Robust Invisible Watermarking of Volume Data Using the 3D DCT

‘Yinghui Wu, ’Xin Guan, ‘Mohan S. Kankanhalli, and lZhiyong Huang

‘Department of Computer Science, ’Department of Computational Science
National University of Singapore, Singapore 117543
huangzy @comp.nus.edu.sg

1. Introduction spatial scaling, etc.), cropping of a block of the volume, re-

placing a subset of the volume with another one, etc.
Digitizing of visual data has had a dual impact. Firstly,
Addition of a constant offset to voxel values.
it ha$ enabled fast and efficicnt storage, transfer and pro-
cessing. Secondly, duplication and manipulation of data has Addition of Gaussian or non-Gaussian noise.
also become very easy and undetectable. This can lead to
violation of copyrights. One solution to this problem is to Linear filtering, such as low pass and high pass filtering, or
embed a secondary signal (watennark) into the visual data non-linear filtering, such as median filtering.
in an unobtrusive and robust manner.
Techniques to embed and retrieve such secondary infor- Local exchange of voxel slices.
mation, or stamp (called watermark), that conveys some in- Digi tal-to-analog and analog-to-digital conversions.
formation about the intended recipient or the lawful owner
of the original data, have been of considerable research in- Collusion. A number of authorized recipients of the same
tcrest [2. 61. However, these works have been mostly con- volume data should not be able to collude and use the differ-
fined to visual data such as digital images [ 7 ] and digital ently watermarked volumes to generate an unwatermarked
video 1.11. Recently, there have been novel techniques pro- copy of the volume.
posed for watermarking 3D models such as arbitrary trian-
gle meshes [ I , 10, 81. NURBS curves and surfaces [9] and Forgery. A number of authorized recipients of the same vol-
volume data [SI. In [SI,a watermarking method is proposed ume data should not be able to collude and form a copy of
based on the wavelet transform. With the same goal but dif- watermarked volume with the valid embedded watermark of
ferent transform and methodology, the method proposed in a person not in the group.
this paper is more robust against common attacks.
In this paper. we propose a novel watermarking algo- It must be noted that if a particularly strong attack man-
rithm for 3D volume data based on the spread-spectrum ages to retnove the watermark from the volume data, thcn
communication technique which is invisible and robust. the quality of its 2D volume rendered images should be suf-
“Invisible” means that the 2D rendercd image of this water- ficiently degraded so as to make this tampered data useless.
marked volume is perceptually indistinguishable from that
of the original volume. “Robust” watermarking implies that 2. The Volume Watermarking Technique
the watermark is resistant to most intentional or uninten-
tional attacks. We have implemented the algorithm and con- Watermarking a volume data is essentially the process
ducted experiments, showing that the watermark is invisi-
of altering the voxel values in a manner to ensure that a
ble in the volume rendered 2D images. This is further con-
viewer of its volume-rendered image does not notice any
firmed by computing the Signal-to-Noise Ratio (SNR) and
percephlal change between the original volume rendering
the Peak-Signal-to-Noise Ratio (PSNR) of the 3D water-
and the watermarked volume rendering. We utilize the
marked volume data. We addressed different attacks listed
spread-spectrum technique 131 in the frequency domain in
as follows and put more emphasis on the first six attacks
order to achieve this effect. The purpose of utilizing the fre-
since they are more commonly performed by attackers. The
quency domain is to make the watermark robust by hiding it
experiments show that the watermarking scheme is robust.
in multiple frequencies. Assume that volume V that needs
Geometrical distortions. Typical geometrical distortions in- to be watermarked is of the size nz x ny x nz.The bayic
clude affine transformations (rotation by a constant angle, scheme of our watermarking technique is outlined below:

359
0-7695-1007-8/01 $10.000 2001 IEEE
1. A 4 x 4 x 4 block-based 3D discrete cosine transform 5. The 3D inverse DCT is performed on VACTto obtain
(DCT) transform [ 111 is applied to the volume V. The a n, x ny x nz size volume V'. The inverse 3D DCT
4 x 4 x 4 3D DCT is computed using: is done using:
f(2,Y, 2) =
F ( u ,21, w) =
~ 3 3 3
3 3 3

+ +
(22 1)un (2y 1)vncos (22 -t 1)wn cos
+ cos
+
(22 1)ux (2y 1)vncos (22 1)wn +
cos
8
cos
8 8
8 8 8 I*
This new volume V' is the watermarked volume data
where corresponding to the original volume data V.
For any given set of volume rendering parameters, the 2D
image produced by volume rendering on V' will be percep-
tually indistinguishable from the 2D image produced using
V. Since a pseudo-noise sequence is used for modulation,
[ 1, otherwise. the watermark sequence is also noise-like which ensures
that the watermark is difficult to detect, locate and manipu-
Note that in our case f(z,y,z)corresponds to the late without compromising on the quality of the correspond-
voxel values and F ( U , V , W )corresponds to the 3D ing volume-rendered images.
DCT coefficients. The 4 x 4 x 4 block-size has been
chosen as a trade-off between the computational com-
plexity of the transformation and the availability of 3. Watermark Detection
sufficient frequencies to hide the watermark.
For detecting the existence of the watermark, the DCT-
2. To embed the watermark information bits aj E transformed original volume data V is subtracted from the
(1, -1) the bits are first spread by a large spread factor DCT-transformed watermarked volume data V' (we use 3'
cr ,called the chiprate [3]. For spreading the informa- instead of V' because it may have been subjected to at-
tion, the bit pattern is repeated in a raster-scan order tacks') to obtain the residual volume data DCT coefficients,
to tile the entire volume of size n, x ny x nz. This i.e. V T = e' - V. The 3D inverse DCT is performed
improves its robustness to geometrical attacks such as on this residual data V T to obtain the residual watermark
cropping. The spreading provides spatial redundancy sequence tii. This tii is then analyzed by correlating it
by embedding the information bits into CT number of with the same pseudo-noise sequence that was used in the
voxels: embedding phase where correlation can be understood as
demodulation followed by summation over the correlation
bi = a j V i = j x K (1)
window. The correlation window for each bit is the chiprate.
and K varies from 1 to cr. The spread bits bi are If the peak of correlation is positive, the corresponding wa-
then modulated with a pseudo-random-noise (PN) se- termark bit is +1 else it is -1. Considering one subset of
quence. the watennark values zi3i over the correlation window where
pi where p i E {-1,1}. (2) iE l...CT
CT CT

This forms the basic watermark sequence. (3)

i=l i=l
3. The modulated signal, i. e. the watermark sequence wi
where wi = bi . p i , forms a volume W of size n, x ny x where A being the error term which can be due to inten-
n,. This watermark volume W is also transformed into
tional or unintentional attacks. But by choosing a large CT
we have adequate redundancy and the summation can be
the frequency domain by using a 4 x 4 x 4 block-based
3D DCT transform. approximated as :
CT

4. For every DCT block b y E V and the corresponding (4)

DCT block by E W , the corresponding coefficients i=l

are added to form a watermarked block by' = b y +by The required information bit Lj (i.e. the detected watermark
which constitute the watermarked volume VACTin the bit) is
frequency domain. a, = sign&). (5)

360
Thus, to retrieve the watermark, the original volume data
and the same unshifted pseudo-noise sequence that was
used at the embedder are required.

4. Test Results

In order to verify the robustness and invisible property of

the algorithm proposed, we used a skull dataset (68 x 64 x
64) and a larger tomato dataset (64 x 208 x 216) to conduct
tests (Fig. 1). (a) the original (b) the watermarked

(a) The skull dataset (b) The tomato dataset

(c) the original (d) the watermarked
Figure 1. Two datasets used in algorithm eval-
uation (rendered by VolView). Figure 2. Comparison of volume-rendered im-
ages of the skull dataset before and after wa-
termark embedding (rendered by PKVox).

After examining the watermarked volume after volume

rendering. we found that the resultant watermarked volume
of the algorithm above is indeed perceptually indistinguish- the test of Table 2 using a 2D image of ”NUS” logo as the
able from the original (Fig. 2). watermark. The Fig. 3 shows the retrieved watermarks (2D
In order to examine the relationship between the robust- images) under the various noise levels.
ness of the embedded watermark, we conducted a series For Table 3 of the tomato dataset, watermark length 1 =
of experiments using the same watermark signal sequence 4000bits and the Chiprate cr = 719. Note that for digital
with different attacking strengths. The distortion caused by images, noise with the PSNR higher than 3 5 d B is hardly
the attacks is measured in terms of SNR (Signal-to-Noise noticeable in general. A noise signal sequence with SNR
Ratio) and PSNR (Peak-Signal-to-NoiseRatio): less than 2 0 d B is considered strong.

5. Conclusion

We have proposed a technique for three-dimensional vol-

ume data watermarking. A software package is imple-
mented. We have also conducted tests and the results show
that our method is robust.
where vi and vi are the ith-voxel values of the original
and watermarked volume data respectively. References
First, we conducted the cropping attacks. Experiment
results of robustness on volume cropping is shown in Table [ 11 0. Benedens. Geometry-based Watermarking of 3D Models.
1 for the skull dataset. Watermark length 1 = 1840 bits and IEEE Computer Graphics & Applications. Vol. 19, No. 1,46-
the Chiprate cr = 53. 55, JanuaryPebruary 1999.
We conducted tests of adding Gaussian noise. The at- [ 2 ] L. Boney, A. H. Tewfik, K. Hamdy. Digital Watermarks for
tacks of resizing (with re-sampling), quantization and re- Audio Signals. Proceedings of 1996 IEEE International Con-
quantization, etc. can be modeled by signal noise addition. ference on Multimedia Computing and Systems (ICMCS ’96).
We are still trying to precisely model these attacks. We did Hiroshima Japan, 473-480, July 1996.

361
 Remaining SNR PSNR Emr
(a) The original logo
size (%) (dB) (dB) rate (%)
100.00 3 1.888 49.462 0.00
60 x 60 x 60 82.40 7.763 25.337 0.00
56 x 56 x 56 66.99 3.977 21.551 0.00
52 x 52 x 52 52.64 2.351 19.925 0.05
44 x 44 x 44 32.50 1.099 18.672 6.58
17.80 0.161 17.735 33.7

Table 1. Experiment results of robustness on

(0 15dB (g) lodB
volume cropping. Figure 3. Retrieved watermarks shown as im-
ages under different SNR values (dB) of Gaus-
sian noise.

Gaussian SNR PSNR Error I. J. Cox, J. Kilian, T. Leighton, and T. Shamoon. Secure
noise SNR (dB) rate (%) Spread-Spectrum Watermarking for Multimedia. IEEE Trans-
(dB) (db)
actions on Image Processing. Vol. 6, No. 12, 1673-1687, De-
35.0 30.1 47.9 0.00
cember 1997.
30.0 28.4 46.2 0.00
25.0 25.7 43.5 0.1 1 J. Dittman, M. Stabenan, R. Steinmetz. Robust MPEG Video
20.0 21.7 39.5 4.10 Watermarking Technologies. Proceedings of ACM MM '98.
15.0 17.2 35.0 16.0 Bristol, U.K., 71-80, September 1998.
10.0 12.4 30.2 30.0
X. Guan, Y. Wu, M. S. Kankanhalli, Z . Huang. Invisible Wa-
termarking of Volume Data Using Wavelet Transform. Pro-
ceedings of MMM '2000. Nagano, Japan, 152 - 166, Nov
Table 2. The skull dataset: experiment results
7000.
of robustness on adding Gaussian noise.
E Hartung, M. Kutter. Multimedia Watermarking Techniques.
Proceedings of the IEEE. Vol. 87, No. 7, 1079-1 107, July
1999.

M. S. Kankanhalli, Rajmohan, K. R. Ramakrishnan. Content-

based Watermarking of Images. Proceedings of ACM MM
Gaussian I SNR I PSNR Error '98. Bristol, U.K., 61-70, September, 1998.
noise S N R (dB) rate (%) R. Ohbuchi, H. Masuda, and M. Aono. Watermarking three-
35.0 0.00 dimensional polygonal models through geometric and topo-
30.0 24.1 43.1 0.00 logical modifications. IEEE Journal on Selected Areas in
25.0 22.5 41.5 0.00 Communications. 16( 14):55 1-560, May 1998.
20.0 19.5 38.5 0.00
R. Ohbuchi, H. Masuda, and M. Aono. A shape-preserving
15.0 15.4 34.4 0.55
data embedding algorithm for NURBS curves and surfaces.
10.0 10.7 29.7 9.10 Proceedings of CGI '99. 18&187. IEEE Computer Society,
5.0 5.93 24.9 24.0 1999.

[lo] E. Praun, H. Hoppe, A. Finkelstein. Robust Mesh Water-

Table 3. The tomato dataset: experiment re- marking. Computer Graphics ACM SIGGRAPH '99 Pmceed-
sults of robustness against adding Gaussian ings. 69-76, September 1999.
noise.
[ 111 K. Rao, R. Yip. Discrete Cosine Transform: algorithms, ad-
vantages, applications. Academic Press Inc. 1990.

362