Transcript talk
Robust Mesh Watermarking Emil Praun Hugues Hoppe Adam Finkelstein Princeton University Microsoft Research Princeton University Watermarking Applications • Authentication / localization of changes Fragile watermarks • Ownership protection Robust watermarks • Tracing of distribution channels Fingerprints Watermarking Applications • Authentication / localization of changes Fragile watermarks • Ownership protection Robust watermarks • Tracing of distribution channels Fingerprints Motivating Scenario 1. Alice creates a 3D shape, and publishes it on the web. 2. Bob sells it as his own. 3. How can Alice prove ownership? (and make Bob pay her a lot of money) Digital Watermarks Hidden in data! kept secret published original document insertion watermark “attack” ? detected watermark extraction suspect document Incidental Attacks • Filtering & smoothing • A/D & D/A conversions • Scaling • Rotation • Cropping Malicious Attacks • Adding noise • Adding another watermark • Resampling • Statistical analysis Our Goal Watermarking scheme for 3D models: • Robust against attacks • Works on arbitrary meshes • Preserves original connectivity • Imperceptible Previous Watermarking [Cox et al. ’97] Introduce spread-spectrum for images [Ohbuchi et al. ’98] 3 schemes fragile under resampling [Kanai et al. ’98] Requires subdivision connectivity meshes [Benedens ’99] Redistributes face normals by moving vertices Spread-Spectrum Watermarking Transform to frequency space [Cox et al. ’97] DCT image frequency domain Spread-Spectrum Salient features largest coefficients Perturb coefficients slightly to embed signal Image basis function DCT coefficient Our Approach Extend spread-spectrum method to meshes Problem: no DCT Solution: multiresolution representation Problem: no natural sampling Solution: registration & resampling Replacing DCT Basis Functions image mesh ? cosine basis Multiresolution frequency information Progressive mesh [Hoppe ’96] Multiresolution Neighborhoods vertex neighborhood corresponding mesh region Naturally correspond to important features Provide hints on allowable perturbation Scalar Basis Function amplitude displacement i i direction di radius Watermark Insertion Construct basis functions 1 … m Watermark Insertion Construct basis functions 1 … m Perturb each vertex: v j ' v j m d w i j i 1 basis function coefficient watermark direction watermark coefficient Matrix system: v' v Bw i i Watermark Extraction Get points v* on attacked mesh surface corresponding to original mesh vertices v Use same basis functions 1 … m and hence same matrix B Solve least-squares system for w*: B w (v v ) False-Positive Probability Correlation = < w*,w > Pfp computed from and m using Student’s t-test Declare watermark present if Pfp < Pthresh ( e.g. Pthresh = 10-6 ) Process (1) original mesh (2) watermarked (exaggerated) (3) suspect mesh (4) registered (5) resampled Registration & Resampling Registration: • [Chen & Medioni ’92] Resampling choices: • Closest point projection • Ray-casting along local normal • Global deformation of original Global Deformation Deform original mesh to fit suspect mesh Minimize: Suspect mesh + Inter-mesh distance ( vertex springs ) + Deformation ( edge springs ) + Penalty for flipped triangles Accurate, but slow Optimized mesh Results 10-7 watermarked mesh 1/2 faces 10-6 watermarked mesh noise 10-29 similarity 10-7 2nd watermark Results 0 10-13 watermarked mesh 1/8 faces 10-12 watermarked mesh smoothing cropped 10-2 all attacks Summary Robust watermarking for 3D meshes • Spread-spectrum • Basis functions from multiresolution analysis • Resampling as global optimization Resilient to a variety of attacks Future Work Consider other attacks: • General affine and projective transforms • Free-form deformations! [StirMark by Petitcolas] Explore other basis functions • e.g. [Guskov et al. ’99] Fast mesh recognition web crawler