1.

Introduction

Loukhaoukha and Chouinard¹ have recently proposed two countermeasures for the problem of false-positive detections^{2, 3} of watermarks that exists in Abdallah ⁴ and Aslantas⁵ singular value decomposition (SVD)-based watermarking schemes without making changes to the original algorithm of those schemes. They claimed that the countermeasures could be applied as an add-on to any SVD-based watermarking schemes that suffered from false-positive detections.

The first countermeasure uses a one-way hash function, such as MD5 or SHA-1 during the embedding process to compute digests of the SVD matrices [TeX:] \documentclass[12pt]{minimal}\begin{document}$U_{\rm W}$\end{document}$U_{\mathrm{W}}$ and [TeX:] \documentclass[12pt]{minimal}\begin{document}$V_{\rm W}$\end{document}$V_{\mathrm{W}}$ of the embedded watermark W. The digests or hash values of [TeX:] \documentclass[12pt]{minimal}\begin{document}$U_{\rm W}$\end{document}$U_{\mathrm{W}}$ and [TeX:] \documentclass[12pt]{minimal}\begin{document}$V_{\rm W}$\end{document}$V_{\mathrm{W}}$ (denoted as [TeX:] \documentclass[12pt]{minimal}\begin{document}$H_{U_{\rm W}}$\end{document}$H_{U_{\mathrm{W}}}$ and [TeX:] \documentclass[12pt]{minimal}\begin{document}$H_{V_{\rm W}}$\end{document}$H_{V_{\mathrm{W}}}$) are then kept by the owner so that he can use them in the extraction process if he wants to claim ownership. During the extraction process, the ownership claimant supplies the digests [TeX:] \documentclass[12pt]{minimal}\begin{document}$H_{U_{\rm W}}$\end{document}$H_{U_{\mathrm{W}}}$ and [TeX:] \documentclass[12pt]{minimal}\begin{document}$H_{V_{\rm W}}$\end{document}$H_{V_{\mathrm{W}}}$ of his own watermark and [TeX:] \documentclass[12pt]{minimal}\begin{document}$H_{U_{\rm W}}$\end{document}$H_{U_{\mathrm{W}}}$ and [TeX:] \documentclass[12pt]{minimal}\begin{document}$H_{V_{\rm W}}$\end{document}$H_{V_{\mathrm{W}}}$ are verified with the hash values of the received (and possibly altered by an attacker) matrices [TeX:] \documentclass[12pt]{minimal}\begin{document}${{\widetilde{U}}_{\rm W}}$\end{document}${\tilde{U}}_{\mathrm{W}}$ and [TeX:] \documentclass[12pt]{minimal}\begin{document}${{\widetilde{V}}_{\rm W}}$\end{document}${\tilde{V}}_{\mathrm{W}}$ (denoted as [TeX:] \documentclass[12pt]{minimal}\begin{document}$H_{{\widetilde{U}}_{\rm W}}$\end{document}$H_{{\tilde{U}}_{\mathrm{W}}}$ and [TeX:] \documentclass[12pt]{minimal}\begin{document}$H_{{\widetilde{V}}_{\rm W}}$\end{document}$H_{{\tilde{V}}_{\mathrm{W}}}$). If [TeX:] \documentclass[12pt]{minimal}\begin{document}$H_{U_{\rm W}}$\end{document}$H_{U_{\mathrm{W}}}$ ≠ [TeX:] \documentclass[12pt]{minimal}\begin{document}$H_{{\widetilde{U}}_{\rm W}}$\end{document}$H_{{\tilde{U}}_{\mathrm{W}}}$ or [TeX:] \documentclass[12pt]{minimal}\begin{document}$H_{V_{\rm W}}$\end{document}$H_{V_{\mathrm{W}}}$ ≠ [TeX:] \documentclass[12pt]{minimal}\begin{document}$H_{{\widetilde{V}}_{\rm W}}$\end{document}$H_{{\tilde{V}}_{\mathrm{W}}}$, then the extraction process halts; otherwise, the extraction process continues. In other words, they claimed that only the rightful owner was able to extract the embedded watermark W if [TeX:] \documentclass[12pt]{minimal}\begin{document}$H_{U_{\rm W}}$\end{document}$H_{U_{\mathrm{W}}}$ = [TeX:] \documentclass[12pt]{minimal}\begin{document}$H_{{\widetilde{U}}_{\rm W}}$\end{document}$H_{{\tilde{U}}_{\mathrm{W}}}$ ([TeX:] \documentclass[12pt]{minimal}\begin{document}$U_{\rm W}$\end{document}$U_{\mathrm{W}}$ = [TeX:] \documentclass[12pt]{minimal}\begin{document}${{\widetilde{U}}_{\rm W}}$\end{document}${\tilde{U}}_{\mathrm{W}}$) and [TeX:] \documentclass[12pt]{minimal}\begin{document}$H_{V_{\rm W}}$\end{document}$H_{V_{\mathrm{W}}}$ = [TeX:] \documentclass[12pt]{minimal}\begin{document}$H_{{\widetilde{V}}_{\rm W}}$\end{document}$H_{{\tilde{V}}_{\mathrm{W}}}$ ([TeX:] \documentclass[12pt]{minimal}\begin{document}$V_{\rm W}$\end{document}$V_{\mathrm{W}}$ = [TeX:] \documentclass[12pt]{minimal}\begin{document}${{\widetilde{V}}_{\rm W}}$\end{document}${\tilde{V}}_{\mathrm{W}}$).

The second countermeasure uses an image-encryption (respectively, decryption) method on the watermark W before the embedding process (respectively, after the extraction process). Before the embedding process, watermark W is encrypted to give [TeX:] \documentclass[12pt]{minimal}\begin{document}${W}_{\rm E}$\end{document}$W_{\mathrm{E}}$ and then [TeX:] \documentclass[12pt]{minimal}\begin{document}${W}_{\rm E}$\end{document}$W_{\mathrm{E}}$ is embedded in cover image I to obtain the watermarked image [TeX:] \documentclass[12pt]{minimal}\begin{document}$I_{\rm W}$\end{document}$I_{\mathrm{W}}$. In the extraction process, [TeX:] \documentclass[12pt]{minimal}\begin{document}$W_E^*$\end{document}$W_E^{*}$ is obtained from the possibly corrupted watermarked image [TeX:] \documentclass[12pt]{minimal}\begin{document}$I_W^*$\end{document}$I_W^{*}$ and decrypted to get the watermark [TeX:] \documentclass[12pt]{minimal}\begin{document}$W^*$\end{document}$W^{*}$, which is perceptually similar to the owner's watermark W. Loukhaoukha and Chouinard¹ claimed that a false-positive attack would result in the first extracted image be the attacker's watermark [TeX:] \documentclass[12pt]{minimal}\begin{document}${\widetilde{W}}$\end{document}$\tilde{W}$ because the attacker is using the matrices [TeX:] \documentclass[12pt]{minimal}\begin{document}${U_{\widetilde{{\rm W}}}}$\end{document}$U_{\tilde{\mathrm{W}}}$ and [TeX:] \documentclass[12pt]{minimal}\begin{document}${V_{\widetilde{{\rm W}}}}$\end{document}$V_{\tilde{\mathrm{W}}}$, instead of proper matrices [TeX:] \documentclass[12pt]{minimal}\begin{document}$U_{\rm W}$\end{document}$U_{\mathrm{W}}$ and [TeX:] \documentclass[12pt]{minimal}\begin{document}$V_{\rm W}$\end{document}$V_{\mathrm{W}}$. However, because the attacker has to feed the first extracted watermark (i.e., [TeX:] \documentclass[12pt]{minimal}\begin{document}${\widetilde{W}}$\end{document}$\tilde{W}$ to the decryption process), his final watermark will thus be an encrypted image, which does not help in his ownership claim.

In Sec. 2 we show that both countermeasures do not solve the false-positive detection in contrast to what is claimed by Loukhaoukha and Chouinard.¹

2.

Theorectical Analysis and Experiments

In the first countermeasure, the hash values of the watermark W’s SVD matrices [TeX:] \documentclass[12pt]{minimal}\begin{document}$U_{\rm W}$\end{document}$U_{\mathrm{W}}$ and [TeX:] \documentclass[12pt]{minimal}\begin{document}$V_{\rm W}$\end{document}$V_{\mathrm{W}}$ (denoted as [TeX:] \documentclass[12pt]{minimal}\begin{document}$H_{U_{\rm W}}$\end{document}$H_{U_{\mathrm{W}}}$ and [TeX:] \documentclass[12pt]{minimal}\begin{document}$H_{V_{\rm W}}$\end{document}$H_{V_{\mathrm{W}}}$) provided by the ownership claimant does not bind to the watermarked image [TeX:] \documentclass[12pt]{minimal}\begin{document}$I_{\rm W}$\end{document}$I_{\mathrm{W}}$. Because there is no proof showing that [TeX:] \documentclass[12pt]{minimal}\begin{document}$H_{U_{\rm W}}$\end{document}$H_{U_{\mathrm{W}}}$ and [TeX:] \documentclass[12pt]{minimal}\begin{document}$H_{V_{\rm W}}$\end{document}$H_{V_{\mathrm{W}}}$ belong to the rightful owner of the watermark W, therefore an attacker A, who repeats the same hashing process on the SVD matrices [TeX:] \documentclass[12pt]{minimal}\begin{document}$U_A$\end{document}$U_A$ and [TeX:] \documentclass[12pt]{minimal}\begin{document}$V_A$\end{document}$V_A$ of his own watermark [TeX:] \documentclass[12pt]{minimal}\begin{document}$W_A$\end{document}$W_A$ to obtain [TeX:] \documentclass[12pt]{minimal}\begin{document}$H_{U_A}$\end{document}$H_{U_A}$ and [TeX:] \documentclass[12pt]{minimal}\begin{document}$H_{V_A}$\end{document}$H_{V_A}$, can claim that the watermarked image [TeX:] \documentclass[12pt]{minimal}\begin{document}$I_{\rm W}$\end{document}$I_{\mathrm{W}}$ belongs to him because the extraction process will verify that [TeX:] \documentclass[12pt]{minimal}\begin{document}$H_{U_A}$\end{document}$H_{U_A}$ = [TeX:] \documentclass[12pt]{minimal}\begin{document}$H_{{\widetilde{U}}_{\rm W}}$\end{document}$H_{{\tilde{U}}_{\mathrm{W}}}$ ([TeX:] \documentclass[12pt]{minimal}\begin{document}$U_A$\end{document}$U_A$ = [TeX:] \documentclass[12pt]{minimal}\begin{document}${{\widetilde{U}}_{\rm W}}$\end{document}${\tilde{U}}_{\mathrm{W}}$) and [TeX:] \documentclass[12pt]{minimal}\begin{document}$H_{V_A}$\end{document}$H_{V_A}$ = [TeX:] \documentclass[12pt]{minimal}\begin{document}$H_{{\widetilde{V}}_{\rm W}}$\end{document}$H_{{\tilde{V}}_{\mathrm{W}}}$ ([TeX:] \documentclass[12pt]{minimal}\begin{document}$V_A$\end{document}$V_A$ = [TeX:] \documentclass[12pt]{minimal}\begin{document}${{\widetilde{V}}_{\rm W}}$\end{document}${\tilde{V}}_{\mathrm{W}}$).

An interesting fact is that since A attacks the scheme, he can provide his own kept [TeX:] \documentclass[12pt]{minimal}\begin{document}$H_{{\widetilde{U}}_{\rm W}}$\end{document}$H_{{\tilde{U}}_{\mathrm{W}}}$ and [TeX:] \documentclass[12pt]{minimal}\begin{document}$H_{{\widetilde{V}}_{\rm W}}$\end{document}$H_{{\tilde{V}}_{\mathrm{W}}}$ which are similar to [TeX:] \documentclass[12pt]{minimal}\begin{document}$H_{U_A}$\end{document}$H_{U_A}$ and [TeX:] \documentclass[12pt]{minimal}\begin{document}$H_{V_A}$\end{document}$H_{V_A}$ during the extraction process. The same case applies to the rightful owner, whereby in order to claim the watermarked image [TeX:] \documentclass[12pt]{minimal}\begin{document}$I_{\rm W}$\end{document}$I_{\mathrm{W}}$, he has to provide his own kept versions of [TeX:] \documentclass[12pt]{minimal}\begin{document}$H_{\widetilde{U}_{\rm W}}$\end{document}$H_{{\tilde{U}}_{\mathrm{W}}}$ and [TeX:] \documentclass[12pt]{minimal}\begin{document}$H_{\widetilde{V}_{\rm W}}$\end{document}$H_{{\tilde{V}}_{\mathrm{W}}}$ that are similar to [TeX:] \documentclass[12pt]{minimal}\begin{document}$H_{U_{\rm W}}$\end{document}$H_{U_{\mathrm{W}}}$ and [TeX:] \documentclass[12pt]{minimal}\begin{document}$H_{V_{\rm W}}$\end{document}$H_{V_{\mathrm{W}}}$ during the extraction process. Therefore, both have equal rights to the watermarked image [TeX:] \documentclass[12pt]{minimal}\begin{document}$I_{\rm W}$\end{document}$I_{\mathrm{W}}$ and no one can prove more than the other. The flaw occurs because the designers¹ view the countermeasure in the owner's perspective, ignoring the fact that the attacker can repeat the same steps as the owner.

In the second countermeasure, an encrypted watermark [TeX:] \documentclass[12pt]{minimal}\begin{document}$W_{\rm E}$\end{document}$W_{\mathrm{E}}$ is used in the embedding process. Hence, in the extraction process, after the encrypted watermark is extracted from the watermarked image [TeX:] \documentclass[12pt]{minimal}\begin{document}$I_{\rm W}$\end{document}$I_{\mathrm{W}}$, it has to be decrypted to obtain the watermark [TeX:] \documentclass[12pt]{minimal}\begin{document}$W^*$\end{document}$W^{*}$, which is perceptually similar to the original watermark W. The owner needs to keep the SVD’s [TeX:] \documentclass[12pt]{minimal}\begin{document}$U_{{\rm W}_{\rm E}}$\end{document}$U_{{\mathrm{W}}_{\mathrm{E}}}$ and [TeX:] \documentclass[12pt]{minimal}\begin{document}$V_{{\rm W}_{\rm E}}$\end{document}$V_{{\mathrm{W}}_{\mathrm{E}}}$ components of the encrypted watermark [TeX:] \documentclass[12pt]{minimal}\begin{document}$W_{\rm E}$\end{document}$W_{\mathrm{E}}$ so that he can supply the components later in the extraction process. If during the extraction process, an attacker A provides encrypted SVD matrices [TeX:] \documentclass[12pt]{minimal}\begin{document}$U_{\widetilde{W}_{\rm E}}$\end{document}$U_{{\tilde{W}}_{\mathrm{E}}}$ and [TeX:] \documentclass[12pt]{minimal}\begin{document}$V_{\widetilde{{\rm W}}_{\rm E}}$\end{document}$V_{{\tilde{\mathrm{W}}}_{\mathrm{E}}}$ of his own encrypted watermark [TeX:] \documentclass[12pt]{minimal}\begin{document}$\widetilde{W}_{\rm E}$\end{document}${\tilde{W}}_{\mathrm{E}}$, instead of proper matrices [TeX:] \documentclass[12pt]{minimal}\begin{document}$U_{\widetilde{{\rm W}}}$\end{document}$U_{\tilde{\mathrm{W}}}$ and [TeX:] \documentclass[12pt]{minimal}\begin{document}$V_{\widetilde{{\rm W}}}$\end{document}$V_{\tilde{\mathrm{W}}}$ as mentioned by the designers,¹ then he can still obtain his own encrypted watermark [TeX:] \documentclass[12pt]{minimal}\begin{document}$\widetilde{W}_E^*$\end{document}${\tilde{W}}_E^{*}$. The encrypted watermark [TeX:] \documentclass[12pt]{minimal}\begin{document}$\widetilde{W}_E^*$\end{document}${\tilde{W}}_E^{*}$ is later decrypted to obtain [TeX:] \documentclass[12pt]{minimal}\begin{document}$\widetilde{W}^*$\end{document}${\tilde{W}}^{*}$, which is perceptually similar to [TeX:] \documentclass[12pt]{minimal}\begin{document}$\widetilde{W}$\end{document}$\tilde{W}$. This countermeasure fails because the designers¹ did not notice that the attacker can simply repeat the same process as the owner in the proof-of-ownership game because they both claim ownership and the extraction process obtains the encrypted SVD matrices from the ownership claimant.

Figure 1 shows the cover image I, the owner's watermark W, the owner's encrypted watermark [TeX:] \documentclass[12pt]{minimal}\begin{document}$W_{\rm E}$\end{document}$W_{\mathrm{E}}$ and the watermarked image [TeX:] \documentclass[12pt]{minimal}\begin{document}$I_{\rm W}$\end{document}$I_{\mathrm{W}}$ after being embedded with [TeX:] \documentclass[12pt]{minimal}\begin{document}$W_{\rm E}$\end{document}$W_{\mathrm{E}}$. Figure 2 shows the attacker's watermark [TeX:] \documentclass[12pt]{minimal}\begin{document}$\widetilde{W}$\end{document}$\tilde{W}$, the encrypted watermark [TeX:] \documentclass[12pt]{minimal}\begin{document}$\widetilde{W}_{\rm E}$\end{document}${\tilde{W}}_{\mathrm{E}}$ of the attacker, the extracted encrypted watermark [TeX:] \documentclass[12pt]{minimal}\begin{document}$\widetilde{W}_E^*$\end{document}${\tilde{W}}_E^{*}$ from the watermarked image [TeX:] \documentclass[12pt]{minimal}\begin{document}$I_{\rm W}^*$\end{document}$I_{\mathrm{W}}^{*}$ using [TeX:] \documentclass[12pt]{minimal}\begin{document}$U_{\widetilde{{\rm W}}_{\rm E}}$\end{document}$U_{{\tilde{\mathrm{W}}}_{\mathrm{E}}}$ and [TeX:] \documentclass[12pt]{minimal}\begin{document}$V_{\widetilde{{\rm W}}_{\rm E}}$\end{document}$V_{{\tilde{\mathrm{W}}}_{\mathrm{E}}}$, and the final decrypted watermark [TeX:] \documentclass[12pt]{minimal}\begin{document}$\widetilde{W}^*$\end{document}${\tilde{W}}^{*}$. As can be seen from the experimental results, the final watermark [TeX:] \documentclass[12pt]{minimal}\begin{document}$\widetilde{W}^*$\end{document}${\tilde{W}}^{*}$ that is decrypted from [TeX:] \documentclass[12pt]{minimal}\begin{document}$\widetilde{W}_E^*$\end{document}${\tilde{W}}_E^{*}$, is perceptually similar to the attacker's watermark [TeX:] \documentclass[12pt]{minimal}\begin{document}$\widetilde{W}$\end{document}$\tilde{W}$ with the correlation coefficient value of 0.948.

Fig. 1

(a) Cover image, (b) owner's watermark (c) owner's encrypted watermark and (d) watermarked image.

Fig. 2

(a) Attacker's watermark, (b) attacker's encrypted watermark, (c) extracted encrypted watermark, and (d) Final decrypted watermark.

A possible countermeasure against false-positive detections would be to avoid^{6, 7} using the watermark's SVD matrices U and V in the embedding (and thus extraction) process of the Abdallah ⁴ and Aslantas⁵ schemes. This removes the influence of SVD matrices U and V on the watermark extraction process, which is the main problem causing false-positive detections.

3.

Conclusions

We have shown that Loukhaoukha and Chouinard¹ countermeasures are not able to solve the false-positive detection of the attacker's watermark and thus are not suitable for proof-of-ownership application. This is in contrast to the designers' (Ref. 1) claims that the countermeasures are explicitly designed to solve the problem. The shortfall is because the designers only viewed the countermeasures’ design from the owner's perspective, instead of also from the attacker's perspective as an ownership claimant. When designing the countermeasures as an add-on to the SVD-based watermarking scheme, the designers did not consider that the attacker can follow the same steps as the owner. This leads to the failure of the countermeasures to solve the false-positive detection problem.