

b�Attacking Channel

Watermark Decoder

s sA B

Encoder Message

Perceptual model

Cover data

Watermark Embedder

Attacks

Watermark Extractor

Decoder

Key

Embedding Extraction

Message


CMK_D52 28/01/02, 5 / 35

In this context, the goal of this deliverable is twofold. First, we give an overview of robustness requirements to the watermarking technologies. Second, we analyse the possible countermeasures against different classes of attacks according to the operational scenarios described in the deliverable D2.1 [16]. In section 2 the general definition of robustness of a digital watemark is considered. It is emphasized that watermark robustness should be considered in the broader sense in comparison with the communication systems. This principal difference consists in the simultaneous consideration of the attack impact on the watermark detection/decoding and the quality of the attacked data.

In section 3 we consider generic countermeasures against the most well-known classes of attacks identified according to the applications described in the deliverables D2.1 and D4.1 [16][17]. Section 4 contains the conclusions and summarizes the deliverable.

2 ROBUSTNESS: Requirements and Attacks In most watermarking applications, the marked data is likely to be processed in some way before it reaches the watermark receiver. The processing could be lossy compression, signal enhancement or D/A and A/D conversion. An embedded watermark may unintentionally or inadvertently be impaired by such a processing. Other types of processing may be applied with the explicit goal of hindering watermark reception. In watermarking terminology, an attack is any processing that may impair detection of the watermark or communication of the information conveyed by the watermark. The processed, watermarked data is then called attacked data. We will follow the definition of different applications and corresponding attacks introduced in the deliverable D4.1 [17]. An important aspect of any watermarking scheme is its robustness against attacks. The notion of robustness is intuitively clear: A watermark is robust if it cannot be impaired without also rendering the attacked data useless. Watermark impairment can be measured by criteria such as miss probability, probability of bit error, or channel capacity. For multimedia, the usefulness of the attacked data can be gauged by considering its perceptual quality or distortion. Hence, robustness can be evaluated by simultaneously considering watermark impairment and the distortion of the attacked data. An attack succeeds in defeating a watermarking scheme if it impairs the watermark beyond acceptable limits while maintaining the perceptual quality of the attacked data. Since a complete theoretical analysis of watermarking algorithm performance with respect to the different attacks is rather complicated, the developers of watermarking algorithms can only evaluate the performance by means of experimental tests in some benchmark. The benchmark combines the possible attacks into a common framework and


CMK_D52 28/01/02, 6 / 35

weighs the resulting performance depending on the possible application of the watermarking technology. Therefore, the understanding of possible attacks and the development of adequate countermeasures are very important for many practical applications. It should be noted that the requirements for watermark robustness will generally differ depending on the particular application. Therefore, to have a clear definition of robustness, one should clearly specify the operational scenario in which the particular data hiding technology should be used. The most typical robustness requirements can be conditionally divided in two large groups. The first group includes data hiding technologies which embed comparatively modest payload, i.e. about 100 bits or the embedding rate is less than 0.5 watermark bits per sample (pixel), but they should be as much as possible robust to the different modifications of the watermarked data. This is typical case for the robust watermarking applications in copyright protection, broadcast monitoring and special cases of document security described in the deliverables D2.1 and D4.1. We note again that the most dangerous modifications or attacks are those that impair watermark detection, while preserving reasonable quality of the attacked data. The second large group of data hiding technologies covers applications that require the embedding of a comparatively large payload with an embedding rate of more than 0.5 bits per sample. In this case, the robustness requirements specified for the first group are of secondary importance. The typical examples are secure communications or steganography, where the main requirements are visual and stochastic �visibility� of the hidden data that cannot be discovered by the third party. Among other possible applications are tamper proofing, self-recovering watermarking, invertible watermarking, annotations, and verification of content integrity. The classification considered above is very general and does not exclude other possible classifications that can be performed based on:

• Watermark embedding/extraction domain; • Method of watermark embedding, encoding/decoding; • Perceptual masking; • Method used to recover from geometrical distortions, i.e. synchronization.

Since the most critical requirements to robustness are suggested for the robust watermarking technologies that are nowadays used in many practical applications, we will concentrate our analysis on the countermeasures against:

• watermark removal attacks; • desynchronization attacks; • protocol attacks; • estimation-based attacks.

We should note, that without loss of generality, many methods used for still images can be extended for video and even for audio. Since Certimark project deals mainly with still images and video, we will consider only countermeasures for these applications.


CMK_D52 28/01/02, 7 / 35

3 Countermeasures Every particular application has its own specific requirements to robustness as discussed above. Therefore, for the sake of generality we will consider only generic countermeasures that are the most typical for current state-of-art methods. Therefore, we will concentrate on the countermeasures against:

• watermark removal attacks: o optimal encoding/decoding; o perceptual masking; o watermark embedding and energy allocation;

• desynchronization attacks: o global affine transforms; o local random geometrical distortions; o projective transforms;

• protocol attacks: o copy attack.

3.1. Generic countermeasures against watermark removal attacks The generic countermeasures against watermark removal attacks include:

o optimal encoding/decoding; o perceptual masking; o watermark embedding and energy allocation.

These countermeasures aim at using optimal encoding/decoding strategies to reach the channel capacity, increasing the energy of watermark using perceptual masking preserving image/video quality, optimal watermark embedding and energy allocation to increase the robustness of the watermark against watermark energy suppression attacks such as denoising and compression or to resist against estimation-based attacks.

3.1.1 Optimal encoding/decoding Channel coding refers to watermark transformations that can render the data hiding system more reliable, i.e. reducing the probability of bit error (Pb) when extracting the information or increasing this amount of information for a fixed Pb. This class of transformations can be divided in two areas: signal design (waveform coding) and structured redundancy (structured sequences). 3.1.1.1 Waveform coding Its objective is transforming the watermark signal into better waveforms, to make the detection process less error-prone. • Antipodal signaling. This is a quite common approach in current watermarking

algorithms. Signals used are mirror images, at the maximum distance of each other. We may have only a two-signal set so one information bit is embedded each time.

• Orthogonal (biorthogonal, transorthogonal) [2] (M-ary modulation). It is an extension of the previous concept but the embedder accepts k information bits each time, driving one of M=2k signals whose cross-correlation detection coefficient zij is either


CMK_D52 28/01/02, 8 / 35

δ(i,j) (orthogonal), or almost a Kronecker�s delta (biorthogonal, transorthogonal). Other approaches use superimposed orthogonal pulses [7].

3.1.1.2 Structured sequences This aspect deals with transforming the data sequences carried by the watermark signal into sequences possessing a redundancy that can be used later to detect and correct errors (e.g. parity check codes). These methods are known to be more efficient than waveform coding methods, both in the achievable performance and in their less complex decoding. There are two big families that have been used in watermarking: • Block codes (BCH, Golay, Reed-Solomon) [1][3]. They operate in regular sized

chunks of the information bits. • Convolutional codes [7]. They operate in a continous fashion, providing better

performance properties. The combination of these families in more efficient and easily decodable codes has given birth to other better approaches: • Concatenated coding [8]. It is the serial concatenation of two block or convolutional

codes through an interleaver. Usually Reed-Solomon and convolutionals are used. • Turbo coding [4][5][6][7][8]. It is the parallel concatenation of two recursive

systematic convolutional codes through an interleaver. It is equivalent to low density parity check (LDPC) codes reported for watermarking applications in [4].

3.1.1.3 Optimal detection The watermark extraction problem can be posed as finding the information codeword that was most likely hidden in the image. If we want to extract the hidden information in an optimal way, we need to know the probability density function (pdf) of the channel conditioned to each embedded information word and to the key used. The optimal maximum likelihood (ML) decoder would decide then the a priori most likely codeword. Another optimum criterion is MAP decoding, where the same kind of decision is taken a posteriori. The list of publications on optimal detector/decoder design is rather extensive and almost all Certimark partners contributed to this subject either before or during the project. In most cases, optimal detection/decoding theory uses the communication formulation of this problem and cover 3 basic objectives how to deal with:

• colored noise at receiver (pre-whitening) [60][1][8]; • non-Gaussian noise (local optimum detection based on a matched filter and

special decoder design for ECC) [8]; • deep fading, cropping, compression and denoising, i.e. partially erasure channels:

diversity reception (channel state estimation and watermark combining) [14][15][57].

3.1.1.4 Chaotic signals for correlation based blind watermarking systems Another class of watermark encoding, that can be considered within the class of waveform coding methods, is chaotic maps. Chaotic maps can be used as generators of watermark signals in blind correlation based methods, instead of pseudorandom


CMK_D52 28/01/02, 9 / 35

generators since, under certain circumstances, they possess superior correlation properties. A significant amount of research on the use and properties of chaotic maps was performed within CERTIMARK project and reported in [84]-[88]. In order to proceed with this study the embedding and detection procedures for the 1-D signal case were mathematically formulated. The overall performance of a system is completely characterised by its ROC curve, i.e., the plot of the probability of false alarm Pfa versus the probability of false rejection Pfr. ROC evaluation requires knowledge of the conditional pdfs fH0, fH1 of the correlator output under hypotheses H0 (the watermark under study is indeed embedded in the host signal) and H1 (the signal hosts a watermark different from the one under study, or no watermark, at all). For simplicity, one can assume that the system/watermark functions under study fH0, fH1 are Gaussian and thus the overall system performance depends on the conditional mean and variance of the correlator output σ2

H0, σ2H1, µH0, µH1, which, in turn,

depend on moments of the signal and the watermark. It has been proven that the system performance depends mainly on the watermark signal autocorrelation function or, equivalently, the power spectral density, and, in a lesser degree, on higher order moments. Watermarks exhibiting highpass spectral characteristics outperform white and lowpass watermarks when no attacks are inflicted on the host signal. However, the watermark spectral properties affect also the systems robustness to lowpass attacks (lowpass filtering, lossy compression). In case of such attacks, a highpass watermark can be degraded more heavily than a lowpass watermark. Initially, the family of n-way Bernoulli shift chaotic maps has been studied in [84],[85]. Bernoulli maps are defined by the following expression

rk+1=Bn(rk)=n rk (mod 1).

The signal is generated by the recursive application of the map, the sequence starting point being the watermark key. Analytical expressions for the moments that are involved in the calculation of the ROC curve have been derived. The power spectrum of Bernoulli maps can be controlled by varying the number n of partitions of the map. For small values of n, Bernoulli watermarks exhibit lowpass behaviour whereas as n increases their spectrum tends to white. It has been proven theoretically that when no distortions occur, pseudorandom white watermarks outperform Bernoulli watermarks. As n increases Bernoulli watermarks converge to a white spectrum and their performance tends to this of the pseudorandom watermarks. When lowpass filtering attacks occur, Bernoulli watermarks achieve better performance due to their lowpass nature. The main drawback of Bernoulli watermarks is that only limited control on their spectrum can be achieved, i.e. their spectrum can vary between lowpass and white. For this reason research has been extended on the family of piecewise linear Markov maps that includes Bernoulli maps [86]-[88]. Analytical expressions for the moments of these maps (and thus analytical ROC expressions) were derived using the Frobenius-Perron operator. The skew tent map that has controllable spectral properties ranging from lowpass to highpass (passing through white) was found to be a good candidate for watermark generation. Varying a single parameter of the map can control the spectral properties of this map. It was shown that highpass tent watermarks outperform white pseudorandom watermarks when no attacks are inflicted. However, they are more vulnerable to lowpass attacks. Furthermore it was proven that white skew tent watermarks have better behaviour than white pseudorandom watermarks because, as


CMK_D52 28/01/02, 10 / 35

mentioned above, performance depends also on higher order moments. As a conclusion skew tent maps can be a good alternative to pseudorandom watermarks. One way to overcome the vulnerability of highpass tent watermarks to lowpass attacks is to embed them in the low frequencies of the DFT domain.

3.1.2 Perceptual masking The important issue is the adaptation of the watermark to the properties of the HVS, i.e. content-adaptive watermarking. Assuming we are given a masking function of the HVS, we wish to embed the watermark into the cover data keeping it under the threshold of visual imperceptibility. Perceptual adaptive watermarking, especially in the early stages of watermarking technology development, was mainly inspired by the achievements in the perception-based image/video compression. Therefore, perceptual masking was mainly addressed in the transform domain. The extensive list of publications and reported results from EPFL and TUDelft research groups [65]-[71] and [72]-[81]. In the framework of the Certimark project, the content-adaptive digital watermarking was mainly covered by UCL, TUDelft, EPFL, Philips Research and University of Geneva. One of the first approaches to content-adaptive digital watermarking was proposed by Podilchuk [24]. This approach was based on a just noticeable difference (JND), which was computed in the DCT domain using a mask developed for lossy JPEG compression by Watson [25]. Another sophisticated approach was proposed by Kankanhali et al. [26]. This approach takes into account the luminance and contrast sensitivity of the human visual system, as well as differentiates between the visibility for edges and texture regions. The basic idea of this approach is based on the original paper of Jayant et al. [27]. The resulted mask was than transferred to the coordinate domain. The coordinate domain approach based on the empirical texture masking was proposed by Piva et al. [28]. The generalized consideration of digital watermarking algorithms based on the HVS was presented in [29]. The next generation of content-adaptive digital watermarking utilizes the idea that the perceptual masking should be performed directly in the transform (mostly wavelet) domain, to match with the upcoming image compression standard JPEG2000 [30][31][32][33]. There are 4 basic independent approaches that were proposed outside or prior to the Certimark project and summarize the multiresolution perceptual watermark masking proposed by Barni et al. [31], Kutter [32], Bertran et al. [33] and Voloshynovskiy et al. [5][48]. The perceptual masking performed in the transform domain has a number of advantages. First, the watermark embedding process is accomplished in the same domain as image/video compression, which makes it possible to perform the watermarking-on-fly. Second, it provides compliance with the JPEG2000 standard, which ensures good robustness of the watermarking algorithms to lossy JPEG2000 compression. It should be noted that the mask and watermark energy allocation should be simultaneously adopted to other types of lossy compression algorithms such as DCT based JPEG.


CMK_D52 28/01/02, 11 / 35

Four main factors can be identified that should be taken into account for the design of perceptual masks based on the HVS:

• background luminance sensitivity; • contrast sensitivity (MTF) depending on the subband or the resolution; • orientation sensitivity (anisotropy); • edge and pattern (texture) masking.

The background luminance is described according to Weber�s law: the eye is less sensitive to noise in bright luminances. For the subband sensitivity, the HVS experiments prove that the eye is differently stimulated depending on the frequency subband, orientation and luminance or chrominance channel. And finally, the higher the texture activity of an area, the lower the sensitivity. The combination of high frequency edges and low frequency luminance variance provides this texture masking factor. The edge proximity factor refers to the fact that the higher the luminance difference of the edge, the less sensitivity the eye has. But as we get away from the edge, the sensitivity is reestablished. To establish a bridge between rate-distortion theory and content-adaptive watermarking, it was proposed by Voloshynovskiy et al. [5] to use a stochastic texture perceptual mask based on a noise visibility function (NVF) early developed only for coordinate domain. This result is also extended to the wavelet domain aiming at including the multi-resolution paradigm in the stochastic framework to take into account a modulation transfer function (MTF) of the HVS [48] and to match the proposed watermarking algorithm with the recent image compression standard JPEG2000 aiming at future integration. This practically means that the different watermark strength is assigned to different image sub-bands. Such a modification leads to the non-white spectrum of watermark matched with the MTF that was not a case for the coordinate domain based version of the NVF. The second reason to use wavelet domain embedding is motivated by the desire to incorporate the anisotropy of the HVS to different spatial directions in the perceptual mask. The coordinate domain version of the NVF uses the isotropic image decomposition based on the extraction of a local mean from the original image or its high-pass filtering. In wavelet domain the image coefficients in 3 basic spatial directions, i.e. vertical, horizontal and diagonal, are received as a result of decomposition that better reflects anisotropy properties of the HVS. As a result, the watermark strength varies for different orientations in the proposed mask. According to that the perceptual edge and texture masking in the wavelet domain is modeled based on the NVF, of pixel ),( ji , for each sub-band component ),( lk :

( ) ( )( ) 2

~,

,,

,,~

,~,

lkxlk

lklk ji

jijiNVF

σωω

+= .

The NVF is based on a stationary Generalized Gaussian (sGG) model of wavelet coefficients for every sub-band. 2

~,lkxσ is the global variance of the wavelet image

coefficients from sub-band ),( lk , and ( )jiw lk ,~, can be written as

( ) ( )[ ]( ) lk

lk

jirji

lk

lklk ,

,

2,

,,,

1,~γ

γγηγω −= with ( ) ( )( )γ

γγη13

ΓΓ= where ( ) ∫

∞−−=Γ

0

1duuet tu is the


CMK_D52

gamma function, and ( ) ( )lkx

lklk

jixjir

,~

,,

,~,

σ= where ( )jix lk ,~

, are the wavelet cover image

coefficients. The NVF's features for a given sub-band are determined by the global sub-band variance and by the shape parameter ( )jilk ,,γ , which is estimated based on the moment matching method. The NVF has automatically adjusted parameters and explains the experimental texture masking enhancement reported in [33]. An example of the NVF pyramid for image �Lena� is shown in Figure 3.

Figure 3. The NVF pyramid.

Finally the weighted watermark is added to the cover image using the following embedding rule:

( ) ( ) ( )( ) ( )( ) ( )jiwSjiNVFSjiNVFjixjiy lkf

lklke

lklklklk ,~,,1,~,~,,,,,,, ⋅⋅+⋅−+=

where ( )jiy lk ,~, are the obtained stego wavelet components and ( )jiw lk ,~

, are the

watermark wavelet components. elkS , is an embedding strength for the edges and textures,

and flkS , is a strength for the flat regions. Visual masking is ensured first by choosing e

lkS ,

greater than flkS , for edges and textures hiding, and second by using adapted strengths for

each resolution, and even for each orientation based on the properties of the MTF. An example of practically used embedding parameters according to the MTF properties, considering cover image pixels values in the range [0,255], are: where rows denote dparameters reflect

0201818e

lkS , =

02.01.01.0

ecreasing resolutions, and coluvery important particularities

1755042207550151111 f

lkS , =

28/01/02, 12 / 35

mns each orientation. The embedding of the HVS. First, the strengths of

13220211015.05.005.02.02.0


CMK_D52 28/01/02, 13 / 35

watermark for the diagonal directions are chosen to be higher than for the vertical and horizontal ones. This is motivated by the fact that the anisotropy sensitivity of the HVS to the diagonally oriented patterns is lower than for the vertical and horizontal directions. Therefore, it makes possible to embed stronger watermark there. Moreover, it allows obtaining, as a result, better robustness against lossy compression (both JPEG-DCT and wavelet JPEG2000). The lossy compression is exploiting the same property of the HVS to allocate smaller amount of bits in the diagonal directions for the image coding. Therefore, the proposed embedding technique utilizes both information about the HVS and quantization of lossy image coding to increase the robustness of watermark. Second, the MTF of the HVS has a typical character as it shown in Figure 4 [[34], p. 55]:

Figure 4. The MTF of the human visual system.

Figure 5. The non-adaptive watermark embedding.

Spatial frequency, cycles/degree

Contrast sensitivity (dB)

0 10 20 30 40



Non-adaptive


CMK_D52 28/01/02, 14 / 35

Figure 6. 1-dimensional sub-band decomposition.

Figure 7. The multiresolution content-adaptive watermark embedding.



Wavelet decomposistion

V1V2 V3 V4 V



Content-adaptive sub-band embedding


CMK_D52 28/01/02, 15 / 35

Figure 8. The multiresolution decomposition and relation with the MTF. Therefore, it is obvious from the above plot that the MTF has a maximum in the low frequencies. In the case of non-adaptive watermark embedding (Figure 5), the typical additive white Gaussian watermark has a uniform spectrum. The increase of watermark strength or equivalently watermark power density will lead to the violation of the visibility constrain in the low frequencies. Although there still remains quite a lot of room for the watermark embedding in the very low, middle and high frequencies under the threshold of imperceptibility. To exploit this opportunity it was suggested to use wavelet sub-band decomposition (Figure 6) where the watermark strength could be adopted according to the local properties of the MTF (Figure 7). This behavior of the MTF is reflected in the proper choice of the embedding parameters that have maxima in the corresponding frequency sub-bands along each spatial direction (Figure 8). Third, the particular properties of the given image within each sub-band are taken into account using local watermark strength control based on the NVF. This feature has image



CMK_D52 28/01/02, 16 / 35

dependent character oppositely to the previous two properties that characterize the HVS in general. Therefore, the proposed watermark embedding technique utilizes both general features of the HVS as well as local statistics of images.

3.1.3 Watermark embedding and energy allocation We will concentrate our analysis on the copyright protection of still images that is an urgent problem for modern e-commerce. Obviously, the embedding methods introduced in this document can be applied to audio and video watermarking algorithms with the safe of generality and with the technical modifications depending on the physics of the considered media. The watermark can be regarded as an additive signal w, which contains the encoded and modulated watermark message b under constraints on the introduced perceptible distortions given by a mask M, so that

y = x + w(M). Note that w must not necessarily be independent from the original data x. The simplest approach to achieve a perceptually indistinguishable watermarked and original signal is to keep the power of the watermark signal very low. Using sophisticated psycho-acoustic or psycho-visual models, more appropriate masks M can be applied to enhance the robustness of the watermarking scheme as discussed in section 3.1.2. Commonly used embedding techniques can be classified into additive [1][2][4][7][8], multiplicative [35], and quantization-based schemes [10][11][12][13]. In additive schemes, there are usually very weak dependencies between w and x, e.g. introduced by choosing w dependent on a data-dependent perceptual mask M. In multiplicative schemes, samples of the original data are multiplied by an independent signal v, so that w=xv-x. Here, w and x are of course dependent on each other. Strong local dependencies between the realizations of w and x exist in quantization based watermarking schemes. However, these dependencies are such that statistically x and w appear (almost) independent. The quantization-based schemes are also considered to be good candidates for the host interference suppression that makes possible to reach the capacity of the generalized watermarking channel. Moreover, these methods are considered in the framework of watermarking as communication with side information that was recently proposed by Cox et al. [9]. An important issue is the watermark energy allocation. The first aspect of this problem connected with the perceptual masking was considered in the section 3.1.2. Here, we will consider the second aspect of this problem connected with the countermeasures against estimation-based attacks, i.e. attacks that take into account the knowledge of watermarking technology and exploit statistics of the original data and watermark signal [37][38][39] that were generalized in [36][40]. In addition, we emphasize that for the design of attacks against watermarking schemes, the distortion of the attacked document and the success of watermark-impairment has to be considered. Within the scope of these attacks, we consider the estimation-based attacks [36]. These attacks are based on the assumption that the original data or the watermark can be estimated - at least partially -


CMK_D52 28/01/02, 17 / 35

from the watermarked data using some prior knowledge of the signals� statistics. Note that estimation does not require any knowledge of the key used for watermark embedding. Further, knowledge of the embedding rule is not required, but the attack can be more successful when it is. The full strength of estimation-based attacks can be achieved by introducing additional noise, where the attacker tries to combine the estimated watermark and the additive noise to impair watermark communication as much as possible while fulfilling a quality constraint on the attacked data. With a sophisticated quality constraint it is also possible to exploit human perception, e.g. the human auditory system in case of audio watermarks and the human visual system (HVS) in case of image and video watermarks. Depending on the final purpose of the attack, the attacker can obtain an estimate of the original data or of the watermark based on some stochastic criteria such as maximum likelihood (ML), maximum a posteriori probability (MAP), or minimum mean square error (MMSE). We do not focus here on the particularities of the above estimation but rather concentrate on different ways to exploit the obtained estimates to impair the embedded watermark. Depending on the way the estimate is used, we can classify estimation-based attacks as removal, protocol, or desynchronization attacks. To resist estimation-based attacks, the embedder aims at making the watermark difficult to estimate. This approach has been investigated for two different scenarios. Power-Spectrum Condition (PSC): An idealized theoretical approach [41] for analysing estimation-based attacks treats the original signal and watermark as independent, zero-mean, stationary, colored Gaussian random processes. The watermarked data is the sum of these two processes. Since the original signal is given, its power spectrum is assumed fixed, but the watermark power spectrum can be varied. The question is, "How should the watermark power spectrum be shaped to resist an estimation-based attack?" For this scenario, the optimal estimate is obtained by a Wiener filter. The mean-squared error E between the original watermark and the estimated watermark provides a convenient way to measure how well a watermark resists estimation. It can be shown that E is maximized if and only if the watermark power spectrum is directly proportional to the power spectrum of the original signal. This requirement is called the power-spectrum condition (PSC). A watermark whose power spectrum satisfies the PSC is the most resistant against estimation. If distortion is measured by the mean-squared difference between the attacked data and the unwatermarked, original data, then the PSC has another important consequence: For any output of the matched filter, a watermark that fulfils the PSC causes the above attack to incur the greatest distortion. To drive the correlation to zero, the attack must make the distortion as large as the power of the original data, so the attacked data is unlikely to be useful. Noise Visibility Function (NVF): The PSC is attractive because it can be proven rigorously and has a convenient mathematical form. For image watermarking, image denoising provides a natural way to develop estimation-based attacks [40] optimized for


CMK_D52 28/01/02, 18 / 35

the statistics of images, although optimality might be difficult to prove. The watermarked image is treated as a noisy version of the original image, and the watermark represents noise that should be eliminated. Thus, the estimated watermark is the same as the estimated noise. We applied different statistical models for the original images, namely a non-stationary Gaussian process (1), or a stationary, generalized Gaussian process (2) [42]. The noise/watermark can be treated as one of these processes, however, here we assume that it is still a stationary Gaussian process. In case (1), the denoising method uses an adaptive Wiener filter, while in case (2) it reduces to the popular denoising methods of hard-thresholding and soft-shrinkage as particular cases. Both denoising methods produce a texture masking function (TMF), which is derived from the image statistics and is therefore image-dependent. The TMF takes on values in [0,1]. To embed a watermark that resists such estimation, the watermark embedding should use the inverted function that is known as a noise visibility function (NVF) [42], defined by NVF = 1 - TMF. NVF values near unity indicate flat regions, where the watermark should be attenuated, while NVF values near unity indicate texture or edge regions where the watermark should be amplified. In this way, the watermark is embedded to resist estimation-based attacks derived from image denoising. A qualitative comparison sheds light on the structure of watermarks produced in this manner. Figure 9a shows the original Cameraman image and the NVFs derived using cases (1) and (2), and Figures 9b depicts the corresponding magnitude spectra. The figure clearly shows that the resulting watermark spectra are closely matched to the power spectrum of the original image. Note that in case of images, the PSC can give only a coarse result since the underlying statistical model does not fit very closely to images. Nevertheless, the results obtained using the PSC agree with those of the NVF. The two approaches complement each other well.


CMK_D52 28/01/02, 19 / 35

Figure 9. (a) From left to right: original image, NVF estimated based on the non-stationary Gaussian and stationary Generalized Gaussian image models and (b) corresponding spectra.

3.2. Countermeasures against desynchronization attacks The main goal of desynchronisation attacks is to impair the watermark detection or decoding by introducing specific geometrical distortions or removing the synchronization mechanisms of the watermarking method. In this context, desynchronisation attacks have a lot of features in common with communication systems in the framework of the coherent and non-coherent decoding. However, there are a number of differences between watermarking and communication that require additional care to be paid, when considering multimedia such as images, video and audio as an equivalent communication channel. The countermeasures against desynchronisation attacks can be classified, as follows:

• affine geometrical attacks; • local random geometrical distortions; • projective transforms; • synchronization removal attacks.

The basic idea of synchronization removal attacks is to detect synchronization patterns, remove them, and then apply desynchronisation techniques, e.g., global affine transformation in the case of image watermarking. Therefore, the basic countermeasure against the synchronisation removal attacks is to make the reference structure difficult for estimation or detection.

a)

b)


CMK_D52 28/01/02, 20 / 35

3.2.1 Global affine transforms The state-of-art methods capable to estimate and recover the undergone affine geometrical transforms can be divided into several groups, depending on the reference structure used, and on the method applied to estimate the parameters of the affine transform. We will concentrate our analysis mostly on still image watermarking applications specifying the difference with video watermarking in the corresponding cases. Depending on the reference features used the existing methods may be divided into 4 main groups:

• methods using a transform invariant domain [3], • methods based on an additional template [43][44][45][46], • methods exploiting the self-reference principle based on an auto-correlation

function (ACF) [47] or magnitude spectrum of a periodical watermark [4][48];

• methods using feature points [82][83]. The main idea of watermarking in the transform invariant domain is to perform the watermark embedding or detection in the domain invariant to geometrical transforms. One of the examples is to apply a Fourier-Mellin transform to the magnitude of the original (or cover) image spectrum [3]. The invariant coefficients are marked using some specific kind of modulation. The inverse mapping is computed in the opposite order. The above approach has several drawbacks. First, the logarithmic sampling of the log-polar mapping must be adequately handled in respect to the interpolation errors and sufficient accuracy. Therefore, the application of the above approach is only known for the comparatively large images of size 512x512 pixels. The second moment is connected with the inability to recover the change of the aspect ratio.

To overcome the problem of poor image quality due to the direct and inverse Fourier-Mellin transform and associated interpolation errors, the template approach is used. The template itself does not contain payload information and is used to recover geometrical transforms. The early methods have applied the log-polar/log-log idea to the template. However, the above mentioned problem of the simultaneous recovering of rotation and change of aspect ration is a weak heritage of this methodology.

The recent proposal [45] aims at overcoming the above problem using general affine transform paradigm. However, the necessity to spend part of the limited available energy for an extra template, as well as the relative simplicity with which the attackers can remove template peaks caused the necessity to use therefore self-reference methods which utilise the same affine paradigm. The examples of different template design are shown in Figure 10. The security of the template based watermarking is based on the argument that the template could be key-dependent. However, the usage of key dependent templates does not prevent the attackers


CMK_D52 28/01/02, 21 / 35

to predict them even without knowledge of the key used for template allocation. This is demonstrated in Figure 11 on the example of the Digimarc template. Knowing the template, the attacker can easily apply the template removal attack proposed in [38].

(a) (b) (c) (d)

Figure 10. The examples of different templates used in the DFT domain: (a) diagonal, (b) circular, (c) distributed, (d) key dependent (random).

Figure 11. An example of Digimarc template detected without any prior knowledge of the used key. To use the template-based methods one should resolve the following open issues:

• where to allocate the template resolving the trade-off between visibility and robustness;

• how to detect peaks after geometrical attacks possibly followed by lossy compression;

• how to design a fast and efficient template matching algorithm for the estimation of the affine transform parameters.

To solve the problems of the template-based watermarking, self-reference watermarks are mostly used in practice. The self-reference watermarks do not use any additional template to cope with the geometrical transforms. Instead, the watermark itself is arranged in the special spatial structure with the desired statistical properties of the watermark statistics. The most often used watermarks within this approach have self-similar features, i.e.


CMK_D52 28/01/02, 22 / 35

repetition of the same watermark in many spatial direction depending on the final goal and the targeting attack. The detection of the applied geometrical transform is based on the prediction of the watermark, which in most cases can be accomplished using the ML or MAP estimators. Then the statistics of the distorted watermark are computed in order to indicate the type and the parameters of the applied transform. Depending on the particularities of the watermark design and the watermark statistics used for the estimation of the global affine transform one can distinguish 4 basic types of the self-reference watermarks that have a lot of common features:

• self-reference watermarks based on 4 times repeated orthogonally permuted patterns and affine estimation based on autocorrelation function (ACF) [47];

• periodic watermarks with any geometry and affine estimation based on the magnitude watermark spectrum [5][48];

• cyclic patterns; • self-similar patterns or patterns with a special spatial structure [18] - [23].

In [47] the watermark is replicated in image in order to create 4 repetitions of the same watermark. This enables to have 9 peaks in the ACF that are used to undergone geometrical transformations (Figures 12 and 13). The descending character of the ACF peaks shaped by the triangular envelope reduces robustness of this approach to the geometrical attacks accompanied by a lossy compression. The need for computing two discrete Fourier transforms (FT) of double image size to estimate the ACF creates also some problems for real time application in the case of large images. Also, empirical cross-shape filter is used for the watermark prediction needed for the ACF computing.

- Figure 12. An example of self-reference synchronization based on the ACF of 4 times repeated watermark.


CMK_D52 28/01/02, 23 / 35

(a) (b) Figure 13. An example of self-reference estimation of the global affine transform based on the ACF of 4 times repeated watermark: (a) original image Lena and corresponding ACF; (b) image Lena after shearing and corresponding detected ACF. The known fact that periodical signals have discrete magnitude spectrum makes it possible to obtain a regular grid of reference points that can easily be employed for recovering from general affine transformations. The existence of many peaks in the magnitude spectrum of the periodically repeated watermark increases the probability to detect geometrical transform even after lossy compression attack [5]. This fact indicates the enhanced robustness of the proposed approach. Secondly, it is more difficult to remove the peaks in the magnitude spectrum based on a local interpolation in comparison with a template scheme. Such an attack would create considerable visible distortions in the attacked image. The practical algorithm based on the magnitude spectrum of the periodical watermarks is described in [48] for coordinate, wavelet or any transform domain. First, the magnitude spectrum is computed from the estimated watermark. Due to the periodicity of the embedded information, the estimated watermark spectrum possesses a discrete structure. Assuming that the watermark is white noise within the block, the spectrum of the watermark will additionally be uniform. Therefore, the magnitude spectrum shows aligned and regularly spaced peaks. If an affine distortion was applied to the stego image, the peaks layout will be rescaled, rotated and/or sheared, but alignments will be preserved. Therefore, it is easy to estimate any affine geometrical distortion from these peaks by fitting alignments and estimating periods (Figure 14).


CMK_D52 28/01/02, 24 / 35

a) b) Figure 14. Recovering from global geometrical transforms based on the magnitude spectrum of the periodical watermark: (a) the estimated watermark after rotation about 37 degree and lossy compression (QF=50%) and (b) the fitted alignments for the estimation of the parameters of the affine transform. Another family of techniques uses watermarks that exhibit spatial symmetry and/or self-similarity, sometimes combined with an appropriate embedding domain in order to achieve invariance to certain affine transforms and/or reduce the parameter space that is searched when detecting the watermark in geometrically distorted images. Such a technique was initially proposed in [18] and further studied and extended in [20] (part of the research reported in this publication was conducted within CERTIMARK). The algorithm additively embeds a circularly symmetric binary watermark in the magnitude of the DFT domain of images The watermark has the form of a ring, in order to affect only a middle frequency band so that neither visual artefacts appear nor is the watermark vulnerable to lowpass attacks. The ring-shaped watermark is divided into a number of sectors, each of which has a constant binary value. This fact allows watermark detection in small rotations and reduces the search space when larger rotations occur. DFT embedding grants to the watermark invariance to scaling and shifting. However for dealing with cropped images exhaustive search of all possible scaling factors is required. A variation of this technique which apart from the circular symmetry incorporates watermark self-similarity has been proposed in [19]. In this method the ring sectors are identical and furthermore the watermark ring consists of several sub-rings, each of which is a scaled version of its inward neighbouring sub-ring. This structure further decreases search ranges in case of geometric distortions. Self-similar copyright protection watermarking in the wavelet domain has been also proposed [21][22]. Wavelet domain watermarking exploits the spatial localization and frequency spreading of the wavelet transform to embed spatially self-similar watermarks (quasi scale invariant) to selected subbands of the transform, resulting in implicit visual masking and thus watermark perceptual invisibility. Due to the hierarchical structure of the transform, multiresolution embedding and detection is possible. The scheme is capable of blind detection using correlation techniques. Experimental results prove the


CMK_D52 28/01/02, 25 / 35

efficiency of this approach against various image distortions, such as filtering, compression, cropping, scaling and rotation. For the geometric distortions, testing various distorted versions of the watermark pattern is required for detection but, as it has been shown, the number of cases that have to be examined is much limited (with respect to the exhaustive search case) due to the watermark�s special structure. A spatial-domain still image watermarking algorithm utilising spatially self-similar watermarks has also been presented in [23]. The watermarks are generated by combining scaled versions of 2-D chaotic signals, in order to attain a self-similar structure. In addition, the 2-D chaotic signal generation procedure contains operations, which ensure that lowpass watermarks are obtained. Such characteristics (lowpass spectrum, self-similarity) enable robustness against distortions of lowpass nature, as well as, cropping and scaling.

The algorithms for the estimation of affine transforms can be divided into 2 categories: • the algorithms based on log-polar and log-log mapping [3][45], • the algorithms performing some constrained exhaustive search aiming at the best

fitting of the reference pattern with the analysed one [47][54][45][56]. These approaches have several drawbacks from both robustness, uniqueness and computational complexity points of view. Log-polar or log-log mapping are unable to estimate a rotation and a change of proportions simultaneously. Exhaustive search of templates is computationally expensive, and the accuracy of template points is strongly sensitive to any distortion such as lossy compression. In this framework, it is proposed to overcome the above mentioned difficulties using the information about the regular structure of the template, or about the magnitude spectrum or the ACF of the periodically repeated watermark [56]. This enables to consider a template with periodical structure or the spectrum of a periodically repeated watermark as a regular grid of points, aligned along 2 main axes within 2 periods. Therefore, keeping in mind this discrete approximation of the grid of lines one can easily exploit a Hough transform (HT) in the binary detection case, or a Radon transform directly applied to the magnitude spectrum or the ACF, in order to receive a robust estimate of the general affine transform parameters [61]. This approach has a number of advantages in comparison with the previous methods. First, it is very general and makes possible to determine any affine transform or even a combination of sequentially applied affine transforms. Moreover, the false peaks or outliers on the grid due to lossy compression or any other attack do not decrease the robustness of the approach due to it�s inherent redundancy. Therefore, the proposed approach is tolerant even with very strong lossy compression, which is not a case for the previously proposed methods. Finally, the strict mathematical apparatus of the HT avoids the necessity for an exhaustive search.

3.2.2 Local random geometrical distortions One problem with almost all current watermarking technologies is that they fail to recover a watermark from random bending geometrical distortions, known as the random bending attack (RBA). The RBA was first introduced by F. Petitcolas in the


CMK_D52 28/01/02, 26 / 35

benchmarking tool Stirmark to model printing/scanning artifacts [49]. If today watermarking technologies resist in practice against printing/scanning, unfortunately however the RBA attack still remains an essential problem for almost all existing watermarking methods. The practical danger of this attack consists in the fact that the attacker can apply it against some watermarking technology using the Stirmark benchmarking tool, while preserving visual image quality. Having removed the watermark the attacker can commercially exploit the attacked image, violating copyright laws. The main difficulty to deal with the RBA comes from the basic assumption that all geometrical alterations introduced by the attacker are modelled as a global affine transform. This does not hold for the RBA where the introduced distortions cannot be described using the parameters of a global affine transform only. Moreover, the situation is complicated by the fact that many technologies [43]-[46] are using a global template in the magnitude spectrum of the image, which does not allow differentiating local alterations introduced in the case of RBA. A group of methods are using the assumption about the local character of the RBA [52][51][50][53][54]. F. Hartung et al. [52] were probably the first who proposed to use this assumption. However, an exhaustive search is used in all methods to recover from this attack. This restricts the usage of such methods in commercial and on-line applications due to the high computational complexity of the exhaustive approach. One way to overcome this problem is to divide the image into segments or cells, and to embed the watermark into each segment. This has been done by Rhoads [43], by Lin et al. [55], Dugelay [54] and Petitcolas [50] as well as by Voloshynovskiy et al. [56][57]. A particular case of this approach to watermark generation is the periodical tiling of the same watermark. In fact the idea of repeating the same watermark has several advantages. First, it allows resisting against cropping. Secondly, exploiting the periodical structure of the watermark one can use either the autocorrelation function (ACF) [47] or the magnitude spectrum of the Fourier transform [5] to estimate and recover from global transformations. Unfortunately, all the above schemes, except [50][54], have the important defect that local random bending alterations and the general class of projective transformations were not integrated in the watermark detector. A possible countermeasure against local random geometrical distortions without exhaustive search was proposed in [56][57]. According to this proposal, the watermark is first estimated using either a Maximum Likelihood (ML) estimator, or a penalized ML or a minimum mean square error (MMSE) estimator. In the case when no geometrical transform was applied the message is decoded from the extracted watermark directly. If some geometrical transform was applied, the extracted watermark is processed in order to invert it. The next step relies on the assumption that local non-linear transforms and the projective transforms are approximated as local affine transforms. Finally, to determine local affine transforms, one can either use local ACF or magnitude spectrums, or exploit the reference watermark information at the block level (Figure 15). To exclude the tremendous exhaustive search the encoded orthogonal reference watermark was used which provides the measure of reliability for the estimation of local affine transform parameters. This approach was also extended to the projective transforms considered in section 3.2.3.


CMK_D52 28/01/02, 27 / 35

Figure 15. Approximation of the RBA by the local affine transform and the recovering based on: (a) locally symmetric watermark that produce zero phase condition and (b) the encoded reference watermark. Another interesting solution that can potentially resists against the RBA attack was proposed in [58]. The original idea of stochastic modelling of the watermarking channel with respect to the geometrical distortions was considered. The authors model the geometrical distortions as a geometric channel, where the noise modifies the geometry of the image rather than the data values. The stochastic model of the geometric channel is based on Markov chain. The resulted decoding algorithm utilizes the MAP decoding rule. The experimental results demonstrate the high efficiency of the proposed approach.

3.2.3 Projective transforms An important application for digital watermarking is a digital cinema. This format makes possible to create high quality cinema with resolution 1920 pixelsx1080linesx 24frames/secx36bits/pixel. The main requirements with respect to the robustness are the robustness to degradations in digital video or photo cameras and the robustness to geometrical distortions that includes the above global projective transforms and more general class of projective transforms. An original and simple solution to resist against projective transforms in this application was proposed by Philips researchers [59]. The main idea of this approach is opposite to the above methods used to fight against the RBA where the distortions are recovered locally. In this approach the watermark is embedded in the full frame by increasing the luminance of every pixel within the frame by 1 for 1 and decreasing by 1 for watermark bit equals 0. To reduce the flicker effect the watermark is adopted to the HVS using special spatial-temporal masking. The detection does not require any special synchronization since the watermark is embedded globally in the frame. The predicted and equalised watermark is cross-correlated with the known watermarks to detect the presence of the watermark.

A

LOCAL MACROBLOCK

LOCAL MACROBLOCK WITH REFERENCE WATERMARK

A

a)

b)


CMK_D52 28/01/02, 28 / 35

It should be noted that the methods able to resist to the RBA could be used to fight against the projective transforms [56][57]. The important issue is the complexity of the watermark decoding. In the case of high quality image acquisition devices the complexity might be compared with the above approach. However, due to possible lossy compression and optical degradations more than 1 block can be required to decode the watermark that might increase the complexity of the method. Finally, an important aspect of desynchronization attacks is related to the channel state estimation. To estimate channel state or the parameters of the applied attacks one should either reallocate some space for the synchronization patterns or templates or to create the watermark with the special features like in the case of self-recovering watermarks. This sequentially leads to the necessity to perform very careful analysis in every particular case in terms of capacity, stochastic visibility and more generally system security, since the attacker can exploit the knowledge of the used synchronization technique to design successful attack.

3.3. Countermeasures against protocol attacks Protocol attacks aim at attacking the entire concept of the watermarking application. One type of protocol attack is based on the concept of invertible watermarks. The idea behind inversion is that the attacker subtracts his own watermark from the watermarked data and claims to be the owner of the watermarked data. This can create ambiguity with respect to the true ownership of the data. It has been shown that for copyright protection applications, watermarks need to be non-invertible. The requirement of non-invertibility of the watermarking technology implies that it should not be possible to extract a watermark from a non-watermarked document. A solution to this problem might be to make watermarks signal-dependent by using one-way functions. Another protocol attack is the copy attack. In this case, the goal is not to destroy the watermark or impair its detection, but to estimate a watermark from watermarked data and copy it to some other data, called target data [39]. The estimated watermark is adapted to the local features of the target data to satisfy its imperceptibility. The copy attack is applicable when a valid watermark in the target data can be produced with neither algorithmic knowledge of the watermarking technology nor the knowledge of the watermarking key. Again, signal-dependent watermarks might be resistant against the copy attack. There are not, at the moment, many publications on the subject how to resist against protocol attacks. Therefore, we can summarize the generic countermeasures to resist to this class of attacks:

• To make the watermark non-additive (the basic published version of the copy attack relies on the assumption that the watermark embedding rule is addition);

• To generate signal dependent watermark (multiplicative or special signal-dependent modulation technologies or quantization);

• To make watermark prediction difficult, i.e. to embed watermark according to the PSC or the NVF discussed in 3.1.3.


CMK_D52 28/01/02, 29 / 35

Within the Certimark project, research has been carried out to study methods to prevent the copy attack. One way to do so, is to make the watermark dependent on the visual content it is embedded in. If such a watermark is estimated and transplanted into another image, the detector will not detect a valid watermark in the illegitimately watermarked content. The usual mode of operation is that a robust signature is extracted from the image. This signature is used to generate the watermark to be embedded. At the detector side, again the signature is computed, the watermark is derived from the signature and subsequently a detection is performed using that particular signature-dependent watermark pattern (see, for instance, [62][63]). To achieve a robust watermark, the signature extraction should be highly insensitive to all processing that the watermark should be robust against. Moreover, the watermark should depend in a continuous fashion on the signature, so that the occurrence of a few bit errors in the signature does not lead to a completely different watermark pattern. To make the success rate of the copy attack as low as possible, the signature should be as discriminating as possible, i.e., it must be very hard to find two perceptually different images having almost the same signatures. Within the Certimark project, attention has been (and is being) paid to finding highly robust signatures for video [64]. A signature, based on the mean luminance computed over relatively large blocks proves to be a computationally cheap solution leading to very robust behaviour.

4 CONCLUSION The design of the robust watermarking technology is a complex non-trivial problem that requires taking into account many contradictory requirements such as robustness, visibility, capacity and algorithmic complexity. In many practical situations it is either very difficult or sometimes even impossible to satisfy all of them simultaneously. Sometimes, the definition of robustness is not well defined in the context of digital watermarking that makes the problem of the countermeasure design very difficult. Therefore, in this document we have tried to provide the clear definition of the main aspects of watermark robustness and considered state-of-art countermeasures against the major classes of watermarking attacks. The described list of countermeasures can be definitely extended depending on the specific applications of watermarking technologies. The considered countermeasures will be used in the related deliverables, such as �European WM� (T5.6) and �Certification process� (T6.5).

5 BIBLIOGRAPHY [1] Juan R. Hernández, Fernando Pérez-González, and José M. Rodríguez. The impact

of channel coding on the performance of spatial watermarking for copyright protection. In Proc. ICASSP'98, volume 5, pages 2973-2976, Seattle, Washington, USA, May 1998.


CMK_D52 28/01/02, 30 / 35

[2] M. Kutter, Performance improvement of spread spectrum based image watermarking schemes through M-ary modulation, in Proc. Information Hiding Workshop, (Dresden, Germany), Springer-Verlag, October 1999.

[3] J. J. K. O. Ruanaidh and T. Pun, Rotation, scale and translation invariant spread spectrum digital image watermarking, Signal Processing, vol. 66, pp. 303-317, May 1998.

[4] Shelby Pereira, Sviatoslav Voloshynovskiy and Thierry Pun, Optimal transform domain watermark embedding via linear programming, Signal Processing, Special Issue: Information Theoretic Issues in Digital Watermarking, 2001.

[5] S. Voloshynovskiy, F. Deguillaume and T. Pun, Content adaptive watermarking based on a stochastic multiresolution image modeling, In Tenth European Signal Processing Conference (EUSIPCO'2000), Tampere, Finland, September 5-8 2000.

[6] J. J. Eggers, J. K. Su and B. Girod, "Performance of a Practical Blind Watermarking Scheme", Electronic Imaging 2001, San Jose, CA, USA, January 2001.

[7] Fernando Pérez-González, Juan R. Hernández, and Félix Balado. Approaching the capacity limit in image watermarking: A perspective on coding techniques for data hiding applications. Signal Processing, Elsevier, 81(6):1215-1238, June 2001. Special Section on Information Theoretic Aspects of Digital Watermarking.

[8] Félix Balado and Fernando Pérez-González. Coding at the sample level for data hiding: turbo and concatenated codes. In Ping Wah Wong and Edward J. Delp, editors, Security and Watermarking of Multimedia Contents III, volume 4314 of Proc. of SPIE, pages 532-543, San José, USA, January 2001.

[9] L.J. Cox, M.L. Miler, and McKelips, Watermarking as communications with side information, Proc. IEEE, 87(7), pp. 1127-1141, July, 1999.

[10] S. Pereira, S. Voloshynovskiy, and T. Pun, A method for generating and decoding image dependant watermarks, European Patent Application PCT/IB00/00494, filed April 20, 2000.

[11] M. Ramkumar, A.N. Akansu, Self-Noise Suppression Schemes for Blind Image Steganography, SPIE Special Session on Image Security, Boston, MA, vol 3845, pp 55-65, September 99.

[12] B. Chen and G.W. Wornell, Provably robust digital watermarking, In Proc. Of SPIE, Vol. 3845, pp. 43-54, Boston, USA, September 1999.

[13] J.J. Eggers, J.K. Su, and B. Girod, �A Blind Watermarking Scheme Based on Structured Codebooks,� IEE Colloquium: Secure Images and Image Authentication, London, UK, April 2000.

[14] D. Kundur and D. Hatzinakos, "Diversity and Attack Characterization for Improved Robust Watermarking," IEEE Transactions on Signal Processing, vol. 29, no. 10, 2001.

[15] S. Voloshynovskiy, F. Deguillaume, S. Pereira and Thierry Pun, Optimal diversity watermarking with channel state estimation, Electronic Imaging 2001: Security and Watermarking of Multimedia Content III, San Jose, California USA, 21-26 January 2001.

[16] DELIVERABLE 2.1: Watermarking applications and requirements for benchmarking, CERTIMARK Project, Oct 2000.

[17] DELIVERABLE 4.1: Watermarking applications and requirements for benchmarking, CERTIMARK Project, Oct 2000.

http://vision.unige.ch/publications/postscript/2001/PereiraVoloshynovskiyPun_sigProc2001.pdf

http://vision.unige.ch/publications/postscript/2001/PereiraVoloshynovskiyPun_sigProc2001.pdf


CMK_D52 28/01/02, 31 / 35

[18] V. Solachidis and I. Pitas, �Circularly symmetric watermark embedding in 2-D DFT domain�, IEEE Int. Conf. on Acoustics, Speech and Signal Processing (ICASSP'99), Phoenix, Arizona, USA, vol. 6, pages 3469-3472,15-19 March 1999.

[19] V. Solachidis, I. Pitas, �Self-similar ring shaped watermark embedding in 2-D DFT domain�, 2000 European Signal Processing Conf. (EUSIPCO'00) CD-ROM,Tampere, Finland, 5-8 September 2000.

[20] V. Solachidis and I. Pitas, �Circularly Symmetric Watermark Embedding in 2D DFT domain�, IEEE Transactions on Image Processing, November 2001.

[21] S. Tsekeridou, I. Pitas, �Wavelet-based Self-Similar Watermarking for Still Images�, 2000 IEEE Int. Symposium on Circuits and Systems (ISCAS'00) vol. I, pp. 220-223, Geneva, Switzerland, 28-31 May 2000.

[22] S. Tsekeridou, I. Pitas, �Embedding Self-Similar Watermarks in the Wavelet Domain�, 2000 IEEE Int. Conf. on Acoustics, Systems and Signal Processing (ICASSP'00), vol. IV, pp. 1967-1970, Istanbul, Turkey, 5-9 June 2000.

[23] S. Tsekeridou, N. Nikolaidis, N. Sidiropoulos, I. Pitas, �Copyright Protection of Still Images Using Self-Similar Chaotic Watermarks�, 2000 IEEE Int. Conf. on Image Processing (ICIP'00), vol 1, pp 411 -414, Vancouver, Canada, 10-13 September 2000.

[24] C. I. Podilchuk and W. Zeng, Image-Adaptive Watermarking Using Visual Models, IEEE Journal on Selected Areas in Communications, v. 16, No 4, pp. 525--539, May 1998.

[25] A. B. Watson, DCT quantization matrices visually optimized for individual images, in Proc. SPIE: Human vision, Visual Processing and Digital Display IV,Vol. 1913, pp.202-216, 1993.

[26] M. Kankanhalli and R. Ramakrishnan, �Content based watermarking of images�, ACM Mulimedia98, Bristol, UK, 1998, pp. 61-70.

[27] N. Jayant, J. Johnston, and R. Safranek, �Signal compression based on models of human perception�, Proc. of the IEEE, 1993, Vol. 81, No10, pp. 1385-1422.

[28] A. Piva, M. Barni, F. Bartolini, V. Cappellini, "Mask building for perceptually hiding frequency embedded watermarks," Proceedings of 5th IEEE International Conference on Image Processing ICIP'98 , Chicago, IL, USA, October 4-7, 1998, pp. 450-454.

[29] Jean-François Delaigle, Christophe de Vleeschouwer and Benoit Macq 'Watermaking algorithm based on a human visual model', Signal Processing, Vol. 66, n° 3, May 1998, pp. 319-336.

[30] A. Tewfik, M. Swanson, and B. Zhu, Method and apparatus for embedding data, including watermarks, in human perceptible images, US patent, US6031914, Feb. 2000.

[31] M. Barni, F. Bartolini, V. Cappellini, A. Lippi, A. Piva, "A DWT-based algorithm for spatio-frequency masking of digital signatures", Proceedings of SPIE vol. 3657, Security and Watermarking of Multimedia Contents, Electronic Imaging '99, San Jose, CA, January 1999.

[32] M. Kutter, Digital image watermarking: hiding information in images, PhD thesis, August 1999, EPFL,Lausanne, Switzerland.

[33] Marc Bertran, Jean-François Delaigle & Benoit Macq: 'Some Improvements to HVS Models for Fingerprinting in Perceptual Decompressors ', ICIP 2001 - IEEE Signal Processing Society International Conference on Image Processing, pp. 1039-1042, October 7-10 2001, Thessaloniki, Greece.

http://www.tele.ucl.ac.be/MEMBERS/Bertran_Marc_e.html

http://www.tele.ucl.ac.be/MEMBERS/Delaigle_Jean-Fran%E7ois_e.html

http://www.tele.ucl.ac.be/MEMBERS/Macq_Benoit_e.html


CMK_D52 28/01/02, 32 / 35

[34] A.K. Jain �Fundamentals of digital image processing�. Prentice Hall 1989. ISBN 0-13-336165-9.

[35] M. Barni, F. Bartolini, V. Cappellini, A. Piva, F. Rigacci, "A MAP identification criterion for DCT-based watermarking," Proceedings of the IX European Signal processing Conference EUSIPCO'98, Island of Rhodes, Greece, September 8-11, 1998, pp. 1513-1516.

[36] S. Voloshynovskiy, S. Pereira, V. Iquise and T. Pun, Attack modeling: Towards a second generation watermarking benchmark, Invited Paper, Signal Processing: Special Issue on Information Theoretic Issues in Digital Watermarking, to appear, 2001.

[37] G.C. Langelaar, R.L. Lagendijk and J. Biemond, Removing Spatial Spread Spectrum Watermarks by Non-linear Filtering, In Proceedings of the 9th European Signal Processing Conference, Island of Rhodes, Greece, Sept. 1998.

[38] A. Herrigel, S. Voloshynovskiy, Y. Rytsar, Template removal attacks, IS&T/SPIE's 13th Annual Symposium, Electronic Imaging 2001: Security and Watermarking of Multimedia Content III, In SPIE Proceedings, San Jose, California USA, January 2001.

[39] M. Kutter, S. Voloshynovskiy and A. Herrigel, Watermark copy attack, IS&T/SPIE's 12th Annual Symposium, Electronic Imaging 2000: Security and Watermarking of Multimedia Content II, Vol. 3971 of SPIE Proceedings, San Jose, California USA, January 2000.

[40] S. Voloshynovskiy, S. Pereira, T. Pun, J. Eggers, J. Su, "Attacks on digital watermarks: classification, estimation-based attacks and benchmarks", Invited Paper, IEEE Communications Magazine, Spec. Issue on: Digital watermarking for copyright protection: a communications perspective, M. Barni, F. Bartolini, I.J. Cox, J. Hernandez, F. Perez-Gonzalez, Guest Eds., August 2001, 39, 8, 118-127.

[41] J. Su and B. Girod. Power-spectrum condition for energy-efficient watermarking. In IEEE ICIP�99 Kobe, Japan, October 1999.

[42] S. Voloshynovskiy, A. Herrigel, N. B. and T. Pun, �A stochastic approach to content adaptive digital image watermarking,� In International Workshop on Information Hiding, Vol. LNCS 1768 of Lecture Notes in Computer Science, pp. 212-236, Springer Verlag, Dresden, Germany, 29 September -1 October 1999.

[43] Digimarc patent, WO 96/36163, Steganography systems, 1996. [44] Fleet, Heerger, Embedding invisible information in color images, ICIP97, 1997. [45] S. Pereira, T. Pun, Fast robust template matching for affine resistant image

watermarking, In International Workshop on Information Hiding, 1999. [46] A. Piva, M. Barni, F. Bartolini, "Copyright protection of digital images by means of

frequency domain watermarking," Proceedings of SPIE 3456, Mathematics of Data/Image Coding, Compression, and Encryption, M. S. Schmalz Ed., San Diego, CA, USA, July 19-24, 1998, pp. 25-35.

[47] M. Kutter, Watermarking resisting to translation, rotation and scaling, Proc. of SPIE: Multimedia systems and applications, 1998.

[48] S. Voloshynovskiy, F. Deguillaume, S. Pereira, A, Herrigel, T. Pun, Method for adaptive digital watermarking robust against geometric transforms, European Patent Application PCT/IB00/01089, filed August 3, 2000.

[49] F. A. P. Petitcolas, R. J. Anderson, M. G. Kuhn. Attacks on copyright marking systems, in David Aucsmith (Ed), Information Hiding, Second International

http://www.cl.cam.ac.uk/~fapp2/papers/ih98-attacks/

http://www.cl.cam.ac.uk/~fapp2/papers/ih98-attacks/


CMK_D52 28/01/02, 33 / 35

Workshop, IH'98, Portland, Oregon, U.S.A., April 15-17, 1998, Proceedings, LNCS 1525, Springer-Verlag, ISBN 3-540-65386-4, pp. 219-239.

[50] J.-L. Dugelay and F.A.P. Petitcolas, �Image watermarking: possible counterattacks against random geometric distortions�, Proceedings of SPIE: Security and Watermarking of Multimedia Content II, vol. 3971, pp. 24-26, San Jose, CA, USA, January 2000.

[51] P. Bas, J.M. Chassery and B. Macq, �Robust watermarking based on the warping of predefined regular triangular patterns�, Proceedings of SPIE: Security and Watermarking of Multimedia Content II, San Jose, CA, USA, January 2000.

[52] F. Hartung, J.K. Su, and B. Girod, �Spread Spectrum Watermarking: Malicious Attacks and Counter-Attacks,� Proc. of SPIE Vol. 3657: Security and Watermarking of Multimedia Contents, San Jose, CA, USA, Jan. 1999.

[53] Institute EURECOM Newsletter, no 14, Dec. 1999, http://www.eurecom.fr/. [54] J.-L. Dugelay and C. Rey, Method of marking a multimedia document having

improved robustness, patent EP 99480075.3, July 1999. [55] C. Lin, M. Wu, J. A. Bloom, I.J. Cox, M.L. Miller, Y.M. Lui, �Rotation, Scale, and

Translation Resilient Public Watermarking for Images�, Proceedings of SPIE: Security and Watermarking of Multimedia Contents II, vol. 3971, pp. 90-98, San Jose, CA, USA, January 2000.

[56] S. Voloshynovskiy, F. Deguillaume, T. Pun, Multibit digital watermarking robust against local non-linear geometrical transformations, ICIP 2001, Int. Conf. Image Processing, Thessaloniki, Greece, October 07-10, 2001.

[57] S. Voloshynovskiy, F. Deguillaume, T. Pun, Method for Digital watermarking robust against local and global geometrical ditortions and projective transforms, US patent application, October, 2001.

[58] S. Baudry; P. Nguyen, H. Maitre, Some theoretical bounds on the capacity of watermarking channels with geometrical distortions, ICIP 2001, Int. Conf. Image Processing, pp. 995-995, Thessaloniki, Greece, October 07-10, 2001.

[59] J. Haitsma and T. Kalker, A watermarking scheme for digital cinema, In Proc. IEEE ICIP2001, Thessaloniki, Greece, pp. 487-489.

[60] J.P. Linnartz, G. Depovere, T. Kalker, �On the design of a watermarking system: consideration and rationals�, 3rd Workshop on Information Hiding, Dresden, Germany, Sept. 29-Oct. 1, 1999, to appear in Lecture notes in Computer Science.

[61] F. Deguillaume, S. Voloshynovskiy, T. Pun, A method for the estimation and recovering of general affine transforms in digital watermarking applications, Proceedings of SPIE: Security and Watermarking of Multimedia Content, January 2002 (submitted).

[62] J. Fridrich and M. Goljan, Robust hash functions for digital watermarking, ITCC 2000, Las Vegas, USA, 2000.

[63] J. Fridrich, Visual hash for oblivious watermarking, Proc. SPIE Photonic West Electronic Imaging 2000, Security and Watermarking of Multimedia Contents, pages 286--294, San Jose, CA, USA, 2000.

[64] J.C. Oostveen, A.A.C. Kalker, J.A. Haitsma, "Visual hashing of Digital Video: applications and techniques". SPIE, applications of Digital Image Processing XXIV, july 31 - august 3, San Diego, USA.

[65] Martin Kutter, Stefan Winkler: "A vision-based masking model for spread-spectrum image watermarking." to appear in IEEE Trans. Image Processing.

http://link.springer.de/link/service/series/0558/tocs/t1525.htm

http://www.eurecom.fr/


CMK_D52 28/01/02, 34 / 35

[66] Stefan Winkler, Animesh Sharma, David McNally: "Perceptual video quality and blockiness metrics for multimedia streaming applications" in Proc. 4th International Symposium on Wireless Personal Multimedia Communications, pp. 553-556, Aalborg, Denmark, September 9-12, 2001 (invited paper).

[67] Stefan Winkler: "Visual fidelity and perceived quality: towards comprehensive metrics." in Proc. SPIE Human Vision and Electronic Imaging Conference, vol. 4299, San Jose, California, January 21-26, 2001.

[68] Stefan Winkler: Vision Models and Quality Metrics for Image Processing Applications. Ph.D. Thesis #2313, Swiss Federal Institute of Technology, Lausanne, Switzerland, 2000.

[69] Pierre Vandergheynst, Martin Kutter, Stefan Winkler: "Wavelet-based contrast computation and application to digital image watermarking." in Proc. SPIE Wavelet Applications in Signal and Image Processing, vol. 4119, pp. 82-92, San Diego, California, July 30-August 4, 2000 (invited paper).

[70] Stefan Winkler, Pierre Vandergheynst: "Computing isotropic local contrast from oriented pyramid decompositions." in Proc. 6th International Conference on Image Processing, vol. 4, pp. 420-424, Kobe, Japan, October 25-28, 1999.

[71] Stefan Winkler: "Visual quality assessment using a contrast gain control model." in Proc. Workshop on Multimedia Signal Processing, pp. 527-532, Copenhagen, Denmark, September 13-15, 1999.

[72] S.J.P. Westen, R.L. Lagendijk, and J. Biemond. "Visibility thresholds of quantization noise in compressed digital image sequences." Proceedings of the fifteenth Symposium on Information Theory in the BENELUX , pages 274-281, Louvain-La-Neuve, Belgium, 1994.

[73] S.J.P. Westen, R.L. Lagendijk, and J. Biemond. "Visual image quality model." In Proceedings of the first annual Conference of the Advanced School for Computing and Imaging , pages 333-342, Heijen, The Netherlands, 1995.

[74] S.J.P. Westen, R.L. Lagendijk, and J. Biemond. . "Perceptual optimization of image coding algorithms." In Proceedings of the ICIP-95, pages 69-72, Arlington, Virginia, USA, 1995.

[75] S.J.P. Westen, R.L. Lagendijk, and J. Biemond. "Perceptual image quality based on a multiple channel HVS model." In Proceedings of ICASSP'95 , pages 2351-2354, Detroit, USA, 1995.

[76] S.J.P. Westen, R.L. Lagendijk, and J. Biemond. "Optimization of JPEG color image coding using a human visual system model." In Proceedings of the SPIE Conference on Human Vision and Electronic Imaging, volume 2657, pages 370-381, San Jose, USA, 1996.

[77] S.J.P. Westen, R.L. Lagendijk, and J. Biemond. "Adaptive spatial noise shaping for dct based image compression." In Proceedings of ICASSP'96, pages 2126-2129, Atlanta, Georgia, 1996.

[78] S.J.P. Westen and R.L. Lagendijk J. Biemond. "The TCQF algorithm: an encoder based noise shaping technique for image coding." In Proceedings of the 17th Symposium on Information Theory in the BENELUX , pages 17-23, Enschede, The Netherlands, 1996.

[79] S.J.P. Westen, R.L. Lagendijk, and J. Biemond. "Spatio-Temporal Model of Human Vision for Digital Video Compression". Proceedings of the SPIE Conference on Human Vision and Electronic Imaging , San Jose, USA, 1997.

http://wpmc01.org/

http://wpmc01.org/

http://www.spie.org/

http://spie.org/web/meetings/calls/pw01/confs/EI10.html

http://www.epfl.ch/

http://www.epfl.ch/

http://ltswww.epfl.ch/~vandergh/

http://www.spie.org/

http://www.spie.org/web/meetings/calls/am00/confs/AM210.html

http://ltswww.epfl.ch/~vandergh/

http://www-it.et.tudelft.nl/~inald/pubs/westen/bnl94.ps


http://www-it.et.tudelft.nl/~inald/pubs/westen/asci95.ps

http://www-it.et.tudelft.nl/~inald/pubs/westen/icip95.ps


http://www-it.et.tudelft.nl/~inald/pubs/westen/icassp95.ps


http://www-it.et.tudelft.nl/~inald/pubs/westen/spie96.ps









CMK_D52 28/01/02, 35 / 35

[80] S.J.P. Westen, R.L. Lagendijk, and J. Biemond. "An Eye Movement Compensated Spatio- Temporal Model for Predicting Distortion Visibility in Digital Image Sequences". In Proceedings of the 18th Symposium on Information Theory in the BENELUX, pages 89-96, Veldhoven, The Netherlands, 1997.

[81] S.J.P. Westen, R.L. Lagendijk, and J. Biemond. "A Quality Measure for Compressed Image Sequences Based on an Eye-Movement Compensated Spatio-Temporal Model." Proceedings of ICIP-97, Santa Barbara, USA, 1997.

[82] Patrick Bas, Méthodes de tatouage d'images fondées sur le contenuPhD, Grenoble, France, October, 2000.

[83] M. Kutter, S. K. Bhattacharjee, and T. Ebrahimi, "Towards Second Generation Watermarking Schemes.", in Proceedings 6th International Conference on Image Processing (ICIP'99), volume 1, pp. 320-323, October 24-28, 1999, Kobe, Japan.

[84] S. Tsekeridou, V. Solachidis, N. Nikolaidis, A. Nikolaidis, A. Tefas, I. Pitas, ``Theoretic Investigation of the Use of Watermark Signals derived from Bernoulli Chaotic Sequences��, 12th Scandinavian Conference on Image Analysis 2001 (SCIA2001), Bergen, Norway, 11-14 June 2001

[85] S. Tsekeridou, V. Solachidis, N. Nikolaidis, A. Nikolaidis, A. Tefas, I. Pitas, ``Theoretic Performance Analysis of a Watermarking System based on Bernoulli Chaotic Sequences��, Communications and Multimedia Security Conf. (CMS 2001), Darmstadt, Germany, 21-22 May 2001

[86] A. Tefas, A. Nikolaidis, N. Nikolaidis, V. Solachidis, S. Tsekeridou and I. Pitas, �Statistical Analysis of Markov Chaotic Sequences for Watermarking applications�, 2001 IEEE International Symposium on Circuits and Systems (ISCAS 2001), May 6 - 9, 2001 Sydney, Australia.

[87] A. Tefas, A. Nikolaidis, N. Nikolaidis, V. Solachidis, S. Tsekeridou and I. Pitas, �Performance Analysis of Watermarking Schemes based on Skew Tent Chaotic Sequences�, NSIP'01, Baltimore, Maryland, USA, 3-6 June, 2001

[88] A. Tefas, A. Nikolaidis, N. Nikolaidis, V. Solachidis, S. Tsekeridou and I. Pitas, �Markov Chaotic Sequences for Correlation based Watermarking schemes�, International Conference on Nonlinear Dynamics (NLD'01), Thessaloniki, Greece, 27-30 August, 2001







Project Number: IST-1999-11422

Documents

Transcript of Project Number: IST-1999-11422