Corina NAFORNIŢĂ

DIGITAL WATERMARKING IN THE WAVELET DOMAIN

DWT

Cuvânt înainte

Lucrarea de faţă constituie rezultatul cercetărilor făcute în perioada oct. 2003 –

oct. 2004, care au fost finanţate de către CNCSIS (Consiliul Naţional al Cercetării Ştiinţifice din Învăţământul Superior) prin grantul TD/47, nr. 33385/29.06.04.

Această lucrare tratează problema extrem de actuală a diseminării ilegale a materialelor audio, video şi imagini pe Internet. O soluţie propusă ar fi înglobarea în semnalul multimedia a unui alt semnal numit marcaj (watermark) fără ca schimbările să fie sesizabile (watermarking). Ideea ar fi ca acest marcaj să conţină detalii despre deţinătorul drepturilor de autor. Este tratată exclusiv problema marcării transparente a imaginilor. Se pune accent pe tipurile de atacuri la care poate fi supusă o imagine marcată şi modul de construire a marcajului în funcţie de acestea.

Primul capitol tratează problema dualităţii marcării transparente, respectiv a steganografiei faţă de cea a compresiei. Daca primele două tehnici sunt folosite pentru a „ascunde” informaţie într-un semnal digital (fie că este vorba de comunicaţie punct-la-punct pentru steganografie, fie multipunct pentru watermarking), în mod evident compresia încearcă să identifice părţile nesemnificative (din punct de vedere vizual sau auditiv) şi să le elimine. Astfel, trebuie căutat un echilibru între cele două tipuri de tehnici: data hiding în general (în acest caz watermarking) şi compresie. De aceea cei mai mulţi cercetători folosesc nu domeniul spaţial pentru înglobarea marcajului, ci o transformată folosită şi în compresie. Standardul de facto de compresie pentru imagini este JPEG care foloseşte transformata cosinus discretă (DCT). Metoda de marcare transparentă propusă de Cox se bazează pe DCT şi foloseşte tehnici de tip spread spectrum. Dacă se are însă în vedere faptul că în viitor tendinţa este de impunere a standardului JPEG2000, se poate lua în considerare transformata wavelet discretă. În continuare, se introduc câţiva termeni generali folosiţi în literatură precum şi câteva principii. Se prezintă noţiunile de date originale, încărcătura marcajului (payload), marcaj vizibil/invizibil, cheia folosită în înglobarea marcajului, sistem public sau privat de marcare, marcaje fragile sau robuste etc. Se descriu partea de înglobare respectiv de detecţie a marcajului, folosind funcţii generale. Sunt enumerate proprietăţile sistemelor de marcare transparentă: imperceptibilitate, redundanţa marcajului respectiv, cheile asociate, care trebuie să asigure securitatea marcajului dacă se are în vedere principiul lui Kerckhoff din criptografie. Sunt descrise posibile aplicaţii ale marcării transparente, considerate mai importante: protejarea drepturilor de autor (copyright protection), protejarea la copiere (copy protection), fingerprinting (folosit în identificarea utilizatorilor), autentificare. Se pune problema construirii unui sistem de marcare robust, care să îndeplinească mai multe criterii: transparenţă perceptuală, robusteţe, securitate, probabilitate mică de fals pozitiv sau negativ etc.

În capitolul II s-a făcut o clasificare a tehnicilor de marcare transparentă precum şi a atacurilor posibile. Tehnicile de marcare transparentă din literatură au putut fi clasificate în funcţie de alegerea locaţiilor unde este înglobat marcajul (tehnici care folosesc ca locaţii părţile semnificative ale imaginii în funcţie de un sistem asemănător sistemului de percepţie uman, respectiv tehnici care aleg în mod aleator

locaţiile în funcţie de o cheie); domeniul de marcare (spaţial, sau în domeniul unei transformate), codarea marcajului (spread spectrum, în care marcajul este o secvenţă pseudo-aleatoare, respectiv, coduri corectoare de erori, în care marcajul se codează cu un anumit cod înainte de înglobare); formarea semnalului compus (modulare în amplitudine sau în fază a semnalului original cu marcajul în domeniul spaţial sau al unei transformate; respectiv bazat pe cuantizare, unde semnalul original nu mai acţionează ca şi interferenţă asupra marcajului ca şi în comunicaţiile cu spectru împrăştiat); extragerea marcajului (prin corelaţie, sau folosind transformata Fourier-Mellin, când marcajul devine invariant la atacuri RST – rotaţie, scalare, translaţie). În continuare s-au enumerat câteva tipuri de atacuri aşa cum au fost descrise în literatură: atacuri de eliminare a marcajului (inclusiv atacul de coliziune); atacuri geometrice; atacuri asemănătoare cu cele din criptografie (prin aflarea cheii); atacuri de protocol sau atacuri de inversiune (prin generarea unui fals original, astfel încât atacatorul poate pretinde că imaginea marcată este rezultatul marcării falsului original cu marcajul său); atacuri de tip benchmark.

În următorul capitol se face o descriere sumară a descompunerii wavelet, pentru semnale unidimensionale şi bidimensionale. Se propune o metodă proprie de marcare, care face uz de aceasta transformată şi de faptul că benzile de frecvenţă HH, HL şi LH (cunoscute şi sub numele de imagini de detalii) conţin texturile şi muchiile unei imagini. Se selectează numai o parte din coeficienţi cu ajutorul unei chei, şi anume coeficienţii care au o amplitudine peste un anumit prag, dependent de subbandă.

În capitolul IV, se prezintă rezultatele obţinute în urma simulărilor. Se face o comparaţie a performanţelor cu metoda propusă de Cox; în urma concluziilor se evidenţiază faptul că cele două au performanţe asemănătoare. Bibliografia conţine titluri din perioada 1997-2004, publicate majoritatea în IEEE.

Autoarea doreşte să mulţumească doamnei prof. Monica Borda, conducătoarea sa de doctorat, pentru îndrumarea competentă, permanentă şi atentă în elaborarea acestei lucrări, domnului prof. Alexandru Isar pentru faptul că i-a adus în atenţie acest domeniu extrem de interesant, precum şi colegilor pentru suportul moral şi climatul asigurat.

Autoarea mulţumeşte domnului prof. Sabin Ionel pentru sprijinul acordat în publicarea acestui material. Nu în ultimul rând, autoarea doreşte să mulţumească domnului prof. Ioan Naforniţă şi doamnnei prof. Miranda Naforniţă pentru atenţie şi răbdare.

Corina Naforniţă

1. Introduction In the last decade we have been witnesses to an explosion in the use and distribution of digital multimedia data. PCs with Internet connections have made the distribution, both legal and illegal, of data and applications much easier and faster. Although digital data has several advantages over its analog counterparts, service providers are reluctant to offer services online because they fear the unrestricted duplication and dissemination of copyrighted material. Since ancient times, there have been ways of establishing the identity of the owner of an object in case of dispute which range from simple inscribing the name of the owner on the object to embedding the owners seal in the object (like a tattoo on the head of slave) [CMB02]. In the modern era, literary works have been copyrighted, goods embedded with company logos, and ideas patented to ensure that the owner of a piece of work is always given his due. Books contain ISBN numbers to uniquely identify the work and establish ownership. In the digital world, though, more sophisticated means are required to ensure the same, since copying and reproducing works of others has become extremely easy and the reproduced work generally spreads at the speed of light across the globe. While encryption is a solution to protect the data transmitted from the seller to the buyer, watermarking has been proposed as a solution to ensure the copyright protection. Watermarking describes techniques which are used to convey information in a hidden manner [VP99, SK01]. This information is required to be robust against intentional removal by malicious parties. In contrast to cryptography where the existence but not the meaning of the information is known [DH76], watermarking aims to hide the existence of the information from any potential eavesdropper altogether. 1.1 Watermarking and steganography vs. data compression Both steganography and watermarking techniques are used to imperceptibly hide information by embedding it into the cover work. However, steganography normally relates to point-to-point covert communication between two parties. Therefore, a steganographic system isn’t typically robust against modification of the data, and may protect the embedded information against typical technical modifications that may occur during transmission and storage (format conversion, compression, etc). Watermarking, on the other hand, is usual a one-to-many communication and has added the notion that the hidden message should be robust against attempts of removing it [HK99]. In the case of copyright protection, obviously the copyright information should resist any modifications made by pirates intending to remove it.

8 Introduction – 1 There exists a duality between data compression and information hiding. While compression aims to identify perceptually insignificant parts of the work and remove it [ICN02], information hiding techniques try to insert information into them. From an information-theoretical point of view, information hiding is a game played between an information hider and an attacker [MS03, CL02]. The cost function in the game is the mutual information between the input and the output of the attack channel; the attacker tries to minimize this cost while the hider tries to maximize it. The upper bound of this mutual information is the data hiding capacity. In other words, the best attack approach is equivalent to the most efficient data compression possible subject to a distortion constraint and the optimal information hiding strategy corresponds to optimal channel coding in which the attacker determines the channel characteristics. Since compression is the operation most performed on images one has to take into account the effects of it when designing a watermarking system. The most common compression standard at this moment is JPEG based on the discrete cosine transform DCT. An alternative to this standard is JPEG2000, proposed in 2000, based on the wavelet transform. 1.2 Watermarking terminology and principles We present some of the terms used in the watermarking domain [CMB02, VP99, SK01]:

- The original data where the watermark is to be inserted is referred to as host or cover work.

- The hidden information is called payload. - Visible watermarks are visual patterns (images, logos) inserted or overlaid on

images/video. Visible watermarks are applied to photos publicly avaible on the web, to prevent commercial use of such images. One example of visible watermarking has been implemented by IBM for the Vatican library [BMM96].

- Most watermarking systems involve making the watermark imperceptible. - The key is required for embedding the watermark. If the same key is used for

retrieving the watermark, the system is private. If another key is used to retrieve it, the system is known as public.

- If the cover work is required at the detector, the system is informed. If the cover work is not required at the detector, the system is blind.

- Watermarking systems are robust or fragile. Robust watermarks are designed to resist any modifications and are designed for the copyright protection. Fragile watermarks are designed to fail whenever the cover work is modified and to give some measure of the tampering. Fragile watermarks are used in authentication.

1.2 – Terminology and principles 9 All watermarking systems consist of an embedding part and a recovery part (see Fig. 1.1 and 1.2). The input to the embedding scheme is the watermark, the cover work and a public or secret key. The cover work can be any multimedia data: audio data, video data or images. The watermark can be a number, text, or an image. The key may be used to enforce security (to prevent unauthorized removal of the watermark). The output is the watermarked work. The recovery part takes the (possibly distorted) watermarked work, the key and/or the original unwatermarked work and returns either the recovered watermark (decoding) or a confidence measure of how likely a specific watermark is present (detection).

Cover work X0 Watermarked

work Xw Watermark embedding ε

Watermark W 0100100010...

Key K Data embedding algorithm

Fig. 1.1: Watermark embedding. The watermark is embedded using a secret or public key, making invisible changes to the cover work.

If I is the watermark information (payload) set, denotes the set of still digital images, is the finite key space, and the set of possible watermark signals, and, the watermark W can be generated as follows [VP99, BN04]:

XK W

( )0 : I , , ,W I X K× × → =X K WG G (1.1) The embedding process is defined as a superposition of W onto the cover work 0X : ( )0 : , , ;wX X W lε × × → =X W R X ε (1.2) The parameter is associated to the embedding watermark energy or, equivalently, to the watermark visibility. In practice, instead of a single parameter , an embedding mask is required for achieving satisfactory embedding. is formed by taking under consideration the characteristics of the human visual/auditory system [CM97].

ll

L L

The detection algorithm is defined as follows:

10 Introduction – 1

{ }

( )

: 0,1

1 if exists in , ,

0 otherwise W X

X K W

× × →

⎧= ⎨⎩

X K WD

D (1.3)

Cover work X0 Detector response

The detection can be made using the original cover work X0 or not (non-blind or blind decoder). We proceed to watermark detection by generating formerly the watermark W using G, which is based exclusively on the key K, the payload I and possibly on the signals X or X0. Most watermarking systems share the following properties [CMB02, VP99, SK01]:

- Imperceptibility. The modifications caused by the watermarking systems should be unobtrusive (we do not consider here the case of visible watermarks). The use of some perceptual model becomes necessary when designing the system. As a consequence the watermark has much less power than the cover work.

- Redundancy. Since a watermark has much less power than its host, it is usually redundantly embedded into the cover work, in order to achieve the desired robustness.

- Keys. Watermarking systems use one or more keys to ensure security against unauthorized removal of the hidden information. This is in accordance to Kerckhoff’s principle in cryptography, where it is assumed that the adversary knows everything about the algorithm except one or more secret keys [HK99].

Although these principles apply to watermarking schemes for all kinds of data, like audio, images, video, and others, we will concentrate on the image watermaking systems from now on.

Watermark detection or decoding D Test data X

Confidence measure Watermark W c(W, W ) ˆ

Decoder response Key K

Recovered watermark W 01011011.......

ˆ

Fig. 1.2: Watermark recovery can be done with or without the cover work.

1.3 – Applications 11 1.3 Watermarking applications Depending on the specific application of a watermarking system, the actual requirements will vary. We review a few of these applications and discuss the design issues associated with them. Copyright protection is one of the major forces that drive the research in this field. Digital data can be easily reproduced without quality loss and transmitted over the Internet. The objective here is to embed copyright information into the data in order to prevent other parties from claiming the copyright on the data. Since the watermarks are used to resolve rightful ownership, this application requires a very high level of robustness. Typically these watermarks are used in conjuction with a buyer-seller protocol [MW01] in online distribution of digital data. Copy protection is a mechanism that prevents users from making unauthorized copies of the digital data. Fingerprinting uses watermarks in order to identify the legal recipient of the digital data. Usually the fingerprints are used in combination with copyright protection watermarks in a transaction. Therefore fingerprints must be designed collusion-secure. In authentication applications, the objective is to detect any tampering made on the cover work. This can be done using a fragile watermark. If the work is modified maliciously, the watermark will be destroyed. If the watermark can be retrieved at the recipient, the work is considered authentic; otherwise it should be discarded as a fake. A low level of compression is usually permitted but not content alteration. Therefore a fragile watermark will have some degree of robustness. There are several types of fragile watermarks: some allow us to detect if the image has been modified [KH99] and some allow us to calculate an approximate of the original image in the modified regions. 1.4 Watermarking design issues The success of a watermarking algorithm is evaluated based on a series of measures. Perceptual Transparency: In most applications, the watermark inserted should not affect the quality of the cover image or data and hence remain undetectable. A more quantitave measure of the imperceptibility is the peak signal-to-noise ratio (PSNR) metric that assesses the “noise” added to the image as a result of embedding the watermark. The PSNR is defined as follows:

12 Introduction – 1

( ){ }

( ) ( )( )( )

2

,10 2

,

max ,( , ) 10 log 1 , ,

m n

wm n

f m nPSNR f w

f m n f m nN

⎡ ⎤⎢ ⎥

= ⎢ ⎥⎢ ⎥−⎣ ⎦∑

(1.4)

where is the host signal, is the watermarked signal, is the watermark, is the particular pixel position, and is the number of pixels in or . PSNR is measured in dB units.

f wf w ( )nm,N f wf

Robustness: Robustness is a measure of the ability of the embedding algorithm to introduce the watermark in such a way that it is retained in the image despite several stages of image processing. The image may be filtered, rotated, translated, cropped, scaled etc. as part of image processing. A good watermarking algorithm embeds the watermark in the spatial or frequency regions of the image, which would be least affected by such processing. Good correlation is possible between the recovered watermark and the original watermark in spite of noise errors introduced in it by processing. A measure of robustness is the correlation coefficient:

( ) ( ) ( )( ) ( )

1

2 21 1

ˆˆ,

ˆ

w

w w

N

iN N

i i

w i w ic w w

w i w i=

= =

= ∑∑ ∑

(1.5)

where and ( )iw ( )w i are the original and recovered watermarks; is the length of the watermark. A robust watermarking system strives to maximize the correlation coefficient, in the presence of signal distortions, while a fragile watermarking system tries to minimize it.

wN

Security: Security of a watermarking technique can be judged the same way as with encryption techniques. Assuming that unauthorized parties know the algorithm used for the embedding, the security of the algorithm lies in the selection of key. Thus the algorithm is truly secure if knowing the exact algorithm to embed and extract data does not help an unauthorized party in actually recovering the data from the watermarked image. Probability of false positive or negative: In most watermarking applications, one has to detect the possible existence of a watermark. This is done by comparing a certain original watermark with a recovered watermark. It is possible that an incorrect watermark is detected or that the presence of a watermark is not properly detected. There are two types of possible errors at the detector [VP99]:

1.4 – Design issues 13

- type I error: the watermark is detected although it doesn’t exist in the data (false positives)

- type II error: the watermark is not detected although it exists (false negatives)

The above errors occur with the specified probabilities of false positive ( fpP ) and false

negative ( fnP ) respectively. Let 1 fpc P= − denote the certainty of a positive detection, then: (1.6) watermark existsthresc c≥ ⇒ The parameter is the certainty level for detection and is chosen by the provider who applies the detection. Hypothesis testing can be used for statistical certainty

thresc

estimation and error manipulation [AP91]. Generally, when false positives become insignificant ( ) the probability to reject a watermark increases ( ) and viceversa. The situation is illustrated in Fig. 1.3 where t-test statistic is considered.

0fpP → 1fnP →

Fig. 1.3: Watermark detection through t-test statistic. Alternative and null hypotheses represent the probabilities for watermark existence and not existence respectively. Errors of type I and II are non-zero for any value of t, derived from the t-test.

0 Type II error (Pfn)

t0 Type I error (Pfp)

t

Null hypothesis H0

Alternative hH1

ypothesis

t-test

2. Watermarking techniques and attacks

2.1 Watermarking techniques Although data hiding and watermarking specifically is a vast research domain, the majority of the publications in this field currently address the copyright of still images. There are of course some exceptions for audio watermarking and for fragile watermarking, but we will not make a topic on it. Most of the existing watermarking algorithms can be classified according to the following criteria:

- The selection of locations where the mark is embedded, using human visual models, or using a randomly generated key,

- The watermarking domain: spatial domain or frequency domain (e.g. DCT, DWT, DFT etc),

- Encoding of payload: using error correction codes (ECC), spread spectrum (SS), time/space, frequency or code division multiplexing,

- Formation of the composite signal: additive or quantization based, - Watermark decoder.

2.1.1 Choice of embedding locations in the host

Since human eyes are less sensitive to noise in regions with textures than in smooth areas, Cox et al. [CKLS97] argue that one should embed watermarks in perceptually significant parts of an image, which survive to compression. Numerous approaches have been proposed which choose embedding locations based on this principle. On the other hand, considering a public watermarking algorithm, removal of the watermark should be prevented solely by the secrecy of the key. This is a direct implication of the Kerckhoffs’ principle. For instance, a secret key may initialize a pseudorandom number generator to select the locations of the watermark [BGM95]. Some algorithms have proposed public recovery of the watermark [HG94] where only a part of the secret key S is known at the decoder (Spub).

2.1.2 Watermarking domain a) Spatial domain Many spatial techniques are based on adding fixed amplitude pseudo noise (PN) sequences to an image. In this case, ε and D are simply addition and subtraction operators. LSB-based techniques These approaches modify the least significant bit (LSB) of the host data. The invisibility of the watermark is achieved on the assumption that the LSB data are visually insignificant. These techniques may involve converting the watermark into a

16 Techniques and attacks – 2 PN sequence which is then embedded into the image or repeated embedding of the watermark when the watermark is much smaller than the host image. Detection can be done visually or using correlation methods. Some of the earliest techniques [STO94], [SO93], [WD96], embed m-sequences into the least significant bit of the data to provide an effective transparent embedding technique. M-sequences are chosen for their good correlation properties, so that a correlation operation can be used for watermark detection. Such a scheme was proposed in [STO94] and extended to two dimensions in [SO93]. Another LSB-based technique, described as the patchwork method [BGM95], divides the image into two subsets A and B where the brightness of one subset is incremented by a small amount and the brightness of the other set is decremented by the same amount. Assuming certain properties for image data, the watermark is easily located by averaging the difference between the values in the two subsets. It is assumed that, on average, without the watermark, this value will be close to zero. If the pixels in set A are incremented by one and the pixels in set B are decremented by one as well, we expect that the sum of differences between the sets is equal to 2n, where n is the number of pixels in each set. Correlation based approaches The most straightforward way to add a watermark to an image in the spatial domain is to add a pseudorandom noise pattern to the luminance values of its pixels. Many methods are based on this principle [BGM95], [STO94], [HG96], [IP96], [WD96]. In general, the pseudorandom noise pattern consists of the integers {−1, 0, 1}; however, also floating-point numbers can also be used. The pattern is generated based on a key using seeds. The only constraints are that the energy in the pattern is more or less uniformly distributed and that the pattern is not correlated with the host image content. To create the watermarked image IW(x, y) the pseudorandom pattern W(x, y) is multiplied by a small gain factor k and added to the host image I(x, y): ( ) ( ) ( ), , ,W .I x y I x y k W x y= + ⋅ (2.1) For detection, the watermarked image is correlated with the watermark image. The correlation value will be very high for a pseudorandom pattern generated with the correct key and would be very low otherwise. b) Transform Domain Transform domain watermarking is useful for taking advantage of perceptual criteria in the embedding process and for designing watermarking techniques robust to common compression techniques. DCT based approaches: The Discrete Cosine Transform is a real domain transform which represents the entire image as coefficients of different frequencies of cosines (which are the basis vectors for this transform). The DCT of the image is calculated by

2.1 – Techniques 17 taking blocks of the image, which are then transformed individually. The 2D DCT of an image gives the result matrix such that top left corner represents lowest frequency coefficient while the bottom right corner is the highest frequency. DCT also forms the basis of the JPEG image compression algorithm, which is one of the most widely used image data storage formats. The DCT approaches are able to withstand some forms of attack very well such as Low-pass/High-pass/median filtering etc.

88×

One of the most influential watermarking works is a spread spectrum approach proposed in [CKLS97]. They argue that the watermark be placed explicitly in the perceptually most significant components of the data, and that the watermark be composed of random numbers drawn from a Gaussian ( )N 0 ,1 distribution, in order to make it invisible and robust to attacks: ( ) ( ) ( )( )1v i v i w iβ′ = + (2.2)

where v(i) is the DCT coefficient to be watermarked, w(i) is the watermark bit, β is the embedding strength and v’(i) is the watermarked coefficient. Detection is made using the similarity between the original W and extracted Ŵ watermarks:

( ) ˆˆsim ,ˆ ˆ

W WW WW W

⋅=

⋅ (2.3)

A simple block-based DCT approach is to exchange the mid – band coefficients of blocks with identical quantization levels as per the standard JPEG color quantization table so that one coefficient B(u1,v1) is greater than the other coefficient B(u2,v2), if the bit is ‘1’ and lesser if the bit is ‘0’. Another possibility is to slightly alter a midrange frequency triplet of coefficients [KZ95]. Odd – even quantization is a simple technique that embeds a “0” or “1” using even or odd quantization operators respectively [SZT97]. Differential Energy Watermarking involves altering the energy levels of two DCT block groups A and B, in such a way that EA < EB if the bit is ‘1’. Before the alteration to the energy levels is made, the DCT blocks are randomly shuffled and then these pairs of A-B blocks are randomly selected in the image which adds to the security of the data [LL01]. Wavelet based approaches: These techniques involve the embedding of information in the LH and HH blocks of the wavelet transform of the image. Changes to these regions are not noticed by observers due to characteristics of the Human Visual System [HW00, KH98, KH03, NI03, NBK04, KM99, KKK02, CM98, CN04]. For instance it appears that the human eye is less sensitive to noise in high resolution DWT bands and in the DWT bands having an orientation of 450 (i.e. HH bands). Wavelet techniques are also utilized for fragile watermarking which is a significant tool for content authentication [PW03, KH99]. Xia et al. [XBA98] insert several watermarks in the DWT domain in each detail image, except the approximation subband, suggesting that the detection could be done

18 Techniques and attacks – 2 hierarchically, computing crosscorrelations of the watermark and the difference between the two images for each resolution level. Other authors [KM99, KKK02] embed the watermark into perceptually significant coefficients for each subband of the DWT using statistical properties of the human visual system (HVS) and of the original image. DFT based approaches: The Discrete Fourier Transform is useful in order to perform phase modulation between the watermark and the original signal [RDB97]. The phase is more important than the amplitude; hence it will be difficult for an attacker to remove the watermark. Also phase modulation often posseses superior noise immunity in comparison with amplitude modulation. Many watermarking techniques use DFT amplitude modulation because the watermark will be translation invariant [LWBC01, RP98]. The DFT is more often used in its derived forms such as the discrete cosine transform or the Fourier-Mellin transform. Fourier-Mellin transform based approaches: This is a relatively new approach that has arisen out of the need for watermarking techniques which are Rotation, Scale and Translation invariant (RST-invariant). This approach involves creating a Log Polar map of the DFT amplitudes of the image, where the embedding takes place. This method is said to be extremely RST invariant and uses a RST invariant watermark [LWBC01, RP98]. 2.1.3 Encoding of payload Spread spectrum is a popular analogy for watermarking. Since watermarks are required to have low power to achieve imperceptibility, watermarking can be seen as a communication process through a very noisy channel. Almost all watermarking schemes represent the payload in the form of a pseudo-random (PN) sequence. The random number seed used to generate the sequence becomes the key of the watermark. Because the decoder needs to know the key to decode the mark, these schemes are essentially private [CKLS97, RP98]. Increasing the payload of the watermark can be made using time/space division multiplexing (TDM/SDM), frequency division multiplexing (FDM) or code division multiplexing (CDM) [CMB02]. In the first two cases the image is divided in spatial or spectral components and every bit of the watermark is embedded into separate tiles of the image in space or in frequency. The third case is to use direct sequence code division multiple access (DS-CDMA) spread spectrum communications. A different stochastically independent pseudorandom pattern RPi is generated for each bit bj dependent on the bit value (e.g. +RPi if bj represents a 0 and −RPi if bj represents a 1). The summation of all l random patterns ±RPi forms the watermark. Error control codes are used to increase the robustness of a watermark. Basically the payload is encoded prior to embedding [MDC02, AWS01].

2.1 – Techniques 19

2.1.4 Formation of the composite signal The most common way of embedding the watermark signal is to use amplitude [LWBC01, RP98] or phase modulation [RDB97] of the cover work and of the watermark (phase modulation only in the frequency domain). The watermark energy can be increased if some perceptual masking is used in embedding. For instance the HVS is less sensitive to changes in regions of high luminance, edges and textures of the image. In additive techniques, the simplest way to increase the watermark energy without quality degradation is to use a gain factor locally adapted [KM99, KKK02]. Another type of embedding is quantization based [CW01a, b], where the cover samples are quantized to represent the embedded data. The decoder quantizes the received samples and looks at which bin each sample falls into. That is the cover signal no longer acts as interference like in spread spectrum techniques.

2.1.5 Watermark extraction Most spread spectrum based techniques use correlation for detecting the watermark. This implicitly assumes that the underlying interference is Gaussian. However, images do not follow the Gaussian distribution and many authors suggest prefiltering the image prior to detection to improve performance, since most of the energy resides in the low frequencies of the image. Highpass filtering makes the signal more Gaussian like. Subtracting the original from the watermarked image in the non-blind schemes is also a form of prefiltering. In spread spectrum approaches, it is assumed that there is a perfect synchronization between the transmitter and the receiver. If the image is cropped, scaled or geometrically transformed, this synchronization is lost. Recent papers propose RST invariant watermarks based on the Fourier-Mellin transform [RP98]. 2.2 Attacks According to the way they were produced, the attacks performed on watermarked images can be classified in two major categories [BN04]: - Unintentional attacks due to signal processing in transmission or storage: filtering,

compression, A/D and D/A conversion etc, - Intentional attacks made by attackers in order to eliminate the watermark or to

insert a false watermark. Another possible classification of attacks is [CMB02, BN04, CMYY98, and PAK98]: Removal based attacks: This kind of attacks aims to estimate the watermark and remove it from the image. It is assumed that the attacker has some knowledge on the watermarking system. In this category fall compression, denoising, and also collusion

20 Techniques and attacks – 2 attack, that doesn’t actually remove the mark, but reduces its power by averaging different watermarks of the same image. Geometric attacks desynchronize the PN sequence. Examples of such attacks are affine transformation (rotation, scaling and translation), cropping, geometric distortions, and jitter. The jitter attack consists of removing samples at random places and duplicating them elsewhere. This attack is effective in audio watermarking. Cryptographic-like attacks are based on searching the watermark by brute force. This works for badly designed systems, where the number/length of keys is small. Protocol attacks or inversion attacks have been introduced by Craver et al. [CMYY98]. The idea of inversion attacks is that an attacker who receives watermarked data can claim that the data contains also the attacker’s watermark. He can easily generate an according fake original by substracting that claimed watermark. In his fabricated “original”, the real watermark can be found. However, also in the real original the fake watermark can be found. Thus, a watermark deadlock situation is produced. Craver et al. also propose remedies and methods to ensure non-invertibility, making the watermark signal-dependent by using a one-way function. The Stirmark benchmark was proposed as an evaluation tool for watermarking systems by Petitcolas et al. [PAK98]. The attacks are mainly geometric attacks (distortions, cropping, scaling), noise addition and common signal processing operations like compression and filtering. Pereira et al. propose another benchmark – Checkmark – that includes removal based attacks and separates the attacks for different types of watermarking systems [PVM01].

3. Watermarking in the wavelet domain

3.1 Wavelets Many applications use the wavelet decomposition taken as a whole. Some of these applications are compression and denoising. In fact, one of the most popular successes of the wavelets is the compression of FBI fingerprints [SM99]. Wavelet analysis allows the use of long time intervals where we want more precise low-frequency information, and shorter regions where we want high-frequency information. The DWT consists in splitting the signal x[n] in low and high frequencies using a lowpass and a highpass filter respectively: ( ) [ ] ( ) [ ]andjn jn

n nH h n e G g n eω ωω ω− −= =∑ ∑ (3.1)

where H(ω) and G(ω) should be orthogonal:

( ) ( )2 21H Gω ω+ = . (3.2)

The signals obtained are down sampled by two, in order to reduce their size. This process can be continued for each signal obtained from the lowpass filter for a number of arbitrary times (see Fig. 3.1). The coefficients obtained are:

[ ] [ ] [ ]

[ ] [ ] [ ]

[ ] [ ]

1

1

0

2

2

j jn

jn

a p h n p a n

d p g n p a n

a p x p

+

+

= −

= −

=

j

∑

∑ (3.3)

where j = 0,…,L is the resolution level (0 - high resolution, L - the lowest resolution). The coefficients aL[p] are the approximation of the original signal and dj[p] are the detail coefficients of x[n]. The reconstruction of the original signal x[n] is the inverse process of the DWT: [ ] [ ] [ ] [ ] [ ]1 12 2j j

n na p h p n a n g p n d n+ += − + −∑ ∑ .j (3.4)

The DWT for two dimensional signals, like images, is similar to the DWT for one dimensional signals. The difference is that one has to implement separately for each dimension the DWT and IDWT respectively. The image will be decomposed for each resolution level into a high-high (HH), high-low (HL), and low-high (LH) subband, and a low-low (LL) subband for the coarsest resolution level. The LL band is also known as as the approximation subimage because it contains most of the information

22 Watermarking in wavelet domain – 3

aj

Fig. 3.1: The DWT (a) and the IDWT (b) of the 1D signal x[n]

from the image. The HL, LH, HH sub bands are the detail sub images containing the horizontal, vertical and diagonal details (see Fig. 3.2 and 3.3).

Fig. 3.2: DWT pyramid decomposition of an image for two resolution levels.

HL1

HH1 LH1

HL2

HH2 LH2

LL2

aj+2

dj+2

aj

G

H

↑ 2

↑ 2aj+1

dj+1 ↑ 2

↑ 2

G

H

(b)

G*

aj+1 aj+2 H*

dj+2 ↓ 2

↓ 2

G*

H*

↓ 2 dj+1

↓ 2

(a)

3.2 – Proposed method 23

DWT

Fig. 3.3: Example of a multiresolution decomposition for images. One can clearly observe that the HL, LH and HH subbands contain horizontal, vertical and respectively diagonal details.

3.2 Proposed method A watermarking scheme proposed by the author in [NBK04, CN04] is presented. As emphasized in the previous section, the details of the image such as edges and textures are well confined into the HH, LH, and HL subbands of the DWT of the image. The human visual system (HVS) is not sensitive to small changes in high frequencies of the image, but is rather sensitive to changes affecting the smooth parts of the image, that is, the coarsest resolution level of the image. Hence, the watermark is repeatedly embedded into perceptually significant coefficients (PSCs) of the detail subbands (HH, LH, and HL). Multiple embedding of the watermark makes the scheme more robust [MR00], while selection of coefficients makes it invisible to the human eye. To achieve invisibility the LL subband is unmodified. An average of the extracted watermarks is computed at the detector. Two types of detection are presented. 3.2.1 Insertion procedure

Let X be the original gray-level image and the watermark W a pseudo random sequence, with binary values: w(i) ∈ {-1, 1} and length Nw. The watermark is repeatedly embedded of M>>1 times in the transform image. Since the watermark is embedded multiple times in every detail subband, this can be viewed as a form of transmitting the watermark in different subchannels. It has been shown by Kundur et al. in [KH03] that diversity techniques can give very good results in detecting the watermark, considering the fact that many watermark attacks are more appropriately modeled as fading like. Each repetition is denoted by Wr, with r = 1,2,...,M. The basic steps for embedding the mark are: (a) Wavelet decomposition of the original image by L levels to obtain a multiresolution decomposition:

( ) { }1 1, , , , ,...,x x x x x xL L L L LY DWT X LL HL LH HH HL HH−= =

24 Watermarking in wavelet domain – 3 (b) Compute the threshold for each subband Let the approximation coefficients be a(m, n) and the detail coefficients from the resolution level l and subband s be ds,l(m, n), where s ∈ {HL, LH, HH} and l ∈ {1,…,L}. The threshold is computed using equation (3.5): ( ){ }, ,,

max ,s l l s lm nT q d m n= (3.5)

(c) Embed the repetition watermark Wr = W For each subband, if the detail coefficient is higher or equal to the above computed threshold, embed the watermark using the equation (3.6) ( ) ( ) ( ), ,, , 1 w

s l s l rd m n d m n w iα⎡ ⎤= +⎣ ⎦ , (3.6)

where α is a parameter that controls the level of the watermark. (d) Repeat previous step M times, until every selected coefficient has been watermarked. (e) Compute the IDWT from these new coefficients. We obtain the watermarked image Xw.

3.2.2 Extraction procedure The extraction process requires the original image, or at least some significant vector extracted from the DWT of the cover work, specifically, the detail coefficients with a value above the computed threshold. The estimate of each repetition of the watermark from the watermarked and

possibly distorted work,

ˆrW

wX is extracted using the wavelet coefficients , that should contain a watermark bit:

( ),ˆ ,s ld m n

( ) ( ) ( )( )

, ,

,

ˆ , ,ˆ sgn

,s l s l

rs l

d m n d m nw i

d m n

⎛ ⎞−= ⎜⎜

⎝ ⎠⎟⎟ (3.7)

A random guess is made for the watermark bit in the location (m, n) if ( ) ( ), ,

ˆ , ,s l s ld m n d m n= or if ( ) 0,, =nmd ls . The original watermark is estimated from its repetitions using the majority rule: the most common bit value is assigned for the recovered watermark bit:

3.2 – Proposed method 25 ( ) ( )( )ˆ sgn rr

w i w i= ˆ∑ (3.8) This is done from all levels (detector type I) or from level 3 since the lowest frequencies are not so affected by compression (detector type II). The correlation coefficient compares the original and the extracted watermarks:

( ) ( ) ( )( ) ( )1

2 21 1

ˆˆ,

ˆ

w

w w

N

iN N

i i

w i w ic w w

w i w i=

= =

=⋅

∑∑ ∑

(3.9)

where ( ) [ ]1,1ˆ, −∈wwc . If the correlation coefficient is above a specified threshold, the watermark is positively detected in the image. In [CN04] it is considered that if the watermark length is large enough, setting the threshold at 0.5 will not result in large probability of false negative. The embedding and extraction are presented in Fig. 3.4 and 3.5. Fig. 3.6 illustrates the two types of detection.

Fig 3.4: Embedding procedure for the proposed method.

Fig 3.5: Extraction type I or II.

DWT Selecting PSCs, for s and l

Original image W

Distorted image

DWT Detection of Ŵr, r ← r+1, r < M

Compute Ŵ from (I) all levels (II) level 3

Ŵ estimate of the original watermark

IDWT DWT Selecting PSCs,

Embed Wr, Water-marked image

Original image r ← r+1,

with r < M for s and l

Wr=W

26 Watermarking in wavelet domain – 3

Fig 3.6: Detectors type I and II, denoted here NC1 and NC2, used in the presented method [CN04].

4. Simulation results 4.1 Watermark embedding In order to prove the validity of the proposed method, four 256 x 256 images were watermarked using the proposed method (for details, see Chapter 3, section 3.2). The images Lenna, Boat, Barbara and Peppers are presented in Fig. 4.1.

(a) (b)

(c) (d)

Fig. 4.1: Original images used for simulations: Lenna (a), Boat (b), Barbara (c) and Peppers (d). The watermark was a binary pseudo-random sequence with Nw = 256. The Daubechies 10pt wavelet was used to produce the wavelet coefficients. Also, the following parameters were used: number of resolution levels L = 3, the strength of the watermark

28 Simulation results – 4 α = 0.1 and the level-dependent variables q1 = 0.06, q2 = 0.04, q3 = 0.02. The performances of the given method [CN04] are compared with the results of the method proposed by Cox in [CKLS97] (see Chapter 2, section 2.1.2). The watermark used was bipolar and its length was for a better comparison, 256 bits. Also, the number of repetitions of the mark was the same in both cases (i.e. 33 repetitions for Peppers). The visual difference between the watermarked and original images for the two methods is evaluated in two ways: using the peak signal-to-noise ratio (PSNR) and with the aid of human observers. The watermarked images using the proposed method were not significantly distorted from the originals, whereas for the method presented by Cox et al. the difference was clearly visible, even upsetting. Table 1 contains the values of PSNR for each image.

Table 1: PSNR [dB] values as a measure of the noise introduced by the watermark

PSNR Image

Lenna Boat Barbara Peppers

Proposed method 45.39 dB 44.35 dB 44.18 dB 45.55 dB

Cox’s method 27.19 dB 25.35 dB 26.44 dB 25.75 dB

Also, for the proposed method, the difference between the watermarked and the original image is presented in Fig. 4.2. From the difference images, it is clear that the watermark was embedded in edges and textures. For instance, for the Lenna image, the watermark affects the details such as the feathers of the hat. 4.2 Detection results In the previous section, it has been demonstrated on four different images that the watermarking process has clearly not affected their visual quality. Further, the robustness of the proposed scheme is analyzed. The extraction is made in two ways as mentioned previously in Chapter 3: from all levels, using a majority rule (detector type I denoted here NC1), and from the coarsest level only (detector type II denoted NC2). The effect of common signal distortions (median filtering, AWGN, JPEG compression) is investigated on the correlation coefficient between the original and the recovered mark. The performances for [CN04] are compared with the results of the method proposed by Cox in [CKLS97]. For each image, the detector response is presented as a function of the filter size M, compression ratio, CR and signal-to-noise ratio, SNR in case of median filtering, JPEG compression and additive white Gaussian noise attacks, respectively (Fig 4.3 - 4.14). The detector response was computed as a mean value of 32 responses for 32 uncorrelated watermarks. The plots marked with ‘o’ and ‘+’ symbols are the results from the method in [CN04], with the detector I and II (or NC1 and NC2) respectively, while the unmarked plots are from the method proposed in [CKLS97].

4.2 – Detection results 29

(a) (b)

(c) (d)

Fig. 4.2: Difference images between watermarked image and original image, for Lenna (a), Boat (b), Barbara (c), and Peppers (d), respectively, for the presented method [CN04].

Setting the threshold value in the detection process at 0.5 we have the followings. Median filtering attack: For Lenna, Barbara and Peppers watermarked images, the attack by median filtering with filter size larger than M=3 leads to a correlation smaller than 0.5. In fact, only the detector NC2 allows filtering with filter size M=3. For Boat watermarked image, not even the NC2 detector is successfully used in finding the mark.

30 Simulation results – 4 JPEG compression: For Lenna, the correlation is smaller than 0.5 at a compression rate of 16 (detector NC2 and Cox) and 10 (NC1), respectively. For Boat and Barbara, the correlation is smaller than 0.5 at a compression rate of 13 for NC2, 10 for Cox and 7 for NC1. For Peppers, the compression rate values for which the correlation is smaller than 0.5 is 15 (NC2, Cox) and 8 (NC1). AWGN attack: For Lenna and Peppers, the detector response in the Cox et al. method is above 0.5 at a signal-to-noise ratio of 5 dB, having a considerably better performance than the detectors NC1 (12 dB) and NC2 (15 dB). For Boat and Barbara, the detector values are approximately the same for each method: 3 dB (Cox), around 14 dB (NC2) and 7 dB (NC1). 4.3 Remarks A robust wavelet-based watermarking method is presented [CN04] that embeds the mark in coefficients selected in such a manner that the visible impact on a human observer isn’t very high. By embedding the watermark bits into the edges and textures of the image the properties of the human visual system are used. Both methods are image-dependant. Apparently, the Cox method is superior for AWGN attack, comparable with the NC2 detector in the case of JPEG compression, and inferior for median filtering. However, taking into account the visibility of the mark, an essential aspect of a watermarking system, it is possible that the method from [CN04], with the two proposed detectors (NC1 and NC2) to be considered comparable or better than the Cox method in the given situation. As a conclusion, the wavelet domain can be a good choice for embedding the watermark. Data hiding capacity is significantly increased by embedding into the wavelet domain.

4.3 – Remarks 31

Fig. 4.3: Detector response to median filtering against watermarked Lenna. The plots marked with the ‘o’ and ‘+’ symbols are the results from the proposed method [CN04], with the detector NC1 and NC2 respectively, while the remaining plots are from the Cox’s method.

Fig. 4.4: Detector response to median filtering against watermarked Boat. The plots marked with the ‘o’ and ‘+’ symbols are the results from the proposed method [CN04], with the detector NC1 and NC2 respectively, while the remaining plots are from the Cox’s method.

32 Simulation results – 4

Fig. 4.5: Detector response to median filtering against watermarked Barbara. The plots marked with the ‘o’ and ‘+’ symbols are the results from the proposed method [CN04], with the detector NC1 and NC2 respectively, while the remaining plots are from the Cox’s method.

Fig. 4.6: Detector response to median filtering against watermarked Peppers. The plots marked with the ‘o’ and ‘+’ symbols are the results from the proposed method [CN04], with the detector NC1 and NC2 respectively, while the remaining plots are from the Cox’s method.

4.3 – Remarks 33

Fig. 4.7: Detector response to JPEG compression against watermarked Lenna. The plots marked with the ‘o’ and ‘+’ symbols are the results from the proposed method [CN04], with the detector NC1 and NC2 respectively, while the remaining plots are from the Cox’s method.

Fig. 4.8: Detector response to JPEG compression against watermarked Boat. The plots marked with the ‘o’ and ‘+’ symbols are the results from the proposed method [CN04], with the detector NC1 and NC2 respectively, while the remaining plots are from the Cox’s method.

34 Simulation results – 4

Fig. 4.9: Detector response to JPEG compression against watermarked Barbara. The plots marked with the ‘o’ and ‘+’ symbols are the results from the proposed method [CN04], with the detector NC1 and NC2 respectively, while the remaining plots are from the Cox’s method.

Fig. 4.10: Detector response to JPEG compression against watermarked Peppers. The plots marked with the ‘o’ and ‘+’ symbols are the results from the proposed method [CN04], with the detector NC1 and NC2 respectively, while the remaining plots are from the Cox’s method.

4.3 – Remarks 35

Fig. 4.11: Detector response to AWGN against watermarked Lenna. The plots marked with the ‘o’ and ‘+’ symbols are the results from the proposed method [CN04], with the detector NC1 and NC2 respectively, while the remaining plots are from the Cox’s method.

Fig. 4.12: Detector response to AWGN against watermarked Boat. The plots marked with the ‘o’ and ‘+’ symbols are the results from the proposed method [CN04], with the detector NC1 and NC2 respectively, while the remaining plots are from the Cox’s method.

36 Simulation results – 4

Fig. 4.13: Detector response to AWGN against watermarked Barbara. The plots marked with the ‘o’ and ‘+’ symbols are the results from the proposed method [CN04], with the detector NC1 and NC2 respectively, while the remaining plots are from the Cox’s method.

Fig. 4.14: Detector response to AWGN against watermarked Peppers. The plots marked with the ‘o’ and ‘+’ symbols are the results from the proposed method [CN04], with the detector NC1 and NC2 respectively, while the remaining plots are from the Cox’s method.

REFERENCES

[AP91] A. Papoulis, Probability & Statistics, Prentice Hall, 1991. [AWS01] A. Ambroze, G. Wade, C. Serdean, M. Tomlinson, Y. Stander, M.

Borda, “Turbo code protection of video watermark channel”, IEE Proceedings Vision Image, Signal Processing, Vol. 148, No. 1, Feb. 2001, pp. 54-58.

[BGM95] W. Bender, D. Gruhl, and N. Morimoto, “Techniques for data hiding,” in Proc. SPIE, Storage and Retrieval for Image and Video Databases III, vol. 2420, San Jose, CA, Feb. 9-10, 1995, pp. 165-173.

[BMM96] G.W. Braudaway, K.A. Magerlein, F. Mintzer, “Protecting publicly available images with a visible watermark,” Proc. SPIE – Int. Soc.Opt. Eng., vol. 2659, pp.126 – 133, 1996.

[BN04] M. Borda, I. Nafornita, “Digital Watermarking – Principles and Applications”, Proc. Of Int. Conf. Communications 2004, Bucharest, pp.41-54.

[CKLS97] I. Cox, J. Killian, T. Leighton, T. Shamoon, “Secure Spread Spectrum Watermarking for Multimedia,” IEEE Trans. On Image Processing, 6, 12, pp.1673-1687, 1997.

[CL02] A. Cohen, A. Lapidoth, “The Gaussian Watermarking Game,” IEEE Trans. On Information Theory, 48, 6, 2002.

[CM97] I. Cox, M. Miller, “A Review of Watermarking and the Importance of Perceptual Modeling,” Proc. SPIE Human Vision and Elect. Imaging II, vol. SPIE, vol. 3016, Feb. 1997.

[CM98] J.J. Chae, B.S. Manjunath, “A Robust Embedded Data from Wavelet Coefficients,” Proceedings of the SPIE EI’98, vol. 3312, pp.308-317, San Jose, Feb. 1998.

[CMB02] I. Cox, M. Miller, J. Bloom, Digital Watermarking, Morgan Kaufmann Publishers, 2002.

[CMYY98] S. Craver, N. Memon, B. Yeo, M. Yeung, “Resolving Rightful Ownerships with Invisible Watermarking Techniques: Limitations, Attacks, and Implications,” IEEE Journal On Selected Areas In Communications, Vol. 16, No. 4, May 1998.

[CN04] Corina Nafornita, “A Wavelet-Based Watermarking for Still Images,” Scientific Bulletin of Politehnica University of Timisoara, tom 49(63) Electronics and Telecommunications, fascicola 2, 2004, Symposium of Electronics and Telecommunications Etc 2004, 22 - 23 October 2004, Timisoara, pp. 126-131.

[CW01a] B. Chen, G.W. Wornell, “Quantization Index Modulation Methods for Digital Watermarking and Information Embedding of Multimedia,” Journal of VLSI Signal Processing 27, 7-33, 2001.

[CW01b] B. Chen, G. W. Wornell, “Quantization Index Modulation: A Class of Provably Good Methods for Digital Watermarking and Information

38 References

Embedding,” IEEE Trans. On Inf. Theory, 47, 4, May 2001 [DH76] W. Diffie, M. Hellman, “New Directions in Cryptography,” IEEE

Trans. On Information Theory, 22, 6, November 1976. [HG94] F. Hartung, B. Girod, “Fast public-key watermarking of compressed

video,” Int. Conf. on Image Processing ICIP’97, Oct. 1997, Santa Barbara, California.

[HG96] F. Hartung, B. Girod, “Digital watermarking of raw and compressed video,” in Proc. SPIE 2952: Digital Compression Technologies and Systems for Video Communication, Oct. 1996, pp. 205-213.

[HK99] F. Hartung, M. Kutter, “Multimedia Watermarking Techniques,” Proc. IEEE, 87, 7, 1999, pp. 1079-1106.

[HW00] C. Hsu, J. Wu, “Image Watermarking by Wavelet Decomposition,” Academy of Information and Management Sciences Journal, 3, 1, pp. 70-86, 2000.

[ICN02] Alexandru Isar, Andrei Cubitchi, Miranda Nafornita, Algorithmes et techniques de compression, ed. Orizonturi Universitare, 2002, 181, 973-8391-38-5.

[IP96] I. Pitas, “A method for signature casting on digital images,” in Proc. ICIP-96, IEEE Int. Conf. Image Processing, vol. III, Lausanne, Switzerland, Sept. 15-17, 1996, pp. 215-218.

[KH03] D. Kundur, D. Hatzinakos, “Diversity and Attack Characterization for Improved Robust Watermarking,” IEEE Transactions on Signal Processing, Vol. 49, No. 10, pp. 2383-2396.

[KH98] D. Kundur, D. Hatzinakos, “Digital Watermarking using Multiresolution Wavelet Decomposition,” Proc. IEEE Int. Conf. On Acoustics, Speech and Signal Processing, Seattle, Washington, Vol. 5, pp. 2969-2972, May 1998.

[KH99] D. Kundur, D. Hatzinakos, “Digital Watermarking for Telltale Tamper Proofing and Authentication,” Proc. IEEE, 87, 7, July 1999.

[KKK02] B. S. Kim, K. K. Kwon, S. G. Kwon, K. N. Park, K. N. Park, K. I. Song, K. I. Lee, “A robust wavelet-based digi-tal watermarking using statistical characteristic of image and human visual system,” Proc. of ITC-CSCC 2002, vol 2. pp. 1019-1022.

[KM99] J.R. Kim and Y.S. Moon, “A Robust Wavelet-Based Digital Watermarking Using Level-Adaptive Thresholding,” Proc. of IEEE ICIP, Vol. 2, Kobe, Japan, Oct. 1999, pp. 226-230.

[KZ95] E. Koch, J. Zhao, “Towards Robust and Hidden Image Copyright Labeling,” in Proc. of 1995 IEEE Workshop on Nonlinear Signal and Image Processing (Neos Marmaras, Greece, June 20-22, 1995).

References 39 [LL01] G.C. Langelaar, R.L. Lagendijk, “Optimal Differential Energy

Watermarking of DCT Encoded Images and Video”, IEEE Trans. On Image Processing, 10, 1, Jan. 2001.

[LWBC01] C. Y. Lin, M. Wu, J. A. Bloom, I. J. Cox, M. L. Miller, Y. M. Lui, “Rotation, Scale, and Translation Resilient Watermarking for Images,” IEEE Trans. On Image Processing, 10, 5, May 2001.

[MDC02] M.L. Miller, G.J. Doerr, I.J. Cox, “Dirty-Paper Trellis Codes for Watermarking,” IEEE Int. Conf. on Image Processing, 2, pp. 129-132, 2002.

[MR00] A T. Murgan, R. Radescu, Principiile teoriei codurilor. Algoritmi si aplicatii, Ed. Tehnica, Bucuresti, 2000.

[MS03] P. Moulin, J. O’Sullivan, “Information-Theoretic Analysis of Information Hiding,” IEEE Trans. On Information Theory, 49, 3, March 2003.

[MW01] N. Memon, P. W. Wong, “A Buyer-Seller Watermarking Protocol,” IEEE Trans. On Image Processing, 10, 4, April 2001.

[NBK04] C. Nafornita, M. Borda, A. Kane, “A Wavelet-Based Digital Watermarking using Subband Adaptive Thresholding for Still Images,” microCAD 2004, Miskolc, Hungary, 18 – 19 March 2004, pp. 87 - 92.

[NI03] C. Nafornita, A. Isar, “Digital Watermarking of Still Images using the Discrete Wavelet Transform,” Scientific Bulletin of Politehnica University of Timisoara, Electronics and Telecommunications Trans., Tom 48(62), Fascicola 1, 2003, pp. 73-78.

[PAK98] F. Petitcolas, R. Anderson, M. Kuhn, “Attacks on Copyright Marking Systems”, 2nd workshop on Information Hiding, 1525, Lecture Notes in Computer Science, Portland, Oregon, April 1998, pp. 218-238.

[PVM01] Shelby Pereira, Sviatoslav Voloshynovskiy, Maribel Madueño, Stéphane Marchand-Maillet and Thierry Pun, “Second generation benchmarking and application oriented evaluation,” In Information Hiding Workshop, Pittsburgh, PA, USA, April 2001.

[PW03] A.H. Paquet, R.K. Ward, “Wavelet-Based Digital Watermarking for Image Autenthication,” IEEE Canadian Conference on Acoustics, Speech and Signal Processing (ICASSP) 2002.

[RDB97] J.J.K Ruanaidh, W.J. Dowling, F.M. Boland, “Phase watermarking of digital images,” Proc. IEEE Int. Conf. Image Processing, Santa Barbara, Oct. 1997, pp. 239-242.

[RP98] J.J.K. Ó Ruanaidh, T. Pun, “Rotation, Scale and Translation invariant Spread Spectrum digital image watermarking”, Signal Processing, 66(1998), pp. 303-317.

40 References [SK01] A. Sequeira, D. Kundur, “Communications and Information

Theory in Watermarking: A Survey,” Multimedia Systems and Applications IV, A. G. Tescher, B. Vasudev, and V. M. Bove, eds., Proc. SPIE (vol. 4518), pp. 216-227, Denver, Colorado, August 2001.

[SM99] S. Mallat, A Wavelet Tour of Signal Processing, Academic Press, 1999.

[SO93] R.G. van Schyndel, C. Osborne, “A two-dimensional watermark,” in Proc. DICTA, 93, pp. 378-383.

[STO94] R.G. van Schyndel, A.Z. Tirkel, C.F. Osborne, “A digital watermark,” in Proc. IEEE Int. Conf. Image Processing, vol. 2, Austin, TX, Nov.1994, pp. 86-90.

[SZT97] M. Swanson, B. Zhu, and A. Tewfik, “Data hiding for video in video,” Proceedings of ICIP97, vol. 2, 1997.

[VP99] G.Voyatzis, I. Pitas, “Problems and Challenges in Multimedia Networking and Content Protection,” TICSP Series No. 3, Editor Iaakko Astola, March 1999.

[WD96] R.B. Wolfgang and E.J. Delp, “A watermark for digital images,” in Proc. IEEE Int. Conf. Image Processing, vol. III, Sept. 16-19, 1996, Lausanne, Switzerland, pp. 219-222.

[WD96] R.B. Wolfgang and E.J. Delp, “A watermark for digital images,” in Proc. IEEE Int. Conf. Image Processing, vol. III, Sept. 16-19, 1996, Lausanne, Switzerland, pp. 219-222.

[XBA98] X. Xia, C. G. Boncelet, and G. R. Arce, “Wavelet transform based watermark for digital images,” Optics Express, Vol. 3, No. 12, 1998, pp. 497-505.

Table of Contents Watermarking in the wavelet domain 1. Introduction.................................................................................................... 7

1.1 Watermarking and steganography vs. data compression........................... 7 1.2 Watermarking terminology and principles ................................................ 8 1.3 Watermarking applications ...................................................................... 11 1.4 Watermarking design issues .................................................................... 11

2. Watermarking techniques and attacks ...................................................... 15 2.1 Watermarking techniques ........................................................................ 15 2.2 Attacks ..................................................................................................... 19

3. Watermarking in the wavelet domain........................................................ 21 3.1 Wavelets................................................................................................... 21 3.2 Proposed method...................................................................................... 23

4. Simulation results......................................................................................... 27 4.1 Watermark embedding............................................................................. 27 4.2 Detection results....................................................................................... 28 4.3 Remarks ................................................................................................... 30

References ......................................................................................................... 37 Table of Contents ............................................................................................. 41