Stochastic Image Warping for Improved Watermark Desynchronization
 Angela D'Angelo^{1}Email author,
 Mauro Barni^{1} and
 Neri Merhav^{2}
DOI: 10.1155/2008/345184
© Angela D’Angelo et al. 2008
Received: 28 November 2007
Accepted: 19 March 2008
Published: 30 March 2008
Abstract
The use of digital watermarking in real applications is impeded by the weakness of current available algorithms against signal processing manipulations leading to the desynchronization of the watermark embedder and detector. For this reason, the problem of watermarking under geometric attacks has received considerable attention throughout recent years. Despite their importance, only few classes of geometric attacks are considered in the literature, most of which consist of global geometric attacks. The random bending attack contained in the Stirmark benchmark software is the most popular example of a local geometric transformation. In this paper, we introduce two new classes of local desynchronization attacks (DAs). The effectiveness of the new classes of DAs is evaluated from different perspectives including perceptual intrusiveness and desynchronization efficacy. This can be seen as an initial effort towards the characterization of the whole class of perceptually admissible DAs, a necessary step for the theoretical analysis of the ultimate performance reachable in the presence of watermark desynchronization and for the development of a new class of watermarking algorithms that can efficiently cope with them.
1. Introduction
Geometric transformations whereby the watermark embedder and detector are desynchronized are known to be one of the most serious threats against any digital watermarking scheme. In the case of still images, for which desynchronization attacks (DAs) can be easily implemented by applying a geometric transformation to the watermarked image, DAs are of the outmost importance, since failing to cope with them would nullify the efficacy of the whole watermarking system.
In the general case, a geometric distortion can be seen as a transformation of the position of the pixels in the image. It is possible to distinguish between global and local geometric distortions. A global transformation is defined by an analytic function that maps the points in the input image to the corresponding points in the output image. It is defined by a set of operational parameters and performed over all the image pixels. Local distortions, instead, refer to transformations affecting in different ways the position of the pixels of the same image or affecting only part of the image. The random bending attack [1], contained in the Stirmark utility, is the most famous example of a local geometric transformation.
Global geometric transformations, especially rotation, scaling, and translation, have been extensively studied in the watermarking literature given their simplicity and diffusion. Though no perfect solution exists to cope with geometric attacks, DAs based on global transformations can be handled in a variety of ways, including exhaustive search [2, 3], templatebased resynchronization [4–6], selfsynchronizing watermarks [7, 8], and watermarking in invariant domains [9]. In all the cases, the proposed solutions rely on the restricted number of parameters specifying the DA. For instance, it is the relatively low cardinality of the set of possible attacks that makes the estimation of the geometric transformation applied by the attacker via exhaustive search or template matching possible (computationally feasible). For this reason, recovering from localized attacks is much harder than recovering from a global attack. A possibility to overcome this problem in case of local attacks could split the search into a number of local searches. However, in this way, it is likely that the accuracy of the estimation is reduced, given that the estimation would have to rely on a reduced number of samples.
Despite the threats they pose, local geometric transformations have received little attention by the watermarking community. In practice, only the random bending sttack (RBA) contained in the Stirmark software has been studied to some extent. However, even in this case, the real desynchronization capabilities of RBA are not fully understood, given that as implemented in Stirmark, RBA consists of three modules with only one corresponding to a truly local geometric transformation [1].
 (i)
to introduce two new classes of local DAs that extend the class of local geometric attacks for still images;
 (ii)
to evaluate the effectiveness of the new attacks and compare them with the classical RBA.
For the above goals, the perceptual impact of the DAs is taken into account since this is the only factor limiting the choice of the attacking strategy. The two models we propose can be seen as a first step towards the characterization of the whole class of perceptually admissible DAs, which in turn is an essential step towards the development of a new class of watermarking systems that can effectively cope with them.
This paper is organized as follows. In Section 2, we describe the RBA contained in the Stirmark software. In Section 3, we introduce a new class of local desynchronization attacks, the LPCD DAs, applied in a full and multiresolution framework. In Section 4, a class of attacks based on Markov random fields is presented. In Section 5, we evaluate the effectiveness of the two new classes of DAs using two simple watermarking systems based on the DCT and DWT transforms. Finally, in Section 6, we summarize the contribution of this work and propose some ideas for future research.
In order to ensure the reproducibility of the experimental results the software, we used for the experiments is available on the web site http://www.dii.unisi.it/~vipp, furthermore a pseudocode description of the algorithms is provided in order to link the software to the global description of the algorithms.
2. Stirmark Rba
The Stirmark benchmark software first explored RBA's ability to confuse watermark detection. In most of the scientific literature, by RBA, the corresponding geometric attack implemented in the Stirmark software is meant [10], however such an attack is not a truly local attack since it couples three different geometric transformations applied sequentially, only the last of which corresponds to a local attack.
where and are two frequencies (usually smaller than 1/20) that depend on the image size, and and are random numbers in the interval . However, (3) is the only local component of the Stirmark attack since it introduces a random displacement at every pixel position. In the sequel by RBA, we will mean only the transformation expressed by (3). This can be obtained by using the Stirmark software setting to the , and parameters (resp., the bending factor, the maximum variation of a pixel value, the maximum distance a corner can move inwards and outwards), and leaving (the randomisation factor) to the default value of .
3. The Class of Lpcd Das
In this section, we describe a first new class of DAs, namely, local permutation with cancelation and duplication (LPCD) DAs. We start from the plain LPCD attack, then we pass to the CLPCD (constrained LPCD). Finally, we consider the multiresolution extension of the above two classes.
3.1. Lpcd
The above interpretation of the LPCD model may open the way to the definition of optimum embedding and detection strategies along the same lines described in [11].
where is the original image and and are i.i.d. integer random variables uniformly distributed in the interval .
3.2. CLpcd
An important limitation of the LPCD model is the lack of memory. This is likely to be a problem from a perceptual point of view: with no constraints on the smoothness of the displacement field, there is no guarantee that the set of LPCD distortions is perceptually admissible even by considering very small values of .
The CLPCD model can be mathematically described by resorting to the theory of Markov chains. For simplicity, let us focus again on the onedimensional case. It is possible to design a Markov chain whose states correspond to the possible sizes of the interval .
where each element of the matrix is the transition probability of going from state to state .
A visual inspection conducted on a set of images distorted with the CLPCD model reveals that changing the value of does not change the perceived intensity of the deformation.
By looking at the figure, it is possible to note that regardless of the value of , all the states have almost the same limit probabilities.
The extension of the CLPCD model to the 2D case is obtained by applying the 1D algorithm by rows to obtain the horizontal displacement field , and by columns for the vertical displacements .
3.3. Multiresolution Extension
To make the distortion less perceptible, we considered a multiresolution version of the LPCD and CLPCD attacks, whereby the DAs are applied at different resolutions to obtain the global displacement field: a lowresolution displacement field is first generated, then a fullsize displacement is built by means of a bicubic interpolation. The full resolution field is applied to the original image to produce the distorted image.
As opposed to the original version of LPCD and CLPCD, however, the presence of noninteger displacements is now possible due to the interpolation. To account for this possibility, whenever the displacement vector points to noninteger coordinates of the original image, the gray level of the attacked image is computed by means of the bicubic interpolation. While the above interpolation does not have a significant impact on the visual quality of the attacked image, the possible introduction of new gray levels, which were not present in the original image, complicates the LPCD and CLPCD models, by making it more difficult to describe the attacked signal as a hidden Markov process (as we did in Section 3.1).
The pseudocode description of the multiresolution version of LPCD DAs is provided by Algorithms 1 and 2.
3.4. Cardinality Evaluation
A measure of the difficulty of coping with a given type of DA is given by the cardinality of the attack class. In fact, the larger is the DA space, the more difficult will be to recover the synchronization between the embedded and the detector, both in terms of complexity and accuracy. As a matter of fact, it is possible to show [3, 11] that as long as the cardinality of the DAs is subexponential, the exhaustive search of the watermark results in asymptotically optimum watermark detection with no loss of accuracy with regard to falsedetection probability. By contrast, when the size of the DA is exponential, simply considering all the possible distortions may not be a feasible solution both from the point of view of computational complexity and detection accuracy [11]. In order to evaluate the cardinality of the classes of DAs, the perceptual impact of LPCD and CLPCD must be taken into account. Thus, we first found the limits of the model parameters by means of perceptual considerations, then we estimated the cardinality of the various classes of LPCD DAs.
Let us observe that from a perceptual point of view, LPCD DAs have a different behavior for different values of and for different levels of resolution , in particular, the image quality increases if the attacks are applied to a lower level of resolution (larger ) but, at the same time, the number of possible distortions decreases.
In a previous work [13], both subjective and objective tests were performed to establish the sensitivity of the human visual system to the geometric distortions introduced by the LPCD model as a function of the control parameters and . This way, the authors were able to identify the range of values of the control parameters that do not affect image quality: for each level of resolution, the maximum value of that can be used while keeping the distortion invisible was found. For instance, in the case of images of size , the maximum admissible geometric distortions are obtained by using for the LPCD model and , or for the CLPCD model (for higher level of resolution, it is not possible to find an adequate value of resulting in an invisible distortion).
We can now use the above considerations to estimate the cardinality of the class of LPCD DAs. For the LPCD model, the number of possible admissible geometric distortions is simply equal, neglecting the boundary effects, to , where is the size of the image. Then, if we consider a image, and if we take into account the perceptual analysis in [13], then we obtain different attacked images.
Cardinality evaluation of the LPCD attacks: in the first row, the number of possible distortions is reported, the second row refers to the number of typical sequences.
LPCD  CLPCD  CLPCD  

Cardinality 







The knowledge of the entropy rate of the Markov chain and the asymptotic equipartition property (AEP) [14] help us to find the number of possible distortions that can be generated with a sodefined Markov chain, since it asymptotically corresponds to the number of typical sequences, that is, . After some algebraic manipulations, we find that in the case of CLPCD with and , is approximately equal to bits and the number of different distortions that is possible to generate is . In the same way, in the case of CLPCD with and , it is possible to generate different distortions. By looking at Table 1, we can see that, as we expected, the cardinality of CLPCD evaluated by considering the entropy rate of the Markov chain (second row) is much smaller than the number of possible distortions (first row). We conclude this section by observing that the size of both the LPCD and the CLPCD DAs exhibit an exponential growth, with the constrained model resulting in a higher growth rate. For this reason, both classes of attacks are likely to make watermark detection rather difficult, and will need to be carefully considered in future works on DAresistent watermarking.
4. Markov Field Da (mfDa)
One problem with the CLPCD attack is that it does not take into account the twodimensional nature of images since it is based on a onedimensional Markov chain. To overcome this limitation, we introduce a new class of DAs based on the theory of Markov random fields. We will refer to this new class of attacks as MFDA.
Markov random field theory is a branch of probability theory for analyzing the spatial or contextual dependencies of physical phenomena. The foundations of the theory of Markov random fields may be found in statistical physics of magnetic materials (Ising models, spin glasses, etc.) and also in solids and crystals, where the molecules are arranged in a lattice structure and there are interactions with close neighbors (e.g., Debye's theory for the vibration of atoms in a lattice is based on a model of quantum harmonic oscillators with coupling among nearest neighbors). Markov random fields are often used in image processing applications, because this approach defines a model for describing the correlation among neighboring pixels [15].
4.1. Model Description
Many vision problems can be posed as labeling problems in which the solution of a problem is a set of labels assigned to image pixels or features. A labeling problem is specified in terms of a set of sites and a set of labels. Let be a discrete set of sites in which are indices (a site often represents a point or a region in the Euclidean space such as an image pixel or an image feature). A label is an event that may happen to a site. Let be a set of labels. The labeling problem is to assign a label from to each of the sites in . In the terminology of random fields, a labeling is called a configuration.
The sites in are related to one another via a neighborhood system. A neighborhood system for is defined as , where is the set of sites neighboring . The neighboring relationship has the following properties:
 (1)
a site is not neighboring to itself: ,
 (2)
the neighboring relationship is mutual: .
Once introduced a set and a neighborhood system , it is possible to define a clique for like a subset of sites in . It consists either of a singlesite (singlesite clique), or a pair of neighboring sites (pairsites cliques), or a triple of neighboring sites (triplesites cliques), and so on.
The collection of all cliques for is denoted by .
A random field is a family of random variables defined on a set , in which each random variable takes a value in a set of labels .
denotes the set of values at the sites neighboring , that is, the neighborhood centered at position . The positivity is due to technical reasons, since it is a necessary condition if we want the HammersleyClifford theorem (see below) to hold [16].
is a sum of cliques potentials, , over all possible cliques . Thus the value of depends on the local configuration on the clique . The practical value of the theorem is that it provides a simple way of specifying the joint probability. Since measures the probability of the occurrence of a particular configuration, we know that the more probable configurations are those with lower energies.
In our case, we can model geometric attacks with a random field defined on the set of the image pixels. The value assumed by each random variable represents the displacement associated to a particular pixel. Specifically, for each pixel, we have two values for the two directions and . For this reason, each variable is assigned a displacement vector . The advantage brought by MRF theory is that by letting the displacement field of a generic point of the image depend on the displacement fields of the other points of its neighborhood (let us indicate this set with the notation ), we can automatically impose that the resulting displacement field is smooth enough to avoid annoying geometrical distortions.
where and are the components of the displacement vector associated to the pixel , is a point belonging to the 4neighborhood of , and are the x,y components of the displacement vector associated to the pixel and and are the two components of the standard deviation vector (these values are controlled by perceptual constraints).
A typical application of MRF in the image processing field is to recover the original version of an image (or a motion vector field) by relying on a noisy version of the image. By assuming that the original image can be described by means of an MRF, the above problem is formulated as a maximum a posteriori estimation problem. Thanks to the HammersleyClifford theorem, this corresponds to an energy minimization problem that is usually solved by applying an iterative relaxation algorithm to the noisy version of the image [16]. The problem we have to face here, however, is slightly different. We simply want to generate a displacement field according to the Gibbs probability distribution defined by (16) and the particular potential function expressed in (18).
Note that in the above equation, the displacements of the pixels in the neighborhood of are fixed, hence resulting in a local minimization of the Gibbs potential. After each pixel is visited and the corresponding displacement gets updated, a new iteration starts. The algorithm ends when no new modification is introduced for a whole iteration, which is usually the case after 78 iterations.
4.2. Perceptual Analysis
In order to evaluate the potentiality of the MFDA class of attacks, the perceptual impact of the distortion they generate must be taken into account. From a perceptual point of view, MRF DAs have a different behavior for different values of , , and , in particular, the image quality increases if the attacks are generated at a lower level of resolution but, in the meantime, the number of possible distortions decreases.
After a visual inspection conducted on a set of images, we found, for each level of resolution, the maximum value of the components and that can be used while keeping the distortion invisible. Specifically, we found that, in case of images of size , the larger perceptually admissible displacements are obtained by using and .
Regarding the cardinality evaluation of this new class of DAs, in principle all the displacement fields are allowed, with the most annoying distortions corresponding to very low probabilities (and thus very large Gibbs potential). In order to evaluate the cardinality of the MFDA class, then, a first step would be to calculate the entropy rate of the field. However, this is a prohibitive task given that no technique is known to calculate the entropy rate of even the simplest MRFs.
5. Desynchronization Properties of The Various Das
In this section, we evaluate the desynchronization capability of the various classes of attacks. To do so, two very simple watermarking algorithms were implemented and the ability of the various DAs to inhibit watermark detection was evaluated. The source image database used for the experiments includes the six standard images: Baboon, Barbara, Boats, Goldhill, Lena, and Peppers. The source image database and the software we used for the experiments are available on http://www.dii.unisi.it/~vipp.
The tested algorithms include
 (i)
blind additive spread spectrum in the frequency domain (BSSF),
 (ii)
blind additive spread spectrum in the wavelet domain (BSSW).
In both the systems, the watermark consists of a sequence of bits ; each value being a random scalar that is either or with equal probability.
where is the embedding strength and PN is a uniformly distributed pseudorandom sequence of and . (20) refers to the embedding of one bit, the extension to multiple bits consists of applying (20) for each bit considering each time a different subset of 0 and a different PN sequence (a moredetailed description of the watermark embedding is given by the Algorithm 4).
In watermark detection, the DCT is applied to the watermarked (and possibly attacked) image, the DCT coefficients are reordered into a zigzag scan, and the coefficients from the th to the are selected to generate a vector . For each bit, the correlation coefficient between the corresponding subset of the vector and a new PN sequence is evaluated and compared to a threshold (equal to ) to recover the embedded bit.
In the BSSW watermarking system, the watermark is added to the DWT coefficients of the three largest detail (i.e., LH, HL, HH) subbands of the image. The embedding and decoding functions are implemented in the same way of the previous system but the watermark is inserted in the wavelet coefficients obtained with a onestep wavelet decomposition. A moredetailed description of the two watermarking systems is given by the Algorithms 6, 7, 8, and 9.
Value of the parameters used for the experiments.
Parameter  Value  

Stirmark  b  0 
d  0  
i  0  
o  0  
R  0.1  
MFDA  c 

DCT system  k  5 
L  25000  
M  16000  
DWT system  k  2 
For both the systems, the RBA attack is not able to prevent a correct watermark decoding, in fact, the RBA plot is not visible in the figures because the biterror rate is always equal to zero. A more powerful class of DAs is the LPCD DAs that in both the systems gives a biterror rate much higher than the RBA attack. The MFDA always results in a very high biterror rate also applying the attack to a lower level of resolution.
6. Conclusion
In this paper, we introduced two new classes of desynchronization attacks that extend the class of local geometric attacks so to allow for more powerful attacks with respect to classical RBA. The effectiveness of the new classes of DAs is evaluated from different perspectives including perceptual intrusiveness and desynchronization efficacy. The experimental results showed that the two new classes of attacks are more powerful than the local geometric attacks proposed so far.
This work can be seen as a first step towards the characterization of the whole class of perceptually admissible DAs, which in turn is an essential step towards the development of a new class of watermarking systems that can effectively cope with them.
Future works may include the development of a perceptual metric suited for geometric distortions and the use of new potential functions.
 1.
Read image to be attacked Y, read size of the window , read level of resolution
 2.
size of the low resolution displacement field
 3.
Initialize matrices and of horizontal and vertical displacement fields to
 4.
for do
 5.
for do
 6.
If or then
 7.
and are randomly chosen in
 8.
else if or then
 9.
and are randomly chosen in
 10.
else
 11.
and are randomly chosen in
 12.
end if
 13.
end for
 14.
end for
 15.
Resize the displacement fields given by and to the image size through
bicubic interpolation provided by the matlab function to obtain
 16.
for do
 17.
for do
 18.
Apply the displacement fields
to the image, to obtain the attacked image Z, by means of bicubic
 19.
end for
 20.
end for
 1.
Read image to be attacked, read size of the window , read level of resolution
 2.
size of the low resolution displacement field
 3.
Initialize matrices and of horizontal and vertical displacement fields to
 4.
for do
 5.
for do
 6.
if or then
 7.
and are randomly chosen in
 8.
else if or Then
 9.
and are randomly chosen in
 10.
else
 11.
is chosen in with a
 12.
is chosen in with a
 13.
end if
 14.
end for
 15.
end for
 16.
Resize the displacement fields given by and to the image size through
bicubic interpolation provided by the matlab function to obtain
 17.
for do
 18.
for do
 19.
Apply the displacement fields
to the image, to obtain the attacked image Z, by means of bicubic
 20.
end for
 21.
end for
 1.
Read image to be attacked, read level of resolution , read standard deviation , read
 2.
size of the low resolution displacement fields and
 3.
Initialize matrices and with random values in the interval
 4.
 5.
 6.
while and are do
 7.
 8.
 9.
row = randperm(dim);
 10.
col = randperm(dim);
 11.
for do
 12.
for do
 13.
i = col(1, k);
 14.
j = row(1, h)
 15.
Find the optimum
displacements and , i.e. the ones minimizing the potential
 16.
 17.
 18.
end for
 19.
end for
 20.
 21.
 22.
end while
 23.
Resize the displacement fields given by and to the image size through
bicubic interpolation provided by the matlab function to obtain
 24.
for do
 25.
for do
 26.
Apply the displacement fields
to the image, to obtain the attacked image Z, by means of bicubic
 27.
end for
 28.
end for
 1.
Read position of the pixel , matrices of displacement fields and ,
 2.
 3.
 4.
Initial potential
 5.
for do
 6.
for do
 7.
 8.
if then
 9.
 10.
 11.
 12.
end if
 13.
end for
 14.
end for
 15.
 16.
 17.
return and
 1.
Read position of the pixel , displacements and , matrices of
 2.
is a first order
 3.
 4.
 5.
return Potential
 1.
Read image to be watermarked, length of the watermark , energy of the
 2.
Generate a random long message
 3.
Perform fullframe DCT
 4.
Reorder the DCT coefficients into a zigzag scan
 5.
Select the coefficients: middle
 6.
for bit = 1: do
 7.
Generate an antipodal PN sequence of length
 8.
and
 9.
if bit = 0 then
 10.
 11.
else
 12.
 13.
end if
 14.
end for
 15.
Reinsert the vector in the zigzag scan
 16.
Perform inverse scan
 17.
Perform inverse full frame DCT
 18.
Save watermarked image and message
 1.
Read watermarked image, seed key, length of the watermark and load
 2.
Perform full frame DCT transform
 3.
Reorder the DCT coefficients into a zigzag scan
 4.
Select the coefficients: middle
 5.
for bit = 1: do
 6.
Generate an antipodal PN sequence of length
 7.
Compute the correlation coefficient as expressed in (21) between
 8.
end for
 9.
for bit = 1: do
 10.
if correlation(bit) > 0 Then
 11.
extracted_message(bit) = 0
 12.
else
 13.
extracted_message(bit) = 1
 14.
end if
 15.
end for
 16.
return Bit Error Rate
 1.
Read image to be watermarked, length of the watermark , energy of the
 2.
Generate a random long message
 3.
Perform a one step wavelet decomposition using Haar filter
 4.
Reorder the LH, HL and HH components into a vector
 5.
for bit = 1: do
 6.
Generate an antipodal PN sequence of length
 7.
and
 8.
if bit = 0 then
 9.
 10.
else
 11.
 12.
end if
 13.
end for
 14.
Perform a one step inverse wavelet decomposition using Haar filter
 15.
Save watermarked image and message
 1.
Read watermarked image, seed , length of the watermark and load
 2.
Perform a one step wavelet decomposition using Haar filter
 3.
Reorder the LH, HL and HH components into a vector
 4.
for bit = 1: do
 5.
Generate an antipodal PN sequence of length
 6.
Compute the correlation coefficient as expressed in (21) between
 7.
end for
 8.
for bit = 1: do
 9.
if correlation(bit) > 0 then
 10.
extracted_message(bit) = 0
 11.
else
 12.
extracted_message(bit) = 1
 13.
end if
 14.
end for
 15.
return Bit Error Rate
Declarations
Acknowledgment
This work was supported by the Italian Ministry for University and Research, under FIRB Project no. RBIN04AC9W: "Image watermarking in the presence of geometric attacks, theoretical analysis, and development of practical algorithm."
Authors’ Affiliations
References
 Petitcolas FAP: Stirmark benchmark 4.0. http://www.petitcolas.net/fabien/watermarking/stirmark
 Lichtenauer J, Setyawan I, Kalker T, Lagendijk R: Exhaustive geometrical search and the false positive watermark detection probability. Security and Watermarking of Multimedia Contents V, January 2003, Santa Clara, Calif, USA, Proceedings of SPIE 5020: 203214.View ArticleGoogle Scholar
 Barni M: Effectiveness of exhaustive search and template matching against watermark desynchronization. IEEE Signal Processing Letters 2005,12(2):158161.MathSciNetView ArticleGoogle Scholar
 Voloshynovskiy S, Deguillaume F, Pun T: Multibit digital watermarking robust against local non linear geometrical distortions. Proceedings of IEEE International Conference on Image Processing (ICIP '01), October 2001, Thessaloniki, Greece 3: 9991002.Google Scholar
 Pereira S, Pun T: Fast robust template matching for affine resistant image watermarking. Proceedings of the 3rd International Workshop on Information Hiding (IH '99), SeptemberOctober 1999, Dresden, Germany, Lecture Notes in Computer Science 1768: 199210.Google Scholar
 Pereira S, Ruanaidh JJKO, Deguillaume F, Csurka G, Pun T: Template based recovery of Fourierbased watermarks using logpolar and loglog maps. Proceedings of the 6th IEEE International Conference on Multimedia Computing and Systems (ICMCS '99), June 1999, Florence, Italy 1: 870874.View ArticleGoogle Scholar
 Delannay D, Macq B: Generalized 2D cyclic patterns for secret watermark generation. Proceedings of IEEE International Conference on Image Processing (ICIP '00), September 2000, Vancouver, BC, Canada 2: 7279.Google Scholar
 Kutter M: Watermarking resistance to translation, rotation, and scaling. Multimedia Systems and Applications, November 1998, Boston, Mass, USA, Proceedings of SPIE 3528: 423431.View ArticleGoogle Scholar
 Lin CY, Wu M, Bloom JA, Cox IJ, Miller ML, Lui YM: Rotation, scale, and translation resilient watermaking for images. IEEE Transactions on Image Processing 2001,10(5):767782. 10.1109/83.918569MATHView ArticleGoogle Scholar
 Petitcolas FAP, Anderson RJ: Evaluation of copyright marking systems. Proceedings of the 6th IEEE International Conference on Multimedia Computing and Systems (ICMCS '99), June 1999, Florence, Italy 1: 574579.View ArticleGoogle Scholar
 Merhav N: An informationtheoretic view of watermark embeddingdetection and geometric attacks. Proceedings of the 1st Wavila Challenge Workshop (WaCha '05), June 2005, Barcelona, SpainGoogle Scholar
 Barni M, D'Angelo A, Merhav N: Expanding the class of watermak desynchronization attacks. Proceedings of the 9th ACM Workshop on Multimedia and Security (MMSec '07), September 2007, Dallas, Tex, USA 195204.Google Scholar
 D'Angelo A, Menegaz G, Barni M: Perceptual quality evaluation of geometric distortions in images. Human Vision and Electronic Imaging XII, January 2007, San Jose, Calif, USA, Proceedings of SPIE 6492:12.View ArticleGoogle Scholar
 Cover T, Thomas J: Elements of Information Theory. John Wiley & Sons, New York, NY, USA; 1991.MATHView ArticleGoogle Scholar
 Li S: Markov Random Field Modeling in Computer Vision. Springer, London, UK; 1995.View ArticleGoogle Scholar
 Besag J: On the statistical analysis of dirty pictures. Journal of the Royal Statistical Society B 1986,48(3):259302.MATHMathSciNetGoogle Scholar
Copyright
This article is published under license to BioMed Central Ltd. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.