Digital Watermarking Frequently Asked Questions (FAQ)
Please help us: The FAQs below are preliminary and not complete. Anybody having an question/answer/correction is encouraged to
us his/her contribution. We will continaully work on the FAQs and update them. Thanks!
This document answers some of the frequently asked questions on watermarking.
To join this list, please refer to the subscription information on
http://www.watermarkingworld.org/ml.html.
If you like to contribute to this ``FAQ``, please email your
questions/answers to faq@watermarkingworld.org. The latest copy of
this FAQ can be found at http://www.watermarkingworld.org
Although different authors use different meanings for the word 'watermark',
it is mostly agreed that the watermark is one, which is imperceptibly
added to the cover-signal in order to convey the hidden data.
Watermarking (now-a-days) is mainly used for copy-protection and copyright-protection
(1.4). Historically, watermarking
has been used to send ``sensitive'' information hidden in another
signal (1.12) . Watermarking has its applications
in image/video copyright protection.
1.4 What is the difference between ``copy protection'' ``copyright
protection'' ?
Copy protection attempts to find ways, which limits the access
to copyrighted material and/or inhibit the copy process itself. Examples
of copy protection include encrypted digital TV broadcast, access
controls to copyrighted software through the use of license servers
and technical copy protection mechanisms on the media. A recent example
is the copy protection mechanism on DVDs. However, copy protection
is very difficult to achieve in open systems, as recent incidents
(like the DVD hack - DeCss) show.
Copyright protection inserts copyright information into the
digital object without the loss of quality. Whenever the copyright
of a digital object is in question, this information is extracted
to identify the rightful owner. It is also possible to encode the
identity of the original buyer along with the identity of the copyright
holder, which allows tracing of any unauthorized copies. The most
prominent way of embedding information in multimedia data is the use
of digital watermarking.
Whereas copy protection seems to be difficult to implement, copyright
protection protocols based on watermarking and strong cryptography
are likely to be feasible.
Consider the following scenario: Alice, the copyright holder, inserts
her own watermark into some object, locks the original away and keeps
selling the marked image. Bob can now try to insert his own watermark
into the already marked object. In case of a dispute, both Alice and
Bob are able to prove the presence of "their" watermark
and claim ownership of the document. How can this situation be resolved?
The "traditional" answer is: look at the objects,
Alice and Bob claim to be the original. Alice's original should not
contain a watermark, whereas Bob's "original" must
contain Alice's watermark (if we assume that Bob cannot remove marks).
This situation would indicate that Bob inserted his watermark after
Alice and so one may conclude that Alice is the rightful owner.
Unfortunately, sometimes the situation is not that simple. It has
been shown that, in particular class of watermarking schemes, Bob
can insert his watermark in a way that it also seems to be present
in the copy Alice locked away (although he has no access to it). So
Alice's original contains Bob's mark and Bob's "original"
contains Alice's mark. This type of attack is called "inversion
attack" or more "dead lock attack". There
is no way to resolve copyright ownership in this case. This result
indicates that watermarking "alone", that is without
a carefully designed protocol around it, will not suffice to resolve
the copyright situation.
One could define a new audio file format, in which the watermark is
a part of the header block but is not removable without destroying
the original signal, because part of the definition of the file format
requires the watermark to be therein. In this case the signal would
not really be literally 'destroyed' but any application using this
file format would not touch it without a valid watermark. Some electronic
copyright management system propose mechanisms like this. Such schemes
are weak as anyone with a computer or a digital editing workstation
would be able to convert the information to another format and remove
the watermark at the same time. Finally this new audio format would
be incompatible with the existing one. Thus the watermark should really
be embedded in the audio signal.
This is very similar to S.C.M.S (Serial Code Management System). When
Philips and Sony introduced the 'S/PDIF' (Sony/Phillips Digital Interchange
Format), they included the S.C.M.S. which provides a way to regulate
copies of digital music in the consumer market. This information is
added to the stream of data that contains the music when one makes
a digital copy (a 'clone'). This is in fact just a bit saying: digital
copy prohibited or permitted. Some professional equipment are exempt
for needing S.C.M.S.
With watermarking however, the copy control information is part of
the audio-visual signal and aim at surviving file format conversion
and other transformations.
While cryptography is about protecting the content of messages
(their meaning), steganography is about concealing their very existence.
It comes from Greek roots, literally means 'covered writing', and
is usually interpreted to mean hiding information in other information.
Examples include sending a message to a spy by marking certain letters
in a newspaper using invisible ink, and adding sub-perceptible echo
at certain places in an audio recording. It is often thought that
communications may be secured by encrypting the traffic, but this
has rarely been adequate in practice. Ãneas the Tactician, and other
classical writers, concentrated on methods for hiding messages rather
than for enciphering them; and although modern cryptographic techniques
started to develop during the Renaissance, we find in 1641 that John Wilkins
still preferred hiding over ciphering because it arouses less suspicion.
This preference persists in many operational contexts to this day.
For example, an encrypted email message between a known drug dealer
and somebody not yet under suspicion, or between an employee of a
defense contractor and the embassy of a hostile power, has obvious
implications.
As the purpose of steganography is having a covert communication
between two parties whose existence is unknown to a possible attacker,
a successful attack consists in detecting the existence of this communication
(e.g., using statistical analysis of images with and without hidden
information). Watermarking, as opposed to steganography, has
the (additional) requirement of robustness against possible attacks.
In this context, the term 'robustness' is still not very clear; it
mainly depends on the application. Copyright marks do not always need
to be hidden, as some systems use visible digital watermarks,
but most of the literature has focused on imperceptible (e.g., invisible,
inaudible) digital watermarks which have wider applications. Visible
digital watermarks are strongly linked to the original paper watermarks
which appeared at the end of the XIII century to differentiate paper
makers of that time. Modern visible watermarks may be visual patterns
(e.g., a company logo or copyright sign) overlaid on digital images.
The intent of use is also different: the payload of a watermark can
be perceived as an attribute of the cover-signal (e.g., copyright
information, license, ownership, etc.). In most cases the information
hidden using steganographic techniques is not related at all to the
cover. These differences in goal lead to very different hiding techniques.
There as been some confusion about the naming of various types of
watermarking techniques and the main reason is that people involved
in this field come from different backgrounds (in particular signal
processing and computer security). On top of this some terminology
has been imported from the related field of steganography.
Originally, public watermarking and blind watermarking
mean the same, but the wording was confusing with public-key
watermarking. 'Signal processing people' took over the field, so
only the later tends to remain. In these schemes, the cover signal
(the original signal) is not needed during the detection process to
detect the mark. Solely the key, which is typically used to generate
some random sequence used during the embedding process, is required.
These types of schemes can be used easily in mass market electronic
equipment or software.
In some cases you may need extra information to help your detector
(in particular to synchronise its random sequence on the possibly
distorted test signal). In particular some watermarking schemes require
access to the 'published' watermarked signal, that is the original
signal just after adding the watermark. People refer to these schemes
as semi-blind watermarking schemes.
Private watermarking and non-blind-watermarking mean
the same: the original cover signal is required during the detection
process.
At last, by asymmetric watermarking or public-key watermarking,
people refer to watermarking schemes with properties reminding asymmetric
cryptosystem (or public key cryptosystem). No such system really exists
yet although some possible suggestions have been made. In this case,
the detection process (and in particular the detection key) is fully
known to anyone as opposed to blind watermarking where a secret key
is required. So here, only a 'public key' is needed for verification
and a 'private key' (secret) is used for the embedding though. Knowledge
of the public key does not help to compute the private key (at least
in a reasonable time), it does not either allow removal of the mark
nor it allows an attacker to forge a mark.
The aims of such watermarks are completely different: A (semi-)fragile
watermark is a mark which is (highly) sensitive to a modification
of the stego-medium. A fragile watermarking scheme should be able
to detect any change in the signal and identify where it has taken
place and possibly what the signal was before modification. It serves
at proving the authenticity of a document. On the opposite, a robust
watermark should be stuck to the document it has been embedded in,
in such a way that any signal transform of reasonable strength cannot
remove the watermark. Hence a pirate willing to remove the watermark
will not succeed unless they debase the document too much to be of
commercial interest. The latter form is the very challenging and attracts
most research.
The characteristics of an watermarking algorithm is normally tied
to the application is was designed for. The following merely explain
the words used in the context of watermarking.
Imperceptibility
In watermarking, we traditionally seek high fidelity,
i.e. the watermarked work must look or sound like the original. Whether
or not this is a good goal is a different discussion.
Robustness
It is more a property and not a requirement of watermarking.
The watermark should be able to survive any resonable processing inflicted
on the carrier (carrier here refers to the content being watermarked).
Security
The watermarked image should not reveal any clues of the
presence of the wateramark, with respect to un-authorized detection,
or (statistical) undetectability or unsuspicious (not the same as
imperceptability).
Fingerprints are characteristics of an object that tend to distinguish
it from other similar objects. They enable the owner to trace authorized
users distributing them illegally. In the case of encrypted satellite
television broadcasting, for instance, users could be issued a set
of keys to decrypt the video streams and the television station could
insert fingerprint bits into each packet of the traffic to detect
unauthorized uses. If a group of users give their subset of keys to
unauthorized people (so that they can also decrypt the traffic) at
least one of the key donors can be traced, when the unauthorized decoder
is captured. In this respect, fingerprinting is usually discussed
in the context of the traitor tracing problem.
1.12 What is the oldest(historical) method developed/used for the purpose
of ownership protection ?
The original paper watermarks appeared at the end of the 13th century
to differentiate paper makers of that time. Modern visible watermarks
may be visual patterns (e.g., a company logo or copyright sign) overlaid
on digital images and are widely used by many photographers who do
not trust invisible watermarking techniques enough.
Similar techniques are being used today. ImageLock, for instance,
keeps a central database of image digests and periodically searches
the Web for images having the same digest. Tracking systems based
on private watermarks also require central databases. Unfortunately,
apart from the extent of the problem (which is now global) nothing
much has changed, since such services still do not provide any proof
of infringement.
[Jeffrey A Bloom] Yes. Most people who publish papers in this
field are developing new algorithms. It may be helpful to think of
watermarking "backwards", i.e. from the perspective
of detection. Consider an image watermarking system.
Define some algorithm to "extract" a watermark (this
could be taking the 1000 highest amplitude DCT coeffs, or averaging
the 8x8 blocks of an image, or subtracting the original and projecting
onto some subspace, or finding salient points, finding the Delaunay
triangulation of those points and representing the result as a graph,
etc.)
Modify the image so that the extracted watermark will be "similar"
to some predefined watermark (or set of watermarks). This may be done
by adding something to the image or by multiplying the image by some
spatially variant map. We may modify some values relative to others,
increase one subset and decrease another subset of pixels or coefficients,
warp the image to obtain a particular arrangement of salient points,
etc. The modification might be done under the control of a perceptual
model to limit the fidelity impact. It may be done under the control
of a distortion model to maximize the robustness.
Different algorithms employ different extraction functions and thus
different embedding functions. They differ in the models used to control
fidelity, robustness, security, bitrate, error rates.
You will find two classes of watermarking papers in the literature,
those that present new algorithms, and those that point out weaknesses
in previously presented algorithms. Hopefully, new algorithms do not
have the same weaknesses that have already been identified.
The use of these terms on an application specific case might be true
but not universally. So, a better question is ``Is this watermarking
technique secure/robust for this application ?''. There is the same
problem in cryptography: people think their system is secure because
it uses RSA. This is an illusion: hackers focus their effort on protocols
or on implementations but they never try to break RSA
[Jeffrey A Bloom] Try the early Digimarc patents. Geoffrey Rhoads
does an excellent job in the disclosures describing "knots"
and "rings" and "tapestries".
That technique is robust to rotation, crop, and resize, it is a blind
detection technique, it is an n-bit watermark, i.e. it has a payload
rather than a 0-bit watermark which is simply present or absent, but
carries 0-bits worth of information. I suspect that these patents
are the foundation of the Mediabridge technology. That is clearly
blind, multi-bit, and robust to the distortions you mention (as well
as others).
For example, try:
Geoffrey B. Rhoads,''Image steganography system featuring perceptually
adaptive and globally scalable signal embedding",United States
Patent 5,748,763,1998,
Geoffrey B. Rhoads,"Steganography system",United
States Patent 5,850,481, 1998
The digital age has simplified the process of content delivery and
has increased the ease at which the buyer can re-distrubute the content,
thus denying the income to the seller. Images published on the internet
is an example of such content. This section will deal with questions
related to image watermarking.
Visibility is a term associated with the perception of the human eye.
A watermarked image in which the watermark is imperceptible, or the
watermarked image is visually identical to its orginal constitutes
a invisible watermarking. Examples include images distrubuted over
internet with watermarks embedded in them for copyright protection.
Those which fail can be classified as visible watermarks. Examples
include logos used in papers in currencies.
Spatial domain, additive watermarking is the same as additive watermarking
in any domain that is a linear transformation of the spatial domain,
e.g. Fourier, block DCT, wavelet, etc. It usually means that someone
has created a watermark pattern that has the same dimensions as the
original image and has added the watermark pattern to the image.
The watermark pattern can be modified by, or even created with a perceptual
analysis of the original image. This does not directly effect the
robustness. Perceptual modeling usually improves the fidelity so that
means, for the same fidelity impact, you might be able to embed a
"stronger" watermark. Often, "stronger"
implies more robust, but not always. The following papers are recommend
to see that "stronger" does not always mean more
robust.
M.L. Miller, I.J. Cox, and J.A. Bloom, ``Informed embedding: exploiting
image and detector information during watermark insertion'', Proceedings
of the IEEE International Conference on Image Processing, vol. 3,
pp. 1-4, 2000.
Also, the book "Digital Watermarking" has many good
references to perceptual modeling and shows some implementations that
optimize the embedding process based on a perceptual model (Watson's
model is used as an example).
C. Podilchuk and W. Zeng, ``Image Adaptive Watermarking Using Visual
Models'', IEEE Journal on Selected Areas inCommunications, 16(4):525-540,
May 1998.
I.J. Cox and M.L. Miller, "A review of watermarking and the
importance of perceptual modeling", Proc. SPIE Conf. on Human
Vision and Electronic Imaging II, Vol 3016, 92-99, February 1987.
Multiple watermarks can be considered as attacks in situations wherein
one expects the presence of single watermark. Thus, any second operation
of watermark embedding or any other processing on the carrier can
be considered as an attack. The survival of the watermark in those
cases is dependent on the application. A robust watermark is expected
to survive such operations. Some watermarking tools do not allow you
to insert a watermark if an image already contains a watermark from
the same tool. Sometimes, a watermark from one tool may get overwritten
with a watermark from another.
There are instances where, a carrier is intentionally watermarked
multiple times. Consider the situation, wherein Alice buys the distrubuting
rights for an watermarked image from Bob(watermark contains info about
Bob). Whenever Alice sells the image to her customer, she watermarks
the image with the customer information. In this situation, the final
image should contain both the watermarks. The presence of both watermarks
help in avoiding copyright theft and illegal copy/distrubution. In
cases of multiple watermarks, the order in which different watermarks
are embedded may influence the detectability. A strong watermark embedded
after a weak watermark will mask the weak watermark and render it
undetectable.
The following refer to the set of papers touching the issue of multiple
watermarks
Ross Anderson, Fabien A.P. Petitcolas, and Markus G. Kuhn, "Attacks
on Copyright Marking Systems." Workshop on Information Hiding
Proceedings, Portland, Oregon, USA, 15 - 17 April 1998. Lecture Notes
in Computer Science, Vol. 1525, Springer-Verlag URL: http://www.cl.cam.ac.uk/~fapp2/papers/ih98-attacks/
Neil F. Johnson and Sushil Jajodia, "Steganalysis of Images
Created using Current Steganography Software," Workshop on
Information Hiding Proceedings, Portland, Oregon, USA, 15 - 17 April
1998. Lecture Notes in Computer Science, Vol. 1525, Springer-Verlag:
273-289. URL: http://www.jjtc.com/pub/ihw98a.htm
Scott Craver, Nasir Memon, Boon-Lock Yeo, Minerva Yeung. "Can
Invisible Watermarks Resolve Rightful Ownerships?," SPIE
Storage and Retrieval for Still Images and Video Databases, Feb. 1997.
Vol. V No. 3022 1997. pp. 310-321.
Scott Craver, Nasir Memon, Boon-Lock Yeo, Minerva Yeung. "Resolving
Rightful Ownerships with Invisible Watermarking Techniques: Limitations,
Attacks, and Implications" in IEEE Journal Selected Areas
of Communications (JSAC), May 1998, pp. 573-586
Neil F. Johnson, "In Search of the Right Image: Recognition
and Tracking of Images in Image Databases, Collections, and The Internet,"
Center for Secure Information Systems Technical Report CSIS-TR-99-05-NFJ,
April 1999. HTML and Postscript versions of this technical report
are available at: http://www.jjtc.com/Steganography/
M. Barni, F. Bartolini, A. De Rosa and A. Piva, "Capacity
of a Watermark-Channel: How Many Bits Can Be Hidden Within A Digital
Image ?"
Sergio D. Servetto, Christine I. Podilchuk, and Kannan Ramachandran,
"Capacity Issues In Digital Image Watermarking"
J.J.K O' Ruanaidh, W.J. Dowling, and F.M. Boland, "Watermarking
Digital Images for Copyright Protection"
[David Freson] I believe the root of this issue is the image's
capacity to convey the watermarks. If you consider the image as a
noisy channel, obviously the image has a bounded capacity. Using spread-spectrum
based techniques will allow to reduce interference of the image with
the embedded watermark and possible other watermarks (in the multiple
watermarking context). Yet interference is bilateral, and raising
the number of watermarks or the number of marked image channels will
impair reliable watermark detection (lowering the computed correlation
versus a pe-defined threshold e.g.). Watermark extraction will even
be impaired more rapidly, i.e. you still might be able to detect the
watermark, but reliable extraction of the stego-bits will not be possible.Seeing
this way, multiple watermarking can be regarded as an watermark detection
disabling attack.
The simplest of the domains to insert watermark is the spatial domain,
where the pixel value of the image is modified. Changing the pixel
value does effect the image statistics. Due to the attribute of a
watermark being imperceptible(in case of invisible watermark), there
cannot be much devation from the original image statistics. In this
situation, the watermark influence on each pixel must be atleast equal
to one quantization step to survive. Similar arguments can be made
for watermarks inserted in other domains. The general notion adopted
is, if the watermarks are embedded in the same domain as the compression,
then they have a higher probability of survival of such operations.
(Ex. DCT domain for JPEG compression)
Visible watermarks on images can be easily achieved thorough image
editing software. Ex. imagemagick or any other, which have the watermark
functionality. Invisible watermarks on images can be achieved through
some properitary softwares. There are several papers in the literary
world which help one to implement their own invisible watermark. The
following are some of the places to start with to learn/implement
watermarking for images.
A very simple defintion of video watermarking would be, ``The process
of watermarking the sequence of video frames''. There are several
avenues in case of video to watermark. One can watermark the raw frame
data, or the compressed data, where watermarking the later is more
challenging.
Pioneer work from Hartung & Girod, "Watermarking of Uncompressed
and Compressed Video", Signal Processing, 66(3):283-301,
1998.
Philips algorithm JAWS (Kalker et al.), "A Video Watermarking
System for Broadcast Monitoring", SPIE 3657, Security and
Watermarking of Multimedia Content, pp. 103-112, 1999.
Swanson and his temporal wavelets, "Multiresolution Scene-Based
Video Watermarking Using Perceptual Models", IEEE Journal
on Selected Areas in Communications, 16(4):540-550, 1998.
Langelaar and his real-time algorithms, "Real-Time Labelling
of MPEG-2 Compressed Video", Jounal of Visual Communication
and Image Representation, 9(4):256-270, 1998.
Su and her anti-collusion algorithm, "A Novel Approach to
Collusion-Resistant Video Watermarking", SPIE 4675, Security
and Watermarking of Multimedia Content IV, pp. 491-502, 2002.
Hartung and his work on drift compensation
Langelaar's work
Watermarking in motion vectors, Jordan et al., "Proposal
of Watermarking Technique for Hiding/Retrieving Data in Compressed
and Decompressed Video", ISO/IEC JTC1/SC29/WG11, 1997.
Alternative strategy for I, P and B frames, Hsu & Wu "DCT-based
Watermarking for Video", IEEE Transactions on Consumer Electronics,
44(1):206-216, 1998.
Videos can be considered as a stream of individual images. Hence,
all image watermarking techniques are equally applicable to video
when the individual frames are treated as images. Such techniques
do not make use of the availability of the temporal domain apart from
the spatial domain which images provide. This can lead to the design
and use of sophisticated techniques, exploiting the presence of temporal
domain. At the same time, the video provide new avenues for designing
better attacks as well.
Audio, like any other data, constitutes a carrier for physo-acoustically
hidden data. Thus the process of embedding information into audio
can be termed as audio watermarking.
Audio content, unlike video or images, doesn't need much help to copyright
ownership (Ex.one cannot dispute as to who sang ``another brick
in the wall'' - Rogers Waters wrote it). The use of watermarking
in audio is more into the tracing the delivery of content, by inserting
details about the distrubutor and the buyer. It is also used to search
through digitised archives.
J.F. Tilik, A.A. Beex. "Encoding a hidden digital signature
onto an audio signal using psycho-acoustic masking", in Proc.
1996 7th International Conf. on Signal Processing Apps and Tech..
pp 476-480
[list some very basic links which exaplain why/how audio content
is watermarked]
[Matthew Miller] All the different domains like DCT, DWT used
in watermarking are energy preserving, orthogonal transforms.
The way I think about them is to imagine their effects on a high-dimensional
"media space", in which each axis corresponds to
one value in the representation of a Work (e.g. in image space, each
axis might correspond to the brightness of one pixel, in audio space,
each axis might correspond to one audio sample, etc.). Thus, each
point in this space is a representation of a Work (image, audio clip,
etc.). When you apply an energy-preserving, orthogonal transform,
what you're doing is rotating the coordinate system so that each axis
has a new interpretation (e.g. instead of pixels, they're now frequencies).
If the watermarking method is independent of the coordinate axes,
applying one of these transforms will have no effect on its performance.
For example, consider a very simple embedder that applies a transform,
adds a white noise pattern, and inverts the transform. Since white
noise is radially symmetric, the probability distribution of watermark
patterns is independent of the coordinate system. This means that,
no matter what transform you use, you don't change the distribution
of watermarked images. The transform will have no effect on the performance.
Where people usually think of transforms as making a difference is
in what happens when the watermark pattern is not white noise. For
example, you might make an image watermark pattern that's white noise
inside a disk, but zero outside that disk. If you add such a pattern
in a frequency domain, you'll get a low-frequency watermark pattern.
But this is just a matter of convenience, rather than a fundamental
issue. You can generate low-frequency patterns in any domain; it's
just most convenient to do it in a frequency domain.
If one does something non-linear in embedding, such as watermarking
the magnitudes of the FFT (taking a magnitude is a non-linear operation),
or applying some form of perceptual modelling (which is almost always
wildly non-linear) then the domain in which it's done _does_ become
fundamentally important. But the non-linear part of the algorithm
must be specified before one can think about the relative merits of
different transforms. In general, the non-linear stuff will only make
any sense in one transform. So it's really the non-linear parts of
the algorithm that are important. The transform is just a tool.
The Human Visual System (HVS) naturally leads to working in the freq.
domain (eg. high freq. -> noise), it is easier to adjust the watermark
to contrast sensitivity constraints if one considers the freq. domain
(see eg. Kundur's paper 'A Robust Digital Image Watermarking Method
using Wavelet-Based Fusion' 1997)
[Neil F. Johnson] It has more to do with the survivability of
the marked areas within an image. Color can easily be changed or converted
to grayscale and you still have a "useable" image.
In marking an image, one want to place the mark in the more robust
areas of an image. Areas of high luminance is not the correct assessment,
because a plain sky may have high luminance but a poor structure for
hiding information. What the watermark tools are really interested
in are areas with high gradient magnitude. In other words, relatively
strong edges with respect to the structure of the image and the luminance
variances of the "edges."
[Lars R. Randleff] A lot of watermarking schemes hide data in
the luminance/intensity due to the fact that the Human Visual System
(HVS) use most of its bandwidth on percepting (changes in) brightness.
In changing an image, by e.g. JPEG compression, one therefore has
to be more gentle to the brightnes information than to the color information
(hue/saturation) since small changes in lightness might be easilier
detectable than large changes in color. If the compression changes
the brightness in an image, this will give the outcome a poor quality
to the HVS, and that is why these changes are avoided. For the watermark
to be robust to e.g. compression, the watermark has to be in parts
of the image that will not be changed in the compression.That is a
reason why hiding data in the Luminance is a good idea.
[Martin Kutter] In 1997 we suggested to use the blue channel to
embed a spread spectrum based watermark into an image (see http://ltssg3.epfl.ch:1248/kutter/watermarking,
M. Kutter, F. Jordan, F. Bossen, "Digital signature of color
images using amplitude modulation"). The blue channel was
used because the HVS is less sensitive to blue colors due to the fact
that the blue cones (S-cones) are less densely distributed than the
green and red cones (M-, L-cones) in the foveal part of the human
retina. Since then, we made numerous subjective tests and found that
in average the energy of a blue channel watermark is up to 50 times
larger than the energy of a luminance watermark, of course both introducing
visually equivalent artifacts. This implies that the blue channel
watermark is more robust towards attacks such as filtering (averaging,
median, ...) and additive noise. Furthermore, we found that under
lossy JPEG compression both approaches are approximately equivalent.
However, one problem that goes with blue channel watermarks is that
it is more difficult to control, or predict, the artifacts. That is,
the visibility of a luminance watermark is more homogeneous and less
dependent on the image colors. Therefore, the design of blue (or any
other color) channel watermarks is more delicate and requires sophisticated
models of the HVS to optimally adapt the watermark to the local contrast,
intensity, and color.
Shelby Pereira, Sviatoslav Voloshynovskiy and Thierry Pun, Optimized
wavelet domain watermark embedding strategy using linear programming,
In Harold H. Szu and Martin Vetterli eds., Wavelet Applications VII
(part of SPIE AeroSense 2000), Orlando, Florida USA, April 26-28 2000.
Shelby Pereira, Sviatoslav Voloshynovskiy and Thierry Pun, Effective
channel coding for DCT watermarks, In IEEE International Conference
on Image Processing ICIP 2000, Vancouver, Canada, September 10-13
2000.
Shelby Pereira, Svyatoslv Voloshynovskiy and Thierry Pun, Optimal
transform domain watermark embedding via linear programming, Signal
Processing, Special Issue: Information Theoretic Issues in Digita
Watermarking, 2001.
[Joachim Eggers] Until about 1998, you could observe the following
procedure in the reearch on digital watermarking:
Somebody, let us say X, invents a watermarking algorithm.
Somebody else, say Y, comes up with a successful attack.
X analyses the successful attack and improves his watermarking technology
Y looks at the improved scheme and comes up with a better attack.
go to 3.
It really looked like a never ending story. Does this process converge?
When can we be sure that a watermarking scheme is really secure and/or
robust?
We would like to break this endless loop. Thus, we assume that the
attacker knows the embedders strategy and the statistics of the host
data. Note that he does not know the exact realization of the embedded
watermark nor the exact realization of the host data. With this setup,
we investigate the resilience of an embedded watermark and break the
loop described above.
Note that Pierre Moulin et al., have looked at the problem via a similar
approach. They introduced the idea of considering watermarking a game
between embedder and attacker. The embedder tries to maximize watermark
robustness; the attacker tries to minimize watermark robustness. With
this approach, some ideal assumptions about the host data statistics,
and a mean-squared error distortion measurement, Moulin et al. could
actually find a solution to this game. Mihcak and Moulin, and Su,
Eggers, and Girod, have independently extended the analysis to colored
data. You can find papers on this subject in the proceedings of ICIP
2000 or on my web page ( http://www.lnt.de/~eggers/publications.html).
In practice, it is hardly possible to achieve the limiting results
derived via the theoretic approach described above. Nevertheless,
you can derive some good guidelines for practical schemes. For instance,
the attacker takes a coarse estimate of the power density spectrum
of an image (very coarse: low pass characteristic), designs the Wiener
filter accordingly, and perhaps can remove at least some of the watermark
components (e.g., high pass watermark components).
Note that the theoretical analysis described above confirms in an
analytical fashion the following heuristic argument given very early
by Cox et al.:
"The watermark should be embedded into the most significant
data components !!!"
Therefore, you should be very careful when designing your watermark
based on psycho-acoustic or psycho-visual masking effects. If you
put your watermark underneath a masking threshold, an attacker can
remove it without any penalty. This approach is not the right one
for very robust watermarks. Nevertheless, masking might be appropriate
when embedding information just as added value (in this scenario we
do not have a malicious attacker). Note that any state- of-the-art
compression scheme (for audio and images) will significantly impair
the watermark underneath the masking threshold.
The theoretical analysis also gives you an idea about the maximum
information that can be embedded per pixel. Assume that a mean-squared
error distortion measurement is used. Further, let the attacker add
simple additive white Gaussian noise (AWGN). In this case, Shannon's
result for the capacity of an AWGN channel gives the the upper limit
on the achieveable watermark rate, e.g. 0.5 bit/sample if the variance
of the AWGN equals the embedding distortion. Everybody can play this
attack! Thus, you never can achieve higher rates. Of course, more
sophisticated attacks can be invented. Thus, in practice the achieveable
watermark rate will be much lower. The goal of current research efforts
is to tighten this bound. Of course, thight bounds can be obtained
only when optimizing the watermarking scheme and the attack for certain
signal statistics. An "all-white" image has less
(exactly zero) watermark capacity than a Gaussian-noise image (see
Moulin's result).
With most techniques, one can identify an upper limit on the safe
message size that can be embedded in a "typical"
cover. This is called steganographic capacity and it is unknown even
for the simplest methods out there, such as the LSB embedding.
You can fine some papers dicussing the channel capacity in
Ching-Yung Lin, Watermarking and Digital Signature Techniques for
MulIt a Authentication and Copyright Protection, Ph.D. Thesis, Columbia
Univ., 2000. Chapter 5: Theoretical Watermarking Capacity of Images
which can be downloaded from http://www.ctr.columbia.edu/~cylin/publications.html
[Kaushal M. Solanki] We, here at UCSB, are working on image-adaptive
high volume data hiding, which I think might be applicable in this
case. Using these techniques one can hide from 16Kbits to 55Kbits
of data depending on the images and robustness required. I would suggest
you to look at the web pages at: http://vision.ece.ucsb.edu/hiding/
Recently, we also presented a paper at ICASSP 02 titled "High
volume data hiding in images: Introducing perceptual criteria in quantization
based embedding". This can be downloaded at the above mentioned
website.
Perceptual mask tells us the maximum change on can make to a pixel
(in case of images/video), before the change becomes noticeable. It
can also be defined the other way around like, the limit of change
on could impart on the the pixel value while watermark insertion and
still be invisible.
Some authors call the functions which generate the scale of visibility
due to watermark as Just Noticeable Difference (JND) or Noise Visibility
Functions (NVF). JND uses standard deviation and thus makes the watermark
appear very strong in the edges.
Some models like watson metric, non-stationary Guassian model and
PSNR quality metric can be found in checkmark benchmarking tool.
More information about DVQ(Digital Video Quality) watson metric can
be found at http://www.nasatech.com/Briefs/Apr01/ARC14236.html.
You can futher find several others metric computations which measure
image quality like
S. Daly. "The Visual Difference Predictor : An Algorithm
for the Assessment of Visual Fidelity." in Digital Image
and Human Vision, MIT Press, 1993.
P. Le Callet, D. Barba. "Perceptual color image quality metric
using adequate error pooling for coding scheme evaluation"
in Human Vision and Electronic Imaging VII, Electronic Imaging 2002.
A good review of different metrics is given in the Ph.D. Thesis written
by Ismail Avcibas (2001), Image Quality Statistics and their Use in
Steganalysis and Compression.
the audio-visual signal (still image, audio track,
video) in which one wish to hide information - the work
Watermark/mark
what is actually imperceptibly added to the cover-signal
in order to convey the hidden data
Payload
message or sequence of information bits to be hidden in
the cover-signal, that is the hidden data
Watermark-access-unit
smallest part of a cover-signal in which a
watermark can be reliably detected and the payload extracted
Capacity
bit size of a payload that a watermark access unit can
carry
Watermarking-scheme
the set algorithms required for embedding and
extraction
Embedding-key
a secret used to embed the mark.
Extraction-key
a key used to detect or extract a watermark. Symmetric
watermarking algorithms require use the same secret key for embedding
and extraction. Asymmetric algorithms use a secret key for embedding
and a public key for extraction. Keys are built in such a way that
the private key cannot be computed from the public one.
Non-blind(private)scheme
the original non-watermarked cover-signal,
the extraction key and the signal to be tested are required for the
detection
Semi-blind-scheme
the published watermarked audio-visual signal,
the extraction key and the signal to be tested are required for the
detection
Blind(public)scheme
only the watermarking-key and the signal to
be tested are required for the detection
Type-I-scheme
the output of the extractor is either the payload
or a symbol meaning the absence of mark in the signal to be tested
Type-II-scheme
such schemes require knowledge of the embedded watermark
for detection in a signal so they are only able to tell whether a
given watermark is present or not
The process of embedding/hiding data in text can be termed as ``text
watermarking''
To begin, you can take a look at:
``Watermarking Document Images with Bounding Box Expansion'',
Jack Brassil and Larry O'Gorman Information Hiding 1st International
Workshop, June 1996
``Marking and Detection of Text Documents Using Transform-domain
Techniques'', Yong Liu, Jonathon, Edward Wong, Steven Low Security
and watermarking of Multimedia Contents, january 1999
``Marking Text Documents'', N. F. Maxemchuk, S. Low, AT&T, University
of Melbourne ICIP'97
``Document Image Data Hiding Technique Using Character Spacing
With Sequence Coding'', Nopporn Chotikakamthorn ICIP'99
First determine what is the format of the image you are dealing with.
Then search for libraries which can decode/read the images and provide
pixel values. Tools like MATLAB can be helpful here. Another option
would be to write plugins for image editing applications like image-magick.
[Scott Craver ] There are several reasons for the wide range of
opinions. You need to consider the following factors, at least, when
evaluating a watermarking technology:
Media
Different media are easier or harder to attack or mark, at
least in my opinion. Images can be subjected to a lot of different
kinds of spatial distortion relative to, say, Audio. Video clips have
lots more data in which to hide things. Images also have very large
samples (pixels,) each individual sample visible with the naked eye;
audio has tens of thousands of samples per second, providing a more
rich environment for such like echo hiding.
Degree-of-prevention(threat-model)
A watermarking company might
just be trying to prevent common case theft, in which case it might
not matter if some people can crack the watermarking scheme. Of course,
these days some people can wrap up an attack into a program which
anyone can download, so it's best to assume that anyone who wants
to defeat a watermark and knows to look on the Internet will find
an attack tool. Then again, will this percentage of people be large
enough to pose a real threat? Who's the bad guy?
Quality-of-attack.
Maybe a mark doesn't survive compression into
RealMedia format, but a demarked skippy postage stamp of video that
doesn't actually play is a Pyrrhic victory.
User-Quality-Standards(very-important)
Prior to MP3s and DVDs, commercial
audio/video formats had gone well over a decade without any real improvement.
As a result, people today are still perfectly happy with VHS. Heck,
the DVD player in my laptop can ONLY display video considerably worse
than VHS quality. If people are conditioned to accept poor quality,
then attacks can be more powerful. They may annoy Golden Ears and
Eyes, but not the common case.
Application
Not all watermarking technologies are aimed at robust
proof of copyright ownership. Some are intended for automated detection/prevention,
some are inteded for adding value (like embedding lyrics in a song.)
Some are not intended to be robust, but fragile, for data authentication.
The application structure can greatly change the threat model, and
render certain attacks pointless. Who cares if I can noise out a watermark,
if it's only use is annotating the media?
That being said:
Is watermarking something I should be considering at this point
?
For what? For a business? Or an emphasis for graduate study? Also,
the application domain greatly determines if watermarking will be
a good investment.
What other methods might I use instead of or in tandem with
watermarking ?
This also depends on your intended use. If your goal is having proof
of copyright ownership, say if you are a photographer; then traditional
methods of establishing ownership might work. For digital images,
a timestamping service can provide evidence that you possessed an
image on a given date. If someone else has what is clearly "the
same" image, then a timestamp is good to have as evidence
in a court of law. Keep the negatives too. If you are managing an
online database (like a stock photo agency,) then fingerprinting images
may be useful in tracking copyright theft.
[Jeffrey A Bloom] There are no commercial watermarking products
available on the market that can do either of these things. It can
be argued that proof of ownership (or at least proof of ancestry)
can be accomplished with watermarking (image hash, etc.), but these
techniques have never been tested in U.S. courts. Note that this application
requires that the watermark be secure against unauthorized removal.
Your watermarking technique can used informed detection (original
image, or a function thereof, is available to the detector). Your
watermarking algorithm should not be secret since it will have to
be revealed in court the first time you use it, so it's security must
be based on a secret key and that key should be different for each
image that you distribute. Thus, depending on how many images you
plan on distributing, key space could be an issue.
Also, if you are distributing many copies of a single image you have
another problem. If you use a different key on each, then an adversary
may be able to average many different copies together to remove the
watermark (collusion attack). If you use the same key, and at some
point have to reveal that key in court, you release your protection
of all other copies.
If you want to prevent images from being copied, you may find better
luck in the crypto arena. Check out Intertrust (http://www.intertrust.com/)
and their digital rights management. They don't make a product for
you, but many of their partners do. Check out Clever Content by Alchemedia
(http://www.Alchemedia.com/). In general, you're looking for Digital
Rights Management of which watermarking is one tool. Do a search for
DRM.
