Transform domain image watermarking method and system

[0002] This is a continuation of application Ser. No. 09/076,284, filed May 12, 1998. Each of these prior applications is hereby incorporated herein by reference, in its entirety.

[0003] The invention relates to digital image watermarking methods and systems and more particularly a method and apparatus for watermarking digital images and authenticating watermarked digital images in the frequency domain.

[0004] The popularity and proliferation of digitized images has resulted in a dramatic increase in image distribution over vast areas. Digitized images comprise formatted digital data conveniently storable in digital form with mass memories, floppy diskettes, or in hard copy form as an image printout. Much of the distribution of digitized images relies upon digital networks such as Local Area Networks (LANs) and the Internet which enable swift and relatively unchecked uploading and downloading of image data between computer systems over vast transmission paths. While legitimate widespread dissemination of a protectable digital image typically benefits the image owner, illegitimate and unauthorized reproduction and distribution often damages the proprietary value of the image.

[0005] To combat the problem of illicit reproduction and dissemination of protected digitized images, a number of methods and devices for embedding detectable tags or “watermarks” into such images have been devised to track unauthorized secondary distribution. One method, disclosed by Larry O'Gorman to the inventors proposes embedding watermarks in the spatial domain of the image data by slightly enhancing or depressing the image grey levels. Although this method works well for its intended purposes, the watermark is substantially non-holographic in that it becomes degraded and in some instances undetectable under circumstances where the image is cropped or compressed by a suitable compression algorithm.

[0006] A second proposal by Cox et. al. allegedly addresses the above shortcomings by watermarking the image data in the frequency domain. The procedure involves randomly choosing a set of unique frequency components to encode a pseudo-random (noise-like) watermark vector. The watermark may then be later recovered or detected by a correlation procedure. The frequency components chosen are perceptibly significant, residing in the low frequency range, to ensure that the relevant information will not be lost due to cropping or compression.

[0007] While the Cox proposal appears beneficial for its designed applications, the pseudo-random noise-like watermark is incapable of directly carrying the watermarking information. Moreover, in order to detect or recover the watermark, a correlation search must be carried out in order to compare the data to all other watermarks. This presents a somewhat complicated and calculation heavy method, requiring substantial computing resources.

[0008] Therefore, a need exists for a method and system for watermarking and authenticating a watermarked image such that the watermark is capable of surviving cropping and compression of the image data. Moreover, the need exists for such a method and system to provide a watermark capable of directly carrying the bits of watermarking information. Additionally, the need exists for such a system and method to provide watermark recovery through straightforward procedures. The method and apparatus of the present invention satisfies these needs.

[0009] Image authentication according to the present invention is effected by using watermarks that are imperceptible and have the ability to directly carry information. The watermarks are distinguishable from one or more differently tagged copies of the image and are easily recovered from a tagged image and the original image. As a durable security feature, attempts to remove the watermarks have noticeable ill-effects on the image. Additionally, image modification and compression algorithms have a relatively minor effect on the tags. Also important is the image cropping survival capability realized through distribution of the watermark in the image plane.

[0010] To realize the above features and advantages, the present invention, in one form, comprises a method of robust digital image watermarking for embedding a predetermined bit sequence into a digital image. The method includes the steps of transforming the digital image into frequency domain data signals, including respective magnitude and phase data signal components. The next step involves determining a set of contiguous region(s) in the frequency domain and then embedding the predetermined bit sequence directly into the image frequency domain data signals by mapping bits to well-defined regions in the frequency domain.

[0011] In yet another form, the present invention includes a method of recovering a watermark from a tagged digitized image comprising a reproduction of an original image. The respective images comprise spatial domain datasets. The method includes the steps of first transforming the spatial domain data comprising the respective images into respective frequency domain datasets, then comparing the respective frequency domain datasets to identify the watermark and verify the authenticity of the image reproduction.

[0012] A further form of the invention comprises a watermark recovery apparatus for authenticating a tagged digitized image comprising a reproduction of an original image. The respective images comprise spatial domain datasets. The apparatus includes a transformer for transforming the spatial domain data comprising the respective images into respective frequency domain datasets; and a comparator responsive to the transformer for comparing the respective frequency domain datasets to identify the watermark and verify the authenticity of the image reproduction.

[0013] Yet another form of the invention comprises a digitized image authentication system for implanting and detecting watermark information in a digitized image. The digitized image comprises spatial domain data and is reproduced from an original image. The system includes a watermarking apparatus for tagging the digitized image. The apparatus includes a transformer for transforming the spatial domain data into frequency domain data, including respective magnitude and phase data components. A processor is disposed at the output of the transformer and is operative to embed information into the magnitude data to develop modified data. A converter responsive to the processor converts the modified data from the frequency domain to the spatial domain to generate the watermarked digitized image. The system further includes a watermark recovery apparatus for authenticating the tagged digitized image. The recovery apparatus includes a transformer for transforming the spatial domain data comprising the respective images into respective frequency domain datasets. A comparator is responsive to the transformer for comparing the respective frequency domain datasets to identify the watermark and verify the authenticity of the image reproduction.

[0014] Other features and advantages of the present invention will be apparent from the following detailed description when read in conjunction with the accompanying drawings, wherein:

[0015] FIG. 1 is a block diagram of a digital image authentication system according to one embodiment of the present invention;

[0016] FIG. 2 is a graphical representation of a watermark mask according to one embodiment of the present invention;

[0017] FIG. 3 is a block diagram illustrating steps involved in the watermarking method of the present invention;

[0018] FIG. 4 is a graphical depiction of a watermark pattern according to one embodiment of the present invention;

[0019] FIG. 5 is a block diagram illustrating steps implemented in one embodiment of the watermark recovery method of the present invention;

[0020] FIGS. 6-8 are block diagrams illustrating steps included in alternative embodiments of the watermark recovery method of the present invention;

[0021] FIGS. 9(a)-9(i) illustrate original images and corresponding watermarked images and watermarks;

[0022] FIGS. 10(a)-10(d) illustrate image data results for a Botticelli digital image watermarked at various intensities;

[0023] FIGS. 11(a)-11(d) illustrates image data results for a Michelangelo digital image watermarked at various intensities;

[0024] FIGS. 12(a)-12(d) illustrates image data results for a Renoir digital image watermarked at various intensities;

[0025] FIGS. 13(a)-13(i) show respective cropped portions of the watermarked images of FIGS. 10-12, the corresponding average value watermarks, and the respective error locations for the watermarks;

[0026] FIGS. 14(a)-14(d) illustrate watermarked images after a 20% quality JPEG compression;

[0027] FIGS. 15(a)-15(i) show results for images after a 20% quality JPEG compression and the respective recovered watermarks and corresponding error locations;

[0028] FIGS. 16(a)-16(i) illustrate results for printed/scanned and cropped images;

[0029] FIGS. 17(a)-17(i) show results for printed/scanned images; and

[0030] FIGS. 18(a)-18(i) illustrate results for Gamma adjusted images.

[0031] The present invention provides digital image watermarks that are designed to be robust under all image modifications or degradations. We have observed that many image modifications or degradations that digital images may experience may be modeled as combinations of intensity shift, linear filtering, and additive noise. In the frequency domain, in particular, the approximations involve modeling the modifications or degradations as an unknown change to the d.c. component, multiplication by a smooth mask, and additive noise.

[0032] A solution for ensuring the protection of digital images according to the present invention involves modifying an original digitized image I(i,j) to produce another image I^W(i,j) that will include embedded information on the image source and its legal user. The amount of information in the watermark is in the range between 30 to 100 bits, with the following conditions applicable:

[0033] 1. The tags/watermarks are imperceptible, i.e., I^Wappear very similar to the original images I;

[0034] 2. Tags have the capability to carry sufficient information;

[0035] 3. Tags are not easily identifiable from one or more differently tagged copies of the image;

[0036] 4. Tags are easily recoverable from a tagged image and the original;

[0037] 5. Attempts to remove the tags or tamper with them have noticeable ill-effects on the image;

[0038] 6. Tags cannot be wiped out by image modification/compression algorithms or by other casual image processing procedures;

[0039] 7. Tags are distributed in the image plane and are recoverable from “arbitrary” portions of the image (i.e. they survive image cropping).

[0040] Watermark Authentication System

[0041] Referring now to FIG. 1, and in accordance with one embodiment of the present invention, a watermark authentication system, satisfying the criteria above and generally designated 30, includes a watermarking apparatus 40 for embedding a watermark into the frequency domain of a given image dataset and a watermark recovery apparatus 60 for authenticating the presence of an embedded watermark.

[0042] The watermarking apparatus 40 includes a data storage device 42 for storing image data representing the “original” image dataset. The data storage device couples to a transformer 44 disposed in a digital computer 46 for transforming spatial domain data representing the “original image” into the frequency domain. A processor 48 is disposed at the output of the transformer to embed watermark information into the frequency domain data and generate modified frequency domain data pursuant to software implemented steps according to the watermarking method of the present invention. Responsive to the output of the processor is a converter 50 for changing the frequency domain data back to spatial domain data. The resultant image data may then be stored in a memory 52.

[0043] The watermark recovery apparatus 60 includes an image data acquisition device 62 such as a scanner or network interface for downloading a digital image into the computer 46. The data acquisition device feeds the spatial image data to a second transformer 64 for converting the spatial data into the frequency domain. The second transformer 64 also receives spatial data from the data storage device 42 representing the “original” image. A comparator 66 disposed downstream of the transformer compares the original image data to the acquired image data in the frequency domain to extract the watermark.

[0044] In operation, the watermark authentication system carries out steps according to the watermarking and watermark recovery methods of the present invention.

[0045] Watermarking Method

[0046] The method for watermarking, according to one embodiment of the present invention, generally includes introducing slight modifications of the image in some transform-domain image representation. For example, using the Fourier domain for tagging, an image I(x,y) is transformed to Ĩ(u,v) via the Fourier transform

[0047] {tilde over (I)}(u,v)=FT{I(x,y)}:=∫∫I(x,y)e^j2π(ux+vy)dxdy

[0048] where Ĩ(u,v) is a complex bivariate function that can be represented by: Ĩ(u,v)=M(u,v)e^jP(u,v)with M(u,v)=|Ĩ(u,v)| the magnitude and P(u,v)ε[0,2π] the corresponding phase. Since I(x,y) is real, M(−u,−v)=M(u,v) and P(u,v)=2π−P(−u,−v).

[0049] Generally, “phase” image modifications are visually more perceptible than magnitude/amplitude modifications. Thus, it is more advantageous to modify the magnitude components in order to ensure imperceptibility. Moreover, modifications to magnitude/amplitude components of frequency data are well tolerated, leading to images that appear very similar to the originals.

[0050] Referring now to FIG. 2, the method of watermarking a digital image represented by I(x,y) according to one embodiment involves first transforming the image data from the spatial domain to the frequency domain at step 70. This is preferably performed by loading a copy of the image data into the computer 46, such that the transformer 44 can operate pursuant to software to transform of the image data. The resulting frequency domain data comprises magnitude/amplitude and phase components.

[0051] The next step, at 72, includes determining the magnitude components of the frequency domain data and embedding a watermark into the magnitude image data M(u,v), at step 74, thereby changing it to MW(u,v). After the embedding step, the modified frequency domain data is converted, at step 76, into spatial domain data.

[0052] Embedding the watermark involves, for example, modifying the magnitude M(u,v) by multiplying it with a “watermark mask” W_M(u,v), or by adding to the data a “watermark mask” W_A(u,v) according to the respective expressions:

[0053] M^W(u,v)=W_m(u,v)·M(u,v)

[0054] M^W(u,v)=W_A(u,v)+M(u,v)

[0055] In the first case, W_M(u,v) is “close” to 1 everywhere, i.e., W_M(u,v)=1+ε_M(u,v), and ε_M(u,v) will be a function of the information bits {b₁, b₂, . . . b_N} to be hidden into the watermark. In the second case, W_A(u,v) itself is small for all (u,v) in order not to visibly perturb the watermarked images.

[0056] In the first case, that of multiplicative mask watermarking, the following expression holds true:

[0057] I^W(x,y)=FT⁻¹{M(u,v)e^jP(u,v)+ε_M(u,v)M(u,v)e^jP(u,v)}=I(x,y)+I(x,y)*FT⁻¹{ε_M(u,v)}

[0058] In both the multiplicative mask marking and additive mask marking cases, in order to keep I^W(x,y) real, we require ε_M/A(u,v)=ε_M/A(−u,−v). For simplicity, only the multiplicative case will be described further, it being understood that through disclosure of the multiplicative watermarking method, those skilled in the art will also have the necessary tools to implement the additive method.

[0059] Referring now to FIG. 3, considering piecewise constant functions ε_M(u,v), which take values 0, ±ε, the information bits b₁, b₂. . . , b_Nmay modulate a sequence of concentric rings 80 in the frequency domain, as follows:

[0060] W_M(u,v)=1+ε(−1)^bfor {square root over (u²+v²)}ε[r_i,r_i+1)

[0061] This method assigns the value (1+ε) if b_i=0 and the value (1−ε) if b_i=1 to the mask over a ring of spatial frequencies located between the radii r_iand r_i+1. As shown in FIG. 3, high frequency components reside in the outer rings while low frequency components lie in the inner rings. Here the parameters ε, r₁, r₂. . . , r_Nare to be chosen so as to achieve imperceptibility, requiring small ε's, and good survival under various image modifications, requiring placing r₁, . . . , r_Ninto the lower frequencies. The constant ε could be replaced with a variable sequence of gains adapted to the frequency domain rings they modulate.

[0062] Many other options for the design of mask functions are available. FIG. 4 illustrates one such mask design possibility. One could embed a variety of geometric designs or even a company logo into W(u,v). Such designs could be of use when the purpose of the watermark is only to imperceptibly identify the source of the image. If explicit bits must be encoded in W(u,v), for example, to identify the recipient of the image, the encoding may be performed with gain sequences combined with a variety of geometric shapes.

[0063] To explain how the watermark survives degradation of the images, we will consider models of the degradation. Suppose a watermarked image I^W(x,y) is generated and then subjected to a linear transformation that adds noise as follows:

[0064] I_D^W(x,y)=A(x,y)*I^W(x,y)+B+N(x,y)

[0065] where B is a constant, N(x,y) is a zero mean noise image, Ã(x,y) is a smooth function, and * denotes a convolution. Then

[0066] Ĩ_D^W(u,v)={tilde over (A)}(u,v)·Ĩ^W(u,v)+Bδ(u,v)+Ñ(u,v)

[0067] ={tilde over (A)}(u,v)[1+ε_M(u,v)]{tilde over (I)}(u,v)+Bδ(u,v)+{tilde over (N)}(u,v)

[0068] The constant B renders the DC component effectively unrecoverable. Hence if the assumption is made that B¢0, then the watermark information should not be embedded in the DC component (i.e., we should have ε_M(0, 0)=0). One may reasonably assume the function Ã(u,v) to be smooth since non-smooth effects may be absorbed into Ñ(u,v).

[0069] Many image transformations which are not necessarily linear filtering processes can, for the purposes of the present invention, nevertheless be reasonably well modeled as such. Examples include printing, photocopying and lossy compression.

[0070] It should be expected that the watermarked image will be subject to cropping. Suppose the original and watermarked image are supported on a [0,1]×[0,1] matrix. Cropping the image corresponds to multiplying I(x,y) by Rect (c_x(x-x₀), cy(y-y₀)) where Rect (x,y)=1_[0,1]×[0,1]. Then

[0071] FT(Rect(x,y))=e^−iπ(u+v)sin cπsin cπv

[0072] hence $\mathrm{FT}\left(I\left(x,y\right)\mathrm{Rect}\left(c_x\left(x-x_0\right),c_y\left(y-y_0\right)\right)\right)=\frac{1}{c_x{c}_y}\tilde{I}\left(u,v\right)\otimes e^{-\mathrm{i2\pi }\left(c_x{x}_0+c_y{y}_0\right)}{e}^{-\mathrm{i\pi }\left(\frac{u}{c_x}+\frac{v}{c_y}\right)}\sin c\frac{\pi u}{c_x}\sin c\frac{\pi v}{c_y}$

[0073] Thus, the effect of cropping on the Fourier transform is to convolve it with a complex smoothing function. To the extent that the constant regions of the watermark are large compared to the main peak of the sinc function, the watermark will survive, i.e., $\left(1+ϵ\left(u,v\right)\right)\tilde{I}\left(u,v\right)\otimes \frac{e^{-\mathrm{i2\pi }\left(c_x{x}_0+c_y{y}_0\right)}}{c_x{c}_y}{e}^{-\mathrm{i\pi }\left(\frac{u}{c_x}+\frac{v}{c_y}\right)}\sin c\frac{\pi u}{c_x}\sin c\frac{\pi v}{c_y}\approx \left(1+ϵ\left(u,v\right)\right)\left[\tilde{I}\left(u,v\right)\otimes \frac{e^{-\mathrm{i2\pi }\left(c_x{x}_0+c_y{y}_0\right)}}{c_x{c}_y}{e}^{-\mathrm{i\pi }\left(\frac{u}{c_x}+\frac{v}{c_y}\right)}\sin c\frac{\pi u}{c_x}\sin c\frac{\pi v}{c_y}\right]$

[0074] for those u,v where ε(u,v) is locally constant on a scale comparable to c_x×c_y. This approximate equality will not hold near the boundaries where the function ε(u,v) changes discontinuously. Thus, the watermark is largely expected to survive cropping if the regions over which ε(u,v) is constant are sufficiently large. Of course, when the attempt to recover the watermark is made, one must compare against an identical cropping of the original image.

[0075] The watermark may also be subjected to lossy compression. Lossy compression of I(x,y) involves replacing I(x,y) with a version I^cp(x,y) that requires fewer bits to encode than I(x,y), but is nonetheless similar to it in some subjective/objective distance measure. It is difficult to evaluate the influence of various compression algorithms. However, we can state, in general, that it will involve filtering out visually “imperceptible” frequency components of I(x,y). When embedding a watermark into the image, these general facts must be given careful consideration. We can model the compression effects as a combination of linear filtering and additive noise: a model we have already discussed. In fact, when we compare a JPEG-compressed image to its original version, we realize that the model of a multiplicative mask in the frequency domain is quite reasonable.

[0076] When implementing a watermarking procedure, one must keep in mind that, given some reasonable economical/financial motivations, there will be serious and professionally well informed attempts to tamper and modify and/or remove the tags embedded in images. It may be assumed that there will be legal arrangements in place, requiring each copyrighted document to have a legible watermark embedded in it. Illegal users will most likely modify, not remove, the existing watermarks. One attempting to disturb the watermark embedded by the method of the present invention would have to first multiply the fourier transform of the image by a random pattern W_rand(u,v). This would generate an image with a watermark of W_M(u,v)·W_rand(u,v) from which it would likely not be possible in general to recover W_M(u,v). However, this would yield a legally unusable image since it will lack a valid watermark. In order to illegitimately generate a watermark that would survive, one would have to know the geometry of the watermarks and multiply the transformed image by a W_attack(u,v) that is adapted to the frequency domain geometry of the watermarks.

[0077] Watermarked images are also subject to so-called “collusion attacks”, in which several watermarked images are used to learn about the watermarks and subsequently modify them. Indeed, if one has two watermarked images one could, assuming identical geometry, approximately recover various ratios, for example: $\frac{W_{M_i}\left(u,v\right)}{W_{M_j}\left(u,v\right)}$

[0078] that would lead to knowledge about the watermark geometry. Therefore, part of the security in the watermarking process proposed must also come from freedom to parameterize the geometry of the spectral masks employed.

[0079] Within the context of watermarking in the fourier transform domain there are essentially two strategies which can be used to enable the watermark to survive various expected image transformations. These include:

[0080] A. Embedding a watermark in such a way that its recovery is not affected by the transformations; and

[0081] B. Attempting to identify or model the transformation so as to compensate for it prior to watermark recovery.

[0082] In the case of cropping, for example, approach B seems to be required in any case. One must precisely locate the cropped portion in the original image. This may be a non-trivial task if the image has also been resampled.

[0083] Approach A has been primarily considered herein with regard to linear filtering. The intention of the present invention, in general, is to guard against a spatially smooth scaling of the Fourier transform and additive noise.

[0084] A potentially effective B type strategy includes leaving various regions of the frequency domain unaltered, i.e., setting ε(u,v)=0 there. Given a modified watermarked image, the spectral modification in the unmarked regions may be sampled and appropriately interpolated to obtain estimates of the modifications in the marked regions. These estimates may be used to approximately invert or model the modifications in the watermarked regions. It may then be possible to use much less geometric redundancy in the watermark and much more error correcting coding.

[0085] Watermark Recovery Method

[0086] The key to the optimal watermark recovery method of the present invention includes the following general considerations from estimation/detection theory. Suppose a set of complex numbers is reported by {s_i}i=1,2, . . . k and a set of observations q_iis expressible as:

[0087] q_i=αs_i+n_i

[0088] where α is a real value and n_iare independent realizations of a complex noise random variable.

[0089] In this setting, the following questions can be addressed:

[0090] 1. What is the optimal estimator of α given {q_i}i=1,2, . . . k; or

[0091] 2. If α=1+ε or α=1−ε, what is the optimal decision on whether a is higher or lower than 1?

[0092] It should be assumed that n_iare independent complex Gaussian random variables with mean 0, and variance 2σ². To answer the first question posed above, one can write p(Q|α) the likelihood of seeing the data given some value of α, and maximize this with respect to α in order to obtain the maximum likelihood ML estimate of α. Accordingly: $p(Q\mid \alpha )=\prod _{i=1}^K\frac{1}{2\pi {\sigma }^2}{e}^{-\frac{1}{2{\sigma }^2}{\left|q_i-\alpha s_i\right|}^2}$

[0093] and here p(Q|α) is maximized if $P\left(\alpha \right):=\prod _{i=1}^K{\left|q_i-\alpha s_i\right|}^2$

[0094] is minimized. Hence, the optimal estimator for α is ${\stackrel{\prime }{\alpha }}_{\mathrm{opt}\left(\mathrm{ML}\right)}=\frac{\sum _i\mathrm{Re}\left(q_i^{*}{s}_i\right)}{\sum _i{s}_i^{*}{s}_i}$

[0095] where s* denotes the complex conjugate of s. In the second case, one must deal with a hypothesis testing problem. If it is assumed that the α₊=1+ε and the α=1−ε cases have equal prior probabilities, then the optimal hypothesis testing decision process proceeds via the following likelihood ratio test: $\lambda \left(Q\right)=\frac{P(Q|{\alpha }_{+})}{P(Q|{\alpha }_{-})}=\frac{P(Q|1+\epsilon )}{P(Q|1-\epsilon )}$

[0096] This yields $\frac{\prod _{i=1}^k{e}^{-\frac{1}{2{\sigma }^2}{\left|q_i-{\alpha }_{+}{s}_i\right|}^2}}{\prod _{i=1}^k{e}^{-\frac{1}{2{\sigma }^2}{\left|q_i-{\alpha }_{-}{s}_i\right|}^2}}\begin{array}{c}{\alpha }_{+}\\ >\\ <\\ {\alpha }_{-}\end{array}1$

[0097] which, by taking logs, is seen to be equivalent to $\sum {\left|q_i-{\alpha }_{+}{s}_i\right|}^2\begin{array}{c}{\alpha }_{-}\\ >\\ <\\ {\alpha }_{+}\end{array}\sum {\left|q_i-{\alpha }_{-}{s}_i\right|}^2$

[0098] This result reduces to $\frac{\sum _i\mathrm{Re}\left(q_i^{*}{s}_i\right)}{\sum _i{\left|s_i\right|}^2}\begin{array}{c}{\alpha }_{+}\\ >\\ <\\ {\alpha }_{-}\end{array}\frac{{\alpha }_{+}+{\alpha }_{-}}{2}$

[0099] If α₊=1+ε and α=1−ε, then the threshold is 1. The result illustrates that the optimal decision rule proceeds via ${\stackrel{\text{'}}{\alpha }}_{\mathrm{opt}\left(\mathrm{ML}\right)}\begin{array}{c}1+\epsilon \\ >\\ <\\ 1-\epsilon \end{array}1$

[0100] Hence, the following result may be stated: The optimal way to recover a from the {q_i} measurements is by calculating $\stackrel{\text{'}}{\alpha }=\frac{\mathrm{Re}\left(\sum _i{q}_i^{*}{s}_i\right)}{\sum _i{s}_i^{*}{s}_i}$

[0101] and, if a priori it is known that a takes on some known values α₊, α₋, one has to compare {acute over (α)} to the average value of α₊ and α₋.

[0102] This general result is implemented in the present invention in order to optimally detect/recover the watermark embedded in the image.

[0103] Referring now to FIG. 5, it shall be assumed as before that the process of embedding a watermark proceeds by first transforming spatial domain data into frequency domain data, at step 90, via multiplication of Ĩ(u,v) by a mask W_M(u,v)=1+ε_M(u,v). The watermarked image I^W(x,y) is first quantized to fit the way images are represented in the computer. Then the quantized image may undergo cropping, compression/decompression, some smoothing and dynamic range corrections and may be corrupted by some additive noise. The resulting quantized/corrupted I^W(x,y) then becomes Ĩ_w(u,v) in the frequency domain with each frequency component of Ĩ_w(u,v) regarded as a complex observation of the corresponding spectral component of Ĩ(u,v).

[0104] To apply the analysis considered above to the general linear filtering model, it is necessary that the multiplicative scaling of the spectrum Ã(u,v) be approximately constant and known, at step 92. This may not be possible in general, requiring an extrapolation procedure, as shown in FIG. 6.

[0105] Referring now to FIG. 6, assuming the unknown multiplicative scaling mask Ã(u,v) is smooth, as in step 94, it would be feasible to estimate it by reserving a small, approximately uniformly distributed, portion of the frequency domain for estimation purposes at step 96. The spectrum would be unaltered there, i.e., we would have Ĩ^W(u,v)=Ĩ(u,v) so that an estimate of Ã(u,v) could be formed at step 98 and extrapolated over the entire frequency domain at step 100.

[0106] Alternatively, as shown in FIG. 7, the watermark data may be modulated so as to ameliorate the effects of smooth but unknown filtering. If, for example, it is known, a priori, that over the regions allocated to each bit in the watermark, the unknown filtering factor changes by only a very small amount, i.e., Ã(u,v)=β=constant there, at step 102, then the bit of information could be encoded over that particular region. This could be done by identifying the regions allocated to the bits, at step 104, partitioning the region R_nallocated to bit b_ninto two disjoint subregions R_n,1and R_n,2at step 106, and encoding b_nat step 108 in the following way:

[0107] W(u,v)=1+ε (u,v)εR_n,1

[0108] if b_n=0

[0109] W(u,v)=1−ε (u,v)εR_n,2

[0110] W(u,v)=1+ε (u,v)εR_n,1

[0111] if b_n=1

[0112] W(u,v)=1−ε (u,v)εR_n,2

[0113] In this case, the recovery of the bit b_nfrom the “spectral” observations provided by the degraded Ĩ^W(u,v) over R_nwill involve straightforwardly deciding whether $\beta \stackrel{\text{'}}{\alpha }\left(R_{n,1}\right)\begin{array}{c}+\\ >\\ <\\ -\end{array}\beta \stackrel{\text{'}}{\alpha }\left(R_{n,2}\right)$

[0114] Denoting q_ias the values of Ĩ_w(u,v) and s_ias the values of Ĩ(u,v) where i indexes (u,v), let N_jdenote the indices associated to R_n,j, j=1,2 respectively. Additionally, assume that q_i=βαs_i+n_iwhere n_iare i.i.d. complex Gaussians and αε{1−ε, 1+ε}. Calculating likelihood ratios, the optimal decision rule when P is known is given by $\begin{array}{cc}\sum _{i\in N_1}\mathrm{Re}\left(q_i^{*}{s}_i\right)\beta \sum _{i\in N_1}{\left|s_i\right|}^2\begin{array}{c}{b}_{n}1\\ >\\ <\\ b_{n}0\end{array}\sum _{i\in N_2}\mathrm{Re}\left(q_i^{*}{s}_i\right)\beta \sum _{i\in N_2}{\left|s_i\right|}^2& \text{Equation 15}\end{array}$

[0115] Note that in the case Σ_iεN1|si|²=Σ_iεN2|si|², this reduces to $\begin{array}{cc}\frac{\sum _{i\in N_1}\mathrm{Re}\left(q_i^{*}{s}_i\right)}{\sum _{i\in N_1}{\left|s_i\right|}^2}\begin{array}{c}{b}_n=1\\ >\\ <\\ b_n=0\end{array}\frac{\sum _{i\in N_2}\mathrm{Re}\left(q_i^{*}{s}_i\right)}{\sum _{i\in N_2}{\left|s_i\right|}^2}& \text{Equation 16}\end{array}$

[0116] so that β need not, in fact, be known. In this case it is optimal to form estimates as described above, one each for R_n,1and R_n,2, at step 110, and then to take the comparative difference, at step 112. If R_n,1and R_n,2are chosen contiguous and of equal area, then it can be expected that Σ_iεN1|si|²∝Σ_iεN2|Si|².

[0117] Since it is desirable that the watermark survive cropping, the areas R_n,1and R_n,2shall not be too small. Thus, Ã(u,v) may not be sufficiently close to a constant. Fortunately, the “differential encoding” procedure presented above can be generalized.

[0118] Referring now to FIG. 8, a generalized procedure for differential encoding may be carried out according to the following steps. One may consider and select, at step 114, for example, a smooth function f supported on a rectangular domain R. Suppose R is subdivided into m uniform columns and n uniform rows, at step 116, where nm is even, creating a grid. Next, assume that the grid is colored in a black-and-white checkerboard pattern, at step 118. Then Let f_wdenote the average of f over the white squares and let f_bdenote the average of f over the black squares, at step 120. As m and n tend to infinity, f_wand f_bboth tend to f_R, the average of f over R. In particular, (1+ε)f_w−(1−ε)f_btends to 2εf_R. More specifically, if f is expanded in a Taylor series about the center of R, at step 122, and m=n=2, then f_w−f_bdepends only on terms of order greater than or equal to 2.

[0119] One may consider the decision rule given by equation 16 and write qi=β_is_iwhere β_idiscretizes in the plane Ã(u,v) and assume that N₁and N₂are given by a 2×2 checkerboard as described above. Assume that |Si|²is a discretized smooth function S in the plane and consider the center of the checkerboard to be the origin. It follows that the sums Σ_iεN1|Si|², Σ_iεN2|Si|², are both equal to the 0th order term of S plus other terms depending only on terms of order of at least 2. Assuming that |Si|²can be modeled as S plus zero-mean i.i.d. noise, then the sums above have an additional random component with a variance inversely proportional to |N₁| and |N₂|, respectively.

[0120] Assuming that Σ_iεN1|Si|²=Σ_iεN2|Si|², then the decision rule amounts to comparing two sums. If it is assumed that A(u,v) and S are smooth, then the sums are equal up to second order terms. Even without assuming that Σ_iεN1|Si|²=Σ_iεN2|Si|², it follows that the difference of the sums depends only on terms of the order of at least 2.

[0121] Other variations on the decision rule are possible. For example, β may be estimated as $\frac{1}{2}*\frac{\sum _{i\in N_i}\mathrm{Re}\left(q_i^{*}{s}_i\right)}{\sum _{i\in N_i}{\left|s_i\right|}^2}+\frac{1}{2}*\frac{\sum _{i\in N_2}\mathrm{Re}\left(q_i^{*}{s}_i\right)}{\sum _{i\in N_2}{\left|s_i\right|}^2}$

[0122] and then substituted into equation 15. In our experiments, the resulting rule gave the same bit errors as those obtained using equation 16.

[0123] Referring to FIGS. 9 through 13, the watermarking and watermark recovery methods described above were extensively tested on a set of three 512×512 grey level 8-bit images, chosen from an art library database. The images comprise cropped grey level versions of paintings by Renoir (FIG. 9(a)), Michelangelo (FIG. 9(b)) and Botticelli (FIG. 9(c)). The multiplicative process discussed above comprised the method chosen for watermark embedding. As disclosed in the method, the magnitude of the 512×512 fourier transform of these images was multiplied by a mask function M(u,v|B) dependent on a vector B of 120 binary digits {b_m,nε{+1, −1}, m=1,2 . . . ,8, n=1,2, . . . , 15}. The geometry of the mask was chosen to be a very simple one. If one regards the frequency domain corresponding to the 512×512 images as [−1,1 ]×[−1,1] and introduces polar coordinates (r,θ) then R_m,n, the region reserved for embedding bit ban, is defined by $R_{m,n}=\left[\left(r,\theta \right)\text{:}r\in \left[\left(m-1\right)\frac{1}{15},m\frac{1}{15}\right],\theta \in \left[\left(n-1\right)\frac{\pi }{8},n\frac{\pi }{8}\right]\right]$

[0124] Recall that the M(u,v|B) must satisfy the symmetry property M(u,v|B)=M(−u,−v|B) so that each region R_m,nis also duplicated by reflection about the origin. Each region R_m,nrectangular in polar coordinates, was then subdivided into a 2×2 rectangular array for differential encoding, as described above in step 116 (FIG. 8). FIGS. 9(g) through 9(i) illustrate examples of M(u,v|B).

[0125] The watermarked version of each test image I(x,y), requantized by rounding and clipping, and shown in FIGS. 9(d)-9(f), was defined to be

[0126] I^W(x,y)=FT⁻¹[1+εM(u,v|B)I(u,v)]

[0127] FIGS. 10, 11 and 12 show, respectively, the Botticelli, the Michelangelo and the Renoir test images watermarked with an arbitrary B vector, and various gain factors ε=0.0, 0.05, 0.1, 0.2. We can see that for ε=0.05, the value chosen for the subsequent tests, and ε=0.01, the watermarked images are virtually indistinguishable from their original. FIGS. 9(a) through 9(i) show watermarked versions of each of the three test images with pseudo-random watermark information bit sequences B and ε=0.05. The ideal local watermark recovery is not perfect due to the requantization of the watermarked images. However, 120 bits of data are perfectly recovered by the optimal watermark estimation procedure in spite of this.

[0128] After these initial tests addressing the effects of requantization alone on the watermark recovery, several others were performed in order to see how the 120 bits of watermark data would be affected by various degradations of the watermarked images. As already noted herein, the various degradations and modifications that affect the watermark include:

[0129] 1. cropping portions of the image;

[0130] 2. lossy compression-decompression cycles (with the standard JPEG algorithm);

[0131] 3. changes in contrast;

[0132] 4. printing on standard laser printers and rescanning the image (with possible cropping).

[0133] In order to test for watermark survival after printing-cropping-rescanning degradation, it is necessary to solve the rather delicate problem of registering the rescanned and possibly cropped image with the original. Recall that the watermark detection mechanism assumes the availability of two images or image portions in perfect registration.

[0134] Let f represent an image which may be a degraded sub-image of a watermarked image whose original may be denoted by g. Let Ω denote the rectangle over which f is defined. One may register f, using a multi-resolution hill climbing algorithm, by finding an affine transformation ψ which minimizes the following function ${\int }_{\Omega }\frac{g\left(\Psi \left(x\right)\right)-\stackrel{\_}{g}}{\Vert g\left(\Psi \left(x\right)\right)-\stackrel{\_}{g}\Vert }*\frac{f\left(x\right)-\stackrel{\_}{f}}{\Vert f\left(x\right)-\stackrel{\_}{f}\Vert }$

[0135] where

[0136] {overscore (g)}:=∫_Ωg(ψ(x))dx

[0137] {overscore (f)}:=∫_Ωf(x)dx.

[0138] Once the desired ψ is found, the image may be resampled appropriately.

[0139] We performed several cropping tests on the three images shown in FIGS. 9(a)-(c), with cropped portions of respective 256×256 sizes. Typically, the bits were recovered with about 6 percent errors. FIGS. 13(a)-(i) show the watermark recovery results. Here, perfect alignment/registration was assumed with the original. The few detected errors resided in the low frequency components. This is undoubtedly due to the relatively small area reserved for bits embedded into these components.

[0140] With respect to images subjected to JPEG compression, the watermarked images were taken (ε=0.05) and compressed using a standard JPEG algorithm with a quality factor of 20 percent. As seen in FIGS. 14(a)-(d) and 15(a)-(i), considerable visible degradations and blocking effects occurred in the images.

[0141] In all three images, the first (i.e., corresponding to low frequency) 55 bits of the watermark string B were recovered correctly and at least 90 of the 120 bits were correctly recovered. With higher quality factors the results would be better. As seen in the spectral image of the watermark recovery, the high frequencies are, not surprisingly, strongly affected by compression. Hence, the bits embedded in this range of the spectrum should not be expected to survive. Noticeably important, however, is the finding that due to the “differential” encoding of each bit, the low-range encoded information remains intact in spite of the fact that the compression process effectively scales the spectrum with a varying gain envelope. This is apparent by referring to FIGS. 15(a)-(i).

[0142] The cycle of degradations involving printing and cropping followed by image rescanning was the most severe test applied to the watermarks. First, the watermarked originals were printed on a 600 dpi laser printer, then scanned with a typical color image scanner at a resolution of 150 dpi. The above described general purpose multi-resolution image registration procedure for generating an optimally registered 512×512 image for each of the three rescanned images shown in FIG. 8 was implemented. Also generated were 256×256 optimally registered sections of the images, from three arbitrarily cropped portions of the rescanned originals. On these six redigitized images, the optimal watermark recovery algorithm was performed. The results are shown in FIGS. 16(a)-(i) and 17(a)-(i). In this case, 105 bits were recovered correctly out of the 120 that were embedded into the watermarked images. The results apply to uncropped images and 95 bits when using the optimally registered, redigitized cropped image sections one quarter in area. From these experimental results, it may be concluded that even under such severe degradations, one may expect to recover 90 bits out of the 120. Practically, this mostly involves the bits embedded into the lower frequency range.

[0143] With respect to images undergoing contrast changes, the image contrast was adjusted in a non-linear way. This was performed by adjusting the intensity value using a Gamma value of 2. The results are shown in FIGS. 18(a)-(i). The point-wise ratio exhibits apparently random noise while the overall brightening of the image reduces contrast and hence the energy in much of the spectrum. Because of the “differential” encoding, all of the bits in each image were nonetheless recovered correctly.

[0144] From our experiments, one of the important conclusions we arrived at included using the lower part of the frequency spectrum for watermarking without the vicinity of the DC component.

[0145] In our experiments we chose, rather arbitrarily, to encode the information in 120 sections in the entire spectral domain, with approximately equal energy under the assumption that the spectrum decayed as 1/r in amplitude from the center. This rather arbitrary choice is capable of customization and optimization, and we could have decided to use a lower section of the spectral domain. Moreover, we could have selected fewer bits to encode and made sure that all regions chosen have exactly the same energy.

[0146] Our experiments also confirmed the feasibility of using differential encoding of the bits. Various nonlinear degradations may be modeled by a rather smooth multiplicative mask in the frequency domain. The differential encoding method handles such degradations well. This method, too, can be refined and adapted to more specific information, assuming information availability, on the various degradations following compression-decompression cycles, printing and rescanning etc.

[0147] Additionally, the experiments support the use of error-correction for the bits strings embedded as watermarks.

[0148] With the arbitrary choice of embedding 120 bits in the entire frequency domain corresponding to the 512×512 images, we can typically recover the bits with less than 25 errors. This shows that an error correcting code could safely enable us to embed about 60 error-free information bits into the images we experimented with. This is more than enough for practical purposes.

[0149] There arises in this context the following issue: how can the recovered watermark bits be used to guarantee the identity associated with the image. If we can recover 60 error-free bits with a high probability, then 20-30 bits should be sufficient to encode the identity. We can then guarantee that all valid 60 bit watermarks are well separated in Hamming distance so that if the recovered 60 bits are valid, then the probability that those are the correct 60 bits uniquely identifying the source and recipient of the image will be very high. This probability value attached to the recovered watermark could be further refined by using soft decoding, for example.

[0150] Those skilled in the art will appreciate the many benefits and advantages afforded by the present invention. Significantly, watermarks embedded by the system and method of the present invention are imperceptible and have the ability to carry predetermined information. Moreover, the watermarks are distinguishable from one or more differently tagged copies of the image and are easily recoverable from a tagged image and the original image.

[0151] As a desirable security feature, attempts to remove the watermarks have noticeable ill-effects on the image. Additionally, image modification and compression algorithms have a relatively minor effect on the tags. Also important is the image cropping survival capability realized through distribution of the watermark in the image plane.

[0152] While the invention has been particularly shown and described with reference to the preferred embodiments thereof, it will be understood by those skilled in the art that various changes in form and detail may be made therein without departing from the spirit and scope of the invention.