Principles of Digital
Watermarking
Ingemar J. Cox, Matt L. Miller, and Jeffrey A
Bloom
Course outline
UCL Adastral Park Postgraduate Campus
 Part 1: Introduction and Applications
 Part 2: Basic Algorithms and Concepts
 Part 3: Advanced Watermarking
Course outline
Part 1: Definitions and
Applications
Definitions and Applications: Outline
 Definitions of watermarking
 Watermarking applications
 Conclusions
UCL Adastral Park Postgraduate Campus
 Properties of watermarking systems
Definitions and Applications
Definitions of watermarking
Without common definitions, various approaches and
technologies cannot be compared.
Definitions and Applications
Watermarking is the practice of unobtrusively
modifying a work of art (image, song, software
program, geometric model, etc.) to embed a
message about that work.
Multimedia watermarking is the practice of
imperceptibly altering a work (image, song, etc.)
to embed a message about that work.
UCL Adastral Park Postgraduate Campus
Definitions of watermarking: Our definition
Definitions and Applications
Original
work
Watermark
embedder
Message
(regarding
work)
Watermarked
work
(looks like
original)
Detected
message
Watermark
detector
UCL Adastral Park Postgraduate Campus
Definitions of watermarking: Basic design of a system
Definitions and Applications
Definitions of watermarking: Other definitions
 Sometimes more broadly defined as any data
hiding (i.e. hidden data need not relate to work).
 Sometimes more narrowly defined as owner
identification (watermarks must indicate identity
of owner).
UCL Adastral Park Postgraduate Campus
 Imperceptibility is not always considered
essential (allows for visible watermarking).
Definitions and Applications
Definitions of watermarking: Related terms
 Steganography: keeping the existence of
messages secret by hiding them within objects,
media, or other messages.
UCL Adastral Park Postgraduate Campus
 Data hiding: any technology for preventing
adversaries from perceiving or finding data.
Definitions and Applications
Watermarking is the practice of unobtrusively
modifying a work of art (image, song, software
program, geometric model, etc.) to embed a
message about that work.
Steganography is the practice of undetectably
modifying a work to embed a message.
UCL Adastral Park Postgraduate Campus
Definitions of watermarking: Related terms
Original
Undetectable
UCL Adastral Park Postgraduate Campus
Unobtrusive
Properties of systems
Understanding, comparing, and selecting watermarking
approaches or technologies takes place in the context
of system properties.
Definitions and Applications
List of properties to be discussed
 Embedding effectiveness
 Data payload
 Blind vs. informed detection
 False positive rate
UCL Adastral Park Postgraduate Campus
 Fidelity
 Robustness
 Security
Definitions and Applications
 When we say “random work”, we mean a work
drawn from an application-dependent
distribution of works. Examples: x-rays,
animation, natural image, classical music,
speech, etc.
 When we say “random watermark”, we mean a
watermark message drawn from the set of
possible messages.
UCL Adastral Park Postgraduate Campus
A note before we begin …
Definitions and Applications
Message
detected
correctly?
Random
work
Random
message
Watermark
embedder
Watermark
detector
UCL Adastral Park Postgraduate Campus
Embedding effectiveness
A system’s embedding effectiveness is the
probability it will succeed in embedding
a random watermark in a random work.
Definitions and Applications
Embedding effectiveness
 In some cases, it is not possible to embed required
amount of information imperceptibly.
 Actual implementations usually involve some
round-off and truncation before watermarked work
is stored, which sometimes make watermark
undetectable.
UCL Adastral Park Postgraduate Campus
 Why might embedding effectiveness be less
than 100 percent?
Definitions and Applications
Random
work
Random
message
Watermark
embedder
Watermarked
work
Human
observer
UCL Adastral Park Postgraduate Campus
Properties of systems: Fidelity
A system’s fidelity is the perceptual similarity
between marked and unmarked works.
works
appear
sufficiently
similar?
Definitions and Applications
UCL Adastral Park Postgraduate Campus
Properties of systems: Data payload
A system’s data payload is the amount of
information that it can embed in a
single work.
01101001…
Random message
Random
work
Watermark
embedder
Watermarked
work
Definitions and Applications
UCL Adastral Park Postgraduate Campus
Blind vs. informed detection
An informed detector requires some
information about the original, unwatermarked
work. A blind detector does not.
Required by
informed detector
Original
work
Message
Watermark
embedder
Watermark
detector
Definitions and Applications
Watermark
detected?
Random,
unwatermarked
work
Watermark
detector
UCL Adastral Park Postgraduate Campus
Properties of systems: False positive rate
A system’s false positive rate is the
frequency with which it is expected to detect
watermarks in unwatermarked works.
Definitions and Applications
Watermark
detected?
Random,
watermarked
work
Watermark
detector
UCL Adastral Park Postgraduate Campus
Properties of systems: False negative rate
A system’s false negative rate is the
frequency with which it is expected to NOT detect
watermarks in watermarked works.
Definitions and Applications
Message
detected
correctly?
Random
work
Random
message
Watermark
embedder
UCL Adastral Park Postgraduate Campus
Properties of systems: Robustness
A watermark’s robustness is its ability to
survive normal processing (e.g. lossy
compression, noise reduction, etc.).
Normal
processing
Watermark
detector
Definitions and Applications
 Types of attacks
 Unauthorized embedding (forgery)
 Unauthorized detection
 Unauthorized removal
UCL Adastral Park Postgraduate Campus
Properties of systems: Security
A watermark’s security is its ability to
resist hostile attacks, specifically designed
to defeat the purpose of the watermark.
Definitions and Applications
Security – unauthorized embedding
Forged
message
Watermarked Watermark
work
Unauthorized
detector
embedding by
an adversary
UCL Adastral Park Postgraduate Campus
Random
work
Forged
Message
detected
Definitions and Applications
Security – unauthorized removal
Random
message
Watermark
embedder
Hostile
processing by
an adversary
Watermark
detector
UCL Adastral Park Postgraduate Campus
Message
detected
correctly?
Random
work
Definitions and Applications
Adversary
can detect
message?
Original
Work
Message
Watermark
embedder
Attempt at
detection by
adversary
UCL Adastral Park Postgraduate Campus
Security – unauthorized detection
Definitions and Applications
Watermarking applications
Watermarking may be appropriate for applications in
which data about a work must be imperceptibly
embedded. Different applications place different
requirements on system properties.
Definitions and Applications
List of examples discussed
 Broadcast Monitoring
 Proof of Ownership
 Transaction Tracking
 Content Authentication
UCL Adastral Park Postgraduate Campus
 Owner Identification
 Copy Control
Definitions and Applications
Original
content
Content was
broadcast!
Watermark
embedder
Broadcasting
system
Watermark
detector
UCL Adastral Park Postgraduate Campus
Broadcast monitoring
Definitions and Applications
 Verify advertising broadcasts (1997 scandal in
Japan)
 Verify royalty payments ($1000 of unpaid
royalties to actors per hour of broadcast)
UCL Adastral Park Postgraduate Campus
Broadcast monitoring
Monitor when and whether content is
transmitted over broadcast channels, such as
television or radio
 Catch instances of piracy
Definitions and Applications
Owner identification
Original
work
Watermark
embedder
Distributed
copy
Alice is
owner!
Watermark
detector
UCL Adastral Park Postgraduate Campus
Alice
Definitions and Applications
Owner identification
 Help honest people identify rightful owner
 Notify people of copyright
 In US, until 1988, such notice was required to
retain copyright
 Since 1988, presence of notice increases possible
reward in lawsuits
UCL Adastral Park Postgraduate Campus
Watermark identifies owner of copyright,
similar to a copyright notice
Definitions and Applications
Owner identification
UCL Adastral Park Postgraduate Campus
The problem with text: this well-known image …
Definitions and Applications
Owner identification
UCL Adastral Park Postgraduate Campus
… is a pirated part of a larger image.
Definitions and Applications
Proof of ownership
Original
work
Watermark
embedder
Distributed
copy
Alice is
owner!
Watermark
detector
UCL Adastral Park Postgraduate Campus
Alice
Bob
Definitions and Applications
Proof of ownership
 Differs from owner identification in two ways
 Intended to carry burden of proof
 Watermark need not be detectable by anyone
other than owner (allows informed detection)
UCL Adastral Park Postgraduate Campus
Watermark is used to prove ownership in a
court of law
Definitions and Applications
Transaction tracking
Watermark A
Original
work
B:Evil Bob
did it!
Watermark
detector
Honest
Bob
Evil
Bob
Watermark B
UCL Adastral Park Postgraduate Campus
Alice
Unauthorized
usage
Definitions and Applications
Watermarks record transaction histories of
content, typically identifying first authorized
recipient
 Identifying pirates (DiVX corporation)
 Identifying information leaks (M. Thatcher,
movie dailies)
UCL Adastral Park Postgraduate Campus
Transaction tracking
Definitions and Applications
Transaction tracking
 One source of material is the annual distribution
of Oscar screeners to the 5,803 voting
members of the Academy
UCL Adastral Park Postgraduate Campus
 The MPAA estimates that piracy costs the US
film industry $3B per year
Transaction tracking
 Screeners appeared on the internet
 The Last Samurai
 Something's Gotta Give
 Mystic River
 Actor Carmine Caridi expelled from MPAA
UCL Adastral Park Postgraduate Campus
 Thomson system enabled the MPAA to distribute
individually-watermarked VHS and DVD screeners to its
5,803 eligible voting members
Content authentication
Watermark
detector
UCL Adastral Park Postgraduate Campus
Watermark
embedder
Definitions and Applications
Content authentication
 Exact authentication: work is inauthentic if even
one bit has changed
 Selective authentication: work is inauthentic
only if significantly changed
 Tell-tale watermarks/localization: identify what
changes have been made
UCL Adastral Park Postgraduate Campus
Watermark is used to detect modifications
applied to cover work
Definitions and Applications
Copy control
 Record control: recording devices contain
detectors and refuse to record copyrighted
material
 Playback control: players contain detectors and
refuse to play pirated material
UCL Adastral Park Postgraduate Campus
Watermarks indicate whether content may be
copied
Definitions and Applications
Copy control
Playback
control
Illegal copy
Compliant
recorder
Record
control
UCL Adastral Park Postgraduate Campus
Legal copy
Compliant
player
Non-compliant
recorder
Definitions and Applications
Conclusions
Definitions and Applications
Conclusions: Stuff not covered
 Cipher and watermark keys
 Modification and multiple watermarks
 Cost
UCL Adastral Park Postgraduate Campus
 Erasability (whether watermark can be perfectly
removed)
Conclusions: Take Away
 Different applications place different
requirements on system properties.
UCL Adastral Park Postgraduate Campus
 Watermarking may be appropriate for
applications in which data about a work must
be imperceptibly embedded.
Conclusions: Take Away







Embedding effectiveness
Fidelity
Data payload
Blind vs. informed detection
False positive rate
Robustness
Security
UCL Adastral Park Postgraduate Campus
 Key properties include
Digression: The politics of DRM
 Why does Hollywood care about piracy?
 Loss in revenue
 Evidence that peer-to-peer file sharing affects
sales is mixed
 But has been used to control the evolution of the digital
market
UCL Adastral Park Postgraduate Campus
 But some level of piracy actually stimulates sales
Digression: The politics of DRM
 Need content owners to provide content in new
digital formats
 Conflict of interests
 Customers don’t want DRM
 Legal and business contracts impose DRM
UCL Adastral Park Postgraduate Campus
 Why do computer and consumer electronics
companies care about DRM?
Course outline
UCL Adastral Park Postgraduate Campus
 Part 1: Definitions and Applications
 Part 2: Basic Algorithms and Concepts
 Part 3: Informed Watermarking
Course outline
Part 2: Basic Algorithms and
Concepts
Basic Algorithms and Concepts: Outline
 Algorithmic building blocks
 Security issues
 Conclusions
UCL Adastral Park Postgraduate Campus
 Robustness issues
Algorithmic building blocks
Over the past 5 to 10 years of research, several ideas
have emerged as basic building blocks of watermarking
systems.
A simple watermark embedder
 Watermark pattern, w
 Cover image co
 Embedding strength a
 Compute watermarked image, cw, as
c w  co  αw
UCL Adastral Park Postgraduate Campus
 Given …
Basic Algorithms and Concepts
UCL Adastral Park Postgraduate Campus
A watermarked version of this …
Basic Algorithms and Concepts
UCL Adastral Park Postgraduate Campus
…looks like this
Basic Algorithms and Concepts
Informed detection
 Given
 Subtract original to obtain watermark pattern (if
present)
w n  c  co  αw if watermark is present 
UCL Adastral Park Postgraduate Campus
 Possibly watermarked image c
 Original cover image co
Basic Algorithms and Concepts
Linear correlation test
 Use linear correlation to determine whether
 Linear correlation defined as
1
1
zlc w n , w   w n  w 
N
N
 w x, y  wx, y
n
x, y
 If c = co + n, then zlc(wn,w) @ 0
UCL Adastral Park Postgraduate Campus
wn @ αw
 If c = co + aw + n, then zlc(wn,w) @ azlc(w,w)
Basic Algorithms and Concepts
Blind detection
 No need to subtract out co before computing
linear correlation.
 White noise pattern tends to have lowmagnitude correlation with any image.
UCL Adastral Park Postgraduate Campus
 If w is chosen so that zlc(co,w) is likely to be
close to 0, then zlc (c,w) @ zlc(wn,w).
Basic Algorithms and Concepts
Interpreting system geometrically
 256 256 grayscale image > 65,536 dimensions
(one for each pixel).
 5 second mono audio clip, sampled at 44,100Hz 
> 220,500 dimensions (one for each sample)
UCL Adastral Park Postgraduate Campus
 Media space – a high-dimensional space in
which each point corresponds to a work.
Basic Algorithms and Concepts
2d pictures of media space
 Abstraction of high-dimensional space (just
pretend media space is really 2d)
 Projection of media space
 Slice of media space
UCL Adastral Park Postgraduate Campus
 Several possible interpretations
Basic Algorithms and Concepts
UCL Adastral Park Postgraduate Campus
Picture of media space
Basic Algorithms and Concepts
UCL Adastral Park Postgraduate Campus
Algorithmic building blocks:
Watermark in media space
Basic Algorithms and Concepts
Geometric interpretation of zlc()
 Dot product of c and w is cosine of angle
between them, times their magnitudes
 If |w| = 1, then dot product is projection of c onto
direction of w
 Comparing zlc(c,w) against a threshold leads to
detection region with planar boundary
UCL Adastral Park Postgraduate Campus
 zlc(c,w) is just dot product of c and w divided by
N
Basic Algorithms and Concepts
UCL Adastral Park Postgraduate Campus
Geometric interpretation of zlc()
Basic Algorithms and Concepts
Now that we have a basic system …
 cwn = ncw , where n is some scalar value
 zlc(cwn,w)  n zlc(cw,w)
 If n < 1, detection value might drop below
threshold
UCL Adastral Park Postgraduate Campus
 … let’s consider a problem: What happens
when we change the contrast of the image?
Basic Algorithms and Concepts
Solution: normalized correlation
cw
znc c, w  
cw
 Scaling has no effect on znc(c,w)
 cw
znc  c, w  
 znc c, w 
cw
UCL Adastral Park Postgraduate Campus
 Normalize correlation by magnitudes of vectors
Basic Algorithms and Concepts
Geometric interpretation of znc()
 Comparing znc(c,w) against a threshold is
equivalent to comparing angle against a
threshold
 Result: detection region with conical boundary
UCL Adastral Park Postgraduate Campus
 znc(c,w) correlation is just cosine of angle
between c and w
Basic Algorithms and Concepts
Geometric interpretation of znc()
acos( znc(c,w) )
w
UCL Adastral Park Postgraduate Campus
c
Basic Algorithms and Concepts
Another problem
 Detection value will depend on autocorrelation
function of watermark pattern.
 White noise pattern has close to zero
autocorrelation.
 \ Watermark is unlikely to be detected.
UCL Adastral Park Postgraduate Campus
 What happens if the image is spatially shifted a
little?
Basic Algorithms and Concepts
Possible solution
 Fourier-magnitudes are invariant to translation
UCL Adastral Park Postgraduate Campus
 Watermark Fourier-magnitude instead of pixel
values
Basic Algorithms and Concepts
Possible solution
 Take FFT of image and compute magnitudes
 Add w to magnitudes
 Scale FFT coefficients of image to new magnitudes
and take inverse FFT
 To detect
 Take FFT of image and compute magnitudes
 Compute normalized correlation between
magnitudes and w
UCL Adastral Park Postgraduate Campus
 To embed
Basic Algorithms and Concepts
Watermark extraction
 A watermark extraction process that maps points in
media space to points in some marking space
(Fourier-magnitude space, in this case)
 A simple watermarking system that operates in
marking space
UCL Adastral Park Postgraduate Campus
 We can view the preceding system as
comprising two basic parts
Basic Algorithms and Concepts
Reasons for watermark extraction
 Project into distortion invariant space
 Invert distortions
 Reduce noise
 Reduce computational cost
 Increase security
 Key-based extraction
UCL Adastral Park Postgraduate Campus
 Increase robustness
Basic Algorithms and Concepts
“Transform domain” watermarking




“Spatial-domain watermarking” (no transform)
“DCT-domain watermarking”
“Wavelet-domain watermarking”
Etc.
 But …
UCL Adastral Park Postgraduate Campus
 Many authors categorize watermarking systems
by transforms included in their extraction
processes, e.g. …
Basic Algorithms and Concepts
“Transform domain” watermarking
 If T is a linear, energy-preserving transform, then
zlc( T(c),w ) = zlc( c,T-1(w) )
 Thus a linear-correlation-based system in domain
T is the same as a spatial-domain system with a
different watermark pattern
 It is the nonlinearities in the extraction process
that distinguish a system’s behavior
UCL Adastral Park Postgraduate Campus
 … the transform alone says little about how the
system works
Basic Algorithms and Concepts
Perceptual shaping
UCL Adastral Park Postgraduate Campus
 Basic idea: amplify watermark in areas where
the cover work can mask noise
co
Perceptual
model
w
cw
Basic Algorithms and Concepts
UCL Adastral Park Postgraduate Campus
Image before embedding
Basic Algorithms and Concepts
UCL Adastral Park Postgraduate Campus
Without perceptual shaping
Basic Algorithms and Concepts
UCL Adastral Park Postgraduate Campus
With perceptual shaping
Basic Algorithms and Concepts
Detection after perceptual shaping
UCL Adastral Park Postgraduate Campus
 Early approach: invert shaping in detector
(shown here for informed detector)
co
Perceptual
model
c
wn
Basic Algorithms and Concepts
Detection after perceptual shaping
 Distortion of watermark pattern degrades detection
value for given watermark scaling value, a, but …
 … possible to use larger value of a because
pattern is better hidden
UCL Adastral Park Postgraduate Campus
 Not necessary to invert perceptual shaping
Basic Algorithms and Concepts
Region of
acceptable
fidelity
Shaped
watermark
vector
Original
(unshaped)
watermark
vector
UCL Adastral Park Postgraduate Campus
Geometric view of perceptual shaping
Basic Algorithms and Concepts
Robustness Issues
The robustness of a watermark is its ability to
survive normal processing.
Additive Noise

Watermarked image is corrupted
by additive noise

Linear Correlation
zlc w, cwn   w  cw  w  n

UCL Adastral Park Postgraduate Campus
cwn  cw  n
Linear Correlation (matched
filtering) is optimal when noise is
AWGN.
Basic Algorithms and Concepts
Valumetric Scaling

Watermarked image is subjected to
a change in contrast

Linear Correlation
zlc w, cwn   n w  cw 

For n < 1, this scaling decreases
the detection value.

How can we select a threshold?
UCL Adastral Park Postgraduate Campus
cwn  n cw
Basic Algorithms and Concepts
Valumetric Scaling
Normalized Correlation

Independent of vector
magnitude
1n

Describes the cosine of the
angle between the vectors

-1  znc  +1
q
w
w
UCL Adastral Park Postgraduate Campus
cwn
cwn
Unit Sphere
Basic Algorithms and Concepts
uncompressed
work

Quantization noise
cannot be modeled
as additive white
noise

There are current
efforts to model
quantization noise
Transform
Quantization
Entropy
Coding
compressed
work
Canonical Transform
Coder


Eggers and
Girod
Appendix B.5
UCL Adastral Park Postgraduate Campus
Quantization
Basic Algorithms and Concepts
Synchronization
Geometric distortion in imagery


translation, rotation, zoom, aspect
ratio, skew, perspective distortion,
warp
Temporal distortion in audio

time delay, time scaling

Video can suffer from both geometric
and temporal misalignments

Noise due to synchronization errors
is not well modeled as additive white
noise.
UCL Adastral Park Postgraduate Campus

Basic Algorithms and Concepts
Synchronization Approaches
 Detection applied at all possible
temporal/geometric distortions
 Negative impact on false positive probability
 Usually requires too much computation
UCL Adastral Park Postgraduate Campus
 Exhaustive Search
Basic Algorithms and Concepts
Synchronization Approaches
 Synchronization pattern is embedded along
with the payload-carrying pattern.
 Registration to synchronization pattern prior to
detection.
 Negative impact on fidelity and security
UCL Adastral Park Postgraduate Campus
 Synchronization
Basic Algorithms and Concepts
Synchronization Approaches
 Watermark location in time or space is relative
to extracted features
 Example: audio reference pattern added
between salient points
UCL Adastral Park Postgraduate Campus
 Implicit Synchronization
Basic Algorithms and Concepts
Synchronization Approaches
 Design patterns that are invariant to
desynchronization
 Example: Use of Fourier magnitude in
watermark extraction process for shift
invariance
UCL Adastral Park Postgraduate Campus
 Invariance
Basic Algorithms and Concepts
Security Issues
The security of a watermark is its ability to
resist hostile attacks specifically designed to
defeat the purpose of the watermark.
Robustness
 Desynchronization Attacks
 Noise Removal Attacks
UCL Adastral Park Postgraduate Campus
 Security against unauthorized removal requires
robustness to any process that maintains
fidelity
Basic Algorithms and Concepts
Mosaic Attack
 Each patch is too small for reliable detection
 Patches are displayed in a table such that
patch edges are adjacent
UCL Adastral Park Postgraduate Campus
 Image is broken into many small rectangular
patches
Basic Algorithms and Concepts
Collusion Attacks
 Many different works, same watermark
 Simple example: averaging
 Average of many different works gives an estimate
of the watermark
 Average of many copies of the same work reduces
the strength of each watermark
UCL Adastral Park Postgraduate Campus
 Many different watermarks, same work
cw1  cw 2 1
1
1
 co  w1  co  w2   co  w1  w2
2
2
2
2
Basic Algorithms and Concepts
Copy Attack
 Watermark is “copied” from one work to another
 Example: apply a watermark removal attack to
obtain an estimate of the watermark, add to
fake.
UCL Adastral Park Postgraduate Campus
 Unauthorized Embedding
Basic Algorithms and Concepts
Ambiguity Attack
 Example: define fake watermark pattern and
subtract from the distributed image. This is the
fake “original.”
 Difference between distributed and Bob’s original
contains Bob’s watermark
 Difference between distributed and Alice’s original
contains Alice’s watermark
UCL Adastral Park Postgraduate Campus
 Create the appearance that a watermark has
been added to someone else’s work
Basic Algorithms and Concepts
Ambiguity Attack
Alice’s
original
(real)
Alice’s
detector
Distributed
copy
Bob’s
Bob “original”
(fake)
Bob is
owner!
UCL Adastral Park Postgraduate Campus
Alice
Alice is
owner!
Bob’s
detector
Basic Algorithms and Concepts
Ambiguity Attack
 May be possible to implement by making
watermark dependent on cryptographic hash of
original work
 Strictly-speaking, provides proof of ancestry, rather
than proof of ownership
UCL Adastral Park Postgraduate Campus
 Solution to ambiguity attack: Alice uses system
that cannot be hacked
Basic Algorithms and Concepts
Sensitivity Analysis
 Estimate the normal to the detection region
surface boundary at some point
 Assume that this normal indicates a short path
out of the detection region
UCL Adastral Park Postgraduate Campus
 Technique for removing watermark when
adversary has black box detector
Basic Algorithms and Concepts
Sensitivity Analysis
2
Find a work that lies on
the detection boundary
Detection region
work A
Approximate the normal
to the detection boundary
attacked
work
3
Scale and add the normal
to the watermarked work
w
watermarked
work
UCL Adastral Park Postgraduate Campus
1
Basic Algorithms and Concepts
Conclusions
Basic Algorithms and Concepts
Conclusions: Major stuff not covered
 Message-coding for multi-bit watermarks
 “Constraint-based” watermarking (can usually
be recast as correlation-based)
 Quantization-based watermarking (will be
covered in part 3)
 Authentication methods
UCL Adastral Park Postgraduate Campus
 Non correlation-based watermarking
 ROC Curves
Basic Algorithms and Concepts
Conclusions: Take Away
 Most processing is not well modeled as AWGN
 Normalized correlation provides robustness to
amplitude changes
 Helpful to think of a work as a point in a high
dimensional space
UCL Adastral Park Postgraduate Campus
 Linear correlation (matched filtering) is optimal
for detecting a signal in AWGN
Basic Algorithms and Concepts
Conclusions: Take Away
 Perceptual modeling can improve fidelity and
allow for stronger embedding
 Robustness to desynchronization is an
difficult problem
 Collusion attacks and sensitivity analysis are
significant security challenges
UCL Adastral Park Postgraduate Campus
 Watermark extraction: project a work to
another space for embedding and/or detection
Basic Algorithms and Concepts
Outline
 Part 2: Basic Algorithms and Concepts
 Part 3: Informed Watermarking
UCL Adastral Park Postgraduate Campus
 Part 1: Definitions and Applications
Part 3: Informed watermarking
Informed watermarking: Outline
 Idea of informed watermarking
 Informed shaping
UCL Adastral Park Postgraduate Campus
 Informed coding
 Conclusions
Informed watermarking
Idea of informed watermarking
Informed watermarking is the practice of using
information about the cover work during watermark
coding and shaping.
Informed watermarking
Blind coding & shaping
Watermark embedder
Message
Blind
coding
Blind
shaping
(scaling)
Watermarked
Work
Informed watermarking
UCL Adastral Park Postgraduate Campus
Original
Work
Informed shaping
Watermark embedder
Message
Blind
coding
Informed
shaping
Watermarked
Work
Informed watermarking
UCL Adastral Park Postgraduate Campus
Original
Work
Informed coding & shaping
Watermark embedder
Message
Informed
coding
Informed
shaping
Watermarked
Work
Informed watermarking
UCL Adastral Park Postgraduate Campus
Original
Work
Central insight
 Shannon’s model: transmitter has knowledge of
channel’s noise characteristics
 In watermarking, cover Work = (part of) noise
 Theoretical results for this type of channel should
apply to watermarking
Informed watermarking
UCL Adastral Park Postgraduate Campus
 Watermarking with informed embedder and
blind detector = communication with side
information at the transmitter
Consequences
 Informed shaping alone
UCL Adastral Park Postgraduate Campus
 Allows more precise control of fidelity/robustness
tradeoff
 Informed coding + informed shaping
 Greatly increases payload for a given
fidelity/robustness performance
 Alternatively, improves fidelity/robustness
performance for a given payload
Informed watermarking
Informed shaping
The cover work can be used to inform perceptual
shaping. It can also be used to adjust watermark
pattern for maximal robustness.
Informed watermarking
Basic approach
 Treat detection algorithm and parameters as
given
 Design best embedder we can
Informed watermarking
UCL Adastral Park Postgraduate Campus
 Design detector (we’ll use the linear-correlation
detector from Part 2)
Embedding problem
 Objective: produce an image within the
intersection of a region of acceptable fidelity
and the detection region
Informed watermarking
UCL Adastral Park Postgraduate Campus
 The embedder is capable of producing any
image
Region of
acceptable
fidelity
Any point in
this area is a
successful
embedding
w
Informed watermarking
UCL Adastral Park Postgraduate Campus
Embedding problem
Embedding problem
 Several possible approaches
UCL Adastral Park Postgraduate Campus
 Maximize robustness for a given fidelity
 Maximize fidelity for a given robustness
 Either approach requires
 Estimate of fidelity
 Estimate of robustness
Informed watermarking
Simple embedding method
 Assume robustness is monotonic function of
linear correlation
 Under these assumptions, blind embedding
achieves maximum “robustness” for given
“fidelity”
 Alternatively …
Informed watermarking
UCL Adastral Park Postgraduate Campus
 Assume MSE indicates fidelity (better estimates
lead to perceptual shaping)
Simple embedding method
UCL Adastral Park Postgraduate Campus
 … we can minimize fidelity impact while
embedding for a constant “robustness”
Informed watermarking
Estimating robustness
 True for linear correlation
 Not true for other detection measures
 For normalized correlation, we have obtained
good results by estimating amount of white
noise that may be added before watermark is
likely to be lost
Informed watermarking
UCL Adastral Park Postgraduate Campus
 Simple assumption: robustness is monotonic
function of detection value
Informed coding
Significantly larger data payloads can be embedded if
the mapping between messages and watermark
patterns is dependent on the cover work.
Informed watermarking
Informed coding: Outline
 Writing on dirty paper (problem studied by M.
Costa)
UCL Adastral Park Postgraduate Campus
 Dirty-paper codes
 Application of dirty-paper codes to
watermarking
 Experimental results
 Conclusions
Informed watermarking
Informed coding: Writing on dirty paper
 Obtain a piece of paper with normally-distributed
dirt
 Write a message using limited ink
 Send message, acquiring more dirt along the way
 Recipient cannot distinguish dirt from ink
 How much information can we send?
Informed watermarking
UCL Adastral Park Postgraduate Campus
 M. Costa studied a “dirty-paper channel”
First
noise
Second
s
noise
n
m
Transmitter
x
y
Receiver
m’
x limited by power constraint:
 xi  p
2
i
Informed watermarking
UCL Adastral Park Postgraduate Campus
Informed coding: The dirty-paper channel
First noise has no effect on channel capacity
Informed watermarking
UCL Adastral Park Postgraduate Campus
Informed coding: Costa’s result
Informed coding: Dirty-paper codes
 Dirty-paper code = code in which each
message is represented by several alternative
code vectors
 From the set of vectors that represent the
desired message, choose the one, u, that is
closest to the first noise, s
 Transmit a function of u and s, for example x =
u-s
Informed watermarking
UCL Adastral Park Postgraduate Campus
 Basic idea
Coding for a simplified channel
 First noise has only two possible values, s1 and s2
(i.e. there are only two possible patterns of dirt on
the paper)
 Remainder of channel is the same
 If s1 is sufficiently different from s2, then Costa’s
result is easy to obtain
Informed watermarking
UCL Adastral Park Postgraduate Campus
 Consider a simplified version of the dirty-paper
channel
Coding for a simplified channel
C
D
F
This group of
code vectors
centered on s1
B
E
G
A
C
B
D
F
UCL Adastral Park Postgraduate Campus
A
This group of
code vectors
centered on s2
E
G
Informed watermarking
Informed coding: Dirty-paper codes
Try to design a dirty-paper code in which, within
the power-constraint around every possible s,
there is at least one code vector for each message.
Informed watermarking
UCL Adastral Park Postgraduate Campus
For full dirty-paper channel:
Coding for full dirty-paper channel
 Capacity cannot be achieved transmitting x =
u – s.
 Costa transmits x = u – as, where a is a
carefully-chosen constant
Informed watermarking
UCL Adastral Park Postgraduate Campus
 Code must ensure that, within the powerconstraint around every possible s, there is at
least one code vector for each message.
Application to watermarking
 In watermarking, noise is not Gaussian
 Non-Gaussian noise necessitates non-spherical
detection regions (e.g. cones)
 Lessons from Costa
 Use dirty-paper codes
 Use non-trivial informed embedding
Informed watermarking
UCL Adastral Park Postgraduate Campus
 Costa’s proof does not translate directly to
watermarking
Practical dirty-paper codes
 Requires exhaustive search during encoding and
decoding
 Practical for only very small data payloads
 Lattice code is most-studied practical code
 Chen & Wornell (“Dither Index Modulation”,
“Quantization Index Modulation”)
 Eggers, Su, & Girod (“Scalar Costa Scheme”)
Informed watermarking
UCL Adastral Park Postgraduate Campus
 Costa’s code is generated randomly
Informed coding: Lattice codes
 Bit encoded by choosing between two
quantization points
0
1
0
1
0
1
0
Informed watermarking
UCL Adastral Park Postgraduate Campus
 Each dimension in marking space encodes one
symbol, usually one bit
Properties of lattice codes
 Not usually as robust as correlation-based
systems
 Correlation-based systems have better
payload/robustness tradeoff when noise is high
 Lattice codes susceptible to changes in image
brightness or audio volume
Informed watermarking
UCL Adastral Park Postgraduate Campus
 Typically much higher capacity than correlationbased systems (> 1000 bits)
Conclusions
Informed watermarking
Conclusions: Stuff not covered
 Informed-embedding for multi-bit watermarks
 Application of informed-coding to correlationbased systems
Informed watermarking
UCL Adastral Park Postgraduate Campus
 Syndrome coding
Conclusions: Take Away
 Embedder may choose any point in the detection
region for the desired message
 Best to base choice on an estimate of robustness
 Informed coding
 Define several patterns for each message, and
embed the one that’s closest to the cover work
 In theory, capacity of watermarking might be
unaffected by distribution of cover works
Informed watermarking
UCL Adastral Park Postgraduate Campus
 Informed shaping
UCL Adastral Park Postgraduate Campus
Future directions
Future directions
 Research
 Quantization index modulation
 Syndrome coding
 Trellis coding
 Robustness
 Non-random processes
•
Esp. geometric distortions
UCL Adastral Park Postgraduate Campus
 Informed coding
Future directions
 Research
 Collusion attacks
 Others …
UCL Adastral Park Postgraduate Campus
 Security
Future directions
 Commercial applications
 Movie screeners
 Digital cinema
 Broadcast monitoring
 Metadata
 Lyrics in MP3 files
UCL Adastral Park Postgraduate Campus
 Transaction tracking
Future directions
 Commercial applications
 Cameras
 Surveillance video
 Medical imagery
 Enhancements to legacy systems
 3D HDTV – Benoit Macq
UCL Adastral Park Postgraduate Campus
 Authentication
Future directions
 Commercial applications?
UCL Adastral Park Postgraduate Campus
 Copy control
 Proof of ownership
Future directions
 Commercial applications
 Not technology
 Similar to commercial applications of cryptography
UCL Adastral Park Postgraduate Campus
 Must be based on a service or product