7.4.2.1Benchmarking Methods

There are many ways to determine the performance of the watermarking with baseline measurement (benchmarking). In general, the robustness of the watermarking is related to the visibility and payload of the watermarking. For fair evaluation of different watermarking methods, it is possible to first determine certain image data, in which watermark is embedded as much as possible while it does not very much affect the visual quality. Then, the embedded watermark data are processed or attacked, so the performance of the watermarking methods can be estimated by measuring the error ratio. It is seen that the benchmarking for measuring watermarking performance will be related to the selection of the payload, the visual quality measurement process as well the procedure of attack. Here are two typical benchmarking methods.

Robustness Benchmarking In this benchmarking (Fridrich and Miroslav, 1999), the payload is fixed at 1 bit or 60 bits; visual quality measure is adopted from spatial mask model (Girod, 1989). This model is based on the human visual system, and it accurately describes the visual distortion/degradation/artifact (artefact) produced in edge regions and smooth regions. The strength of the watermark is adjusted so that only less than 1% of the pixels can be seen when these pixels have been changed, based on the model above. The selected processing methods and related parameters are listed in Table 7.1; the visual distortion ratio is a function of the relevant process parameters.

Perception Benchmarking In this benchmarking (Kutter and Petitcolas, 1999), the effective payload is fixed to 80 bits; the visual quality metric used is the distortion metric (Branden and Farrell, 1996). This distortion metric considers the contrast sensitivity and the mask characteristic of the human vision system and counts the points over the visual threshold (JND).

7.4.2.2Outside Interferences

There are a variety of outside interferences for images. They can be divided into two categories from the perspective of the robustness of the watermark. The first category consists of the conventional means of image processing (not specifically for watermark), such as sampling, quantization, D/A and A/D conversion, scanning, low-pass filtering, geometric correction, lossy compression, and printing. The ability of image watermarking against these outside interferences is more commonly called the robustness. The second category refers to malicious attack mode (specifically for watermarking), such as illegal detection and decoding of the watermark, resampling, cropping, special displacement, and the scale changes. The ability of watermarking to withstand these outside attacks is commonly measured by anti-attack aptitude.

The attacks to watermark refers to various unauthorized operations, they are often divided into three types:

(1)Detection: For example, a user of watermark product tries to detect a watermark that only the owner has the right to do, which is also called passive attacks.

(2)Embedding: For example, a user of watermark product tries to embed a watermark that only the owner has the right to do, which is also called forgery attack.

(3)Deletion: For example, a user of watermark product tries to delete a watermark that only the owner has the right to do, which is also called removing attack that can be further divided into eliminating attack and masking attack.

Several types of the above attacks may also be used in combination. For example, first to remove existing watermark from products and then to re-embed other watermarks needed, which is also called changing attack.

The so-called watermark attack analysis is to design methods to attack the existing watermarking system, in order to test its robustness. The purpose of the attack is to make the corresponding watermarking system from correctly restoring watermark or make the detecting tool from detecting the presence of the watermark. By analyzing the weaknesses and vulnerability of system, it is possible to improve the design of watermarking systems.

There is a simulation tool called StirMark, which is a watermark attack software. People can use it to evaluate the different anti-attack capability of watermarking algorithms, by inspecting whether the watermark detector can extract or detect watermarks from watermark carrier that has suffered attacks. StirMark can simulate many kinds of processing operations and various means of attack, such as geometric distortion (stretching, shear, rotate, etc.), nonlinear A/D and D/A conversion, print out, scan, and resampling attacks. In addition, StirMark can also combine a variety of processing operations and means of attack to form a new kind of attack.

7.4.3.1Meaningless Watermarking in DCT Domain

Two tests using Lena image are carried out.

Robustness Test Several common image processing operations and interferences are tested with the watermarking algorithm presented in Section 7.2.1. Figure 7.9 shows several results obtained for watermarked Lena image. Figure 7.9(a) is the result of mean filtering with mask of size 5 × 5 (PSNR = 21.5 dB). Figure 7.9(b) is the result of 2: 1 subsampling in both the horizontal and vertical directions (PSNR = 20.8 dB). Figure 7.9(c) is the result of compression by retaining only the first four DCT coefficients (PSNR = 19.4 dB). Figure 7.9(d) is the result of adding white Gaussian noise (PSNR = 11.9 dB, the effect of noise is quite obvious). Under these four situations, the images all have exceedingly distortion, but the watermark can still be accurately detected out.

Uniqueness Test Given a random sequence as the watermark, other sequences generated by the same probability distribution could also be taken as watermarks. According to this idea, 10,000 random sequences are generated from a Gaussian distribution N(0, 1), taking one of them as a (real) watermark and all others as fake watermarks for comparison. The test results of mean filtering, subsampling, and compression processing are shown in Table 7.2. Since the differences between the real watermark and the results obtained with fake watermark are very significant (correlation values are quite distinct), the real watermark and the fake watermark can easily be distinguished.

7.4.3.2Meaningful Watermarking in DCT Domain

In addition to the use of Lena image, the performance test of the meaningful watermarking algorithm presented in Section 7.2.2 also uses two other images: the Flower and the Person, respectively, as shown in Figures 7.10(a) and (b).

Three tests are carried out.

Robustness Test against Mean Filtering A sequence of eight symbols is embedded in each test image. Masks of 3 × 3, 5 × 7 are used, respectively. Figure 7.11 gives a few of the filtering results. Figures 7.11(a) and (b) are for Lena image with masks of 5 × 5 and 7 × 7, respectively. Figures 7.11(c) and (d) are for Flower image with masks of 5 × 7, respectively.

Table 7.2: Test results on the uniqueness of watermark.

Detection of meaningful watermark needs not only to extract all symbols but also to detect correctly the position of each symbol. Table 7.3 gives the corresponding test results, the number of correct symbols (# Correct) here refers to both the correct symbols and the correct position. In each case, the peak signal-to-noise ratio (PSNR) of watermarked images after low-pass filtering is also provided to give an indication of the quality of the image.

It is seen from Figure 7.11 and Table 7.3 that with the increase in the size of the mask, the image becomes more blurred, and the ability of watermark to resist mean filtering drops, too. Since the details of Lena image and Flower image are less than the details of Person image, so after filtering with 5 × 5 mask, all watermark symbols can still be detected, but at this time the watermark symbols embedded in the Person image could not be correctly detected.

Table 7.3: Robustness test results of mean filtering.

Robustness Test against Subsampling A sequence of eight symbols is embedded in each test image. Three kinds of subsampling rate (both in the horizontal and vertical directions) are considered here: 1:2 subsampling, 1:4 subsampling, and 1:8 subsampling. Figure 7.12 gives the results of the several subsampling process, in which Figures 7.12(a) and (b) are the partial view of Lena image after 1:2 and 1:4 subsampling, respectively; Figures 7.12(c) and (d) are the partial view of Person image after 1:2 and 1:4 subsampling, respectively. Comparing two groups of images, the subsampling has more influence on Person image than on Lena image.

Table 7.4 lists the corresponding test results. In various situations, the peak signal-to-noise ratio (PSNR) of the watermarked images after subsample is also listed in order to give an indication of the quality of the image. Compared to the cases of mean filtering, the subsampling leads to a more serious distortion of the image.

Robustness Test against JPEG Compression In this experiment, the sequence size of embedded symbols varies from 1 to 128, for each test images. Table 7.5 gives the corresponding test results. Values given in the table is the lowest value of an image PSNR at which the entire sequence of watermark symbols can be correctly detected. As can be seen from Table 7.5, the length of sequence of symbols embedded is related with the image PSNR. Since the dimension of the matched filter is automatically adjusted, so for the sequence of symbols of different lengths, the noise level that can be tolerated is also different.

Table 7.4: Robustness test results of sub-sampling.

Table 7.5: Robustness test results of JPEG compression (dB).

7.4.3.3Watermarking in DWT Domain

The robustness test for the wavelet domain watermarking algorithm described in Section 7.3 still uses Lena image. The resistance of watermark embedded to some image processing processes and attacks is shown in Table 7.6, if the decision threshold is set to 0.2, all the symbols of watermark can be detected correctly according to the normalized correlation coefficients.

7.5.2.1Image Blending

Let carrier image be f(x, y), the hidden image be s(x, y). Suppose α is a real number satisfying 0 ≤ α ≤ 1, then the image

$b\left(x,y\right)=\alpha f\left(x,y\right)+\left(1-\alpha \right)s\left(x,y\right)\left(7.28\right)$

is the result of blending images f(x, y) and s(x, y) with parameter α, which is called a trivial blending when α is 0 or 1.

A blending example of two images is shown in Figure 7.13, in which Figure 7.13(a) is the carrier image (Lena image) and Figure 7.13(b) is the hidden image (Girl image). Taking α = 0.5, the blending image in as Figure 7.13(c).

From the perspective of camouflage, the image obtained by blending should not be different in the visual sense with carrier image. According to the definition of the image blending, when the parameter α is close to 1, the image b(x, y) will be close to f(x, y); when the parameter α is close to 0, the image b(x, y) will be close to s(x, y). This allows the utilization of human visual characteristics for better hiding one image into another image. Hidden images can be restored by the following formula:

$s\left(x,y\right)=\frac{b\left(x,y\right)-\alpha f\left(x,y\right)}{1-\alpha }\left(7.29\right)$

For digital images, some errors in rounding will be produced during the calculation and recovery process, and this induces the drop of quality of restored image. This error is dependent on the two images themselves and the blending parameter. When two images were given, this error is only the function of parameter α . This error can be measured by the root-mean-square error between two images. In Figure 7.14, the function curves of rounding error versus the parameter α(left for blended image, right for restored image) are given, where Figures 7.13(a) and (b) are taken as carrier image and hidden image, respectively (Zhang et al., 2003).

It is seen from Figure 7.14 that the more the parameter α approaches 1, the better the effect of image hiding, but the worse of the quality of restored image. On the contrary, if the better quality of restored image is required, then the parameter α could not approach 1; however, the effect of image hiding would not be good. Therefore, there must be a best blending parameter value that can make the sum of errors from blended image and from restored image to be a minimum, this is shown by the valley in the curve of Figure 7.15.

In summary, the general principles of image hiding are selecting first the carrier image that resemble the image to be hidden as close as possible, then selecting the blending parameter as small as possible in the permitted visual range. In this way, the quality of the restored image could be ensured.

7.5.2.2Iterative Blending with Single Image

Extending the above procedure, it is possible to obtain the iterative blending of images by using several blending parameters with a number of times.

Suppose $\left\{{\alpha }_l|.\le {\alpha }_l\le 1,i=1,2,\dots ,\mathrm{N}\right\}$ are N given real numbers, blending image f(x, y) and image s(x, y) with parameter α1 gives b1(x, y) = α1f(x, y) + (1 – α1)s(x, y), blending image f(x, y) and image b1(x, y) with parameter α2 gives b2(x, y) = α2f(x, y) + (1 – α2)b1(x, y), . . ., continuing this procedure can obtain bN(x, y) = αNf(x, y) + (1 – αN)bN–1(x, y), and image bN(x, y) can be called N-fold iterative blend image with respect to {αi, i = 1, ..., N}. It can be proved that in no-trivial cases, image bN(x, y) will monotonically be converged to the carrier image f(x, y):

$\underset{\mathrm{N}\to \infty }{\lim }{b}_{\mathrm{N}}\left(x,y\right)=f\left(x,y\right)\left(7.30\right)$

Figure 7.16 presents some examples of using the above iterative algorithm for image hiding and restoration, in which the images of Figures 7.13(a) and (b) are taken as carrier image and hiding image, respectively. In Figure 7.16, the up line images are blending results with 1, 2, and 3 iterations (the blending parameters are 0.8, 0.7, and 0.6), respectively; the bottom line images are the hiding images restored from corresponding blend images. The related parameters and error data are listed in Table 7.8, with RMSE stands for root-mean-square error.

7.5.2.3Iterative Blending with Multiple Images

The above algorithm of image blending and algorithm of iterative blending with single image embedding both a secret image in only one carrier image. If the attacker does intercept the carrier image and blend image, and does have some doubt, then the attacker would restore the secret image with the help of the original carrier image by subtraction. The security of such a hiding system is completely dependent on only one carrier image, so it is relatively fragile. In order to solve this problem, the idea of image blending can be extended to use multiple blending parameters and also multiple carrier images to hide a single secret image, which is called the iterative blending with multiple images.

Table 7.8: Parameters and error data of iterative blending with single image.

Let fi(x, y), i = 1, 2, . . ., N be a group of carrier images, s(x, y) be a secret image, {αi|0 ≤ ${\alpha }_l\le 1,i=1,2,\dots ,\mathrm{N}\}$ be N given real numbers. Blending image f1(x, y) and image s(x, y) with the parameter α1 gives b1(x, y) = α1f1(x, y) + (1 – α1)s(x, y), Blending image f2(x, y) and image b1(x, y) with the parameter α2 gives b2(x, y) = α2f2(x, y) + (1 – α2)b1(x, y), continuing this procedure can obtain bN(x, y) = αNfN(x, y) + (1 – αN)bN–1(x, y). The image bN(x, y) is called N-fold iterative blend image with respect to parameters {αi, i = 1, . . ., N} and images {fi(x, y), i = 1, . . ., N}.

According to the definition of iterative blending with multiple images, it is possible to obtain an image hiding scheme, which blend a secret image into multiple carrier images iteratively with the help of masking properties of human visual system. To restore such a secret image, it is required to use N blend images and N blend parameters, and to know the blend order of these images. Therefore, this scheme of iterative blending with multiple images is a quite safe one.

One example of iterative blending with multiple images is shown in Figure 7.17. In the hiding process, the image Couple in Figure 7.17(c) is hided in the image Girl in Figure 7.17(b) with blend parameter α2 = 0.9, the result image is further hided in the image Lena in Figure 7.17(a) with blend parameter α1 = 0.85. In this example, Figure 7.17(a) is the open image, Figure 7.17(b) is the image with intermediate result, and Figure 7.17(c) is the hiding image.