Affine Transformation Resistant Watermarking ... - Krest Technology
Affine Transformation Resistant Watermarking Based on Image Normalization Ping Dong, and Nikolas P. Galatsanos Department of Electrical Engineering, Illinois Institute of Technology Chicago, IL 60616 [email protected], [email protected] ABSTRACT Geometric attacks are among the most challenging problems in present day watermarking. Such attacks are very simple to implement yet they can defeat most of the existing watermarking algorithms without causing serious perceptual image distortion. In this paper we propose a new public watermarking algorithm, which is robust to such attacks. This algorithm uses a normalized with respect to affine transformation representation of the image based on the image moments. Then, a CDMA scheme is used to embed a multi-bit watermark in the discrete cosine transform domain of the normalized image. Numerical experiments are shown where the properties of the proposed algorithm are tested. These numerical experiments show that the proposed algorithm is very robust to wide range of geometric attacks. 1. INTRODUCTION Although lot of progress has been made in watermarking research and application recently, geometric resistant watermarking remains to be one of the most difficult outstanding areas. A small distortion, such as rotation, scaling, translation, shearing, random bending or change of aspect ratio [1], can defeat most of the existing watermarking schemes claimed robust. Such distortion can destroy the synchronization, which is required by the above mentioned watermarking techniques. This problem is even more pronounced when multi-bit public watermarking is needed in practical application, which means the original unwatermarked image is unavailable for watermark extractor and the application need to embed multi-bit information, such as copyright ownership or license numbers. To our knowledge, J' Ruanaidh and T. Pun [2] are the first to suggest a Fourier-Mellin transform based watermarking scheme to handle geometric attacks, such as rotation, scaling and translation (RST). The algorithm seems workable theoretically, but proved to be difficult in implementation. C. Y. Lin and M. Wu, etc [3] proposed an improvement to the implementation difficulty [2] by embedding the watermark into an 1-dimensional signal
obtained by projecting the Fourier-Mellin transformed image onto log-radius axis. Such algorithm can embed only one bit information, i.e. presence or absence of the watermark, and the implementation is still a headache and far from practical application. Pereira and Pun [4] proposed an approach to embed a template into the DFT domain besides the intended watermark. Parameters of affine geometric attacks are estimated through the detection of template. Then affine distortions are recovered using the estimated parameters and detection of watermark is performed from the recovered image. To such an algorithm, a correct positive detection requires that both the payload-carrying marks and the synchronization pattern be successfully embedded and detected. A second problem arises when many images watermarked with this method share a common template. This can ease the collusion detection of the template and pose security threats to the template itself [5]. Moment based image normalization has been used in computer vision for pattern recognition for a long time [6]. Its use in watermarking was first reported in [7]. The scheme handles flipping, scaling and rotation attacks, and it is only used to embed 1-bit information. In this paper, we present a blind normalization algorithm (BNA) [8] based multi-bit public watermarking scheme to handle general affine geometric attacks. Fig.1 illustrates the normalization based watermarking system. The main differences between our scheme and the one used in [7] is that, first, general affine distortion is addressed instead of specific geometric attack, and second, a CDMA based multi-bit watermarking system is proposed while [7] handle 1-bit watermarking. 2. WATERMARKING ALGORITHM In this section, we will first define in 2.1 what we mean by affine geometric attack. Then CDMA watermarking is briefly introduced in 2.2. In 2.3 the BNA algorithm is
detailed. Section 2.4 watermarking algorithm. Watermark Embedder
presents Watermark Message
the
BNA
based
Key
pseudo-random binary sequence of {-1,1} with zero mean, generated using the key as the seed. The size of pi,j(k) is the same as cover image. Then the CDMA watermark will be M
Original Image
Image Normalization
Watermark Embedding
w = P • m' = ∑ pi , j (k )b' k
Restore to original size and orientation
Possible attacks
Watermark Extractor
(2.4)
k =1
The CDMA watermark can be embedded into a cover image additively by ~
Watermark Message
Watermark Detection
v i , j = vi , j + λ * w
Image Normalization
(2.5)
Where
vi , j : Pixel value of cover image at location (i, j)
Key
~
Fig.1 Image normalization based watermarking system
v i , j : Corresponding pixel values of the watermarked
2.1 Affine transform Assume f(x,y) is an image signal, an affine geometric distorted image fd(x,y) is defined by parameters {A,d} as
the image at (i, j) λ : Coefficient used as watermark strength
Where
fd(x,y) = f(xd,yd)
x a X = d = 11 y d a 21
a12 x + a 22 y
(2.1) d1 (2.2) d = Ax + d 2
A simple detection can be performed using correlation detector. The correlation is calculated as
i, j
M
Based on singular value decomposition (SVD), the matrix A can be decomposed as:
a11 a12 cos(φ ) sin(φ ) λ1 a a = − sin(φ ) cos(φ ) 0 21 22
0 cos(τ ) − sin(τ ) λ2 sin(τ ) cos(τ ) (2.3) T
Where λ1 and λ2 are eigenvalues of AA , φ and τ are angles related to the eigenvectors of AAT. If A is nonsingular matrix, λ1 and λ2 will have positive values. From (2.2) and (2.3), it can be concluded that any affine transform can be decomposed as combination of translation, rotations, scaling or aspect ratio change. 2.2 CDMA Watermark Suppose the watermark message is a binary sequence denoted by m = {bi | bi ∈ {0,1}} i=1, 2, …, M, where M is the length of the watermark sequence. Usually we use
m' = {bi' | bi' = 1 − 2bi , i = 1L M } , So m' is a binary polar sequence of {-1,1}. The pseudo-random noise
pattern is defined as P = { pi , j (k ) | k = 1, K M } , where pi,j(k) is 2-D
i, j
= ∑ ∑ p i , j (l ) ⋅ p i , j ( k ) ⋅ bk' = k =1 i , j
By recentering the signal with respect to the center of mass, we can remove the translation factor d easily.
M
~
C l = ∑ p i , j (l ) ⋅ v i , j = ∑ p i , j (l ) ⋅ v i , j + ∑ p i , j (l ) ∑ p i , j ( k )bk' k =1
i, j
∑| p
i, j
( k ) | 2 bl'
i, j
(2.6) In the above deduction, because pi,j(l) is a zero mean pseudo-random binary sequence of {-1,1}, and it is is independent with vi,j , term p (l ) ⋅ v
∑
i, j
i, j
i, j
supposedly close to zero. Other terms are all zeros when k ≠ l because pseudo-random patterns pi,j(k) are uncorrelated with each other. So watermark message can be decoded by
bl' ≈ sign(C l )
(2.7)
2.3 Blind Normalization Algorithm (BNA) BNA was first introduced in [8] as a pre-step to achieve affine invariant wavelet transform. What BNA does is to try to find a normalized signal f0 from the set D(f) of all affine distorted versions of the signal f. The BNA consists of two components. The first is a Rotate and Scale (RnS) step that rotates the signal by a fixed angle θ followed by scale normalization. The second component is the computation of the orientation indicator index (OII) defined below. The algorithm iterates repeatedly the RnS and OII steps. After a finite number of iterations, the signal corresponding to the maximum value of the OII is chosen as f0 . 2.3.1 Rotate and Scale (RnS)
In this step, the signal is rotated by a angle θ and is scaled to the normalized the size by {1/α, 1/β}, where α and β are the dimensions of the region of support for the signal f(x, y), and are defined as
α = max{x : f (x, y) ≠ 0} − min{x : f (x, y) ≠ 0} x
x
(2.8)
And
β = max{y : f (x, y) ≠ 0} − min{y : f (x, y) ≠ 0} y
y
0 cos(θ ) sin(θ ) x (2.10) 1 cos(θ ) y β − sin(θ )
2.3.2 Orientation Indicator Index (OII) OII of f(x,y) is defined as OII
f
=
µ x2 + µ
2 y
(2.11)
Where µ
=
x
∫
(x − g
∫
( y − g
x
)
3
=
y
y
)
3
f ( x , y ) dxdy
R
(gx, gy) is the center of the mass for f(x, y), and defined as g
x
=
∫
xf ( x , y ) dxdy
∫
yf ( x , y ) dxdy
R
g
y
=
3. 4.
Recentering: Recenter fd(x,y) with respect to the center of mass (gx,gy) defined by 2.12. Scale normalization: Compute {α, β} from equation 2.7, 2.8, and scale the pixel coordinates (x,y) to (x/α,y/β). Calculate OII for each rotated position Iteration: Repeat steps 3 and 4 for rotation interval θ = [0, π/2]. Normalization: Selects the signal corresponding to the maximum value of the OII, and stores it as f0(x,y)
2.4 BNA Based Watermarking Scheme Watermarking embedding procedures: 1. Find the normalized image using BNA algorithm described in section 2.3 2. Watermark the normalized image. In current paper, CDMA watermark, see section 2.2, is added to the mid-frequency DCT coefficients of the normalized image. A private key is used to generate the watermark 3. Restore the watermarked image to the original orientation and size. In step 3, we know exactly the transforms used to normalize the image. So we can restore the watermarked image to the original orientation and size.
f ( x , y ) dxdy
R
µ
2.
5. (2.9)
If f(x, y) is the input to the RnS step, the outcome f(xd, yd) is obtained by a coordinate transform,
x d α1 y = 0 d
1.
(2.12)
R
OII has two important properties: 1. For non-rotationally-symmetric images, the OII is periodic with period π/2. So each image has at least 4 normalized orientations. We can eliminate this ambiguity by choosing the orientation closest to that of original image. 2. The OII has a strong alternating energy. This property enables us to detect the orientation accurately. For image in Fig.2, its OII is displayed in Fig 3. 2.3.3 BNA Algorithm We use a slightly different version of the BNA from [8]. Because of the periodic property of OII, a full rotation interval of θ = [0, 2π] is time consuming and not necessary. Other orientations with max OII can be find by adding multiple π/2. The BNA algorithm used in this paper is summarized as following.
Decoding procedures: 1. Find the normalized image using BNA algorithm 2. Decode the watermark using the private key 3. EXPERIMENTAL RESULTS A series of experiments have been performed to test the proposed algorithm. We embedded a watermark of 64 bits into the original image shown in Fig.1. The watermarked image is displayed in Fig. 4, and has a PSNR of 29 dB. Because translation attack can be removed easily by recentering, we focus our experiments on scaling, rotation, aspect ratio and general affine transform attacks. Bicubic method is used in all the interpolations. 1. Scaling attacks The watermarked image is scaled down up to 99% of the original size. The bit error rate (BER) vs. scaling factor plot is shown in Fig. 5. Experiments show the watermark can survive scaling down up to 40% without decoding error. 2. Rotation attacks Experiments were performed on the watermarked image with rotations of 5, 15, 25, 45, 75 respectively. In all 5 test cases, the 64-bit watermark was decoded correctly. 3. Aspect-ratio change attacks In this experiment, we fixed the height while changing the width of the image. The BER vs. the
aspect ratio change is plotted in Fig. 6. We successfully decoded the watermark with scaling down in width of the image up to 90%. 4. Combined attack Fig.7 shows the watermarked image undergone a general affine transform given by 0 .1 , 1 .3 A = − 0 . 05
0 . 8
which was used in [4] to justify the robustness to affine geometric attack. For this attack we were able to detect the 64-bit watermark without any bit errors.
Fig.2 Original image
Fig 4. Watermarked image. PSNR=29 dB
Fig 3. Orientation Indicator Index of Fig
Fig. 7 Watermarked image undergone an affine transformation
5. CONCLUSION In this paper, we presented a new watermarking scheme robust to affine transformation. Through experiments, the algorithm shows strong robustness to rotation, scaling, and aspect ratio attack. The algorithm also shows robustness to general affine geometric to some degree. Dramatic affine transform is out of the research scope of current paper. 6. REFERENCES [1] F.A.P. Petitcolas, R.J. Anderson, and M.G. Kuhn, "Attacks on copyright marking systems," in Workshop on Information Hiding, Portland, OR, 15-17 April, 1998
[2] J. O'Ruanaidh and T. Pun, "Rotation, scale and translation invariant spread spectrum digital image watermarking, " Signal Processing, vol. 66, no. 3, pp. 303-317, 1998 [3] C. Y. Lin, M. Wu, etc, "Rotation, Scale, and Translation Resilient Public watermarking for images," in IEEE trans. on image processing, vol. 10, no.5, May 2001 [4] S. Pereira and T. Pun, "Robust template matching for affine resistant image watermarks," in IEEE trans. on image processing, vol. 9, no. 6, June, 2000 [5] Ingemar J. Cox, Matthew L. Miller, Jeffrey A. Bloom, Digital Watermarking, Morgan Kaufmann publishers, 2001
[6] J.Wood, "Invariant Pattern Recognition: A Review," Pattern Recognition, vol. 29, no. 1, pp. 1-17,1996. [7] Masoud Alghoniemy and Ahmed H. Tewfik, "Geometric distortion correction through image normalization," Multimedia and Expo, 2000, ICME 2000 [8] Victor H. S. Ha and Jose M. F. Moura, "Affine invariant wavelet transform," Acoustics, Speech, and Signal processing, 2001,proceedings. May, 2001 [9] I.J. Cox, J.Kilian, F.T. Leighton, and T. Shamoon, "Secure spread spectrum watermarking for multimedia," IEEE Trans. on Image Processing, vol. 6, no. 12, 1997
Fig. 5 Bit Error rate vs. scaling factor
Fig. 6 Bit error rate vs. aspect-ratio change
obtained by projecting the Fourier-Mellin transformed image onto log-radius axis. Such algorithm can embed only one bit information, i.e. presence or absence of the watermark, and the implementation is still a headache and far from practical application. Pereira and Pun [4] proposed an approach to embed a template into the DFT domain besides the intended watermark. Parameters of affine geometric attacks are estimated through the detection of template. Then affine distortions are recovered using the estimated parameters and detection of watermark is performed from the recovered image. To such an algorithm, a correct positive detection requires that both the payload-carrying marks and the synchronization pattern be successfully embedded and detected. A second problem arises when many images watermarked with this method share a common template. This can ease the collusion detection of the template and pose security threats to the template itself [5]. Moment based image normalization has been used in computer vision for pattern recognition for a long time [6]. Its use in watermarking was first reported in [7]. The scheme handles flipping, scaling and rotation attacks, and it is only used to embed 1-bit information. In this paper, we present a blind normalization algorithm (BNA) [8] based multi-bit public watermarking scheme to handle general affine geometric attacks. Fig.1 illustrates the normalization based watermarking system. The main differences between our scheme and the one used in [7] is that, first, general affine distortion is addressed instead of specific geometric attack, and second, a CDMA based multi-bit watermarking system is proposed while [7] handle 1-bit watermarking. 2. WATERMARKING ALGORITHM In this section, we will first define in 2.1 what we mean by affine geometric attack. Then CDMA watermarking is briefly introduced in 2.2. In 2.3 the BNA algorithm is
detailed. Section 2.4 watermarking algorithm. Watermark Embedder
presents Watermark Message
the
BNA
based
Key
pseudo-random binary sequence of {-1,1} with zero mean, generated using the key as the seed. The size of pi,j(k) is the same as cover image. Then the CDMA watermark will be M
Original Image
Image Normalization
Watermark Embedding
w = P • m' = ∑ pi , j (k )b' k
Restore to original size and orientation
Possible attacks
Watermark Extractor
(2.4)
k =1
The CDMA watermark can be embedded into a cover image additively by ~
Watermark Message
Watermark Detection
v i , j = vi , j + λ * w
Image Normalization
(2.5)
Where
vi , j : Pixel value of cover image at location (i, j)
Key
~
Fig.1 Image normalization based watermarking system
v i , j : Corresponding pixel values of the watermarked
2.1 Affine transform Assume f(x,y) is an image signal, an affine geometric distorted image fd(x,y) is defined by parameters {A,d} as
the image at (i, j) λ : Coefficient used as watermark strength
Where
fd(x,y) = f(xd,yd)
x a X = d = 11 y d a 21
a12 x + a 22 y
(2.1) d1 (2.2) d = Ax + d 2
A simple detection can be performed using correlation detector. The correlation is calculated as
i, j
M
Based on singular value decomposition (SVD), the matrix A can be decomposed as:
a11 a12 cos(φ ) sin(φ ) λ1 a a = − sin(φ ) cos(φ ) 0 21 22
0 cos(τ ) − sin(τ ) λ2 sin(τ ) cos(τ ) (2.3) T
Where λ1 and λ2 are eigenvalues of AA , φ and τ are angles related to the eigenvectors of AAT. If A is nonsingular matrix, λ1 and λ2 will have positive values. From (2.2) and (2.3), it can be concluded that any affine transform can be decomposed as combination of translation, rotations, scaling or aspect ratio change. 2.2 CDMA Watermark Suppose the watermark message is a binary sequence denoted by m = {bi | bi ∈ {0,1}} i=1, 2, …, M, where M is the length of the watermark sequence. Usually we use
m' = {bi' | bi' = 1 − 2bi , i = 1L M } , So m' is a binary polar sequence of {-1,1}. The pseudo-random noise
pattern is defined as P = { pi , j (k ) | k = 1, K M } , where pi,j(k) is 2-D
i, j
= ∑ ∑ p i , j (l ) ⋅ p i , j ( k ) ⋅ bk' = k =1 i , j
By recentering the signal with respect to the center of mass, we can remove the translation factor d easily.
M
~
C l = ∑ p i , j (l ) ⋅ v i , j = ∑ p i , j (l ) ⋅ v i , j + ∑ p i , j (l ) ∑ p i , j ( k )bk' k =1
i, j
∑| p
i, j
( k ) | 2 bl'
i, j
(2.6) In the above deduction, because pi,j(l) is a zero mean pseudo-random binary sequence of {-1,1}, and it is is independent with vi,j , term p (l ) ⋅ v
∑
i, j
i, j
i, j
supposedly close to zero. Other terms are all zeros when k ≠ l because pseudo-random patterns pi,j(k) are uncorrelated with each other. So watermark message can be decoded by
bl' ≈ sign(C l )
(2.7)
2.3 Blind Normalization Algorithm (BNA) BNA was first introduced in [8] as a pre-step to achieve affine invariant wavelet transform. What BNA does is to try to find a normalized signal f0 from the set D(f) of all affine distorted versions of the signal f. The BNA consists of two components. The first is a Rotate and Scale (RnS) step that rotates the signal by a fixed angle θ followed by scale normalization. The second component is the computation of the orientation indicator index (OII) defined below. The algorithm iterates repeatedly the RnS and OII steps. After a finite number of iterations, the signal corresponding to the maximum value of the OII is chosen as f0 . 2.3.1 Rotate and Scale (RnS)
In this step, the signal is rotated by a angle θ and is scaled to the normalized the size by {1/α, 1/β}, where α and β are the dimensions of the region of support for the signal f(x, y), and are defined as
α = max{x : f (x, y) ≠ 0} − min{x : f (x, y) ≠ 0} x
x
(2.8)
And
β = max{y : f (x, y) ≠ 0} − min{y : f (x, y) ≠ 0} y
y
0 cos(θ ) sin(θ ) x (2.10) 1 cos(θ ) y β − sin(θ )
2.3.2 Orientation Indicator Index (OII) OII of f(x,y) is defined as OII
f
=
µ x2 + µ
2 y
(2.11)
Where µ
=
x
∫
(x − g
∫
( y − g
x
)
3
=
y
y
)
3
f ( x , y ) dxdy
R
(gx, gy) is the center of the mass for f(x, y), and defined as g
x
=
∫
xf ( x , y ) dxdy
∫
yf ( x , y ) dxdy
R
g
y
=
3. 4.
Recentering: Recenter fd(x,y) with respect to the center of mass (gx,gy) defined by 2.12. Scale normalization: Compute {α, β} from equation 2.7, 2.8, and scale the pixel coordinates (x,y) to (x/α,y/β). Calculate OII for each rotated position Iteration: Repeat steps 3 and 4 for rotation interval θ = [0, π/2]. Normalization: Selects the signal corresponding to the maximum value of the OII, and stores it as f0(x,y)
2.4 BNA Based Watermarking Scheme Watermarking embedding procedures: 1. Find the normalized image using BNA algorithm described in section 2.3 2. Watermark the normalized image. In current paper, CDMA watermark, see section 2.2, is added to the mid-frequency DCT coefficients of the normalized image. A private key is used to generate the watermark 3. Restore the watermarked image to the original orientation and size. In step 3, we know exactly the transforms used to normalize the image. So we can restore the watermarked image to the original orientation and size.
f ( x , y ) dxdy
R
µ
2.
5. (2.9)
If f(x, y) is the input to the RnS step, the outcome f(xd, yd) is obtained by a coordinate transform,
x d α1 y = 0 d
1.
(2.12)
R
OII has two important properties: 1. For non-rotationally-symmetric images, the OII is periodic with period π/2. So each image has at least 4 normalized orientations. We can eliminate this ambiguity by choosing the orientation closest to that of original image. 2. The OII has a strong alternating energy. This property enables us to detect the orientation accurately. For image in Fig.2, its OII is displayed in Fig 3. 2.3.3 BNA Algorithm We use a slightly different version of the BNA from [8]. Because of the periodic property of OII, a full rotation interval of θ = [0, 2π] is time consuming and not necessary. Other orientations with max OII can be find by adding multiple π/2. The BNA algorithm used in this paper is summarized as following.
Decoding procedures: 1. Find the normalized image using BNA algorithm 2. Decode the watermark using the private key 3. EXPERIMENTAL RESULTS A series of experiments have been performed to test the proposed algorithm. We embedded a watermark of 64 bits into the original image shown in Fig.1. The watermarked image is displayed in Fig. 4, and has a PSNR of 29 dB. Because translation attack can be removed easily by recentering, we focus our experiments on scaling, rotation, aspect ratio and general affine transform attacks. Bicubic method is used in all the interpolations. 1. Scaling attacks The watermarked image is scaled down up to 99% of the original size. The bit error rate (BER) vs. scaling factor plot is shown in Fig. 5. Experiments show the watermark can survive scaling down up to 40% without decoding error. 2. Rotation attacks Experiments were performed on the watermarked image with rotations of 5, 15, 25, 45, 75 respectively. In all 5 test cases, the 64-bit watermark was decoded correctly. 3. Aspect-ratio change attacks In this experiment, we fixed the height while changing the width of the image. The BER vs. the
aspect ratio change is plotted in Fig. 6. We successfully decoded the watermark with scaling down in width of the image up to 90%. 4. Combined attack Fig.7 shows the watermarked image undergone a general affine transform given by 0 .1 , 1 .3 A = − 0 . 05
0 . 8
which was used in [4] to justify the robustness to affine geometric attack. For this attack we were able to detect the 64-bit watermark without any bit errors.
Fig.2 Original image
Fig 4. Watermarked image. PSNR=29 dB
Fig 3. Orientation Indicator Index of Fig
Fig. 7 Watermarked image undergone an affine transformation
5. CONCLUSION In this paper, we presented a new watermarking scheme robust to affine transformation. Through experiments, the algorithm shows strong robustness to rotation, scaling, and aspect ratio attack. The algorithm also shows robustness to general affine geometric to some degree. Dramatic affine transform is out of the research scope of current paper. 6. REFERENCES [1] F.A.P. Petitcolas, R.J. Anderson, and M.G. Kuhn, "Attacks on copyright marking systems," in Workshop on Information Hiding, Portland, OR, 15-17 April, 1998
[2] J. O'Ruanaidh and T. Pun, "Rotation, scale and translation invariant spread spectrum digital image watermarking, " Signal Processing, vol. 66, no. 3, pp. 303-317, 1998 [3] C. Y. Lin, M. Wu, etc, "Rotation, Scale, and Translation Resilient Public watermarking for images," in IEEE trans. on image processing, vol. 10, no.5, May 2001 [4] S. Pereira and T. Pun, "Robust template matching for affine resistant image watermarks," in IEEE trans. on image processing, vol. 9, no. 6, June, 2000 [5] Ingemar J. Cox, Matthew L. Miller, Jeffrey A. Bloom, Digital Watermarking, Morgan Kaufmann publishers, 2001
[6] J.Wood, "Invariant Pattern Recognition: A Review," Pattern Recognition, vol. 29, no. 1, pp. 1-17,1996. [7] Masoud Alghoniemy and Ahmed H. Tewfik, "Geometric distortion correction through image normalization," Multimedia and Expo, 2000, ICME 2000 [8] Victor H. S. Ha and Jose M. F. Moura, "Affine invariant wavelet transform," Acoustics, Speech, and Signal processing, 2001,proceedings. May, 2001 [9] I.J. Cox, J.Kilian, F.T. Leighton, and T. Shamoon, "Secure spread spectrum watermarking for multimedia," IEEE Trans. on Image Processing, vol. 6, no. 12, 1997
Fig. 5 Bit Error rate vs. scaling factor
Fig. 6 Bit error rate vs. aspect-ratio change
