Analysis of digital watermarks subjected to optimum linear filtering and additive noise

s: English and German provided Tables: None Figures: 15 Galley proofs: Please send galley proofs to J. K. Su at the MIT Lincoln Laboratory address given above. Telephone: +1-781-981-4188, fax: +1-781-981-7271, email: [email protected]. Abstract Using a theoretical approach based on random processes, signal processing, and information theory, we study the performance of digital watermarks subjected to an attack consisting of linear shift-invariant filtering and additive colored Gaussian noise. Watermarking is viewed as communication over a hostile channel, where the attack takes place. The attacker attempts to minimize the channel capacity under a constraint on the attack distortion (distortion of the attacked signal), and the owner attempts to maximize the capacity under a constraint on the embedding distortion (distortion of the watermarked signal). The distortion measure is frequency-weighted mean-squared error (MSE). In a conventional additive-noise channel, communication is most difficult when the noise is white and Gaussian, so we first investigate an effective white-noise attack based on this principle. We then consider the problem of resisting this attack and show that capacity is maximized when a power-spectrum condition (PSC) is fulfilled. The PSC states that the power spectrum of the watermark should be directly proportional to that of the original signal. However, unlike a conventional channel, the hostile attack channel adapts to the watermark, not vice versa. Hence, the effective white-noise attack is suboptimal. We derive the optimum attack, which minimizes the channel capacity for a given attack distortion. The attack can be roughly characterized by a rule-of-thumb: At low attack distortions, it adds noise, and at high attack distortions, it discards frequency components. Against the optimum attack, the PSC does not maximize capacity at all attack distortions. Also, there is no unique watermark power spectrum that maximizes capacity over the entire range of attack distortions. To find the watermark power spectrum that maximizes capacity against the optimum attack, we apply iterative numerical methods, which alternately adjust the watermark power spectrum and re-optimize the parameters of the optimum attack. Experiments using ordinary MSE distortion lead to a rule-of-thumb: White watermarks perform nearly optimally at low attack distortions, while PSC-compliant watermarks perform nearly optimally at high attack distortions. The effect of interference from the original signal in suboptimal blind watermarking schemes is also considered; experiments examine its influence on the optimized watermark power spectra and the potential increase in capacity when it can be partially suppressed. Additional experiments demonstrate the importance of memory, and compare the optimum attack with suboptimal attack models. Finally, the rule-of-thumb for the defense is extended to the case of frequency-weighted MSE as a distortion measure.