A Robust and Transparent Watermarking Method

against Block-based Compression Attacks

Phi Bang Nguyen1, Azeddine Beghdadi

1 and Marie Luong

1

1L2TI Laboratory, Galilee Institute. 99, Ave. J. B. Clement

93430 Villetaneuse, France

{nguyen, beghdadi, marie.luong}@univ-paris13.fr

Abstract. In this paper, we present a new transparent and robust watermarking

method against block-based compression attacks based on two perceptual

models. In order to resist to block-based compression, the main idea is to

embed the watermark into regions that are not or less affected by blocking

effect. These auspicious regions are selected based on a spatial prediction

model of blocking effect. Then, the embedding strength is optimally determined

using a JND model. The combination of these two models provides more gain

in robustness and transparency. Experimental results demonstrate that our

proposed method achieves a good invisibility and robustness against common

“signal processing" attacks, especially to JPEG compression.

Keywords: Watermarking, Pyramid Transform, Human Visual System,

Blocking Effect Prediction, JND

1 Introduction

One of the most challenging issues in watermarking is to solve the trade-off between

robustness and transparency. Unfortunately, these criteria are conflicting. Indeed, to

enhance robustness, we have to increase the watermark strength at the expense of loss

in transparency and vice versa. Designing algorithms for such an optimizing problem

is still a challenge for the watermarking community. We believe that one of the most

promising solutions to this issue is to take into account HVS (Human Visual

System)'s properties in the design of watermarking algorithms. By this way, we can

maximize robustness by introducing a perceptual constraint on transparency.

In the literature, most of existing approaches that resist to Jpeg compression are based

on the selection of the frequency bands, i.e. embedding in low or middle frequencies

prevent the signal from the quantization artifacts. Koch and Zhao [1] are among the

first researchers who propose a method in DCT domain which is based on a JPEG

compression model and pulse position modulation technique. The copyright code is

first encrypted and then embedded into random quantized DCT coefficients selected

in the middle-frequency band. In [2], Cox et al. proposed another non-blind DCT

based technique which allows a better robustness to JPEG compression by embedding

the watermark into low frequency components. However, embedding in the low

frequency band often causes visible distortions and hence, decreases the watermark

transparency. To overcome this problem, some authors have considered HVS in the

design of their watermarking algorithm. In [3], a watermark robust to a desired

compression quality level is constructed using the difference between the original and

the reconstructed image after compression. The used visual component is simply the

local average brightness. In [4], Seo et al. proposed to embed in the DC component of

the 8x8 DCT block due to the remark that this component contains most of image

energy and is the least affected by the quantization process. However, this strategy

risks a visible distortion. A JND (Just-Noticeable-Distortion) model is therefore

employed to guarantee the watermark imperceptibility. Finally, an important research

that should be considered is the study of Eggers and B. Girod [5] about the effects of

quantization on digital watermark. They proved that the robustness of an additive

watermarking scheme (via correlation based detector) after Jpeg compression can be

predicted with sufficient accuracy. Indeed, they propose a close form of the detection

output which is a function of the statistics of the host signal, the watermark and the

quantization step size.

Here, we propose an approach very different from the literature. The Jpeg

compression process is now regarded from an image quality point of view where its

impact is "blocking effect" rather than quantization effect. Firstly, the onset of

blocking effect (before compression) is predicted. The main idea is to predict how a

block-based compression procedure affects the image at a given bit rate. Then, the

watermark is selectively inserted into locations not or less affected by the blocking

effect and hence can survive compression. We present two perceptual models to

achieve gain in transparency and robustness (against Jpeg compression) at the same

time, that are the Blocking Effect Prediction (BEP) and the Pyramidal JND (PJND)

model. These models are proposed to control the imperceptibility of the watermark

and to improve its robustness against Jpeg compression. The idea of the BEP model is

to predict the onset of blocking effect (before compression) to selectively embed the

watermark into regions less affected by Jpeg compression (indicated by the BEP

map). The JND model is then used to control the watermark strength. This JND

allows hiding the watermark just beneath the detection threshold and therefore

guarantee the watermark transparency. An interesting remark is that although the BEP

model is used to improve the robustness to Jpeg compression, we can still have gain

in transparency. The same results are obtained with the JND model. A combination of

these two models is finally proposed which offers more gain in robustness and

transparency.

The paper is organized as follows: section 2 and 3 present the PJND and the BEP

models. Section 4 introduces three embedding schemes using these models. The

performance evaluation is reported in section 5 and finally, we give some conclusions

and perspectives in section 6.

2 JND Maps

In this section, we describe briefly our proposed JND model which has been designed

for the pyramid transform [6]. Such a model has been successfully exploited in

watermarking [7] [8]. For each level of the pyramid, a JND map is computed by

incorporating the most relevant HVS's properties such as contrast sensitivity function

(CSF), luminance masking and contrast masking.

2.1 Incorporating CSF and Luminance Adaptation

The CSF describes the variation of HVS’s sensitivity as a function of spatial

frequency and therefore has to be applied in frequency domain. To adapt this

phenomenon for spatial domain, we refer to the approach in [7]. For each level of the

Laplacian pyramid, the contrast threshold (CT) at the pixel (x,y) could be expressed as

the contrast threshold at the peak frequency of the channel ( )peakkCT f weighted by the

contribution of the level:

1

( , )( , ) ( )

( , )

peak kk k K

kk

L x yCT x y CT f

L x y

(1)

where ( , )kL x y is the kth

level Laplacian coefficient at the pixel (x,y), CT(fkpeak

) is the

contrast threshold at the peak frequency of the level, computed as its inverse CSF. To

this end, we use the Barten’s model [9] thanks to its flexibility and relative simplicity:

( , ) . .exp( . ). 1 .exp( . )CSF f L a f b f c b f (2)

where c is a constant, a and b are functions of the global luminance L (in cd/m2)

which is computed as follows:

0( , ) ( , )IL x y L L x y (3)

where L0 is the ambient luminance and LI is the local luminance computed, for each

pixel, from the corresponding Gaussian value in the (k+1)th

level, 1( , )kG x y ,

followed by a grayscale to luminance transformation:

1max min

( , )( , ) max( ( ) , )

255

kI

G x yL x y L L (4)

where Lmax and Lmin are respectively the maximum and minimum luminance of the

display, whereas is the exponential factor used in the gamma correction of the

display. The detection threshold T0k(x,y) which accounts for contrast sensitivity and

luminance adaptation is then computed by:

0 1( , ) ( , ). ( , )k k kT x y CT x y G x y (5)

2.2 Contrast Masking

The JND threshold is finally obtained by incorporating a contrast masking model

inspired from [10]:

0 0

0

0

( , ) ( , ) ( , )

( , ) ( , )( , ).

( , )

k k k

k k

k

k

T x y if L x y T x y

JND x y L x yT x y otherwise

T x y

(6)

where is a factor that describes the degree of masking, 0.6 1 [10].

3 BEP Map

Blocking effect is the consequence of partitioning image into blocks and processing

each block independently (with assumption that information contained in the image

are independent), as is generally the case with block-based compression methods. The

impact of blocking effect on an image region depends strongly on its local activity

(i.e. homogeneous, edge or texture). A number of local descriptors could be used to

characterize the region’s activity either in spatial domain or in frequency domain. In

order to make our approach independent of compression method, we use a descriptor

in the spatial domain, the local variance, thanks to its simplicity. Indeed, we assume

that a pixel is affected by blocking effect if its gradient (in the compressed image) is

null and its variance (in the original image) is not null. Based on this analysis, the

BEP map can be computed via a learning process described as follows [11].

3.1 Learning Process

The learning process is performed off-line on an image database. For each pixel (x,y)

of the kth

image in the database, we associate an influence factor defined as:

1, ( , , , , ) 0 ( , , ) 0

( , , , , )0,

if g x y k V q V x y kx y k V q

otherwise

(7)

where g is the pixel gradient computed in the compressed image, V is the local

variance computed in the original image, on a 3x3 window centered at the pixel, and q

is the quality factor of the compression process.

By compressing all images in the database at different quality factors, we can

construct an accumulation matrix, denoted as H. Each element of H represents the

influence factors accumulated over pixels and over images. For each pair of values (V,

q):

, ,

( , ) ( , , , , )

x y k

H V q x y k V q (8)

After a normalization step, we have ( , ) 0,1H V q

which represents the

probability represents the probability of being affected by blocking effect of a pixel

which has the variance v and is compressed at a quality factor q. Fig. 1 displays a part

of the accumulation matrix. For the sake of visibility, only variance values lower than

18 are illustrated. Indeed, one can see that the probability of being affected by

blocking effect is inversely proportional to the variance as well as the quality factor as

expected. The precision of the accumulation matrix depends on the size and the

content richness of the training database. Nevertheless, there is no guarantee that all

possible values of the local variance are present in the tested database, i.e. low

variance values are more often encountered than high variances since homogeneous

regions tend to be predominant in natural images. This leads to a lack of some

variance values in the voting matrix. To cope with this problem, a curve fitting is

applied on the experimental data to obtain an accumulation matrix for variance values

in the interval [0 255]. This selected interval does not theoretically cover all possible

variance values but practically sufficient since the variance values of 8x8 blocks

typically do not exceed this limit. Fig. 1 illustrates the data fitting. For the sake of

visibility, only four quality factors (corresponding to four lines in the accumulation

matrix) are shown. Each curve in the figure is a function of the variance and could be

interpreted as the probability that a pixel with local variance v belongs to a blocking

effect area at a given quality factor q.

Figure 1. The Accumulation Matrix (left) and the curve fitting (right) applied on the

accumulation matrix at quality factors of 80, 25, 15 and 10.

3.2 Prediction Process

Once the accumulation matrix computed, the BEP map of an arbitrary image can be

derived using a simple procedure. For a given quality factor q, the BEP map of an

image is obtained following the two steps:

1. Compute the local variance image V

2. For each pixel (x,y), assign the value corresponding to the local variance V(x,y)

as given in H

Figure 2. The "Barbara" image compressed at q=80, 20, 5 (bottom) and their

corresponding BEP maps (top)

50 100 150 200 250 300 350 400 450 500

50

100

150

200

250

300

350

400

450

500

0.1

0.2

0.3

0.4

0.5

0.6

50 100 150 200 250 300 350 400 450 500

50

100

150

200

250

300

350

400

450

500

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

50 100 150 200 250 300 350 400 450 500

50

100

150

200

250

300

350

400

450

500

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

Attacked Image Attacked Image Attacked Image

For an intuitive evaluation of the proposed method, Fig. 2 displays an image

compressed at different quality factors and its corresponding BEP map where red and

blue regions correspond to high and low probabilities of being affected by blocking

effect, respectively. It is clear that this probability increases with the decrease of

quality factor. Moreover, homogeneous regions are affected more quickly by blocking

effect than textured regions. As expected, there is a consistency between the

prediction and the actual compression. The same observations are also obtained for

different images.

4 Embedding using JND and BEP maps

For the sake of simplicity, we consider only the zero-bit additive scheme that embeds

a bipolar pseudo-random sequence { 1,1}kW into each level of the Laplacian

pyramid. Three embedding strategies are proposed as below.

4.1. Scheme 1

A straightforward strategy is to hide the watermark just beneath the detection

threshold using the following scheme:

( , ) ( , ) ( , ). ( , )wk k k kL x y L x y JND x y W x y (9)

By this way, the embedding strength is determined in an optimal way and hence,

achieves the trade-off between robustness and transparency.

4.2. Scheme 2

Two strategies can be considered. In the first strategy, the embedding strength is

adapted according to the BEP map while in the second one, the binary BEP map is

used to select “relevant regions” (image regions that are less vulnerable to blocking

effect) for embedding.

S1) ( , ) ( , ) (1 ( , )) ( , )wk k k kL x y L x y PBEP x y W x y (10)

S2) ( , ) . ( , ). ( , )wk k k kL L x y BPBEP x y W x y (11)

where is a global factor for controlling the watermark strength, PBEP and BPBEP

are the Pyramidal BEP map and its binary version, respectively.

The PBEP map is computed by applying a Gaussian pyramid transform on the BEP

map. Then, its binary version is obtained by thresholding this PBEP map. It is worth

to notice that a threshold of 0.5 means the selected regions are supposed affected by

blocking effect with a probability of 50%. So, we set this threshold to 0.3 to ensure

certainly that selected zones are the least affected.

Assuming that the BEP map works correctly, a linear correlation based detector is

used as follows:

1

1( ). ( )

N

lc

i

Cor f i w iN

(12)

where w is the watermark, f is the watermarked coefficient (possibly attacked) and N

is the number of watermarked coefficients.

We would like to know which scheme is better. In general, the product of f and w

is approximately the same for the two strategies (since the watermark survives at

regions unaffected by blocking effect and destroyed elsewhere) but the linear

correlation obtained from S1 is always lower than in S2 since it is divided by a larger

number of embedded coefficients N. Hence, S2 should be chosen.

4.3. Combined Scheme

In the second scheme, we demonstrated how the robustness against Jpeg compression

of a watermarking system can be improved by using the BEP map. Nevertheless, the

embedding strength is not optimally defined since it requires an additional global

factor. On the other hand, the first scheme offers an explicit and more sophisticated

manner to determine the visual detection threshold for the watermark strength. Hence,

it is necessary to take advantages of these two schemes. Such a solution can be

obtained by combining the BEP map and the JND map. The embedding rule is

defined as follows:

( , ) ( , ) ( , ). ( , ). ( )wk k k k kL x y L x y BPBEP x y JND x y W i (13)

Fig. 3 illustrates the BPBEP and the PJND map of the "Parrot" image for the first five

levels of the pyramid.

Figure 3. The BPBEP (top) and the PJND map (bottom)

0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1

0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1

0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1

0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1

0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1

50 100 150 200 250 300 350 400 450 500

50

100

150

200

250

300

350

400

450

5000

5

10

15

20

25

30

35

40

45

50 100 150 200 250 300 350 400 450 500

50

100

150

200

250

300

350

400

450

500

2

4

6

8

10

12

14

16

18

50 100 150 200 250 300 350 400 450 500

50

100

150

200

250

300

350

400

450

500

1

2

3

4

5

6

7

8

9

10

11

50 100 150 200 250 300 350 400 450 500

50

100

150

200

250

300

350

400

450

500

1

2

3

4

5

6

7

8

9

10

50 100 150 200 250 300 350 400 450 500

50

100

150

200

250

300

350

400

450

500

1

2

3

4

5

6

7

8

9

10

11

5 Performance Evaluation

Performances of the three proposed schemes are evaluated in terms of robustness and

transparency. For the first scheme, by using the BEP map, the watermark can survive

Jpeg compression at very low quality (q=6) but considerably fragile to other attacks

(see Table I). Furthermore, the watermark transparency is also improved due to the

fact that only a small portion of the image is chosen for embedding. Fig. 4 illustrates

watermarked images from schemes with and without using BEP map. For a fair

comparison, the same embedding rule (i.e. the same parameter ) is applied.

Figure 4. Zoom of a watermarked image with (left) and without (right) using BEP

map.

For the second scheme, the transparency is optimally achieved by using the JND map.

As shown in Figure 5, the original and the watermarked image are perceptually

undistinguishable (see [7] for a complete visual quality evaluation of the watermark).

The robustness is also significantly improved (see Table 1).

Now, the question is whether we have more gain in robustness and transparency when

combining the BEP and JND maps. Fig. 6 displays the detector output of the

combined scheme and the JND based scheme against Jpeg compression. It can be

seen that using both BEP and JND maps offers a significant gain in robustness to Jpeg

compression.

It is also necessary to know if the overall robustness (against other attacks)

decreases or increases with the combined schemes. Table I shows that for scheme 2

and the combined scheme, the watermark survives many severe attacks but there are

no significant difference in robustness between these two schemes to attacks exclude

Jpeg compression. Furthermore, robustness against some attacks “like Jpeg”

(Jpeg2000) is even slightly improved. This can be explained by interesting remark on

common characteristic of the two maps (see Fig. 3). The JND map also presents very

high values at regions “selected” by the BEP map so that most of watermark energy

concentrates at these common regions. This leads to the fact that embedding at other

regions does not help to increase much in terms of watermark energy.

Finally, it is clear that the transparency of the combined scheme is even better than

the second one (that uses only JND map) due to the fact that we embed in only a

small portion of the image and the embedding strength is controlled by the JND map.

Table I: Robustness Evaluation (tested on the “Parrot” image with some

common “signal processing attacks” and Photoshop manipulations). The shown

values represent the breakdown limit of the method (the strongest level of attacks to

which the watermark still survives).

Attack Type BEP JND BEP+JND

Centered cropping 12% 0.5% 1%

Jpeg compression q=6 q=9 q=3

Jpeg 2000 0.8 bpp 0.1 bpp 0.08 bpp

Gaussian Noise 20%

70%

70%

Wiener filtering Ok Ok Ok

Median filtering 3x3 5x5 5x5

Sharpening Failed Ok Ok

Blurring Failed Ok Ok

Bit plan reduction Failed Ok Ok

Histogram Equal. Ok Ok Ok

Rescale (50%) Ok Ok Ok

6 Conclusion and Perspectives

A novel approach that allows improving at the same time the robustness and

transparency of a watermarking system has been proposed and evaluated. The

obtained results are threefold. Firstly, using BEP map helps to significantly improve

the performance of a watermarking system not only in terms of robustness to Jpeg

compression but also in terms of transparency. Secondly, the use of the JND map in

the embedding helps to control the watermark transparency. Finally, the combined

scheme gives more gain in both robustness and transparency. It is worth to notice that

the proposed algorithm is quite flexible and can be exploited for other block-based

compression standards just by redoing the learning process when constructing the

BEP map. It could be straightforward to extend the BEP map to color by applying the

scheme to each color channel separately.

Figure 5. a) Original image and b) Watermarked image

Figure 6. Detector output of S1 and S2 schemes after Jpeg compression attacks at

different quality factors

References

1. E. Koch and J. Zhao, “Toward robust and hidden image copyright labeling,” in IEEE

Workshop on Nonlinear Signal and Image Processing, Greece, June 1995, pp. 452–455.

2. I. J. Cox, J. Kilian, T. Leighton, and T. Shamoon, “Secure spread spectrum watermarking

for multimedia,” IEEE ICIP’97, vol. 6, no. 12, pp. 1673–1687, December 1997.

3. H. J. Lee, J. H. Park, and Y. Zheng, “Digital watermarking robust against jpeg compression,”

in Information Security, LNCS. 1999, vol. 1729, pp. 167–177, Springer-Verlag.

4. H-U. Seo, J-S. Sohn, B-I. Kim, T-G. Lee, S-I. Lee, and D-G. Kim, “Robust image

watermarking method using discrete cosine decompostion and just noticeable distortion,” Proc.

of the 23rd ITC-CSCC’ 2008, pp. 765–768.

5. J. J. Eggers and B. Girod, “Quantization effects on digital watermarks,” Signal Processing,

vol. 81, pp. 239–263, February 2001.

6. P. J. Burt and E. H. Adelson, “The Laplacian Pyramid as a Compact Image Code”, in IEEE

Transactions on Communications, April 1983, pp. 532-540.

7. P. B. Nguyen, A. Beghdadi and M. Luong, "Robust Watermarking in DoG Scale Space

Using a Multi-scale JND Model", Lecture Notes in Computer Science, vol. 5879, pp. 561-573,

ISBN: 978-3-642-10466-4, Muneesawang, P.; Wu, F.; Kumazawa, I.; Roeksabutr, A.; Liao,

M.; Tang, X. (Eds.), 2009

8. P. B. Nguyen, A. Beghdadi, and M. Luong, “Perceptual watermarking using pyramidal JND

maps”, in Proc. of 10th IEEE ISM’08, pp. 418-423, Berkeley, CA, USA (2008).

9. P. G. J. Barten, “Evaluation of Subjective Image Quality with the Square-Root Integral

Method”, in Jour. of the Opt. Society of America A: Vol. 7, Issue 10, Oct. 1990, pp. 2024-

2031.

10. G. E. Legge and J. M. Foley, “Contrast Masking in Human Vision”, in Jour. of the Opt.

Soc. of America, 1980, pp. 1458-1471.

11. A. Chetouani, G. Mostafaoui and A. Beghdadi, “Predicting blocking effects in the spatial

domain using a learning approach”, in Proc. of SIGMAP 2008, pp. 197-201, Porto, Portugal,

2008.

5 10 15 20 25 30 35 40 45 500

0.5

1

1.5

2

2.5

Quality Factor

Det

ecto

r O

utp

ut

S1 (JND +BEP)

S2 (JND)