Easy and Fast Photo Watermarking

Visual Watermark is photo watermarking software for digital image protection. This picture watermark software places very strong watermarks that no one can remove. Your digital images will be effectively protected from unauthorized use. It is useful for everyone who wants to protect their pictures. Read more...

	Size: 2.37 Mb, for Windows Vista, XP, 2000 and 98
	Personal Version - $34.95 (can NOT be used for commercial purposes).
	Business Version - $59.95 (can be used for commercial purposes).
We accept Visa, MasterCard/EuroCard, American Express, bank/wire transfers and PayPal.

Watermarking FAQ

August 26, 2005

1 Introduction
2 Image Watermarking
3 Video Watermarking
4 Audio Watermarking
5 Signal Processing for Watermarking
6 Others

1 Introduction

Easy and Fast Photo Watermarking
Visual Watermark is photo watermarking software for digital image protection. This picture watermark software places very strong watermarks that no one can remove. Your digital images will be effectively protected from unauthorized use. It is useful for everyone who wants to protect their pictures. Read more...

Size: 2.37 Mb, for Windows Vista, XP, 2000 and 98

Personal Version - $34.95 (can NOT be used for commercial purposes).

Business Version - $59.95 (can be used for commercial purposes).

We accept Visa, MasterCard/EuroCard, American Express, bank/wire transfers and PayPal.

This document answers some of the frequently asked questions on watermarking. To join this list, please refer to the subscription information on http://www.watermarkingworld.org/ml.html. If you like to contribute to this ``FAQ``, please email your questions/answers to faq@watermarkingworld.org. The latest copy of this FAQ can be found at http://www.watermarkingworld.org

1.1 What is a "watermark'' ?

Although different authors use different meanings for the word 'watermark', it is mostly agreed that the watermark is one, which is imperceptibly added to the cover-signal in order to convey the hidden data.

1.2 What is "watermarking'' ?

The process of embedding information into another object/signal can be termed as watermarking.

1.3 What is the use of watermarking and its applications ?

Watermarking (now-a-days) is mainly used for copy-protection and copyright-protection (1.4). Historically, watermarking has been used to send ``sensitive'' information hidden in another signal (1.12) . Watermarking has its applications in image/video copyright protection.

1.4 What is the difference between ``copy protection'' ``copyright protection'' ?

Copy protection attempts to find ways, which limits the access to copyrighted material and/or inhibit the copy process itself. Examples of copy protection include encrypted digital TV broadcast, access controls to copyrighted software through the use of license servers and technical copy protection mechanisms on the media. A recent example is the copy protection mechanism on DVDs. However, copy protection is very difficult to achieve in open systems, as recent incidents (like the DVD hack - DeCss) show.

Copyright protection inserts copyright information into the digital object without the loss of quality. Whenever the copyright of a digital object is in question, this information is extracted to identify the rightful owner. It is also possible to encode the identity of the original buyer along with the identity of the copyright holder, which allows tracing of any unauthorized copies. The most prominent way of embedding information in multimedia data is the use of digital watermarking.

Whereas copy protection seems to be difficult to implement, copyright protection protocols based on watermarking and strong cryptography are likely to be feasible.

1.5 What is a Original image ?

Consider the following scenario: Alice, the copyright holder, inserts her own watermark into some object, locks the original away and keeps selling the marked image. Bob can now try to insert his own watermark into the already marked object. In case of a dispute, both Alice and Bob are able to prove the presence of "their" watermark and claim ownership of the document. How can this situation be resolved?

The "traditional" answer is: look at the objects, Alice and Bob claim to be the original. Alice's original should not contain a watermark, whereas Bob's "original" must contain Alice's watermark (if we assume that Bob cannot remove marks). This situation would indicate that Bob inserted his watermark after Alice and so one may conclude that Alice is the rightful owner.

Unfortunately, sometimes the situation is not that simple. It has been shown that, in particular class of watermarking schemes, Bob can insert his watermark in a way that it also seems to be present in the copy Alice locked away (although he has no access to it). So Alice's original contains Bob's mark and Bob's "original" contains Alice's mark. This type of attack is called "inversion attack" or more "dead lock attack". There is no way to resolve copyright ownership in this case. This result indicates that watermarking "alone", that is without a carefully designed protocol around it, will not suffice to resolve the copyright situation.

1.6 Why not add the copyright information into the file format ?

One could define a new audio file format, in which the watermark is a part of the header block but is not removable without destroying the original signal, because part of the definition of the file format requires the watermark to be therein. In this case the signal would not really be literally 'destroyed' but any application using this file format would not touch it without a valid watermark. Some electronic copyright management system propose mechanisms like this. Such schemes are weak as anyone with a computer or a digital editing workstation would be able to convert the information to another format and remove the watermark at the same time. Finally this new audio format would be incompatible with the existing one. Thus the watermark should really be embedded in the audio signal.

This is very similar to S.C.M.S (Serial Code Management System). When Philips and Sony introduced the 'S/PDIF' (Sony/Phillips Digital Interchange Format), they included the S.C.M.S. which provides a way to regulate copies of digital music in the consumer market. This information is added to the stream of data that contains the music when one makes a digital copy (a 'clone'). This is in fact just a bit saying: digital copy prohibited or permitted. Some professional equipment are exempt for needing S.C.M.S.

With watermarking however, the copy control information is part of the audio-visual signal and aim at surviving file format conversion and other transformations.

1.7 What is the difference between watermarking, steganography, and cryptography ?

While cryptography is about protecting the content of messages (their meaning), steganography is about concealing their very existence. It comes from Greek roots, literally means 'covered writing', and is usually interpreted to mean hiding information in other information. Examples include sending a message to a spy by marking certain letters in a newspaper using invisible ink, and adding sub-perceptible echo at certain places in an audio recording. It is often thought that communications may be secured by encrypting the traffic, but this has rarely been adequate in practice. Aneas the Tactician, and other classical writers, concentrated on methods for hiding messages rather than for enciphering them; and although modern cryptographic techniques started to develop during the Renaissance, we find in 1641 that John Wilkins still preferred hiding over ciphering because it arouses less suspicion. This preference persists in many operational contexts to this day. For example, an encrypted email message between a known drug dealer and somebody not yet under suspicion, or between an employee of a defense contractor and the embassy of a hostile power, has obvious implications.

As the purpose of steganography is having a covert communication between two parties whose existence is unknown to a possible attacker, a successful attack consists in detecting the existence of this communication (e.g., using statistical analysis of images with and without hidden information). Watermarking, as opposed to steganography, has the (additional) requirement of robustness against possible attacks. In this context, the term 'robustness' is still not very clear; it mainly depends on the application. Copyright marks do not always need to be hidden, as some systems use visible digital watermarks, but most of the literature has focused on imperceptible (e.g., invisible, inaudible) digital watermarks which have wider applications. Visible digital watermarks are strongly linked to the original paper watermarks which appeared at the end of the XIII century to differentiate paper makers of that time. Modern visible watermarks may be visual patterns (e.g., a company logo or copyright sign) overlaid on digital images. The intent of use is also different: the payload of a watermark can be perceived as an attribute of the cover-signal (e.g., copyright information, license, ownership, etc.). In most cases the information hidden using steganographic techniques is not related at all to the cover. These differences in goal lead to very different hiding techniques.

1.8 What are 'public watermarking', 'blind watermarking', 'semi-blind watermarking', 'private watermarking', 'non-blind watermarking' and 'asymmetric watermarking' ?

There as been some confusion about the naming of various types of watermarking techniques and the main reason is that people involved in this field come from different backgrounds (in particular signal processing and computer security). On top of this some terminology has been imported from the related field of steganography.

Originally, public watermarking and blind watermarking mean the same, but the wording was confusing with public-key watermarking. 'Signal processing people' took over the field, so only the later tends to remain. In these schemes, the cover signal (the original signal) is not needed during the detection process to detect the mark. Solely the key, which is typically used to generate some random sequence used during the embedding process, is required. These types of schemes can be used easily in mass market electronic equipment or software.

In some cases you may need extra information to help your detector (in particular to synchronise its random sequence on the possibly distorted test signal). In particular some watermarking schemes require access to the 'published' watermarked signal, that is the original signal just after adding the watermark. People refer to these schemes as semi-blind watermarking schemes.

Private watermarking and non-blind-watermarking mean the same: the original cover signal is required during the detection process.

At last, by asymmetric watermarking or public-key watermarking, people refer to watermarking schemes with properties reminding asymmetric cryptosystem (or public key cryptosystem). No such system really exists yet although some possible suggestions have been made. In this case, the detection process (and in particular the detection key) is fully known to anyone as opposed to blind watermarking where a secret key is required. So here, only a 'public key' is needed for verification and a 'private key' (secret) is used for the embedding though. Knowledge of the public key does not help to compute the private key (at least in a reasonable time), it does not either allow removal of the mark nor it allows an attacker to forge a mark.

1.9 What is the difference between (semi-) fragile and robust watermarks ?

The aims of such watermarks are completely different: A (semi-)fragile watermark is a mark which is (highly) sensitive to a modification of the stego-medium. A fragile watermarking scheme should be able to detect any change in the signal and identify where it has taken place and possibly what the signal was before modification. It serves at proving the authenticity of a document. On the opposite, a robust watermark should be stuck to the document it has been embedded in, in such a way that any signal transform of reasonable strength cannot remove the watermark. Hence a pirate willing to remove the watermark will not succeed unless they debase the document too much to be of commercial interest. The latter form is the very challenging and attracts most research.

1.10 What are the different attributes associated with watermarking ?

The characteristics of an watermarking algorithm is normally tied to the application is was designed for. The following merely explain the words used in the context of watermarking.

Imperceptibility: In watermarking, we traditionally seek high fidelity, i.e. the watermarked work must look or sound like the original. Whether or not this is a good goal is a different discussion.
Robustness: It is more a property and not a requirement of watermarking. The watermark should be able to survive any resonable processing inflicted on the carrier (carrier here refers to the content being watermarked).
Security: The watermarked image should not reveal any clues of the presence of the wateramark, with respect to un-authorized detection, or (statistical) undetectability or unsuspicious (not the same as imperceptability).

1.11 What are fingerprints ?

Fingerprints are characteristics of an object that tend to distinguish it from other similar objects. They enable the owner to trace authorized users distributing them illegally. In the case of encrypted satellite television broadcasting, for instance, users could be issued a set of keys to decrypt the video streams and the television station could insert fingerprint bits into each packet of the traffic to detect unauthorized uses. If a group of users give their subset of keys to unauthorized people (so that they can also decrypt the traffic) at least one of the key donors can be traced, when the unauthorized decoder is captured. In this respect, fingerprinting is usually discussed in the context of the traitor tracing problem.

1.12 What is the oldest(historical) method developed/used for the purpose of ownership protection ?

The original paper watermarks appeared at the end of the 13th century to differentiate paper makers of that time. Modern visible watermarks may be visual patterns (e.g., a company logo or copyright sign) overlaid on digital images and are widely used by many photographers who do not trust invisible watermarking techniques enough.

In the 17th century, Claude GellA�e of Lorraine (1600a1682), also known as Claude Lorrain, introduced a method for protecting his intellectual property nearly hundred years before any relevant law was introduced (the first 'copyright' law was the 'Statute of Anne' introduced by the English Parliament in 1710.) From some time around 1635 until the end of his life in 1682, Lorrain kept a book that he called the Liber Veritatis (now kept in the British Museum in London). The Liber Veritatis was a collection of drawings in the form of a sketchbook. The book was specially made for him, with a scheme of alternating pages, four blue pages followed by four white, which repeated in this manner and contained around 195 drawings. One of Lorrain's biographers, reported that the purpose in creating the Liber Veritatis was to protect Lorrain against forgery (it is not clear 'how far the objective of protection against forgery can be accepted as an adequate example of the book's raison d'A^atre') In fact, any comparison between drawings and paintings goes to show that the former were designed to serve as a `check' on the latter and from the Liber any very careful observer could tell whether a given painting was a forgery or not.

Similar techniques are being used today. ImageLock, for instance, keeps a central database of image digests and periodically searches the Web for images having the same digest. Tracking systems based on private watermarks also require central databases. Unfortunately, apart from the extent of the problem (which is now global) nothing much has changed, since such services still do not provide any proof of infringement.

1.13 What are people referring to when they say, they are working on watermarking. Do they all develop their own techniques?

[Jeffrey A Bloom] Yes. Most people who publish papers in this field are developing new algorithms. It may be helpful to think of watermarking "backwards", i.e. from the perspective of detection. Consider an image watermarking system.

Define some algorithm to "extract" a watermark (this could be taking the 1000 highest amplitude DCT coeffs, or averaging the 8x8 blocks of an image, or subtracting the original and projecting onto some subspace, or finding salient points, finding the Delaunay triangulation of those points and representing the result as a graph, etc.)
Modify the image so that the extracted watermark will be "similar" to some predefined watermark (or set of watermarks). This may be done by adding something to the image or by multiplying the image by some spatially variant map. We may modify some values relative to others, increase one subset and decrease another subset of pixels or coefficients, warp the image to obtain a particular arrangement of salient points, etc. The modification might be done under the control of a perceptual model to limit the fidelity impact. It may be done under the control of a distortion model to maximize the robustness.

Different algorithms employ different extraction functions and thus different embedding functions. They differ in the models used to control fidelity, robustness, security, bitrate, error rates.

You will find two classes of watermarking papers in the literature, those that present new algorithms, and those that point out weaknesses in previously presented algorithms. Hopefully, new algorithms do not have the same weaknesses that have already been identified.

1.14 Is there a secure/robust/removal resilient watermarking technique ?

Yes and No.

The use of these terms on an application specific case might be true but not universally. So, a better question is ``Is this watermarking technique secure/robust for this application ?''. There is the same problem in cryptography: people think their system is secure because it uses RSA. This is an illusion: hackers focus their effort on protocols or on implementations but they never try to break RSA

[Jeffrey A Bloom] Try the early Digimarc patents. Geoffrey Rhoads does an excellent job in the disclosures describing "knots" and "rings" and "tapestries". That technique is robust to rotation, crop, and resize, it is a blind detection technique, it is an n-bit watermark, i.e. it has a payload rather than a 0-bit watermark which is simply present or absent, but carries 0-bits worth of information. I suspect that these patents are the foundation of the Mediabridge technology. That is clearly blind, multi-bit, and robust to the distortions you mention (as well as others).

For example, try:

Geoffrey B. Rhoads,''Image steganography system featuring perceptually adaptive and globally scalable signal embedding",United States Patent 5,748,763,1998,

Geoffrey B. Rhoads,"Steganography system",United States Patent 5,850,481, 1998

2 Image Watermarking

The digital age has simplified the process of content delivery and has increased the ease at which the buyer can re-distrubute the content, thus denying the income to the seller. Images published on the internet is an example of such content. This section will deal with questions related to image watermarking.

2.1 What is the difference between visible and invisible watermarking ?

Visibility is a term associated with the perception of the human eye. A watermarked image in which the watermark is imperceptible, or the watermarked image is visually identical to its orginal constitutes a invisible watermarking. Examples include images distrubuted over internet with watermarks embedded in them for copyright protection. Those which fail can be classified as visible watermarks. Examples include logos used in papers in currencies.

2.2 What are spatial watermarks ? If they are perceptually based, are they always robust ?

Spatial domain, additive watermarking is the same as additive watermarking in any domain that is a linear transformation of the spatial domain, e.g. Fourier, block DCT, wavelet, etc. It usually means that someone has created a watermark pattern that has the same dimensions as the original image and has added the watermark pattern to the image.

The watermark pattern can be modified by, or even created with a perceptual analysis of the original image. This does not directly effect the robustness. Perceptual modeling usually improves the fidelity so that means, for the same fidelity impact, you might be able to embed a "stronger" watermark. Often, "stronger" implies more robust, but not always. The following papers are recommend to see that "stronger" does not always mean more robust.

M.L. Miller, I.J. Cox, and J.A. Bloom, ``Informed embedding: exploiting image and detector information during watermark insertion'', Proceedings of the IEEE International Conference on Image Processing, vol. 3, pp. 1-4, 2000.
Also, the book "Digital Watermarking" has many good references to perceptual modeling and shows some implementations that optimize the embedding process based on a perceptual model (Watson's model is used as an example).
C. Podilchuk and W. Zeng, ``Image Adaptive Watermarking Using Visual Models'', IEEE Journal on Selected Areas inCommunications, 16(4):525-540, May 1998.
I.J. Cox and M.L. Miller, "A review of watermarking and the importance of perceptual modeling", Proc. SPIE Conf. on Human Vision and Electronic Imaging II, Vol 3016, 92-99, February 1987.

2.3 What will happen if you watermark the watermarked image? Could this be regarded as a kind of attack? and if so what is its effect?

Yes and No.

Multiple watermarks can be considered as attacks in situations wherein one expects the presence of single watermark. Thus, any second operation of watermark embedding or any other processing on the carrier can be considered as an attack. The survival of the watermark in those cases is dependent on the application. A robust watermark is expected to survive such operations. Some watermarking tools do not allow you to insert a watermark if an image already contains a watermark from the same tool. Sometimes, a watermark from one tool may get overwritten with a watermark from another.

There are instances where, a carrier is intentionally watermarked multiple times. Consider the situation, wherein Alice buys the distrubuting rights for an watermarked image from Bob(watermark contains info about Bob). Whenever Alice sells the image to her customer, she watermarks the image with the customer information. In this situation, the final image should contain both the watermarks. The presence of both watermarks help in avoiding copyright theft and illegal copy/distrubution. In cases of multiple watermarks, the order in which different watermarks are embedded may influence the detectability. A strong watermark embedded after a weak watermark will mask the weak watermark and render it undetectable.

The following refer to the set of papers touching the issue of multiple watermarks

Ross Anderson, Fabien A.P. Petitcolas, and Markus G. Kuhn, "Attacks on Copyright Marking Systems." Workshop on Information Hiding Proceedings, Portland, Oregon, USA, 15 - 17 April 1998. Lecture Notes in Computer Science, Vol. 1525, Springer-Verlag URL: http://www.cl.cam.ac.uk/~fapp2/papers/ih98-attacks/
Neil F. Johnson and Sushil Jajodia, "Steganalysis of Images Created using Current Steganography Software," Workshop on Information Hiding Proceedings, Portland, Oregon, USA, 15 - 17 April 1998. Lecture Notes in Computer Science, Vol. 1525, Springer-Verlag: 273-289. URL: http://www.jjtc.com/pub/ihw98a.htm
Scott Craver, Nasir Memon, Boon-Lock Yeo, Minerva Yeung. "Can Invisible Watermarks Resolve Rightful Ownerships?," SPIE Storage and Retrieval for Still Images and Video Databases, Feb. 1997. Vol. V No. 3022 1997. pp. 310-321.
Scott Craver, Nasir Memon, Boon-Lock Yeo, Minerva Yeung. "Resolving Rightful Ownerships with Invisible Watermarking Techniques: Limitations, Attacks, and Implications" in IEEE Journal Selected Areas of Communications (JSAC), May 1998, pp. 573-586
Neil F. Johnson, "In Search of the Right Image: Recognition and Tracking of Images in Image Databases, Collections, and The Internet," Center for Secure Information Systems Technical Report CSIS-TR-99-05-NFJ, April 1999. HTML and Postscript versions of this technical report are available at: http://www.jjtc.com/Steganography/
M. Barni, F. Bartolini, A. De Rosa and A. Piva, "Capacity of a Watermark-Channel: How Many Bits Can Be Hidden Within A Digital Image ?"
Sergio D. Servetto, Christine I. Podilchuk, and Kannan Ramachandran, "Capacity Issues In Digital Image Watermarking"
J.J.K O' Ruanaidh, W.J. Dowling, and F.M. Boland, "Watermarking Digital Images for Copyright Protection"

[David Freson] I believe the root of this issue is the image's capacity to convey the watermarks. If you consider the image as a noisy channel, obviously the image has a bounded capacity. Using spread-spectrum based techniques will allow to reduce interference of the image with the embedded watermark and possible other watermarks (in the multiple watermarking context). Yet interference is bilateral, and raising the number of watermarks or the number of marked image channels will impair reliable watermark detection (lowering the computed correlation versus a pe-defined threshold e.g.). Watermark extraction will even be impaired more rapidly, i.e. you still might be able to detect the watermark, but reliable extraction of the stego-bits will not be possible.Seeing this way, multiple watermarking can be regarded as an watermark detection disabling attack.

2.4 Will watermark survive compression/quantization ?

The simplest of the domains to insert watermark is the spatial domain, where the pixel value of the image is modified. Changing the pixel value does effect the image statistics. Due to the attribute of a watermark being imperceptible(in case of invisible watermark), there cannot be much devation from the original image statistics. In this situation, the watermark influence on each pixel must be atleast equal to one quantization step to survive. Similar arguments can be made for watermarks inserted in other domains. The general notion adopted is, if the watermarks are embedded in the same domain as the compression, then they have a higher probability of survival of such operations. (Ex. DCT domain for JPEG compression)

2.5 How can an image be watermarked ?

Visible watermarks on images can be easily achieved thorough image editing software. Ex. imagemagick or any other, which have the watermark functionality. Invisible watermarks on images can be achieved through some properitary softwares. There are several papers in the literary world which help one to implement their own invisible watermark. The following are some of the places to start with to learn/implement watermarking for images.

Papers:

temptemp

Books :

http://www.watermarkingworld.org/books.html

Source Code:

http://www.cosy.sbg.ac.at/~pmeerw/Watermarking/

3 Video Watermarking

3.1 What is video watermarking ?

A very simple defintion of video watermarking would be, ``The process of watermarking the sequence of video frames''. There are several avenues in case of video to watermark. One can watermark the raw frame data, or the compressed data, where watermarking the later is more challenging.

3.2 Can you provide me with some papers in video watermarking ?

Pioneer work from Hartung & Girod, "Watermarking of Uncompressed and Compressed Video", Signal Processing, 66(3):283-301, 1998.
Philips algorithm JAWS (Kalker et al.), "A Video Watermarking System for Broadcast Monitoring", SPIE 3657, Security and Watermarking of Multimedia Content, pp. 103-112, 1999.
Swanson and his temporal wavelets, "Multiresolution Scene-Based Video Watermarking Using Perceptual Models", IEEE Journal on Selected Areas in Communications, 16(4):540-550, 1998.
Langelaar and his real-time algorithms, "Real-Time Labelling of MPEG-2 Compressed Video", Jounal of Visual Communication and Image Representation, 9(4):256-270, 1998.
Su and her anti-collusion algorithm, "A Novel Approach to Collusion-Resistant Video Watermarking", SPIE 4675, Security and Watermarking of Multimedia Content IV, pp. 491-502, 2002.
Hartung and his work on drift compensation
Langelaar's work
Watermarking in motion vectors, Jordan et al., "Proposal of Watermarking Technique for Hiding/Retrieving Data in Compressed and Decompressed Video", ISO/IEC JTC1/SC29/WG11, 1997.
Alternative strategy for I, P and B frames, Hsu & Wu "DCT-based Watermarking for Video", IEEE Transactions on Consumer Electronics, 44(1):206-216, 1998.

3.3 Where can I find more information on mpeg?

http://www.mpeg.org

3.4 How is video watermarking different in comparison to image watermarking?

Videos can be considered as a stream of individual images. Hence, all image watermarking techniques are equally applicable to video when the individual frames are treated as images. Such techniques do not make use of the availability of the temporal domain apart from the spatial domain which images provide. This can lead to the design and use of sophisticated techniques, exploiting the presence of temporal domain. At the same time, the video provide new avenues for designing better attacks as well.

3.5 What are the applications of video watermarking ?

digital archives, copyright, legal delivery of content, anti-piracy, broadcast monitoring, etc ...

4 Audio Watermarking

4.1 What is audio watermarking ?

Audio, like any other data, constitutes a carrier for physo-acoustically hidden data. Thus the process of embedding information into audio can be termed as audio watermarking.

4.2 What are the applications of audio watermarking ?

Audio content, unlike video or images, doesn't need much help to copyright ownership (Ex.one cannot dispute as to who sang ``another brick in the wall'' - Rogers Waters wrote it). The use of watermarking in audio is more into the tracing the delivery of content, by inserting details about the distrubutor and the buyer. It is also used to search through digitised archives.

4.3 Can you provide me some starting point for audio watermarking ?

http://table-saw.media.mit.edu/DataHiding/
J.F. Tilik, A.A. Beex. "Encoding a hidden digital signature onto an audio signal using psycho-acoustic masking", in Proc. 1996 7th International Conf. on Signal Processing Apps and Tech.. pp 476-480

[list some very basic links which exaplain why/how audio content is watermarked]

5 Signal Processing for Watermarking

5.1 What are the advantages of watermarking in different domains ex.DCT Vs DWT ?

[Matthew Miller] All the different domains like DCT, DWT used in watermarking are energy preserving, orthogonal transforms.

The way I think about them is to imagine their effects on a high-dimensional "media space", in which each axis corresponds to one value in the representation of a Work (e.g. in image space, each axis might correspond to the brightness of one pixel, in audio space, each axis might correspond to one audio sample, etc.). Thus, each point in this space is a representation of a Work (image, audio clip, etc.). When you apply an energy-preserving, orthogonal transform, what you're doing is rotating the coordinate system so that each axis has a new interpretation (e.g. instead of pixels, they're now frequencies).

If the watermarking method is independent of the coordinate axes, applying one of these transforms will have no effect on its performance. For example, consider a very simple embedder that applies a transform, adds a white noise pattern, and inverts the transform. Since white noise is radially symmetric, the probability distribution of watermark patterns is independent of the coordinate system. This means that, no matter what transform you use, you don't change the distribution of watermarked images. The transform will have no effect on the performance.

Where people usually think of transforms as making a difference is in what happens when the watermark pattern is not white noise. For example, you might make an image watermark pattern that's white noise inside a disk, but zero outside that disk. If you add such a pattern in a frequency domain, you'll get a low-frequency watermark pattern. But this is just a matter of convenience, rather than a fundamental issue. You can generate low-frequency patterns in any domain; it's just most convenient to do it in a frequency domain.

If one does something non-linear in embedding, such as watermarking the magnitudes of the FFT (taking a magnitude is a non-linear operation), or applying some form of perceptual modelling (which is almost always wildly non-linear) then the domain in which it's done _does_ become fundamentally important. But the non-linear part of the algorithm must be specified before one can think about the relative merits of different transforms. In general, the non-linear stuff will only make any sense in one transform. So it's really the non-linear parts of the algorithm that are important. The transform is just a tool.

5.2 Is there any advantage in frequency domain watermarking over spatial domain watermarking, other than being resistant to a high noise level enviroment ?

The Human Visual System (HVS) naturally leads to working in the freq. domain (eg. high freq. -> noise), it is easier to adjust the watermark to contrast sensitivity constraints if one considers the freq. domain (see eg. Kundur's paper 'A Robust Digital Image Watermarking Method using Wavelet-Based Fusion' 1997)

5.3 Why is watermark embedded in only luminance components rather then in chroma components as well in image/video?

[Neil F. Johnson] It has more to do with the survivability of the marked areas within an image. Color can easily be changed or converted to grayscale and you still have a "useable" image. In marking an image, one want to place the mark in the more robust areas of an image. Areas of high luminance is not the correct assessment, because a plain sky may have high luminance but a poor structure for hiding information. What the watermark tools are really interested in are areas with high gradient magnitude. In other words, relatively strong edges with respect to the structure of the image and the luminance variances of the "edges."

[Lars R. Randleff] A lot of watermarking schemes hide data in the luminance/intensity due to the fact that the Human Visual System (HVS) use most of its bandwidth on percepting (changes in) brightness. In changing an image, by e.g. JPEG compression, one therefore has to be more gentle to the brightnes information than to the color information (hue/saturation) since small changes in lightness might be easilier detectable than large changes in color. If the compression changes the brightness in an image, this will give the outcome a poor quality to the HVS, and that is why these changes are avoided. For the watermark to be robust to e.g. compression, the watermark has to be in parts of the image that will not be changed in the compression.That is a reason why hiding data in the Luminance is a good idea.

[Martin Kutter] In 1997 we suggested to use the blue channel to embed a spread spectrum based watermark into an image (see http://ltssg3.epfl.ch:1248/kutter/watermarking, M. Kutter, F. Jordan, F. Bossen, "Digital signature of color images using amplitude modulation"). The blue channel was used because the HVS is less sensitive to blue colors due to the fact that the blue cones (S-cones) are less densely distributed than the green and red cones (M-, L-cones) in the foveal part of the human retina. Since then, we made numerous subjective tests and found that in average the energy of a blue channel watermark is up to 50 times larger than the energy of a luminance watermark, of course both introducing visually equivalent artifacts. This implies that the blue channel watermark is more robust towards attacks such as filtering (averaging, median, ...) and additive noise. Furthermore, we found that under lossy JPEG compression both approaches are approximately equivalent. However, one problem that goes with blue channel watermarks is that it is more difficult to control, or predict, the artifacts. That is, the visibility of a luminance watermark is more homogeneous and less dependent on the image colors. Therefore, the design of blue (or any other color) channel watermarks is more delicate and requires sophisticated models of the HVS to optimally adapt the watermark to the local contrast, intensity, and color.

5.4 Will it be effective to do watermarking in both spatial and frequency domain simultaneously ?

Shelby Pereira, Sviatoslav Voloshynovskiy and Thierry Pun, Optimized wavelet domain watermark embedding strategy using linear programming, In Harold H. Szu and Martin Vetterli eds., Wavelet Applications VII (part of SPIE AeroSense 2000), Orlando, Florida USA, April 26-28 2000.
Shelby Pereira, Sviatoslav Voloshynovskiy and Thierry Pun, Effective channel coding for DCT watermarks, In IEEE International Conference on Image Processing ICIP 2000, Vancouver, Canada, September 10-13 2000.
Shelby Pereira, Svyatoslv Voloshynovskiy and Thierry Pun, Optimal transform domain watermark embedding via linear programming, Signal Processing, Special Issue: Information Theoretic Issues in Digita Watermarking, 2001.

5.5 Is there a watermarking technique that is resistant to translation, rotation, scaling and general affine skew ?

http://www.kodak.com/US/plugins/acrobat/en/corp/researchDevelopment/dataEmbedding.pdf

5.6 How can the attacker design the wiener filter without knowing the power spectrum of watermark and host data? Does the attacker know the design algorithm of the watermark?

[Joachim Eggers] Until about 1998, you could observe the following procedure in the reearch on digital watermarking:

Somebody, let us say X, invents a watermarking algorithm.
Somebody else, say Y, comes up with a successful attack.
X analyses the successful attack and improves his watermarking technology
Y looks at the improved scheme and comes up with a better attack.
go to 3.

It really looked like a never ending story. Does this process converge? When can we be sure that a watermarking scheme is really secure and/or robust?

We would like to break this endless loop. Thus, we assume that the attacker knows the embedders strategy and the statistics of the host data. Note that he does not know the exact realization of the embedded watermark nor the exact realization of the host data. With this setup, we investigate the resilience of an embedded watermark and break the loop described above.

Note that Pierre Moulin et al., have looked at the problem via a similar approach. They introduced the idea of considering watermarking a game between embedder and attacker. The embedder tries to maximize watermark robustness; the attacker tries to minimize watermark robustness. With this approach, some ideal assumptions about the host data statistics, and a mean-squared error distortion measurement, Moulin et al. could actually find a solution to this game. Mihcak and Moulin, and Su, Eggers, and Girod, have independently extended the analysis to colored data. You can find papers on this subject in the proceedings of ICIP 2000 or on my web page ( http://www.lnt.de/~eggers/publications.html).

In practice, it is hardly possible to achieve the limiting results derived via the theoretic approach described above. Nevertheless, you can derive some good guidelines for practical schemes. For instance, the attacker takes a coarse estimate of the power density spectrum of an image (very coarse: low pass characteristic), designs the Wiener filter accordingly, and perhaps can remove at least some of the watermark components (e.g., high pass watermark components).

Note that the theoretical analysis described above confirms in an analytical fashion the following heuristic argument given very early by Cox et al.:

"The watermark should be embedded into the most significant data components !!!"

Therefore, you should be very careful when designing your watermark based on psycho-acoustic or psycho-visual masking effects. If you put your watermark underneath a masking threshold, an attacker can remove it without any penalty. This approach is not the right one for very robust watermarks. Nevertheless, masking might be appropriate when embedding information just as added value (in this scenario we do not have a malicious attacker). Note that any state- of-the-art compression scheme (for audio and images) will significantly impair the watermark underneath the masking threshold.

The theoretical analysis also gives you an idea about the maximum information that can be embedded per pixel. Assume that a mean-squared error distortion measurement is used. Further, let the attacker add simple additive white Gaussian noise (AWGN). In this case, Shannon's result for the capacity of an AWGN channel gives the the upper limit on the achieveable watermark rate, e.g. 0.5 bit/sample if the variance of the AWGN equals the embedding distortion. Everybody can play this attack! Thus, you never can achieve higher rates. Of course, more sophisticated attacks can be invented. Thus, in practice the achieveable watermark rate will be much lower. The goal of current research efforts is to tighten this bound. Of course, thight bounds can be obtained only when optimizing the watermarking scheme and the attack for certain signal statistics. An "all-white" image has less (exactly zero) watermark capacity than a Gaussian-noise image (see Moulin's result).

5.7 What is maximum amount of information (channel capacity for watermarking) that one can embed in a given image ?

With most techniques, one can identify an upper limit on the safe message size that can be embedded in a "typical" cover. This is called steganographic capacity and it is unknown even for the simplest methods out there, such as the LSB embedding.

You can fine some papers dicussing the channel capacity in

Ching-Yung Lin, Watermarking and Digital Signature Techniques for MulIt a Authentication and Copyright Protection, Ph.D. Thesis, Columbia Univ., 2000. Chapter 5: Theoretical Watermarking Capacity of Images

which can be downloaded from http://www.ctr.columbia.edu/~cylin/publications.html

[Kaushal M. Solanki] We, here at UCSB, are working on image-adaptive high volume data hiding, which I think might be applicable in this case. Using these techniques one can hide from 16Kbits to 55Kbits of data depending on the images and robustness required. I would suggest you to look at the web pages at: http://vision.ece.ucsb.edu/hiding/ Recently, we also presented a paper at ICASSP 02 titled "High volume data hiding in images: Introducing perceptual criteria in quantization based embedding". This can be downloaded at the above mentioned website.

5.8 How to generate perceptual mask for watermarking ?

Perceptual mask tells us the maximum change on can make to a pixel (in case of images/video), before the change becomes noticeable. It can also be defined the other way around like, the limit of change on could impart on the the pixel value while watermark insertion and still be invisible.

Some authors call the functions which generate the scale of visibility due to watermark as Just Noticeable Difference (JND) or Noise Visibility Functions (NVF). JND uses standard deviation and thus makes the watermark appear very strong in the edges.

Some models like watson metric, non-stationary Guassian model and PSNR quality metric can be found in checkmark benchmarking tool.

More information about DVQ(Digital Video Quality) watson metric can be found at http://www.nasatech.com/Briefs/Apr01/ARC14236.html.

You can futher find several others metric computations which measure image quality like

S. Daly. "The Visual Difference Predictor : An Algorithm for the Assessment of Visual Fidelity." in Digital Image and Human Vision, MIT Press, 1993.

P. Le Callet, D. Barba. "Perceptual color image quality metric using adequate error pooling for coding scheme evaluation" in Human Vision and Electronic Imaging VII, Electronic Imaging 2002.

A good review of different metrics is given in the Ph.D. Thesis written by Ismail Avcibas (2001), Image Quality Statistics and their Use in Steganalysis and Compression.

6 Others

6.1 What do they mean ?

Cover-signal: the audio-visual signal (still image, audio track, video) in which one wish to hide information - the work
Watermark/mark: what is actually imperceptibly added to the cover-signal in order to convey the hidden data
Payload: message or sequence of information bits to be hidden in the cover-signal, that is the hidden data
Watermark-access-unit: smallest part of a cover-signal in which a watermark can be reliably detected and the payload extracted
Capacity: bit size of a payload that a watermark access unit can carry
Watermarking-scheme: the set algorithms required for embedding and extraction
Embedding-key: a secret used to embed the mark.
Extraction-key: a key used to detect or extract a watermark. Symmetric watermarking algorithms require use the same secret key for embedding and extraction. Asymmetric algorithms use a secret key for embedding and a public key for extraction. Keys are built in such a way that the private key cannot be computed from the public one.
Non-blind(private)scheme: the original non-watermarked cover-signal, the extraction key and the signal to be tested are required for the detection
Semi-blind-scheme: the published watermarked audio-visual signal, the extraction key and the signal to be tested are required for the detection
Blind(public)scheme: only the watermarking-key and the signal to be tested are required for the detection
Type-I-scheme: the output of the extractor is either the payload or a symbol meaning the absence of mark in the signal to be tested
Type-II-scheme: such schemes require knowledge of the embedded watermark for detection in a signal so they are only able to tell whether a given watermark is present or not

6.2 What is text watermarking ?

The process of embedding/hiding data in text can be termed as ``text watermarking''

To begin, you can take a look at:

``Watermarking Document Images with Bounding Box Expansion'', Jack Brassil and Larry O'Gorman Information Hiding 1st International Workshop, June 1996
``Marking and Detection of Text Documents Using Transform-domain Techniques'', Yong Liu, Jonathon, Edward Wong, Steven Low Security and watermarking of Multimedia Contents, january 1999
``Marking Text Documents'', N. F. Maxemchuk, S. Low, AT&T, University of Melbourne ICIP'97
``Document Image Data Hiding Technique Using Character Spacing With Sequence Coding'', Nopporn Chotikakamthorn ICIP'99

6.3 How can get the pixel values in image to watermark them ?

First determine what is the format of the image you are dealing with. Then search for libraries which can decode/read the images and provide pixel values. Tools like MATLAB can be helpful here. Another option would be to write plugins for image editing applications like image-magick.

6.4 What kind of watermarking technique should I use for my application ? Companies that supply a product tell about wonders of watermarking and everyone else that any watermark can be rendered useless ?

[Scott Craver ] There are several reasons for the wide range of opinions. You need to consider the following factors, at least, when evaluating a watermarking technology:

Media: Different media are easier or harder to attack or mark, at least in my opinion. Images can be subjected to a lot of different kinds of spatial distortion relative to, say, Audio. Video clips have lots more data in which to hide things. Images also have very large samples (pixels,) each individual sample visible with the naked eye; audio has tens of thousands of samples per second, providing a more rich environment for such like echo hiding.
Degree-of-prevention(threat-model): A watermarking company might just be trying to prevent common case theft, in which case it might not matter if some people can crack the watermarking scheme. Of course, these days some people can wrap up an attack into a program which anyone can download, so it's best to assume that anyone who wants to defeat a watermark and knows to look on the Internet will find an attack tool. Then again, will this percentage of people be large enough to pose a real threat? Who's the bad guy?
Quality-of-attack.: Maybe a mark doesn't survive compression into RealMedia format, but a demarked skippy postage stamp of video that doesn't actually play is a Pyrrhic victory.
User-Quality-Standards(very-important): Prior to MP3s and DVDs, commercial audio/video formats had gone well over a decade without any real improvement. As a result, people today are still perfectly happy with VHS. Heck, the DVD player in my laptop can ONLY display video considerably worse than VHS quality. If people are conditioned to accept poor quality, then attacks can be more powerful. They may annoy Golden Ears and Eyes, but not the common case.
Application: Not all watermarking technologies are aimed at robust proof of copyright ownership. Some are intended for automated detection/prevention, some are inteded for adding value (like embedding lyrics in a song.) Some are not intended to be robust, but fragile, for data authentication. The application structure can greatly change the threat model, and render certain attacks pointless. Who cares if I can noise out a watermark, if it's only use is annotating the media?

That being said:

Is watermarking something I should be considering at this point ?

For what? For a business? Or an emphasis for graduate study? Also, the application domain greatly determines if watermarking will be a good investment.

What other methods might I use instead of or in tandem with watermarking ?

This also depends on your intended use. If your goal is having proof of copyright ownership, say if you are a photographer; then traditional methods of establishing ownership might work. For digital images, a timestamping service can provide evidence that you possessed an image on a given date. If someone else has what is clearly "the same" image, then a timestamp is good to have as evidence in a court of law. Keep the negatives too. If you are managing an online database (like a stock photo agency,) then fingerprinting images may be useful in tracking copyright theft.

[Jeffrey A Bloom] There are no commercial watermarking products available on the market that can do either of these things. It can be argued that proof of ownership (or at least proof of ancestry) can be accomplished with watermarking (image hash, etc.), but these techniques have never been tested in U.S. courts. Note that this application requires that the watermark be secure against unauthorized removal. Your watermarking technique can used informed detection (original image, or a function thereof, is available to the detector). Your watermarking algorithm should not be secret since it will have to be revealed in court the first time you use it, so it's security must be based on a secret key and that key should be different for each image that you distribute. Thus, depending on how many images you plan on distributing, key space could be an issue.

Also, if you are distributing many copies of a single image you have another problem. If you use a different key on each, then an adversary may be able to average many different copies together to remove the watermark (collusion attack). If you use the same key, and at some point have to reveal that key in court, you release your protection of all other copies.

If you want to prevent images from being copied, you may find better luck in the crypto arena. Check out Intertrust (http://www.intertrust.com/) and their digital rights management. They don't make a product for you, but many of their partners do. Check out Clever Content by Alchemedia (http://www.Alchemedia.com/). In general, you're looking for Digital Rights Management of which watermarking is one tool. Do a search for DRM.

6.5 List of companies working on watermarking ?

6.6 Contributors to this FAQ

We would like to thank all those who have contributed to this FAQ.

Fabien Petitcolas
Jong-Hyeon Lee
Matthieu Brunet
Stefan Katzenbeisser
Martin Kutter
Madan Ankapura
Klaus Hansen

& several others

Easy and Fast Photo Watermarking

	Size: 2.37 Mb, for Windows Vista, XP, 2000 and 98
	Personal Version - $34.95 (can NOT be used for commercial purposes).
	Business Version - $59.95 (can be used for commercial purposes).
We accept Visa, MasterCard/EuroCard, American Express, bank/wire transfers and PayPal.