Robust Mesh Watermarking Based on Multiresolution Processing

Computers & Graphics 25 (2001) 409–420

Technical Section

Robust mesh watermarking based on multiresolutionprocessing

Kangkang Yina, Zhigeng Pana,b,*, Jiaoying Shia, David Zhangb

aState Key Laboratory of CAD&CG, Zhejiang University, Hangzhou, 310027, People’s Republic of ChinabDepartment of Computing, Hong Kong Polytechnic University, Hung Hom, Kowloon, Hong Kong, People’s Republic of China

Abstract

In this paper we propose a new mesh watermarking scheme for triangle meshes, which are widely used in computer

graphics systems. Arbitrary meshes lack a natural parameterization for frequency-based signal processing, and thusthey are harder to be watermarked. In this paper, we adopt Guskov’s multiresolution signal processing method formeshes and use his 3D non-uniform relaxation operator to construct a Burt–Adelson pyramid for the mesh, and then

watermark information is embedded into a suitable coarser mesh. Since all the computation and data structures are thesame as those used in the multiresolution signal processing, our mesh watermarking algorithm can be integratednaturally with the multiresolution mesh processing toolbox. To detect watermarks, registration and resampling areneeded to bring the attacked mesh model back into its original location, orientation, scale, topology and resolution

level. Experimental results and attack analysis are given to show that our watermarking algorithm is robust under avariety of attacks, including vertex reordering, noise addition, simplification, filtering and enhancement, cropping, etc.Our main contribution to the field of 3D watermarking is that we propose a generic applicable multiresolution

framework in which other proposed techniques may fit in as well. # 2001 Published by Elsevier Science Ltd.

Keywords: Digital watermarking; Mesh watermarking; Multiresolution analysis; Mesh pyramid; Attack analysis

1. Introduction

Digital media data have become very common on theInternet in recent years. Its prevalence creates an urgentneed for appropriate copyright protection schemes in

digitized media. Conventional cryptographic systemspermit only valid key-holders access to encrypted data,but once such data are decrypted there will be no way to

track its reproduction or retransmission. Digital water-marking provides a novel way to achieve effectivecopyright protection [1–3]. Providing digital information

security is attracting more and more attention nowa-days.In this paper we will describe a technique for

watermarking graphics models, which may be used in

Internet-based model shopping systems and collabora-tive design systems.

1.1. Background

Digital watermarking embeds unobtrusive labels indigital content. The label, also called a digital water-mark, is usually imperceptible, but can be extracted or

detected by some computing processes. The digitalcontent can be in various data types, including audio,video, still image, text, graphical data, etc. There aremany methods in which watermark signals are inserted

into a document, including spatial domain approaches,frequency domain approaches, compressed domainapproaches, statistical approaches, and approaches

utilizing human sensory characteristics. The applicationdomains are classified as ownership assertion, traitortracing, authentication and integrity verification, label-

ing and annotation, usage control, and content protec-tion [3]. The robustness requirement of watermarks can

*Corresponding author. Department of Computing, Hong

Kong Polytechnic University, Hung Hom, Kowloon, Hong

Kong, People’s Republic of China.

E-mail address: [email protected] (Z. Pan).

0097-8493/01/$ - see front matter # 2001 Published by Elsevier Science Ltd.

PII: S 0 0 9 7 - 8 4 9 3 ( 0 1 ) 0 0 0 6 5 - 6

vary greatly due to different targetted applications. Inownership assertion or traitor tracing, the more robust

the watermark is, the better, because we would possiblylike to use them as a proof for resolving copywritedisputes. In contrast, we do not care too much about

robustness if the watermarks are used as labels andannotations which just carry some information to theend users.In this paper, we aim at embedding robust water-

marks into 3D meshes, which means the watermarkmust be difficult (hopefully impossible) to remove ordestroy while remaining imperceptible. Acts of removal

can be either unintentional, like common signal proces-sing operations, or intentional, like deliberate andmalicious attacks.

1.2. Mesh watermarking and previous research work

Watermarking provides a mechanism for copyrightprotection of digital media by embedding informationidentifying the owner in the data. The bulk of theresearch on digital watermarking has focused on media

such as image, video, audio and text watermarking [4–6].Research about mesh watermarking began in 1998.Ohbuchi et al. [7] proposed several watermarking

algorithms for polygonal models in, including trianglesimilarity quadruple (TSQ), tetrahedral volume ratio(TVR) and a visible mesh watermarking algorithm.

These algorithms provide many insights into meshwatermarking, but the techniques are not yet robustenough. Benedens et al. [8] subtly altered surfacenormals to embed watermark bits, and the watermark

can survive simplification attacks. Yeung et al. [9]proposed a fragile watermarking algorithm. The mostsuccessful robust mesh watermarking algorithm was

proposed by Praun et al. [10]. They generalized spreadspectrum techniques to surfaces. Firstly, they construct amultiresolution set of scalar basis functions over the

mesh, and then perturb the coordinates of the meshvertices, using the basis functions as weights. Experi-ments show that this algorithm has high robustness, but

it still leaves some space for improvements. Forexample, their scheme is not essentially a multiresolutionone, at least the resolution concept in their contextcannot be shifted directly into multiresolution mesh

processing; the computational cost is high and indepen-dent of mesh processing and editing algorithms.We address the two challenges of mesh watermarking

mentioned in [10] in natural and efficient ways:

(i) Arbitrary meshes lack a natural parameterization

for frequency-based decomposition, and are thusharder to watermark. We adopt Guskov’s relaxa-tion operator [11] to construct Burt–Adelson (B–A)

mesh pyramids, which are multiresolution repre-sentations for meshes. Then we embed the water-

mark into a coarser level of the mesh pyramid,which corresponds to the low-frequency compo-

nents of the original finer mesh.(ii) Various attacks may modify the geometry and

topology of a watermarked mesh. Registration and

resampling are needed to bring the attacked meshmodel back into its original location, orientation,scale, topology and resolution level. Our registra-tion and resampling methods are quite simple yet

effective. More complex methods can be used toenhance the efficiency and accuracy.

The watermarking method proposed in this paper hastwo major advantages: (a) All the computation and datastructures are the same with those used in the multi-

resolution signal processing methods proposed byGuskov, so our mesh watermarking algorithm can beintegrated with his mesh processing toolbox naturally.

(b) Watermarks are inclined to survive when meshmodels are processed by various multiresolution meshprocessing operations, since multiresolution signalprocessing of meshes mainly operates on the high-

frequency components while our watermarks are em-bedded into the low-frequency components. However,this watermarking method is not a blind one, which

means that the watermark detection requires access tothe original mesh data and the original embeddedwatermark.

In Section 2, the mesh watermarking method isdescribed in detail. Sections 3 and 4 present implemen-tation techniques, experimental results and attackanalysis. In Section 5, we draw a conclusion and list

some possible future work.

2. Description of the mesh watermarking algorithm

The basic procedures of our watermarking algorithmare shown in Fig. 1. The upper part of Fig. 1 stands for

the watermark embedding process. The lower part ofFig. 1 stands for the watermark detection process.Building a B–A pyramid for a mesh is a common

component of both watermark embedding and detec-tion. In addition, the registration and resamplingalgorithms are used to prepocess an attacked meshbefore its watermark detection. These techniques are

disscussed in detail in the following subsections.

2.1. Burt–Adelson pyramid construction

The B–A pyramid is a kind of Laplacian pyramidscheme proposed by Burt and Adelson [12]for compactimage coding, and Guskov [11] generalized it to a mesh

pyramid using his 3D non-uniform relaxation operator.We briefly introduce the construction of B–A pyramid

K. Yin et al. / Computers & Graphics 25 (2001) 409–420410

for meshes in the following; more detailed descriptions

can be found in [11,12] or in the appendix.Pyramid algorithms belong to multiresolution analy-

sis. A useful multiresolution approach for meshes is

Hoppe’s progressive mesh (PM) [13]. The PM approachprovides a decimation step by an edge collapse, anupsampling step by a vertex split. Let M ¼ ðP; KÞrepresent a triangular mesh, where P ¼ fpi 2 R3 j14i4Ng is a set of vertices, and pi ¼ ðxi; yi; ziÞ is thecoordinate of a vertex; K contains all the topologicalinformation, which indicates the adjacency relations.

With the PM approach we can obtain a sequenceof meshes Mn ¼ ðPn; KnÞ; 14n4N, where Pn ¼fpi j 14i4ng, together with a sequence of detail records

that indicate how to incrementally refine M0 exactlyback into the original mesh MN . The vertex that isremoved from mesh Pn to get Pn�1 is numbered n.

Different methods can be used to determine the sequenceof edge collapses and the vertex position after an edgecollapse. Garland’s quadric error metric [14] is aneffective priority criterion for edge collapses. Half-edge

collapse, which simply removes one vertex of an edge

while leaving the other vertex position unchanged, is a

simple and efficient way for edge collapses.In the PM setting, we may only change the coordinate

of the vertex which is left after an edge collapse during a

decimation step; while in the B–A pyramid method, theneighborhood vertex coordinates with subdivision con-nectivity to the vertex involved in the edge collapse can

also be changed. The specific procedures for construct-ing a B–A pyramid are shown in Fig. 2. To construct asequence of meshes Mn ¼ ðSn; KnÞ; 14n4N, we startfrom the original mesh SN . There are four stages in

obtaining Sðn�1Þ from SðnÞ: presmoothing, downsam-pling, subdivision and computation of details.In Fig. 2, sðnÞ denotes the vertex coordinates in SðnÞ,

the new coordinates of the remaining vertices aftersubdivision are denoted as qðnÞ, and the differencesbetween two mesh levels, i.e., the details, are denoted as

d ðnÞ. In presmoothing and subdivision procedures, arelaxation operator proposed by Guskov [11] is used.Half-edge collapse is adopted in the downsamplingsteps. More detailed description can be found in the

appendix.

Fig. 1. Watermarking procedures.

Fig. 2. Burt–Adelson style pyramid scheme.

K. Yin et al. / Computers & Graphics 25 (2001) 409–420 411

Starting from the upper level or coarser level in the B–A mesh pyramid, we can reconstruct the lower level or

finer level meshes: use sðn�1Þ, subdivide values qðnÞ, add inthe details d ðnÞ, and then get the recovered originalvaluessðnÞ.

In pyramid construction, we need to record someuseful information which is to be used in pyramidreconstruction, multiresolution signal processing orwatermark extraction. The information recorded in-

cludes: downsampling vertex sequence {n}, weight valuesequence {wðnÞ} of relaxation operators (see the appen-dix), and detail sequence {dðnÞ}.

From the above procedures of pyramid construction,we can see that the upper coarser mesh can be viewed asthe low-frequency components of the lower finer mesh.

From the viewpoint of signal processing, the vertices inthe coarser mesh are the downsamples of the vertices inthe finer mesh, and thus correspond to the low-

frequency components which retain the most importantfeatures of the original mesh while discarding the detailinformation. Compared with the image watermarkingalgorithms that embed watermarks into the low-

frequency components of static images [5], we canembed watermarks into the coarser mesh. This is theprimary difference between our algorithm and the

algorithm presented by Praun et al. [10], who foundthose half-edge collapses which cause the largestgeometric changes during the PM construction, and

the vertices in those half-edge collapses correspond tolow-frequency components. In our scheme, we find thelow frequency components through pyramid construc-tion. It resembles a low-pass filter for images, and

conceptually it is easier to understand.

2.2. Watermark embedding

Praun et al. [10] adopted 50 real numbers as awatermark vector, sampled from a Gaussian distribu-

tion with zero mean and variance 1, i.e., Nð0; 1Þ.Instead, we use wk 2 f�1; 1g; k ¼ 1; . . . ; m; as ourwatermark signal. It is a binary sequence, so it can bemapped directly to a {0, 1} bit stream. This enables the

embedding of watermarks with real meaning, such ascopyright text or a small logo image.The watermark is inserted as follows (refer to Fig. 1):

1. Construct a B–A pyramid for the original mesh Mo,select a suitable level of coarser mesh mo as the object

of watermarking.2. Choose m=3

� �vertices {pi fi ¼ 1; . . . ; m=3

� �g from

mo. Calculate the minimal length of pi’s 1-ring edge

neighborhood by lmi ¼ minflengthðeÞ j e 2 e1ðiÞg(seethe appendix for neighborhood definitions). Then wecan represent the insertion process as three equations:

p0ix ¼ pix þ wkalmi; ð1Þ

p0iy ¼ piy þ wkþ1almi; ð2Þ

p0iz ¼ piz þ wkþ2almi ; ð3Þ

where pix is the x coordinate of vertex pi, p0ix thewatermarked x coordinate, and other symbols

have similar meanings. a is the strengthcoefficient, which controls the energy of the em-bedded watermark signal. lmi is the parameter

controlling the local watermarking strength; itensures that the watermark strength adapts to thelocal feature of the mesh. The watermarked coarser

mesh is denoted as mw.In practice, we give a threshold T , and only embedwatermark into vertices whose lmi > T . It can

eliminate weak watermark information and ensurethe robustness. The higher T is, the shorter theembedded watermark is. The vertices pi can bechosen either randomly or key-dependently, but they

should approximately uniformly scatter on the wholemodel so the robustness to crop attacks can beensured. In our experiments given in Section 4, we

choose pi randomly for simplicity. To enforceuniform distribution, once we have selected a vertexfor watermarking, we do not allow its 1-ring vertex

neighbourhood to be watermarked anymore.

3. Reconstruct the watermarked finer mesh Mw from

mw, using pyramid reconstruction algorithm.

2.3. Watermark detection

Our watermark detection algorithm has two steps.The first is watermark extraction, in which we need to

access the original mesh data. Given a mesh Mt, theextraction algorithm extracts the watermark signalpossibly embedded in the mesh. The second is thecorrelation test, in which we need to access the original

embedded watermark. Then we can decide whethermesh Mt contains this designated watermark bycomparing it with the extracted watermark. Typically,

the decision is made by the people who hold the originalmesh data, i.e., who watermarked the mesh.Based on the above watermark insertion algorithm,

our watermark detection algorithm is as follows (refer toFig. 1). We construct the B–A pyramid forMt, using thepyramid information of the original mesh Mo. Then we

take the coarser mesh mt that is of the same resolution asmo, and extract the watermark:

wnk ¼ signðp0ix � pixÞ; ð4Þ

wnkþ1 ¼ signðp0iy � piyÞ; ð5Þ

wnkþ2 ¼ signðp

0

iz � pizÞ; ð6Þ


where p0i is the vertex in mt, pi the vertex in mo, and sign afunction that returns the sign of its parameter.

If the watermarked mesh undergoes some processingor attacks, the extracted watermark may not be exactlythe same with the embedded watermark. So we need to

define a criterion by which we can decide whether thedesignated watermark is present in the mesh. We employlinear correlation [15,10] between the extracted water-mark and the designated watermark as our decision

criterion:

corrðwn; wÞ ¼Pm

i¼1 ðwni � wnÞðwi � %wÞffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiPm

i¼1 ðwni � wnÞ2

q ffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiPmi¼1 ðwi � %wÞ2

q ; ð7Þ

where wn is the extracted watermark, w the designatedwatermark, %w the mean of vector w, wn the mean ofvector wn, and m the vector length. The value of corr lies

in [�1, 1]. If corr equals 1, it means the two vectores arecompletely positively correlated, which in our case ofbinary sequences means the two watermarks are the

same. A value of corr near zero indicates that the vectorsare uncorrelated. So if the computed correlation exceedsa deliberately chosen threshold, we conclude that thedesignated watermark w is present in the mesh. Since the

extracted watermark from an unwatermarked or differ-ently watermarked mesh is highly impossible to correlatewith the designated watermark and can be viewed as a

random sequence, the computed correlation tends to below (see Section 4.1).

2.4. Registration

Similarity transforms, including translation, rotationand uniform scale, are often applied to a 3D model when

it is employed within a graphical scene. Often, wetransform an object during rendering while leaving theobject geometry unaltered. Yet an attacker might

change the vertex coordinates directly, which putsforward the necessity to bring the object back to itsoriginal location, orientation and scale}a process called

object registration}before watermark extraction.Our registration algorithm is quite simple. Seven

degrees of freedom are allowed: translation, rotation

and uniform scaling of the mesh. The registration isalways performed between the attacked mesh and theoriginal unwatermarked mesh, for registration with thewatermarked mesh will falsely introduce the watermark

information and increase the false positive possibility.We denote the mesh to be registered as Mt, the originalmesh as Mo. The registration procedure is as follows:

Step 1. Provide an initial transformation between the

two meshes. This is done by users from theGraphical User Interface (GUI) provided by theunderlying system. The approximately regis-tered Mt is denoted as Mr.

Step 2. Uniformly choose a subset of verticesvri; ði ¼ 1 ; . . . ; kÞ from Mr.

Step 3. Define an energy function:E ¼Pk

i¼1 Edist

ðvri; voiÞ, where voi is the nearest vertex of vriin Mo. Edist measures the distances between the

meshes, it is the sum of the squared distancesbetween the corresponding vertex pairs. Wethen use the Powell method [15] to minimize theenergy function E. After this minimization

process, Mr is used as the registered version ofmesh Mt.

This registration algorithm requires a reasonableinitial condition and is somewhat low in efficiency.More complex registration algorithms can be employed

to enhance the efficiency, such as the algorithm proposedby Chen et al. [16].

2.5. Resampling

When a watermarked mesh undergoes some attackslike simplification, vertex reordering or cropping, the

topology of the mesh will be changed and we cannotextract the watermark directly using our watermarkdetection algorithm. Therefore we need first to resample

the attacked mesh to obtain a mesh with the topology ofthe original mesh but retain the geometry of the attackedmesh. We denote the mesh to be resampled as Ms, the

original mesh as Mo. The resampling procedure is asfollows:

Step 1. For every vertex in Ms, find its nearest vertex

in Mo. If their Euclidean distance is less than agiven threshold, mark them as a matchedvertex pair.

Step 2. Project every unmatched vertex in Mo onto itsnearest plane in Ms, mark the vertex and itsprojection as a vertex pair.

Step 3. Connect the matched vertices and the pro-jected vertices in Ms, using the adjacencyinformation in Mo. The resulting mesh is

denoted as Mr.Step 4. Define an energy function E ¼Pn

i¼1 ðEdistðvri; voiÞ þ cdEdeformðvri; voiÞÞ, wherevri is a vertex in Mr, voi is its corresponding

vertex in Mo. Edist measures the distancesbetween the meshes, it is the sum of thesquared distances between the corresponding

vertex pairs. Edeform measures the deformationof the resampled mesh. Each edge in the meshis viewed as a spring, with rest length equal to

its corresponding edge length in Mo. Then thedeformation Edeform can be measured by thepotential energy of the springs. cd is a weight

factor, which is equal to 10�3 in our imple-mentation. We then use a conjugate gradient


method [15] to minimize the energy function E,which represents the energy difference between

Mr and Mo. After minimization process, Mr isused as the resampled version of mesh Ms.

It should be noted that in the matched vertexpairs found out in Step 1, when the distance of thevertex pair is less than a given threshold, we neglect thisvertex pair in our energy-minimization process. The

reason is that these vertices contain the watermarkinformation.More complex resampling algorithms can be em-

ployed to enhance the accuracy, such as the algorithmused by Praun et al. [10,17].

3. Implementation of a mesh watermarking system

Based on the watermarking algorithm describedabove, we implemented an experimental mesh water-marking system in MSVC++6.0 on a PII 350 machine.

The interface is shown in Fig. 3. The left sub window isfor mesh rendering. Users can view and transform themodel interactively here. The right subwindow is for

commands and parameter settings. It contains fourgroup boxes: ‘‘Pyramid’’ is for B–A pyramid building

and half-edge simplification; ‘‘Watermark’’ is for water-mark embedding and detection; ‘‘Attacks’’ is for

applying various mesh attacks; ‘‘RegandRes’’ is forperforming necessary registration or resampling opera-tions. Generally speaking, buttons correspond to com-

mands or operations and edit boxes are in charge ofparameter settings.The watermark length, strength and threshold T

(threshold of lmi in Eqs. (1)–(3)) can be controlled by

users. T depends on both the original size of the meshmodel and the chosen mesh pyramid level (adjustable by‘‘lower bound’’ and ‘‘upper bound’’ edit boxes) into

which we plan to insert the watermark. The larger the Tis, the smaller the number of watermark bits that can beembedded into a certain resolution level of a given

model. If T is so large that the designated watermarklength cannot be granted, then we only embed as manybits as possible and return the length of the watermark

actually embedded. The watermark strength is con-trolled by strength coefficient a in Eqs. (1)–(3). When aexceeds some threshold, the watermark will becomeperceivable.

In our experiments, a watermark of 250 bits isembedded into a Head model and a watermarkof 300 bits is embedded into a Bunny model.

These watermark lengths are longer than Praun’s

Fig. 3. Interface of the watermarking system.


watermark length of 50 coefficients [10]. The resultingwatermarked models are denoted as Headwm andBunnywm as shown in Fig. 4. We set a ¼ 0:08 and T ¼0:03 in both cases. Similar parameter settings are also

used in the following attack analysis. Human visionscannot distinguish the original and the watermarkedmodels, which implies that this watermarking algorithm

is transparent. Later attack analysis will show that it isrobust too. Similar results have been obtained when thewatermarking and various attacks are applied to other

models.

4. Experimental results and attack analysis

4.1. Threshold setting

To perform watermark detection, we should firstchoose a suitable correlation threshold for correlation

test. Then we can assert a watermark’s presence bycomparing this threshold and the correlation valuecomputed from Eq. (7). Since our watermark can be

any binary sequence and possesses no distinctiveprobability distribution, there is no universal way tocompute a suitable threshold mathematically in the case

of the null hypothesis. Therefore, just as what is usuallydone in the watermarking literature [5], we adopt anexperimental method to choose a threshold. The nature

of such experiment is the Monte-Carlo method oftenused in the probability theory.In doing this, 10,000 randomly generated watermark

vectors of length k � 50 ðk ¼ 1; . . . ; 9Þ are correlated

with the designated watermarks of the same length, andthe experiment is run 10 times with different sets ofdesignated watermarks. We plot the mean of the mean

correlation values, the maximum of the maximalcorrelation values and the correlation values of thedesignated watermarks with themselves in Fig. 5. This

figure can guide us to choose a suitable thresholdfor a given watermark length. For example,

when the watermark length is 250 bits, the maximalcorrelation between a randomly generated watermarkand the designated watermark is very probablybelow 0.3. So we can set the correlation threshold to

0.3. In order to decrease the possibility of falsepositive, we can increase the threshold further, but thepossibility of false negative will rise as a result. Here

false positive means asserting incorrectly that a docu-ment is watermarked when it is not, false negative meansfailing to detect a watermarked document. Usually, a

compromise favoring a lower false positive rate needs tobe achieved.After some mesh attacks, the embedded watermark

will be partly damaged, so its correlation with the

original watermark will be less than 1. However, if ourwatermark algorithm is roboust enough and can resistattacks to some extent, the extracted watermark should

be more ‘‘close’’ to the original watermark than arandom watermark, i.e., the correlation is larger thanthe threshold we choose from the random watermark

correlation test. So when the detected watermark has astronger correlation with the embedded watermark, it isgenerally sound to conclude that the mesh contains the

designated watermark. Although, of course, falsepositives and negatives do exist due to the probabilisticnature of the watermark detection method. In Section4.2, we will see that the detector results degrade

gracefully after various attacks, which shows thiswatermark algorithm is robust.

4.2. Attack analysis

The watermark detection results for a variety ofattacked Head models are listed in Table 1, and some ofthe attacked meshes are shown in Fig. 6. Since the

watermarking process and some of the attacks dependon random numbers or processes, there is variability inthe results. We therefore perform each test five times on

Head models with different watermarks embedded indifferent locations, and report the mean value.

Fig. 4. Original model and watermarked model.


If registration (denoted as Reg in Table 1) orresampling (denoted as Res in Table 1) needs to be

performed between the attacked mesh and the originalmesh before the watermark detection, then we put a ! in

the corresponding row. In the Corr column, thecorrelation values computed by Eq. (7) are listed.

To demonstrate the resilience of the watermark undernoise addition, we add a noise vector to each vertex. The

Fig. 5. Correlation threshold setting.

Table 1

Attack analysis of mesh watermarking

Attack Reg Res Attack parameters and descriptions Corr

Vertex reorder ! Shuffle vertex number randomly 0.7856

Noise addition Uniform noise amplitude is 0.45% of the largest dimension of the object 0.5184

Multiple water-marking

Type A Embed a first watermark of 250 bits, a second watermark of 350 bits

Detect the first watermark 0.7504

Detect the second watermark 0.7844

Type B Embed a first watermark of 250 bits, a second watermark of 250 bits

Detect the first watermark 0.5600

Detect the second watermark 0.7440

Simplification

Type A ! Half-edge collapse simplification, remove 7/8 vertices, 847 vertices left 0.6656

Type B ! Merge near-coplanar faces simplification [18], M3 level, 1555 vertices

left on average

0.5600

Multiresolution filtering Set the details of level 12695n46769 in the mesh pyramid to 0 0.6464

Multiresolution enhancement Multiply the details of level 12695n46769 in the mesh pyramid by 2 0.6258

Single resolution filtering 15 relaxation steps 0.6752

Single resolution enhancement Multiply all details by 2 after 15 relaxation steps 0.7264

Cropping ! 1077 vertices cropped on average 0.6512

Similarity transform ! Users input transformations randomly from the GUI 0.7792

Combined attacks ! ! Second watermarking, vertex reorder, simplification, noise addition,

single resolution filtering, cropping and similarity transform

0.4256


amplitude of the noise vector is 0.45% of the largestdimension of the object. Although the resulting mesh

model suffers from severe quality degradation, thecorrelation is still high above the threshold.For multiple watermarking, we add a second water-

mark to the watermarked model. In type A, we embed a

second watermark of 350 bits with a ¼ 0:04 into adifferent resolution coarser mesh. In type B, we embed asecond watermark of 250 bits with a ¼ 0:08 into the

same resolution coarser mesh. Both can pass watermarkdetection.We adopt two different simplification algorithms to

test the watermark robustness to simplification attacks.

Type A simplification is simply half-edge collapses usingGarland’s quadric error metric [14] as the priority

criterion; 7/8 vertices are removed. Type B simplificationis based on merging near-coplanar faces [18], whichencompasses merging faces and retriangulations. Thethird level of detail M3 of the watermarked mesh is used

for watermark detection. Both simplification methodscannot destroy the watermark embedded in the originalmeshes.

Multiresolution filtering and enhancement are typicaloperations in Guskov’s multiresolution processing tool-box for meshes [11]. We operate on the detail coefficients

in the range of 12695n46769, i.e., the first 5500 detail

Fig. 6. Attacked models.


coefficients in the B–A pyramid. When multiplying thesedetail coefficients by a value k, 04k51, multiresolution

filtering is achieved. If k > 1, multiresolution enhance-ment is achieved. In our experiments, we set detailcoefficients to zero when filtering, multiply them by 2

when enhancing. Single resolution filtering is achievedby using Guskov’s relaxation operator on all verticessimultaneously. In our tests we run the relaxationoperator 15 times. By multiplying the differences

between the original mesh and the single resolutionrelaxed mesh by 2, we get the single resolution enhancedmesh. Our watermarks can survive all these processes.

Five crop attacks are applied, in which we discardseparately all vertices in the top, bottom, front, back andleft fourth of the object’s bounding box. On average,

1077 vertices are deleted. The watermark information inthe cropped meshes is still strong enough for detection.Around half of the vertices can be removed before the

correlation value drops down to the threshold.Similarity transformations are performed from the

user interface of the experimental watermarking system.One of them is shown in Fig. 6.

Finally, combined attacks in the last row of Table 1include: second watermarking, vertex reordering, simpli-fication, noise addition, single resolution filtering, crop-

ping and similarity transform. In the five tests, theamplitude of noise is 0.2% of the largest dimension of themesh. Single resolution filtering runs the relaxation step

once. On average, 2630 vertices are left after simplifica-tion and cropping. Both types of multiple watermarkingare tried. Vertex reorder and similarity transform aredone randomly, either by the watermarking system or by

the end users. As can be seen, the watermarks are stilldetectable in the meshes after the series of attacks.The experimental results show that our watermarking

algorithm is robust under a variety of signal processing,including vertex reordering, noise addition, multiplewatermarking, mesh simplification, multiresolution fil-

tering and enhancement, single resolution filtering andenhancement, cropping, similarity transform and com-bination of the above attacks.

5. Conclusion and future work

Our watermarking algorithm has proven to be robustagainst a wide variety of attacks, including noise

addition, multiple watermarking, simplification, filter-ing, enhancement, cropping, similarity transforms andcombined attacks. Under the same level and kind of

attacks, the robustness of our algorithm is comparableto the algorithm presented by Praun et al. [10]. Also, ourwatermarking can resist some multiresolution proces-

sing attacks which Praun et al. did not test. Higherrobustness can be achieved by increasing the watermark

strength coefficient. Furthermore, our watermarkingalgorithm has the following characteristics:

(1) The watermark signal is embedded into the low-

frequency components of a mesh, as in manywatermarking algorithms for static images[5,19,20]. Most mesh processing and attacks manip-ulate the high-frequency components of a mesh.

After all, it is the low-frequency components thatdetermine the main features of the mesh. So low-frequency components become the natural host for

watermarks.(2) The algorithm can be naturally integrated with

Guskov’s multiresolution signal processing toolbox

for meshes, hence no extra computation and datastructures are needed. Another gain is, whenprocessed by the mesh toolbox, the watermark can

be well retained. We believe any robust water-marking scheme requires (to be integrated in) somekind of multiresolution framework, otherwisewatermarks will not be robust against standard

signal processing operations.(3) The registration and resampling algorithms are

simple yet effective, which enable the watermark

detection of an attacked mesh whose geometry andtopology have been changed.

(4) The watermark signal is a binary sequence, which

enables the embedding of watermarks with realmeaning.

Future work may include the following aspects:

* To apply other kinds of attacks and test possiblefailures of our algorithms. It is feasible to extend our

registration method to undo general affine transfor-mations, although it can only undo similaritytransformations at present. But to remove complex

non-linear/non-affine transformations is problematic,even with user assistance.

* To build a statistical model to choose the suitable

threshold for the correlation detector to satisfycertain false positive and negtive requirements. Forempirical claims would not work in copyright

disputes. The possible method could be either toconvert to another correlation detector, or to exertsome sort of probability constraints on the embeddedwatermarks so as to have some hypothesis in

developing a statistical model.* To change our watermarking algorithm into a blind

watermarking algorithm. As we can see, our water-

mark extraction requires access to the original meshdata. While in a blind watermarking algorithm, theoriginal mesh is not needed in the watermark

detection process. It will not only facilitate water-mark detection (registration and resampling are not


needed anymore), but also enhance the security of theoriginal data. What’s more, in blind watermarking,

the advantage of our long binary watermarks overshort real number watermarks will become obvious,since we can provide readable ownership assertion to

the end users directly. The biggest hurdle to revise 3Dwatermarking to blind watermarking still lies in thefact that 3D models lack a natural parametrizationfor frequency-based decomposition. We have to

invent a multiresolution signal analysis method formeshes, which leaves the low-frequency componentsgenerally unaffected by resampling, transformation

and noise addition, etc. The multiresolution meshprocessing method presented by Guskov et al. [11]cannot guarantee a stable coarser mesh after such

processing and attacks, so we have to resort to theoriginal mesh data for frequency information. Onepossible frequency decomposition technique we are

considering is to exert some constraints in pyramidconstruction to get a ‘‘regular’’ coarser mesh, say byrequiring one vertex in each volumetric cubicelement. This vertex may correspond to the center

of gravity of all the surfaces in the finer meshenclosed in a cubic element. Such low-frequencycomponents should be somewhat stable so we can

apply many blind watermarking schemes proposed inthe image watermarking literature [19,20,21] toaddress blind watermarking for 3D meshes.

* To integrate various watermarking algorithms fordifferent media types, including text, images, audio,video, and 3D models. The integrated watermarkingmethod can find applications in virtual environments.

Acknowledgements

This research work is supported by the NationalNatural Science Foundation of China. We would like tothank Dr. Weiqun Cao and Dr. Xingguo Liu for theirvaluable discussions and supports, and Dr. Jim Little for

his review and editing. We would also like to give ourspecial thanks to the anonymous reviewers for theirvaluable comments and suggestions.

Appendix. Relaxation operators and Burt–Adelson pyramid

Most of the content of this appendix is derived from

[11], in which Guskov generalized the Burt–Adelsonpyramid scheme to a mesh pyramid using his 3D non-uniform relaxation operator. We hope this will facilitatethe understandings of our method.

(1) Some definitions. First we define some notationsfor triangular meshes and topological neighborhood.Let M ¼ ðP; KÞ represent a triangular mesh, where P ¼fpi 2 R3 j 14i4Ng is a set of vertices, and pi ¼ ðxi; yi;ziÞ is the coordinate of a vertex; K contains all thetopological information, which indicates the adjacency

relations.Given a vertex i, an edge e, V1ðiÞ denotes i’s 1-ring

vertex neighborhood, e1ðiÞ denotes i’s 1-ring edgeneighborhood, V2ðiÞ denotes i’s 1-ring vertex neighbor-

hood with flaps, e2ðiÞ denotes i’s 1-ring edge neighbor-hood with flaps, and wðeÞ denotes e’s vertexneighborhood. In Fig. 7, gray vertices constitute vertex

neighborhoods, and bold edges constitute edge neigh-borhood.(2) Relaxation operators. Guskov et al. [11] presented

a 3D relaxation operator for meshes:

Rpi ¼Xj2V2ðiÞ

wi; jpj ; ðA:1Þ

where wi;j is computed as

wi; j ¼ �

Pfe2e2ðiÞjj2wðeÞg ce; ice; jP

e2e2ðiÞ c2e; i

: ðA:2Þ

Fig. 7. Neighborhood definitions.

Fig. 8. Computing ce; jði ¼ fj; k; l1; l2gÞ.


According to the adjacency relations in Fig. 8, thecoefficients ce;i are calculated in one of the four ways:

ce; l1 ¼Le

A½l1 ; k; j ; ce; l2 ¼

Le

A½l2 ; j; k ;

ce; j ¼ �LeA½k; l2 ; l1

A½l2 ; k; j A½l2 ; j; k ; ce;k ¼ �

LeA½j; l1 ; l2

A½l2 ; k; j A½l2 ; j; k ; ðA:3Þ

where Le is the length of the common edge e (the boldedge in Fig. 8), A represents the signed area of thetriangle formed by corresponding subscript vertices, and

A½k; l2 ; l1 and A½j; l1 ; l2 are the triangle areas after 4kl2l1and 4jl1l2 are rotated into one plane, using the commonedge e as a hinge.

(3) The Burt–Adelson pyramid and its construction.The Burt–Adelson (B–A) pyramid is a kind of Laplacianpyramid scheme proposed by Burt and Adelson for

compact image coding [12]. It is generalized into a meshpyramid using the above relaxation operator in [11].According to Fig. 2 (in the main text), the following

stages are needed to obtain Sðn�1Þ from SðnÞ:(a) Presmoothing: Compute the new coordinates for

n’s 1-ring vertex neighborhood,

8j 2 Vn1 ðnÞ : s

ðn�1Þj ¼

Xk2vn

2ð jÞ

wðnÞj;ks

ðnÞk ; ðA:4Þ

Other vertex coordinates pass from SðnÞ to Sðn�1Þ

unchanged.

8j 2 Vn�1\Vn1 ðnÞ : sðn�1Þj ¼ sðnÞj : ðA:5Þ

(b) Downsampling: Remove vertex n by a half-edgecollapse.(c) Subdivision: Use the coordinates in Sðn�1Þ to

compute subdivided coordinates qðnÞj for the vertices

whose positions have been changed. The coordinates ofvertex n just removed can be evaluated as

qðnÞn ¼X

j2Vn2ð jÞ

wðnÞn;j s

ðn�1Þj : ðA:6Þ

The coordinates of n’s 1-ring vertex neighborhood can

be evaluated as

8j 2 Vn1 ðnÞ : qðnÞj ¼

Xk2Vn

2ðjÞ\fng

wðnÞj;ks

ðn�1Þk þ wðnÞ

j;nqðnÞn : ðA:7Þ

(d) Detail computation: Compute the details for vertex

n and its 1-ring vertex neighborhood in a local frameF ðn�1Þ:

8j 2 Vn1 ðnÞ [ fng : d

ðnÞj ¼ F

ðn�1Þj ðsðnÞj � q

ðnÞj Þ: ðA:8Þ

References

[1] Anderson RJ, editor. Information Hiding: First Interna-

tional Workshop, Lecture Notes in Computer Science, vol.

1174, Berlin: Springer, May 1996.

[2] Jian Zhao, Koch E, Chenghui Luo. In business today and

tomorrow. Communications of the ACM 1998;41(7):67–72.

[3] Memon N, Ping Wah Wong. Protecting digital media

content. Communications of the ACM 1998;41(7):35–43.

[4] Bender W, Gruhl D, Morimoto N. Techniques for data

hiding. IBM Systems Journal 1996;35(3&4):313–35.

[5] Cox IJ, Kilian J, Leighton T, Shamoon T. Secure spread

spectrum watermarking for multimedia. IEEE Transac-

tions on Image Processing 1997;6(12):1673–87.

[6] Hartung F, Kutter M. Multimedia watarmarking techni-

ques. Proceedings of the IEEE 1999;87(7):1079–1107.

[7] Ohbuchi R, Masuda H, Aono M. Watermarking three-

dimensional polygonal models through geometric and

topological modifications. IEEE Journal on Selected Areas

in Communications 1998;16(4):551–60.

[8] Benedens O. Geometry-based watermarking of 3D

models. IEEE Computer Graphics and Applications

1999:46–55.

[9] Minerva Yeung, Boon-Lock Yeo. Fragile watermarking of

three-dimensional objects. Proceedings of International

Conference on Image Processing, vol. 2. Los Angeles:

IEEE Computer Society, 1998. p. 442–6.

[10] Praun E, Hoppe H, Finkelstein A. Robust mesh water-

marking. SIGGRAPH’99 Proceedings. New York: ACM

Press, 1999. p. 49–56.

[11] Guskov I, Sweldensy W, Schroder P. Multiresolution

signal processing for meshes. SIGGRAPH’99 Proceedings.

New York: ACM Press, 1999. p. 325–334.

[12] Burt PJ, Adelson EH. Laplacian pyramid as a compact

image code. IEEE Transactions on Communications

1983;31(4):532–40.

[13] Hoppe H. Progressive meshes. SIGGRAPH’96 Proceed-

ings. New York: ACM Press, 1996. p. 99–108.

[14] Garland M, Heckbert PS. Surface simplification using

quadric error metrics. SIGGRAPH’97 Proceedings, New

York: ACM Press, 1997. p. 119–128.

[15] Press WH, Teulkolsky SA, Vetterling WT, Flannery BP.

Numerical recipes in C, 2nd ed. London: Cambridge

University Press, 1996.

[16] Chen Y, Medioni G. Object modeling by registration of

multiple range images. Image and Vision Computing

1992;10(3):145–55.

[17] Maillot J, Yahia J, Verroust A. Interactive texture

mapping. SIGGRAPH’93 Proceedings. New York: ACM

Press, 1993. p. 27–34.

[18] Weiqun Cao, Hujun Bao, Qunsheng Peng. A level of detail

modeling by merging near-coplanar faces based on Gauss

sphere. Journal of Software, in press [in Chinese].

[19] Fridrich J, 2 Lt Baldoza AC, Simard RJ. Robust digital

watermarking based on key-dependent basis functions.

Proceedings of the International Information Hiding

Workshop, April 1998. p. 143–57.

[20] Piva A, Barni M, Bartolini F, Cappellini V. DCT-based

watermark recovering without resorting to the

uncorrupted original image. International Conference on

Image Processing (ICIP’97), IEEE Signal Processing

Society, Santa Barbara, CA, vol. I, October 1997. p.

520–23.

[21] Ruanaidh J’O, Pun T. Rotation, translation and scale

invariant digital image watermarking. 1997 International

Conference on Image Processing (ICIP’97), IEEE Signal

Processing Society, Santa Barbara, CA, vol. I, October

1997. p. 536–39.


Robust Mesh Watermarking Based on Multiresolution Processing

Documents

Transcript of Robust Mesh Watermarking Based on Multiresolution Processing