Reversible watermarking scheme withimage-independent embedding capacity

C.-T. Li

Abstract: Permanent distortion is one of the main drawbacks of all the irreversible watermarkingschemes. Attempts to recover the original signal after the signal passing the authentication processare being made starting just a few years ago. Some common problems, such as salt-and-pepperartefacts owing to intensity wraparound and low embedding capacity, can now be resolved.However, some significant problems remain unsolved. First, the embedding capacity is signal-dependent, i.e., capacity varies significantly depending on the nature of the host signal. The directimpact of this is compromised security for signals with low capacity. Some signals may be evennon-embeddable. Secondly, while seriously tackled in irreversible watermarking schemes, thewell-known problem of block-wise dependence, which opens a security gap for the vectorquantisation attack and transplantation attack, are not addressed by researchers of the reversibleschemes. This work proposes a reversible watermarking scheme with near-constant signal-independent embedding capacity and immunity to the vector quantisation attack and transplantationattack.

1 Introduction

Significant amounts of effort have been put into the researchof fragile watermarking methods for multimedia authentica-tion in general, and image authentication in particular.A common drawback of all irreversible watermarkingschemes [1–5] is permanent embedding distortion, whichcannot be erased after the signal passing the authenticationprocedure so as to recover the original signal. Attempts toeliminate this problem have been made in the last few years[6–13]. Some common problems regarding reversiblewatermarking, such as salt-and-pepper artefacts owing tointensity wraparound (e.g., intensity change from 0 to 255 orvice versa for 8-bit images) and low embedding capacity,can now be resolved [6, 8, 11–13]. However, we point outin this work that there are still some significant issues to beaddressed.First, the embedding capacity of previously published

works [6, 8, 11] is signal-dependent, i.e., capacity variessignificantly depending on the nature of the host signal. Thedirect impact of this is compromised security for signalswith low embedding capacity. Some signals may be evennon-embeddable. One way to approach this problem is totrade embedding distortion for embedding capacity byallowing more significant components of the signal (e.g.,more significant bits of the image) to be watermarked [6–8,11–13]. This approach is feasible provided that thedistortion does not become noticeable. However, forschemes with signal-dependent embedding capacity, thereis no guarantee that the signal will be watermarked to a

desired degree of embedding capacity without inflictingnoticeable distortion on it. One may argue that noticeabledistortion is acceptable because the distortion will be erasedeventually by the reversible scheme. However, if we rethinkwhat makes watermarking differ from cryptography, werealise that the requirement of low distortion should not becompromised simply because the scheme is reversible. In theapplications of copyright protection using digital water-marking, two key superior factors distinguishing water-marking from cryptography are:

(i) cryptography provides no further protection to the signalafter decryption while watermarking does after watermarkextraction because it has been blended into the raw data;(ii) cryptography scrambles the contents and masks thesemantics of the signal while watermarking does not.

The first feature is important for applications of copyrightprotection because the emphases are the robustness and thevery existence of the watermark in the host media in thefuture. Alternatively, in the applications of multimediaauthentication and content integrity verification with fragilewatermarking, which is the theme of this work, rather thanbeing designed to survive the attacks, the fragile watermarkis designed to be destroyed if attacked. That is to say that theemphases are the authenticity and integrity at the moment ofauthentication, not the robustness and existence of thewatermark in the host media after the authenticationprocedure. This is also why we want to make the fragilewatermarking scheme reversible so that the existence of thewatermark can be removed after authentication. Thus, wecan say that the first feature has less or no significance forreversible fragile watermarking scheme in the applicationsof authentication and the second factor is the one thatcharacterises the advantage of fragile watermarking overcryptography. However, when the watermark embeddingdistortion becomes noticeable, this superiority of fragilewatermarking over cryptography becomes marginal.Therefore, ensuring the balance between embeddingcapacity and embedding distortion is more important thansimply seeking high capacity at the expense of high

q IEE, 2005

IEE Proceedings online no. 20045041

doi: 10.1049/ip-vis:20045041

The author is with the Department of Computer Science, University ofWarwick, Coventry CV4 7AL, UK

E-mail: ctli@dcs.warwick.ac.uk

Paper first received 29th May 2004 and in revised form 22nd April 2005.Originally published online 5th July 2005

IEE Proc.-Vis. Image Signal Process., Vol. 152, No. 6, December 2005 779

distortion. Unfortunately, finding this balance is not a trivialtask for the schemes with signal-dependent embeddingcapacity [6–8, 11–13]. It is thus desirable to have a schemewith signal-independent embedding capacity, which allowsthe user to specify a near-constant capacity and distortion ina reasonable range.

Second, while seriously tackled in irreversible water-marking schemes, the well-known problem of block-wisedependence, which opens a security gap for vectorquantisation attack [4] (also known as the Holliman-Memon counterfeiting attack [14], birthday attack, orcollage attack [15]) and transplantation attack [1–3] is notaddressed by the researchers of the reversible schemes.Vector quantisation attack is a malicious operation ofcollecting some image blocks from a large set=database ofimages watermarked with the same scheme to create acounterfeit or ‘collage’. By involving block-wise dependentor contextual information in the embedding procedure,vector quantisation attack cannot succeed because placingwatermarked blocks in the wrong context will not pass theauthentication. Transplantation attack is another form ofmalicious operation of collecting blocks with deterministicdependence information (i.e., the dependence information isnot calculated in a random but a deterministic manner) tocreate a counterfeit. The reader is referred to [4, 14, 15] and[1–3] for more information about vector quantisationattacks and transplantation attacks, respectively.

It is our intention in this work to propose a reversiblewatermarking scheme with near-constant signal-indepen-dent embedding capacity and immunity to the vectorquantisation attack and transplantation attack.

2 Related work

Barton [16] proposed one of the earliest reversible dataembedding schemes, which compresses the bits to beaffected by the embedding operation for two purposes:firstly preserving the original data and secondly creatingspace for the payload – the secret information to be hidden.The compressed data and the payload are then embeddedinto the host media. This practice of compressing originaldata for reversibility purposes has been adopted widely [6,8, 11]. Honsinger et al. [9] employed reversible embeddingfor authentication applications, which uses addition modulo256 to overcome the problems of overflow and underflowowing to embedding operations. However, apart fromembedding distortion, this modulo operation introducessalt-and-pepper artefacts because intensities close to zeroare flipped=wraparound to 255 and the intensities close to255 are mapped to 0. Another adverse effect of this is thatthe scheme may not be able to extract the payload if thenumber of flipped pixels is too significant. The salt-and-pepper artefacts can also be found in Macq’s method [10].Schemes with high embedding capacity and without thesalt-and-pepper artefacts have been reported in [6, 8,10–13]. The main difference among these methods is thatthe methods of [6, 8, 11] employ compression techniques forreserving the original data while the method of [12] ‘clips’the intensities of some pixels before embedding the payloadin order to create intensity gaps for the payload. This isjustifiable because the images captured by the acquisitionsystems are not a ‘perfect’ presentation of the real scene.The deviation of the clipped version from the ‘perfect’version is not necessarily greater than the deviation of thecaptured one from the ‘perfect’ version.

Although steady progress in terms of high embeddingcapacity is being made, the capacity of all the aforemen-tioned methods is highly sensitive to the nature of the

images. For reversible watermarking schemes, such as [6, 8,11, 12], that exploit intensity variation, images with largerlow-frequency areas tend to have higher embeddingcapacity while images with more high-frequency areastend to have lower embedding capacity. Another commonlimitation of these methods is that the well-recognisedrequirement of establishing block-wise dependence forresisting vector quantisation attack and transplantationattack is not met.

3 Proposed scheme

To eliminate those two common limitations of the reviewedwork, we propose a reversible watermarking scheme withnear-constant and image-independent embedding capacityand immunity to the vector quantisation attack andtransplantation attack. We define some symbols as follows:

f: the original image with the greyscale of its ith pixeldenoted as f(i) and bit j of f(i) denoted as fjðiÞf 0 : the image received by the watermark detectorw: the secret-key-generated watermark image of the samesize as the original image fw0 : the extracted watermark image by the decoderh( f(i), w(i)): the Hamming code of pixel i generated byperforming Exclusive-OR operation on f(i) and w(i).D( f(i), w(i)): the Hamming distance between f(i) and w(i)N(i): the square dependence neighbourhood centred at pixeli of an images(i): the secret non-deterministic dependence information ofpixel i extracted from N(i). This secret information isintended to counter the vector quantisation attack [4, 14, 15]and transplantation attack [1–3]. This information can bethe hash output, the sum of the intensity, or some measurecalculated in a random=non-deterministic manner. Specificdesign of s(i) in this work will be detailed later. Now let usassume that s(i) is available.

The basic idea behind the proposed work is to assign thepixels into a finite number of states characterised by someconditions so that only one-to-one transition from one stateto another can be made. In the context of digital imagewatermarking, the intensity f(i) or the transformed form ofthe intensity such as Hamming code, the correspondingwatermark pixel w(i), and the secret information s(i)determine the state which pixel i is in. The action offorward state transition is the operation of watermarkembedding and the action of backward state transition is theoperation of watermark extraction.

3.1 Observations on Hamming Code

In this work, we will map=transform the intensity of eachpixel in an image into a Hamming code by performing anExclusive-OR (XOR) operation on the intensity of the pixelf(i) and a watermark pixel w(i). Although the proposedscheme can be employed for watermarking colour andgreyscale images with arbitrary number of bits per pixel,without loss of generality, we will assume that we areworking with 8-bit greyscale images throughout the rest ofthis work. Since there are 8 bits per pixel, if we allow onevalue of Hamming distance to represent one main state, thenthere will be 9 states, which can be denoted as Dk; k 2 ½0; 8�withD0 standing for Hamming distance 0,D1 for distance 1,and so on. Therefore, after the mapping, each pixel will bein one of the 9 main states. Taking state D1 as an example,with 8 bit positions, there are 8 possible Hamming codeswith distance 1, e.g., 00000001 and 00000010. So state D1

can be partitioned into 8 sub-states, each corresponding

IEE Proc.-Vis. Image Signal Process., Vol. 152, No. 6, December 2005780

to one Hamming code. Each sub-state can be furtherdivided into two sub-sub-states, watermarkable andnon-watermarkable, depending on w(i) and s(i). For thepixels of each watermarkable sub-sub-state, only onespecific bit is taken as watermarkable bit. Reversibleembedding is carried out by negating the watermarkablebit of the pixel to make a transition=mapping from the sub-sub-state of Dk to another of Dk�1 if 8k; 0< k � 4 or fromone of Dk to another of Dkþ1 if 8k; 4 � k< 8: Note thatbecause of the symmetry, which will become clear laterafter Table 1 is explained, pixels in sub-sub-states of D4 areallowed to transit to the sub-sub-state ofD3 orD5 dependingon their Hamming codes. Since the state transition is one-to-one and the watermarkable bit of each sub-sub-state isspecifically defined, at the verifier’s side, when a pixel isdetected as watermarked and passes the authentication, thescheme will be able to negate the watermarked bit to itsoriginal value, making a backward state transition to theoriginal sub-sub-state. From now on, we will use the words‘state’, ‘sub-state’, and ‘sub-sub-state’ interchangeably.Note also that to make the reversible embedding possible,

empty states must be in existence initially. This can beachieved by changing the greyscale of an insignificantproportion of pixels and use this pre-processed image as theoriginal. This operation is similar to the intensity clippingfrequently adopted by reversible watermarking schemes[12, 17]. Given the fact that image acquisition systems arenot perfect (e.g., a captured image is by no means a perfectrepresentation of the real scene), sensible minute changeswould make the pre-processed version close to the capturedimage or possibly even closer to the ‘perfect’ version.Moreover, since the key concern of the reversible water-marking scheme is the reversibility to the image before it iswatermarked, not to any prior version(s), thus, provided thatthe effect of the pre-processing is insignificant in terms ofthe number of pixels affected and the amount of intensitychanges, sensible pre-processing would be acceptable forthe users.For two 8-bit numbers, the total number of possible

Hamming codes that can be obtained is 256. The number ofcodes (or pixels) belonging to Di is the number ofcombination of ‘choosing i from 8’ denoted as C(8, i). Inthis context, Cð8; 0Þ ¼ Cð8; 8Þ ¼ 1; Cð8; 1Þ ¼ Cð8; 7Þ ¼8; Cð8; 2Þ ¼ Cð8; 6Þ ¼ 28; Cð8; 3Þ ¼ Cð8; 5Þ ¼ 56; andCð8; 4Þ ¼ 70: For any image, except the random noiseimages highly similar to the secret-key-generated randomwatermark image w which should not be deemed as images,the Hamming codes created of the image f and w have thesame statistical property, i.e. the number of pixels in stateDi

is close to the aforementioned figures. Thus, a natural steptoward creating empty states would be negating bit 0 of thepixels with their Hamming distance equal to 0 or 8 because

these pixels account statistically for only ð2=256 ¼ 0:78%Þof the total population. Another benefit of the proposedpre-processing, which will become clear later, is that half ofthose pixels mapped into the new states of D1 and D7 arewatermarkable, thus, contributing to higher embeddingcapacity.

3.2 Algorithm design

Based on the above framework, the proposed algorithm canbe described as follows. First, a secret-key shared by theembedder and the verifier is used to generate a random 8-bitwatermark image w of the same dimension as the host imagef. Secondly, an image h of the Hamming code for each pixelis created by performing an Exclusive-OR operation on thecorresponding pixels of the host image f and the watermarkimage w. Pre-processing is then carried out by negating bit 0of the pixels f(i) with a Hamming distance of 0 or 8 so as tocreate empty states D0 and D8: To maintain low embeddingdistortion, we do not watermark any bit of the pixels moresignificant than bit 3 (note that the indices of the bits are in[0, 7]). So a symbol system denoted as Dk;h3h2h1h0&sj�s0¼wj�w0 can be adopted for identifying the states of Dk; withh3h2h1h0 standing for the 4 least significant bits of aHamming code and &sj�s0¼wj�w0 specifying the con-dition that the jþ1 least significant bits of the secretinformation s(i) and watermark pixel w(i) must be the sameðj<8Þ: The underscored bit of h3h2h1h0; is the water-markable bit. Note that the position of watermarkable bitvaries from state to state. wj; the most significant bitspecified in the condition &sj�s0¼wj�w0; is where thewatermark bit to be embedded. Note that sj and wj are bit j ofs(i) and w(i), respectively.

The watermarkable states characterised by the Hammingcode, Hamming distance, and conditions are listed inTable 1. For example, an image pixel f(i) is said to be inwatermarkable state D2;0101 & s3�s0¼w3�w0 (the thirdcolumn of the third row in Table 1) if their Hammingdistance is 2, the 4 least significant bits of the Hammingcode are 0101, and bit 0 to bit 3 of s(i) and w(i) are the same.The bit of f(i) corresponding to the bit position underscoredin the state symbol D2;0101& s3�s0¼w3�w0 is the water-markable bit. Watermarking a pixel is simply done bynegating the watermarkable bit. This operation results in aforward state transition. For example, for any image pixelf(i) in stateD2;0101& s3�s0¼w3�w0; to watermark it, bit 0 off(i) is negated (because h0 is underscored), resulting in atransition from state D2;0101& s3�s0¼w3�w0 to state D1;0100

& s2�s0¼w2�w0: Now it is clear that the arrow in eachentry of Table 1 points to the direction of forwardstate transition during the watermark embedding process.To verify the received image at the verifier’s side, whenany received image pixel f 0ðiÞ in, for example, state

Table 1: Table of watermarkable states with the arrows indicating the direction of forward state transition

D0 D0 & s0 ¼ w0 D0 & s1s0 ¼ w1w0 D0 & s2 � s0 ¼ w2 � w0

D1;0001 & s0 ¼ w0 " D1;0010 & s1s0 ¼ w1w0 " D1;0100 & s2 � s0 ¼ w2 � w0 " D1;1000 & s3 � s0 ¼ w3 � w0 "

D2;0011 & s1s0 ¼ w1w0 " D2;0110 & s2 � s0 ¼ w2 � w0 " D2;0101 & s3 � s0 ¼ w3 � w0 " D2;1001 & s4 � s0 ¼ w4 � w0 "

D3;0111 & s2 � s0 ¼ w2 � w0 " D3;1110 & s3 � s0 ¼ w3 � w0 " D3;1101 & s4 � s0 ¼ w4 � w0 " D3;1011 & s5 � s0 ¼ w5 � w0 "

D4;1111 & s3 � s0 ¼ w3 � w0 " D4;1111 & s4 � s0 ¼ w4 � w0 " D4;1111 & s5 � s0 ¼ w5 � w0 " D4;1111 & s6 � s0 ¼ w6 � w0 "

D4;0000 & s3 � s0 ¼ w3 � w0 # D4;0000 & s4 � s0 ¼ w4 � w0 # D4;0000 & s5 � s0 ¼ w5 � w0 # D4;0000 & s6 � s0 ¼ w6 � w0 #

D5;1000 & s2 � s0 ¼ w2 � w0 # D5;0001 & s3 � s0 ¼ w3 � w0 # D5;0010 & s4 � s0 ¼ w4 � w0 # D5;0100 & s5 � s0 ¼ w5 � w0 #

D6;1100 s1s0 ¼ w1w0 # D6;1001 & s2 � s0 ¼ w2 � w0 # D6;1010 & s3 � s0 ¼ w3 � w0 # D6;0110 & s4 � s0 ¼ w4 � w0 #

D7;1110 & s0 ¼ w0 # D7;1101 & s1s0 ¼ w1w0 # D7;1011 & s2 � s0 ¼ w2 � w0 # D7;0111 & s3 � s0 ¼ w3 � w0 #

D8 D8 & s0 ¼ w0 D8 & s1s0 ¼ w1w0 D8 & s2 � s0 ¼ w2 � w0

IEE Proc.-Vis. Image Signal Process., Vol. 152, No. 6, December 2005 781

D1;0100 & s2�s0¼w2�w0 is encountered, the scheme willtake s3 as the extracted watermark bit w0

3 (i.e., let w03 ¼ s3:)

Then if w03 equals the original watermark bit w3; f

0ðiÞ isdeemed authentic and the original image pixel f(i) can berecovered by simply negating bit 0 of f 0ðiÞ; i.e., making abackward transition from state D1;0100 & s2�s0¼w2�w0 tostate D2;0101 & s3�s0¼w3�w0: If the image is attacked, s(i)would be different from its counterpart at the embeddingside. In this case, assigning a wrong value of sj to w0

j resultsin a mismatch between w0

j and wj (i.e., an alarm of attack).One of the key features of the proposed scheme is its

property of near-constant and image-independent embed-ding capacity, which is explained as follows. From the entryin the first column of the second row of Table 1 (i.e.,D1;0001 & s0¼w0), we know that 1=2 of the pixels withHamming distance 1 and the 4 least significant bits equal to0001 are watermarkable because only 1=2 of the pixelssatisfy the condition s0¼w0: By the same token, only 1=4 ofthe pixels associated with D2;0011 & s1s0¼w1w0 are water-markable because of condition s1s0¼w1w0: The condition,s2�s0¼w2�w0; in the first column of the fourth rowindicates that only 1=8 of the pixels associated with D3;0111

& s1s0¼w1w0 are watermarkable, and so on. Since Table 1is symmetrical about the bold line, the same property can befound in the lower part of the Table. The benefit of the pre-processing becomes clear now. By negating bit 0 of thepixels with their Hamming distance equal to 0 or 8, thosepixels transit to states D1;0001 & s0¼w0 or D7;1110 & s0¼w0;respectively, and, as just mentioned, 1=2 of them arewatermarkable. The proportions of the pixels associatedwith Dk;h3h2h1h0 & sj�s0¼wj�w0; which are watermarkable,are listed in Table 2. The two values of 1=2 in parentheses inthe first column remind us that half of the pixels in the twostates are mapped from states of D0 and D8 by the pre-processing operation. The symmetry and regularity ofTable 1 imply the simplicity for implementing the proposedscheme while the symmetry and regularity of Table 2 implythe near-constancy of embedding capacity. The sum of theproportions including the two ‘1=2’ in the parenthesesequals 4.5156. With 8 bits, the number of possible Hammingcodes (states) is 256, each having a probability of 1=256:Therefore, the predicted embedding capacity (PEC) of theproposed scheme is

PEC ¼ 4:5156 � 1

256¼ 0:0176 bits=pixel ð1Þ

Note from Table 2, we can see that the number ofwatermarkable pixels with more significant watermarkablebits is smaller. This is helpful in keeping distortion down.

Another key feature of the proposed work is theinvolvement of a secret contextual dependence informations(i) for countering vector quantisation attack and transplan-tation attack. The missing definition of s(i) can now bedefined as

sðiÞXj2NðiÞ

f ðjÞ

0@

1Amod256;

8f ðiÞwhose Dk;h3h2h1h0 does not match any one in Table 1:

ð2ÞThe purpose of the condition set in (2) is to prevent thewatermarkable pixels from being involved in the calculationof s(i). Because the watermark embedder and detectorsharing the same key are able to figure out the same set ofwatermarkable pixels, by excluding these pixels, whosevalue may or may not be modified, the same s(i) can beobtained at both sides. Since Dk;h3h2h1h0 is unknown to thethird party without the secret key, s(i) is secret. mod is themodular arithmetic operator. ‘mod 256’ operation confinesthe range of s(i) in [0, 255], the same range as f(i) and w(i). Ifthe watermarked image is attacked, s(i) changes accord-ingly. Consequently, the states are disturbed and the correctwatermark bits cannot be extracted.

The watermark embedding and detecting algorithms ofthe proposed scheme are summarised as follows.

Watermark embedding algorithmStepe1 : Generate an 8-bit watermark image w with thesecret key shared with the detectorStepe2 : For each pixel i,

Stepe2:1 : Calculate the Hamming code h( f(i), w(i)) anddistance D( f(i), w(i))Stepe2:2 : Negate the LSB of f(i) if D( f(i), wðiÞÞ ¼ 0 or 8(pre-processing).

Stepe3 : Identify watermarkable pixelsStepe4 : For each watermarkable pixel i,

Stepe4:1 : Calculate the secret dependence informations(i) according to (2)Stepe4:2 : Negate the watermarkable bit of f(i) dependingon the state of the pixel.

Watermark detecting algorithmStepd1 : Generate an 8-bit watermark image w with thesecret key shared with the embedderStepd2 : Initialise the extracted watermark w0 by letting w0

¼ w:Stepd3 : For each pixel i, calculate the Hamming codehð f 0ðiÞ; wðiÞÞ and distance Dð f 0ðiÞ; wðiÞÞStepd4 : Identify watermarkable pixelsStepd5 : For each watermarkable pixel i,

Stepd5:1 : Calculate the secret dependence informations(i) according to (2)Stepd5:2 : Extract watermark bit by setting w0

jðiÞ ¼ sjðiÞStepd5:3 : Recover original image pixel f(i) by negatingthe watermarkable bit of f 0ðiÞ if w0ðiÞ ¼ wðiÞ:

4 Algorithm analyses

A general expression of the embedding capacity of theproposed scheme can be derived as follows. Suppose wehave an image of b bits per pixel and we do not want towatermark any bit of the pixels more significant than bitk; k 2 ½0; b� 1�; then Table 2 can be expanded into a2 � bb=2c � ðk þ 1Þ matrix, where b�c is the floor functionthat returns the greatest integer less than or equal to itsargument. Taking the upper half of Table 2 without the‘1=2’ in the parentheses into consideration, the value of eachelement decreases monotonically toward the lower-rightcorner of the matrix. The value at the upper-left cornerequals 1=2 while the value at the upper-left cornerequals1=2bb=2c�ðkþ1Þ: If we take the two halves of the matrix

Table 2: The proportions of the pixels, which arewatermarkable

D1;0001 1=2 ð1=2Þ D1;0010 1=4 D1;0100 1=8 D1;1000 1=16

D2;0011 1=4 D2;0110 1=8 D2;0101 1=16 D2;1001 1=32

D3;0111 1=8 D3;1110 1=16 D3;1101 1=32 D3;1011 1=64

D4;1111 1=16 D4;1111 1=32 D4;1111 1=64 D4;1111 1=128

D4;0000 1=16 D4;0000 1=32 D4;0000 1=64 D4;0000 1=128

D5;1000 1=8 D5;0001 1=16 D5;0010 1=32 D5;0100 1=64

D6;1100 1=4 D6;1001 1=8 D6;1010 1=16 D6;0110 1=32

D7;1110 1=2 ð1=2Þ D7;1101 1=4 D7;1011 1=8 D7;0111 1=16

IEE Proc.-Vis. Image Signal Process., Vol. 152, No. 6, December 2005782

and the two ‘1=2’ in the parentheses into consideration,because of the symmetrical characteristic of the matrix, anexpression of the predictable embedding capacity (PEC) canbe formulated as

PEC ¼ 2 � 1

2þXbb=2ci¼0

Xkj¼0

1

2iþjþ1

!� 12b

ð3Þ

If we take the special case described in Section 3 as anexample, i.e., b ¼ 8 and k ¼ 3; then PEC ¼ 0:0176:This model offers the user some degree of freedom in

specifying the performance of the scheme. The factor 1=2b

in the above expression indicates that the more bits perpixel, the lower the embedding capacity. Therefore, insteadof involving all the b bits in the creation of Hamming codeand the definition of the states, the user can choose to usefewer bits per pixel. Now, with a b-bit image, if we onlyallow the b1 least significant bits to be involved in thedefinition of the states and the watermarkable bit to be ashigh as bit k; k 2 ½0; b1 � 1�; a more general expression ofthe (PEC) can be formulated as

PEC ¼ 2 � 1

2þXbb1=2ci¼0

Xkj¼0

1

2iþjþ1

!� 1

2b1ð4Þ

However, the embedding capacity is increased at theexpense of having to involve more pixels in the pre-processing stage in order to make empty initial states. Forexample if b1 equals 4, the number of possible Hammingcodes is 16, and the pixels associated with Hammingdistance 0 and 4 will have to be involved in the pre-processing stage, which account for 2=16 of the total pixelpopulation. Although, as we mentioned in the previousSection, that owing to the imperfection of the imageacquisition system, involving a small proportion of pixels inthe pre-processing stage is acceptable. However, large-scaleinvolvement still needs to be avoided in practice.

5 Experiments

The proposed scheme has been tested on six commonimages as shown in Fig. 1. We involve all the 8 bits of apixel to create Hamming code and allow the scheme to markup to bit 3 only. The size of the tested images and theperformance of the scheme in terms of pre-processingdistortion, embedding distortion, and embedding capacity(bits per pixel) are listed in Table 3. Pre-processingdistortion is the impact of the pre-processing of Stepe 2:2;which is insignificant (with all the PSNRs greater than69 dB) as we mentioned in Section 2. The values of pre-processing distortion are near-constant and independent ofimage because, as mentioned at the end of Section 3.1, thepixels with their Hamming distance equal to 0 or 8 accountstatistically for only 2=256 ¼ 0:78% of the total populationof all kinds of image. From the Table, we can also clearlysee that embedding capacity and embedding distortion forLena’s Face and Lena are nearly the same. We can also seefrom the same Table that even the nature of the imagesvaries significantly, the embedding capacity is still nearlyconstant, i.e., the embedding capacity is independent of theimages. These figures are closely consistent with the (PEC),0.0176 bits per pixel, as calculated in (1). It is interesting tosee that the embedding distortion in terms of PSNR inflictedon the images by the scheme is also near-constant, with thelowest one equal to 55.719 dB. The pre-processed unwa-termarked and watermarked versions of Cameraman areillustrated in Fig. 2 for comparison. Note higher embedding

capacity can be achieved by changing the parameters b1 andk in (4).

The embedding capacity of Fridrich et al.’s scheme with‘amplitude’ equal to 1 reported in [8] is converted into bitsper pixels and listed in Table 4. The embedding capacity ofour proposed scheme for the first three images is listedalongside for comparison. From the first two entries ofTable 4, we can see that, with Fridrich et al.’s scheme, theembedding capacities of Lena’s Face and Lena are 1.5 timesdifferent, while the capacities with our scheme are nearlythe same. This difference is more prominent when thecapacity of the Mandrill image is compared against that ofLena; Mandrill’s embedding capacity is very close to zero.These figures indicate that the Fridrich scheme is highlysensitive to the nature of the image. Images with more low-frequency contents tend to have higher embedding capacitywhile images with more high-frequency content tend tohave relatively lower embedding capacity. Actually this is acommon characteristic, which can be found in Tan’s [11],Alattar’s [6], and van Leest et al.’s [12] schemes.

Figure 3a shows that a magazine has been pasted ontothe coat of the cameraman in the watermarked image(See the difference between Figs. 2b and 3a). Figure 3bshows the authentication result with the shaded blocksindicating the tampered area. This experiment demonstratesthat the proposed scheme is able to localise the tamperingwith high resolution. Note that the watermark embeddingand extraction=authentication processes involve the secretcontextual dependence information s(i), which, according to(2), is a function of the dependence neighbourhood N(i).Therefore, manipulating any one of the pixels within N(i)may trigger an alarm at pixel i. Since there is no way ofknowing which pixel(s) within N(i) is (are) responsible fortriggering the alarm, so if any pixel i fails the authenticationprocess, the whole square area covered by N(i) is shaded toindicate that this area is not authentic (see Fig. 3b). In ourexperiments, the size of N(i) is 9� 9: Note that the smallerthe size, the higher the resolution of tampering localisation,but the weaker the security. This is because the embeddingcapacity of reversible watermarking schemes is normallylower than irreversible schemes and the non-watermarkablepixels are not authenticated explicitly but protected byinvolving them in the calculation of s(i). If N(i) is too small,some of non-watermarkable pixels may not be covered bytheir nearest watermarkable pixels. As a result, manipu-lation of these unprotected non-watermarkable pixels wouldgo undetected. There is no theoretical backing for decidingthe optimal size of N(i), so 9� 9 is our empiricalsuggestion.

Figure 4 demonstrates the proposed scheme’s capabilityof thwarting vector quantisation attack. Figure 4a shows acounterfeit image collage created by taking its fourquadrants from four slightly different Lena images water-marked with the same secret key and scheme. Figure 4bshows the authentication result with the shaded blocksindicating the boundary of four patches=quadrants. Notethat the shaded areas appearing along the borders of Fig. 4bare due to the fact that in constructing N(i) to calculate s(i),we allow the image to wraparound, e.g., the nextcolumn=row of the last column=row of the image is thefirst column=row, and vice versa. This is intended to detectthe cropping attack. For example, in this experiment, the lastcolumn of the forged image dose not come from the sameimage as the first column, resulting in wrong values of s(i)during the authentication process. Consequently, the alarmwould be raised.

IEE Proc.-Vis. Image Signal Process., Vol. 152, No. 6, December 2005 783

Fig. 1 Six images used in the experiments

a Lena Faceb Lenac Mandrilld Boate Cameramanf F16

Table 3: Performance of the proposed scheme. Pre-processing distortion is the distortion inflicted by pre-processing inStepe2:2 on the original imagewhile embedding distortion is inflicted by the watermarking on the pre-processed image

Images

Performance

Lena face

ð128 � 128Þ

Lena

ð256 � 256Þ

Mandrill

ð512 � 512Þ

Boat

ð200 � 200Þ

Cameraman

ð256 � 256Þ F16 ð256 � 256Þ Average

pre-processing distortion

(PSNR in dB)

69.783 69.237 69.280 69.483 68.280 69.119 69.364

embedding distortion

(PSNR in dB)

56.145 55.844 56.092 56.335 56.405 55.719 56.09

embedding capacity

(bits=pixel)

0.0168 0.0169 0.0168 0.0162 0.0167 0.0172 0.0168

Fig. 2 Original and Watermarked image of Cameraman

a Original imageb Watermarked image

IEE Proc.-Vis. Image Signal Process., Vol. 152, No. 6, December 2005784

6 Conclusions

We have pointed out, in this work, that seeking highembedding capacity at the expense of high distortion tosome extent may marginalise the advantage of fragilewatermarking over cryptography and emphasised theimportance of finding the balance between embeddingcapacity and embedding distortion. We also observed thatfinding this balance is not a trivial task for the schemes withsignal-dependent embedding capacity and proposed a newscheme with near-constant embedding capacity, which isindependent of the host signal. We also addressed the issueof leaving a security gap open to the vector quantisationattack and transplantation attack owing to the lack of

non-deterministic contextual dependence information in theembedding process and proposed a simple method forestablishing the dependence information.

7 References

1 Barreto, U.P.S.L.M., Kim, H.Y., and Rijmen, V.: ‘Toward securepublic-key blockwise fragile authentication watermarking’, IEE Proc.,Vis. Image Signal Process., 2002, 148, (2), pp. 57–62

2 Li, C.-T.: ‘Digital fragile watermarking scheme for authentication ofJPEG images image authenticity’, IEE Proc., Vis. Image SignalProcess., 2004, 151, (6), pp. 460–466

3 Li, C.-T., and Yang, F.-M.: ‘One-dimensional neighbourhood formingstrategy for fragile watermarking’, J. Electron. Imaging, 2003, 12, (2),pp. 284–291

Fig. 3 Resistance against cut-and-paste attack

a A magazine has been pasted onto the coat of the cameraman in the watermarked image of Fig. 2bb The authentication result with the shaded blocks indicating the tampered area

Fig. 4 Resistance against vector quantisation attack

a An image collage – a result of the vector quantisation attack, with its four quadrants taken from four slightly different Lena images watermarked with thesame secret key and schemeb The authentication result with the shaded blocks indicating the boundary of four patches=quadrants

Table 4: Performance comparison in terms of embedding capacity and embedding distortion

Scheme Capacity (bits=pixel) Average PSNR (dB)

Image Fridrich et al. Proposed Fridrich et al. Proposed

Lena Face ð128 � 128Þ 0.0104 0.0168 53.12 56.03

Lena ð256 � 256Þ 0.0158 0.0169

Mandrill ð512 � 512Þ 0.0007 0.0168

Average Capacity (bits=pixel) 0.019 0.0168

IEE Proc.-Vis. Image Signal Process., Vol. 152, No. 6, December 2005 785

4 Wong, P.W., and Memom, N.: ‘Secret and public key image water-marking schemes for image authentication and ownership verification’,IEEE Trans. Image Process Proc., 2001, 10, (10), pp. 1593–1601

5 Yeung, M., and Minzter, F.: ‘Invisible watermarking for imageverification’, J. Electron. Imaging, 1998, 7, (2), pp. 578–591

6 Alattar, A.M.: ‘Reversible watermark using difference expansion oftriplets’. Proc. IEEE Int. Conf. Image Process., Barcelona, Spain,September 2003, Vol. I, pp. 501–504

7 Celik, M.U., Sharma, G., Tekalp, A.M., and Saber, E.: ‘Reversible datahiding’. Proc. Int. Conf. Image Process., Rochester, New York, USA,September 2002, Vol. II, pp. 157–160

8 Goljan, M., Fridrich, J.J., and Du, R.: ‘Distortion-free data embeddingfor images’. Proc. 4th Inf. Hiding Workshop, Pittsburgh, PA, USA,April 2001, pp. 27–41

9 Honsinger, C.W., Jones, P.W., Rabbani, M., and Stoffel, J.C.: ‘Losslessrecovery of an original image containing embedded data’, 2001, USpatent, 6 278 791

10 Macq, B.: ‘Lossless multiresolution transform for image authenticatingwatermarking’. Proc. EUSIPCO, Tampere, Finland, September 2000

11 Tian, J.: ‘Reversible data embedding using a difference expansion’,IEEE Trans. Circuits Syst Video Technol., 2003, 13, (8), pp. 890–896

12 van Leest, A., van der Veen, M., and Bruekers, F.: ‘Reversible imagewatermarking’. Proc. IEEE Int. Conf. Image Process., Barcelona, Spain,September 2003, Vol. II, pp. 731–734

13 De Vleeschouwer, C., Delaigle, J.F., and Macq, B.: ‘Circularinterpretation of bijective transformations in losslesss watermarkingfor media asset management’, IEEE Trans. Multimedia, 2003, 5,pp. 87–105

14 Holliman, M., and Memon, N.: ‘Counterfeiting attacks on obliviousblock-wise independent invisible watermarking schemes’, IEEE Trans.Image Process., 2000, 9, (3), pp. 432–441

15 Fridrich, J.J., Goljan, M., and Memom, N.: ‘Cryptanalysis of theYeung–Mintzer fragile watermarking technique’, J. Electron. Imaging,2002, 11, (2), pp. 262–274

16 Barton, J.M.: ‘Method and apparatus for embedding authenticationinformation within digital data’, 1997, U.S. Patent 5 646 997

17 Cox, I.J., Miller, M., and Jeffrey, B.: ‘Digital watermarking: principlesand practice’ (Morgan Kaufmann, 2002)

IEE Proc.-Vis. Image Signal Process., Vol. 152, No. 6, December 2005786