Proceedings Chapter
Reference
Watermark copy attack
KUTTER, Martin, VOLOSHYNOVSKYY, Svyatoslav, HERRIGEL, Alexander
Abstract
Research in digital watermarking has progressed along two paths. While new watermarking technologies are being developed, some researchers are also investigating di erent ways of attacking digital watermarks. Common attacks to watermarks usually aim to destroy theembedded watermark or to impair its detection. In this paper we propose a conceptually new attack for digitally watermarked images. The proposed attack doesnot destroy anembedded watermark, but copies it from one image to a di erent image. Although this new attack does not destroy awatermark or impair its detection, it creates new challenges, especially when watermarks are used for copyright protection and identi cation. The process of copying the watermark requires neither algorithmic knowledge of the watermarking technology nor the watermarking key. The attack is based on an estimation of the embedded watermark in the spatial domain through a ltering process. The estimate of the watermark is then adapted and inserted into the target image. To illustrate the performance of the proposed attack we applied it to commercial and non-commercial watermarking schemes. [...]
KUTTER, Martin, VOLOSHYNOVSKYY, Svyatoslav, HERRIGEL, Alexander. Watermark copy attack. In: Ping Wah Wong and Edward J. Delp. IS\&T/SPIE's 12th Annual Symposium, Electronic Imaging 2000: Security and Watermarking of Multimedia Content II . 2000.
Available at:
http://archive-ouverte.unige.ch/unige:47812
Disclaimer: layout of this document may differ from the published version.
The Watermark Copy Attack
Martin Kutter a
and Sviatoslav Voloshynovskiy a,b
and AlexanderHerrigel a
a
Digital Copyright Technologies, Stauacher Strasse 149, 8004 Zurich,Switzerland
b
CUI-University of Geneva, 1211Geneva,Switzerland
Securityand Watermarkingof MultimediaContent II,
Vol. 3971,January2000,
SanJose,CA,USA.
ABSTRACT
Researchin digitalwatermarkinghas progressedalong twopaths. Whilenewwatermarkingtechnologiesare being
developed,someresearchersarealso investigating dierentwaysofattackingdigitalwatermarks. Commonattacks
towatermarksusuallyaimtodestroytheembeddedwatermarkortoimpairitsdetection. Inthispaperwepropose
aconceptually new attackfor digitally watermarked images. The proposed attackdoesnotdestroy anembedded
watermark,butcopiesitfromoneimagetoadierentimage. Althoughthisnewattackdoesnotdestroyawatermark
orimpair itsdetection,itcreatesnewchallenges,especiallywhenwatermarksareusedforcopyrightprotectionand
identication. Theprocessof copyingthe watermark requires neither algorithmicknowledge of thewatermarking
technology nor the watermarking key. The attack is based on an estimation of the embedded watermark in the
spatial domain through a lteringprocess. The estimate of thewatermarkis then adapted and inserted into the
targetimage. Toillustratetheperformanceoftheproposedattackweappliedittocommercialandnon-commercial
watermarkingschemes. Theexperimentsshowedthattheattack isveryeectivein copyingawatermarkfromone
image to a dierent image. In addition, we havea closer look at application dependent implications of this new
attack.
Keywords: digitalwatermarking,attack,robustness
1. INTRODUCTION
About700yearsafter theinventionofthewellknownpaperwatermarksin Fabriano, 3
Italy,asimilar conceptwas
applied todigitalmedia, suchasimages, audioandvideo. Researcheortsin theeld ofdigitalwatermarkingare
increasing fastalloverthe world. Furthermore, people such ascontent providersand intellectual property owners
aremoreandmoreinneedforeÆcientsolutionstoprotect,track,andmonitordigitalmedia.
Sincethebeginningofthedigitalwatermarkingareathetechnologieshaveevolvedinanimpressiveway,resulting
inveryeÆcientcommercialsolutions. Furthermore,besidestheideaofhidinginformationindigitaldatainarobust
manner,theconceptoffragiledigitalwatermarksforthevericationofdataintegrityemerged. Foranintroduction
todigitalwatermarkingandanoverviewofdierenttechnologiesthereaderisreferredtoHartungandKutter.
3
Similartothepaperwatermarkindustry,theinventionofdigitalwatermarksnotonlytriggeredworldwideresearch
on digital watermarking technologies, but also ways of attacking, counterfeiting and falsifying digitalwatermarks
with the goalof makingillegal protorbypassinglaws. Theresearch on watermarkattacks hasthe positiveside
eect thatitencouragespeopledoingresearchondigitalwatermarkingtechnologiestodevelopnewmethodswhich
are resilient to the attacks. In this article we focus on attacks on robust digitalwatermarkingschemes. We will
introduceanewattack,calledthewatermarkcopyattack,whichhasanimportantimpactoncurrentoveralldigital
watermarkingsolutionsforavarietyofapplicationssuchascopyrightprotection,monitoringandtracking.
Before we have acloser look at the proposed attack, we givean overview in Section 2of current attacks. In
Section3wepresentthenewattackandthenoutlinetheconceptualpartsoftheattack,thatiswatermarkprediction
Furtherauthorinformation:
M.K.: E-mail:martin.kutter@kutter.ch
S.V.: E-mail:svolos@cui.unige.ch
A.H.:E-mail:alexander.herrigel@dct-ch.ch
Attacks on Digital Watermarking Systems
Geometrical Attacks Cryptographic Attacks
Global, local warping
Jittering
Collusion Averaging
Copy attack Denoising
Remodulation Lossy compression Quantization
Global, local transform.
Brute forth key search
Removal Attacks Protocol Attacks
Orcale
Watermark inversion
Figure1. Typesofattacksondigitalwatermarkingsystems.
inSection4,andcopyinsertioninSection5. TotesttheeÆcacyoftheattackweappliedittotwopubliclyavailable
watermarkingtools. Theresultsofthese attacksarepresentedin Section6. Beforedrawingthenalconclusions in
Section8wewilldiscussomeimplicationsoftheattackinSection 7.
2. ATTACKS ON WATERMARKING SYSTEMS
Acloserlookatmaliciousattacksonrobustdigitalwatermarkingschemesshowsthattherearemainlyfourinherently
dierentattackingconcepts: removalattacks,geometricalattacks,cryptographicattacks,andprotocol attacks. We
willnowbrieylookateachconcept. Inaddition,Figure2showsasummaryofthedierentattacks.
Removalattacksaimat completely removingawatermarkfrom thecoverdata. These approachesconsiderthe
inserted watermark as noise with a given statistic and try to estimate the original, non watermarked cover data
from the stego, that is watermarked, data. EÆcient removal attacks based on denoising have for example been
proposed byLangelaaret al.
8
Theyproposeto apply asequenceoperationsto thewatermarkedimage, including
median ltering,highpassltering,andnon-lineartruncation. Voloshynovskiyet al.
15
proposeaspatialwatermark
predictiontroughalteringprocessbasedonamaximumaposteriori(MAP)watermarkestimationwithfollowing
remodulationtocreatetheleastfavorablenoisedistribution forthewatermarkdetector.
In contrastto removalattacks,geometrical attacksintendnotto removetheembedded watermark,but distort
it through spatial or temporal alterations of the stego data. The attacks are usually such that the watermark
detectorloosessynchronizationwiththeembeddedinformation. Theresultisthefailureofthewatermarkdetection
process,andthisalthoughthewatermarkisstillinthedata. Firstattacksbasedongeometricalalterationshavebeen
proposedfordigitalimages. Heremainlytwoutilitiesaretomention,UnzignandStirmark. Unzign 13
introduceslocal
pixel jitteringandisveryeÆcientin attackingspatial domain watermarkingschemes. Stirmark 5,6
introduceslocal
geometricalbending in additionto aglobalgeometrical transformation. Fornaturalimagesthis attackintroduced
barely noticeableartifactsandat themomentofwritingthisarticlenoknownwatermarkingtechnology isresilient
toit.
Cryptographicattacksareverysimilartoattacksusedincryptographyandmaybeofdierentnature. Thereare
thebruteforthattackswhichaimatndingasecretthroughanexhaustivesearch. Sincemanywatermarkingschemes
usea secretkeyit is veryimportant touse keyswithasecure length. Another attackis theso called Oracle 10,2,1
attackwhichcanbeusedtocreateanon-watermarkedimagewhenawatermarkdetectordevice isavailable. Other
attacksin thisgrouparestatisticalaveraging,andcollusionattacks. Theformerdescribesanattackin whichmany
instancesofagivendataset,eachtimesignedwithadierentkeyordierentwatermark,areaveragedtocompute
theattackeddata. Ifthenumberofdatasetsislargeenough,theembeddedwatermarkmaynobedetectedanymore.
Inthe collusionattack,again manyinstance of thesamedata areavailable,but this timethe attackeddata set is
generatebytackingonlyasmallpartofeachdataset andrebuildingannewattackeddatasetfrom theseparts.
Theattacksin thelastgroup,theprotocol attacks,doneitheraimat destroyingtheembeddedinformationnor
disable the detection of the embedded information through local or global data manipulation. The goalof these
Watermark
Prediction Adaptation
Attacked Image Stego Image y
Target Image t
w w
t Counterfeit /
Figure2. Thebuildingblocksofthewatermarkcopyattack.
attacksistoattacktheconceptofthewatermarkingapplication. Therstprotocolattackwas proposed byCraver
et al.
16
They introduced the concept of invertiblewatermarksand showedthat for copyright protectionpurpose
watermarksneedto be non-invertible. This requirementonthewatermarkingtechnology meansthatit shouldnot
bepossibletoextractawatermarkfrom anon-watermarkedimage.
Althoughthepresentedclassicationallowsforaclearseparationbetweenthe attacks,it should be notedthat
veryoften amaliciousattackerappliesnotonly onesingleattackat themoment,but rather acombinationof two
ormoreattacks.
Thewatermarkcopyattackproposedin thisarticlebelongsto thelastgroup,theprotocol attacks. Thegoalof
theattackitto copyawatermarkfromstego datato thetargetdata withouthavinganyspecic knowledgeabout
thewatermarkingtechnology. AswewillseeinSection7,dependingontheapplicationofthedigitalwatermarking
technology,thisattackmayhaveveryseriousimplications.
3. THE WATERMARK COPY ATTACK
As mentionedabove,theideaof thewatermarkcopyattackbelong tothe groupofprotocolattacks, which means
thegoal of theattack isnot to destroythe embedded watermark, but jeopardize theapplication for whichdigital
watermarksareused. Thebasicideaoftheattackistocopyawatermarkfromoneimagetoanotherimage,andthis
withoutanpriorinformationaboutthewatermarkingtechnologyandadditionalinformationsuchasthesecretkey.
Figure2showsthefunctionalblocksoftheattack. Theinputstothesystemarethestegoimage,whichcontains
thewatermarkto becopied,andthetarget image,into which thewatermarkformthestego imageisto becopied.
From atechnical pointof viewtheattackconsist ofthree main steps. Inthe rststepthewatermarkinthe stego
image is predicted, resultingin w.^ Theprediction is then processed in the nextstep. The goalof this processing
is to adapt the watermarkto the target image in order to maximizeits energy under the constraintof keepingit
imperceptibleafterinsertioninthetargetimage. Inthelaststep,thepredictedandprocessedimageisaddedtothe
targetimage.
4. WATERMARK PREDICTION
4.1. Introduction
Predicting the embedded watermark is the key operation in the watermark copy attack and to a large extend
inuences the eectiveness of the attack. Predictingthe embedded watermark canbeperformed in two ways: 1)
direct prediction,2)denoising. Inthiswork wefocusonwatermarkpredictionthroughdenoisingasitallowsus to
usethewelldevelopedapparatusofthedenoisingtheory.
Independentofthewatermarkingtechnology employed,wecanmodelthewatermarkingprocessasanaddition
ofawatermarkto thecoverimageinthespatialdomain:
y=x+w; (1)
whereyisthestegoimage,x theoriginal/coverimageandwthewatermark. Consideringthestegoimageasanoisy
image, then the watermarkis the noiseand wecan compute anestimate of thenoise/watermarkw^ bytaking the
dierencebetweentheestimatex^ofthecoverimageandthestegoimage:
^
w=y x:^ (2)
Estimator x w y
Figure3. Watermarkpredictionthroughdenoising.
Thisapproachofpredictingtheembeddedwatermarkthroughdenoisingisillustratedin Figure3.
Ifassumeto havenopriorinformationaboutthestatisticsof thestego imagewecanuseamaximumlikelihood
(ML)-estimate of the watermark. On the other hand, a Maximum a posteriori Probability (MAP) estimate can
be used if we assume to have prior information about the image statistics.
4
Depending on the statistics, closed
formsolutionsexist incertaincasesforbothapproaches. An overviewof thesolutionsforspecialcasesisshown in
Figure4.
4.2. ML-estimate
Ifweassumeto havenopriorinformationon thestatisticsoftheimage andprior informationaboutthestatistics
ofthenoise/watermark,wecanuseaML-estimator. Theestimatorisgivenby:
^
x=argmax
~ x2R
N flnp
w
( yj~x)g; (3)
wherep
w
(:)istheprobabilitydensityfunction ofthewatermark.
TheML-estimate hasaclosed form solutionfor the two caseswhen thewatermarkhaseither a Gaussian ora
Laplaciandistribution. IfthewatermarkhasaGaussiandistributiontheML-estimateisgivenbythelocalmeanof
y:
^
x=localmean(y); Gaussianwatermark: (4)
Onthotherhand,ifthewatermarkfeaturesaLaplaciandistributionthesolutionoftheML-estimateisgivenby
thelocalmedian:
^
x=localmedian(y); Laplacianwatermark: (5)
ComputingtheML-estimateofthecoverimagethereforereducesto computingthelocal meanorlocal median.
Todoso,severalapproachesexistsuchassimplycomputingtheaverageormedianinasquarewindow. However,if
weassumetoworkwithnaturalimagesthen wecancomputemoreaccurateestimatesofthelocalmeanormedian
byconsideringonlypixelinacross-shapedneighborhood. Thisisduetothefactthatnaturalimagesfeatureahigher
correlationinhorizontaland verticaldirection.
4.3. MAP-estimate
Ifweassumetohaveapriorinformationaboutthestatisticsofboththecoverimageandthewatermark/noise,then
wecanuseanMAP-estimator. TheMAP-estimatorisgivenby:
^
x=argmax
~ x2R
N flnp
w
( yj~x)+lnp
x
(~x ))g; (6)
wherep
x
(:)istheprobabilitydensityfunctionofthecoverimage.
It is not possible to nd a closed form solution for the MAP-estimate in all cases. We model the image as
stationary generalized Gaussian distribution and the watermark asGaussian. The generalizedGaussian model is
givenby:
p
x (x)=
()
2 ( 1
)
!N
2
1
jdetR
x j
1
2
expf ()(jx xj
2
) T
R
2
x
jx x j
2
g; (7)
(no prior on image) ML-estimate
Local Median Laplacian Watermark Local Mean Gaussian Watermark
MAP-estimate (with prior on image) Watermark Prediction
Wiener (Lee) Filter Gaussian Watermark Gaussian Image
Gaussian Watermark Laplacian Image Soft-Shrinkage
Gaussian Watermark Iterative RLS Solution Generalized G. Image
Figure4. Principles forwatermarkprediction.
where()= r
( 3
)
( 1
)
and (t)= R
1
0 e
u
u t 1
duisthegammafunction. R
x
isadiagonalautocovariancefunction of
dimensionN. ForthestationarymodeltheelementsofR
x
areequaland constant. iscalled theshapeparameter
of the generalized Gaussian distribution. For =2 the generalized Gaussian distribution reduces to the normal
Gaussiandistributionandfor( =1)itreducestotheLaplaciandistribution. Forrealimagestheshapeparameter
isintherange0:31.
Forourapproach,thatis GaussianwatermarkandstationarygeneralizedGaussiancoverimage,there existsno
closedformsolutionfortheMAP-estimateofthecoverimage. Therefore,weproposetoreformulateitasareweighted
leastsquares(RLS)problem,whichallowsustoderiveaniterativeoptimalsolution.
14
Thenequation(6)isreduced
tothefollowingminimization problem:
^ x
k +1
=arg min
~ x2R
N f
1
2 2
n ky x~
k
k 2
+w k +1
kr k
k 2
g; (8)
where
w k +1
= 1
r k
0
(r k
); (9)
r k
= x
k
x k
k
x
; (10)
0
(r)=[()]
r
jrj 2
; (11)
wherekisthenumberofiterations,andisagaintheshapeparameterofthegeneralizedGaussiandistribution. In
thiscase,thepenaltyfunction isquadraticforaxedweightingfunction w.
Assumingwisconstantforaparticulariterationstep,onecanwritethegeneralRLSsolutioninthenextform:
^ x=
w 2
n
w 2
n +
2
x x+
2
x
w 2
n +
2
x
y: (12)
ThissolutionissimilartotheclosedformWienerltersolution. ThesameRLSsolutioncouldalsoberewritten
intheformof Leelter 9
:
^ x=x+
2
x
w 2
n +
2
x
(y x ): (13)
The principal dierence with classical Wiener orLee lters is the presence of the weighting function w. This
weightingfunctiondependsontheunderlyingassumptionsaboutthestatisticsofthecoverimage. Intherestofthis
paper,wewillonlyconsidertheLeeversionofthesolutionwhichcoincideswiththeclassicalcaseofGaussianprior
(shapeparameter =2) ofthecoverimage(w =1). It isimportant tonote that theshrinkagesolutionof image
denoisingproblem previouslyused onlyin thewavelet domain caneasilybeobtainedfrom Equation8in thenext
closedform:
^
x=x+max(0;jy xj T)sign(y x); (14)
where T =
2
n
x p
2isthethreshold forpracticallyimportantcaseof Laplacianimageprior. This coincides withthe
soft-thresholdingsolutionoftheimagedenoisingproblem.
11
5. COPY INSERTION
The predicted watermark from the previous section could directly be added to the target image. However, this
solutionis notoptimal and would result in avariety ofartifact in the target image. Therefore, before adding the
predictedwatermarktothetargetimageweneedtoprocessit. Asmentionedabove,thegoaloftheprocessingisto
adaptthecopyofthewatermarktothetargetimagein ordertokeepitimperceptiblewhilemaximizingitsenergy.
Thisprocessisactuallythesameasinastandardwatermarkembeddingscheme. Therearemanywaystoadaptthe
watermarkto thetargetimage, such as methodsexploiting thecontrastsensitivityand maskingphenomenaofthe
HVS.
7,12
Inthis work wedecided toused thenoise visibilityfunction (NVF) proposedbyVoloshynovskiyet al.
14
Thenoisevisibilityfunction isdenedas:
NVF =
!
!+ 2
x
; (15)
where 2
x
thecoverimagevariance,and!isalocalweightingfunction denedby:
!=[()]
1
jrj 2
; (16)
wherer= x x
x
. isatuning parameterdened by:
= 100
2
max
(17)
ThereNVFcanbeusedfortwodierentmodels. Intherstmodel weassumeanon-stationaryGaussiancover
image. InthiscasetheNVF inEquation15reduces to:
NVF(i;j)= 1
1+ 2
x (i;j)
; (18)
where 2
x
(i;j)denotes thelocalvarianceoftheimage inawindowcenteredat thecoordinates(i;j). Inthesecond
model we assume a stationary generalized Gaussian coverimage. In this case, the NVF dened in Equation 15
reducesto:
NVF(i;j)=
!(i;j)
!(i;j)+ 2
x
; (19)
where!(i;j)isthelocalweightingfactor,and 2
x
isconstant. Forthewatermarkcopyattackwewillworkwiththe
non-stationaryGaussianmodel,andthereforeuseEquation18.
The NVF characterizesthe local texture of the image and varies between0 and 1, where it is 1for at areas
and 0for highly texturedareas. It canthereforebeused todescribethelocal texturemasking phenomenaforthe
watermark,thatisinareswithhighactivitythewatermarkstrengthmaybeincreasedduetothemaskingeect. In
additionto themaskingeect,wewill alsotakethecontrastsensitivityintoaccountand combineitwith thenoise
thresholdofnoiseisapproximatelyproportionaltothelocalluminance. Thenalweightisthengivenas:
W =((1 NVF)+NVF(1 ))lum; (20)
where =(0;:::;1) describes therelation between the watermarkstrength in textured areas and atareas, and
lumthelocalluminance. Ifweset =1,thewatermarkwill be concentratedontextured areas,thatis edgesand
corners. Iftheset=0,thewatermarkwillmainly beputintoatareas.
The fakewatermarkedimage isthen generatedby scalingtheweightingfunction W, multiplyingit bythesign
ofthepredictedwatermark,andthenaddingtheresulttothetargetimage:
~
t=t+Wsign(w);^ (21)
where is theoverallwatermarkstrength.
6. RESULTS
To test the proposed watermark copy attack we applied it to two publicly available watermarkingtools for still
images. WerefertothesetoolsassoftwareAand B.Thewatermarkingtechnologiesintheattackedtoolshavethe
followingproperties:
Software A:spatial domainspreadspectrumbasedwatermarkingwith afrequencytemplateforgeometrical
reference,64bitspayload.
Software B: spatialdomainspreadspectrumbasedwatermarkingschemewithweightingmaskbasedonthe
humanvisualsystem,64bitspayload.
Theattackwastestedonthetwograyscaleimageslenaandcameraman,bothofsize256256.Forthewatermark
predictionweused astandardadaptiveWienerlterwithawindowsizeof 55. Thetestswereasfollows. First,
wesignedthelena imageusing oneof thementionedwatermarkingtools. Thenwecopiedthewatermarkfromthe
watermarkedlena image to the cameraman imageand tried toextract thewatermarkform thecounterfeit image.
ThetoptwoimagesinFigure 6showthewatermarkedimagescorrespondingto thetwowatermarkingtoolsA)and
B).Thesecond rowof thesamegure showsthepredictedwatermarkfrom thestego images in thetoprow. It is
interesting to note the dierent characteristics for thepredicted watermarks. Thelast row of Figure 6showsthe
targetimagesafter insertingascaled versionofthesignofthepredictedwatermark.
Inbothcaseswewereabletoretrievethewatermarkformthecounterfeitimages. Wemadeadditionaltestwith
dierentimagesandsucceededeachtimetocopythewatermarkfrom theoriginalstegoimagetothetargetimage.
7. DISCUSSION
Independent of the application of the digitalwatermarking technology, the proposed attack puts in question the
link between the cover data and the embedded information. Let us consider one specic application of digital
watermarkingandlookat theweaknesscausedbytheproposed attack. Weconsiderthecasewherethewatermark
has an identication or authentication purpose in a passport picture. The idea of this application is to embed
informationabouttheownerof thepassport,such asthenameorsocialsecuritynumber,into theimage. Thegoal
ofthewatermarkistouniquelylinktheimagetothelegalownerofthepassport. Ifsomeonechangestheimageina
passport,thenewimagewouldnotcontaintherequiredwatermarkandhenceallowforthedetectionofthefalsied
document. However, if we can show that the watermarkingtechnology used to protect thepassport images does
notresistthewatermarkcopyattack,thenthewatermarkisuselessbecauseanyonecouldeasilyreplacetheoriginal
imagebyanewimageandcopytheoriginalwatermarktothenewimage.
Similarscenariosarepossibleifthewatermarkisusedforcopyrightprotectionordatamonitoring. Ifawatermark
doesnotresist thewatermarkcopyattack,then ausercannewerbesureifadetectedwatermarkreallybelongsto
thedataunderinspection. Asaresult,in manyapplicationstheuseofawatermarkwouldbeuseless.
(c)Predicted watermarkSoftwareA (d)Predicted watermarkSoftwareB
(e)CounterfeitimageSoftwareA (f)CounterfeitimageSoftwareA
Figure 5. Watermarkcopyattackappliedtotwowatermarkingtools.
Thewatermarkcopyattackis anew attackbelonging to thegroupofprotocolattacks. Theconcept oftheattack
consistsin copyingawatermarkfromastegoimagetoatargetimagewithoutusinganyspecicinformationabout
thewatermarkingtechnology. Theattackconsist of threemain steps. Intherststepwecomputeapredictionof
thewatermarkin the stego data. Insteadof directly predictingthe embedded watermark, weproposeto compute
the prediction through a denoising process. In other word, the watermark prediction is computed by taking the
dierencebetweenthestego image andadenoisedversionofthestego image. Toperform thedenoisingwelooked
at ML-estimatesandMAP-estimatesofthecoverimageand proposeclosed formanditerativesolutionsforspecial
casesofnoiseandcoverimagestatistics. Inthesecondstepthepredictedwatermarkisprocessed. Thegoalofthe
processingstepis to maximizetheenergyof thewatermarkunder theconstraintofimperceptibility. Toadapt the
watermarktothetargetimageweproposetouseanoisevisibilityfunction. Inthelaststeptheprocessedprediction
ofthewatermarkisaddedtargetimage.
Theeectiveness oftheattackwastestedbyapplyingitto twopubliclyavailablewatermarkingtools. Wehave
shown that forboth toolsit was possible to copy the watermarkfrom the stego image to the target image. This
newattackhasseveralimportantimplicationsdependingontheapplicationofdigitalwatermarking. Ifatechnology
doesnotresist tothecopyattack,ausermaynotbesureifadetectedwatermarkreally belongsto thedataunder
inspection. This is abig problem for may applications. Newwatermarkingtechnologiesshould therefore takethe
watermark copy attack into account during the technology design process. We are current working on optimized
versions of the attack for avariety of media. Furthermore, we are investigating solutionsto make watermarking
technologiesresilienttothewatermarkcopyattack.
REFERENCES
1. I.J.CoxandJ.-P.Linnartz. Somegeneralmethodsfortamperingwithwatermarks. IEEE JournalonSelected
Areasof Communications(JSAC),1997.
2. I.J. Cox,J.-P. Linnartz, andT. Shamoon. Publicwatermarksandresistanceto tampering. InProceedings of
the InternationalConference onImage Processing (ICIP),1997.
3. FrankHartungandMartin Kutter. Multimedia watermarkingtechniques. Proceedings IEEE:SpecialIssue on
IdenticationandProtection of MultimediaInformation,87(7):1079{1107,July1999.
4. CarlW.Helstrom. Probability andStochasticProcesses forEngineers. Macmillan,1991.
5. Markus G. Kuhn and Fabien A. P. Petitcolas. StirMark. <http://www.cl.cam.ac.uk/~fapp 2/wat erma rkin g/
stirmark/>,November1997.
6. M. Kutter and F. Petitcolas. A fair benchmark for image watermarking systems. In Ping Wah Wong and
EdwardJ.Delp,editors,Proceedings of theSPIE,SecurityandWatermarking ofMultimediaContents, volume
3657,pages226{239,SanJose,CA,USA,January1999.IS&T,TheSocietyforImagingScienceandTechnology
andSPIE,TheInternationalSocietyforOpticalEngineering,SPIE.
7. MartinKutter.DigitalImageWatermarking: HidingInformationinImages. PhDthesis,SwissFederalInstitute
ofTechnology,Lausanne,Switzerland,1999.
8. G. Langelaar, R. Lagendijk, and J. Biemond. Removing spatial spread spectrum watermarks by non-linear
ltering. InProceedings EUSIPCO98,volume4,pages2281{2284,1998.
9. JaeS. Lim. Two-DimensionalSignalandImage Processing. PrenticeHall,1990.
10. AdrianPerrig.Acopyrightprotectionenvironmentfordigitalimages.Diplomadissertation,
EcolePolytechnique
FederaledeLausanne,Lausanne,Switzerland,February1997.
11. P.MoulinandJ.Liu. Analysisofmultiresolutionimagedenoisingschemesusinggeneralized-gaussianpriors. In
Proc.IEEESig.Proc.Symp.onTime-FrequencyandTime-ScaleAnalysis,Pittsburgh,PA,USA,October1998.
12. ChristineI.Podilchukand WenjunZeng. Image-adaptivewatermarkingusingvisualmodels. IEEEJournalon
SelectedAreasof Communications(JSAC),16(4):525{539,May1998.
13. Unknown. UnZignwatermarkremovalsoftware. http://altern.org/watermark/,July1997.
14. SviatoslavVoloshynovskiy,AlexanderHerrigel, NazaninBaumgrtner,and ThierryPun. Astochastic approach
tocontentadaptivedigitalimagewatermarking.InProceedingofInternationalWorkshoponInformationhiding,
Dresden,Germany,September1999.
eralizedwatermarkingattackbasedonwatermarkestimation andperceptualremodulation. InProceedings of
SPIE:SecurityandWatermarking ofMultimediaContentII,SanJose,CA,USA,January2000.SPIE.
16. S. Craver N. Memon B.-L. Yeo and M. Yeung. Resolving rightful ownerships with invisible watermarking
techniques:limitations,attacks,andimplications. IEEEJournalonSelectedAreasinCommunications (Special
issueonCopyright andPrivacy Protection),16(4):573{586,May1998.
