Wavelet-Based Blind Watermarking of 3D Models

F. Uccheddu
Department of Electronic and Telecommunications University of Florence Via S. Marta 3 50139, Firenze, Italy

M. Corsini
Department of Electronic and Telecommunications University of Florence Via S. Marta 3 50139, Firenze, Italy

M. Barni
Department of Information Engineering University of Siena Via Roma 56 53100, Siena, Italy

[email protected] ABSTRACT

[email protected] 1.

[email protected]

Watermarking of 3D meshes has received a limited attention due to the diculties encountered in extending the algorithms developed for 1D (audio) and 2D (images and video) signals to topological complex objects such as meshes. Other diculties arise from the wide variety of attacks and manipulations 3D watermarks should be robust to. For this reason, most of the 3D watermarking algorithms proposed so far adopt a non-blind detection. In this paper we present a new blind watermarking algorithm for 3D meshes. In order to simultaneously achieve watermark imperceptibility and robustness a multiresolution framework is adopted. To do so we assume that host meshes are semi-regular ones, a property that permits to rst perform a wavelet decomposition and then to embed the watermark at a suitable resolution level. Watermark detection is accomplished by computing the correlation between the watermark signal and the tobe-inspected mesh. Robustness against geometric transformations such as rotation, translation and uniform scaling is achieved by embedding the watermark in a normalized version of the host mesh, obtained by means of Principal Component Analysis. Experimental results show the validity of the proposed algorithm both in terms of imperceptibility and robustness against a wide class of attacks including noise addition, smoothing and cropping.

INTRODUCTION

Categories and Subject Descriptors

I.3.5 [Computer Graphics]: Computational Geometry and Object Modeling; K.5.1 [Legal Aspects of Computing]: Software ProtectionCopyrights

General Terms
Algorithms

Keywords
3D watermarking, mesh watermarking, blind detection, copyright protection, 3D wavelets
Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for prot or commercial advantage and that copies bear this notice and the full citation on the rst page. To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specic permission and/or a fee. MM&Sec04 September 20-21, 2004, Magdeburgo, Germany Copyright 2004 ACM 1-58113-854-7/04/0009 ... $5.00.

In the last decade, watermarking has been one of the most active research topics, attracting the interest of researchers with dierent backgrounds, such as signal processing, communication and information theory, cryptograhy, and computational vision [4, 2]. However a great deal of this research eort has focused on digital watermarking of audio, images and video data. The result is that watermarking technology for this kind of media has now reached a good maturity. On the contrary, watermarking of 3D objects is far from this level of maturity even if 3D models are diused in several applications such as virtual prototyping, Cultural Heritage, and entertainment industry (movies and video-games). One of the reasons for this gap is that it is dicult to extend common processing algorithms used in signal processing to 3D data. This is the case, for example of basic tools such as ltering and frequency analysis. Even if 3D objects can be represented in several dierent ways (e.g. NURBS, voxels, implicit surface, polygonal meshes) most of the existing 3D watermarking algorithms work on polygonal meshes since this representation is the lowest common denominator of the other ones (i.e. it is easy to convert the other representations to meshes). For example the watermark may be inserted by altering mesh attributes such as vertex coordinates or vertex connectivity. Here we follow the same approach, i.e. we embed the watermark in the mesh describing the shape of the 3D object. A strategy which is successfully adopted by many watermarking algorithms designed to deal with still images and video sequences, consists in rst describing the host document by means of a multiresolution framework and then inserting the watermark at a resolution level presenting a satisfactory trade-o between perceptibility of the watermark and robustness against attacks. The extension of this multiresolution approach to the 3D case, however, is not straightforward. The main reason for this diculty, as well as for the diculties encountered when trying to extend 2D processing tools to the 3D mesh case, is that the essentially 2-manifold structure of 3D surfaces has to be taken in account. In particular it is not possible to dene equi-spaced sampling patterns on general 2-manifolds thus making the extensions of Fourier and other multiresolution analysis and synthesis tools very dicult. So, in order to extend common signal processing algorithms to geometry data we need to use sampling patterns which are as regular as possible.

143

Subdivision surfaces [20] have recently attracted the attention of computer graphics researchers since by providing a semi-regular sampling of surfaces, they are likely to become a fundamental block of many multiresolution algorithms for mesh processing [19]. This is the case, for example, of 3D wavelet decomposition [14]. In the following, a polygonal mesh obtaining by regularly subdividing an irregular coarse one will be referred to as a semi-regular mesh. In this paper, we present a novel multiresolution mesh watermarking algorithm particularly designed to work with semiregular meshes with subdivision connectivity. The proposed algorithm embeds the watermark by modifying the wavelet coecients of 3D models obtained by decomposing the host mesh by means of the algorithm proposed by Lounsbery et al. [14]. Particular attention is paid to ensure that the embedding algorithm preserves the visual integrity of the models. The watermark is recovered by means of a correlation detector designed according to statistical detection theory [12]. Another distinguishing feature of the watermarking algorithm proposed in this paper, regards watermark detection. In fact, whereas most 3D watermarking systems proposed so far adopt non-blind detection, our system does not require that the original non-marked mesh is available at the detector, thus resulting in a much more exible system easily adaptable to practical applications. This paper is organized as follows. In section 2 a brief overview of 3D models representation is given, and the peculiarities of 3D watermarking reviewed. In section 3, the state of the art of 3D watermarking is briey sketched. Section 4 describes the new watermarking algorithm, with regard to the embedding phase, whereas section 5 is devoted to watermark detection. Experimental results are presented in section 6. Finally some conclusions are drawn in section 7.

2.

BACKGROUND

In this section we give some background material on 3D models representation and outline the main peculiarities of 3D watermarking.

of a vertex vi is called 1-ring of the vertex and is dened as v1 (i) = {j |{i, j } E}. The cardinality of v1 (i) is called degree or valence of the vertex vi . The geometric realization of a simplex s K , denoted with (s), is the strictly convex hull of the vertices vi with i s. For example the geometric realization of an edge {i, j } E is the segment connecting the vertex vi with the vertex vj , the realization of a face {i, j, k } F is the triangle dened by the vertices vi , vj and vk , and so on. The 3D model is the geometric realization of the mesh (K ) dened as sK (s). Usually the vertices are characterized not only by theirs coordinates but even by other attributes such as texture coordinates, color and so on. Here we are interested only in the geometry of the mesh so we do not take in account these attributes. In the following when we refer to a mesh we intend a triangular mesh, i.e. a mesh composed by triangles only. This assumption implies no loss of generality since every polygon of a nontriangular mesh can be triangulated to obtain a triangular mesh. A mesh is called irregular if its vertices can have any valence, completely-regular if all vertices have the same valence and semi-regular if most of its vertices have the same degree except a small number that can have any valence. This last denition arises because a semi-regular mesh is obtained by repeatedly and regularly subdividing [20] an irregular mesh. During the subdivision process the irregular vertices of the initial mesh remain irregular while most of the newly inserted vertices converge to valence six (for triangular semi-regular mesh). This classication is very important because for semi-regular meshes (and for completely regular ones) a lot of geometric processing tools exist. For example wavelet decomposition is dened only for semi-regular and completely-regular meshes[14]. It is important to underline that an irregular mesh can be always converted to a semi-regular one by an operation called remeshing [1, 21, 13]. As noted in the introduction, our algorithm is expressly designed to work with semi-regular meshes so to take advantage of the multiresolution framework provided by 3D wavelet analysis [14].

2.2

Main peculiarities of 3D watermarking

2.1

3D models representation

Dierent representations are commonly used for 3D models; for example a 3D model can be described as a collection of parametric curves (e.g. Non-Uniform Rational B-Splines, NURBS) or as a set of implicit surfaces1 . More usually, a 3D model is represented by polygonal meshes. A mesh M can be seen as a tuple (K, V ) where V = {vi R3 |i = 1 . . . Nv } is the set of the vertices of the model (points in R3 ) and K is a set encoding adjacency information for vertices, edges and faces of the mesh. In particular K is formed by subsets of I = {1, . . . , Nv } called simplices. We have three types of simplices: vertices V = {{i}|i I }, edges E = {{i, j }|i, j I, {i, j } is an edge} and faces F = {{i, j, k }|i, j, k I, {i, j, k } is a face}. The set K is called simplicial complex and is dened as K = V E F . A vertex vi is a neighbor of another vertex vj if an edge exists that connects vi and vj . The set of all the neighbors The implicit method uses a function depending on axis variables, usually equal to 0, to describe a shape. For example the equation x2 + y 2 + z 2 = 1 represents the sphere of radius 1.
1

Any watermarking system must cope with three basic, yet conicting, requirements: payload, robustness and imperceptibility. In 3D watermarking, each of the above aspects assume a particular characterization.

2.2.1

Watermark payload

The payload of a watermarking systems is the amount of information bits that the watermark is able to convey. In general, watermark payload depends on the particular watermarking algorithm and it is related to the characteristic of the host data. This is also true for 3D models: the achievable payload is tightly related to the complexity of the mesh. Because it is not simple to dene mesh complexity from an information theoretic viewpoint, we will refer to mesh complexity as the number of faces and vertices it contains, assuming that mesh vertices do not over-sample the shape they represent.

2.2.2

Imperceptibility

Watermark imperceptibility is a crucial point for 3D watermarking since in many cases the user is allowed to manipulate the 3D mesh in a variety of ways. For instance, it is easily guessed that watermark visibility will depend on the

144

particular rendering algorithm used to visualize the mesh, e.g. it will depend on the shading algorithm, the reectance properties of the object and so on. So far, only a few studies on 3D watermark perceptibility have been done, all the more that a 3D model can be viewed in an interactive way thus making the perceptual analysis of 3D models more complex than for image or video data. Our approach to guarantee the visual quality of the watermarked model is to perform an interactive visual comparison between the watermarked and the original mesh to establish the maximum watermark power that can be injected within the host model without introducing signicant distortions in the geometry of the model. Fixed rendering conditions have been also assumed. The possibility of using an automatic process indicating the maximum watermark power still ensuring invisibility is a matter of an on-going research.

Retriangulation

Figure 1: Re-triangulation attack.

the model followed by a re-denition of the vertices connections (a re-triangulation).

2.2.4

Embedding domain

2.2.3

Robustness

A nal important requirement for any watermarking algorithms, especially for those used in Intellectual Property Right (IPR) protection applications, is robustness against manipulations. One of the main peculiarities of 3D watermarking is that a lot of sophisticated and dicult-to-prevent attacks are possible on polygonal meshes. Just to mention some, the watermark should be robust against noise addition, translation, rotation, scaling, simplication, retriangulation, smoothing, cutting, remeshing and many others. A detailed description of some of these attacks follows: Translation/Rotation/Uniform Scaling. These geometric transformations are very used in computer graphics to position a 3D model inside a scene. Other geometric transformations less used than these, are ane and projective ones may be used, even if they are less common than . Noise. By noise attack we intend the addition of random vectors to mesh vertices. The modulus of these vectors have to be small compared with the mesh dimension to preserve the overall shape of the model. Re-triangulation. This attack changes the connections between mesh vertices leaving their position unaltered. (see gure 1). Mesh smoothing. A smoothing of the surface represented by a polygonal mesh can be obtained by mesh ltering such as Taubin ltering [22]. This kind of lter acts on the mesh as a low-pass lter attenuating the roughness of the surface. Polygonal simplication. Polygonal simplication is often used to transmit a low-level version of the model or to optimize a model eliminating most of the non-salient faces. Cropping. Cropping concerns the disjunction of a part of the model. Users can discard the pieces of the model that they do not need (e.g. the hand of a statue). Remeshing Remeshing is used to regularize a mesh converting an irregular mesh into a semi-regular [13, 1, 21] or a completely-regular [6] one. This operation can be seen as a geometric resampling of the shape of

The rst step towards the denition of a watermarking algorithms, consists in the choice of the host features, i.e. the selection of a set of properties of the host model that will bear the watermark information. For a 3D objects many possibilities exist, vertices positions, texture coordinates, shape-related features and so on. Here, we are interested in the geometric properties of the mesh, so we focus only on geometric and topological features. Geometric Features. The main geometric features of a mesh are its vertices. One possible way to embed the watermark is to modify the position of the vertices. Another way to embed the watermark is to modify the normals of vertices (vertex normals are related to the curvature of the mesh, hence to the shape of the 3D objects). Both these entities are altered by perturbing the coordinates of mesh vertices. Topological Features. These features are related to the connectivity of the mesh vertices. Usually, a set of connected vertices is selected by using some geometric features. Then, the topology of these vertices is redened to encode one or more bits. Usually topological features are used when the robustness constraint of the watermarking algorithm is relaxed, in fact these features are particularly vulnerable to the re-triangulation attack, that it is straightforward to implement. Our algorithm embeds the watermark by modifying the position of the mesh vertices in a transformed domain, i.e. wavelet domain.

2.2.5

Watermark retrieval

The way the system extracts the embedded information from the host mesh has a strong impact on practical applications. For example, it is known that non-blind techniques are less useful in practical applications than blind ones. Another important distinction is between readable and detectable watermarks. In the rst case, the algorithm embeds a code that can be re-extract (read) without knowing it in advance. In the second case the algorithm is only capable of verifying whether a given code is contained in the data or not. The latter kind of techniques are sometimes referred to as 1-bit watermarking because the output of the detector is just yes or not. The algorithm presented in this paper belongs to the category of detectable watermarks.

145

3.

PREVIOUS WORKS

Watermarking of 3D models is a relatively new research topic. One of the earliest works on 3D watermarking was presented by Ohbuchi et al. in [16, 17]. They presented several techniques embedding the watermark in the geometrical domain: the watermark is embedded into the polygon data by modifying either the vertex coordinates, the vertex connectivity , or both. They also discussed the ordering schemes into a set of geometrical or topological elements for embedding and extracting the watermark. The techniques they presented are non blind and robust to 3D ane transformations and cropping. Kanai et al. [10] propose to decompose the host mesh into a multiresolution representation by applying the lazy wavelet transform proposed by Lounsbery et al. [14]. Then they modify the wavelet coecients to embed the watermark and detect it in a non-blind way. Our method is based on this work and extend it providing a novel blind technique for 3D watermarking. Praun and Hoppe [18], also presented a detail-preserving non-blind method driven by multiresolution theory. Due to the construction of lters applied to the mesh, the watermark aects the overall sweep of surfaces, so that the algorithm is resistant against many local transformation such as noise addition and smoothing. Moreover robustness against complex attacks such as remeshing are achieved thanks to a regisration - resampling phase performed before the extraction phase. Benedens [3] developed two methods, namely Normal Bin Encoding and Ane Invariant Embedding, both of which are based on the alteration of surface normals. He maps surface normals onto the unit sphere, and then subtly alters groups of similar normals in order to embed the individual bits of the watermark sequence. However he demonstrates robustness only with simplication attacks. These methods are not completely blind (semi-blind), in that some information directly derived from the original mesh must be provided to the detector. Thomas Harte and Adrian G. Bors[8] presented a blind technique to embed information in a 3D objects by altering vertices position in geometric domain. They demonstrated robustness only against scaling and rotation and combination of geometrical transformation. In [15], Ohbuchi et al. proposed a frequency domain approach to the watermarking of 3D shapes. The mesh is rst segmented into patches, and then the watermark is embedded by modulating the amplitude of the mesh spectral coecients with a spread-spectrum approach. Spectral coefcients are computed by means of a spectral analysis based on the Kirchho matrix of each patch. Nevertheless, the patch generation step cannot be performed automatically, and manual interaction is needed. Yin et al. reported an informed (non blind) detection, robust mesh watermarking algorithm that works in a transformed domain [23]. It is based on a multiresolution decomposition of polygonal mesh shapes developed by Guskov [7] that separates a mesh into detail and coarse feature sequences essentially by repeatedly applying local smoothing combined with shape dierence. This non-blind watermarking algorithm has shown good robustness properties, somewhat similar to the method proposed by Praun et al. [18]. As some of the methods discussed above, our scheme embeds the watermark in a transformed domain, namely the

wavelet domain. As opposed to these methods, though, we do not need the original mesh to recover the watermark, since blind detection is accomplished.

4.

WATERMARK EMBEDDING

The 3D watermarking system presented in this paper embeds a numeric code into a semi-regular mesh with subdivision connectivity using a multiresolution framework. An advantage of the multiresolution analysis is that it permits to extend the geometrical deformations introduce by the watermark from low to high resolution in a smooth way, so that deformations result distributed around the perturbed vertices avoiding the noise eect usually caused by most watermarking algorithm that works at full resolution. In this way, the visual quality of the nal watermarked model is greatly improved. Moreover robustness improvements are expected from this approach since the watermark is tied to the very basic shape of the mesh, and hence it is very difcult to remove the watermark without that, at the same time, the mesh quality is severely degraded. This also explains why we chose to work with semi-regular meshes, since this is the basic assumption multiresolution analysis relies on. Another important feature of the new algorithm is detector blindness. To obtain this result, and yet preserve robustness against geometrical transformations, it is necessary that the watermark embedding and detection phases work on a normalized model, i.e. on a model re-oriented and scaled as the original one. This normalization allows to ignore translation, rotation and uniform scaling modications. It goes without saying that model normalization at the detector must be accomplished without the use of the original model, not to compromise the blindness of the overall watermarking system. For this reason, a normalization phase expressly designed to cope with geometric manipulations of the host model is inserted before the embedding and detection stages (see section 4.2). In the following, after a brief excursus on subdivision surface and multiresolution analysis, we describe in detail the normalization phase and the watermark embedding algorithm. Watermark recovery will be described in section 5.

4.1

3D multiresolution framework

Wavelet theory, and multiresolution analysis in general, is a powerful tool for representing signals at dierent levels of detail. In our system we implemented a class of 3D wavelets based on subdivision surface [14]. According to this theory, it is assumed that the mesh to be decomposed by wavelet analysis is a semi-regular one, i.e. a triangular mesh obtained by regularly subdividing an irregular one [20]. Note that it is always possible to transform an irregular mesh into a semi-regular one by a remeshing operation [1, 21, 13]. Usually remeshing operation is performed by extracting a base mesh, parameterizing the model, and choosing a rule of subdivision [20]. Figure 2 illustrates the decomposition and multiresolution representation of a polygonal model by using the wavelet transform. The high-resolution polygons are decomposed into a low-resolution part and a detail part. The detail parts are expressed as the wavelet coecient vectors, while the low resolution part is the coarse model. In the following we indicate by M the semi-regular mesh. The mesh M can be seen as a tuple (V, H ) where V is the

146

...

A
@ A B

(a)

(b)

...

(c)

"

wavelet coefficients

wavelet coefficients


&

'

 0

Figure 2: Decomposition of a polyhedral surface.

2 2 1 2 3 4 1 5 3 4

"

"

'

set of vertices and H encodes adjacency information (to represent edges and faces). M j indicates the mesh at level of resolution j , in particular for a mesh with n levels of resolution, M 0 is the base mesh and M n1 = M is the mesh at full resolution. With this notation we can formulate the wavelet transformation by: V j 1 = Aj 1 V j W j 1 = B j 1 V j (1)

'

6 3

"

"

Figure 3: Inverse wavelet transform. In the rst step each triangle of the low resolution mesh is split into four sub-triangles by introducing new vertices at the midpoints and then the position of these new vertices is modied according to the wavelet coecients vectors. translation and scaling are trivial operations, the orientation phase needs some comments. As we already said, the basic idea is to re-orient the model using principal component analysis. As opposed to previous works (see for example [9]), we compute the covariance matrix and the center of mass of the model by considering the centers of the faces of the mesh, instead of its vertices. Each face center is associate to a mass mi which is equal to the area of the face (see [5]). This strategy is more reliable than the one based on vertices positions because re-orienting the model by means of its surface area distributions provides more robustness against vertices positions changes. For example, if we imagine to add randomly vertices around a specic location on the mesh, in the rst approach the center of the mass changes, while in our approach mass center remains the same. Specically, we calculate the center of mass O of the model as: O= 1 nf
nf

j j j T where V j = [v1 v2 ...vm is a matrix whose rows correspond j] to vertex coordinates of the model M j , V j 1 corresponds to the next lower resolution level j 1 and mj is the number j 1 j 1 j 1 T of vertices at resolution j . W j 1 = [w1 w2 ...wn j 1 ] denotes a matrix whose rows correspond to the wavelet coecient vectors at resolution level j 1 where nj 1 = mj mj 1 . The matrices Aj and B j are called analysis lters. The process dened in equation (1) is recursively applied to the high resolution part until the coarsest representation of the mesh V 0 is obtained. The whole process can be formulated as:

V 0 = A0 A1 ...Al2 Al1 V l W 0 = B 0 B 1 ...B l2 B l1 V l

(2)

On the contrary, the inverse wavelet transform is expressed as: V j = P j 1 V j 1 + Qj 1 W j 1 (3)

where P and Q are called synthesis lters. The relationship between these lters and the analysis ones is: P j 1 Qj 1 = Aj 1 B j 1
1

pi mi ,
i=1

(5)

(4)

The synthesis can be viewed more concretely as consisting of two steps: each triangle of the low resolution mesh (V j 1 ) is split into four sub-triangles by introducing the new vertices at the midpoints of edges by using P j 1 (polyhedral subdivision), and then the position of these new vertices is modied according to the wavelet coecients by using Qj 1 . Figure 3 shows this process. It is important to remark that in this implementation the wavelet coecients are vectors.

where pi is the center of the i-th face of the model and the mass mi associated to pi is the area of the face pi belongs to. Then, the PCA is applied to the following covariance matrix: n n n 2 i=1 xi mi i=1 yi xi mi i=1 zi xi mi n n n 2 (6) I= i=1 xi yi mi i=1 yi mi i=1 zi yi mi n n n 2 x z m y z m z m i i i i i i i i i=1 i=1 i=1 where (xi , yi , zi ) are the coordinates of the points pi s relative to the center of mass O. Finally, the eigenvectors of I are computed and used to align the principal axis of I to the coordinate axis. This is done by simply multiplying the position of each vertex by the PCA matrix.

4.2

Mesh normalization

Mesh normalization works in two stages. In the rst one, model orientation is normalized by means of Principal Component Analysis (PCA). Then the model is tted to a bounding box consisting of a cube of dimensions 1.0 1.0 1.0 centered in the barycenter of the model. Fitting is obtained by applying a translation and a uniform scaling. While

4.3

Embedding rule

The watermarking embedding algorithm works according to three parameters: i) a secret key K ; ii) the resolution level l that will host the watermark, and iii) a coecient determining the strength of the watermark.

147

W0

W1

... WnL

Rebuilding W
L

Wavelet Analysis

Coarse Level L (V )

Watermarking Embedding Algorithm Wmap

Numeric Key (K) Input Model (M) Watermark Map Generation Watermarked Model (M ) *

Figure 4: Scheme of the watermark embedding algorithm. An overall picture of the watermark insertion process is shown in gure 4. In particular the following steps are performed: 1. A particular watermark-dependent structure called watermarking map is generated according to K . 2. The input model M is decomposed into a set of wavelet coecients W 0 , W 1 , . . . , W n1 and a base domain M 0 . 3. The vertices of the model at level l (V ) and the wavelet coecients at the same level (W l ) are used by the embedding algorithm to embed the watermark by altering the modulus of a subset of the wavelets coecients of W l.
l 4. The watermarked wavelet coecients W and the other l+1 n1 sets of wavelets W , . . . , W are used to reconstruct the watermarked full resolution model. l

180
o

WMAP

90

D(vL)
0
o

180

360

v3L-1 v1L-1
vL vL

D
wL-1

( L, L, L ) = vL v v V

In the next sections we give a detailed description of each of the above step.

4.3.1

Watermarking map generation

v2L-1

Given the key K , a matrix called watermarking map (WM AP ) is built. This map is used in the embedding phase to insert K within the host model. To build WM AP , the key K is used as a seed to generate a pseudo-random sequence of displacement values D = {d1 , d2 , . . . , dt } uniformly distributed in the [1, 1] interval. Then, this sequence is arranged into a matrix with n rows and m columns (t = n m). The basic meaning of WM AP , is that of a mapping of the watermarking signal into polar coordinates, where the row index of WM AP samples the azimuth angle ( [0, 2 ]) and the column index samples the elevation angle ( [0, ]). The number of rows and columns of WM AP determines the accuracy with which the polar representation of the unitary sphere is sampled. Here we adopted a WM AP of 360 180 elements, i.e. 1 degree of resolution.

Figure 5: Watermark embedding. The modulus of the wavelet coecient |wl1 | is perturbed according to the value of the watermarking map (WM AP ) indexed by the polar coordinates (v , v ) of the application point v l of the wavelet coecient. where the exact meaning of W will be explained below. The exact amount of perturbation the modulus of the wavelet coecient undergoes, namely D ( v (wi ), WM AP ), is determined by the parameter , and by D ( v (wi ), WM AP ), a quantity which depends on the application point v (wi ) of the wavelet coecient wi and by the watermarking map WM AP . Specically, the polar coordinates (v (wi ) are , v ) of v used to index the watermarking map and to obtain a value of perturbation specic for that position and that watermark. In the following we assume that (v , v ) are expressed in degrees and not in radians. Of course no guarantee exists that the polar coordinates of v (wi ) will exactly correspond to
l

4.3.2

Watermark casting

As we already said, the set of wavelet coecients W l and the vertices V l are used to embed the watermark. In particular the modulus of the each wavelet coecients wi at level l (W l ) is altered as follows: |wi, | = |wi | + D ( v (wi ), WM AP ) , wi W ,
l

(7)

148


180 120

WMAP

and the wavelet coecients is calculated as follows:

d19 d13

d20 d14 d8 d2
60 v

d21 d15 d9 d3

d22 d16 d10 d4

180

d23 d17 d11 d5

d24 d18 d12 d6

(d19 ) (d13 ) (d7 ) (d1 )

360

1 n
wi W

|wi |D ( v (wi ), WM AP )
l

(11)

v d7

d1
0

240 300

where n is the cardinality of W . If is greater than a certain threshold T the watermark is present, else the model is declared non-marked. The value of T is obtained by means of statistical considerations. In the next section we provide the theoretical analysis used to determine this threshold and a theoretical evaluation of the performance of the proposed algorithm. In the experimental results section we validate this theoretical performance.

Figure 6: Example of computation of D ( v (wi ), WM AP ). As an example, a 24-sample long sequence D = {d1 , . . . , d24 } is arranged into a watermarking map of 4 6 elements. The point v (wi ) of polar coordinates (v = 110.2, v = 73.5) is mapped to D ( v (wi ), WM AP ) = d9 . a position expressed by an integer index of WM AP , hence the following simple interpolation rule is adopted to calculate the exact value of D ( v (wi ), WM AP ): D ( v (wi ), WM AP ) = WM AP (i , i ) i = round(v (m/360.0)) i = round(v ((n 1)/180.0)) (8) (9)

5.1

Choice of T

The most popular approach to the choice of T consists in resorting to statistical detection theory. Specically the Neyman-Pearson criterion is usually adopted, which consists in maximizing the missed detection probability for a given probability of falsely revealing the watermark in a nonmarked host mode [2]. We use the same approach here. To go on, we need to compute the probability of falsely detecting the watermark presence, i.e.: Pf = P { > T |H0 }. (12)

where H0 indicates the hypothesis that |wi | are not marked. Similarly we can dene the probability of missing the watermark as: Pm = P { < T | H 1 } . (13)

where round(x) is the integer nearest to the value of x. Note that if two or more points v (wi )s are mapped to the same index of WM AP , then some correlation is introduced within the watermarking sequence D ( v (wi ), WM AP ), hence it is desirable that this happens as rarely as possible. In our system the resolution of 1 degree has been found to be a good trade-o between independence of wi s and robustness. This question will be better clarify in the experimental results section. Figure 6 shows graphically how D ( v (wi ), WM AP ) is calculated. In order to minimize the geometrical distortion introduced by the use of spherical coordinates, only those wavelets for which v Thus, only is far from the poles are marked. wavelets with v 180.0 are marked. In our implementation is set to twenty degrees. We indicate l this subset with W . A particular attention must be paid to avoid that the watermarking process produces negative modules. To do so we replace negative modules with zero, that is: |wi, | = min(0, |wi | + D ( v (wi ), WM AP )) , wi W
l

(10)

5.

WATERMARK DETECTION

The detection procedure works as follows: the user species the numeric key K and the level of resolution l where he wants to verify the presence of K and the detector provides a positive or negative answer. To do so the watermarking map WM AP is generated by starting from K , Vl and Wl are obtained by wavelet analysis, and then the correlation between the watermarking signal

where H1 indicates the hypothesis that |wi | are marked with the watermark K whose presence is under verication. In both cases, the error probabilities are obtained by xing the host model and averaging over dierent watermarks K . In the sequel we will assume that watermark samples are zero mean i.i.d. random variables. As we anticipated when describing the role of the watermarking map, this is true only if the application points of wavelet coecients are mapped into dierent elements of WM AP . In turn, this is true only if the step used to sample the polar coordinates of v (wi ) is small enough. We found experimentally that by letting such a sample step be equal to 1 degree a reasonable trade-o is reached between independence of watermark samples and robustness (see section 6). In order to go on, let us indicate by wi the i-th coecient under inspection. We use a dierent symbol wi to explicitly indicate that the detector does not know whether wi is marked or not. We start by noting that according to our model D (wi )s are independent random variables and |wi |s are xed parameters which are known to the detector2 , hence, by invoking the central limit theorem, we can conclude that follows a normal distribution. To completely characterize , then, it is sucient to estimate its mean and variance. Let us assume that H0 holds. In this case we have |wi | = |wi |, hence: 1 |wi |D ( v (wi )) = |H0 = E [|H0 ] = E n (14) l
wi W

= D w = 0, From now on we avoid to explicitly indicate the dependence of D upon WM AP .

2

149

where w = |wi |/n, n is the number of elements in W and D is the mean of the sequence D ( v (wi )). As to the variance of under hypothesis H0 , we can write: 1 1 2 2 |H0 = var |wi |D ( v (wi )) = w2 , (15) D n n l
wi W

l 3 2 1

bunny max 0.0005 0.0008 0.0030

l 3 2 1

venus max 0.0003 0.0005 0.0009

with w2 = 1 n | wi | 2 ,
wi W
l

Table 1: Maximum value of before the watermark becomes perceivable (max ) for dierent watermarking levels (l). Model bunny bunny bunny venus venus venus l 3 2 1 3 2 1
Pf = 102 3.43 102 1.35 102 1.11 102 3.14 102 1.07 102 0.97 102 Pf = 103 8.4 103 1.8 103 1.1 103 6.4 103 1.2 103 1.0 103

(16)
l

denoting the sample mean square value of |wi | W , and 2 denoting the variance of the sequence D ( v (wi )). We D can now calculate the false detection probability, obtaining:

Pf =
T

p(|H0 )d =

1 erfc 2

(T |H0 )2 2 2 |H0

. (17)

This expression of Pf can be inverted to calculate the detection threshold, yielding: T = 2|H0 erfc1 (2Pf ) + |H0 . (18) By inserting equations (14) and (15) in the above expression, we nally have: T =
2 2 w2 D

Table 2: Actual false alarm rate for dierent water marking levels (l). Pf is the target value of Pf .

6.1

Watermark Perceptibility

erfc1 (2Pf ).

(19)

In a similar way we can evaluate the probability of missing the watermark presence [2], obtaining: Pm = 1 erfc 2 (|H1 T )2 2 2 . (20)

By using the result in (19), it is easy to obtain the following expression for Pm , in which the missed detection probability is expressed as a function of Pf : Pm = 1 erfc 2
2 ( D 2 2 w2 n D 2 2 w2 erfc1 (2Pf ))2 n D

+ 2 [E [D ] E [D

2 2 ] ]

(21) Equation (21) completely characterizes the detector performance. Such performance are usually summarized through ROC curves where the missed detection probability is plotted against Pf .

In order to achieve high visual quality of the watermarked model we have carefully considered the problem of watermark perceptibility after its insertion in the model. As previously noticed, it is very dicult to evaluate in a objective way the perceptibility of the geometric distortion introduced by the watermarking process. Hence we evaluated this distortion by visual inspection; an human user compares the original and the watermarked model using a software expressly designed for this purpose and nd the maximum watermark strength ( ) that results in a non-visible watermark. We used this analysis to determine a value of that ensured invisibility for all the models used. All the experimental results we provide in this section guarantee a imperceptibility of the watermark, i.e. a high visual quality of the watermarked model. An example of the inuence of on the visibility of the watermark is shown in gure 7, where the 3D model Venus has been watermarked with dierent values of . In table 1 it is shown how the maximum perceptually tolerable value of changes while varying the model and the resolution level l. In particular max increases at lower resolution levels.

6.2

False alarm rate

6.

EXPERIMENTAL RESULTS

In this section we report a selection of the results that we obtained while testing the validity of our watermarking algorithm. Specically three aspects where considered: i) watermark invisibility, ii) actual false detection probability, and iii) robustness. The models used in the experiments are the semi-regular meshes made available to the public by the Multiresolution Modeling Group of Caltech University. These models are the bunny, the feline, the Venus head, the rabbit and the horse model. Here we present some of the results obtained, in particular, for the bunny and the Venus models but similar results, from a qualitative viewpoint, are obtained even for the other models.

Equation 19 permits to determine a threshold T that guarantees the performance of the detector in terms of false detection probability. To validate this theoretical result, we tried to detect 10,000 dierent watermarks on the same non marked model for a xed value of Pf = Pf ; we expect that the actual false alarm rate equals Pf . The results we obtained are summarized in table 2. As it is readily seen, the agreement between theory and practice is rather good. The slight dierences that can be observed can be explained by considering how watermark coecients are mapped onto the watermarking map WM AP . In fact, as previously noticed, if the model has a great density of vertices it may happen that a certain number of different points v (wi ) are mapped on the same index of WM AP . The eect is that ( v (wi ), WM AP ) values are no more independent, thus increasing the actual variance of and causing

150

Figure 7: Watermark Perceptibility. (Left) Original Venus model. (Center) Venus model watermarked with l = 3, = 0.0002, the watermark is imperceptible. (Right) Venus model watermark with l = 3, = 0.002, the geometric manipulations introduced by the watermarking process become visible. an actual value of Pf greater than expected. This problem can be alleviated either by embedding the watermark at a lower resolution level or by augmenting the resolution of WM AP , for example by using a map with 720 360 elements (0.5 degrees of resolution).

x 10

1.2 1 0.8 0.6 0.4 0.2 0 0

4

6.3

Robustness

One of the main problems of 3D watermarking is the wide variety of dierent attacks possible on a polygonal mesh. This is one of the main reason why many 3D watermarking algorithms use the original model in the extraction phase. Since our technique is specic for semi-regular meshes with subdivision connectivity, we do not take in account those attacks that alter this properties of the mesh such as re-triangulation, simplications or re-meshing. Instead we tested the robustness of the algorithm against additive noise, low pass ltering, geometric manipulations, cropping and a combination of the above.

0.05

0.1

/lmed

0.15

0.2

0.25

6.3.1

Additive noise

x 10 1.2 1 0.8 0.6 0.4 0.2 0 0

Additive noise is a standard attack to evaluate the performance of a watermarking system. In our case the noise is added to the watermarked model by perturbing its vertices at full resolution in a random way. More specically, for each vertex a dierent displacement vector noise = (x , y , z ) is applied. The vector components x ,y and z are random variables with uniform distribution in the interval [, ]. In gure 8 the value of and T for increasing values of is given. In particular the plot is given as a function of the quantity lmed /, where lmed is the average length of the edges of the model. The models used in this test are the bunny and Venus both watermarked at level of resolution l = 3 with = 0.0004 and Pf = 108 . To give a visual idea of the maximum amount of noise the watermark can survive, in gure 9, a noisy version of the bunny model is shown, where noise strength is set to the maximum level for which the watermark can be recovered. As it can be seen, though the mesh is signicantly deteriorated, the watermark is still detectable.

0.05

0.1

/lmed

0.15

0.2

0.25

Figure 8: Robustness against Additive Noise attack. (Top) Bunny model watermarked with l = 3, = 0.0004 and Pf = 108 . (Bottom) Venus model watermarked with the same watermarking parameters.

151

x 10

1.2 1 0.8 0.6 0.4 0.2 0 0 x 10 1.2 1 0.8 0.6 0.4 0.2 0 0
4

10

15

20

Number of iterations
T

Figure 9: Robustness against Additive Noise attack. Original (up) and attacked (bottom) models. The model is attacked with the maximum amount of noise for which the watermark is detected.

10

15

20

Number of iterations

6.3.2

Low pass ltering

Figure 10: Robustness against Taubin ltering (the coecients of the lter are = 0.6307 = 0.6352 producing a strong smoothing eect). (Top) Bunny model. (Bottom) Venus model. For both the models watermarking parameters are the same used for the noise attack (l = 3, = 0.0004, Pf = 108 ).

Mesh ltering is used by a number of diverse applications, e.g. to eliminate the surface imperfections in an 3D object acquired by laser scanner or for editing purposes. Usually mesh ltering is a local operations, in other words it aects only the high-resolution part of the model. So, we expect that by embedding the watermark at a low-medium resolution level a good resistance against this kind of attacks is obtained. This is indeed the case. In particular we evaluated the performance of the watermarking system against the Taubin lter [22]. Several coecients of the lter have been tried to obtain dierent smoothing eects and these battery of lters has been applied to the watermarked model a certain numbers of times. An example of the results that we obtained is given in Figure 10 and 11.

6.3.3

Geometric transformations

In the absence of further attacks, robustness against geometric manipulations such as translation, rotation and uniform scaling is guaranteed by the normalization phase preceding both watermark insertion and detection. Some problems may arise when a geometric manipulation is accompanied by other attacks that may cause an error in the normalization phase. Hence we measured the robustness of the watermark when the marked mesh is ltered, degraded by noise addition and rotated. Specically, in gure 12, the mesh obtained after a 22 degree rotation around the x axis, 11 degree rotation around y axis, 5 applications of Taubin ltering with = 0.6307 and = 0.6352

Figure 11: Visual eect of Taubin ltering (15 iterations). The watermark can be recovered even if the host mesh is severely degraded by the lter.

152

Figure 12: Robustness against combined attacks. The model has been watermarked with l = 3, = 0.0004 and Pf = 105 , then it has been smoothed by Taubin lter ( = 0.6307, = 0.6352, 5 applications), attacked with noise ( lmed = 0.1) and rotated by 22 around x axis and 11 around y axis. The detector is still able to recover the watermark. parameters and noise addition (/lmed = 0.1) is shown. Even in this case the watermark was successfully recovered ( = 3.02 105 , T = 3.06 105 ).

Figure 13: Cut Attacks. (Left) Bunny model watermarked with l = 3, = 0.0009 and Pf = 108 and then cut by a plane. (Right) Venus model watermarked with l = 3, = 0.0004 and Pf = 108 and then cut by a plane. In both cases the system is able to recover the watermark. brought back to a semi-regular format by a remeshing operation. Finally, to further diminish watermark visibility, the possibility of modulating the watermark strength according to perceptual considerations will be investigated.

8.

ACKNOWLEDGEMENTS

6.3.4

Cropping

Finally we veried whether the watermarked can be recovered even when a part of the mesh is removed. This may cause a synchronization problem, since the mapping on WM AP depends by the center of mass of the mesh. In fact, if a part of the mesh is cut, the position of the center of mass changes desynchronizing the watermarking map used by the embedder and that available at the detector. Hence in order to verify whether the watermark could be recovered on a subpart of the mesh, we assumed that absolute coordinates are used. It goes without saying that a proper synchronization algorithm must be developed in order to ensure full robustness against cropping (for a possible way to achieve this goal see section 7). Apart from the above considerations, the watermark exhibited an excellent robustness against cropping, as it is shown in Figure 13.

This work was partially supported by the European Commission through the IST Programme under Contract IST2002-507932 ECRYPT. The information in this paper is provided as is, and no guarantee or warranty is given or implied that the information is t for any particular purpose. The user thereof uses the information at its sole risk and liability. The semi-regular meshes used for the experimental results are made public available by the Multiresolution Modeling Group of Caltech University. (http://www.multires.caltech.edu/software/pgc)

9.

REFERENCES

7.

CONCLUSIONS AND FUTURE WORKS

In this paper we presented a new watermarking algorithm for 3D models. In order to cast the watermarking problem in a multiresolution framework, the algorithm is expressly designed to work with semi-regular meshes, thus making 3D wavelet analysis feasible. A particular mapping strategy is proposed to take into account the non-regular sampling of the 3D mesh. Correlation-based and geometric normalization allow the blind detection of the watermark and a good robustness against several attacks. Several directions for future work remain open. First of all, we are planning to apply the watermark to subparts of the mesh [11]. By applying geometric normalizing to each subpart, robustness against combined cropping and geometric manipulations should be achieved. We are also going to evaluate the robustness of the watermark when the semiregular mesh is converted to a irregular one, edited, and

[1] P. Alliez, D. Cohen-Steiner, O. Devillers, B. Levy, and M. Desbrun. Anisotropic polygonal remeshing. ACM Trans. Graph., 22(3):485493, 2003. [2] M. Barni and F. Bartolini. Watermarking Systems Engineering: Enabling Digital Assets Security and other Applications. Marcel Dekker, 2004. [3] O. Benedens and C. Busch. A frequency-domain approach to watermarking 3d shapes. EUROGRAPHICS 2002, 21(3), 2002. [4] I. J. Cox, M. L. Miller, and J. A. Bloom. Digital Watermarking. Morgan Kaufmann, 2001. [5] S. Gottschalk. Collision queries using oriented bounding box. PhD Thesis, Department of Computer Science, University of North Carolina at Chapel Hill, 1999. [6] X. Gu, S. J. Gortler, and H. Hoppe. Geometry images. In Proceedings of the 29th annual conference on Computer graphics and interactive techniques, pages 355361. ACM Press, 2002. oder. [7] I. Guskov, W. Sweldens, and P. Schr Multiresolution signal processing for meshes. SIGGRAPH 99, pages 4956, 1999.

153

[8] T. Harte and A. Bors. Watermarking 3d models. In International Conference on Image Processing, volume 3, pages 661 664, 2002. [9] A. Kalivas, A. Tefas, and I. Pitas. Watermarking of 3d models using principal component analysis. In Proceedings of Acoustics, Speech and Signal Processing (ICASSP03), volume 5, pages 676679. ACM Press, 2003. [10] S. Kanai, H. Date, and T. Kishinami. Digital watermarking for 3d polygons using multiresolution wavelet decomposition. In Sixth IFIP WG 5.2 GEO-6, 1998. [11] S. Katz and A. Tal. Hierarchical mesh decomposition using fuzzy clustering and cuts. ACM Trans. Graph., 22(3):954961, 2003. [12] S. M. Kay. Fundamentals of Statistical Signal Processing: Detection Theory, volume II. Prentice Hall, 1998. [13] A. W. F. Lee, W. Sweldens, P. Schr oder, L. Cowsar, and D. Dobkin. Maps: multiresolution adaptive parameterization of surfaces. In Proceedings of the 25th annual conference on Computer graphics and interactive techniques, pages 95104. ACM Press, 1998. [14] M. Lounsbery, T. D. DeRose, and J. Warren. Multiresolution analysis for surfaces of arbitrary topological type. ACM Trans. Graph., 16(1):3473, 1997. [15] R. Ohbuchi, M. Akio, and T. Shigeo. A frequency-domain approach to watermarking 3d shapes. EUROGRAPHICS 2002, 21(3), 2002.

[16] R. Ohbuchi, H. Masuda, and M.Aono. Watermarking three-dimensional polygonal models. In ACM Multimedia 97, 1997. [17] R. Ohbuchi, H. Masuda, and M.Aono. Watermarking three-dimensional polygonal models through geometric and topological modications. IEEE Journal on selected areas in communications, 16(4):551559, 1998. [18] E. Praun, H. Hoppe, and A. Finkelstein. Robust mesh watermarking. SIGGRAPH 99, pages 4956, 1999. [19] P. Schr oder. Subdivision as a fundamental building block of digital geometry processing algorithms. Journal of Computational and Applied Mathematics, 149(1):207219, Dec. 2002. [20] P. Schr oder and D. Zonin. Course notes: Subdivision for modeling and animation. In Proc. SIGGRAPH 99, 1999. [21] V. Surazhsky, P. Alliez, and C. Gotsman. Isotropic remeshing of surfaces: a local parameterization approach. In Proceedings of 12th International Meshing Roundtable, 2003. [22] G. Taubin. A signal processing approach to fair surface design. In Proceedings of the 22nd annual conference on Computer graphics and interactive techniques, pages 351358. ACM Press, 1995. [23] K. Yin, Z. Pan, J. Shi, and D. Zhang. Robust mesh watermarking based on multiresolution processing. Computer and Graphics, 25:409420, 2001.

154