AN OPTIMAL WATERMARKING SCHEME BASED ON SINGULAR VALUE DECOMPOSITION *
Emir Ganic, Nasir Zubair and Ahmet M. Eskicioglu Department of Computer and Information Science CUNY Brooklyn College, 2900 Bedford Avenue, Brooklyn, NY 11210, USA
Abstract Watermarking, the process of embedding data into a multimedia element, can be used primarily for copyright protection and other purposes. The schemes that have recently been proposed modify the pixel values or transform domain coefficients. The Singular Value Decomposition (SVD) is a practical numerical tool with applications in a number of signal processing fields including image compression. In an SVD-based watermarking scheme, the singular values of the cover image are modified to embed the watermark data. We propose an optimal SVD-based watermarking scheme that embeds the watermark twice. In the first layer, the cover image is divided into smaller blocks and a piece of the watermark is embedded in each block. In the second layer, the cover image is used as a single block to embed the whole watermark. Layer 1 allows flexibility in data capacity, and Layer 2 provides additional robustness to attacks. Key words: watermarking, copyright protection, visual watermark, singular value decomposition.
1. Introduction Watermarking (data hiding) is the process of embedding data into a multimedia element such as image, audio or video. This embedded data can later be extracted from, or detected in, the multimedia for several purposes including copyright protection, access control and broadcast monitoring. A watermarking algorithm consists of the watermark structure, an embedding algorithm and an extraction, or a detection, algorithm. Watermarks can be embedded in the pixel domain or the transform domain such as the DCT or wavelet. In most multimedia applications, three desired attributes for a watermarking scheme are invisibility, robustness and high capacity. Invisibility refers to the degree of distortion introduced by the watermark and its affect on the viewers or listeners. Robustness is the resistance of an embedded watermark against intentional attacks, and normal audio/visual processes such as noise, filtering, resampling, scaling, *Email address of the corresponding
[email protected]
author:
rotation, cropping and lossy compression. Capacity is the amount of data that can be represented by the embedded watermark. The SVD for square matrices was discovered independently by Beltrami in 1873 and Jordan in 1874, and extended to rectangular matrices by Eckart and Young in the 1930s. It was not used as a computational tool until the 1960s, however, because of the need for sophisticated numerical techniques. In later years, Gene Golub demonstrated its usefulness and feasibility as a tool in a variety of applications [1]. Every real matrix A can be decomposed into a product of 3 matrices A = UΣVT, where U and V are orthogonal matrices, UTU = I, VTV = I,and Σ = diag (λ1, λ2, ...). The diagonal entries of Σ are called the singular values (SVs) of A, the columns of U are called the left singular vectors of A, and the columns of V are called the right singular vectors of A. This decomposition is known as the Singular Value Decomposition (SVD) of A, and can be written as
r T A = ∑ λiU iVi i =1 where r is the rank of matrix A. It is important to note that each SV specifies the luminance of an image layer while the corresponding pair of singular vectors specifies the geometry of the image. SVD is one of the most useful tools of linear algebra with several applications in image compression [2,3,4,5,6,7], watermarking [8,9,10] and other signal processing fields [11,12,13,14].
2. Watermarking in the SVD domain We surveyed the relevant literature, and found several approaches for SVD-based watermarking, which are summarized in Table 1. They are either block-based or global schemes with a watermark chosen to be a random sequence or a digital image (i.e., a visual watermark).
Scheme
Cover image
Watermark
600x512 RGB image
240x120 gray scale image
Method 1
The cover image A, represented in 24 bpp RGB format, is divided into blocks of size 4x4, and the SVD of each block of the R,G and B layers is computed. The largest SV of each block is quantized to embed one bit of data.
An aerial view image (size not specified)
An emf file (representing an aircraft route)
Presented.
Method 2
The three color layers are divided into blocks as in method 1. The vector of all SVs of each block is modified by a quantized Euclidean norm of the vector. One bit of data is embedded into each block.
Random sequence embedded.
The SVD of the entire cover image is obtained. After multiplying the matrix of pseudo Gaussian random numbers by a scaling factor, and adding the product to the diagonal matrix of SVs, the modified diagonal matrix is inserted back in the cover image.
200x200 gray scale Lena
2500 pseudo Gaussian random numbers
Presented.
Visual watermark embedded.
Liu and Tan
Gorodetski et al
Table 1. Summary of the SVD-based watermarking schemes
A visual watermark is used instead of a matrix of pseudo Gaussian random numbers.
200x200 gray scale Lena
Not presented.
Scaling factor d(red)=46 d(green)=22
Attacks
JPEG (quality factor not specified)
d(blue)=52
d(red)=40
JPEG (40% compression)
d(green)=24 d(blue)=48
0.2
Gaussian noise (mean=0, variance=0.05) 16x16 Gaussian low pass filter (variance =4) JPEG (quality factor=5) Rotation (angle=300) Clipping (left half removed)
50x50 2-color image (white letters N,L,P,R against a black background)
Presented.
0.2
Gaussian noise (mean=0, variance=0.05) 16x16 Gaussian low pass filter (variance =4) JPEG (quality factor=5) Rotation (angle=300) Clipping (left half removed)
Four watermarking schemes are implemented: Global (non-adaptive and adaptive): The SVD of both the cover image and the visual watermark is obtained. The SVs of the watermark are multipled by a scaling factor and added to the SVs of the cover image. Chandra
Watermarked cover image
Block-based (non-adaptive and adaptive: The cover image is segmented into blocks and one bit of data is embedded into each block. Block-based offset: A constant offset is added (for embedding 1) to, or subtracted (for embedding 0) from, all the SVs of each block of the cover image. Gorodetski et al: As described above.
512x512 gray scale Peppers
64x64 2-color image (white letters A,B,C and white digits 1,2,3 against a black background)
Not presented.
0.2 (global approach only). Not specified for other methods.
JPEG (quality factors 25 and 10) 3x3 low pass filter
3. An optimal SVD-Based Watermarking Scheme In all of the above papers, we observed that the scaling factor was chosen to be a constant. In [15], which presents a spread-spectrum watermarking scheme based on the Discrete Cosine Transform (DCT), three different ways are proposed for watermark embedding. Let V = v1 , v 2 ,..., v n be the sequence of coefficients obtained
from the transform domain and X = x1 , x 2 ,..., x n be the watermark sequence. 1. 2. 3.
vi′ = vi + αxi vi′ = vi (1 + αxi ) αx vi′ = vi (e i )
The authors argue that a single scaling factor α may not be applicable for modifying all the values vi since different spectral components may exhibit different tolerance to modification. The recommendation is to use multiple scaling factors α1 , α 2 ,..., α n in the update formula such as vi′ = vi (1 + α i xi ) . Since we may have little idea of how sensitive the image is to various values of the scaling factor, one can resort to experimentation (e.g., using attacks on the original image, obtaining the * distorted image D and choosing α i to be proportional to * | vi − vi |), global assumptions (e.g., requiring that
α i ≥ α j whenever vi ≥ v j ), or a combination of the two. In spite of these potentially promising ideas, the scaling factor α = 0.1 is used for all the experiments in the paper.
We argue that a critical parameter in SVD-based watermarking is the magnitude of the SVs of the cover image relative to the SVs of the watermark image. Hence, the scaling factor α i should be a function of both
λ max and λ wi , i.e.,
α i = f (λ max , λ wi ) . Let us assume that the largest SV of the watermark is 60,000 and the smallest SV is 0.5. Further, assume that the maximum of the largest SVs in all 16x16 blocks is 3,000 and the minimum is 750. It is evident that if we embed 10% of 60,000 to 3,000, the distortion will be visible in that block. Similarly, if we embed 10% of 0.5 to 750, the modification will be insufficient. So, what is a general formula for using multiple scaling factors? For a given block, we first obtain the ratio λ max / λ wi , and multiply it with a constant percentage to compute the value of the scaling factor for the SV pair. Our first layer watermarking algorithm with multiple scaling factors is: Embedding d λmax = λmax + α i λ wi , where α i = c
λ
max
λ
.
wi
Extracting k k d Let λ max , i = 1,..., x be the possibly distorted SV of n n a given nxn block of the watermarked image. d
λ − λ max d λ wi = max . αi
In developing the proposed scheme, we had two main objectives: Maximizing data capacity and increasing robustness. We propose to use double watermarking to achieve these objectives.
Hence, W
3.1 Layer 1 Watermarking
3.2 Layer 2 Watermarking
The kxk cover image A is divided into nxn blocks. For each nxn block, λ max denotes the largest SV of the cover
The SVD of the cover image A and the visual watermark W are, respectively,
image. The SVD of the lxl (l ≤ k) visual watermark W is r T denoted by W = Σ λ wi U wi Vwi , where r, the rank of i =1 W, is less than or equal to l. The order of the SVs of W is randomized, and each λ wi is embedded into one nxn block of the cover image.
Layer1
r d T = Σ λ wi U wi Vwi . i =1
A = UΣ V a
T
and W = U Σ V W
T
W W
.
λ , i = 1,..., k denote the SVs of the cover image, and i
λ
wi
, i = 1,..., l denote the SVs of the visual watermark.
Our second layer watermarking algorithm with a constant scaling factor α is: Embedding
λ
d = λ + αλ i i wi
Note that W needs to be smaller than A but the rank of W may be greater than the rank of A.
(a)
(b)
(c)
(d)
Extracting Let λ
d be the possibly distorted SV of A. i
λdwi Hence, W
Layer 2
d
λ − λi = i . α
d T = U W Σ W VW .
An essential difference between Layer 1 and Layer 2 algorithms is that the former is localized embedding and the latter global.
4. Experiments We have tested the proposed scheme in seven experiments. The chosen attacks are JPEG compression, JPEG 2000 compression, Gaussian blur, Gaussian noise, rescaling, rotation and cropping. Because of space limitation, we will present only the watermarks extracted in Layer 1. Since both watermarking schemes are additive, we do not strip the second layer watermark before we extract the first layer watermark. Figure 1 shows the 512x512 gray scale cover image Lena, the 512x512 gray scale visual watermark Mandrill, the doubly watermarked Lena, and the watermark extracted in Layer 1. In first layer watermarking, the cover image is divided into 16x16 blocks, and one SV of the watermark is embedded into each block. Since we have 32x32 blocks, there are 1024 locations for embedding. We therefore embedded the 512 SVs of the watermark twice, and took the average of each pair of SVs. The constant percentage c is equal to 0.05. In second layer watermarking, the value of the constant scaling factor is 0.1. In Figures 2-8, we present the seven attacks on the doubly watermarked Lena.
Figure 1. (a) Cover image Lena, (b) Visual watermark Mandrill, (c) Doubly watermarked Lena, (d) Extracted Layer 1 watermark Figure 2 shows the scheme’s resistance to the first attack, i.e., JPEG compression. The watermarked Lena is JPEG compressed at 50:1 ratio.
(a)
(b)
Figure 2. (a) JPEG compressed Lena (50:1), (b) Extracted watermark Figure 3 shows the scheme’s resistance to the second attack, i.e., JPEG 2000 compression. The watermarked Lena is JPEG 2000 compressed at 100:1 ratio.
(a)
(b)
Figure 3. (a) JPEG 2000 compressed Lena (100:1), (b) Extracted watermark Figure 4 shows the scheme’s resistance to the third attack, i.e., Gaussian blur with radius 5.
(a) Figure 4.
(a)
Figure 6. (a) Rescaled Lena (512Æ256Æ512), (b) Extracted watermark Figure 7 shows the scheme’s resistance to the sixth attack, i.e., cropping. The right half of the watermarked Lena was cropped, and the missing half was replaced with the right half of unwatermarked Lena.
(b) (a)
(a) Gaussian blurred Lena (radius=5), (b) Extracted watermark
Figure 5 shows the scheme’s resistance to the fourth attack, i.e., 15% Gaussian noise.
(a)
(b)
(b)
Figure 7. (a) Cropped Lena (right half is cropped), (b) Extracted watermark Figure 8 shows the scheme’s resistance to the seventh attack, i.e., rotation. The watermarked Lena was rotated 20 degrees clockwise, and rotated back to its original position using bilinear interpolation.
(b)
Figure 5. (a) Gaussian noisy Lena (percentage=15%), (b) Extracted watermark Figure 6 shows the scheme’s resistance to the fifth attack, i.e., rescaling. Using bilinear interpolation, the watermarked Lena was scaled from 512x512 to 256x256, and then rescaled to its original size.
(a) Figure 8.
(b)
(a) Rotated Lena (rotation angle=200), (b) Extracted watermark
Note that after each attack, the image loses its commercial value entirely, yet the watermark is extracted in a very reliable way.
5. Conclusions We presented a new double watermarking scheme. In the first layer, the cover image is divided into nxn blocks, and the largest SV of each block is modified to embed one SV of the visual watermark. In the second layer, the SVs of the watermark are embedded in the corresponding SVs of the cover image. We showed the feasibility of embedding a watermark that has the same size as the cover image. The robustness of the scheme is increased by embedding the watermark twice using two different approaches – block based and global. This does not affect the visibility of the watermark in any noticeable way. The proposed watermarking scheme is suitable for copyright protection and not access control. If the ownership of the watermarked image is disputed, the judge will ask the owner to prove the ownership by providing evidence regarding the watermark and the watermarking algorithm. As the cover image SVs, multiple scaling factors, and the U and V vectors of the watermark for each layer are securely kept by the owner, they will be used to extract the watermark as the proof of ownership. For access control, the watermark detection scheme needs to be installed in a receiver such as a digital TV or DVD player, requiring the storage of secret information. In Layer 1, we used a block size of 16 for the cover image. Other block sizes are also possible to change the data capacity of the first layer. For example, if the block size is 8, the capacity would increase 4 times as the total number of blocks would be 4096 instead of 1024. To match the increased capacity of Layer 1, the Layer 2 watermark may contain only a critical portion of the data embedded in Layer 1.
4
5
6
7
8
9
10
11
We are now exploring how each layer of watermarking could be used to resist attacks in a different way.
Acknowledgment This work was supported in part by a grant from the City University of New York PSC-CUNY Research Award Program.
12
13
References 1 2
3
D. Kahaner, C. Moler and S. Nash, Numerical Methods and Software (New Jersey: Prentice-Hall, Inc, 1989). H. C. Andrews and C. L. Patterson, “Singular value Decomposition (SVD) Image Coding,” IEEE Transactions on Communications, 24(4), April 1976, pp. 425-432. N. Garguir, “Comparative Performance of SVD and Adaptive Cosine Transform in Coding Images,”
14
15
IEEE Transactions on Communications, 27(8), August 1979, pp. 1230-1234. D. P. O’Leary and S. Peleg, “Digital Image Compression by Outer Product Expansion,” IEEE Transactions on Communications, 31(3), March 1983, pp. 441-444. J. F. Yang and C. L. Lu, “Combined Techniques of Singular Value Decomposition and Vector Quantization,” IEEE Transactions on Image Processing, 4(8), August 1995, pp. 1141-1146. P. Waldemar and T. A. Ramstad, “Hybrid KLT-SVD Image Compression,” 1997 IEEE International Conference on Acoustics, Speech and Signal Processing, Vol. 4, Munich, Germany, April 21-24, 1997, pp. 2713-2716. S. O. Aase, J. H. Husoy and P. Waldemar, “A Critique of SVD-Based Image Coding Systems,” 1999 IEEE International Symposium on Circuits and Systems VLSI, Vol. 4, Orlando, FL, May 1999, pp. 13-16. V. I. Gorodetski, L. J. Popyack, V. Samoilov and V. A. Skormin, “SVD-based Approach to Transparent Embedding Data into Digital Images,” International Workshop on Mathematical Methods, Models and Architectures for Computer Network Security (MMM-ACNS 2001), St. Petersbug, Russia, May 2123, 2001. R. Liu and T. Tan, “A SVD-Based Watermarking Scheme for Protecting Rightful Ownership,” IEEE Transactions on Multimedia, 4(1), March 2002, pp.121-128. D. V. S. Chandra, “Digital Image Watermarking Using Singular Value Decomposition,” Proceedings of 45th IEEE Midwest Symposium on Circuits and Systems, Tulsa, OK, August 2002, pp. 264-267. K. Konstantinides and G. S. Yovanof, “Improved Compression Performance Using SVD-Based Filters for Still Images, SPIE Proceedings, Vol. 2418, San Jose, CA, February 7-8, 1995, pp. 100-106. K. Konstantinides and G. S. Yovanof, “Application of SVD-Based Spatial Filtering to Video Sequences,” 1995 IEEE International Conference on Acoustics, Speech and Signal Processing, Vol. 4, Detroit, MI, May 9-12, 1995, pp. 2193-2196. K. Konstantinides, B. Natarajan and G. S. Yovanof, “Noise Estimation and Filtering Using Block-Based Singular Value Decomposition, IEEE Transactions on Image Processing, 3(3), March 1997, pp. 479-483. R. Karkarala and P. O. Ogunbona, “Signal Analysis Using a Multiresolution Form of the Singular Value Decomposition, IEEE Transactions on Image Processing, 10(5), May 2001, pp. 724-735. I. J. Cox, J. Kilian, T. Leighton and T. Shamoon, “Secure Spread Spectrum Watermarking for Multimedia,” IEEE Transactions on Image Processing, 6(12), December 1997, pp. 1673-1687.
