A Wavelet-based Image Watermarking Scheme

Alessandra Lumini DEIS - CSITE-CNR - Universit di Bologna viale Risorgimento 2,40136 Bologna - Italy. alumini@deis.unibo.it Abstract
A wavelet-based image watermarking scheme is proposed, based on the insertion of pseudo-random codes in the frequency domain. The original image is required for the watermark detection. The strength of the signature to be embedded depends on the image to be marked, thus fitting signal capacity. The experimental results prove that the method is more tamper resistant and less perceptible for any type of images than other well-known private methods in the frequency domains.

Dario Maio DEIS - CSITE-CNR - Universit di Bologna viale Risorgimento 2,40136 Bologna - Italy. dmaio@deis.unibo.it
The experimental results prove that the method is more tamper-resistant and is less perceptible for any type of images, include cartoons, that are usually hard to be marked, and requires lower computational costs in comparison with the COX approach. The paper is structured as follows. In section 2 the main watermarking approaches in the literature are reported; particular emphasis is given to the COX method that is described in section 3. In section 4, a detailed analysis of the new method to insert a watermark in the wavelet domain is reported. Experimental results and some comparisons with COX are included in section 5. Finally, section 6 draws some concluding remarks and includes proposals of future work.

1. Introduction
With the coming and the expansion of the World Wide Web an increased amount of digital information, such as documents, images audio and video data become available to a large number of people. Since the digital network is often used to offer digital media for profit, there is a strong need for copyright protection and a considerable interest in methods for inserting in a multimedia document a visible, or preferably invisible, mark to identify the owner. A watermark (or digital signature) is an identification code that can be embedded in a multimedia document, in particular in images, video or audio sequences or directly in a text. It can be used to identify the document owner, to discourage unauthorized document copying and distribution, and, possibly, to earn royalties. To be effective a watermark scheme should be imperceptible, easily extractable and reliable, unambiguous and robust against common signal transformations and tampering. In this work we describe a new watermarking technique directed to images. Our approach is derived from the method proposed by Cox et al.[1] (called COX in the following), which was, in our opinion, one of the most promising approaches to insert the watermark in the frequency domain. Our scheme is based on the discrete wavelet transformation of the image, and encodes the signature by an inserting function depending on the image to be marked, thus able to fit signal capacity.

2. Related work
Existing digital watermarking schemes can be classified into private and public (also called blind) depending on the requirement of the original image during the detection process; most existing methods are private and typically they subtract the original image from the watermarked one before a detection algorithm is applied. Of course, blind watermarking techniques are less robust and are therefore more suitable for applications requiring lower security than copyright protection, such as authorized copying distribution in electronic commerce. Another classification criterion distinguishes schemes into spatial domain techniques and transform domain techniques depending on whether the watermark is encoded by directly modifying pixels or by altering some frequency bins obtained by transforming the image in the frequency domain [2]. Spatial domain techniques [4][5][5] are simple to implement and often require a lower computational cost, although they can be less robust against tampering than methods which place the watermark in the most perceptually significant components of a transform domain (Fourier, Wavelet, Cosine) [6][7][8][9]. A typical formulation [10] of watermark insertion and detection in the frequency domain of a digital image is the following. The insertion is procedure encoding a signature

into an image I to obtain a marked image , the detection is a decoding procedure in which a signature T is extracted from an image J (possibly different from ) and compared to the searched one W (figure 1). The signature W is assumed to be present in J if the value of a similarity function C(T,W), used to compare the extracted signature T and the original one, is greater than a fixed threshold .

counterfeit original. Barni et al. [11] present a public watermarking algorithm similar to COX that does not need the original for extracting watermarks.

4. A new watermarking inserting scheme

In order to better protect images against some spatial operators (blur, sharper, cropping) and improve perceptual invisibility of the watermark we propose some modifications to the COX scheme: A. Using a different transform-based technique to determine the frequency coefficients to be modified by the embedding procedure. B. Making the amount of information to be inserted dependent on the image to be marked, in particular the number n of coefficients to be modified should be proportional to the capacity of the image in order not to affect image fidelity. C. Modifying the insertion procedure to scale the watermark differently from one image to another: that means to add more watermark energy, where it is possible, without reducing image fidelity, and vice versa to reduce the watermark energy if it is too strong with respect to the image. Therefore, the new scheme is very different from COX in the insertion procedure, although the same similarity function is employed in the detection procedure.

ENCODING
I E W
 :70 

DECODING
Yes J D I T C No

W
9 0 ,9072,7 574.088 8 , 0.4/ 3 9 2, 0 -

,
%

3.4/ 3 9 0 2, 0 5488 -

574.088  -

380790/ ,9072,7 ,3 2, 0 8 2 ,7 9 /:7 3

394

/ 1107039 1742 3,

8 0 97,.90/ 1742 20,38 41 , 8 349 706: 70/

,3/ 9 03 .425,70/

1:3.9 43   % 0 47

9 0 /090.9 43 574.088 147 5:- . 8. 0208

3. The COX method

COX is a private method working in the transform domain: the watermark is placed in perceptually significant components of the signal, in order to make it robust to common signal distortion and malicious attack. In fact, the modification of such components in order to remove the signature would cause a significant degradation of the image itself. On the other hand, perceptually significant components can be only slightly modified by the embedding procedure without any loss of image quality. The watermark to be embedded is a sequence of 1000 random numbers W={w1,...,w1000}, having a Gaussian distribution N(0,1). The watermark sequence is embedded in the largest coefficients fi of the DCT transform by the following encoding function: where i=1..1000 fi* = fi + wifi The parameter , set to the value 0.1, represents a compromise between resistance and image fidelity. The watermarked image is obtained by calculating the inverse DCT transform. The extraction process is exactly the inverse of the insertion one and requires the original image. A correlation function is used to compare T and W: WT sim(T, W ) = TT The function sim() is a statistic significance test to prove that T and W are correlated if its value is larger than a fixed threshold (=6). Some researchers at IBM [10] proposed a slight modification to the COX method in order to make it noninvertible, that is resistant to attacks by creating a

4.1 Frequency Decomposition

Although the wavelet theory is a relative new and evolving discipline, in recent years there has been growing interest in wavelet transforms in image processing and time-frequency signal analysis. As compared to the traditional Fourier analysis, the wavelet transform is less rigid, because the wavelet functions have a better space-frequency localization and thus they are suited for analyzing images where most of the informative content is represented by components localized in space such as edges and borders. The main property of wavelet functions is to process data at different scales or resolutions, highlighting both large and small features. Wavelet functions have advantages over traditional Fourier methods in analyzing signals containing many discontinuity or sharp changes and they have been used in several fields: image compression, signal denoising, image smoothing and texture analysis [12]. The main advantages of inserting watermarks in the wavelet transform domain instead of other frequency domains, such as Fourier, are: The capability to better localize the features (edges, textures) to whose changes the human eye is less sensitive. The capability to localize information in space and frequency. This localization makes a watermark

scheme based on wavelets more robust against geometric attacks, such as cropping and scaling. The watermark transform requires a lower computational cost O(n) than the Fourier or the Cosine transform O(nlog(n)), where n is in the length of the signal to be transformed. The image is decomposed into several bands with a pyramid structure using the Daubechies wavelet family [13], and the watermark is inserted in the most perceptually significant region of the image, spreading the signature over the middle-low frequency coefficients. In such a way an attempt to remove the watermark would cause a strong degradation of the image itself. Only four decomposition steps are performed and the signature is embedded in some frequency bins chosen inside the bands L2 and L3 , highlighted in figure 3. The choice of the frequencies to be altered will be explained in section 4.2; here it is important to remark that we exclude the residual band to make the watermark less perceptible and we do not consider the first high frequencies (bands L1 and L0) to reduce the computational cost of the selection procedure.

4.2 Frequency coefficients selection

A factor of great relevance is the effect that embedded signature has on the original image. The number of frequency coefficients to be modified by the watermark is a very important parameter of the problem because it gives a trade-off between perceptual degradation of the image and robustness against the attacks. The fixed value of 1000 frequency bins to be modified in COX ensures a strong resistance, but it makes the watermark often visible. In order to avoid this drawback we determine the strength of the watermark to be inserted taking into account the perceptual capacity of the image, that is, the ratio between its dimension and the amount of hidden information that can be added. For a good information hiding scheme, it is reasonable to expect that a lower number of coefficients could be modified in homogeneous images, characterized by large regions with few color variations, where the watermark could affect perceptual fidelity; on the contrary, a stronger signature could be impressed inside detailed images, where slight modifications are less visible. Thus, it is necessary to have a measure of how a particular image is suited to receive additional hidden data. A useful measure is the concept of coherence [12]. A signal is coherent with respect to a set of basis functions (i.e. the wavelet functions), if its representation with respect to that set is succinct in the sense that relatively few coefficients in the transform domain have large magnitude. Therefore, in a coherent signal most of the information is concentrated in a few coefficients of the transform domain. The concept of coherence is strictly related to information-carrying capacity, in fact highly coherent signals possess an

inherent large capacity to contain and convey information as opposed to highly incoherent signals, such as white noise, which have little or no capacity to hold information. The concept of coherence has been applied to the noise suppression problem [14]: the noise, considered as incoherence with respect to a set of basis functions, is removed by a thresholding operation that resets the smaller magnitude coefficients. In analogy with this approach we adopt a threshold method to select the coefficient to be modified in the watermark insertion procedure. Consequently, it is expected that a different number of coefficients, depending on the signals degree of coherence, will be modified. The rationale of this scheme lies in the expectations that by embedding the signature in the coherent part of the signal, it is probably less sensitive to noise and it can be removed only at the cost of a deep modification of the original image. A different threshold should be chosen for each image in order to preserve the contribution due to the coherent portion among different images. In fact, by adopting a fixed threshold a large number of coefficients would be modified in images characterized by high frequency values, and a too small number in images with low frequency values. In order to avoid such problems, the threshold has been chosen equal to the average value of the frequency coefficients inside the bands L2 and L3 : = avg L 2 ,L 3

4.3 The encoding function

After selecting the coefficient higher than the threshold we modify their values according to the same insertion formula of the COX scheme: fi*=fi (1 + wi ) As previously discussed, the goals of maximizing the watermark robustness and minimizing its perceptibility are competing objectives. The parameter can be tuned in order to improve performance of one or the other: in fact, by increasing the robustness is improved, while by decreasing more perceptual fidelity to the original is achieved. In figure 2 both a measure of perceptual fidelity to the original (PSNR1) and a measure of robustness (the sim() function) are plotted as functions of . The experiments proved that a fixed value between 0.15 and 0.2 for gives good results both in robustness and in making the watermark indistinguishable for most of the test images. Unfortunately, in cartoon images with
1 PSNR (Peak Signal-to-Noise Ratio) is a measure of similarity between images. Given 2 images f(i,j) and g(i,j) of NM pixels:

PSNR = 20 log

255 RSME

where 255 represents the maximum value of luminance and

RMSE =

1 N M

[g(i, j ) f(i, j )]2

i =1 j =1

N M

large homogeneous regions the signature remains perceptible, while very detailed images could tolerate a more impressive signature. In order to adapt the coding process to different image typologies, a better estimate of the parameter is given by means of the concept of image local variance. The image local variance is a measure of how much the image is detailed, obtained by evaluating the luminance variations characterizing its pixels.
80 70 60 50 40 30 20 10 0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0
sim() PSNR

The watermark recovery process is exactly the inverse of the inserting one and it performs the detection phase by applying the correlation function sim() already introduced in section 3 for the COX method.

5. Experimental results
Experiments are directed to measuring both contrasting quantities that are of direct interest in terms of watermarking performance: Robustness to attacks: the resistance of a watermark to attacks is evaluated by means of the correlation function sim() which gives a confidence value to the effective watermark presence in the image. Perceptual visibility: the distortion produced in the original image by the watermark is calculated by the previously defined PSNR ratio; low values of the PSNR attest high distortion. We have implemented the COX approach and we have compared the performance of the two schemes subjected to some common image distortions: JPEG compression, scaling, cropping, blurring, and sharpening. The test images (256256 gray and color images) have been classified into four groups according to their perceptual characteristics: Detailed images (D): these images are characterized by many details and are more suitable for watermarking, because a more impressive signature can be hidden without degrading the image. Homogeneous images (H): these images are characterized by large zones without color variations and a small amount of details. These are difficult to watermark because the signature is often visible. Normal images (N): these represent most images and they contain both homogeneous regions and details Cartoon images (C): these represent the limit case of homogeneous images; watermarking is very difficult because the watermark has nowhere to hide. Modified bins Watermarked image

:70 

,9072,7

74-:893088 ,3/ ; 8 -

;,7

% 0 ;, :08 5 4990/ - :7 ,99,.

,;0 -003 4-9, 30/ 147 9 0 2, 0 41

8 2

03, 9 0 ;, :0 41 9 0

1:3.9 43 8 ., .: ,90/ ,1907 ,

94 9 0 2, 0

The point local variance for a pixel k is calculated by means of the following formula: d I (x )2 I (x ) xB xB locVk = d2 where B represents a window centered in k with dimensions dd and I(x) represents the luminance value of the pixel x. The number Vs of pixels whose local variance exceeds a fixed threshold (experimentally set to 255) is determined to yield an estimation of as: if < 0.1 0.1 Vs = v = if 0.1 0.5 given NM 0.5 if > 0.5 where N and M are the image dimensions, and v is a weighting factor fixed to 0.45. Figure 3 shows a functional scheme of the method. Original image Local variance
2

calculation Inverse DWT DWT Watermark Insertion

4 level Wavelet transform

 :70   1:3.9 43, 8. 020 41 9 0 30

Coefficients selection Selected bins

209 4/ 147 02-0// 3 , ,9072,7

Watermark
3 , / 9, 2, 0

Several tests have been carried out to prove the efficacy of our method: Test I: robustness analysis. The images chosen are watermarked by 100 different signature. The average PSNR index and the average value of the sim() function after common image distortion are evaluated. Test II: watermark uniqueness. To prove that the algorithm has very low false positive the response of the detector to 100 randomly generated watermarks of which only one is present in the image is shown. Test III: resistance to collusion. A collusion attack is simulated by averaging five versions of an image each watermarked by a different signature. The presence of the five signatures is evaluated on the resulting image also after common image distortions.

30 25 20 Sim() 15 10 5 0 N1 N2 N3 N4 N5 N6 D1 D2 H1 H2 C1 C2 Our Cox

(a)
40 35 30 25 20 15 10 5 0

Test I: robustness analysis

The experimental results in figure 4 show that the proposed method is able to cast watermarks which are resistant to digital filtering, cropping and resizing and JPEG compression for any kind of images. In the case of homogeneous and cartoon images, because of the visibility problems the watermark is embedded with insufficient strength to be resistant to JPEG compression with a parameter of 5% quality. However, this is not a significant limitation because such low quality compression results in very notable distortions of the image, making it unusable.
40 N1 N2 N3 N4 N5 N6 D1 D2 O1 O2 C1 C2
JPEG 20JPEG 10JPEG 5 SHARP BLUR SCALE CROP

PSNR

N1 N2 N3 N4 N5 N6 D1 D2 H1 H2 C1 C2

(b)
 :70 
/ 894790/ ,

Our
090.947 70854380 3 ,-8. 88,  003 9 0 47

Cox
,;07, 0 43 -09 2, 08 3 003 4:7

.42243 ,99,. 8 $ 2 ,7 9

147 9 0

2, 08 -0 43

94 9 0 9089 809 209 4/ ,3/  1:3.9 43 -09 2, 0 147 -49

, .425,7 843 3, ,3/  9 0

20,8:70/ -

9 0 !$# ,9072,7 0/

4:7 209 4/ ,3/ 

Test II: watermark uniqueness

The test consists in embedding a signature inside an image and trying to recover some other watermarks to prove that only the correct one can obtain a positive response from the detection procedure. The search is performed directly on the watermarked image not distorted by attack; however, other experiments on images subjected to distortions give similar results. The watermark detector response to the searching of 100 different watermarks in the Elaine image (marked with seed 20) is shown in figure 6: only the correct watermark obtains a sim() value greater than the threshold .
40 35 30 25 20 15 10 5 0 -5 -1 0 0 10 20 30 40 50 60 70 80 90 ID

30

20

10

0 ORIG

 :70 

;07, 0

/090.947

70854380

,1907

.42243 ,9072,7 8 3 9 0 9 70/ 8 9 0

2, 0 / 89479 438 ,9072,7 0/ 9 0 ,99,. 8 94 -4:3/ 147 9 0 .

3 ,-8. 88,

147 / 1107039

02-0//0/ 3 9 0 9089 2, 08 47 0,.

8 2

2, 0 570; 4:8
sim()

1:3.9 43 8 ., .: ,90/ ;,7

9 0 2, 0 8 8:- 0.90/ % 0 897,

30 7057080398 9 0 ;, :0 41 9 0 9 708 4 / ,9072,7

/090.9 43 1:3.9 43

In figure 5 the performance of our method compared to the COX one shows that the new method is more robust against attacks even with higher values of the PSNR.

 :70 
,9072,7 8 2, 0 ,3/

,9072,7 9 0 

/090.947 70854380 94  / 1107039 ,9072,7 8 02-0//0/ 3 9 0 9089 70,907 9 ,3 9 0 9 708 4 /

, 38 , ;, :0

Test III: resistance to collusion.

The test consists in evaluating detector response for the five different signature in the averaged image. The graph in figure 7a shows that the proposed method is resistant against this type of collusive attacks if the image is not distorted by other transformations. In figure 7b the detector response to our method and the COX one are compared for images subjected to common image distortion: while the COX method often cannot recover the watermark, our method is robust for most tests.
20 15 10 5 0 Sim()

experimental results that the proposed method is robust against common image distortions and image compression which do not degrade the image perceptually. Moreover, the proposed method is able to cast watermarks in any kind of image, included cartoon images, which have a very low perceptual capacity, therefore only a little information can be hidden. Finally the DWT approach proposed in this paper requires a low computational cost with respect to other DCT approaches. Future work will be dedicated to the definition and the experimentation of a public method derived from this private one. Research will focus on the search for some features invariant with respect to a large set of image transformations, where a signature can be embedded and subsequently extracted without requiring a comparison between the marked image and the original one.

References
1 3
Sim ()

(a)
16 14 12 10 8 6 4 2 0

11

13

15

17

19

21

23

25

SH

MED

BL

J20

J10

J05

STR

CR

(b)

Our
, 1742 ,9072,7 9 0 1 789 . ,9072,7 8 9 0

Cox
070 02-0//0/ 3 9 0 2, 0 ,8 -003

 :70
2, 08 -49 -09 4-9, 30/

/090.947 70854380 94  / 1107039 ,;07, 0/

,9072,7 8

090.947 70854380 147 ,3 2, 0 8:- 0.90/ ,3/ , / 89479 43 , .425,7 843 

94 , .4 :8 ;0 ,99,.

003 4:7 209 4/ ,3/ 

6. Conclusions
In this work we have dealt with the problem of inserting a digital watermark in an image for copyright protection and document authentication. We followed the idea of inserting a watermark into most perceptually significant coefficients of the frequency domain. In particular, a sequence of pseudorandom numbers with a gaussian distribution is embedded in selected wavelet coefficients. The contribution of our approach is the idea of making both the length and the strength of the wavelet sequence dependent on the image to be marked, by means of the concepts of perceptual capacity. In such a way a better fidelity of the watermarked image to the original one is achieved, ensuring, at the same time, a strong resistance against attacks. It has been demonstrated by

[1] I. Cox, J. Kilian, T. Leighton and T. Shamoon. Secure Spread Spectrum Watermarking for Multimedia, NEC Research Inst. Tech. Report, 95-10, 1995. [2] I. Cox, M.L. Miller. A review of watermarking and the importance of perceptual modeling. In Proc. of SPIE Human Vision and electronic imaging II, v. 3016, pp92-99, 1997. [3] G. B. Rhoads. Identification/authentication coding method and apparatus. World Intellectual Property Organization, WIPO WO 95/14289, 1995. [4] W. Bender, D. Gruhl, N. Morimoto. Techniques for data hiding. In Proceedings of SPIE, vol. 2420, pp. 40, Feb 1995. [5] G. Caronni. Assuring ownership rights for digital images. In Proceedings Reliable IT System, VIS95. Vieweg Publishing Company, pp. 251-263, 1995. [6] F. M. Boland, J. J. K. Ruanaidh and W. J. Dowling. Watermarking digital images for copyright protection. In IEEE Proceedings on Vision, Signal and Image Processing, v. 143, n. 4, pp. 250-256, 1996. [7] I. Pitas. A method for signature casting on digital images. In Proc. of the International Conference on Image Processing, v. 3, pp 215 - 218, 1996. [8] E. Koch and J. Zhao. Towards robust and hidden image copyright labaleing. In Proc. of IEEE Workshop of Nonlinear Signal and Image Processing, Halkidiki, Greece, 1995. [9] D Kundur and D Hatzinakos. Digital watermarking using multiresolution wavelet decomposition. In International Conference on Acoustic, Speech and Signal Processing (ICASP), Seattle, USA, v 5 pp. 2969-2972, 1998. [10] S. Craver, N. Memon, B. Yeo and M. Yeung. Can Invisible Watermarks Resolve Rightful Ownerships?. IBM Research Report, RC 20509, 1996. [11] M. Barni, F. Bartolini, V. Cappellini and A. Piva, A DCTdomain system for robust image watermarking, Signal Processing, v. 66, n. 3, pp. 357-372, 1998 (Special Issue on Watermarking). [12] A. Teolis. Computational Signal Processing with Wavelets. Birkhauser, 1998. [13] I. Daubechies. Wavelets. Philadelphia. S.I.A.M. 1992. [14] D.L. Donoho, De-noising by soft thresholding, IEEE Trans. Information Theory, v. 41, n. 3, pp. 613-627, 1995.

20

Sim()