Jonathan K. Su

Spread spectrum watermarking: malicious attacks and counterattacks

Most watermarking methods for images and video have been proposed are based on ideas from spread spectrum radio communications, namely additive embedding of a (signal adaptive or non-adaptive) pseudo-noise watermark pattern, and watermark recovery by correlation. Even methods that are not presented as spread spectrum methods often build on these principles. Recently, some skepticism about the robustness of spread spectrum watermarks has arisen, specifically with the general availability of watermark attack software which claim to render most watermarks undetectable. In fact, spread spectrum watermarks and watermark detectors in their simplest form are vulnerable to a variety of attacks. However, with appropriate modifications to the embedding and extraction methods, spread spectrum methods can be made much more resistant against such attacks. In this paper, we review proposed attacks on spread spectrum watermarks are systematically. Further, modifications for watermark embedding and extraction are presented to avoid and counterattack these attacks. Important ingredients are, for example, to adapt the power spectrum of the watermark to the host signal power spectrum, and to employ an intelligent watermark detector with a block-wise multi-dimensional sliding correlator, which can recover the watermark even in the presence of geometric attacks.

Digital watermarking of text, image, and video documents

Abstract The ease of reproduction, distribution, and manipulation of digital documents creates problems for authorized parties that wish to prevent illegal use of such documents. To this end, digital watermarking has been proposed as a last line of defense. A digital watermark is an imperceptible, robust, secure message embedded directly into a document. The watermark is imperceptible both perceptually and statistically. Robustness means that the watermark cannot be removed or modified unless the document is altered to the point of no value. The watermark is secure if unauthorized parties cannot erase or modify it. Current watermarking schemes may be viewed as spread-spectrum communications systems, which transmit a message redundantly using a low-amplitude, pseudo-noise carrier signal. An example highlights the basic mechanisms and properties of spread spectrum and their relation to watermarking. Finally, specific issues in watermarking of text, images, and video are discussed, along with watermarking examples.

Asymmetric Watermarking Schemes

Unauthorized copying and distribution of digital data is a severe problem in protecting intellectual property rights. The embedding of digital watermarks into multimedia content has been proposed to tackle this problem, and many different schemes have been presented in the last years. However, almost all of them are symmetric, meaning the key used for watermark embedding must be available at the watermark detector. This leads to a security problem if the detectors are implemented in consumer devices that are spread all over the world. Therefore, the development of asymmetric schemes becomes important. In such a scheme the detector only needs to know a public key, which does not give enough information to make watermark removal possible. In this paper, we review recent proposals for asymmetric watermarking and analyze their performance.

Robustness of a blind image watermarking scheme

It was shown previously that, in some situations, blind watermarking can perform as well as watermarking schemes with the host signal available to the decoder. In this paper, blind watermarking of colored Gaussian host signals in the presence of filtering and additive Gaussian noise attacks is discussed. Three suboptimal but practical schemes are compared with a scheme where the host signal is available at the decoder. The performance is analyzed theoretically and experimentally for image watermarking.

Analysis of digital watermarks subjected to optimum linear filtering and additive noise

Using a theoretical approach based on random processes, signal processing, and information theory, we study the performance of digital watermarks subjected to an attack consisting of linear shift-invariant filtering and additive colored Gaussian noise. Watermarking is viewed as communication over a hostile channel, where the attack takes place. The attacker attempts to minimize the channel capacity under a constraint on the attack distortion (distortion of the attacked signal), and the owner attempts to maximize the capacity under a constraint on the embedding distortion (distortion of the watermarked signal). The distortion measure is frequency-weighted mean-squared error (MSE). In a conventional additive-noise channel, communication is most difficult when the noise is white and Gaussian, so we first investigate an effective white-noise attack based on this principle. We then consider the problem of resisting this attack and show that capacity is maximized when a power-spectrum condition (PSC) is fulfilled. The PSC states that the power spectrum of the watermark should be directly proportional to that of the original signal. However, unlike a conventional channel, the hostile attack channel adapts to the watermark, not vice versa. Hence, the effective white-noise attack is suboptimal. We derive the optimum attack, which minimizes the channel capacity for a given attack distortion. The attack can be roughly characterized by a rule-of-thumb: At low attack distortions, it adds noise, and at high attack distortions, it discards frequency components. Against the optimum attack, the PSC does not maximize capacity at all attack distortions. Also, there is no unique watermark power spectrum that maximizes capacity over the entire range of attack distortions. To find the watermark power spectrum that maximizes capacity against the optimum attack, we apply iterative numerical methods, which alternately adjust the watermark power spectrum and re-optimize the parameters of the optimum attack. Experiments using ordinary MSE distortion lead to a rule-of-thumb: White watermarks perform nearly optimally at low attack distortions, while PSC-compliant watermarks perform nearly optimally at high attack distortions. The effect of interference from the original signal in suboptimal blind watermarking schemes is also considered; experiments examine its influence on the optimized watermark power spectra and the potential increase in capacity when it can be partially suppressed. Additional experiments demonstrate the importance of memory, and compare the optimum attack with suboptimal attack models. Finally, the rule-of-thumb for the defense is extended to the case of frequency-weighted MSE as a distortion measure.

Illustration of the duality between channel coding and rate distortion with side information

Digital watermarking can be viewed as channel coding with side information at the encoder (CC-SI); the original data to be watermarked is known to the encoder but not the decoder. Likewise, distributed source coding is rate distortion with side information at the decoder (RD-SI); a noisy observation of the source data to be compressed is available to the decoder but not the encoder. For a Gaussian channel or source, CC-SI and RD-SI are shown to be information-theoretic duals. Ideal coding schemes are presented, and the schemes are interpreted geometrically to highlight dual elements and quantities.

Fundamental performance limits of power-spectrum condition-compliant watermarks

Our previous work introduced a stochastic framework for studying watermarking. When the receiver used direct correlation detection and the attack employed linear shift- invariant (LSI) filtering, the optimal attack consisted of Wiener filtering and adding noise. Resisting the Wiener attack led to a power-spectrum condition (PSC): the watermark and original power spectra should be directly proportional. PSC- compliant watermarks are most difficult to estimate from the watermarked document in the minimum mean-squared error sense. This paper investigates the fundamental limits of PSC- compliant watermarks; it has two main parts. First, expressions are derived for the detection-error probabilities after the Wiener attack with PSC-compliant Gaussian noise. An explicit relationship between attacked-document distortion and capacity results. The second part studies optimal LSI- filtering attacks and receivers. Because direct correlation detection is only optimal for white Gaussian noise (WGN), the Wiener attack and PSC may actually be suboptimal. It is shown that the PSC holds for a suboptimal, effective white-noise attack. The optimum attack is derived, but there does not appear to be an analytical solution for the optimum watermark power spectrum. Numerical experiments suggest that, as a rule of thumb, white watermarks perform well at lower distortions, while PSC-compliant watermarks perform better at higher distortions.

Computational intelligence in biological sensing

This paper presents an alternative, computational intelligence based paradigm for biological attack detection. Conventional approaches to this difficult problem include sensor technologies and analytical modeling approaches. However, the processes that constitute the environmental background as well as those which occur as the result of an attack are extremely complex. This phenomenological complexity, in terms of both physics and biology aspects, is a challenge difficult to overcome by conventional approaches. In contrast to such approaches, the proposed approach is centered on automatic learning to discriminate between sensor signals that are in a normal range from those that are likely to represent a biological attack. It is argued that constructing machine learning methods robust enough to perform such a task is often more feasible than constructing an adequate model that could form a basis for bioattack detection. The paper discusses machine learning and multisensor information fusion methods in the context of biological attack detection in a subway environment, including recognition architecture and its components. However, the applicability of the proposed approach is much broader than the subway bioattack protection case, extending to a wide range of CBR defense applications.

Optimum attack on digital watermarks and its defense

We study the theoretical robustness of digital watermarks by viewing watermarking as communication over a hostile channel. Signals are modeled as stationary Gaussian random processes, and distortion is measured by the frequency-weighted mean-squared error (MSE). The attack consists of linear shift-invariant filtering and additive Gaussian noise; it is optimized by selecting the filter and noise to minimize attacked-signal distortion under a capacity constraint. Then the defense is optimized by maximizing attacked-signal distortion under constraints on capacity and watermarked-signal distortion. We obtain performance limits and give rules-of-thumb for attack and defense. Experiments also show the influence of memory, suboptimality of additive noise and effective white noise attacks, and the effect of frequency-weighted distortion.

Assessment of effects of lossy compression of hyperspectral image data

Hyperspectral imaging (HSI) sensors provide imagery with hundreds of spectral bands, typically covering VNIR and/or SWIR wavelengths. This high spectral resolution aids applications such as terrain classification and material identification, but it can also produce imagery that occupies well over 100 MB, which creates problems for storage and transmission. This paper investigates the effects of lossy compression on a representative HSI cube, with background classification serving as an example application. The compression scheme first performs principal components analysis spectrally, then discards many of the lower-importance principal-component (PC) images, and then applies JPEG2000 spatial compression to each of the individual retained PC images. The assessment of compression effects considers both general-purpose distortion measures, such as root mean square difference, and statistical tests for deciding whether compression causes significant degradations in classification. Experimental results demonstrate the effectiveness of proper PC-image rate allocation, which enabled compression at ratios of 100-340 without producing significant classification differences. Results also indicate that distortion might serve as a predictor of compression-induced changes in application performance.