MXPA99001089A - Method and arrangement for detecting a watermark - Google Patents

Abstract

Recently developed methods for copy protection rely on a watermark detector to judge whether multimedia content can be copied or not. In such copy protection schemes, a watermark detector examines the multimedia content and outputs a signal (D) indicating whether a watermark is present or not. Known watermark detectors determine a decision variable (y) indicating to which extent the watermark is present, for example, the amount of correlation between the input signal and a reference copy of the watermark to be detected. The watermark is detected if the decision variable exceeds a predetermined threshold (y2). Such a detector is vulnerable to an attack which is described in this patent application. Disclosed is a watermark detector which increases the work load for an attacker by several orders of magnitude. To this end, the detector generates a random output signal for a predetermined range of decision values (y) between the threshold (y2) and a further threshold (y1).

Description

METHOD AND ARRANGEMENT TO DETECT A WATER MARK FIELD OF THE INVENTION The invention relates to a method and an arrangement for detecting a watermark included in an information signal. The invention also relates to a method for removing a watermark from an information signal that has a watermark included.

BACKGROUND OF THE INVENTION Watermarks are perceptually invisible messages included in information signals such as a multi-media material, for example, audio, still images, animations or video. Watermarks can be used to identify the authorial property of the information. They allow a copyright owner to detect illegal copies of their material, inspecting if the watermark is present in such copies. Watermarks are included in an information signal by modifying samples of signal data (for example, audio samples of an audio signal, pixels of an image, transformation coefficients of a signal coded by transformation, etc.), so that the original is not affected in a perceptible way. Various methods for marking with watermarks are known in the art. By For example, the pixels of an original image are increased or decreased slightly according to the corresponding bits of a binary watermark pattern. To detect if an information signal has a watermark included, the signal is subjected to a statistical analysis. The statistical analysis produces a parameter, which is referred to hereinafter as a "decision variable", which indicates in what degree the watermark is present in the signal, for example, if an image signal is marked with a mark of water by increasing or decreasing its pixels according to a watermark pattern, the decision variable can be the amount of correlation between the signal and an applied reference copy of the watermark.If an image is marked with a mark of water by modifying selected pixels, a prediction is calculated for such pixels from temporal or spatially adjacent pixels.The decision variable can then be the number of pixels that are sufficiently different from its prediction. The previous technique generates a binary output signal that indicates that a "watermark was found" or "a watermark was not enclosed." This is achieved by comparing the decision variable with a predetermined threshold. If the value of the decision variable exceeds the threshold, the watermark is considered is present in the signal. In consumer products such as home recorders, the watermark detector will generally be implemented as a tamper-proof box, so that an attacker can not redesign the detection algorithm or its implementation parameters. It has been found, however, that an attacker may "nevertheless remove a watermark by observing the detector's binary output signal under various conditions of the input signal.

OBJECTIVES AND BRIEF DESCRIPTION OF THE INVENTION An object of the invention is to provide a method and arrangement for detecting a watermark, which is less vulnerable to attack. For this purpose, the method according to the invention is characterized by the step of randomly generating the output signal for decision values below such threshold. Preferably, the random output signal is generated for a range of decision values between the threshold and a further predetermined threshold. The invention was based on the recognition that the watermark detectors of the prior art exhibit a sharp transition between the decisions of 'the watermark was found' and 'no trademark was found.

"This property allows an attacker to iteratively modify an input signal and observe the output of the detector until it has found an input signal that causes the detector to operate in the vicinity of its threshold. transition, it is not difficult to generate an input signal that closely resembles the signal marked with a watermark, but which is not recognized as being marked with a watermark. By randomizing the transition point of the detector, the attacker obtains less (or at least less reliable) information from each modification of the signal. Additional advantageous embodiments of the invention are defined in the appended claims.

BRIEF DESCRIPTION OF THE DRAWINGS Figure 1 shows a prior art system comprising a device for including watermarks and a watermark detector. Figure 2 shows a watermark pattern to illustrate the operation of the system shown in Figure 1. Figure 3 shows waveforms illustrating the operation of the prior art watermark detector shown in Figure 1. Figure 4 shows a flow chart of operations to remove a watermark from an image marked with a watermark, using the watermark detector of the prior art, which is shown in Figure 1. Figure 5 shows waveforms illustrating an operation of the watermark detector according to the invention . Figures 6-8 show modalities of the watermark detectors according to the invention. Figure 9 shows the waveforms illustrating the operation of the watermark detectors shown in Figures 7 and 8. Figures 1 10-12 show modalities of the watermark detectors according to the invention.

DESCRIPTION OF THE MODALITIES The invention will now be described in relation to a watermark detector, in which, the decision variable indicating in what degree the watermark is present in the signal, is the amount of correlation between the signal which is being analyzed and a reference copy of the watermark to be detected. However, the description should not be construed as restricting the invention to such modality. Figure 1 shows a prior art system comprising a device for including trademarks of water 1 and a watermark detector 2. The device for including watermarks receives an original information signal p and a watermark signal w. It is assumed that the information signal p is a digitized image having luminance pixel values of 8 bits p (n). It is assumed that the watermark w is a specific binary pattern of values v? (N) = 1 or w (n) = -1. An example of such a watermark pattern is shown in Figure 2. The device for including watermarks comprises an addition step 10, which adds the values of the watermark w (n) to the spatially corresponding pixels. (n) of the input image. It should be appreciated that this does not affect the visual appearance of the image. The watermark included in this way is perceptually invisible. The information signal q is applied, after transmission or storage (not shown), to the watermark detector 2. The watermark detector 2 comprises a multiplication stage 21 and an adder circuit 22, which together they constitute a correlation circuit. The multiplication stage receives the information signal q and a reference copy of the watermark, the presence of which, will be detected in the signal q. The pixel values q (n) of the received image and the corresponding values (n) of the reference watermark are multiplied individually and then added together to obtain a decision variable y, which represents the amount of correlation between the input signal q and the watermark w »In mathematical notation: -V and - & B = l () where N is the total number of pixels. The correlation value y is applied to a comparator 23 to compare it with a threshold value ythr- As shown in Figure 3, the comparator produces a signal output D = 1, (a watermark was found) for y > ? th and an output D = 0 (no watermark was found) for y <yth. The pattern of the watermark w and the threshold value ythr / are carefully chosen, to prevent the detector from making a false decision too often. Now, a method for removing the watermark from an image marked with a watermark will be described using the prior art watermark detector, described above with reference to a flowchart of operations, which are shown in FIG. Figure 4. The attack applies to any watermark detector that has a sharp transition between the 'found a watermark' and 'no watermark found' decisions.

In a first step 11, a test image is created, which is close to the boundary of the watermark to be * removed. At this point, it does not matter if the resulting image looks like the original or not. The only criterion is that 5 small modifications of the test image cause the detector to respond with 'a watermark was found' or 'no watermark was found', with the probability that it is sufficiently different from zero or one . The test image can be created by manipulating improperly with an image marked with a watermark (for which y »yth) step by step, until the detector responds corf 'no watermark was found." One method is to gradually reduce the contrast in the image, enough to be "below the threshold where the detector reports the presence of the watermark. An alternative method is I replace more and more pixels in the image by neutral gray. There must be a point where the detector makes the transition from observing a watermark to responding that the image is free of a watermark. Otherwise, this step will eventually result in a uniformly colored gray image, and no reasonable watermark detector can say that such an image contains a watermark. Having thus found a suitable test image, a portion of the image is modified in a step 12, for example, a value of particular pixel, until the detector detects the watermark again. This provides an indication of how the device to include the watermark modifies the value of that pixel. Step 12 is repeated for each pixel in the image. It should be noted that instead of experiencing pixel by pixel, the attacker can also use another set of orthogonal modifications of the image, for example, increasing or decreasing the DCT coefficients of an image encoded by discrete cosine transformation. Knowing how sensitive the detector is to the modification of each pixel, a combination of pixel values is estimated, which has the greatest influence on the detector, in a step 13. Then, in a step 14, the estimate is subtracted of the original marked image. It may be necessary to subtract the estimate? Sometimes to make the detector report that a watermark is not present,? it is found experimentally, and is preferably as small as possible. The process described above results in a new image, which is not recognized as being marked with a watermark, but only contains a small distortion compared to the image marked with a watermark or compared to the unmarked image original. This attack works equally well if the brand of Water is included in the DCT domain. The process can be repeated if it is suspected that the algorithm for marking with a watermark contains non-linear elements, or that they depend on the image. Known simulation and search techniques, including simulated annealing, can be exploited in this iterative process. The watermark detector according to the invention is substantially less vulnerable to this attack. As illustrated in Figure 5, the detector randomizes the transition point from D = 0 (no watermark was found) to D = 1 (a watermark was found), if ^ the decision variable and has a value in a given interval ?? < and < y2. The slight modification of the signal applied while the detector operates in this interval (step 12 in Figure 4) now does not give reliable feedback to an attacker. Consequently, the watermark can no longer be estimated. The detector is less vulnerable to attacks, since the distance between the threshold levels yi and y2 is larger. Modes of a watermark detector having the properties desired by those skilled in the art can be easily designed. A simple example is shown in Figure 6. In this example, the multiplication step 21, the summing circuit 22 and the comparator 23 are the same as shown in Figure 1. The detector comprises an additional comparator 24, which compares the amount of correlation and with the lowest threshold value yl f and a pseudorandom binary sequence generator (PRBS) 25, which generates a random value R (0 or 1). A logic circuit comprising a gate Y 26 and a gate O 27, combines both outputs of the comparator and the random value R to obtain the output decision signal D, according to the following truth table: With the modality shown in Figure 6, the end point of the interval y =? 2, where the detector changes from producing D = 1 to producing D = R, can be found relatively easy by an attacker. Since the probability of producing D = 0 in the interval is 50%, the first time that D = 0 occurs, although it gradually affects an image marked with a watermark (step 11 in Figure 4), it is an indication reasonable to have found the final point. To alleviate this problem, one mode of the watermark detector_ is arranged to produce the output signal D in the interval Yi < and < zt with a increase (preferably uniform) of the probability when and is closer to the threshold y2. An embodiment of a watermark detector having such a function of increasing the probability is shown in Figure 7. The detector comprises an arithmetic circuit composed of a subtracter 28 and a multiplier 29, which modifies the decision variable and in a. z sign according to: t-l *? -? The signal z is applied to the comparator 23, which receives a random number r, having a value between 0 and 1, which is generated by a random number generator 30. As can be easily understood, the detector works exactly as the detector shown in Figure 6 for images having a correlation and > y2 y y < yi However, if the amount of correlation is between yi and y2 (ie, 0 <z <1), the output signal of comparator D depends on the real value of r, while the probability of producing D = 1 is Increase linearly according to: Figure 8 shows another embodiment of the watermark detector according to the invention. In this mode, a random number r 'is generated between 0 and y2- ?? by means of a random number generator 31 and added to the decision value and by means of an adder 32. The signal y + r 'is then compared to the threshold value y2. As we have tried to illustrate in Figure 9, the comparator always produces an output D = 0 for y < Yi and an output D = 1 for y > y2, while randomly producing 0 or 1 for yi < and < y2. Note that the probability that y + r 'is larger than y2 (resulting in D = 1), is very small for values of y just above yi, and very large for values of y just below y2. Consequently, this modality inherently has the property of showing a linear probability increase to produce D = 1 when and becomes larger. The linear probability curve is denoted as 91 in Figure 9. The inventors have found that the best form of the probability function in the interval yi < and < and 2 is (or substantially resembles) an increased cosine function: 2 y2 -y, Such a probability curve (denoted 92 in Figure 9) can be obtained by applying an appropriate mathematical function F to the output of the random number generator 31. In Figure 8, this function is executed by a conversion circuit 33 between the generator of random numbers 31 and the adder 32. The repeated application of the same input image to any of the previously described modes of the watermark detector, and therefore the content of the number of times the detector produces D = 0 or D = 1, shows an attacker at which point on the probability curve the detector operates. Figures 10 and 11 show additional improved watermark detectors, which do not suffer from this disadvantage. In these modes, the random generator is of the type that has a seeding input. The generator produces the same random number as long as it receives the same seed. The entrance of seeded, is derived from the input image, so that the watermark detector produces the same output signal D, as long as the same input image is applied. As a result of this, an attacker can not obtain statistical information about the point of operation of the detector on the probability curve by repeatedly applying the same image.

In the embodiment shown in Figure 10, the seed is derived from the input image by means of a circuit 34, which converts the received input image q to a number that has fewer bits. The function of the circuit 34 is usually referred to as the "parasitic" function The seed (for example, the sum of the N module of all the pixel values of the image) is then applied to the random generator 31. In the embodiment shown in the Figure 11, the correlation circuit (21, 22) acts as the parasitic function.The decision value and itself is now applied to the seed input of the random number generator 31. It should be noted that the characteristic of applying a seed to the Random generator can also be adopted for the modes shown in Figures 6 and 7. The difference between the watermark detector with and without the seeding feature can be best explained by way of example.Apply the same input image 100 times to a watermark detector that does not have the seeding characteristic, will cause the detector to produce, for example, 90 times an output D = 1 (a watermark was found) and 10 times an output D = 0 (n or a watermark was found). Applying the same input image 100 times to a watermark detector with the seeding characteristic, will cause the detector to produce 100 times the same output, the probability of D = 1 is 90% and the probability of D = 0 is 10%. In the latter case, an attacker can not obtain statistical information by repeating the watermark test for the same image over and over again. A watermark detector is particularly invulnerable to attacks if the characteristics described above "(uniform increase of the probability function, seed supply through parasitic function and supply of the seed by the decision variable itself) are Such a modality is shown in Figure 12. Randomization of the watermark detection point can also be obtained by randomly selecting the pixels considered to calculate the decision variable and (or, on the contrary, the pixels that were discarded). For this purpose, the randomly selected image pixels q (n) and the corresponding values of the watermark (n) are applied to the correlation circuit 21, 22, which is shown in Figure 1. For example, if 60% of the pixels of an image marked with a watermark are considered and the image is not modified by an attacker, the detector will still generate D = 1 despite the fact that The decision is less than when all the pixels are considered. However, if the pixels of the image are modified, the decision value may decrease, which results in D = 0 being generated, depending on how many pixels have been modified. The invention can be summarized as follows. Recently developed methods to protect against copying depend on a watermark detector to judge whether the content of multiple media can be copied or not. In such copy protection schemes, a watermark detector examines the content of multiple media and produces a signal (D) that indicates whether or not a watermark is present. Known watermark detectors determine a decision variable (y) that indicates in what degree the watermark is present, for example, the amount of correlation between the input signal and a reference copy of the watermark to be detected. The watermark is detected if the decision variable exceeds a predetermined threshold (y2). Such a detector is vulnerable to attack, which is described in this patent application. A watermark detector is described, which increases the workload of an attacker by several orders of magnitude. For this purpose, the detector generates a random output signal for a predetermined interval of decision values (y) between the threshold (y2) and an additional threshold (yi).

Claims (13)

CHAPTER CLAIMEDICATORÍO Having described the invention, it is considered as a novelty and, therefore, the content is claimed in the following:

1. A method for detecting a watermark () included in an information signal (q), comprising the steps of: determining a decision variable (y) that indicates in what degree the watermark is present in such a signal; and generating an output signal (D) indicating the detection of the watermark if the decision variable exceeds a predetermined threshold (y2); characterized by the step of randomly generating the output signal for decision values lower than the threshold (y2). The method according to claim 1, characterized by the step of randomly generating the output signal for a range of decision values between the threshold (y2) and an additional predetermined threshold.

(Vi) •

3. The method according to claim 1 or 2, characterized in that the random output signal is generated with an increase in the probability when the decision variable is closer to the predetermined threshold (y2) -

4. The method according to the claim 3, characterized in that the probability is a linear function of the decision variable within the interval between the threshold (y2) and an additional threshold (yi).

5. The method according to claim 3, characterized in that the probability is an increased cosine function of the decision variable within the interval between the threshold (? 2) and an additional threshold (Yi).

6. The method according to claim 1 or 2, characterized in that the step of randomly generating the output signal includes generating the same output signal as long as the same information signal is received.

7. An arrangement for detecting a watermark () included in an information signal (q), comprising: means for determining a decision variable (y) that indicates in what degree the watermark is present in said signal; and • means for generating an output signal (D) that indicates detection of the watermark if the decision variable exceeds a predetermined threshold (y2); characterized in that the array comprises means for randomly generating the output signal for decision values below the threshold (? 2).

8. The arrangement according to claim 7, characterized in that the array comprises means for randomly generating the output signal for a range of decision values between the threshold (y2) and an additional predetermined threshold (yi). The arrangement according to claim 7 or 8, characterized in that it comprises means for generating the random output signal with an increase in the probability when the decision variable is closer to the predetermined threshold (y2). The arrangement according to claim 9, characterized in that the means for randomly generating the output signal includes a random number generator with a seed input, and means for deriving the seed input from the information signal. , according to a predetermined function. The arrangement according to claim 9, characterized in that the means for determining the decision variable constitute the means for deriving the seed input. 12. A method for removing a watermark from an information signal having an included watermark, characterized in that it comprises the steps of: applying the information signal to a watermark detector that generates an indication of whether the information signal includes a watermark; modifying the selected portions of the information signal until the watermark detector reverses the indication, to obtain the respective portions of the estimated watermark causing the inversion; and subtract the estimated watermark from the information signal. 13. An apparatus for reproducing and / or recording multiple means, characterized in that it comprises an arrangement according to any of claims 7-11.