1.1.1 Visual Cryptography

The main instantiation of VC realizes a cryptography protocol called secret sharing (SS). In a conventional SS scheme, a secret image is shared among n participants in such a way that subsets of qualified participants can pull their shares and recover the secret but subsets of forbidden participants can obtain no information about it. Here, both the sharing phase and the reconstruction phase involve algorithms that are run by computers (specially, a dealer runs a distribution algorithm and a set of qualified parties can run a reconstruction algorithm). The surprising novelties of a VSS scheme are in representing data as images and in an elementary realization of the reconstruction phase, consisting of just viewing the image obtained after stacking transparencies. VSS schemes inherit all applications of conventional SS schemes; most notably, access control. As an example, consider a bank vault that must be opened everyday by five tellers, but for security purposes it is desirable not to entrust any two individuals with the combination. Hence, a vault-access system that requires any three of the five tellers may be desirable. This problem can be solved using a 3-out-of-5 threshold scheme. In addition to access control, VSS schemes can be applied to a number of other cryptographic protocols and applications using conventional SS, such as threshold signatures, private multiparty function evaluation, electronic cash, and digital elections.

Another quite intriguing instantiation of VC schemes realizes VSS with innocent-looking images as shares. This version of VSS has applications to a multiparty variant of steganography. In a steganography scheme, a user A sends an innocent-looking image to another user B, in such a way that B can recover some hidden images, but no observer of the communication between A and B even suspects that the communication contains some hidden images. In a multiparty variant of conventional steganography schemes, a user A sends innocent-looking images to users, B₁, …, B_m in such a way that qualified subsets of the recipients can recover some hidden image, but no observer of the communication between A and B₁, …, B_m even suspects the existence of hidden images. Interestingly, a version of VSS with innocent-looking images as shares can implement this steganography variant. In practice, however, both regular VSS and VSS with innocent-looking images work by expanding a single pixel of an image into multiple pixels, with consequences on image quality. It is indeed of great interest to design schemes achieving high image quality. Although the literature has paid a significant amount of attention to VSS, some different paradigms of VC have also been studied, giving rise to visual versions of other types of cryptographic protocols.

1.1.2 Halftone Visual Cryptography

Traditional VC constructions are exclusively based on combinational techniques. In the halftoning framework of VC, a secret binary image is encrypted into high-quality halftone images, or halftone shares. In particular, this method applies the rich theory of blue noise halftoning to the construction mechanism used in conventional VSS schemes to generate halftone shares, while the security properties are still maintained. The decoded secret image has uniform contrast. The halftone shares carry significant visual information to the reviewers, such as landscapes, buildings, etc. The visual quality obtained by the new method is significantly better than that attained by any available VSS method known to date. As a result, adversaries, inspecting a halftone share, are less likely to suspect that cryptographic information is hidden. A higher security level is thus achieved [26, 23].

1.1.3 Blue Noise Error Diffusion

Among all blue noise halftoning algorithms, error diffusion is a simple, yet efficient algorithm to halftone a grayscale image. The quantization error at each pixel is filtered and fed back to a set of future input samples. Figure 1.1 shows a binary error diffusion diagram where f(m, n) represents the (m, n)th pixel of the input grayscale image, d(m, n) is the sum of the input pixel value and the “diffused” past errors, and g(m, n) is the output quantized pixel value [12, 16]. Error diffusion consists of two main components. The first component is the thresholding block where the output g(m, n) is given by:

The threshold t(m, n) can be position-dependent. The second component is the error filter h(k, l) whose input e(m, n) is the difference between d(m, n) and g(m, n). Finally, we can compute d(m, n) as:

As an example, the widely used Floyd-Steinberg error filter is shown in Figure 1.2 where • indicates the current pixel. The weights of the filter are given by: h(0,1) = 7/16, h(1, −1) = 3/16, h(1, 0) = 5/16 and h(1, 1) = 1/16.

The recursive structure of the block diagram shown in Figure 1.1 indicates that the quantization error e(m, n) depends not only on the current input and output but also on the entire past history. The error filter is designed in such a way that the low frequency difference between the input and output image is minimized. The error that is diffused away by the error filter is high frequency or “blue noise” in nature, leading to visually pleasing halftone images for human vision [12, 13, 7]. As will be described in this chapter, all the shares in the introduced halftone visual cryptography (HVC) methods are generated by a constrained error diffusion based on the algorithm introduced above.

For the HVC construction methods to be introduced shortly, it is necessary to generate mutually exclusive sets of pixels. To this end, the method of error diffusion is modified so as to produce multitone output pixels where the pixels of each tone are assigned to a pixel set. Multitone error diffusion is obtained by simply replacing the thresholding block by a multilevel quantization block in halftone error diffusion. The number of output levels of the quantization block is the same as the number of tones of the multitone image [15]. Multitone error diffusion can generate multitone images where the pixels of each tone are homogeneously distributed. The multitone error diffusion algorithm proposed in [4] is used here for the generation of mutually exclusive pixel sets. This algorithm jointly optimizes the distribution of multitone pixels by locating the pixels of different tones in a correlated fashion so that the mutual interference between different tones is minimized and multitone pixels are well separated from each other. Refer to [4] for details.

1.2.1 Notion and Formal Definitions

To illustrate the principles of VSS, consider a simple 2-out-of-2 VSS scheme shown in Figure 1.3. Each pixel p taken from a secret binary image is encoded into a pair of black and white subpixels in each of the two shares. If p is white/black, one of the first/last two columns tabulated under the white/black pixel in Figure 1.3 is selected. The selection is random such that each column is selected with a 50% probability. Then, the first two subpixels in that column are assigned to share 1 and the following two subpixels are assigned to share 2. Independent of whether p is black or white, p is encoded into two subpixels of black-white or white-black with equal probabilities. Thus, an individual share gives no clue as to whether p is black or white [26, 25]. Now consider the superposition of the two shares as shown in the last row of Figure 1.3. If the pixel p is black, the superposition of the two shares outputs two black subpixels corresponding to a gray level 1. If p is white, it results in one white and one black subpixel, corresponding to a gray level 1/2. Then by stacking two shares together, we can obtain the full information of the secret image.

Figure 3.24 shows an example of the application of the 2-out-of-2 VSS scheme. Figure 1.4(a) shows a secret binary image SI to be encoded. According to the encoding rule shown in Figure 1.3, each pixel p of SI is split into two subpixels in each of the two shares, as shown in Figure 1.4(b) and Figure 1.4(c). Superimposing the two shares leads to the output secret image shown in Figure 1.4(d). The decoded image is clearly identified, although some contrast loss occurs. The width of the reconstructed image is twice that of the original secret image since each pixel is expanded to two subpixels in each share.

The 2-out-of-2 VSS scheme demonstrated above is a special case of the k-out-of-n VSS scheme [19]. Ateniese et al. designed a more general model for VSS schemes based on general access structures [2]. An access structure is a specification of all the qualified and forbidden subsets of shares. The participants in a qualified subset can recover the secret image while the participants in a forbidden subset cannot. Formal definitions of VSS are presented below.

Let P = {1, · · · , n} be a set of elements called participants. A visual secret sharing scheme for a set P of n participants is a method to encode a secret binary image SI into n shadow images called shares, where each participant in P receives one share. Let 2^P denote the set of all subsets of P and let Γ_Qual ⊆ 2^P and Γ_Forb ⊆ 2^P, where Γ_Quaι ∩ Γ_Forb = ∅. We refer to members of Γ_Qual as qualified sets and call members of Γ_Forb forbidden sets. The pair (Γ_Qual, Γ_Forb) is called the access structure of the scheme [2].

Any qualified set of participants X ∈ Γ_Qual can visually decode SI, but a forbidden set of participants Y ∈ Γ_Forb has no information of SI [2, 3]. A visual recovery for a set X ∈ Γ_Qual consists of xeroxing the shares given to the participants in X onto transparencies and then stacking them together. The participants in X are able to observe the secret image without performing any cryptographic computation. VSS is characterized by two parameters: the pixels expansion γ, which is the number of subpixels on each share that each pixel of the secret image is encoded into, and the contrast α, which is the measurement of the difference of a black pixel and a white pixel in the reconstructed image [5].

For each secret binary pixel p that is encoded into γ subpixels in each of the n shares, these subpixels can be described as an n × γ Boolean matrix M, where a value 0 corresponds to a white subpixel and a value 1 corresponds to a black subpixel. The ith row of M, r_i, contains the subpixel values to be assigned to the ith share. The gray level of the reconstructed pixel p, obtained by superimposing the transparencies in a participant subset X = {i₁, i₂, ••• ,i_s}, is proportional to the Hamming weight w(v) of the vector v=OR(ri1,ri2,⋯ri2), where ri1,ri2,⋯ri2 are the corresponding rows in the matrix M [26, 25].

Definition 1 Let (Γ_Qual, Γ_Forb) be an access structure on a set of n par- ticipants. Two collections of n × γ Boolean matrices C₀ and C₁ constitute a VSS scheme if there exists a value α(γ) and value t_X for every X in Γ_Qual satisfying [3]:

1. Contrast condition: any (qualified) subset X = {i₁, i₂, · · · , i_u} ∈ Γ_Qual of u participants can recover the secret image by stacking the corresponding transparencies. Formally, for a matrix M ∈ C_j, (j = 0, 1) the row vectors vj(X,M)=OR(ri1,ri2,⋯riu). It holds that: w(v₀(X, M)) ≤ t_X − α(γ) · γ for all M ∈ C₀ and w(v₁(X, M)) ≥ t_X for all M ∈ C₁. α(γ) is called the relative difference referred to as the contrast of the decoded image and t_X is the threshold to visually interpret the reconstructed pixel as black or white.

2. Security condition: Any (forbidden) subset X = {i₁, i₂, · · · , i_v} ∈ Γ_Forb has no information of the secret image. Formally, the two collections D_j(j = 0, 1), obtained by extracting rows i₁, i₂, · · · , i_v from each matrix in C_j, are indistinguishable.

1.2.2 Construction of VSS Scheme

If the given secret pixel p is black (white), the matrix M is randomly selected from matrices collections C₁ (C₀). The matrix collections can be obtained by permuting the columns of the corresponding basis matrix S₀ or S₁ in all possible ways [3]. The basis matrices are defined below.

Definition 2 Two matrices S₀ and S₁ are called basis matrices, if S₀ and S₁ satisfy the following tow conditions [3]:

1. Contrast condition: If X = {i₁, i₂, ... , i_u} ∈ Γ_Qual, the row vectors v₀ and v₁ , obtained by performing OR operation on rows i₁, i₂, ... , i_u of S₀ and S₁ respectively, satisfy w(v₀) ≤ t_X − α(γ) · γ and w(v₁) ≥ t_X.

2. Security condition: If X = {i₁, i₂, ... , i_v} ∈ Γ_Forb, one of the two v × γ matrices, formed respectively by extracting rows i₁, i₂, ... , i_v from S₀ and S₁, equals to a column permutation of the other.

The algorithm to construct the basis matrices for a given VSS scheme can be found in [2, 5]. See [5] for the construction algorithm of basis matrices that leads to the best contrast. As an example, the S₀ and S₁ in a 2-out-of-2 scheme are shown below:

S₀ corresponds to the encoding of a white secret pixel and S₁ corresponds to the encoding of a black secret pixel.

1.3.1 Share Structure

The first step in constructing a halftone VSS scheme is to construct the underlying k-out-of-n VSS scheme where a secret image pixel is encoded into γ pixels in each share. γ is the VSS pixel expansion and only a function of (k, n). Furthermore, in halftone VSS, a share image is divided into nonoverlapping halftone cells of size q = v₁ × v₂ where q > γ. A secret image pixel is encoded into one halftone cell in each share. Within the q pixels in a halftone cell, only γ pixels called secret information pixels (SIPs) actually carry the secret information. Here γ is exactly the VSS pixel expansion. Since γ SIPs are not designed to carry share visual information, q ≥ 2γ is desirable for good share image quality.

It is required that when all qualified shares are stacked together, only the secret visual information is revealed. Thus, besides SIPs, auxiliary pixels that are forced to be black (value 1) are also introduced. These pixels are called auxiliary black pixels (ABP). In each halftone cell, there are x ABPs. ABPs are deliberately introduced into the shares so that some ABPs on one share block the visual information of the other shares. Thus, when qualified shares are stacked together, only the secret visual information is revealed on the reconstructed image as a result of the OR operation. In each halftone cell, the remaining q – γ – x pixels that are neither SIPs or ABPs are assigned to carry the visual information of the shares.

An example of the halftone cells in a 2-out-of-2 scheme is shown in Figure 1.5 where the 1st and 2nd pixels in each cell are SIPs. The 3rd pixel in share 1 and the 4th pixel in share 2 are ABPs. When stacking two shares together, the result is a white pixel with contrast 1/4. The 4th pixel in share 1 and the 3rd pixel in share 2 are assigned values to carry visual information of the shares. They can take a value of 0 or 1, which will not affect the decoded image.

There should be a sufficient number of ABPs in the shares so that the visual information of one share is completely blocked by the ABPs on the other shares. Since the ABPs are not designed to carry visual information, the number of ABPs in a share is to be minimized as follows. Let p(i, j) = [p₁(i, j), p₂(i, j),… ,p_n(i, j)]^T be the vector where p_l(i, j) is the (i, j)th pixel of share l. If the (i, j)th pixel is non-SIP, there should be at least n − k +1 ABPs in p(i, j) so that any k entries selected from p(i, j) contain at least one ABP. In each halftone cell, there are q − γ non-SIPs. Thus, the optimal number of ABPs in a halftone cell is:

where [ ] returns the smallest integer that is no less than the argument.

To understand how the x ABPs are arranged in a halftone cell, we introduce a configuration matrix T to describe the q − γ non-SIPs. In the matrix T, only the values of ABPs are defined. In a k-out-of-n scheme, T is of size (q − γ) − n where one row corresponds to one share. There are x ABPs assigned to each row. The ABPs in each row should have minimal overlap with ABPs on the other rows. The construction of the matrix T is as follows. First, x ABPs are placed on the first row from the first to xth column. Then another x ABPs are placed on the second row from the (x + 1)th column to the (2x)th column. If 2x > q − γ, then the ABPs are placed from the (x + 1)th column to the last column and then from the first column to the (2x − q + γ)th column. The x ABPs on other rows are placed sequentially in the same way.

For the 2-out-of-2 example above, the configuration matrix T for the 2 non-SIPs is:

where 1 indicates ABP that has value 1 and Δ indicates an undefined pixel. The corresponding non-SIPs are then assigned values to carry the share visual information through the error diffusion. Each row of T is assigned to each share. It can be seen that when we stack 2 halftone shares together, all the non-SIPs result in black.

As another example, consider a 2-out-of-3 halftone VSS scheme where a secret image pixel is encoded into a halftone cell of size q = 12. The number of SIPs is γ = 6. By Eqn. 1.4, the optimal number of ABPs is x = 4. Thus, the configuration matrix T of the 6 non-SIPs is given by:

From the content of T, it is concluded that 1/3 of the pixels on a share will be ABPs.

1.3.2 Distribution of SIPs and ABPs

The locations of the SIPs do not depend on the share images or the secret image, but only on the HVC expansion q and the underlying VSS scheme. Thus, the distribution of SIPs can be generated prior to the generation of halftone shares. For security purposes, the SIPs should be randomly distributed. To achieve good image quality, it is also desirable to distribute the SIPs homogeneously so that one SIP is maximally separated from its neighboring SIPs. Since the SIPs are maximally separated, the quantization error caused by an SIP will be diffused away before the next SIP is encountered leading to visually pleasing halftone shares. Similarly, the distribution of ABPs can also be determined a priori. As SIPs, ABPs should be distributed as homogenously as possible and maximally separated from each other. Since there is a strong correlation between the distribution of SIPs and the distribution of ABPs, the distributions of SIPs and ABPs should be optimized jointly to avoid low frequency spectral interference among them [4]. The SIPs and ABPs should also be maximally separated from each other. The jointly optimized distributions of SIPs and ABPs are generated based on a method of blue noise multitoning as follows [4].

We first construct a constant grayscale image with gray level g=∑i=0wgizi, where g_i is a tone arbitrarily chosen between 0 and 1 and g_i ≠ g_j for i ≠ j. z_i is the pixel density for the pixels with tone g_i. The value of z_i, together with w, depends on q, γ and the structure of the configuration matrix T. By using the blue noise multitone error diffusion, an output image with w +1 tones is produced. The distribution of pixels with tone g_i indicates a pixel distribution denoted by Z_i. Let z₀ = γ/q, then Z₀ indicates the distribution of SIPs. The distribution of ABPs in a share is a subset of {Z_i}, i = 1,…, w.

An example following the previous 2-out-of-3 halftone VSS example is used to illustrate how to set z_i, g_i, and w, where a secret image pixel is encoded into a halftone cell of size q = 12. Among the q pixels, γ = 6 SIPs are characterized by basis matrix S₀ or S₁; q − γ = 6 non-SIPs are characterized by the configuration matrix T. Thus, the matrix R_i, i = 0,1, is constructed below for the q pixels:

where each row corresponds to q pixels in one share. The □ indicates the SIPs that are determined by S_i. Columns of R_i are partitioned into several sets Z_i, where the columns with the same configuration are assigned to the same set. As shown in (1.7), columns are partitioned into 4 sets Z_i, i = 0,1,…, 3. The set Z₀ denotes the distribution of SIPs and contains 1/2 of all the pixels. The non-SIPs of each share are partitioned between set Z₁, Z₂, and Z₃, where each set contains 1/6 of all the pixels. Thus, to generate Z_i on the share, we can set the parameters for the multitone error diffusion as follows: w = 3, z₀ = 0.5, and z₁ = z₂ = z₃ = 1/6. The corresponding tone is arbitrarily chosen as: g₀ = 0, g₁ = 0.3, g₂ = 0.6, and g₃ = 0.9. By using the algorithm proposed in [4], we obtain homogenous distributions Z_i, i = 0, 1, . . . , 3. The combination of Z₁ and Z₂ is the distribution of ABPs of share 1; the combination of Z₂ and Z₃ is the distribution of ABPs of share 2; and the combination of Z₁ and Z₃ is the distribution of ABPs of share 3, as shown in (1.8)

As an example, assume the share has size 6 × 8 and is partitioned into 4 halftone cells of size 3 × 4, each cell corresponding to one secret image pixel. Within each cell, there are 6 SIPs and 4 ABPs. Suppose the generated distributions Z_i, i = 0, 1, . . . , 3 are shown on the up-left image in Figure 1.6. Then, as also shown in Figure 1.6, the distributions of SIPs and ABPs of each share are determined based on Z_i. Note that without knowing what values the ∆s carry, any two shares can be stacked together to decode the secret image pixels.

Notice that we may not be able to generate an exact number of pixels as desired for sets Z_i, i = 0, 1, 2, 3. However, for ABPs, as long as the membership of ABPs to the sets Z_i indicated in (1.8) is maintained, a slight deviation from its desired number of pixels for Z_i, i = 1, 2, 3 is allowable. The contrast condition of image decoding is still maintained. Such a point can be clearly illustrated in Figure 1.7 where the composition of each share is shown. It is clear that the relative size of Z_i, i = 1, 2, 3 is not important.

However, the distribution of SIPs, denoted by Z₀, needs to be refined to guarantee that there are exactly γ SIPs in each halftone cell. Each halftone cell is checked to find out the number of pixels belonging to Z₀. Assume the number is τ. In most cases, τ = γ and no operation is needed. If τ < γ, then γ − τ pixels within the current cell are selected and removed from sets Z_i, i ≠ 0 and assigned to Z₀. The pixels are added one by one in such a way that each newly added pixel is maximally separated from other pixels belonging to Z₀ within that halftone cell. If τ > γ, then within that halftone cell, γ − τ pixels belonging to Z₀ are randomly selected and removed from Z₀. For each removed pixel, a pixel set is randomly selected from {Z_i}, i ≠ 0 and the removed pixel is added to that set. After such a procedure, there are exactly γ SIPs in each halftone cell and most of the SIPs are well separated from each other.

The configuration matrix helps to generate the distribution of ABPs. It should be noted that there is no need to find out the exact x ABPs in each halftone cell. The number x only characterizes the local density of the ABPs. We also only need to ensure that the contrast condition of the image decoding is satisfied.

1.3.3 Generation of Halftone Shares via Error Diffusion

After the distributions of SIPs and ABPs are generated, the next step is to assign the values to all the SIPs. This procedure only depends on the underlying VSS scheme. Under the k-out-of-n VSS scheme, the basis matrices S₀ and S₁ are constructed first. Then we construct the matrix collections C₀ and C₁ from the basis matrices. For each γ SIPs of a halftone cell, a matrix M is randomly selected from C₀ or C₁ depending on the value of the corresponding secret image pixel p. The SIPs in the ith share are then replaced with the ith row of M. s_ij, the jth SIP in share i, is set as: s_ij· = M(i, j). For the ABPs, they are assigned value 1 (black). Thus, the locations and the values of the SIPs and ABPs are set before halftone shares are actually generated. As it will be described below, the pixels other than ABPs and SIPs are assigned freely to carry the share visual information.

Once the assignments of the SIPs and ABPs are determined, a halftoning algorithm, such as error diffusion and direct binary search (DBS) [1], can be employed to produce the halftone shares from grayscale images. Error diffusion is used in our method as it is a computationally efficient way to generate halftone shares. The basic computation required is linear filtering followed by quantization.

The process of generating halftone shares via error diffusion is shown in Figure 1.8, where the values of the SIPs and ABPs are preset. To produce the halftone share i, a grayscale image is provided. Let f_i(m, n) be the (m, n)th pixel of the grayscale image, then the input to the threshold block is:

where h(k, l) ∈ H and H is a two dimensional error filter. Here 0 < α ≤ 1 is an error diffusion constant that can be tuned to avoid instability in error diffusion [24]. A α < 1 means that not all quantization errors are diffused, which can prevent instability under excessive quantization errors. e_i(m, n) is the quantization error at point (m, n). Assume the threshold for the error diffusion is t_i(m, n), then the output halftone pixel g_i(m, n) is 1, if d_i(m, n) > t_i(m, n); or 0, if d_i(m, n) ≤ t_i(m, n). The quantization error e_i(m, n) is given by:

The above procedure is applied only when g_i(m, n) is not a SIP or an ABP. Otherwise, instead of simple thresholding, the value of the output pixel g_i(m, m) is set equal to the value of the corresponding predetermined SIP or ABP and the error e_i(m, n) is calculated as the difference between the input to the thresholding block and the SIP or ABP value. Since the SIPs and ABPs are separated from each other, the quantization error caused by the introduction of the SIPs and ABPs is diffused away to the neighboring grayscale pixels, as illustrated in Figure 1.8, and will not accumulate to cause visible distortion. In this way, the SIPs and ABPs are seamlessly embedded into the halftone shares generated and the halftone share is structured taking meaningful visual information.

Much like the methods in [26, 25], the above procedure can be extended to an arbitrary access structure (Γ_Qual, Γ_Forb). The security of the introduced halftone VSS scheme is guaranteed by the properties of the underlying visual secret sharing scheme.

1.6.1 Improvement of Image Quality

As stated previously, the quality index s heavily affects the image quality of the halftone shares. A large s leads to visually pleasing halftone shares, but it also introduces higher contrast loss in the reconstructed images. The error filter employed in the error diffusion also affects the image quality of the shares. For example, an error filter with longer weights leads to a sharper contrast in the halftone image [20, 14]. Another factor that affects the image quality is the position-dependent threshold in the thresholding block. To achieve a visually more pleasing halftone image, output-dependent threshold modulation can be used in the error diffusion to spread the minority pixels as homogeneously as possible and suppress some unwanted textures [6]. For various methods that can improve the halftone image by error diffusion, refer to [20, 6, 17, 21], etc.

Error diffusion is employed as the halftoning algorithm to generate halftone shares since error diffusion is able to generate a visually pleasing halftone image with simple computation. However, other halftoning algorithms can also be applied to the second method to generate halftone shares. The DBS algorithm can be used to generate a high quality halftone image but with significant computation [1]. Note that the DBS algorithm for multitoning can also be used to generate the distributions of SIPs and ABPs.

1.6.2 Comparison with Other Methods

To evaluate the performance of the introduced methods, it is illustrative to compare our methods with VC and extended visual cryptography (EVC) [3]. VSS can be treated as a special case in our methods for s = 0, which means that no visual information is carried by the share. In EVC, shares carry visual information and there is a tradeoff between the contrast of the reconstructed image and the contrast of the share image. This tradeoff is similar to the tradeoff between the contrast of the reconstructed image and the image quality of the halftone shares in our methods. However, the shares generated by EVC is basically based on pixels expansion. Thus, EVC is unable to generate shares that can show fine details.

1.6.3 Image Decoding

In the methods introduced in this chapter, a large HVC expansion is desirable to make s large. But the contrast loss of the decoded image is severe when the HVC expansion is large. However, a low contrast does not hinder the decoding of the secret image if the decoding can be performed digitally. Initially shares are supposed to be xeroxed on transparencies and decoding of the secret image involves stacking the shares physically. However, both the distribution of the shares and decoding of the secret image can be performed in a digital way where the decoding rule remains the same (OR operation). The human visual system is still the ultimate tool to identify the secret image.

The robustness of the introduced scheme to the contrast loss is attributed to the fact that shares have well-defined local structure. If decoded digitally, we can measure the local intensity of the reconstructed image by filtering the data through a running window. Then we measure the local intensity of the data within the window. We can assign 1 to the current pixel if the local intensity is relatively high and assign 0 to the current pixel if the local intensity is relatively low. By such a simple method, the contrast of the reconstructed image can be enhanced and the content is more readable. The size of the running window should be the same as the size of the halftone cell. However, if the halftone cell size is unknown, a proper window size can be obtained by trying different window sizes until only two different local intensities are most likely to appear.