Generalized watermarking attack based on watermark ... - CVML

*HQHUDOL]HGZDWHUPDUNLQJDWWDFNEDVHGRQZDWHUPDUNHVWLPDWLRQDQGSHUFHSWXDOUHPRGXODWLRQUHPRGXODWLRQ69RORVK\QRYVNL\ DE 6 3HUHLUD D $ +HUULJHO E 1 %DXPJDUWQHU E 7 3XQ DD8QLYHUVLW\ RI *HQHYD 6ZLW]HUODQGE 'LJLWDO &RS\ULJKW 7HFKQRORJLHV =XULFK 6ZLW]HUODQG

2XWOLQH ,QWURGXFWLRQ :DWHUPDUNLQJ 3DUDGLJP :HDN 3RLQWV RI :DWHUPDUNLQJ $OJRULWKPV :DWHUPDUN $WWDFNV 5HVXOWV &RQFOXVLRQV

,QWURGXFWLRQ3UREOHP0DUNHW UHTXLUHV FRS\ULJKW SURWHFWLRQ WHFKQRORJ\IRU LPDJHV 03(* DQG DXGLR VLQFH FRS\LQJ LV HDV\ TXLFNDQG ZLWK WKH PRVW UHFHQW WHFKQRORJ\ ORVVOHVV HJ &'520ZULWLQJ3RVVLEOH 6ROXWLRQ LQVHUWLRQ RI D ZDWHUPDUN :0 ZKLFKFDQ EH XVHG WR DXWKHQWLFDWH DQ LPDJH DXGLR VRXQGWUDFN03(* HWF:DWHUPDUN FRQWDLQV IRU H[DPSOH XQLTXH LGHQWLILHUVSHFLI\LQJ EX\HU DQG VHOOHU PRVW XVHIXO DUH :0 ZKLFKKDYH DW OHDVW ELWV RI LQIRUPDWLRQ3

,QWURGXFWLRQz 5REXVWQHVV :0 PXVW UHVLVW PDLQ‡ JHRPHWULFDO DWWDFNV GHV\QFKURQL]DWLRQ HJ FURSSLQJDQG WUDQVODWLRQ DIILQH WUDQVIRUPDWLRQV OLNH URWDWLRQVFDOLQJ DVSHFW UDWLR FKDQJHV URZFROXPQ UHPRYDOUDQGRP ORFDO GLVWRUWLRQV‡ VLJQDO SURFHVVLQJ DWWDFNV QRQOLQHDU DQG DGDSWLYHILOWHULQJ FRPSUHVVLRQ UHTXDQWL]DWLRQ PXOWLSOHZDWHUPDUNV DQG QRLVH DGGLWLRQz:0 VKRXOG EH LQYLVLEOH DQG GHWHFWDEOH ZLWKRXW RULJLQDOLPDJH REOLYLRXV4

,QWURGXFWLRQ3UREOHPVz QR VWDQGDUG JHQHUDO SXUSRVH EHQFKPDUNz ODFN RI UREXVWQHVV WR DWWDFNV:K\ ZRUN RQ DWWDFNVz GHYHORS EHWWHU ZDWHUPDUNLQJ PHWKRGVz GHILQH EHWWHU EHQFKPDUNLQJ3LRQHHULQJ ZRUN 6WLUPDUN EHQFKPDUNLQJ 8Q]LJQ5

,QWURGXFWLRQ*RDOV RI ZDWHUPDUNLQJ DWWDFNV1RWDWLRQVxwyRULJLQDO FRYHU LPDJHQRLVHOLNH ZDWHUPDUNVWHJR LPDJH ZLWKy = x +w0DLQ JRDO RI ZDWHUPDUNLQJ DWWDFNV‡ SUHVHUYH LPDJH TXDOLW\y′≅x DWWDFNHG VWHJRLPDJH‡ UHQGHU ZDWHUPDUN XQGHWHFWDEOHXQGHFRGDEOH6

,QWURGXFWLRQ*RDOV RI ZDWHUPDUNLQJ DWWDFNV2XU JRDO LV WR XVH SULRU NQRZOHGJHz RI ZDWHUPDUN DQG FRYHULPDJH VWDWLVWLFVz RI ZDWHUPDUNLQJ PHWKRG XVHGWR GHYHORS JHQHUDOL]HG DWWDFN RQ ZDWHUPDUNLQJ VFKHPHVz WKDW WDNHV LQWR DFFRXQW KXPDQ SHUFHSWLRQz LV VWRFKDVWLF DSSOLFDEOH WR D ZLGH FODVV RI LPDJH DQGYLGHR ZDWHUPDUNLQJ DOJRULWKPV RSHUDWLQJ LQ FRRUGLQDWH RUWUDQVIRUP )7 '&7 ZDYHOHW GRPDLQV7

:DWHUPDUNLQJ3DUDGLJPCoverimagexMessagebPerceptualmodelEncodercMWatermarkEmbedderyAttacksy´WatermarkExtractorŵDecoderbˆKey8

:DWHUPDUNLQJ3DUDGLJP0HVVDJH HPEHGGLQJbz 0HVVDJH LV HQFRGHG XVLQJ HLWKHU 0DU\ PRGXODWLRQ RU(UURU &RUUHFWLRQ &RGHV (&&z 7KH HQFRGHG PHVVDJHLV VSUHDGHG RYHU WKH FRYHULPDJH EDVHG RQ DQ RUWKRJRQDO SURMHFWLRQ IXQFWLRQcpz 7KH VSUHDGHG PHVVDJH LV PDVNHG E\ D SHUFHSWXDO PDVNUHVXOWLQJ LQ QRLVHOLNH ZDWHUPDUNFRYHULPDJHwDQG DGGHG WR WKHM9

:DWHUPDUNLQJ3DUDGLJP0HVVDJH H[WUDFWLRQz :DWHUPDUN H[WUDFWLRQ LV EDVHG HLWKHU RQ 0D[LPXP/LNHOLKRRG 0/ RU 0D[LPXP D 3RVWHULRUL 0$3HVWLPDWRUV0/0$3wˆ=wˆ=arg maxw~∈Rw~∈RNarg maxNp X~( y′¦ w)p~Xp W~{ ( y′¦ w) ⋅ ( w)}Rw⇒ w ˆ =′R + Rˆwx( y′− y )p Xp W() .() .SGI RI WKH FRYHULPDJHSGI RI WKH ZDWHUPDUN10

:DWHUPDUNLQJ3DUDGLJP0HVVDJH H[WUDFWLRQz 0HVVDJH GHFRGLQJ LV EDVHG PRVWO\ RQ 0/ GHFRGHU'HVSUHDGLQJ SDUW LV GHVLJQHG EDVHG RQ 0/ GHWHFWLRQXQGHU DVVXPSWLRQ RI NQRZQ VLJQDO LQ DGGLWLYH*DXVVLDQ QRLVHr = wˆ, pWKH FHQWUDO OLPLW WKHRUHP &/7 DSSUR[LPDWLRQ IRU ODUJHVDPSOH VSDFHVr = Ac+ n0/ PHVVDJH GHFRGHU IRU DGGLWLYH ZKLWH *DXVVLDQ QRLVHb ˆ~= arg max p r ¦ b , x~b( )11

:DWHUPDUNLQJ3DUDGLJP0HVVDJH H[WUDFWLRQ(&& GHFRGHUŵ⊗p∑rHard orSoftDecoderbˆ0DUU\ GHPRGXODWRUŵ⊗1p k⊗∑∑1r kLr kMaxindexbˆLp k12

:HDN3RLQWVRI:DWHUPDUNLQJ$OJRULWKPVz ZDWHUPDUN SUHGLFWLRQ LV NH\LQGHSHQGHQWRww ˆ =′R + Rˆwx( y′− y )'HVWUR\ :0&RS\ :0z GHVSUHDGLQJ SDUW LV GHVLJQHG DV 0/ GHWHFWRU IRU $:*1FKDQQHOr = wˆ,z GHFRGHU LV GHVLJQHG LQ DVVXPSWLRQ RI $:*1pr = Ac+n2( 0, I )n ~ N σn13

:DWHUPDUN$WWDFNV7KH PDLQ DWWDFNV EDVHG RQ WKH ZHDNQHVVHV RIZDWHUPDUNLQJ DOJRULWKPVz GHFUHDVH WKH ZDWHUPDUN UHGXQGDQF\ XVLQJ ZDWHUPDUNUHPRYDO EDVHG RQ GHQRLVLQJFRPSUHVVLRQz FUHDWH WKH OHDVW IDYRUDEOH VWDWLVWLFV IRU WKH $:*1GHFRGHU XVLQJ SHUFHSWXDO UHPRGXODWLRQ RI WKH ZDWHUPDUN14

:DWHUPDUN$WWDFNV0DVNLQJ SURSHUW\ RI +XPDQ 9LVXDO 6\VWHP +96Stego imageMasking property of the HVSvisiblevisiblemasked15

:DWHUPDUN$WWDFNV7ZR VWDJH DWWDFNz 6WDJH ZDWHUPDUN HVWLPDWLRQ DQG UHPRYDO EDVHG RQGHQRLVLQJFRPSUHVVLRQz 6WDJH ZDWHUPDUN UHPRGXODWLRQ XVLQJ ZDWHUPDUNVWDWLVWLFV DQG SURSHUWLHV RI WKH +9616

:DWHUPDUN$WWDFNV%DVLF LGHDStego imageAttacked imageremodulatedSmooth17

:DWHUPDUN$WWDFNV6WDJH ZDWHUPDUN UHPRYDOy′ ≅ xˆ and w → 00$3 'HQRLVLQJ &RPSUHVVLRQ:LHQHU/HH ILOWHU6RIWVKULQNDJH+DUGVKULQNDJH&RPSOH[LW\UHJXODUL]DWLRQ0RXOLQ /LX6RIWVKULQNDJH ZLWK8QLIRUP 7KUHVKROG4XDQWL]DWLRQ 874&KDQJ

:DWHUPDUN$WWDFNV0$3 'HQRLVLQJxˆ=arg max~x∈RN{ ln p ( y ¦ x) + ln p ( x)}W~X~$VVXPSWLRQVw ~ i.i.d.N σ2( 0, wI )(2x,γ , σ I ) <strong>Generalized</strong> Gaussianx ~ i.i.d . GGx:xˆ=⎧ 1arg min⎨x~ N∈R ⎩2σ2wy−~x2+ ρ( res)⎫⎬⎭ρ(res)WKH HQHUJ\ IXQFWLRQ IRU WKH ** PRGHO19

:DWHUPDUN$WWDFNV0$3 'HQRLVLQJ LLG *DXVVLDQ ZDWHUPDUN2( 0, I )w ~ N σz :LHQHU/HH ILOWHU ORFDOO\ LLG *DXVVLDQ LPDJHxˆ=y+z 6RIWVKULQNDJH JOREDOO\ LLG VWDWLRQDU\ *HQHUDOL]HG2*DXVVLDQ V** LPDJH /DSODFLDQ γ = 1 ~ sGG( x,1,σ xI )( 0, y − y −T) ( y − y)x³³2w2x+³2x( y − y)xˆ= y + maxsignwz +DUGVKULQNDJH JOREDOO\ LLG V** LPDJH( y − y) 1( y − > T )xˆ = y +yγ → 020

:DWHUPDUN$WWDFNV6FDOLQJVKULQNLQJ GHQRLVLQJ IXQFWLRQV:LHQHU/HH6RIWVKULQNDJH +DUGVKULQNDJH( y − y)( y − y)( y − y)21

:DWHUPDUN$WWDFNV:DWHUPDUN UHPRYDO EDVHG RQ ORVV\ FRPSUHVVLRQNz &RPSOH[LW\ UHJXODUL]DWLRQ 0$3 x~∈Rxˆ{ ( y x~ Γln ¦ ) + ln ( x~)}= arg maxp~ x∈Γp W

:DWHUPDUN$WWDFNV:DWHUPDUN UHPRYDO EDVHG RQ ORVV\ FRPSUHVVLRQz 8QLIRUPO\ TXDQWL]HG VRIWVKULQNDJHQ-T T-T T∆23

:DWHUPDUN$WWDFNV6WDJH ZDWHUPDUN SHUFHSWXDO UHPRGXODWLRQ3DUWLFXODULWLHVz VWDJH NLOOV UHPRYHV ZDWHUPDUN PRVWO\ LQ IODWUHJLRQVz VWDJH FKDQJHV WKH VLJQ RI ZDWHUPDUN RQ RSSRVLWH DQGFUHDWHV RXWOLHUV PRVWO\ LQ WKH DULDV RI HGJHV DQGWH[WXUHV24

:DWHUPDUN$WWDFNV6WDJH ZDWHUPDUN SHUFHSWXDO UHPRGXODWLRQz HVWLPDWLRQ RI ZDWHUPDUNz HVWLPDWLRQ RI ZDWHUPDUN VLJQz SHUFHSWXDO UHPRGXODWLRQwˆ=y− xˆs = sign( wˆ)( 1−NVF ) ⋅{ S e + NVF ⋅ S } ⋅( − s) ⋅ py = xˆ+′′fNVF 1RLVH 9LVLELOLW\ )XQFWLRQS eS fNVF→ 0 VWUHQJWK IDFWRU IRU HGJH UHJLRQV NVF →1 VWUHQJWK IDFWRU IRU IODW UHJLRQV 25

5HVXOWV'LIIHUHQW WHFKQRORJLHV KDYH EHHQ LQYHVWLJDWHGz '&7z 'LJLPDUNz (LNRQDPDUNz 6\V&RS`7HVW FDVHV LPDJHV RI VL]H [6RIWZDUH$ &RRUGLQDWH GRPDLQ (&&WH[WXUH PDVNLQJ :0 ELWV% &RRUGLQDWH GRPDLQ 0DU\OXPLQDQFH PDVNLQJ :0 ELWV& '&7 GRPDLQ (&& -XVW 1RWLFHDEOH 'LIIHUHQFH :0 ELWV26

5HVXOWV&ULWHULD IRU HYDOXDWLRQ9LVLELOLW\ 9&DSDFLW\ & 5REXVWQHVV 5&DSDFLW\ & ELWV W\SLFDOO\ 5REXVWQHVV 5z ELW HUURU UDWHz ELQDU\ GHFLVLRQ :0 GHWHFWHGQRW GHWHFWHG9LVLELOLW\ 9z VXEMHFWLYH KXPDQ HYDOXDWLRQz +96EDVHG FRPSXWHU PRGHOz ZHLJKWHG 361527

5HVXOWV:HLJKWHG 3615wPSNR= 10log10x255− y22NVFZ3615 G% G% G%6WHJR LPDJH3615 G%7KH Z3615 LV FORVHU WR SHUFHSWLRQ WKDQ WKH 361528

5HVXOWV6RIWZDUH $6WHJR LPDJH3615 G%Z3615 G%:0 \[:0 \ [$WWDFNHG LPDJH3615 G%Z3615 G%0HVVDJH ZDWHUPDUN ZDV QRW IRXQG29

5HVXOWV6RIWZDUH %6WHJR LPDJH3615 G%Z3615 G%:0 \[:0 \ [$WWDFNHG LPDJH3615 G%Z3615 G%0HVVDJH ZDWHUPDUN ZDV QRW IRXQG30

5HVXOWV6RIWZDUH &6WHJR LPDJH3615 G%Z3615 G%:0 \[:0 \ [$WWDFNHG LPDJH3615 G%Z3615 G%0HVVDJH ZDWHUPDUN ZDV QRW IRXQG31

5HVXOWV$ % &:0\[:0\ [32

&RQFOXVLRQVz 3RVVLEOH WR UHPRYH ZDWHUPDUN ZKLOH SUHVHUYLQJ LPDJHTXDOLW\z :DWHUPDUNLQJ DWWDFNV VKRXOG XVH DV PXFK DV SRVVLEOHRI LPDJH DQG ZDWHUPDUN VWDWLVWLFVz :DWHUPDUNLQJ DOJRULWKP GHYHORSPHQW VKRXOG DVVXPHWKDW WKH DWWDFNHUV NQRZ \RXU PHWKRG .HUKRII·VSULQFLSOH9HU\ XVHIXO WR VWXG\ ZDWHUPDUN DWWDFNV IRU WKHGHYHORSPHQW RI WKH HQKDQFHG WHFKQRORJLHV DVVXPLQJWKH EDG JX\V DUH DOZD\V RQH VWHS DKHDG 33