Transform domain image watermarking method and system

[0001] The invention relates to digital image watermarking methods and systems and more particularly a method and apparatus for watermarking digital images and authenticating watermarked digital images in the frequency domain.

[0002] The popularity and proliferation of digitized images has resulted in a dramatic increase in image distribution over vast areas. Digitized images comprise formatted digital data conveniently storable in digital form with mass memories, floppy diskettes, or in hard copy form as an image printout. Much of the distribution of digitized images relies upon digital networks such as Local Area Networks (LANs) and the Internet which enable swift and relatively unchecked uploading and downloading of image data between computer systems over vast transmission paths. While legitimate widespread dissemination of a protectable digital image typically benefits the image owner, illegitimate and unauthorized reproduction and distribution often damages the proprietary value of the image.

[0003] To combat the problem of illicit reproduction and dissemination of protected digitized images, a number of methods and devices for embedding detectable tags or watermarks into such images have been devised to track unauthorized secondary distribution. One method, disclosed by O'Gorman in U.S. patent application Ser. No. ______, filed Jun. 20, 1994, entitled Watermarks for Security and Authetication of Digital Pictures and assigned to the assignee of the present invention, proposes embedding watermarks in the spatial domain of the image data by slightly enhancing or depressing the image grey levels. Although this method works well for its intended purposes, the watermark is substantially non-holographic in that it becomes degraded and in some instances undetectable under circumstances where the image is cropped or compressed by a suitable compression algorithm.

[0004] A second proposal by Cox et. al. allegedly addresses the above shortcomings by watermarking the image data in the frequency domain. The procedure involves randomly choosing a set of unique frequency components to encode a pseudo-random (noise-like) watermark vector. The watermark may then be later recovered or detected by a correlation procedure. The frequency components chosen are perceptibly significant, residing in the low frequency range, to ensure that the relevant information will not be lost due to cropping or compression.

[0005] While the Cox proposal appears beneficial for its designed applications, the pseudo-random noise-like watermark is incapable of directly carrying the watermarking information. Moreover, in order to detect or recover the watermark, a correlation search must be carried out in order to compare the data to all other watermarks. This presents a somewhat complicated and calculation heavy method, requiring substantial computing resources.

[0006] Therefore, a need exists for a method and system for watermarking and authenticating a watermarked image such that the watermark is capable of surviving cropping and compression of the image data. Moreover, the need exists for such a method and system to provide a watermark capable of directly carrying the bits of watermarking information. Additionally, the need exists for such a system and method to provide watermark recovery through straightforward procedures. The method and apparatus of the present invention satisfies these needs.

[0007] Image authentication according to the present invention is effected by using watermarks that are imperceptible and have the ability to directly carry information. The watermarks are distinguishable from one or more differently tagged copies of the image and are easily recovered from a tagged image and the original image. As a durable security feature, attempts to remove the watermarks have noticeable ill-effects on the image. Additionally, image modification and compression algorithms have a relatively minor effect on the tags. Also important is the image cropping survival capability realized through distribution of the watermark in the image plane.

[0008] To realize the above features and advantages, the present invention, in one form, comprises a method of robust digital image watermarking for embedding a predetermined bit sequence into a digital image. The method includes the steps of transforming the digital image into frequency domain data signals, including respective magnitude and phase data signal components. The next step involves determining a set of contiguous region(s) in the frequency domain and then embedding the predetermined bit sequence directly into the image frequency domain data signals by mapping bits to well-defined regions in the frequency domain.

[0009] In yet another form, the present invention includes a method of recovering a watermark from a tagged digitized image comprising a reproduction of an original image. The respective images comprise spatial domain datasets. The method includes the steps of first transforming the spatial domain data comprising the respective images into respective frequency domain datasets, then comparing the respective frequency domain datasets to identify the watermark and verify the authenticity of the image reproduction.

[0010] A further form of the invention comprises a watermark recovery apparatus for authenticating a tagged digitized image comprising a reproduction of an original image. The respective images comprise spatial domain datasets. The apparatus includes a transformer for transforming the spatial domain data comprising the respective images into respective frequency domain datasets; and a comparator responsive to the transformer for comparing the respective frequency domain datasets to identify the watermark and verify the authenticity of the image reproduction.

[0011] Yet another form of the invention comprises a digitized image authentication system for implanting and detecting watermark information in a digitized image. The digitized image comprises spatial domain data and is reproduced from an original image. The system includes a watermarking apparatus for tagging the digitized image. The apparatus includes a transformer for transforming the spatial domain data into frequency domain data, including respective magnitude and phase data components. A processor is disposed at the output of the transformer and is operative to embed information into the magnitude data to develop modified data. A converter responsive to the processor converts the modified data from the frequency domain to the spatial domain to generate the watermarked digitized image. The system further includes a watermark recovery apparatus for authenticating the tagged digitized image. The recovery apparatus includes a transformer for transforming the spatial domain data comprising the respective images into respective frequency domain datasets. A comparator is responsive to the transformer for comparing the respective frequency domain datasets to identify the watermark and verify the authenticity of the image reproduction.

[0012] Other features and advantages of the present invention will be apparent from the following detailed description when read in conjunction with the accompanying drawings, wherein:

[0013] FIG. 1 is a block diagram of a digital image authentication system according to one embodiment of the present invention;

[0014] FIG. 2 is a graphical representation of a watermark mask according to one embodiment of the present invention;

[0015] FIG. 3 is a block diagram illustrating steps involved in the watermarking method of the present invention;

[0016] FIG. 4 is a graphical depiction of a watermark pattern according to one embodiment of the present invention;

[0017] FIG. 5 is a block diagram illustrating steps implemented in one embodiment of the watermark recovery method of the present invention;

[0018] FIGS. 6-8 are block diagrams illustrating steps included in alternative embodiments of the watermark recovery method of the present invention;

[0019] FIGS. 9(a)-9(i) illustrate original images and corresponding watermarked images and watermarks;

[0020] FIGS. 10(a)-10(d) illustrate image data results for a Botticelli digital image watermarked at various intensities;

[0021] FIGS. 11(a)-11(d) illustrates image data results for a Michelangelo digital image watermarked at various intensities;

[0022] FIGS. 12(a)-12(d) illustrates image data results for a Renoir digital image watermarked at various intensities;

[0023] FIGS. 13(a)-13(i) show respective cropped portions of the watermarked images of FIGS. 10-12, the corresponding average value watermarks, and the respective error locations for the watermarks;

[0024] FIGS. 14(a)-14(d) illustrate watermarked images after a 20% quality JPEG compression;

[0025] FIGS. 15(a)-15(i) show results for images after a 20% quality JPEG compression and the respective recovered watermarks and corresponding error locations;

[0026] FIGS. 16(a)-16(i) illustrate results for printed/scanned and cropped images;

[0027] FIGS. 17(a)-17(i) show results for printed/scanned images; and

[0028] FIGS. 18(a)-18(i) illustrate results for Gamma adjusted images.

[0029] The present invention provides digital image watermarks that are designed to be robust under all image modifications or degradations. We have observed that many image modifications or degradations that digital images may experience may be modeled as combinations of intensity shift, linear filtering, and additive noise. In the frequency domain, in particular, the approximations involve modeling the modifications or degradations as an unknown change to the d.c. component, multiplication by a smooth mask, and additive noise.

[0030] A solution for ensuring the protection of digital images according to the present invention involves modifying an original digitized image I(i,j) to produce another image I^W(i,j) that will include embedded information on the image source and its legal user. The amount of information in the watermark is in the range between 30 to 100 bits, with the following conditions applicable:

[0031] 1. The tags/watermarks are imperceptible, i.e., I^W appear very similar to the original images I;

[0032] 2. Tags have the capability to carry sufficient information;

[0033] 3. Tags are not easily identifiable from one or more differently tagged copies of the image;

[0034] 4. Tags are easily recoverable from a tagged image and the original;

[0035] 5. Attempts to remove the tags or tamper with them have noticeable ill-effects on the image;

[0036] 6. Tags cannot be wiped out by image modification/compression algorithms or by other casual image processing procedures;

[0037] 7. Tags are distributed in the image plane and are recoverable from arbitrary portions of the image (i.e. they survive image cropping).

[0038] Watermark Authentication System

[0039] Referring now to FIG. 1, and in accordance with one embodiment of the present invention, a watermark authentication system, satisfying the criteria above and generally designated 30, includes a watermarking apparatus 40 for embedding a watermark into the frequency domain of a given image dataset and a watermark recovery apparatus 60 for authenticating the presence of an embedded watermark.

[0040] The watermarking apparatus 40 includes a data storage device 42 for storing image data representing the original image dataset. The data storage device couples to a transformer 44 disposed in a digital computer 46 for transforming spatial domain data representing the original image into the frequency domain. A processor 48 is disposed at the output of the transformer to embed watermark information into the frequency domain data and generate modified frequency domain data pursuant to software implemented steps according to the watermarking method of the present invention. Responsive to the output of the processor is a converter 50 for changing the frequency domain data back to spatial domain data. The resultant image data may then be stored in a memory 52.

[0041] The watermark recovery apparatus 60 includes an image data acquisition device 62 such as a scanner or network interface for downloading a digital image into the computer 46. The data acquisition device feeds the spatial image data to a second transformer 64 for converting the spatial data into the frequency domain. The second transformer 64 also receives spatial data from the data storage device 42 representing the original image. A comparator 66 disposed downstream of the transformer compares the original image data to the acquired image data in the frequency domain to extract the watermark.

[0042] In operation, the watermark authentication system carries out steps according to the watermarking and watermark recovery methods of the present invention.

[0043] Watermarking Method

[0044] The method for watermarking, according to one embodiment of the present invention, generally includes introducing slight modifications of the image in some transform-domain image representation. For example, using the Fourier domain for tagging, an image I(x,y) is transformed to (u,v) via the Fourier transform

[0045] where (u,v) is a complex bivariate function that can be represented by: (u,v)M(u,v)e^iP(u,v) with M(u,v)(u,v) the magnitude and P(u,v)0,2 the corresponding phase. Since I(x,y) is real, M(u,v)M(u,v) and P(u,v)2P(u,v).

[0046] Generally, phase image modifications are visually more perceptible than magnitude/amplitude modifications. Thus, it is more advantageous to modify the magnitude components in order to ensure imperceptibility. Moreover, modifications to magnitude/amplitude components of frequency data are well tolerated, leading to images that appear very similar to the originals.

[0047] Referring now to FIG. 2, the method of watermarking a digital image represented by I(x,y) according to one embodiment involves first transforming the image data from the spatial domain to the frequency domain at step 70. This is preferably performed by loading a copy of the image data into the computer 46, such that the transformer 44 can operate pursuant to software to transform of the image data. The resulting frequency domain data comprises magnitude/amplitude and phase components.

[0048] The next step, at 72, includes determining the magnitude components of the frequency domain data and embedding a watermark into the magnitude image data M(u,v), at step 74, thereby changing it to MW(u,v). After the embedding step, the modified frequency domain data is converted, at step 76, into spatial domain data.

[0049] Embedding the watermark involves, for example, modifying the magnitude M(u,v) by multiplying it with a watermark mask W_M(u,v), or by adding to the data a watermark mask W_A(u,v) according to the respective expressions:

[0050] In the first case, W_M(u,v) is close to 1 everywhere, i.e., W_M(u,v)1_M(u,v), and _M(u,v) will be a function of the information bits b₁, b₂, . . . b_N to be hidden into the watermark. In the second case, W_A(u,v) itself is small for all (u,v) in order not to visibly perturb the watermarked images.

[0051] In the first case, that of multiplicative mask watermarking, the following expression holds true:

[0052] In both the multiplicative mask marking and additive mask marking cases, in order to keep I^W(x,y) real, we require _M/A(u,v)_M/A(u,v). For simplicity, only the multiplicative case will be described further, it being understood that through disclosure of the multiplicative watermarking method, those skilled in the art will also have the necessary tools to implement the additive method.

[0053] Referring now to FIG. 3, considering piecewise constant functions _M(u,v), which take values 0, , the information bits b₁, b₂ . . . , bN may modulate a sequence of concentric rings 80 in the frequency domain, as follows:

[0054] This method assigns the value (1) if b_i0 and the value (1) if b_i1 to the mask over a ring of spatial frequencies located between the radii r_i and r_i1. As shown in FIG. 3, high frequency components reside in the outer rings while low frequency components lie in the inner rings. Here the parameters , r₁, r₂ . . . , r_N are to be chosen so as to achieve imperceptibility, requiring small 's, and good survival under various image modifications, requiring placing r₁, . . . , r_N into the lower frequencies. The constant could be replaced with a variable sequence of gains adapted to the frequency domain rings they modulate.

[0055] Many other options for the design of mask functions are available. FIG. 4 illustrates one such mask design possibility. One could embed a variety of geometric designs or even a company logo into W(u,v). Such designs could be of use when the purpose of the watermark is only to imperceptibly identify the source of the image. If explicit bits must be encoded in W(u,v), for example, to identify the recipient of the image, the encoding may be performed with gain sequences combined with a variety of geometric shapes.

[0056] To explain how the watermark survives degradation of the images, we will consider models of the degradation. Suppose a watermarked image I^W(x,y) is generated and then subjected to a linear transformation that adds noise as follows:

[0057] where B is a constant, N(x,y) is a zero mean noise image, (x,y) is a smooth function, and * denotes a convolution. Then

[0058] The constant B renders the DC component effectively unrecoverable. Hence if the assumption is made that B0, then the watermark information should not be embedded in the DC component (i.e., we should have _M (0, 0)0). One may reasonably assume the function (u,v) to be smooth since non-smooth effects may be absorbed into (u,v).

[0059] Many image transformations which are not necessarily linear filtering processes can, for the purposes of the present invention, nevertheless be reasonably well modeled as such. Examples include printing, photocopying and lossy compression.

[0060] It should be expected that the watermarked image will be subject to cropping. Suppose the original and watermarked image are supported on a 0,10,1 matrix. Cropping the image corresponds to multiplying I(x,y) by Rect (c_x(x-x₀), cy(y-y₀)) where Rect (x,y)1_0,10,1. Then

[0061] hence

FT(I(x,y)Rect(c_x(xx₀), c_y(yy₀))) $\mathrm{FT}\left(I\left(x,y\right)\mathrm{Rect}\left(c_x\left(x-x_0\right),c_y\left(y-y_0\right)\right)\right)=\frac{1}{c_x{c}_y}\tilde{I}\left(u,v\right){}^{-2\left(c_x{x}_0+c_y{y}_0\right)}{}^{-\left(\frac{u}{c_x}+\frac{v}{c_y}\right)}\sin c\frac{u}{c_x}\sin c\frac{v}{c_y}$

[0062] Thus, the effect of cropping on the Fourier transform is to convolve it with a complex smoothing function. To the extent that the constant regions of the watermark are large compared to the main peak of the sinc function, the watermark will survive, i.e., $\left(1+\left(u,v\right)\right)\tilde{I}\left(u,v\right)\frac{{}^{-2\left(c_x{x}_0+c_y{y}_0\right)}}{c_x{c}_y}{}^{-\left(\frac{u}{c_x}+\frac{v}{c_y}\right)}\sin c\frac{u}{c_x}\sin c\frac{v}{c_y}\left(1+\left(u,v\right)\right)\left[\tilde{I}\left(u,v\right)\frac{{}^{-2\left(c_x{x}_0+c_y{y}_0\right)}}{c_x{c}_y}{}^{-\left(\frac{u}{c_x}+\frac{v}{c_y}\right)}\sin c\frac{u}{c_x}\sin c\frac{v}{c_y}\right]$

[0063] for those u,v where (u,v) is locally constant on a scale comparable to c_xc_y. This approximate equality will not hold near the boundaries where the function (u,v) changes discontinuously. Thus, the watermark is largely expected to survive cropping if the regions over which (u,v) is constant are sufficiently large. Of course, when the attempt to recover the watermark is made, one must compare against an identical cropping of the original image.

[0064] The watermark may also be subjected to lossy compression. Lossy compression of I(x,y) involves replacing I(x,y) with a version I^cp(x,y) that requires fewer bits to encode than I(x,y), but is nonetheless similar to it in some subjective/objective distance measure. It is difficult to evaluate the influence of various compression algorithms. However, we can state, in general, that it will involve filtering out visually imperceptible frequency components of I(x,y). When embedding a watermark into the image, these general facts must be given careful consideration. We can model the compression effects as a combination of linear filtering and additive noise: a model we have already discussed. In fact, when we compare a JPEG-compressed image to its original version, we realize that the model of a multiplicative mask in the frequency domain is quite reasonable.

[0065] When implementing a watermarking procedure, one must keep in mind that, given some reasonable economical/financial motivations, there will be serious and professionally well informed attempts to tamper and modify and/or remove the tags embedded in images. It may be assumed that there will be legal arrangements in place, requiring each copyrighted document to have a legible watermark embedded in it. Illegal users will most likely modify, not remove, the existing watermarks. One attempting to disturb the watermark embedded by the method of the present invention would have to first multiply the fourier transform of the image by a random pattern W_rand(u,v). This would generate an image with a watermark of W_M(u,v)W_rand(u,v) from which it would likely not be possible in general to recover W_M(u,v). However, this would yield a legally unusable image since it will lack a valid watermark. In order to illegitimately generate a watermark that would survive, one would have to know the geometry of the watermarks and multiply the transformed image by a W_attack(u,v) that is adapted to the frequency domain geometry of the watermarks.

[0066] Watermarked images are also subject to so-called collusion attacks, in which several watermarked images are used to learn about the watermarks and subsequently modify them. Indeed, if one has two watermarked images one could, assuming identical geometry, approximately recover various ratios, for example: $\frac{W_{M_i}\left(u,v\right)}{W_{M_j}\left(u,v\right)}$

[0067] that would lead to knowledge about the watermark geometry. Therefore, part of the security in the watermarking process proposed must also come from freedom to parameterize the geometry of the spectral masks employed.

[0068] Within the context of watermarking in the fourier transform domain there are essentially two strategies which can be used to enable the watermark to survive various expected image transformations. These include:

[0069] A. Embedding a watermark in such a way that its recovery is not affected by the transformations; and

[0070] B. Attempting to identify or model the transformation so as to compensate for it prior to watermark recovery.

[0071] In the case of cropping, for example, approach B seems to be required in any case. One must precisely locate the cropped portion in the original image. This may be a non-trivial task if the image has also been resampled.

[0072] Approach A has been primarily considered herein with regard to linear filtering. The intention of the present invention, in general, is to guard against a spatially smooth scaling of the Fourier transform and additive noise.

[0073] A potentially effective B type strategy includes leaving various regions of the frequency domain unaltered, i.e., setting (u,v)0 there. Given a modified watermarked image, the spectral modification in the unmarked regions may be sampled and appropriately interpolated to obtain estimates of the modifications in the marked regions. These estimates may be used to approximately invert or model the modifications in the watermarked regions. It may then be possible to use much less geometric redundancy in the watermark and much more error correcting coding.

[0074] Watermark Recovery Method

[0075] The key to the optimal watermark recovery method of the present invention includes the following general considerations from estimation/detection theory. Suppose a set of complex numbers is reported by s_ii1,2, . . . k and a set of observations q_i is expressible as:

[0076] where is a real value and n_i are independent realizations of a complex noise random variable.

[0077] In this setting, the following questions can be addressed:

[0078] 1. What is the optimal estimator of given q_ii1,2, . . . k; or

[0079] 2. If 1 or 1, what is the optimal decision on whether a is higher or lower than 1

[0080] It should be assumed that n_i are independent complex Gaussian random variables with mean 0, and variance 2². To answer the first question posed above, one can write p(Q) the likelihood of seeing the data given some value of , and maximize this with respect to in order to obtain the maximum likelihood ML estimate of . Accordingly: $p(Q)=\underset{i=1}{\overset{K}{}}\frac{1}{2{}^2}{}^{-\frac{1}{2{}^2}{q_i-s_i}^2}$

[0081] and here p(Q) is maximized if $P\left(\right):=\underset{i=1}{\overset{K}{}}{q_i-s_i}^2$

[0082] is minimized. Hence, the optimal estimator for is ${\stackrel{}{}}_{\mathrm{opt}\left(\mathrm{ML}\right)}=\frac{\underset{i}{}\mathrm{Re}\left(q_i^{*}{s}_i\right)}{\underset{i}{}{s}_i^{*}{s}_i}$

[0083] where s* denotes the complex conjugate of s. In the second case, one must deal with a hypothesis testing problem. If it is assumed that the 1 and the 1 cases have equal prior probabilities, then the optimal hypothesis testing decision process proceeds via the following likelihood ratio test: $\left(Q\right)=\frac{P(Q{}_{+})}{P(Q{}_{-})}=\frac{P(Q1+)}{P(Q1-)}$

[0084] This yields $\frac{\underset{i=1}{\overset{k}{}}{}^{-\frac{1}{2{}^2}{q_i-{}_{+}{s}_i}^2}}{\underset{i=1}{\overset{k}{}}{}^{-\frac{1}{2{}^2}{q_i-{}_{-}{s}_i}^2}}\begin{array}{c}{}_{+}\\ >\\ <\\ {}_{-}\end{array}1$

[0085] which, by taking logs, is seen to be equivalent to ${q_i-{}_{+}{s}_i}^2\begin{array}{c}{}_{-}\\ >\\ <\\ {}_{+}\end{array}{q_i-{}_{-}{s}_i}^2$

[0086] This result reduces to $\frac{\underset{i}{}\mathrm{Re}\left(q_i^{*}{s}_i\right)}{\underset{i}{}{s_i}^2}\begin{array}{c}{}_{+}\\ >\\ <\\ {}_{-}\end{array}\frac{{}_{+}+{}_{-}}{2}$

[0087] If 1 and 1, then the threshold is 1. The result illustrates that the optimal decision rule proceeds via ${\stackrel{\text{'}}{}}_{\mathrm{opt}\left(\mathrm{ML}\right)}\begin{array}{c}1+\\ >\\ <\\ 1-\end{array}1$

[0088] Hence, the following result may be stated: The optimal way to recover a from the q_i measurements is by calculating $\stackrel{\text{'}}{}=\frac{\mathrm{Re}\left(\underset{i}{}{q}_i^{*}{s}_i\right)}{\underset{i}{}{s}_i^{*}{s}_i}$

[0089] and, if a priori it is known that a takes on some known values , , one has to compare {acute over ()} to the average value of and .

[0090] This general result is implemented in the present invention in order to optimally detect/recover the watermark embedded in the image.

[0091] Referring now to FIG. 5, it shall be assumed as before that the process of embedding a watermark proceeds by first transforming spatial domain data into frequency domain data, at step 90, via multiplication of (u,v) by a mask W_M(u,v)1_M(u,v). The watermarked image I^W(x,y) is first quantized to fit the way images are represented in the computer. Then the quantized image may undergo cropping, compression/decompression, some smoothing and dynamic range corrections and may be corrupted by some additive noise. The resulting quantized/corrupted I^W(x,y) then becomes _w(u,v) in the frequency domain with each frequency component of _w(u,v) regarded as a complex observation of the corresponding spectral component of (u,v).

[0092] To apply the analysis considered above to the general linear filtering model, it is necessary that the multiplicative scaling of the spectrum (u,v) be approximately constant and known, at step 92. This may not be possible in general, requiring an extrapolation procedure, as shown in FIG. 6.

[0093] Referring now to FIG. 6, assuming the unknown multiplicative scaling mask (u,v) is smooth, as in step 94, it would be feasible to estimate it by reserving a small, approximately uniformly distributed, portion of the frequency domain for estimation purposes at step 96. The spectrum would be unaltered there, i.e., we would have ^W(u,v)(u,v) so that an estimate of (u,v) could be formed at step 98 and extrapolated over the entire frequency domain at step 100.

[0094] Alternatively, as shown in FIG. 7, the watermark data may be modulated so as to ameliorate the effects of smooth but unknown filtering. If, for example, it is known, a priori, that over the regions allocated to each bit in the watermark, the unknown filtering factor changes by only a very small amount, i.e., (u,v)constant there, at step 102, then the bit of information could be encoded over that particular region. This could be done by identifying the regions allocated to the bits, at step 104, partitioning the region R_n allocated to bit b_n into two disjoint subregions R_n,1 and R_n,2 at step 106, and encoding b_n at step 108 in the following way:

[0095] if b_n0

[0096] if b_n1

[0097] In this case, the recovery of the bit b_n from the spectral observations provided by the degraded ^W(u,v) over R_n will involve straightforwardly deciding whether $\stackrel{\text{'}}{}\left(R_{n,1}\right)\begin{array}{c}+\\ >\\ <\\ -\end{array}\stackrel{\text{'}}{}\left(R_{n,2}\right)$

[0098] Denoting q_i as the values of _w(u,v) and s_i as the values of (u,v) where i indexes (u,v), let N_j denote the indices associated to R_n,j, j1,2 respectively. Additionally, assume that q_is_in_i where n_i are i.i.d. complex Gaussians and 1, 1. Calculating likelihood ratios, the optimal decision rule when P is known is given by $\begin{array}{cc}\underset{i{N}_1}{}\mathrm{Re}\left(q_i^{*}{s}_i\right)\underset{i{N}_1}{}{s_i}^2\begin{array}{c}{b}_{n}1\\ >\\ <\\ b_{n}0\end{array}\underset{i{N}_2}{}\mathrm{Re}\left(q_i^{*}{s}_i\right)\underset{i{N}_2}{}{s_i}^2& \text{Equation15}\end{array}$

[0099] Note that in the case _iN1Si²_iN2Si², this reduces to $\begin{array}{cc}\frac{\underset{i{N}_1}{}\mathrm{Re}\left(q_i^{*}{s}_i\right)}{\underset{i{N}_1}{}{s_i}^2}\begin{array}{c}{b}_n=1\\ >\\ <\\ b_n=0\end{array}\frac{\underset{i{N}_2}{}\mathrm{Re}\left(q_i^{*}{s}_i\right)}{\underset{i{N}_2}{}{s_i}^2}& \text{Equation16}\end{array}$

[0100] so that need not, in fact, be known. In this case it is optimal to form estimates as described above, one each for R_n,1 and R_n,2, at step 110, and then to take the comparative difference, at step 112. If R_n,1 and R_n,2 are chosen contiguous and of equal area, then it can be expected that _iN1si²_iN2Si².

[0101] Since it is desirable that the watermark survive cropping, the areas R_n,1 and R_n,2 shall not be too small. Thus, (u,v) may not be sufficiently close to a constant. Fortunately, the differential encoding procedure presented above can be generalized.

[0102] Referring now to FIG. 8, a generalized procedure for differential encoding may be carried out according to the following steps. One may consider and select, at step 114, for example, a smooth function f supported on a rectangular domain R. Suppose R is subdivided into m uniform columns and n uniform rows, at step 116, where nm is even, creating a grid. Next, assume that the grid is colored in a black-and-white checkerboard pattern, at step 118. Then Let f_w denote the average of f over the white squares and let f_b denote the average of f over the black squares, at step 120. As m and n tend to infinity, f_w and f_b both tend to f_R, the average of f over R. In particular, (1)f_w(1)f_b tends to 2f_R. More specifically, if f is expanded in a Taylor series about the center of R, at step 122, and mn2, then f_wf_b depends only on terms of order greater than or equal to 2.

[0103] One may consider the decision rule given by equation 16 and write qi_is_i where _i discretizes in the plane (u,v) and assume that N₁ and N₂ are given by a 22 checkerboard as described above. Assume that Si² is a discretized smooth function S in the plane and consider the center of the checkerboard to be the origin. It follows that the sums _iN1Si², _iN2Si², are both equal to the 0th order term of S plus other terms depending only on terms of order of at least 2. Assuming that Si² can be modeled as S plus zero-mean i.i.d. noise, then the sums above have an additional random component with a variance inversely proportional to N₁ and N₂, respectively.

[0104] Assuming that _iN1Si²_iN2Si², then the decision rule amounts to comparing two sums. If it is assumed that A(u,v) and S are smooth, then the sums are equal up to second order terms. Even without assuming that _iN1Si²_iN2Si², it follows that the difference of the sums depends only on terms of the order of at least 2.

[0105] Other variations on the decision rule are possible. For example, may be estimated as $\frac{1}{2}*\frac{\underset{i{N}_i}{}\mathrm{Re}\left(q_i^{*}{s}_i\right)}{\underset{i{N}_i}{}{s_i}^2}+\frac{1}{2}*\frac{\underset{i{N}_2}{}\mathrm{Re}\left(q_i^{*}{s}_i\right)}{\underset{i{N}_2}{}{s_i}^2}$

[0106] and then substituted into equation 15. In our experiments, the resulting rule gave the same bit errors as those obtained using equation 16.

[0107] Referring to FIGS. 9 through 13, the watermarking and watermark recovery methods described above were extensively tested on a set of three 512512 grey level 8-bit images, chosen from an art library database. The images comprise cropped grey level versions of paintings by Renoir (FIG. 9(a)), Michelangelo (FIG. 9(b)) and Botticelli (FIG. 9(c)). The multiplicative process discussed above comprised the method chosen for watermark embedding. As disclosed in the method, the magnitude of the 512512 fourier transform of these images was multiplied by a mask function M(u,vB) dependent on a vector B of 120 binary digits b_m,n1, 1, m1,2 . . . ,8, n1,2, . . . , 15. The geometry of the mask was chosen to be a very simple one. If one regards the frequency domain corresponding to the 512512 images as 1,1 1,1 and introduces polar coordinates (r,) then R_m,n, the region reserved for embedding bit ban, is defined by $R_{m,n}=\left[\left(r,\right)\text{:}r\left[\left(m-1\right)\frac{1}{15},m\frac{1}{15}\right],\left[\left(n-1\right)\frac{}{8},n\frac{}{8}\right]\right]$

[0108] Recall that the M(u,vB) must satisfy the symmetry property M(u,vB)M(u,vB) so that each region R_m,n is also duplicated by reflection about the origin. Each region R_m,n rectangular in polar coordinates, was then subdivided into a 22 rectangular array for differential encoding, as described above in step 116 (FIG. 8). FIGS. 9(g) through 9(i) illustrate examples of M(u,vB).

[0109] The watermarked version of each test image I(x,y), requantized by rounding and clipping, and shown in FIGS. 9(d)-9(f), was defined to be

[0110] FIGS. 10, 11 and 12 show, respectively, the Botticelli, the Michelangelo and the Renoir test images watermarked with an arbitrary B vector, and various gain factors 0.0, 0.05, 0.1, 0.2. We can see that for 0.05, the value chosen for the subsequent tests, and 0.01, the watermarked images are virtually indistinguishable from their original. FIGS. 9(a) through 9(i) show watermarked versions of each of the three test images with pseudo-random watermark information bit sequences B and 0.05. The ideal local watermark recovery is not perfect due to the requantization of the watermarked images. However, 120 bits of data are perfectly recovered by the optimal watermark estimation procedure in spite of this.

[0111] After these initial tests addressing the effects of requantization alone on the watermark recovery, several others were performed in order to see how the 120 bits of watermark data would be affected by various degradations of the watermarked images. As already noted herein, the various degradations and modifications that affect the watermark include:

[0112] 1. cropping portions of the image;

[0113] 2. lossy compression-decompression cycles (with the standard JPEG algorithm);

[0114] 3. changes in contrast;

[0115] 4. printing on standard laser printers and rescanning the image (with possible cropping).

[0116] In order to test for watermark survival after printing-cropping-rescanning degradation, it is necessary to solve the rather delicate problem of registering the rescanned and possibly cropped image with the original. Recall that the watermark detection mechanism assumes the availability of two images or image portions in perfect registration.

[0117] Let f represent an image which may be a degraded sub-image of a watermarked image whose original may be denoted by g. Let denote the rectangle over which f is defined. One may register f, using a multi-resolution hill climbing algorithm, by finding an affine transformation which minimizes the following function ${}_{}\frac{g\left(\left(x\right)\right)-\stackrel{\_}{g}}{g\left(\left(x\right)\right)-\stackrel{\_}{g}}*\frac{f\left(x\right)-\stackrel{\_}{f}}{f\left(x\right)-\stackrel{\_}{f}}$

[0118] where

[0119] Once the desired is found, the image may be resampled appropriately.

[0120] We performed several cropping tests on the three images shown in FIGS. 9(a)-(c), with cropped portions of respective 256256 sizes. Typically, the bits were recovered with about 6 percent errors. FIGS. 13(a)-(i) show the watermark recovery results. Here, perfect alignment/registration was assumed with the original. The few detected errors resided in the low frequency components. This is undoubtedly due to the relatively small area reserved for bits embedded into these components.

[0121] With respect to images subjected to JPEG compression, the watermarked images were taken (0.05) and compressed using a standard JPEG algorithm with a quality factor of 20 percent. As seen in FIGS. 14(a)-(d) and 15(a)-(i), considerable visible degradations and blocking effects occurred in the images.

[0122] In all three images, the first (i.e., corresponding to low frequency) 55 bits of the watermark string B were recovered correctly and at least 90 of the 120 bits were correctly recovered. With higher quality factors the results would be better. As seen in the spectral image of the watermark recovery, the high frequencies are, not surprisingly, strongly affected by compression. Hence, the bits embedded in this range of the spectrum should not be expected to survive. Noticeably important, however, is the finding that due to the differential encoding of each bit, the low-range encoded information remains intact in spite of the fact that the compression process effectively scales the spectrum with a varying gain envelope. This is apparent by referring to FIGS. 15(a)-(i).

[0123] The cycle of degradations involving printing and cropping followed by image rescanning was the most severe test applied to the watermarks. First, the watermarked originals were printed on a 600 dpi laser printer, then scanned with a typical color image scanner at a resolution of 150 dpi. The above described general purpose multi-resolution image registration procedure for generating an optimally registered 512512 image for each of the three rescanned images shown in FIG. 8 was implemented. Also generated were 256256 optimally registered sections of the images, from three arbitrarily cropped portions of the rescanned originals. On these six redigitized images, the optimal watermark recovery algorithm was performed. The results are shown in FIGS. 16(a)-(i) and 17(a)-(i). In this case, 105 bits were recovered correctly out of the 120 that were embedded into the watermarked images. The results apply to uncropped images and 95 bits when using the optimally registered, redigitized cropped image sections one quarter in area. From these experimental results, it may be concluded that even under such severe degradations, one may expect to recover 90 bits out of the 120. Practically, this mostly involves the bits embedded into the lower frequency range.

[0124] With respect to images undergoing contrast changes, the image contrast was adjusted in a non-linear way. This was performed by adjusting the intensity value using a Gamma value of 2. The results are shown in FIGS. 18(a)-(i). The point-wise ratio exhibits apparently random noise while the overall brightening of the image reduces contrast and hence the energy in much of the spectrum. Because of the differential encoding, all of the bits in each image were nonetheless recovered correctly.

[0125] From our experiments, one of the important conclusions we arrived at included using the lower part of the frequency spectrum for watermarking without the vicinity of the DC component.

[0126] In our experiments we chose, rather arbitrarily, to encode the information in 120 sections in the entire spectral domain, with approximately equal energy under the assumption that the spectrum decayed as 1/r in amplitude from the center. This rather arbitrary choice is capable of customization and optimization, and we could have decided to use a lower section of the spectral domain. Moreover, we could have selected fewer bits to encode and made sure that all regions chosen have exactly the same energy.

[0127] Our experiments also confirmed the feasibility of using differential encoding of the bits. Various nonlinear degradations may be modeled by a rather smooth multiplicative mask in the frequency domain. The differential encoding method handles such degradations well. This method, too, can be refined and adapted to more specific information, assuming information availability, on the various degradations following compression-decompression cycles, printing and rescanning etc.

[0128] Additionally, the experiments support the use of error-correction for the bits strings embedded as watermarks.

[0129] With the arbitrary choice of embedding 120 bits in the entire frequency domain corresponding to the 512512 images, we can typically recover the bits with less than 25 errors. This shows that an error correcting code could safely enable us to embed about 60 error-free information bits into the images we experimented with. This is more than enough for practical purposes.

[0130] There arises in this context the following issue: how can the recovered watermark bits be used to guarantee the identity associated with the image. If we can recover 60 error-free bits with a high probability, then 20-30 bits should be sufficient to encode the identity. We can then guarantee that all valid 60 bit watermarks are well separated in Hamming distance so that if the recovered 60 bits are valid, then the probability that those are the correct 60 bits uniquely identifying the source and recipient of the image will be very high. This probability value attached to the recovered watermark could be further refined by using soft decoding, for example.

[0131] Those skilled in the art will appreciate the many benefits and advantages afforded by the present invention. Significantly, watermarks embedded by the system and method of the present invention are imperceptible and have the ability to carry predetermined information. Moreover, the watermarks are distinguishable from one or more differently tagged copies of the image and are easily recoverable from a tagged image and the original image.

[0132] As a desirable security feature, attempts to remove the watermarks have noticeable ill-effects on the image. Additionally, image modification and compression algorithms have a relatively minor effect on the tags. Also important is the image cropping survival capability realized through distribution of the watermark in the image plane.

[0133] While the invention has been particularly shown and described with reference to the preferred embodiments thereof, it will be understood by those skilled in the art that various changes in form and detail may be made therein without departing from the spirit and scope of the invention.