Watermarking 3DObjects f0.rVevification *

W e have entered an era where inexpen-sive, readily available tools and equip-

ment can replicate, manipulate, and distribute digitalmultimedia materials with ease. Most often, replicationof digital content can produce perfect copies of the orig-inal, manipulation and editing of digital copies can

deceive even the most professionaleyes, and mass distribution can take

The watermarking place in a matter of seconds in elec-tronic forms. Misappropriation of

technique proposed here digital assets greatly concerns con-tent owners and creators, especially

enables the verification of when the content is made availablethrough the Internet. Without the

3D polygonal models for assurance of proper protectionagainst lost revenues, the owners of

detecting unauthorized digital content will be reluctant tomake these assets available.

alterations. Many view digital watermarkingas a potential solution for copyright

protection of valuable digital materials like CD-qualityaudio, publication-quality images, and digital video. Thefield of digital watermarking is relatively new, and manyof its terms have not been well defined. Among the dif-ferent media types, watermarking of 2D still images iscomparatively better studied. Inherently, digital water-marking of 3D objects remains a difficult problem. Webelieve a complete solution will not employ a genericalgorithm to watermark objects for a variety of applica-tions. Instead, different classes of applications willimpose different requirements and call for differentwatermarking techniques, ranging from slight modifi-cation of existing algorithms to completely orthogonalmethods.

Nonetheless, we intend to introduce and investigatethe fundamental similarities and differences of water-marking 3D graphic models compared to 2D images,and propose some solutions to address a class of appli-cations of digital watermarking-the verification of 3Dpolygonal models. To our knowledge, watermarking of3D objects for verification PurDoses has not been

Boon-Lock Yeo and Minerva M. YeungIntel Corporation

addressed in any published literature. The proposedscheme,% its present form, is not intended for use inapplicahons that require robust watermarks. One recentworkin 3D data hiding addressed applications requiring *robust means of hiding data.’

We will first introduce digital watermarking, discussits goals and application domains, and explain the dif-ferent categories of watermarks. We believe the goalsand applications will remain fairly similar for 2D imagesand 3D models.

Digital watermarkingWe define watermarking as a process that embeds

data into an object-a watermark. The object can be animage, an audio clip, a video clip, or a 3D model. Somepapers discuss watermarking other forms of multime-dia data such as sound clips.2*3Since our research focus-es on visual data, we say visible and invisible when in awider sense we mean perceptible and imperceptible. Wefurther define visible watermarking as embedding dataintentionally perceptible to a human observer, whileinvisible watermarking embeds data not perceptible,but extractable by a computer program.

In the image domain, a variety of invisible water-marking schemes have been reported in recent years,2-8along with commercial systems like Digimarc’s. Two cat-egories broadly classify these techniques: spatial-domainand transform-domain based. The earlier watermarkingtechniques reported were spatial in nature, the simplestbeing the ones that modified the least-significant-bits(LSB) of an image’s pixel data? Other literature proposed

,

improvement and variants of this technique.2*4Transform-domain-based techniques can be

employed with common image transforms like discretecosine transforms (DCT), wavelets, Fourier transforms(such as the FFT), and Hadamard transforms. Zhao andKoch reported one of the earlier transform-domain-based techniques tailored to JPEG-lossy image com-pression. Other techniques include the work ofSwanson, Zhu, and Tewfik! Cox et al. proposed a morerobust techniaue based on spread-spectrum principles3

Form SF298 Citation Data

Report Date("DD MON YYYY") 01011999

Report TypeN/A

Dates Covered (from... to)("DD MON YYYY")

Title and Subtitle Watermarking 3D Objects for Vevification

Contract or Grant Number

Program Element Number

Authors Project Number

Task Number

Work Unit Number

Performing Organization Name(s) and Address(es) Microcomputer Research Labs Intel Corp., SC12-303 2200Mission College Blvd. Clara, CA 95052-8119

Performing Organization Number(s)

Sponsoring/Monitoring Agency Name(s) and Address(es) Monitoring Agency Acronym

Monitoring Agency Report Number(s)

Distribution/Availability Statement Approved for public release, distribution unlimited

Supplementary Notes

Abstract

Subject Terms

Document Classification unclassified

Classification of SF298 unclassified

Classification of Abstract unclassified

Limitation of Abstract unlimited

Number of Pages 11

REPORT DOCUMENTATION PAGEForm Approved

OMB No. 074-0188Public reporting burden for this collection of information is estimated to average 1 hour per response, including the time for reviewing instructions, searching existing data sources, gathering andmaintaining the data needed, and completing and reviewing this collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information,including suggestions for reducing this burden to Washington Headquarters Services, Directorate for Information Operations and Reports, 1215 Jefferson Davis Highway, Suite 1204, Arlington, VA22202-4302, and to the Office of Management and Budget, Paperwork Reduction Project (0704-0188), Washington, DC 20503

1. AGENCY USE ONLY (Leave blank) 2. REPORT DATE

1/1/993. REPORT TYPE AND DATES COVERED

Article4. TITLE AND SUBTITLE

Watermarking 3D Objects for Verification5. FUNDING NUMBERS

6. AUTHOR(S)

Boon-Lock Yeo and Minveva M. Yeung

7. PERFORMING ORGANIZATION NAME(S) AND ADDRESS(ES) 8. PERFORMING ORGANIZATION REPORT NUMBER

IATACInformation Assurance Technology AnalysisCenter3190 Fairview Park DriveFalls Church VA 220429. SPONSORING / MONITORING AGENCY NAME(S) AND ADDRESS(ES) 10. SPONSORING / MONITORING

AGENCY REPORT NUMBER

Defense Technical Information CenterDTIC-IA8725 John J. Kingman Rd, Suite 944Ft. Belvoir, VA 2206011. SUPPLEMENTARY NOTES

12a. DISTRIBUTION / AVAILABILITY STATEMENT

A

12b. DISTRIBUTION CODE

13. ABSTRACT (Maximum 200 Words)

The watermarking techinque proposed in this article enables the verification of 3Dpolygonal models for detecting unauthorized alterations.

14. SUBJECT TERMS

Watermarking,15. NUMBER OF PAGES

16. PRICE CODE

17. SECURITY CLASSIFICATION OF REPORT

Unclassified

18. SECURITY CLASSIFICATION OF THIS PAGE

UNCLASSIFIED

19. SECURITY CLASSIFICATION OF ABSTRACT

UNCLASSIFIED

20. LIMITATION OF ABSTRACT

None

They embed a set of independent and identically dis-tributed samples drawn from a Gaussian distributioninto the perceptually most significant frequency com-ponents of the data. These papers have shown the tech-niques to be somewhat robust against variousimage-processing operations, and a few techniques caneven recover the watermarks in some test images afterprinting and rescanning.

Depending on the end applications, watermarkingtechniques can be further classified into fragile androbust watermarking. In fragile watermarking theembedded watermark will change or disappear if awatermarked object is altered. In other words, thewatermark can be used for verification of an object.Applications include providing trustworthy images cap-tured with a digital camera for inclusion into news arti-cles and trustworthy objects that will be delivered toremote clients. An invisible watermark is embedded atcapture or creation time; its presence at the time of pub-lication or upon receipt is intended to indicate that theimage or object has not been altered. In another appli-cation, objects like VRML9 models or human-fingerprintimages have been delivered or scanned and stored in adigital archive. In this case, the content owner may wantto detect any unauthorized alteration without compar-ing the objects to the o&inal models or scans, or send-ing separate signature files for authentication via digitalsignature schemes.

In robust watermarking, the embedded watermarkwill persist even in the face of removal. Such removalcan be unintentional transformations like filtering, crop-ping, translation, rotation, resizing, and lossy compres-sion; or intentional by processing the objects to removethe watermark. Intentional attack can include any com-binations of the aforementioned transformations. Theembedded robust watermarks can serve as evidence ofownership if the owner’s label is detected in a suspect-ed copy. The watermarks can also serve as identificationin the fingerprinting application. Here the seller of anobject imprints an invisible label to indicate to whomthe object is sold. If the seller later finds a cdpy of theobject published without royalty payment, the water-marks can help identify the misappropriator. Further-more, the embedded watermarks may serve as a form ofcopy protection-the detection of these indicators cantrigger protection or royalty collection mechanisms likethe current copy protection standard. Such a standardwould incorporate digital watermarking under consid-eration in the Digital Versatile Disc (DVD) standardiza-tion committee, plus some commercial systemsadvertising the capabilities of “web-crawling” copy-righted images.

The end applications of the embedded watermarksimpose specific criteria and requirements on the corre-sponding watermarking schemes that will give rise tothe desired properties of the watermarks. This is whywe avoid the term “data hiding” or “data embedding”and prefer the term watermarking. Data hiding refersto the process of hiding data in an object or media typein general and does not distinguish the end applications,nor does it describe adequately the desired propertiesof a particular class of watermarks.

Related workWatermarking research is relatively new in many

fields. In the previous section, we briefly introducedsome published image watermarking techniques, most-ly from signal-processing perspectives. A majority ofexisting techniques focus on embedding data into stillimage and video, some of which has shown a certaindegree of robustness against JPEG compression, filter-ing, limited cropping, and rotation. Interestingly, manyhave equated “robust” data hiding to adequate copyright protection without a clear understanding of thelimitations. Such arguments often understate therequirements and overstate the goals and benefits of thetechniques developed. For example, counterfeit-water-marking schemes can be developed to allow multipleclaims of rightful ownerships on an image, despite theimage being watermarked. The attempt to remove thewatermark is not even necessary. (A recent study on theclasses of watermark attacks appears elsewhere.“)

Watermarking techniques notdesigned carefully for 3D objects caneasily fall prey to trials and tribula-tions similar to those experienced byimage watermarking. In this article,we provide the background andgeneral formulations of watermark-ing 3D objects, and address the

In robust watermarking,

the embedded

watermark willwatermarking of 3D models for ver-ification applications. We focus onfragile 3D watermarking, which hasa clearly defined set of requirements

persist even in the

face of removal.and a clear goal of detecting andlocating unauthorized alterations. We do not intend toaddress the entire spectrum of issues in 3D watermark-ing and present solutions for every application.

Embedding data in 3D modelsTo our knowledge, only one published research paper

addresses the watermarking of 3D objects. Data hidingin 3D polygonal models was recently studied to addresscopyright protection concerns in VRML models.’ Theembedding algorithms operate on 3D polygonal mod-els of geometry by modifying either the vertex coordi-nates, the connectivity, or both. The schemes reporteddo not need the reference original models to extract theembedded data. In addition to invisible data embed-ding, the literature also discusses a method to embedpatterns into a model for visible water-marking with afocus primarily on embedding data. The embeddingmethods reported incorporated certain robustness cri-teria against some transformations like resection andlocal deformation by using repeated strings of data bits.A randomization of coordinates-a more general classof geometric transformation, remeshing, and so on-can destroy the embedded data.

In the reported work, the techniques provide littlesecurity to combat attempts at removal. In fact, anyonewho knows the data embedding and extraction algo-rithms can extract the embedded data bits, and subse-quently remove them. An optional stego-key describedwas not integrated into the watermark embedding andextraction processes; rather, it is a key for encrypting a

1 Encoding,decoding, andcomparingembeddedwatermarks inan object.

k,

Original object, 0I I

YEI---

Watermarked object, 8

Test object, 0’ Original object,I 0 (optional)

LQ,’c

(optional)

readable message into a sequence of bits for embeddingpurposes-even if someone recovers the bit sequence,they cannot read it. But an attacker does not need toknow the message before he can remove the entire bitsequence. Since the authors addressed robust water-marking applications, the lack of protection and securedecoding may eventually defeat the entire purpose ofwatermarking the models.

We believe that any watermarking scheme shouldincorporate some form of secure means in the watermarkembedding and extraction processes. (Note that thedegree of security may differ from the stricter require-ments in data encryption and decryption.) This beliefinfluences our formulations, described in later sections.

extends the error-diffusion tech-niques in image half-toning to pro-duce small and random changes.This smoothly spreads out errorsproduced locally. The watermarkextraction function, wx ( ) , is com-puted from a given verification keyand can be implemented in the formof binary lookup-tables. In the imageverification stage, a watermarkimage is extracted from a test image(presumably watermarked) by firstcomputing the watermark extrac-tion function from the verificationkey, then applying the function toevery pixel to obtain the extractedwatermark pixel. The extractedwatermark image lets users visually

detect unauthorized alterations made to the image (post-watermarked) and verify or authenticate the content.

The goals and the principles of 2D-image and 3D-object vGrification have significant similarities. Howev-er, the method employed in the image domain cannotbe directly mapped to the 3D objects. ,

A generalized model for watermarking3D objects

t

In robust watermarking research, many issues havenot been well defined, let alone resolved. These include,but are not limited to, the spectrum of possible attacksand transformations, performance measurements, andother issues. Ohbuchi, Masuda, and Aono’s study’ pro-vides a beginning vertex in the quest for better and morerobust water-marking techniques. Understandably, theseissues warrant further detailed study in the future.

lmage verification with digital watermarksIn the image domain, Yeung and Mintzer described a

technique7 for quickly verifying that the content of animage has not changed since the image was water-marked via the use of an invisible watermark embeddedinto the image pixel values. This “fragile” watermark-ing technique consists of a watermarking process thatstamps a watermark pattern invisibly onto a sourceimage using a verification key, plus a watermark extrac-tion process that decodes the embedded watermarkfrom a watermarked (or stamped) image, based on theverification key. The watermark pattern is designed toallow quick visual inspection.

In the watermarking process, a binary map of a water-mark image is embedded into the source image. The pro-cessing applies a watermark extraction function JO theselected pixel, tests the extracted watermark value todetermine if it equals the desired watermarkvalue, and,if necessary, modifies the pixel value to produce thedesired watermark bit value. The modification is cou-pled with a modified error-diffusion process, which

For better understanding, we present the definitionsand formulations of watermarking 2D and 3D objects,and discuss the 3D features and verification process fur-ther. Also note that the formulations presented here arethe generalized forms for both robust and fragile water-marking.

Definitions and formulationsWe have introduced the terminology and different

classes of watermarking schemes. We next present thegeneralized formulations of’ invisible watermarkingschemes. We define in general terms the process ofwatermarking (watermark insertion/embedding) anobject and the process of watermark extraction. Figure1 illustrates both the watermarking process, by which awatermark is inserted into an object, and the extractionprocess, by which a watermark is recovered and thencompared to the inserted watermark.

Here we denote an object, 0; a watermark, W, com-prising a sequence of owner-supplied data bits W = {WI,~2, . . .}; and the watermarked object, 0. In addition, wealso define a key, K, which is a sequence of bits that helpsdefine the specific mapping function for additional secu-rity in watermark insertion and extraction. E is an \encoder function if it takes an object, 0, and a water-mark, W, incorporates the mapping supplied by a key, K,and generates a new object called the watermarkedobject, 6, for example, &CO, IV”=6 Note that we donot exclude the possibility that the watermark, W, isdependent on the object, 0. In such cases, the encodingprocess described above still holds. Also note that insome watermarking schemes the watermark, W, canactually be the key, K, or it can include the informationprovided in K. In other words, &CO,) = 6.

A decoder function D takes an object, 0’ (0’ can be a

watermarked or unwatermarked object, and possiblycorrupted), and recovers a watermark, W, or evidenceof the original watermark’s presence, W, from the object.If available, a decoding key, K, can help define the spe-cific mapping of the decoding function. In this process,an additional object, 0, can also be included, often theoriginal (and unwatermarked) version of 0’. This hap-pens because some decoding schemes may use the orig-inal or reference objects in the water-marking process toprovide extra robustness against intentional and unin-tentional corruption of pixel values. More formally, if

\ the decoding scheme involves a reference 0, DK (0’, 0)= P (IV), where P is a function indicating the presenceof a watermark, W, in 0’. We call this type of water-marking scheme a “private” watermarking scheme.WhenP(W) = W, the decoding simply returns theextracted watermark W. P may also be of the form P()= Evid() that returns a scalar value indicating the evi-dence of the presence of Win 0’. Again, in some schemesthe watermark itself may suffice as the key for extrac-tion. In such cases the information encoded is alreadyanticipated in the decoding process, like checkingwhether a presumably watermarked object contains aparticular data sequence supplied by its owner.

If the decoding does not need 0 in the watermarkextraction, we can write a general decoding function asDK (0’) = P (IV). This type of watermarking scheme iscalled a “public” watermarking scheme. Note that insome water-marking schemes, the decoding function, D,may depend on the specific watermark embedded in theencoding process.

When P(w) = W, the extracted watermark, W, isthen compared to the reference watermark, W, by acomparator function, C6, and a binary output decisionis generated indicating a match or otherwise:

(1)

Here, c is the correlation of the two watermgks. With-out loss of generality, a watermarking scheme can betreated as a three-tuple (E, D, Cs), such that D (E(O,W))= W for any object, 0, and any allowable watermark, W.

In robust watermarking, the encoding and decodingfunctions have to be designed such that, given the testobject, 0’, is a derived or transformed object from thewatermarked object, 6, that is, O’=T& for some trans-formation T: (1) if the decoding returns a value P(W) =Evid() indicating the presence of the watermark W inthe test object 0’, then the value has to be sufficientlylarge; or (2) if P(w) = W, then C(W, VV) = 1 for a suf-ficiently large c.

In fragile water-marking the encoding and decodingfunctions have to be designed such that, given the testobject OLdeviates from the watermarked object 0, thatis, 090: (1) if the decoding returns a valueP(W) =Evid() indicating the presence of the watermarkWin the test object 0’, then the value has to be suffi-cientlysmall; or (2) ifP(VV) = W, then C(W, w) = 0 fora sufficiently large c.

Both robust and fragile watermarking schemes can befurther classified into public and private schemes accord-

ing to whether a scheme requires using the referenceoriginal 0 in the decoding. In practice, since fragilewatermarks are used for verification applications-thebenefit of which includes the capability to verify an objectwithout resorting to comparing with a reference origi-nal-it does not make sense to have a “private” fragilewatermarking scheme.

30 features for watermarkingFeature-based watermarking schemes that embed a

watermark W = (wl, wz, l ..) into a set of derived fea-tures F(0) = cfi(O), fi(O), l .+ represent one commonapproach towards watermarking an object. Usually, thefeature set cfi(O),f2(0), ...} is chosen such that slightmodification of individual features does not perceptu-ally degrade the functionality of the object, 0. In theimage domain, it is the perceptual quality of an image.An example of such a set of features would be transformdomain (like DCT and wavelet) coefficients, which con-tain significant energy content.

In a 3D model, the modification will have to be doneon a set of features that will not significantly change themodel’s end uses and degrade the perceptual quality ofthe graphics generated from the model. A 3D objectmodel may contain many types of information, includ-ing geometry, color of the vertices, directions of nor-mals, and images for texture mapping.

We will assume, without loss of generality, that the 3Dobjects of interest are described using a sequence ofpolygonal surfaces. In particular, each surface S will beof the form {vi, v2, . . . , vn}, where Vi is a vertex in 3D spacespecified by its 3D coordinate (Xi, yi, Zi). In describing OIU

watermarking algorithm for verification, we will use onlythe surface information of an object (the sequence of sur-faces Si, S2, ...), each of which is a polygon. In VRML,9surface information of an object is described using theIndexedFaceSet construct of the following form:

IndexedFaceSet {coord Coordinate C

vertex [...IIcoordIndex [...I

I

Polygonal surfaces are fundamental descriptors of 3Dobjects. While other descriptors exist, such as globallighting information, color of the vertices, directions oinormals, and texture, they’re not always necessary indescribing 3D objects. In addition, it is straightforwardto include them into the watermarking techniques, ijdesired. For example, in texture maps of images, 2Cimage watermarking techniques can be directly appliedonto the images in addition to water-marking the polygonal 3D objects.

Watermarking 3D objects forverification

The technique we propose for watermarking 3Eobjects for image verification inherits several character,istics from the 2D image verification technique describecby Yeung and Mintzer.7 Common to both techniques an

2 A flowchartof the water-mark decodingprocess.

ti= i+l i

I the processes of stamping an invisible watermark,I decoding based on a verification key, andI encoding based on making slight modifications to the

object or image to meet certain criteria.

A key difference is that images lie on a fixed and regulargrid, while 3D objects do not. Our technique overcomesthis additional constraint (or rather, the freedom) inher-ent in 3D objects.

Before describing the watermarking technique, weneed to state some notations. The list of 3D vertices isordered as vi, ~2, vg, . . . . The set of vertices, vj’s, are con-nected on some surface to vi (these vertices are calledthe adjacent neighbors of vi) such that j < i and the ver-tex vi itself is denoted by N(vJ . The number of this col-lection is denoted by 1 N(vJ I. A watermark signal, W,represents an ordered set of binary value used for inser-tion into the 3D object and for testing the authenticityof the objects. For the discussion that follows, we willassume W to be a 2D order set indexed by W(i, j) . Aver-ification key, K, represents a set of lookup tables (LUTs)with binary entries and is necessary for decoding a 3Dobject.

We will describe the water-marking technique on one3D object, 0. The generalization to several objects isstraightforward. Following the notations introduced ear-lier, the watermarked object is denoted by 6, and 0’denotes a test object whose authenticity we want to verify.

Decoding the watermarked objectThe goal of decoding is to extract a watermark, W,

from the test object, 0’, and compare against the water-mark, W, to test for changes made to the 3D object, 0.Our scheme is a public scheme, meaning our decodingdoes not use the original object. We will describe P()(and thus the comnarator CR of Eauation 1) later.

60 (b)3 Three sets of location indices on 64 x 64 grids forthree different objects: (a) a chair model with 450vertices (shown in Figure 9), (b) a coffee pot modelwith 524 vertices, and (c) a tank model with 1,512vertices (shown in Figure 8).

The process follows: Given a vertex v of the object 0’,we first generate two values, the location index, L(v),and the value index, p(v). L(v) is used to index into thewatermark, W, for extraction of the bit value, W(L). (Wewill refer to the indices as L and p when there is no ambi-guity regarding the vertex of interest.) The value index,p, ext+cts the bit from the verification key, K, at loca-tion p, represented by K(p). If the two bit values W(L)and K@) do not match, we say that the vertex v isinvalid. The purpose of watermark embedding is tomake sure that every vertex in a 3D object is validaccording to the verification key, K, and watermark, W.We illustrate this process in Figure 2.

If an arbitrary key is used instead of the correct key, K,about 50 percent of the vertices will be invalid. Thus,without a’correct key, you cannot extract the watermarkcorrectly.

Computing the location index. To generate thelocation index, L, we first compute N(v) of the currentvertex v. The 3D coordinates of the vertices in N(v) arethen combined and hashed to produce the index L. Thebasic key step to generate a 2D index L = (Lx, LJ follows:

[Algorithm Compute Location Index]

l.Set S=(sx,sy,se)=-l c

I 4uti(v) u

WV

2.N, = ConvertToInteger(sx), NY = ConvertToInte-ger(s,), N = ConvertToInteger(s,)

3. Lx = f,(N,, NY, NJ and L, = fyWx, NY, W

In step 1, we find the centroid of the vertices in N(v).This step seeks to combine the list of 3D coordinatesinto a three-tuple. Other methods, like the median andmode, can also be employed. Step 2 converts the float-ing-point numbers from step 1 into integers throughthe ConvertToInteger() routine. Step 3 then combinesthe three integers derived in step 2 to obtain two inte-gers, L, and Ly. An example fx is (Nx + Ny + Nz) modXSZE. In summary, the three steps provide a mappingfrom the centroid (or other combinations) of the ver-tices in N(v) to a discrete 2D grid of size XSIZE by YSIZE.The location index, L, denotes the location on the grid.Finure 3 shows three sets of location indices corre-

sponding to three different objects.The 2D grid is chosen to be 64 x 64,and a white vertex represents anoccupied 2D location.

Computing the value index.Next, to generate the value index,we take the 3D coordinate of v andmap it into a three-tuple of integers,denotedbyp = (pl,p2#3)*~j'funC-

tions for scaling a floating-point rep\ resentation to integers (such as

ConvertToIntegerO) serves for thispurpose. The valuep is analogous tothe color information of a pixelvalue. Thus, the combination oflocation L andvaluep are analogousto the combination of pixel location

i= 1FCompute

WW) + K(PW 4

and color information in 2D images. Note, however, thatmapping the collection of location indices does not coverall the 2D pixels in a regular grid.

The value index p is then used as the input into thekey, K, to derive the bit K(p). This bit value shouldmatch the watermark bit at location L-the bit W(L)would validate the 3D vertexv, for example. The LUT inthe key K can be gen&rated using a pseudo-randomnumber generator. The size of the LUT should also besufficiently large to be secure. In our experiments, weuse a key with 256 x 256 x 256 = 224 entries. In fact,our LUT consists of three separate LUTs, Ki, &, and KS,each with 256 binary entries. The value of K(p) is thencomputed as

K@) =Kl(pd@Kz(pz)@K3@3) (2) be a time-consuming process and require intensive userinteraction (rotating the model and zooming in on

where $ denotes binary XOR. We only need to maintain details to see changes). The difficulty of verification can256 x 3 = 768 binary entries. grow in complex models. Another method allows the

user to visualize the extent of the modifications madeb Verification. One approach to compare the extract- to object 0 using a 2D technique. This technique allowsed watermark W and W is to count the numbFr of mis- a user to immediately see the extent of modificationmatches between K@(v)) and W(L(v)). Precisely, we (none, some, or a lot) and can be used with the 3D visu-can compute a number c, the correlation between two al-inspection technique. We describe a technique to visu-watermarks, as follows: alize and verify models in a 2D image plane later.

l{v : K(p(v)) = w(LW}l Embedding the watermarkC =

II ‘II(3) The task of watermark embedding is to make slight

V changes to the geometry of an object such that

When no changes have been made to 0, c = 1. To detectthat no changes have been made to 0, we require thatS = 1 in Equation 1.

All the detected invalid vertices in a 3D model can behighlighted (for example, using different colors at thesevertices) at rendering time for quick identification andlocalization of the modifications through visual inspec-tion. In general, the set of invalid vertices consists ofmodified vertices in a 3D object and some of their adja-cent neighbors. The adjacent neighbors of a modified vmay be flagged “invalid” because their location indicescould be changed by the modification made to v. We willdiscuss some experimental results of such later.

Visual inspection of 3D models with a naked eye can

K@(v)) = WLW) (4)

holds for every vertex v in the object. We will describe atechnique for achieving this through the modificationof only v. Generalization to include N(v) and other rel-evant information (such as lighting) is straightforward.We illustrate this embedding process in Figure 4.

An important consideration in computing Equation4 is that of causality. Since we are perturbing vi, it isessential to perturb them in the correct order (VI, ~2, a.*,for example). This causality concern is already built intothe definition of N(vi), where the dependence is never onthose unvisited vertices.

Figure 5 shows an ordered traversal and nrocessinn

4 A flowchartof the water- l

mark embed-ding process.

5 An illustra-tion showing anordered traver-sal of thevertices.

6 A 2D watermark of size 100 x 63is a bitmap of a logo (a). The setof position indices for the tankmodel (b).

WMK(a)

00 W

w

w7 Visualizing the extracted watermarks: (a) extracted from watermarked object 0’ , (b)extracted from a slightly modified version of watermarked object 0’ , and (c)alteration detect-ed (highlighted difference).

/I*(

Bf some vertices. If the current vertex in processing is~4, then vi, ~2, and v3 are already processed. Then, thecalculation of the location indexL(v4) involves only thevertices 19, ~3, and ~4.

To perturb a vertex v = (x, y, z) to v’ = (x’, y’, z’), wefirst move the individual coordinate by L\x (or AY or A,),and slowly increment the perturbation until Equation 4holds. The first few steps are

1.v’t(x+4r,yA,2.v’+ (x-Ax,y,z),3.v'+ ky + AyA,4.v'c (x,y-AY,z),5.v'+ (x,y,z + &I,6.v'4dx,y,z-&L7.v'+(x+&,y+LSyA,

and so on.

Visualizing the decoded watermarkAfter a watermark has been extracted from a 3D

object, the number of times Equation 4 is not satisfiedcan indicate the amount of modification made to theobject. The invalid vertices can be highlighted in 3Dusing rendering time for visual inspection. Anothermethod allows the user to visualize the changes in 2D.This eliminates the need for constant user’s interactionwith the system (no zooming, panning, and rotating ofthe 3D model). To achieve this, we select a 2D-water-marksignal, W, which is meaningful whenviewed as animage. Figure 6a shows an example watermark, W,which is a bitmap of a logo. Figure 6b shows the set ofposition indices of a 3D object on the same 2D grid, uponwhich W is based.

To visualize the extent of modification made to a 3Dmodel, we propose to superimpose the location indicesonto the watermark signal W. We construct a grayscaleimage W’ from W, the set of location indices of 0’,

L(O'), the sets Gl = {v E 0' : K@(v))= W@(v))), and GZ = {v E 0’ :K@(v)) z W@(v))}. The image W’consists of only 4 values: 0,64,192,and 255. To begin the process, weset the pixels in W” to take on thevalue 192 if the corresponding bit(at the same location) of W is 1, and64 if the bit is 0. Then, on the loca-tions specified by L(0’) we modifythe pixel values to either 0 or 255,according to whether the corre-sponding v is in G1 or Gz. For thosevalid v’s in Gl, the pixels with value64 become 0, and pixels with value192 become 255. On the otherhand, for those invalid v’s in G;2, thepixels with value 64 become 255,and pixels with value 192 become0. The effect is to both highlight thelocation indices (using pixel values0 and 255) and to indicate thoselocations where the invalid v’s weremapped. We call the process visual-

izing the extracted watermark.If we perform a watermark extraction process for

unwatermarked objects, statistically about 50 percent ofthe extracted pixel value v’s are invalid. This acts likesuperimposing a noise pattern onto the watermarkimage W: the processes of changing the pixel values from192 to 0 or from 64 to 255 significantly degrade or evendestroy the watermark image for visualization purpos-es. On the other hand, the extracted results from awatermarked object clearly show the watermark image.Figure 7 shows W’ of the object after watermark extrac-tion and the results after modification of the water-marked object. Figure 7a shows W” of a watermarkedobject that has not been modified. Here, we can clearlysee the logo image. Further-mare, pixels with value 0 and255 indicate the position indices. Finally, Figure 7bshows W’ of a watermarked object that has been slight-ly modified (a view of the object is shown in Figure 8~).We use a red circle on a location indexhighlighting mod-ified 3D vertices in Figure 7c. Comparing 7a and 7b, wecan see that a few pixels differ. These locations representthe location indices of those 3D vertices that have beenmodified.

Some enhancement featuresA few features will help enhance the watermarking

process. Specifically, we will address those discussed \earlier.

Detecting object cropping. Protection againstcropping-rather, detection of object croppingattempts-results from the dependencies built in whenthe location index is computed: when a neighboringvertex u of a vertex v is removed, a different L results.However, in an alternative to the scheme, further pro-tection via cropping detection may also be added bymaking the computation of the position index, p(v),also dependent on the neighbors of vertexv. For the fol-

b(v)>0’ :1W’192,,wethe

3 bitandoca-difym,rre-loseAuellueherthe55,)methe

1uesoserereual-

forIt oflikelark-0mvenIOS-n alge.rac-ter-kedarlyand

7b:ht-3c).od-we:enteen

ingsed

nstingleningIts.ro-bY

:v>,fol-

lowing discussion, we will denote N(vJ = (~1, ~2, . ..,UMiMi), and p(vJ = Cpl(ViI, p2(Vi), p3CViII. K(p(viI) can

instead be computed as

where CB denotes binary XOR. Thus, the lookup table Kis applied not just to the position indices of the currentvertex, vi, but also to all of its other elements of N (Vi).When some of the neighbors are missing, due to crop-ping for example, a possibly different K(p(vJ) results.In other words, cropping will produce a mismatch onabout half of the extracted results on the boundaries.

Guarding against potential attacks. In access-ing the scheme’s resistance against tampering, we haveto look at how easy it is to forge a “good” watermarkafter an alteration without the knowledge of the key(or the set of binary LUTs). In other words, the alter-ation will go undetected in the verification process.Deciphering the content of the set of tables provestedious thanks to the key length (768 bits) and thedependencies of one vertex on its neighbors in thedecoding of the watermark, which make the inversioncomputationally infeasible without knowledge of thewatermark. The exhaustive inversion computation maybe made slightly easier by having complete or partialknowledge of the watermark image. For example, whileit is visually pleasant to have corporate logos as water-mark images, such a practice can lead to an attackerguessing or experimenting to find partial informationon the watermark for subsequent attacks. Though notoften feasible, we can guard against potentially sophis-ticated attacks by further scrambling the watermarkwith a key. This key can be the same or different fromthe one used to generate the watermark extraction

’ function. Alternatively, we could modulate the water-mark image into some random-looking patterns usingsome noise signal, which in turn can serve% the key indecoding the “chaotic image mixing” technique. In thiscase we need ‘to incorporate an additional step ofdescrambling the watermark prior to visual verification.

Results and discussionFigure 8 shows a tank model at different stages of

watermarking. Figure 8a shows the original model 0.Figure 8b shows the same of view of the watermarkedmodel 6. We chose this view to show as many 3D ver-tices as possible and to illustrate that even after water-marking, the two models are visually identical. InFigure 8c, we make a slight change to 6 to form 0’: thetop of the tank is now made sharp and pointed. To makethis change, the locations of 12 vertices are changed in6 to form 0’. The decoding reports that 15 vertices areinvalid. Of the 15 vertices, 12 vertices have been mod-ified, with the remaining 3 vertices classified as invalidbecause some of the modified 12 vertices changed thelocation indices of neighboring vertices. This violatesthe right-hand side of Equation 4, even though the left-hand side does not change. Figure 7c lets us visualize

(a)

the extracted watermark from this modified object ir2D. From this view,slight modifications

we can immediately see that on13have been made to the 3D object.

Generally, decoding will report more vertices a!invalid because of using adjacency information. However, adjacency information is crucial in describing 31:objects-and thus cannot be omitted. We can furthe!study methods that precisely locate the altered verticerand polygons. We will also look into the techniques tha

IEEE Computer Graphics and Applications

B A tank model

rhowing (a) aview of the

original, (b) the

same view afterthe original has

been water-

marked, and

(c) the same

view after the

watermarkedoriginal has

been modified.

9 A water-marked chairmodel: (a) oneview, (b) anoth-

er view, and(c) a zoomed-inview.

incorporate explicit authentication and verification ofpartialVRML models. Currently, verification of a partialmodel is implied: all vertices and polygons in the par-

tial model can be verified except those on the outer-most boundaries, which will appear to have beenaltered since watermarking.

In Figure 9, we show a watermarked version of a sim-ple chair model. This example is chosen to illustrate thateven on models with simple surfaces, watermarkingdoes not induce visible artifacts. Figures 9a and 9b showdifferent views of the chair. Figure 9c shows a zoomed-in view. Even in the zoomed-in view we cannot perceiveany artifact due to watermarking.

For a fragile watermarking scheme to be effective andsecure in verification and authentication applications, itmust be very difficult-better yet impossible-for aninterloper to decide whether an object has been water-marked, what the watermark is, and where the infor-mation is embedded. This must be done in such amanner that an attacker cannot reapply the correctwatermark after an alteration to fool the verificationprocess. In this sense, the experimental results obtainedindicate that our verification achieves this goal. With-out the proper key, it’s very unlikely that anyone couldextract the watermark, or even decide if the model is awatermargd version. In addition, an interloper, afteraltering the model, cannot remap the geometry torestore the changed watermark data to its original ver-sion without knowing the key and the watermark.

Our proposed technique allows us to detect, local-ize, and visualize the locations and extent of modifi-cations made to the geometry of 3D objects. To extendthe idea to indicate modifications to other relevantinformation, such as color, normals, and texture, wecan incorporate these parameters, where available,into the mapping and hashing processes in computinglocation and value indices. This allows a multiple-levelverification in which, at the most fundamental level,only the geometry is verified, then the lighting infor-mation, followed by texture mapping. Color and tex-ture maps can be watermarked also by image-basedtechniques for respective verification. The incorpora-tion and integration of these other features warrantfuture investigations.

Conclusions and future workIn this article, we have presented definitions and for-

mulations for generalized watermarking of 3D objects.We also proposed new watermarking techniques for 3Dobject verification to detect unauthorized alterations inthe underlying polygonal models. The goal of suchwatermarking techniques is to embed watermarks thatare sensitive to slight modification and to allow quickdetection, localization, and visualization of the modifi-cations. We achieved verification and authenticationwithout resorting to the original model for comparison.

We have discussed some future investigations, whichinclude developing visualization tools to detect andlocalize alterations, and the techniques that can provide‘enhanced functionality like authentication and verifi-cation of partial VRML models and multilevel authenti-cation of 3D models.

Fragile watermarking is only one category of water-marking. To broaden the field of applications, we alsoneed to study robust watermarking of 3D objects. Dif-

ferent sets of criteria and challenges exist for robustwatermarking.

Watermarking technologies are new to manyresearchers in the signal (audio/image/video) pro-cessing and steganography fields, and even newer to thecomputer graphics community. Inherently, digitalwatermarking of objects, like its image counterparts,proves a difficult problem. Understandably, the existingtechnologies, in particular robust watermarking tech-niques, may not yet have achieved their ambitious goalsand lived up to the high expectations. Nevertheless, thetopic is an important one in any field that involves mediacontent creation, manipulation, and delivery-computer graphics not excluded. We hope introducingand investigating the topic will help generate more dis-cussions and prompt future work in this area. n

References1. R.Ohbuchi, H. Masuda, and M. Aono, “Watermarking

Three-Dimensional Polygonal Models through Geometricand Topological Modifications,” IEEE J. on Selected Areasin Comm.,VoI. 16, No. 4, May 1998, pp. 551-560.

2. W.R. Bender, D. GruhI, and N. Morimoto, “Techniques forData Hiding,“Proc. SPIE: Storage andRerrieval ofrmage andVideo Databases, Vol. 2420,1995, pp. 164-173.

3. I.J. Cox et al., Secure Spread Spectrum Wa&ermarkingforMultimedia, Tech. Report TR-95-10, NEC Research Insti-tute, Princeton, N.J., 1995.

4. N. Nikolaidis and I. Pitas, “Copyright Protection of Imagesusing Robust Digital Signatures,” Proc. IEEE Int’l Conf.Acoustics, Speech, and Signal Processing, IEEE Press, Pis-cataway, N.J., 1996.

5. R.G. van Schyndel, A.Z Tirkel, and C.F. Osborne, “A Digi-tal Watermark,” Proc. IEEEZnt7 Con, Image Processing, Vol.2, IEEE Press, Piscataway, N.J., 1994, pp. 86-90.

6. M. Swanson, B. Zhu, and A. Tewfik, “Transparent Robust, Image Watermarking,” Proc. Znt7 Con. Image Processing

96, Vol. 3, IEEE Press, Piscataway, N.J., 1996, pp. 211-214.7. M.M. Yeung and EC. Mintzer, “An Invisible Witermarking

Technique for Image Verification,” Proc. Znt7 Conf. ImageProcessing 97, Vol. 2, IEEE Press, Piscataway, N.J., 1997,pp. 680-683.

8. J. Zhao and E. Koch, “Embedding Robust Labels intoImages for Copyright Protection,” Intellectual Property

Rights and New Technologies, Proc. KnowRight Conf.,1995, pp. 241-251.

9. ISO/IEC 14772-111997, The Virtual Reality Modeling Lan-

ww 3 1997, http://www.vrml.org/Specifications/VRML97/.

10. S. Craver, B.L. Yeo, and M.M. Yeung, “Digital Watermark-ing-Technical Trials and Legal Tribulations,” Comm. ACM,Vol. 41, No. 7,1998, pp. 45-54.

Boon-Lock Yeo manages the VideoTechnology department for theMicrocomputer Research Labs ofIntel Corporation. He received hisBSEE from Purdue University in1992, and his MA and PhD degreesfrom Princeton University in 1994

and 1996, respectively. He holds four US patents, has 73pendingpatent applications, and was the recipient of the1996 IEEE Circuits and Systems Society Video TechnologyTransactions Best Paper Award. He is an Associate Editorfor IEEE Transactions on Image Processing. His interestsare in the general areas of image and video processing.

Minerva M. Yeung is currently aSenior Staff Researcher and manag-er of a research group working onmedia protection and managementfor the Microcomputer Research Labsof Intel Corporation. She received aBSEE (with Highest Distinction)

from Purdue University in 1992, and her PhD and MAdegrees from Princeton University in 1996 and 1994,respectively. She is an associate editor of the new IEEETransactions on MultiMedia, a guest editor of a specialissue of the Communications of the ACM on digitalwatermarking, and a co-chair of the Storage and Retrievalof Images and Video Databases conference in 1999. Herresearch interests are in the general areas of image andvideo processing, content protection, computer-humaninteraction, and muhimedia information systems.

Contact Yeo at Microcomputer Research Labs, IntelCorp., SC12-303, 2200 Mission College Blvd., SantaCZara, CA 95052-8119, e-mail boon-Zock.yeo@inteZ.com.