Blind image counterwatermarking – hidden data filter
 929 Downloads
Abstract
Watermarking is a dynamically developing method of copyright protection used for media (sounds, images, films, or 3D objects) that employs signal processing in order to hide additional, invisible information about the owner or author. However, studies until now have not widely considered the problem of attempting to blind removal of hidden data in a manner that allows the watermarked signal to be returned to the original signal. Current considerations of authors of leading articles in the watemarking field focus on the robustness of the method – security system against intentional attacks of removal of the additional information, without taking into account the aspect of simultaneous degradation of the quality and form of the watermarked picture. As has been shown in the article, it is possible to design a perfect filter (same as reversible operations) that allows the removal of additional information from the watermarked picture in a way that makes it possible to return to the form of the host image. This paper describes an ideal filter used for removal of additional, invisible information in forms of an eliminating function and a signal masking function. Their effectiveness has been demonstrated for practical implementations of this type of eliminating and masking filters for watermarking methods in the cepstrum domain.
Keywords
Hidden data filter Watermarking Image watermarking Counterwatermarking1 Introduction
The problem of a hidden data filter has been merely demonstrated [5] in the form of problems of an attack aimed at elimination of the watermark and the masking. In [4, 17] such considerations are not found, while in [2, 16] the problem of hidden data filter is estimated in a manner similar to the masking described in [5]. In the book [1] the authors provide examples of elimination of the watermark from watermarked pictures on the basis of a collusion or oracle attack. However, in each of these cases the examples are those of a masking attack, not the perfect removal of a watermark from the watermarked picture, making it possible to return to the host image. An additional element that absolutely must be taken into account is the fact that the perfect hidden data filter must be separated from the robustness of the method which, according to [9, 16], cannot be based on the properties of the algorithm, or access to the watermarking application, but on the general possibilities of transformation of the watermarked picture, both within the space and frequency domains.
Elements of professionally prepared attacks, testing the robustness of watermarking methods have been included in the Stir Mark [8, 14] application. It includes a wide range of methods for potentially preventing the detection of a watermark in a picture containing additional, invisible information. Testing of the possibilities of the watermarking method is performed automatically using a prepared protocol.
However, in literature it is impossible to find algorithms that eliminate the watermark signal from the watermarked signal under the condition of returning to the original signal with high signal quality maintained. The article presents in its first part a theoretical model of the perfect hidden communication filter, an accurate description of both functions – the one eliminating and the one masking the watermark signal, the practical implementation of the hidden communication filter and efficiency tests results.
2 Perfect hidden data filter
2.1 Perfect hidden transmission filter

O _{ all } designates one from all possible decoder inputs (in this case tested signals are rejected). It is described in third equation,

O _{ wm } ^{′} designates one from all signals watermarked after passing through the communication channel, taking into account possible attacks on the signal – both intentional and unintentional.
If we take into account that in the communication channel the form of the watermarked signal \( {O}_{wm} \) can be changed intentionally or not. However, in both cases, conversion of it into signal \( {O}_{wm}^{\prime } \) is performed.
2.2 Elimination vs. masking
 access to the signal,

access only to the watermarked signal – most likely case,

access to watermarked signals and corresponding information i,

access to watermarked signals and corresponding original signals (with the goal being to recover information i),


access to the encoder,

access to the decoder,

access to the watermarking algorithm – both E _{ wmf } and D _{ wmf } functions.
In literature it is possible to find examples of masking filtering, such as [12], where the authors propose a masking method for decoding watermarking algorithms based on spectral dispersion using nonlinear filtering, estimating the watermark in the watermarked signal. In the first part, they filter the watermarked signal using a 3x3sized median filter. Then they subtract from the watermarked signal the difference between the watermarked signal and the medianfiltered signal; the difference has been once again highpass filtered and empirically scaled on the basis of a determined coefficient. Thanks to this method they estimate the watermark signal and can successfully mask it.
As an example of eliminating filtration it is possible to give an example of collusion processing, where the attacker has only the watermarked signals but in this case it is necessary to satisfy the condition of partial uniformity (masking), or total uniformity (elimination) of the watermark signal W. For this type of filtration only watermarked signals are required, which means that it is a blind method. The process will be based on averaging the watermarked signals – the watermark signal will become clear from among the noise of random values of the remaining averaged samples of watermarked signals. For a watermark signal processed in such a way there is nothing else to do other than to remove the recurring samples of the signal of the watermark W by means of subtraction. This attack applies to watermarking methods in which the watermark signal W added to the original signal O is not its function. The effectiveness of this type of elimination filtration has been shown in [7] for algorithms for watermarking films.
In the case of the person conducting the elimination or masking the watermark signal having access to the watermark encoder, it is possible to perform effective masking of the watermark signal (it should be noted that the person conducting the attack does not have to have the physical encoder, just temporary access to it will enable that person to watermark their own signal, or a couple of original signals), and in a special case – to eliminate the watermark signal. This applies especially to algorithms that use the entire space of the original signal, or, for example, in solid blocks, as acquisition of the watermarked signal makes it possible to determine the spatial or spectral range in which the encoder is operating and establish a solid filtering matrix. Adaptive methods are more resistant to such attacks, where a larger collection of original signals and their corresponding watermarked signals are needed for generalized determinations.
Another particular example of a masking algorithm is described in [11], where the authors prove that in the case of access to a single watermarked signal and a decoder, it is possible to recover a part of the original signal. In this case they use pseudolinear dependencies used in the detector and it is possible to recover the original signal for a watermark signal without the DC component and within the range of values {−1, 1}. However, it should be noted that the attack in this case is against the watermarking algorithm for broadcast applications, where each user has access to the watermark decoder.
In the case of [10] the authors described a masking algorithm that removes the additional information from the watermarked signal, while maintaining the quality of the original signal, in this case a picture. For algorithm [6] it obtained a PSNR = 36.65 dB, with NC = 0.12, while for [13] a PSNR = 32.95 and NC = 0.28, where these and other attacked watermarking algorithms are of the nonblind type (which greatly limits their use in practical watermarking applications). It should be noted that the masking algorithm quite precisely removes the watermark signal from the watermarked signal, while maintaining good quality of the reconstructed original signal.
3 Implementation of the filter

x,y – indexes of discrete spatial positions of pixels,

X,Y – spatial resolution of images,

k,l – indexes of discrete, 2D signal frequencies of the spectrum.

m,n – indexes of discrete coefficients of the twodimensional autocepstral matrix.

δ – watermark power coefficient, calculated empirically in [15].
Then, for the luminance matrix of the disturbed watermarked picture \( {Y}_{wm}^{\prime } \) processed in such a way, a luminance matrix is obtained with the eliminated watermark \( {Y}_{cwm}^{\prime}\left(x,y\right) \) which is the same as matrix \( {Y}^{\prime}\left(x,y\right) \). The last step is transforming the matrix from YCbCr to RGB, which results in the output signal \( {O}^{\prime } \).

we create an empty matrix for the movement model,

we supplement it with a vector with a length of l (f.e. 2 pixels) and angle θ (\( 135{}^{\circ} \)), centered on the middle coefficient of the h filter matrix,

for each coordinate (i,j), calculate the closest ND distance between this location of the ND and the segment of the model,

\( h= \max \left(1ND,0\right) \),
The spatial averaging filter is a matrix with dimensions \( 4x4 \) with a value of the coefficients 0,0625. At the output of the averaging spatial filter the filtered matrix \( {Y}_{median}^{\prime } \) is obtained which is subtracted from the degraded watermarked signal, resulting in matrix \( {Y}_{diff}^{\prime } \) being obtained. It is an estimated watermark matrix used in the function \( {E}_{wmf} \) which we again subtract from the degraded watermarked signal, obtaining as a result matrix \( {Y}_{cwm}^{\prime } \) that is the approximate luminance matrix of the degraded original signal \( {O}_{deg}^{\prime } \).
4 Efficiency test results

O _{ p } – peak value (number of quantization levels for colors).
For the database of 99 pictures, after use of elimination function \( {F}_{cwm} \) the average value of the PSNR coefficient between the original and watermarked pictures was \( 39,19\; dB \), at \( BER=0\% \), while between original pictures and the ones filtered using the elimination function the \( PSNR=67,88\; dB \), while detection of all watermark signals was not possible (\( {Y}_{wm\; cepst}^{\prime}\left(m,n\right)<\tau \)). The result confirm the effectiveness of the hidden communication filter in the form of function \( {F}_{cwm} \), in addition in Fig. 7 confirms the return of the form of signal \( {O}_{wm}^{\prime } \) to \( {O}^{\prime } \).
Effectiveness of implemented masking function \( {M}_{cwm} \)
N  99  99  99  99 

\( Effect \) [%]  81.82  99.7  98.90  97.98 
\( {M}_{size} \)  2 × 2  4 × 4  4 × 4  5 × 5 
l  4  6  4  4 
\( {PSNR}_{OrygWm} \) [dB]  39.31  37.18  39.36  39.27 
\( {PSNR}_{Orygcwm} \) [dB]  32.06  34.93  35.72  36.54 

Effect –the efficiency of the masking of the watermarking signal, measured as the ratio between the watermark signals removed from watermarked pictures and the total number of watermarked pictures, maintaining the condition of returning the watermarked picture to the form of the host image.

M _{ size } – sizes of the matrix of the spatial median filter,

l – translation coefficient for the matrix initiating the search for the PSF of the encoding function \( {E}_{wmf} \) of the Wiener blind deconvolution filter,

PSNR _{ oryg–Wm } – PSNR calculated between the original and the watermarked picture,

PSNR _{ oryg–c–wm } – PSNR calculated between the original picture and the one recovered as a result of the use of the masking function \( {M}_{cwm} \).
Taking into account the quality of the recovered host image, the algorithm used \( l=4 \) and \( {M}_{size}=\left[4,4\right] \) as the most optimal values for the method of masking the watermark signal.
In addition, the method contained in [15] was tested using a popular masking algorithm removing embedded content described in [12] and it demonstrated high resistance to this type of processing: BER was only \( 2,04\% \). After executing masking function PSNR between the host images and the masked watermark signal was \( 39,27\; dB \). Tests were performed with the values of the coefficient for scaling nonlinear filtering \( A=2 \) recommended by the authors at [12].
5 Conclusions
The article pays particular attention to the problem of elimination and masking of watermarked signals, when it is possible to return the signal containing additional, imperceptible information to its initial, i.e. original, form. In the case of precise removal of the watermark signal, the process is called elimination, while when the signal of the watermark is removed in an approximate manner, it is called masking. Special attention should be paid to the fact that articles concerning watermarking written so far disregard these considerations (there are some, not many, masking algorithms, but they have very limited use). The article presents a developed theoretical model of a function aimed at eliminating the additional, imperceptible information inserted using a spatial algorithm operating in the cepstrum domain. A masking function was also designed. Both functions have been implemented in practice through efficiency testing which confirmed their high effectiveness. The significant robustness of the cepstral algorithm against a popular masking method has also been demonstrated.
References
 1.Arnold M, Wolthusen SD, Schmucker M (2003) Techniques and applications of digital watermarking and content protection. Artech House. ISBN: 1580531113Google Scholar
 2.Bartolini F, Barni M (2004) Watermarking systems engineering enabling digital assets security and other applications, CRC Press. ISBN: 9780824748067Google Scholar
 3.Bogert BP, Healy MJR, Tukey JW (1963) The Quefrency Alanysis of Time Series for Echoes: Cepstrum, Pseudo Autocovariance, CrossCepstrum and Saphe Cracking. In: Rosenblatt M (ed) Proceedings of the Symposium on Time Series Analysis, vol 15. Wiley, New York, pp 209–243Google Scholar
 4.Cole E (2003) Hiding in Plain Sight: Steganography and the Art of Covert Communication. Wiley Publishing, Inc., IndianapolisGoogle Scholar
 5.Cox IJ, Miller ML Digital watermarking and steganography 2nd ed. MK; ISBN 9780123725851Google Scholar
 6.Cox J, Kilian J, Leighton FT, Shamoon T (1997) Secure spread spectrum watermarking for multimedia. IEEE Trans Image Process 6(12):1673–1687CrossRefGoogle Scholar
 7.Cox IJ, Linnartz JPMG (1998) Some general methods for tampering with watermarks. IEEE J Select Areas Commun 16(4):587–593CrossRefGoogle Scholar
 8.Fabien A, Petitcolas P, Anderson RJ, Kuhn MG (1988) Attacks on copyright marking systems, in David Aucsmith (Ed), Information Hiding, Second International Workshop, IH’98, Portland, Oregon, U.S.A., April 15–17, 1998, Proceedings, LNCS 1525, SpringerVerlag, 219–239. ISBN 3540653864Google Scholar
 9.Fridrich J (1998) Applications of data hiding in digital images. Tutorial of the ISPACS ’98 Conference, MelbourneGoogle Scholar
 10.Hsu TC, Hsieh WS, Su TS (2008 ) A new watermark attacking method based on eigenimage energy, intelligent information hiding and multimedia signal processing, 2008. IIHMSP '08 International Conference on 15–17 Aug. 2008, 29–32. doi: 10.1109/IIHMSP.2008.349
 11.Kalker T, Linnartz JPMG, van Dijk M (1998) Watermark estimation through detector analysis, Proc Int Conf Image Proc 425–429Google Scholar
 12.Langelaar GC, Lagendijk RL, Biemond J (1998) Removing Spatial Spread SpectrumWatermarks by NonLinear Filtering. Ninth European Signal ProcessingConference, Island of Rhodos, Greece, pp 2281–2284Google Scholar
 13.Lee CH, Lee YK (1999) An adaptive digital image watermarking technique for copyright protection. IEEE Trans Consum Electron 45(4):1005–1015CrossRefGoogle Scholar
 14.Petitcolas FAP (2000) Watermarking schemes evaluation. IEEE Sign Proc 17(5):58–64CrossRefGoogle Scholar
 15.Piotr Lenarczyk, Zbigniew Piotrowski (2010) Novel hybrid blind digital image watermarking in cepstrum and DCT domain, mines, 2010 International conference on multimedia information networking and security, 356–361. ISBN: 9780769542584Google Scholar
 16.Seitz J Digital watermarking for digital media, In Information science publishing. ISBN 1591405181Google Scholar
 17.Sencar HT, Ramkumar M, Akansu AN Data hiding fundamentals and applications, 1st edition content security in digital multimedia, ISBN: 9780120471447Google Scholar
Copyright information
Open Access This article is distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits unrestricted use, distribution, and reproduction in any medium, provided you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license, and indicate if changes were made.