GrAN Grup de recerca d’an`alisi num`erica

Detection of geometrical edges for image watermarking Olivier Le Cadet and Anne-Sophie Piquemal

October 20, 2005 GrAN report 05-02

Departament de Matem`atica Aplicada Universitat de Val`encia 46100 Burjassot, Val`encia (SPAIN)

Detection of geometrical edges for image watermarking 1 Olivier Le Cadet

2

and Anne-Sophie Piquemal

3

October 20, 2005

Abstract: We present a new wavelet watermarking process for images, of private type with restricted keys. This new algorithm is based on geometrical edge detection techniques using multiscale wavelets. Numerical results are given, and the robustness of the watermarking algorithm is studied using the benchmark Checkmark. It proves to be particularly resistant against filtering and compression algorithms.

1

Work partially supported by the EC-IHP Network Breaking Complexity and the Rhˆ ones-Alpes region. 2 Departament de Matem` atica Aplicada. Universitat de Val`encia. Val`encia. (Spain). e-mail:[email protected] 3 EGIM, Technopˆ ole de Chˆ ateau-Gombert, 38, rue Joliot-Curie, 13451 Marseille Cedex 20 (France). e-mail:[email protected]

1

Introduction

For few years, the amount of information exchanged on the Internet has been considerably increasing. As a consequence, the need for protection of the available digital data is more and more important. To cope with this problem, several protection techniques have already been defined, in which an invisible structure, called a digital watermark, is added to the host image to mark its ownership. To be really effective, a watermark has to be imperceptible, in the sense that the original image and the watermarked one have to be visually similar. It has to be discrete in order to prevent unauthorized removal, and easily extractible by the owner. Moreover, since computers, printers and high rate transmission facilities are currently used, the watermarking process has also to be robust to attacks, such as compression, erasing or filtering. These characteristics immediatly induce some features that the watermarking algorithm has to satisfy. For example, since it has to be resistant to high compression ratio, the mark has to be included in the most visually significant parts of the image, which will be preserved by a compression algorithm. This inclusion has to be done in such a way that the image appears unchanged. Thus, embedding algorithm should be adaptive by taking care of the structure of the image. In the same way, since this algorithm has to be resistant to unauthorized removal, the embedding process should be redundant, in the sense that we can mark several times the image with the same information. Several techniques satisfying these requirements have already been defined, such as those described in [15, 17]. Watermarking techniques can be categorized in a number of classes on the basis of their distinct features. Private methods require the original image for the detection algorithm, in opposition with blind methods. Another classification is obtained by taking into account the domain where the watermark is embedded. Some methods deal with modification of the intensity of pixels in the spatial domain while other techniques modify the coefficients in a transform domain such as DCT, DFT or DWT domains. Descriptions of wavelet techniques can be found in [3, 8, 12, 13]. Finally, one also has to make a distinction between restricted and unrestricted key watermarks. In the first type, the mark can be extracted or read only by persons that have access to secret keys, whereas in the second case every image user can read the mark, but only the owner of the image can embed or erase the mark. In this paper, we define a new wavelet watermarking algorithm, of private type with restricted keys. The main drawback of the last wavelet methods lies in the fact that they mark the most important wavelet coefficients at different scales, which might correspond to textured part of the image. Marking these parts might visually modify the host image. In order to avoid this problem, 1

we use an edge detection process [7] as a preprocessing step of the embedding process, which detect the geometrical contours of an image. Thus, by marking these geometrical parts of the image, we define a watermarking algorithm more robust against compression and low-pass filtering attacks. In the following, the edge detection algorithm is detailed in Section 2, while Section 3 describes the embedding and extraction processes. The results of the application of these algorithms on two classical images, Lena and Mandrill, are given in Section 4, as well as extraction tests on attacked watermarked images, which afford to evaluate the main advantages and inconvenients of our algorithm.

2

The Edge Detection Algorithm

In this section, we present a method for edge detection in an image, based on the works of S. Mallat [9, 10], and whose implementation on images is detailed in [7]. First, we define the model of the edge points, then we use a transform denoted the Multiscale Canny Transform (MCT), adapted to their detection, which properties are studied. We also show a way to implement it efficiently. Furthermore, let’s note that the MCT allows to characterize quite precisely the detected edge points through their Lipschitz regularity (but this characterization will not be detailed here).

2.1

Definition of an edge point

We want to find the edges in an image, that is, the geometrical contours separating two different objects or two different regions in an image. A first approach, the “region” approach, consists in finding the regions, for example by placing ”seeds” that will grow up until they correspond to a region. The edges are the lines separating the obtained regions. The dual approach, that we will adopt here, the ”gradient” approach, consists in finding directly the edges. In this purpose, we need to define a model of an edge, allowing to find them automatically. Since an edge separates two different regions, an edge point is a point where the local intensity of the image varies rapidly, more rapidly than in the neighbour points next to the edge. Such a point could therefore be characterized as a local maximum of the gradient of the image intensity (we will refer to these points as local maxima in the following). The problem is that such a characterization has to be applied to differentiable images, and above all that it detects all noise points. Canny[2] decided to evade the problem by smoothing the image first. But which smoothing should we choose? A strong smoothing will lead to detection of less points, a lighter one will be more permissive. That is why S. Mallat defined, in his work with S. Zhong [11], multiscales contours, contours (local maxima) for different scales of

2

smoothing, and in his work with W. Hwang [10], a chaining across the scales binding the different local maxima of the scale-space plane generated by a same point of the original image. Thus, every edge point of the image is characterized by a whole chain of the scale-space plane (see figure 1). The longer the chains are, the more important is the smoothing we impose, and the less we will get edge point. Let’s note that this chain also allows to get information about the regularity of the image at the edge point it characterizes.

s=1

minimum length required

s=N (coarsest scale)

Figure 1: Chaining across scales Taking advantage of these ideas, we will define here a point of an edge as the top, towards fine scales, of such a chain (see figure 1). Let us see now how to compute, for different smoothing scales s, the local maxima of the gradient of the intensity smoothed by a kernel θs (x, y), which is equivalent, as reminded below, to computing a vectorial wavelet transform (W 1 f, W 2 f ), which we will ~ Detecting call Multiscale Canny Transform, using the vectorial wavelet Ψ = ∇θ. edge points of the image smoothed by a kernel of scale s, which we will refer to as edge points of scale s, will be done by computing the local maxima of |(W 1 f (x, y, s), W 2 f (x, y, s))| at the scale s. Then, we will see how to define the chaining across the scales, which relates all the local maxima in the scale-space plane which have been produced by a same singular point of the original image (see figure 1), and allows to localize an edge point.

2.2 2.2.1

The Multiscale Canny Transform Choice of the smoothing kernel

We will use here a gaussian kernel, whose properties (separability, invariance by convolution) afford an efficient numerical implementation, guarantee the existence of interesting geometrical properties (thanks to its isotropy, see the

3

works of Freeman and Adelson[4] about steerable filters), and guarantee that the smoothing process will be a diffusion process (following the heat equation): going towards coarser scale, we will not see new local maxima appear. In the terminology of the wavelets, we say that the wavelets which are derivatives of gaussians are causal. We will precise the importance of this property when we speak about the chaining. 2.2.2

The Multiscale Canny Transform

Thus, let us consider a gaussian kernel θ(x, y) = e−π(x

2

+y 2 )

.

~ = (ψ 1 , ψ 2 ) = ∇θ, ~ with which we define a vectorial wavelet and a wavelet Ψ transform: ~ (x, y, s) = (W 1 f, W 2 f ) = f ? Ψ ~ˇ s (x, y) Wf where

~ˇ y) = ψ(−x, ~ ψ(x, −y) and ~ˇ x . y ) ~ˇ s (x, y) = 1 Ψ( Ψ s s s

(1)

The first component, W 1 f , detects vertical singularities, whereas W 2 f detects horizontal singularities. ~ , to which we will Let us point two properties of the wavelet transform Wf refer as the Multiscale Canny Transform (MCT) in the following: • As can be seen from the steerable filters theory, or as demonstrated in [6], ~ θ f defined as W ~ θ f = R−θ Wf, ~ W where Rθ is the rotation matrix of angle θ, is a vectorial directional wavelet ~ multiplied by Rθ provides information transform[14]. This means that Wf about the singularities in any direction θ and in the direction orthogonal to θ. • From the fact that we use a vectorial wavelet which is a gradient of a ~ = (ψ 1 , ψ 2 ) = ∇θ), ~ smoothing function θ (ψ we can easily deduce that ~ Wf (x, y, s) is proportional to the gradient of the image smoothed by θs . Adopting the notations 1, we have: ~ (x, y, s) = s∇(f ~ ?Θ ˇ s )(x, y). Wf

(2)

This property is the ground for the success of the Multiscale Canny Transform. Indeed, it provides:

4

– the maxima of the gradient of the image smoothed by a kernel at dif~ (x, y, s) at ferent scales (which correspond to the local maxima of Wf each scale s). We saw that we needed this information to characterize edge points. – the direction of the gradient of the image smoothed by a kernel. This geometrical information proves very useful, for example to compute the local maxima of the gradient. Indeed, if we test that a point is a local maximum in a circular neighbourhood, we might compare two edge points together. Making this comparison with the neighbour points in the direction of the gradient, we avoid this difficulty and we reduce the computational cost of the detection of a local maxima. We will also see how we can benefit from this information when studying the chaining across scales. Thus, at each scale s, we define the modulus of the wavelet transform of a signal f by p M f (x, y, s) = |W 1 f (x, y, s)|2 + |W 2 f (x, y, s)|2 , (3) and the associated angle

Af (x, y, s) = tan−1



= π − tan

W 2 f (x,y,s) W 1 f (x,y,s)

−1



 ,

W 2 f (x,y,s) W 1 f (x,y,s)

if W 1 f (x, y, s) ≥ 0, 

(4)

1

, if W f (x, y, s) < 0.

Since M f (x, y, s) is proportional to the modulus of the gradient of the image ˇ s )(x, y), detecting its smoothed by the gaussian kernel at the scale s, ∇(f ? Θ local maxima in the direction Af (x, y, s) afford us to find edge points of scale s.

2.2.3

Practical implementation: an overview

To implement the vectorial wavelet transform previously described so as to be numerically as efficient as possible, we will take profit from two classical ideas. • A gaussian is invariant by convolution, in the sense that, if G(x, y) = 2 2 e−π(x +y ) : j−1 convolutions }| { z 1 x y G ? G · · · ? G )(x, y) = G( √ , √ ). j j j

Thus, by making iteratively N convolutions by a gaussian on the image, and applying at each step a derivation filter (horizontal for W 1 f , vertical for W 2 f ) we can obtain,
with a reduced √ cost, the wavelet coefficients W 1 f (., ., sj , W 2 f (., ., sj ) for scales in j: √ √ sj = 1, 2, · · · , N. 5

Moreover, a gaussian being separable, each convolution can be done in O(m × n) where m × n is the size of the image, by making the convolutions on the lines first, on the columns in a second time. Nevertheless, to represent a gaussian in a discrete way, one should use at least a 7 × 7 matrix, so that the constant K in the computational cost (K × N × m × n) is relatively high. • A very classical tool issued from the wavelet’s theory for implementing wavelet transforms is the algorithm “` a trous” of S. Mallat (see for example [9]). One need a low pass filter h and a high pass filter g issued from a multiresolution analysis. Iterative convolutions by the low pass filter h, oversampled (by intercaling 2j zeros between each of its coefficients at the step j), are done, and at each step j, a convolution by the high pass filter g (oversampled in the same way that h) delivers the wavelet coefficients at the scale s = 2j . Thus, we obtain the wavelet coefficients, for dyadic scales s = 2j , j = 0 · · · J, in a computational cost O(J × n × m). However, to achieve a performant chaining across the scales, we shouldn’t use scales so far from each other. For our part, we will do iterative convolutions by low-pass filters approximating a gaussian, and use a high pass filter g which is√a derivation filter. We will not do any oversampling, so as to obtain scales in n. The derivation filter we use is a non-centered derivation filter: g = [0, 1, −1]. Taking a centered derivation filter proves to be a bad choice for the reconstruction process (see [6]). We will use as a low pass filter h a binomial filter:   1 2 1 1  2 4 2 . h= 16 1 2 1

Let’s note that

• h is separable

  1 1 1 2 , h = [1, 2, 1] ~ 4 4 1

where ~ stands for the non-periodic discrete convolution. • the filter h represents a B-spline of order 1 (j − 1 iterative convolutions by h give a filter hj representing a B-spline of order 2j − 1, whose fast convergence to gaussian is demonstrated in [18]). If we note β2j−1 (x, y) the B-spline of degree 2j − 1, 6

lim

j→+∞

(

j 2j−1 β 6

r

j x, 6

r

j y 6

!)

=

1 − x2 +y2 2 e 2π

Thus, the iterative convolution by h provides, in a numerically efficient way (in O(m × n × N ) for N scales and an image of size m × n), a very close approximation of a Multiscale Canny Transform. More details, and in particular inverse algorithms allowing to reconstruct the image from the coefficient of the MCT, can be found in [6]. Figure 2 sums up the inner working of the algorithm.

  

Image f  HH ? f ?g

HH j H

f ?Θ f ? gT  XXXX XXX  @ XX @  R @ X z X +  f ? (h ~ h) f ? (h ~ g) f ? (h ~ g T ) .. . PP PP PP ? Pq P N convolutions N −1 convolutions z z }| { }| { f ? (h ~ h··· ~ h) f ? ( h ~ h · · · ~ h ~g)

? N −1 convolutions

z }| { f ? ( h ~ h · · · ~ h ~g T )

Figure 2: scheme of the algorithm

2.3

Chaining of the local maxima

Using the previous algorithm, we compute the modulus M f (., ., si ) and the orientations Af (., ., si ) for a discrete set of scales (i = 1 · · · N ). At each scale si , a point (x, y) is a modulus maximum if M f (x, y, si ) is maximum with respect to its two neighbours in the direction of the gradient Af (x, y, si ). For each modulus maxima points, we keep the values M f (x, y, si ) and Af (x, y, si ), otherwise we put M f (x, y, si ) = Af (x, y, si ) = 0. We will now see how to chain these maxima together across the scales. We aim at chaining maxima that have been generated by a same singularity of the original image. √ Using scales in n, as we do, makes sure [1] that a local maxima produced by a given point of the original image at the scale si won’t move of more than one 7

pixel at the next scale si−1 . Thus, if we want to link a modulus maximum (xi , yi ) at the scale si with a modulus maximum (xi−1 , yi−1 ) at the scale si−1 , we just have to check the positions xi−1 ∈ {xi , xi −1, xi +1} and yi−1 ∈ {yi , yi −1, yi +1}. There is therefore at most 9 possibilities for (xi−1 , yi−1 ). Since both modulus maxima should characterize the same edge point of the original image, one has Af (xi , yi , si ) ∼ Af (xi−1 , yi−1 , si−1 ), which give us a criterion to choose among the 9 points.

s-1

(Xi,Yi, s-1)

Maximum to chain

s

(Xi,Yi,s)

Figure 3: Finding a correspondance between a local maxima at a given scale and another local maxima at the next finer scale Going from a local maximum (xN , yN ) of the coarsest scale sN , we chain it with a local maxima of the scale sN −1 , and we continue the chaining until we reach a local maximum (x0 , y0 ) to the finest scale, s0 = 1 (scale without smoothing, only numerical differentiation). Finally, the image of edges Cf is defined by  M f (x0 , y0 , 1), (x0 , y0 ) is on an edge, Cf (x0 , y0 ) = 0, otherwise. The detected edge points are then gathered in segments, and the holes in these segments are filled, if possible, thanks to the information of the finest scale. Details about this procedure will be given in [7]. Figure 4 displays the results of this new algorithm on Lena and Mandrill. Remark 2.1 Moreover, one can calculate, thanks to the chaining, the pointwise Lipschitz regularity of all the detected edge points. Theorems making the link between wavelets transforms and Lipschitz regularity can be found in [11]. Details about the computation of the local Lipschitz-regularity of an edge point are given in [6]. Edge points belonging to jump discontinuity (passage from a region of one color to a region of a different color) have a 0 Lipschitz regularity. Edge points belonging to a line have a −1 regularity. Thus, we can mark only the contours being real jump discontinuity for example. 8

Original image f

Image of edges Cf

Figure 4: Edge detection of Lena and Mandrill

9

3

The Watermarking Approach

In this section, we apply the edge detection algorithm to the definition of a new wavelet watermarking algorithm, which is of private type, with restricted keys. Since the mark is compulsorily included in the edges of the host image, this new watermarking technique will be by definition resistant to the attacks linked to the compression and to different types of filtering. In the following, the embedding and the extraction processes are respectively detailed in section 3.2, and 3.3. Numerical results are given section 4.1 and finally, the robustness to different types of attacks is treated in section 4.2, using the benchmark Checkmark1 (see [16]).

3.1

General definitions

The proposed method employs a multiresolution orthogonal wavelet decomposition of both the host image and the image of edges. We then consider a two dimensional orthogonal multiresolution analysis (Vj )j≥0 of L2 (]0, 1[2 ) constructed using tensor products of a one dimensional multiresolution analysis (Vj )j≥0 of L2 (]0, 1[), namely Vj = Vj ⊗ Vj . Classically, the spaces Vj are spanned by the family of the dilated at the scale j, and the translated versions of a scaling function φ j

Vj = span {φj,k = 2 2 φ(2j · −k), 0 ≤ k ≤ 2j − 1}. In the same way, the wavelet spaces Wj , j ≥ 0, defined as the orthogonal complement of Vj in Vj+1 , Vj+1 = Vj ⊕ Wj , are spanned by the family of the dilated at the scale j, and the translated versions of a wavelet ψ j

Wj = span {ψj,k = 2 2 ψ(2j · −k), 0 ≤ k ≤ 2j − 1}. Then the corresponding two dimensional wavelet spaces Wj are spanned by the family of functions {Ψj,κ }κ usually defined for a fixed integer j, j ≥ 0, by for κ = (k, l),

0 ≤ k, l ≤ 2j − 1,

=1 =2 =3

Ψ1j,κ = ψj,k ψj,l , Ψ2j,κ = ψj,k φj,l , Ψ3j,κ = φj,k ψj,l .

For any square matrix f , of size N × N , N = 2J , we denote by fwt the corresponding 2d orthogonal wavelet transform of J − 1 levels associated to the multiresolution analysis (Vj )j≥0 of L2 (]0, 1[2 ). 1 2 3 As shown in Figure 5, we define PJ−s , PJ−s , and PJ−s , 1 ≤ s ≤ J − 1, the subparts of the wavelet decomposition at level J−s, corresponding to the wavelet families {Ψ1J−s,κ }κ , {Ψ2J−s,κ }κ , and {Ψ3J−s,κ }κ . 1 http://watermarking.unige.ch/Checkmark/

10

3 PJ−2 2 PJ−2

1 PJ−2

2 PJ−1

3 PJ−1

1 PJ−1

Figure 5: Wavelet decomposition

3.2

Five stage method

We assume that the watermark m to be embedded is a binary square matrix of zeros and ones, of size M × M . We associate to m the vector mv , of size M 2 , defined by reading line per line the matrix m (the first M coefficients of mv correspond to the first line of the mark m) The host image f is defined as a dyadic square matrix of size N × N , N = 2J , J > 0, and the corresponding image of edges Cf is defined following the section 2. Following the scheme shown figure 6, the embedding algorithm computes the watermarked image g, from the host image f and the mark m, and is decomposed into five main steps, corresponding to the application of the edge detection algorithm (see section 2), the computation of the wavelet transforms, the embedding process, a merging step and finally the application of the inverse wavelet transform. The result will depend on three private security keys, belonging to the owner of the host image, and needed to extract the watermark, namely • a marking constant R1 • an embedding rate R2 , 0 ≤ R2 ≤ 1 • a set of M 2 randomly chosen positions ∆1M = {(i1k , jk1 ), 1 ≤ k ≤ M 2 } where the mark is embedded. Moreover, we also need a threshold Cp and a constant s (where J − s represents the scale where the mark is embedded) to define the marked image g. Let us detail now the five main steps of the algorithm. • Step 1, Edge detection: Using the algorithm described in section 2, we compute the image of edges Cf , associated to the host image f .

11

Original Image f

2

Wavelet Dec. A 4 fwt AU A Wavelet Dec. gwt

-

1 ? Image of Egdes Cf

2


Wavelet
4 Dec.
∗ 6 Cfwt

Wavelet Dec. Cfwt

5

Marked Image g

3 Watermark m Figure 6: The embedding algorithm • Step 2, Wavelet transforms: Using the orthogonal multiresolution analysis described in the section 3.1, we define the wavelet transform of J − 1 levels of the images f and Cf , denoted fwt , and Cfwt . • Step 3, Embedding process: In this part, choosing the constants s and Cp , and using the marking constant R1 , we embed the mark m in the ∗ wavelet transform Cfwt to define Cfwt . We first search a set of positions ∆ = {(αk , βk ), 1 ≤ k ≤ kmax } in the  parts PJ−s (1 ≤  ≤ 3) such that ∀k, 1 ≤ k ≤ kmax , Cfwt (αk , βk ) ≥ Cp . If kmax ≥ M 2 , we randomly choose a set of M 2 positions ∆1M = {(i1k , jk1 ), 1 ≤ k ≤ M 2 } ⊂ ∆, ∗ where the mark is embedded. Finally the matrix Cfwt is defined as ∗ Cfwt (i1k , jk1 ) = Cfwt (i1k , jk1 ) + mv (k)R1 ,

1 ≤ k ≤ M 2.

Since we work with a binary mark, mv (k) = 0 or 1. If kmax < M 2 , we have to choose a lower constant Cp . • Step 4, Merging: Finally, using the embedding rate R2 , the wavelet transform of the marked image gwt is defined by ∗ gwt = (1 − R2 )fwt + R2 Cfwt .

12

• Step 5, Inverse wavelet transforms: Applying a J − 1 levels inverse wavelet transform on gwt , we define the marked image g. ∗ max Remark 3.1 Using L = b kM 2 c, if L > 1, the definition of Cfwt in the step 3 can be modified in a redundant manner. Let us consider ∆1M defined previously, and all the subsets of M 2 positions

∆lM = {(ilk , jkl ), 1 ≤ k ≤ M 2 } ⊂ ∆, 2 ≤ l ≤ L, l+1 where for all k, 1 ≤ k ≤ M 2 , and for all l, 1 ≤ l ≤ L − 1, (il+1 k , jk ) is the first l l ∗ non marked position in ∆ after (ik , jk ). Then the matrix Cfwt can be defined as

1 ≤ k ≤ M 2,

∗ Cfwt (ilk , jkl ) = Cfwt (ilk , jkl ) + mv (k)R1 ,

1 ≤ l ≤ L.

Remark 3.2 The constants R1 and R2 are chosen by the owner of the host image f before applying the watermarking algorithm, and can be viewed as security keys, needed to extract or remove the watermark from the marked image g. The value of the marking rate R1 displays the importance of the modification of the wavelet transform of the edges Cfwt , and the value of the embedding rate R2 shows the influence of this modification in the definition of gwt . If R2 = 1, ∗ we only consider the modified image of edges to define g (gwt = Cfwt ), while if R2 = 0, g = f , no watermarking process is done. Moreover, changing R2 concern all the points of the marked image g, while ∗ changing R1 influence only the few points of the image of edges Cfwt . Then, the choice of R2 strongly influences the PSNR between the marked image g and the host image f . The PSNR, as shown figure 7, linearly depends on log R 2 . PSNR=f(log(R2)) pour Lenna, avec R1=600,Cp=30,s=3 40

35

PSNR

30

25

20

15 −4

−3.5

−3

−2.5

−2

−1.5

log(R2)

Figure 7: PSNR between the marked image g and the original image f , versus log(R2 ) Remark 3.3 The choice of the constants Cp ans s are in a certain way linked, and influences the resistance to certain type of attacks. Indeed, if we define the set ∆ by searching the available positions in the lower 13

scales (s = J − 1, J − 2), the watermarking process will be resistant to low-pass filtering attacks, but by this way, only few positions are defined, and then only a few amount of information can be embedded. In conclusion, in order to define a sufficiently important set of available positions ∆, a low scale s possibly induces the choice of a small threshold C p , while an upper scale s allows to take higher value of Cp . Remark 3.4 By decreasing the length of the maxima chain, we can define more non-zero points in the image of edges Cf , and then more available positions in the definition of the set ∆ in the embedding step. By this way, we can embed a larger amount of information. Nevertheless, these new points are less visually significant and their perturbations can result visible more rapidly in the marked image g.

3.3

The extraction process

Let us consider g˜ the possibly corrupted watermarked image and m ˜ the corresponding extracted watermark. The extraction processs is done using the original host image f , the randomly chosen set of positions ∆1M and the security constants R1 and R2 , by applying the inverse procedure of the embedding algorithm described section 3.2, and is divided into three main steps. • Step 1: As in the embedding algorithm, we first compute the image of edge Cf associated to the original image f , and applying a J − 1 levels wavelet transform, we define fwt and Cfwt . • Step 2: Using the security key R2 , we compute 1 1 − R2 ˜ Cf g˜wt − fwt . wt = R2 R2 • Step 3: Using the set of position ∆1M , we compute for all k, 1 ≤ k ≤ M 2 , ˜ (i1 , j 1 ) − Cfwt (i1 , j 1 )|. ak = |Cf wt k k k k Then, we define a vector m ˜ v of size M 2 as  ∀k, 1 ≤ k ≤ M 2 if ak ≥ R21 , if ak < R21 ,

then, m ˜ v (k) = 1, then, m ˜ v (k) = 0.

Finally, the vector m ˜ v is transformed into the matrix m. ˜ The robustness of the watermarking technique is then evaluated by computing the rate Cm,m ˜ to the original one ˜ , comparing the extracted watermark m m, and defined as   Ω = k, 1 ≤ k ≤ M 2 /m(k) ˜ = m(k) ,  

Cm,m ˜

=

100 M2

· #(Ω). 14

4 4.1

Numerical results Some embedding tests

In the following, we apply the watermarking algorithm defined section (3.2) to two classical images, namely Lena and Mandrill, respectively of size 2562 and 5122 . The watermark is a binary image of size 16 × 16. Figure 8 displays the original images. Lena

Mandrill

Watermark m 2

4

6

8

10

12

14

16 2

4

6

8

10

12

14

16

Figure 8: Original unmarked images, and the watermark We run the watermarking algorithm for different values of R1 , R2 , and s. The figure 9 displays the obtained results and the difference between the original and marked images.

4.2

Robustness of the watermarking algorithm

The performance of this wavelet watermarking algorithm has been tested using the second generation benchmark for image watermarking called Checkmark[16] (http://watermarking.unige.ch/Checkmark/). In this context, the wide class of watermarking attacks is divided into four main categories: interference and removal attacks, geometrical attacks, cryptographics attacks and protocol attacks. Checkmark produces attacked images from the watermarked images. Figure 10 shows some four examples of geometrical attacks (linear transforms, projective transform, rotation, and warping) while figure 11 presents a set of four interference attacks (dithering, hard thresholding, filtering, compression), obtained through Checkmark on the watermarked image of mandrill. To test the performance of our algorithm, we try to extract the embedded mark, m, ˜ on each of the attacked image produced by Checkmark, and compare it to the original mark m. The tables 1 and 2 shows the extraction results giving the percentage Cm,m ˜ of correctly recovered coefficients, on the two marked images presented figure 9. The names of the attacked images are the names given by the Checkmarck

15

50 50

100 150

100

200 250

150

300 350

200

400 450

250

500 50

100

150

200

250

50

100

150

200

250

300

350

400

450

500

Figure 9: Top: watermarked images (Lena: R1 = 300, R2 = 0.08, s = 4 / Mandrill: R1 = 400, R2 = 0.1, s = 5) – Bottom: difference between the original and marked images

16

linear transforms

projective transforms

rotation

wraping

Figure 10: Set of geometrical attacks produced by Checkmark on Mandrill

17

dithering PSNR=6.64db

compression PSNR=25.06db

hard thresholding PSNR=26.65db

trimmed mean filtering PSNR=22.41db

Figure 11: Set of interference and removal attacks produced by Checkmark on Mandrill – PSNR between the marked image and the corresponding attacked image

18

benchmark, and correspond to the attack that has been done. The letter J denotes a jpeg compression (J50 means that we use a JPEG compression with a compression rate of 50%), the letter W denotes a wavelet compression (which is as strong as the number following W is small). Studying these tables, we see that our marking algorithm is strongly resistent to a wide class of filtering and compression attacks (for example to attacks showed figure 11), since the mark is hided in the edges of the image. We manage to detect correctly almost all the coefficients of the mark, even in attacked images visually strongly deformed. The following list points out the attacks with which • jpeg compression • hard thresholding • wavelet compression • inversion of a certain number of rows and columns • soft thresholding our algorithm deals better: • wiener filtering • gaussian filtering • trimmed mean filtering • dithering Nevertheless, our algorithm doesn’t resist to geometrical attacks, since the positions where we look for the marked points are a secret key (a parameter of our extraction algorithm). For example, if the image is rotated, we will not search at the right places. Moreover, since the set of positions ∆1M are given with respect to a repair whose origin is the left upper point of the image, we can recover the mark into cropped images, but only if the left border and the upper border have not be cropped (so that the positions of the marked points are still correct)

 Let us note that if we hide the mark in the finest scale (in the parts PJ−1 presented figure 5), the results prove very bad. Hiding it more deeply (i.e. choosing a larger value for the scale s) allows to improve the results for most filtering attacks (which generally attack the high frequencies of the image). The table 1 of the results on the Lena image allows to compare the results when hiding the mark in the scale J − 3 (s = 3) and in the scale J − 4 (s = 4).

19

Attacked images cropping4 W150.jpg cropping4 W350.jpg cropping4 W80.jpg cropping6 W150.jpg cropping6 W350.jpg cropping6 W60.jpg cropping6 W80.jpg gaussian1 J100.jpg gaussian2 J100.jpg hardthresh1 J100.jpg hardthresh2 J100.jpg jpegcompression1 J100.jpg jpegcompression1 J15.jpg jpegcompression1 J25.jpg jpegcompression1 J30.jpg jpegcompression1 J40.jpg jpegcompression1 J50.jpg jpegcompression1 J60.jpg jpegcompression1 J75.jpg jpegcompression1 J80.jpg jpegcompression1 J85.jpg jpegcompression1 J90.jpg medfilt2 J100.jpg midpoint1 J100.jpg rowcol1 W150.jpg rowcol1 W350.jpg rowcol1 W80.jpg rowcol1 W800.jpg templateremove1 J100.jpg trimmedmean1 J100.jpg trimmedmean2 J100.jpg waveletcompression1 W150.jpg waveletcompression1 W350.jpg waveletcompression1 W60.jpg waveletcompression1 W80.jpg waveletcompression1 W800.jpg wiener1 J100.jpg wiener2 J100.jpg

R1 = 300, R2 = 0.08 s=3 Cm,m ˜ 84.76 % 85.93 % 73.04 % 82.03 % 83.20 % 66.01 % 83.20 % 85.54 % 85.15 % 69.14 % 58.59 % 100 % 71.87 % 87.10 % 92.18 % 98.04 % 97.65 % 99.21 % 100 % 100 % 100 % 100 % 75 % 60.15 % 84.76 % 85.54 % 72.65 % 86.54 % 82.03 % 80.85 % 59.76 % 98.82 % 100 % 60.54 % 78.12 % 100 % 85.93 % 52.34 %

R1 = 300, R2 = 0.08 s=4 Cm,m ˜ 89.84 % 91.40 % 79.29 % 85.54 % 86.71 % 73.04 % 86.71 % 96.09 % 96.09 % 87.89 % 85.93 % 100 % 62.5 % 84.79 % 91.79 % 95.31 % 98.04 % 100 % 100 % 100 % 100 % 100 % 91.01 % 78.51 % 90.23 % 91.01 % 80.07 % 90.62 % 96.48 % 93.35 % 74.21 % 97.65 % 100 % 69.53 % 84.37 % 100 % 96.48 % 80.85 %

Table 1: Results of Checkmark on Lena 2562

20

Attacked images cropping4 W150.jpg cropping4 W350.jpg cropping4 W800.jpg cropping6 W150.jpg cropping6 W350.jpg cropping6 W800.jpg dither1 J100.jpg dpr1 J100.jpg dpr2 J100.jpg dprcorr1 J100.jpg dprcorr2 J100.jpg gaussian1 J100.jpg gaussian2 J100.jpg hardthresh1 J100.jpg hardthresh2 J100.jpg jpegcompression1 J10.jpg jpegcompression1 J100.jpg jpegcompression1 J15.jpg jpegcompression1 J25.jpg jpegcompression1 J30.jpg jpegcompression1 J40.jpg jpegcompression1 J50.jpg jpegcompression1 J60.jpg jpegcompression1 J75.jpg jpegcompression1 J80.jpg jpegcompression1 J85.jpg jpegcompression1 J90.jpg

R1 = 400, R2 = 0.1 s=5 Cm,m ˜ 84.37 % 88.67 % 88.67 % 82.03 % 85.54 % 85.54 % 95.70 % 81.25 % 80.46 % 81.64 % 79.29 % 96.48 % 96.48 % 89.45 % 89.06 % 73.04 % 100 % 84.37 % 96.48 % 98.82 % 100 % 99.6 % 100 % 100 % 100 % 100 % 100 %

Attacked images medfilt1 J100.jpg medfilt2 J100.jpg midpoint1 J100.jpg rowcol1 W150.jpg rowcol1 W350.jpg rowcol1 W800.jpg sampledownup1 J100.jpg sampledownup2 J100.jpg softthresh1 J100.jpg softthresh2 J100.jpg templateremove1 J100.jpg trimmedmean1 J100.jpg trimmedmean2 J100.jpg waveletcompression1 W150.jpg waveletcompression1 W350.jpg waveletcompression1 W60.jpg waveletcompression1 W80.jpg waveletcompression1 W800.jpg wiener1 J100.jpg wiener2 J100.jpg

Table 2: Results of Checkmark on Mandrill 5122

5

Conclusion

We have defined a new wavelet watermarking process for images, of private type with restricted keys, based on edge detection techniques using wavelets. To define a marked image g, from a host image f and a watermark m, we first apply a edge detection algorithm on f , to obtain the corresponding image of geometrical edges Cf , which has to be viewed as the map where we can add the watermark in order to define g visually similar to f . Numerical results have been given, and the robustness of our watermarking algorithm has been studied using the benchmark Checkmark. A good resistance 21

R1 = 400, R2 = 0.1 s=5 Cm,m ˜ 78.12 % 90.23 % 82.03 % 83.98 % 88.28 % 88.67 % 77.34 % 73.43 % 94.92 % 96.09 % 98.82 % 96.09 % 95.70 % 98.96 % 100 % 74.21 % 78.12 % 100 % 100 % 92.96 %

to interference attacks, like filtering, compression, dithering, has been shown. For instance, this algorithm, created to resist to compression and filtering, is not adapted to counter geometrical attacks.

References [1] K. Berkner, R.O. Wells, A new hierarchical scheme for approximating the continuous wavelet transform with applications to edge detection, IEEE Signal Processing Letters, 6 no. 8 (1999) 148–153. [2] J. Canny, A computational approach to edge detection, IEEE Trans. Patt. Anal. and Mach. Intell., PAMI-8 no. 6 (1986) 679-698. [3] R. Dugad, K. Ratakonda, N. Ahuja, A new Wavelet-based Scheme for Watermarking Images, Proceedings of the IEEE International Conference on Image Processing, ICIP ’98 (1998). [4] W. T. Freeman, E. H. Adelson, The Design and Use of Steerable Filters, IEEE Trans. Patt. Anal. and Mach. Int. (1991). [5] D. Kundur, D. Hatzinakos, A Robust Image Watermarking Method using Wavelet-Based Fusion, IEEE Sig. Proc. Society (1997). [6] O. Le Cadet, D´etection et caract´erisation des contours d’une image. Application la segmentation d’images m´edicales et au watermarking., PhD thesis (2004). [7] O. Le Cadet, V. Perrier, Edge detection and classification through the directional Multiscale Canny Transform, to be submitted. [8] J. Levy Vehel, A. Manoury, Wavelet packet based digital watermarking, ICPR (2000). [9] S. Mallat, A Wavelet Tour of Signal Processing, Academic Press (1998). [10] S. Mallat, W.L. Hwang, Singularity Detection and Processing with Wavelet, IEEE Trans. Info. Theory 38(2) (1992) 617–643. [11] S. Mallat, S. Zhong, Characterization of signals from multiscale edges, IEEE Trans. On Patt. An. And Mach. Int. 14(7) (1992) 710–732. [12] P. Meerwald, A. Uhl, A Survey of Wavelet-Domain Watermarking Algorithms, Ping Wah Wong and Edward J. Delp, editors, Proceedings of SPIE, Electronic Imaging, Security and Watermarking of Multimedia Contents III, volume 4314, San Jose, CA, USA, SPIE (2001).

[13] P. Meerwald, Digital Image Watermarking in the Wavelet Transform Domain, Master’s thesis, Department of Scientific Computing, University of Salzburg, Austria (2001).

22

[14] R. Murenzi, Ondelettes multidimensionnelles et applications l’analyse d’images, thse de doctorat, universit catholique de Louvain, Belgique, 1990. [15] N. Nikolaidis, I. Pitas, Digital Image Watermarking: an Overview, ICMCS 99, Volume 1, Florence, Italy (1999), pp 1–6. [16] S. Pereira, S. Voloshynovskiy, M. Madueno, S. Marchand-Maillet, T. Pun, Second Generation benchmarking and Application oriented evaluation, Information Hiding Workshop III, Pittsburg, PA, USA (2001). [17] J. K. O Ruanaidh, W. J. Dowling, and F. M. Boland. Watermarking digital images for copyright protection, I.E.E. Proceedings on Vision, Signal and Image Processing 143(4) (1996) 250–256. [18] M. Unser, A. Aldroubi, M. Eden, On the asymptotic convergence of Bspline wavelets to Gabor functions, IEEE Trans. of Information Theory 38(2) (1992) 864–872.

23